ike: Use optional jitter to calculate retransmission timeouts

Also adds an optional limit to avoid very high retransmission timeouts
with high numbers of retries.

conf/options/charon.opt

@@ -311,6 +311,13 @@ charon.retransmit_timeout = 4.0
 charon.retransmit_tries = 5
 	Number of times to retransmit a packet before giving up.
 
+charon.retransmit_jitter = 0
+	Maximum jitter in percent to apply randomly to calculated retransmission
+	timeout (0 to disable).
+
+charon.retransmit_limit = 0
+	Upper limit in seconds for calculated retransmission timeout (0 to disable).
+
 charon.retry_initiate_interval = 0
 	Interval in seconds to use when retrying to initiate an IKE_SA (e.g. if DNS
 	resolution failed), 0 to disable retries.

conf/strongswan.conf.5.tail.in

@@ -408,6 +408,8 @@ using the three keys listed below:
 .BR charon.retransmit_base " [1.8]"
 .BR charon.retransmit_timeout " [4.0]"
 .BR charon.retransmit_tries " [5]"
+.BR charon.retransmit_jitter " [0]"
+.BR charon.retransmit_limit " [0]"
 .fi
 .RE
 .PP
@@ -419,7 +421,15 @@ The following algorithm is used to calculate the timeout:
 .PP
 Where
 .I n
-is the current retransmission count.
+is the current retransmission count. The calculated timeout can't exceed the
+configured retransmit_limit (if any), which is useful if the number of retries
+is high.
+.PP
+If a jitter in percent is configured, the timeout is modified as follows:
+.PP
+.EX
+	relative timeout -= random(0, retransmit_jitter * relative timeout)
+.EE
 .PP
 Using the default values, packets are retransmitted in: