Do not query CHILD_SA during delete if they already expired

src/libcharon/sa/ikev2/task_manager_v2.c

@@ -825,7 +825,7 @@ static status_t process_request(private_task_manager_t *this,
 							else
 							{
 								task = (task_t*)child_delete_create(this->ike_sa,
-																PROTO_NONE, 0);
+														PROTO_NONE, 0, FALSE);
 							}
 							break;
 						}
@@ -1308,9 +1308,11 @@ METHOD(task_manager_t, queue_child_rekey, void,
 }
 
 METHOD(task_manager_t, queue_child_delete, void,
-	private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi)
+	private_task_manager_t *this, protocol_id_t protocol, u_int32_t spi,
+	bool expired)
 {
-	queue_task(this, (task_t*)child_delete_create(this->ike_sa, protocol, spi));
+	queue_task(this, (task_t*)child_delete_create(this->ike_sa,
+												  protocol, spi, expired));
 }
 
 METHOD(task_manager_t, queue_dpd, void,

src/libcharon/sa/ikev2/tasks/child_delete.c

@@ -61,6 +61,11 @@ struct private_child_delete_t {
 	 */
 	bool rekeyed;
 
+	/**
+	 * CHILD_SA already expired?
+	 */
+	bool expired;
+
 	/**
 	 * CHILD_SAs which get deleted
 	 */
@@ -247,16 +252,29 @@ static void log_children(private_child_delete_t *this)
 	enumerator = this->child_sas->create_enumerator(this->child_sas);
 	while (enumerator->enumerate(enumerator, (void**)&child_sa))
 	{
-		child_sa->get_usestats(child_sa, TRUE, NULL, &bytes_in);
-		child_sa->get_usestats(child_sa, FALSE, NULL, &bytes_out);
+		if (this->expired)
+		{
+			DBG0(DBG_IKE, "closing expired CHILD_SA %s{%d} "
+				 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
+				 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
+				 ntohl(child_sa->get_spi(child_sa, TRUE)),
+				 ntohl(child_sa->get_spi(child_sa, FALSE)),
+				 child_sa->get_traffic_selectors(child_sa, TRUE),
+				 child_sa->get_traffic_selectors(child_sa, FALSE));
+		}
+		else
+		{
+			child_sa->get_usestats(child_sa, TRUE, NULL, &bytes_in);
+			child_sa->get_usestats(child_sa, FALSE, NULL, &bytes_out);
 
-		DBG0(DBG_IKE, "closing CHILD_SA %s{%d} "
-			 "with SPIs %.8x_i (%llu bytes) %.8x_o (%llu bytes) and TS %#R=== %#R",
-			 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
-			 ntohl(child_sa->get_spi(child_sa, TRUE)), bytes_in,
-			 ntohl(child_sa->get_spi(child_sa, FALSE)), bytes_out,
-			 child_sa->get_traffic_selectors(child_sa, TRUE),
-			 child_sa->get_traffic_selectors(child_sa, FALSE));
+			DBG0(DBG_IKE, "closing CHILD_SA %s{%d} with SPIs %.8x_i "
+				 "(%llu bytes) %.8x_o (%llu bytes) and TS %#R=== %#R",
+				 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
+				 ntohl(child_sa->get_spi(child_sa, TRUE)), bytes_in,
+				 ntohl(child_sa->get_spi(child_sa, FALSE)), bytes_out,
+				 child_sa->get_traffic_selectors(child_sa, TRUE),
+				 child_sa->get_traffic_selectors(child_sa, FALSE));
+		}
 	}
 	enumerator->destroy(enumerator);
 }
@@ -356,7 +374,7 @@ METHOD(task_t, destroy, void,
  * Described in header.
  */
 child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
-									u_int32_t spi)
+									u_int32_t spi, bool expired)
 {
 	private_child_delete_t *this;
 
@@ -373,6 +391,7 @@ child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
 		.child_sas = linked_list_create(),
 		.protocol = protocol,
 		.spi = spi,
+		.expired = expired,
 	);
 
 	if (protocol != PROTO_NONE)

src/libcharon/sa/ikev2/tasks/child_delete.h

@@ -52,9 +52,10 @@ struct child_delete_t {
  * @param ike_sa		IKE_SA this task works for
  * @param protocol		protocol of CHILD_SA to delete, PROTO_NONE as responder
  * @param spi			inbound SPI of CHILD_SA to delete
+ * @param expired		TRUE if CHILD_SA already expired
  * @return				child_delete task to handle by the task_manager
  */
 child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
-									u_int32_t spi);
+									u_int32_t spi, bool expired);
 
 #endif /** CHILD_DELETE_H_ @}*/

src/libcharon/sa/ikev2/tasks/child_rekey.c

@@ -352,7 +352,7 @@ METHOD(task_t, process_i, status_t,
 	protocol = to_delete->get_protocol(to_delete);
 
 	/* rekeying done, delete the obsolete CHILD_SA using a subtask */
-	this->child_delete = child_delete_create(this->ike_sa, protocol, spi);
+	this->child_delete = child_delete_create(this->ike_sa, protocol, spi, FALSE);
 	this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
 	this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;