using dpd actions to enforce connection state

dpd actions a per child-, not peer ike-sa

src/charon/sa/tasks/child_delete.c

@@ -152,23 +152,48 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
 }
 
 /**
- * destroy the children listed in this->child_sas
+ * destroy the children listed in this->child_sas, reestablish by policy
  */
-static void destroy_children(private_child_delete_t *this)
+static status_t destroy_and_reestablish(private_child_delete_t *this)
 {
 	iterator_t *iterator;
 	child_sa_t *child_sa;
+	child_cfg_t *child_cfg;
 	protocol_id_t protocol;
 	u_int32_t spi;
+	status_t status = SUCCESS;
 	
 	iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 	while (iterator->iterate(iterator, (void**)&child_sa))
 	{
 		spi = child_sa->get_spi(child_sa, TRUE);
 		protocol = child_sa->get_protocol(child_sa);
+		child_cfg = child_sa->get_config(child_sa);
+		child_cfg->get_ref(child_cfg);
 		this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
+		if (!this->initiator)
+		{	/* enforce child_cfg policy if deleted passively */
+			switch (child_cfg->get_action(child_cfg))
+			{
+				case ACTION_RESTART:
+					child_cfg->get_ref(child_cfg);
+					status = this->ike_sa->initiate(this->ike_sa, child_cfg);
+					break;
+				case ACTION_ROUTE:
+					status = this->ike_sa->route(this->ike_sa, child_cfg);
+					break;
+				default:
+					break;
+			}
+		}
+		child_cfg->destroy(child_cfg);
+		if (status != SUCCESS)
+		{
+			break;
+		}
 	}
 	iterator->destroy(iterator);
+	return status;
 }
 
 /**
@@ -209,9 +234,8 @@ static status_t process_i(private_child_delete_t *this, message_t *message)
 	this->child_sas = linked_list_create();
 	
 	process_payloads(this, message);
-	destroy_children(this);
 	SIG(CHILD_DOWN_SUCCESS, "CHILD_SA closed");
-	return SUCCESS;
+	return destroy_and_reestablish(this);
 }
 
 /**
@@ -234,9 +258,8 @@ static status_t build_r(private_child_delete_t *this, message_t *message)
 	{
 		build_payloads(this, message);	
 	}
-	destroy_children(this);
 	SIG(CHILD_DOWN_SUCCESS, "CHILD_SA closed");
-	return SUCCESS;
+	return destroy_and_reestablish(this);
 }
 
 /**

src/charon/sa/tasks/ike_delete.c

@@ -87,6 +87,7 @@ static status_t process_r(private_ike_delete_t *this, message_t *message)
 			break;
 		case IKE_ESTABLISHED:
 			DBG1(DBG_IKE, "deleting IKE_SA on request");
+			this->ike_sa->reestablish(this->ike_sa);
 			break;
 		case IKE_REKEYING:
 			break;

src/charon/sa/tasks/ike_reauth.c

@@ -68,7 +68,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 	
 	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 	
-	/* reestablish only if we have children */
+	/* reauthenticate only if we have children */
 	iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
 	if (iterator->get_count(iterator) == 0
 #ifdef ME
@@ -77,7 +77,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 #endif /* ME */
 		)
 	{
-		DBG1(DBG_IKE, "unable to reestablish IKE_SA, no CHILD_SA to recreate");
+		DBG1(DBG_IKE, "unable to reauthenticate IKE_SA, no CHILD_SA to recreate");
 		iterator->destroy(iterator);
 		return FAILED;
 	}
@@ -104,7 +104,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 		{
 			charon->ike_sa_manager->checkin_and_destroy(
 								charon->ike_sa_manager, new);
-			DBG1(DBG_IKE, "reestablishing IKE_SA failed");
+			DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
 			return FAILED;
 		}
 	}
@@ -131,7 +131,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 					iterator->destroy(iterator);
 					charon->ike_sa_manager->checkin_and_destroy(
 										charon->ike_sa_manager, new);
-					DBG1(DBG_IKE, "reestablishing IKE_SA failed");
+					DBG1(DBG_IKE, "reauthenticating IKE_SA failed");
 					return FAILED;
 				}
 				break;