workaround for peers rekeying at the same time

loading lifetime policies from ipsec.conf

src/charon/sa/child_sa.c

@@ -82,6 +82,11 @@ struct private_child_sa_t {
 	 */
 	u_int32_t reqid;
 	
+	/**
+	 * time, on which SA was installed
+	 */
+	time_t install_time;
+	
 	/**
 	 * Lifetime before rekeying
 	 */
@@ -239,6 +244,8 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
 												mine ? 0 : this->soft_lifetime,
 												this->hard_lifetime,
 												enc_algo, int_algo, prf_plus, mine);
+	
+	this->install_time = time(NULL);
 
 	return status;
 }
@@ -406,11 +413,12 @@ static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
 	{
 		logger = this->logger;
 	}
-	logger->log(logger, CONTROL|LEVEL1, "  \"%s\":   protected with %s (0x%x/0x%x), reqid %d:",
+	logger->log(logger, CONTROL|LEVEL1, "  \"%s\":   protected with %s (0x%x/0x%x), reqid %d, rekeying in %ds:",
 				name,
 				this->protocol == PROTO_ESP ? "ESP" : "AH",
 				htonl(this->me.spi), htonl(this->other.spi),
-				this->reqid);
+				this->reqid, 
+				this->soft_lifetime - (time(NULL) - this->install_time));
 	iterator = this->policies->create_iterator(this->policies, TRUE);
 	while (iterator->has_next(iterator))
 	{

src/charon/sa/states/create_child_sa_requested.c

@@ -223,7 +223,15 @@ static status_t process_message(private_create_child_sa_requested_t *this, messa
 	if (response->get_request(response))
 	{
 		this->logger->log(this->logger, ERROR | LEVEL1, "CREATE_CHILD_SA requests not allowed state create_child_sa_requested");
-		return FAILED;
+		/* TODO: our state implementation currently can not handle incoming requests cleanly here.
+		 * If a request comes in before an outstanding reply, we can not handle it the correct way.
+		 * Currently, we create a ESTABLISHED state and let it process the message... But we
+		 * need changes in the whole state mechanism.
+		 */
+		state_t *state = (state_t*)ike_sa_established_create(this->ike_sa);
+		state->process_message(state, response);
+		state->destroy(state);
+		return SUCCESS;
 	}
 	
 	/* get signer for verification and crypter for decryption */

src/charon/sa/states/delete_child_sa_requested.c

@@ -80,7 +80,15 @@ static status_t process_message(private_delete_child_sa_requested_t *this, messa
 	if (response->get_request(response))
 	{
 		this->logger->log(this->logger, ERROR | LEVEL1, "INFORMATIONAL requests not allowed state delete_child_sa_requested");
-		return FAILED;
+		/* TODO: our state implementation currently can not handle incoming requests cleanly here.
+		 * If a request comes in before an outstanding reply, we can not handle it cleanly.
+		 * Currently, we create a ESTABLISHED state and let it process the message... But we
+		 * need changes in the whole state mechanism.
+		 */
+		state_t *state = (state_t*)ike_sa_established_create(this->ike_sa);
+		state->process_message(state, response);
+		state->destroy(state);
+		return SUCCESS;
 	}
 	
 	/* get signer for verification and crypter for decryption */

src/charon/sa/states/ike_sa_established.c

@@ -274,6 +274,17 @@ static status_t process_create_child_sa(private_ike_sa_established_t *this, mess
 				nonce_request = (nonce_payload_t*)payload;
 				break;	
 			}
+			case KEY_EXCHANGE:
+			{
+				/* we currently do not support a diffie hellman exchange
+				 * for CHILD_SAs. */
+				u_int16_t no_group[1];
+				no_group[0] = htons(MODP_NONE);
+				chunk_t no_group_chunk = chunk_from_buf(no_group);
+				this->ike_sa->send_notify(this->ike_sa, CREATE_CHILD_SA, INVALID_KE_PAYLOAD, no_group_chunk);
+				payloads->destroy(payloads);
+				return FAILED;
+			}
 			case NOTIFY:
 			{
 				notify = (notify_payload_t*)payload;

src/charon/sa/states/responder_init.c

@@ -369,7 +369,7 @@ static status_t build_ke_payload(private_responder_init_t *this,ke_payload_t *ke
 	this->logger->log(this->logger, CONTROL | LEVEL2, "Process received KE payload");
 	group = ke_request->get_dh_group_number(ke_request);
 				
-	if (group == MODP_UNDEFINED)
+	if (group == MODP_NONE)
 	{
 		this->logger->log(this->logger, AUDIT, "No diffie hellman group to select. Deleting IKE_SA");
 		return DESTROY_ME;
@@ -560,7 +560,7 @@ responder_init_t *responder_init_create(protected_ike_sa_t *ike_sa)
 	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	this->sent_nonce = CHUNK_INITIALIZER;
 	this->received_nonce = CHUNK_INITIALIZER;
-	this->dh_group_number = MODP_UNDEFINED;
+	this->dh_group_number = MODP_NONE;
 	this->diffie_hellman = NULL;
 	this->proposal = NULL;