implemented IKE_SA rekeying

uses ikelifetime, rekeymargin and rekeyfuzz config settings
	no handling of simultaneus exchanges yet!

src/charon/config/connections/connection.c

@@ -109,6 +109,22 @@ struct private_connection_t {
 	 * Supported proposals
 	 */
 	linked_list_t *proposals;
+	
+	/**
+	 * Time before an SA gets invalid
+	 */
+	u_int32_t soft_lifetime;
+	
+	/**
+	 * Time before an SA gets rekeyed
+	 */
+	u_int32_t hard_lifetime;
+	
+	/**
+	 * Time, which specifies the range of a random value
+	 * substracted from soft_lifetime.
+	 */
+	u_int32_t jitter;
 };
 
 /**
@@ -164,7 +180,19 @@ static host_t *get_other_host (private_connection_t *this)
  */
 static linked_list_t* get_proposals(private_connection_t *this)
 {
-	return this->proposals;
+	iterator_t *iterator;
+	proposal_t *current;
+	linked_list_t *proposals = linked_list_create();
+	
+	iterator = this->proposals->create_iterator(this->proposals, TRUE);
+	while (iterator->iterate(iterator, (void**)&current))
+	{
+		current = current->clone(current);
+		proposals->insert_last(proposals, (void*)current);
+	}
+	iterator->destroy(iterator);
+	
+	return proposals;
 }
 	
 /**
@@ -273,6 +301,25 @@ static bool check_dh_group(private_connection_t *this, diffie_hellman_group_t dh
 	prop_iter->destroy(prop_iter);
 	return FALSE;
 }
+/**
+ * Implementation of connection_t.get_soft_lifetime
+ */
+static u_int32_t get_soft_lifetime(private_connection_t *this)
+{
+	if (this->jitter == 0)
+	{
+		return this->soft_lifetime ;
+	}
+	return this->soft_lifetime - (random() % this->jitter);
+}
+
+/**
+ * Implementation of connection_t.get_hard_lifetime
+ */
+static u_int32_t get_hard_lifetime(private_connection_t *this)
+{
+	return this->hard_lifetime;
+}
 
 /**
  * Implementation of connection_t.get_ref.
@@ -310,8 +357,10 @@ static void destroy(private_connection_t *this)
 connection_t * connection_create(char *name, bool ikev2,
 								 cert_policy_t cert_policy,
 								 cert_policy_t certreq_policy,
-								 host_t *my_host, host_t *other_host, 
-								 auth_method_t auth_method)
+								 host_t *my_host, host_t *other_host,
+								 auth_method_t auth_method,
+								 u_int32_t hard_lifetime,
+								 u_int32_t soft_lifetime, u_int32_t jitter)
 {
 	private_connection_t *this = malloc_thing(private_connection_t);
 	
@@ -328,6 +377,8 @@ connection_t * connection_create(char *name, bool ikev2,
 	this->public.get_auth_method = (auth_method_t(*)(connection_t*)) get_auth_method;
 	this->public.get_dh_group = (diffie_hellman_group_t(*)(connection_t*)) get_dh_group;
 	this->public.check_dh_group = (bool(*)(connection_t*,diffie_hellman_group_t)) check_dh_group;
+	this->public.get_soft_lifetime = (u_int32_t (*) (connection_t *))get_soft_lifetime;
+	this->public.get_hard_lifetime = (u_int32_t (*) (connection_t *))get_hard_lifetime;
 	this->public.get_ref = (void(*)(connection_t*))get_ref;
 	this->public.destroy = (void(*)(connection_t*))destroy;
 	
@@ -340,6 +391,9 @@ connection_t * connection_create(char *name, bool ikev2,
 	this->my_host = my_host;
 	this->other_host = other_host;
 	this->auth_method = auth_method;
+	this->hard_lifetime = hard_lifetime;
+	this->soft_lifetime = soft_lifetime;
+	this->jitter = jitter;
 	
 	this->proposals = linked_list_create();
 	

src/charon/config/connections/connection.h

@@ -134,8 +134,7 @@ struct connection_t {
 	/**
 	 * @brief Returns a list of all supported proposals.
 	 * 
-	 * Returned list is still owned by connection and MUST NOT
-	 * modified or destroyed.
+	 * Returned list and its proposals  must be destroyed after usage.
 	 * 
 	 * @param this		calling object
 	 * @return 			list containing all the proposals
@@ -235,6 +234,25 @@ struct connection_t {
 	 * @return			TRUE if group acceptable
 	 */
 	bool (*check_dh_group) (connection_t *this, diffie_hellman_group_t dh_group);
+
+	/**
+	 * @brief Get the lifetime of a connection, before IKE_SA rekeying starts.
+	 * 
+	 * A call to this function automatically adds a jitter to
+	 * avoid simultanous rekeying.
+	 * 
+	 * @param this		calling object
+	 * @return			lifetime in seconds
+	 */
+	u_int32_t (*get_soft_lifetime) (connection_t *this);
+	
+	/**
+	 * @brief Get the lifetime of a connection, before IKE_SA gets deleted.
+	 * 
+	 * @param this		calling object
+	 * @return			lifetime in seconds
+	 */
+	u_int32_t (*get_hard_lifetime) (connection_t *this);
 	
 	/**
 	 * @brief Get a new reference to this connection.
@@ -271,6 +289,9 @@ struct connection_t {
  * @param my_host			host_t representing local address
  * @param other_host		host_t representing remote address
  * @param auth_method		Authentication method to use for our(!) auth data
+ * @param hard_lifetime		lifetime before deleting an IKE_SA
+ * @param soft_lifetime		lifetime before rekeying an IKE_SA
+ * @param jitter			range of randomization time
  * @return 					connection_t object.
  * 
  * @ingroup config
@@ -278,6 +299,7 @@ struct connection_t {
 connection_t * connection_create(char *name, bool ikev2,
 								 cert_policy_t cert_pol, cert_policy_t req_pol,
 								 host_t *my_host, host_t *other_host,
-								 auth_method_t auth_method);
+								 auth_method_t auth_method, u_int32_t hard_lifetime, 
+								 u_int32_t soft_lifetime, u_int32_t jitter);
 
 #endif /* CONNECTION_H_ */

src/charon/config/policies/policy.c

@@ -258,7 +258,19 @@ static linked_list_t *select_other_traffic_selectors(private_policy_t *this,
  */
 static linked_list_t *get_proposals(private_policy_t *this)
 {
-	return this->proposals;
+	iterator_t *iterator;
+	proposal_t *current;
+	linked_list_t *proposals = linked_list_create();
+	
+	iterator = this->proposals->create_iterator(this->proposals, TRUE);
+	while (iterator->iterate(iterator, (void**)&current))
+	{
+		current = current->clone(current);
+		proposals->insert_last(proposals, (void*)current);
+	}
+	iterator->destroy(iterator);
+	
+	return proposals;
 }
 
 /**
@@ -349,7 +361,6 @@ static u_int32_t get_soft_lifetime(private_policy_t *this)
 	{
 		return this->soft_lifetime ;
 	}
-	srandom(time(NULL)+getpid());
 	return this->soft_lifetime - (random() % this->jitter);
 }
 

src/charon/config/policies/policy.h

@@ -136,8 +136,7 @@ struct policy_t {
 	 * 
 	 * policy_t does store proposals for AH/ESP, IKE proposals are in 
 	 * the connection_t.
-	 * List and Items are still owned by policy and MUST NOT
-	 * be manipulated or freed!
+	 * Resulting list and all of its proposals must be freed after usage.
 	 *
 	 * @param this			calling object
 	 * @return				lists with proposals