child-delete: Delay the removal of the inbound SA of rekeyed CHILD_SAs

After deleting a rekeyed CHILD_SA we uninstall the outbound SA but don't
destroy the CHILD_SA (and the inbound SA) immediately.  We delay it
a few seconds or until the SA expires to allow delayed packets to get
processed. The CHILD_SA remains in state CHILD_DELETING until it finally
gets destroyed.

2 files changed, 50 insertions, 6 deletions

diff --git a/src/libcharon/sa/ikev2/tasks/child_delete.c b/src/libcharon/sa/ikev2/tasks/child_delete.c
index 0954b7b94..160865636 100644
--- a/src/libcharon/sa/ikev2/tasks/child_delete.c
+++ b/src/libcharon/sa/ikev2/tasks/child_delete.c
@@ -18,9 +18,14 @@
 
 #include <daemon.h>
 #include <encoding/payloads/delete_payload.h>
+#include <processing/jobs/delete_child_sa_job.h>
 #include <sa/ikev2/tasks/child_create.h>
 #include <sa/ikev2/tasks/child_rekey.h>
 
+#ifndef DELETE_REKEYED_DELAY
+#define DELETE_REKEYED_DELAY 5
+#endif
+
 typedef struct private_child_delete_t private_child_delete_t;
 
 /**
@@ -308,6 +313,12 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
 	uint32_t spi, reqid, rekey_spi;
 	action_t action;
 	status_t status = SUCCESS;
+	time_t now, expire;
+	u_int delay;
+
+	now = time_monotonic(NULL);
+	delay = lib->settings->get_int(lib->settings, "%s.delete_rekeyed_delay",
+								   DELETE_REKEYED_DELAY, lib->ns);
 
 	enumerator = this->child_sas->create_enumerator(this->child_sas);
 	while (enumerator->enumerate(enumerator, (void**)&entry))
@@ -326,13 +337,32 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
 			{
 				install_outbound(this, protocol, rekey_spi);
 			}
+			/* for rekeyed CHILD_SAs we uninstall the outbound SA but don't
+			 * immediately destroy it, by default, so we can process delayed
+			 * packets */
+			child_sa->remove_outbound(child_sa);
+			expire = child_sa->get_lifetime(child_sa, TRUE);
+			if (delay && (!expire || ((now + delay) < expire)))
+			{
+				lib->scheduler->schedule_job(lib->scheduler,
+					(job_t*)delete_child_sa_job_create_id(
+									child_sa->get_unique_id(child_sa)), delay);
+				continue;
+			}
+			else if (expire)
+			{	/* let it expire naturally */
+				continue;
+			}
+			/* no delay and no lifetime, destroy it immediately */
 		}
 		spi = child_sa->get_spi(child_sa, TRUE);
 		reqid = child_sa->get_reqid(child_sa);
 		child_cfg = child_sa->get_config(child_sa);
 		child_cfg->get_ref(child_cfg);
 		action = child_sa->get_close_action(child_sa);
+
 		this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
+
 		if (entry->check_delete_action)
 		{	/* enforce child_cfg policy if deleted passively */
 			switch (action)
@@ -425,14 +455,20 @@ METHOD(task_t, build_i, status_t,
 		/* we work only with the inbound SPI */
 		this->spi = child_sa->get_spi(child_sa, TRUE);
 	}
+
+	if (child_sa->get_state(child_sa) == CHILD_DELETING)
+	{	/* DELETEs for this CHILD_SA were already exchanged, but it was not yet
+		 * destroyed to allow delayed packets to get processed */
+		this->ike_sa->destroy_child_sa(this->ike_sa, this->protocol, this->spi);
+		message->set_exchange_type(message, EXCHANGE_TYPE_UNDEFINED);
+		return SUCCESS;
+	}
+
 	INIT(entry,
 		.child_sa = child_sa,
+		.rekeyed = child_sa->get_state(child_sa) == CHILD_REKEYED,
 	);
 	this->child_sas->insert_last(this->child_sas, entry);
-	if (child_sa->get_state(child_sa) == CHILD_REKEYED)
-	{
-		entry->rekeyed = TRUE;
-	}
 	log_children(this);
 	build_payloads(this, message);
 
diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.c b/src/libcharon/sa/ikev2/tasks/child_rekey.c
index 5a703bffb..761c860e7 100644
--- a/src/libcharon/sa/ikev2/tasks/child_rekey.c
+++ b/src/libcharon/sa/ikev2/tasks/child_rekey.c
@@ -132,6 +132,7 @@ static void find_child(private_child_rekey_t *this, message_t *message)
 	notify_payload_t *notify;
 	protocol_id_t protocol;
 	uint32_t spi;
+	child_sa_t *child_sa;
 
 	notify = message->get_notify(message, REKEY_SA);
 	if (notify)
@@ -141,8 +142,15 @@ static void find_child(private_child_rekey_t *this, message_t *message)
 
 		if (protocol == PROTO_ESP || protocol == PROTO_AH)
 		{
-			this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
-														spi, FALSE);
+			child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
+												  spi, FALSE);
+			if (child_sa &&
+				child_sa->get_state(child_sa) == CHILD_DELETING &&
+				child_sa->get_outbound_state(child_sa) == CHILD_OUTBOUND_NONE)
+			{	/* ignore rekeyed CHILD_SAs we keep around */
+				return;
+			}
+			this->child_sa = child_sa;
 		}
 	}
 }