ike: Restart inactivity counter after doing a CHILD_SA rekey

When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity
job is queued for a time unrelated to the rekey time, so it might happen
that the inactivity job gets executed just after rekeying. If this happens,
inactivity is detected even if we had traffic on the rekeyed CHILD_SA just
before rekeying.

This change implies that inactivity checks can't handle inactivity timeouts
for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter
than the rekey time to have any effect.

diff --git a/man/ipsec.conf.5.in b/man/ipsec.conf.5.in
index 92be6700001ce72c6524778bcb77e521a9ca7c43..a0be75536ebfd4cc48c57fb8230ec93cae034a4e 100644 (file)
--- a/man/ipsec.conf.5.in
+++ b/man/ipsec.conf.5.in
@@ -386,7 +386,9 @@ retransmission timeout applies, as every exchange is used to detect dead peers.
 .TP
 .BR inactivity " = <time>"
 defines the timeout interval, after which a CHILD_SA is closed if it did
-not send or receive any traffic.
+not send or receive any traffic. The inactivity counter is reset during CHILD_SA
+rekeying. This means that the inactivity timeout must be smaller than the
+rekeying interval to have any effect.
 .TP
 .BR eap_identity " = <id>"
 defines the identity the client uses to reply to an EAP Identity request.

diff --git a/src/libcharon/processing/jobs/inactivity_job.c b/src/libcharon/processing/jobs/inactivity_job.c
index 9ab69b417a94ee56a517210b3d2fb06c12004f4f..1977339799b86523da7baf958a60830d82ab780a 100644 (file)
--- a/src/libcharon/processing/jobs/inactivity_job.c
+++ b/src/libcharon/processing/jobs/inactivity_job.c
@@ -73,12 +73,13 @@ METHOD(job_t, execute, job_requeue_t,
                {
                        if (child_sa->get_reqid(child_sa) == this->reqid)
                        {
-                               time_t in, out, diff;
+                               time_t in, out, install, diff;
 
                                child_sa->get_usestats(child_sa, TRUE, &in, NULL, NULL);
                                child_sa->get_usestats(child_sa, FALSE, &out, NULL, NULL);
+                               install = child_sa->get_installtime(child_sa);
 
-                               diff = time_monotonic(NULL) - max(in, out);
+                               diff = time_monotonic(NULL) - max(max(in, out), install);
 
                                if (diff >= this->timeout)
                                {