[strongSwan] ipv6ready IKEv2_Self_Test v1.0.3 failing with strongSwan

[Martin Willi]

Hi Jiri,

> When an SA expires (based on locally configured values of either
> lifetime or octets passed), and implementation MAY either try to renew
> it with a CREATE_CHILD_SA exchange or it MAY delete (close) the old SA
> and create a new one.

> strongSwan seems to do neither, that's why it never sends the INFORMATIONAL
> message with the delete payload

It really should, and it does here. Lifetimes are enforced by the
kernel, the daemon creates corresponding CREATE_CHILD_SA/INFORMATIONAL
messages.

To enforce a rekey using CREATE_CHILD_SA in 30s, set

   lifetime=40s
   margintime=10s
   rekeyfuzz=0%

Margin specifies the time we have to renew the SA. Setting

  lifetime=30s
  margintime=0s
  rekeyfuzz=0%

should end directly in an INFORMATIONAL delete, as there is no time to
do a rekey.

For volume based rekeying, use

  lifebytes=3000
  marginbytes=3000
  rekeyfuzz=0%

You can set marginbytes to zero for an immediate delete.

There are also lifepackets/marginpackets parameters for lifetimes based
on the number of processed packets.

> However, strongSwan automatically uses any integrity algorithm
> specified in a ike= proposal definition 

This is a limitation inherited from the configuration syntax for IKEv1.

I don't know if it makes sense for real setups, but extending the syntax
should be no problem. The question would be how we distinguish PRF and
integrity algorithms in our proposal string (psha1,psha256?).

Best regards
Martin