[strongSwan] Rekey Collisions

[Martin Willi]

Steve,

> If you cant see any problem in the log, I'll gather some more data
> next time it happens.

> 15[IKE] CHILD_SA rekey collision lost, deleting rekeyed child

> 13[IKE] CHILD_SA rekey collision won, deleting old child

That all looks like it works as expected. Each peer deletes the CHILD_SA
it should, and the peers should end up with the same rekeyed CHILD_SA.

> the SPIs of the left and right ends match at first but this morning
> they are different.

That's definitely strange. Even if the peers don't agree on the
CHILD_SAs to keep or delete, I don't see why the SAs should be out of
sync.

Did this happen during the log you provided, or can you provide a log
when this happens?

Also, I've attached a patch that adds some additional debugging to check
if we falsely lookup the CHILD_SA by the outbound SPI where this is not
intended. Just a wild guess, not sure if it is related.

> do I just accept that it will and do my best to reduce the likelihood
> of collisions 

Even if they happen, it is no issue here. Collisions get resolved just
fine every time for the many collisions I've produced. That should be
true for both 5.1.1 and 5.2.0.

Regards
Martin
-------------- next part --------------
A non-text attachment was scrubbed...
Name: debug-spi-switch.diff
Type: text/x-patch
Size: 1057 bytes
Desc: not available
URL: <http://lists.strongswan.org/pipermail/users/attachments/20140731/ad204441/attachment.bin>