improved CHILD_SA output for "ipsec statusall"
[strongswan.git] / src / charon / sa / child_sa.c
index 5bb895e..fd144ca 100644 (file)
@@ -6,6 +6,7 @@
  */
 
 /*
+ * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
  * Copyright (C) 2005 Jan Hutter, Martin Willi
  * Hochschule fuer Technik Rapperswil
  *
@@ -36,25 +37,12 @@ typedef struct sa_policy_t sa_policy_t;
  */
 struct sa_policy_t {
        
-       /**
-        * Network on local side
-        */
-       host_t *my_net;
-       
-       /**
-        * Network on remote side
-        */
-       host_t *other_net;
-       
-       /**
-        * Number of bits for local network (subnet size)
-        */
-       u_int8_t my_net_mask;
-       
-       /**
-        * Number of bits for remote network (subnet size)
-        */
-       u_int8_t other_net_mask;
+       struct {
+               /** subnet address behind peer peer */
+               host_t *net;
+               /** netmask used for net */
+               u_int8_t net_mask;
+       } me, other;
        
        /**
         * Protocol for this policy, such as TCP/UDP/ICMP...
@@ -73,45 +61,62 @@ struct private_child_sa_t {
         */
        child_sa_t public;
        
+       struct {
+               /** address of peer */
+               host_t *addr;
+               /** actual used SPI, 0 if unused */
+               u_int32_t spi;
+       } me, other;
+       
        /**
-        * IP of this peer
+        * Allocated SPI for a ESP proposal candidates
         */
-       host_t *me;
+       u_int32_t alloc_esp_spi;
        
        /**
-        * IP of other peer
+        * Allocated SPI for a AH proposal candidates
         */
-       host_t *other;
+       u_int32_t alloc_ah_spi;
        
        /**
-        * Local security parameter index for AH protocol, 0 if not used
+        * Protocol used to protect this SA, ESP|AH
         */
-       u_int32_t my_ah_spi;
+       protocol_id_t protocol;
        
        /**
-        * Local security parameter index for ESP protocol, 0 if not used
+        * List containing sa_policy_t objects 
         */
-       u_int32_t my_esp_spi;
+       linked_list_t *policies;
        
        /**
-        * Remote security parameter index for AH protocol, 0 if not used
+        * reqid used for this child_sa
         */
-       u_int32_t other_ah_spi;
+       u_int32_t reqid;
        
        /**
-        * Remote security parameter index for ESP protocol, 0 if not used
+        * time, on which SA was installed
         */
-       u_int32_t other_esp_spi;
+       time_t install_time;
        
        /**
-        * List containing policy_id_t objects 
+        * Lifetime before rekeying
         */
-       linked_list_t *policies;
+       u_int32_t soft_lifetime;
        
        /**
-        * reqid used for this child_sa
+        * Lifetime before delete
         */
-       u_int32_t reqid;
+       u_int32_t hard_lifetime;
+       
+       /**
+        * has this CHILD_SA been rekeyed?
+        */
+       bool rekeyed;
+
+       /**
+        * Specifies if NAT traversal is used
+        */
+       bool use_natt;
        
        /**
         * CHILD_SAs own logger
@@ -120,64 +125,93 @@ struct private_child_sa_t {
 };
 
 /**
+ * Implements child_sa_t.get_reqid
+ */
+static u_int32_t get_reqid(private_child_sa_t *this)
+{
+       return this->reqid;
+}
+       
+/**
+ * Implements child_sa_t.get_spi
+ */
+u_int32_t get_spi(private_child_sa_t *this, bool inbound)
+{
+       if (inbound)
+       {
+               return this->me.spi;
+       }
+       return this->other.spi;
+}
+
+/**
+ * Implements child_sa_t.get_protocol
+ */
+protocol_id_t get_protocol(private_child_sa_t *this)
+{
+       return this->protocol;
+}
+
+/**
+ * Allocate SPI for a single proposal
+ */
+static status_t alloc_proposal(private_child_sa_t *this, proposal_t *proposal)
+{
+       protocol_id_t protocol = proposal->get_protocol(proposal);
+               
+       if (protocol == PROTO_AH)
+       {
+               /* get a new spi for AH, if not already done */
+               if (this->alloc_ah_spi == 0)
+               {
+                       if (charon->kernel_interface->get_spi(
+                                                charon->kernel_interface, 
+                                                this->other.addr, this->me.addr,
+                                                PROTO_AH, this->reqid,
+                                                &this->alloc_ah_spi) != SUCCESS)
+                       {
+                               return FAILED;
+                       }
+               }
+               proposal->set_spi(proposal, this->alloc_ah_spi);
+       }
+       if (protocol == PROTO_ESP)
+       {
+               /* get a new spi for ESP, if not already done */
+               if (this->alloc_esp_spi == 0)
+               {
+                       if (charon->kernel_interface->get_spi(
+                                                charon->kernel_interface,
+                                                this->other.addr, this->me.addr,
+                                                PROTO_ESP, this->reqid,
+                                                &this->alloc_esp_spi) != SUCCESS)
+                       {
+                               return FAILED;
+                       }
+               }
+               proposal->set_spi(proposal, this->alloc_esp_spi);
+       }
+       return SUCCESS;
+}
+
+
+/**
  * Implements child_sa_t.alloc
  */
 static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
 {
-       protocol_id_t protocols[2];
        iterator_t *iterator;
        proposal_t *proposal;
-       status_t status;
-       u_int i;
        
-       /* iterator through proposals */
+       /* iterator through proposals to update spis */
        iterator = proposals->create_iterator(proposals, TRUE);
        while(iterator->has_next(iterator))
        {
                iterator->current(iterator, (void**)&proposal);
-               proposal->get_protocols(proposal, protocols);
-       
-               /* check all protocols */
-               for (i = 0; i<2; i++)
+               if (alloc_proposal(this, proposal) != SUCCESS)
                {
-                       switch (protocols[i])
-                       {
-                               case PROTO_AH:
-                                       /* do we already have an spi for AH?*/
-                                       if (this->my_ah_spi == 0)
-                                       {
-                                               /* nope, get one */
-                                               status = charon->kernel_interface->get_spi(
-                                                                                       charon->kernel_interface,
-                                                                                       this->me, this->other,
-                                                                                       PROTO_AH, FALSE,
-                                                                                       &(this->my_ah_spi));
-                                       }
-                                       /* update proposal */
-                                       proposal->set_spi(proposal, PROTO_AH, (u_int64_t)this->my_ah_spi);
-                                       break;
-                               case PROTO_ESP:
-                                       /* do we already have an spi for ESP?*/
-                                       if (this->my_esp_spi == 0)
-                                       {
-                                               /* nope, get one */
-                                               status = charon->kernel_interface->get_spi(
-                                                                                       charon->kernel_interface,
-                                                                                       this->me, this->other,
-                                                                                       PROTO_ESP, FALSE,
-                                                                                       &(this->my_esp_spi));
-                                       }
-                                       /* update proposal */
-                                       proposal->set_spi(proposal, PROTO_ESP, (u_int64_t)this->my_esp_spi);
-                                       break;
-                               default:
-                                       break;
-                       }
-                       if (status != SUCCESS)
-                       {
-                               iterator->destroy(iterator);
-                               return FAILED;
-                       }
+                       iterator->destroy(iterator);
+                       return FAILED;
                }
        }
        iterator->destroy(iterator);
@@ -186,181 +220,159 @@ static status_t alloc(private_child_sa_t *this, linked_list_t *proposals)
 
 static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus, bool mine)
 {
-       protocol_id_t protocols[2];
        u_int32_t spi;
-       encryption_algorithm_t enc_algo;
-       integrity_algorithm_t int_algo;
-       chunk_t enc_key, int_key;
-       algorithm_t *algo;
-       crypter_t *crypter;
-       signer_t *signer;
-       size_t key_size;
+       algorithm_t *enc_algo, *int_algo;
+       algorithm_t enc_algo_none = {ENCR_UNDEFINED, 0};
+       algorithm_t int_algo_none = {AUTH_UNDEFINED, 0};
        host_t *src;
        host_t *dst;
+       natt_conf_t *natt;
        status_t status;
-       u_int i;
-       
-       /* we must assign the roles to correctly set up the SAs */
-       if (mine)
-       {
-               src = this->me;
-               dst = this->other;
-       }
-       else
-       {
-               dst = this->me;
-               src = this->other;
-       }
-       
-       proposal->get_protocols(proposal, protocols);
-       /* derive keys in order as protocols appear */
-       for (i = 0; i<2; i++)
-       {
-               if (protocols[i] != PROTO_NONE)
+       
+       this->protocol = proposal->get_protocol(proposal);
+       
+       /* now we have to decide which spi to use. Use self allocated, if "mine",
+        * or the one in the proposal, if not "mine" (others). Additionally,
+        * source and dest host switch depending on the role */
+       if (mine)
+       {
+               /* if we have allocated SPIs for AH and ESP, we must delete the unused
+                * one. */
+               if (this->protocol == PROTO_ESP)
                {
-                       
-                       /* now we have to decide which spi to use. Use self allocated, if "mine",
-                        * or the one in the proposal, if not "mine" (others). */
-                       if (mine)
+                       this->me.spi = this->alloc_esp_spi;
+                       if (this->alloc_ah_spi)
                        {
-                               if (protocols[i] == PROTO_AH)
-                               {
-                                       spi = this->my_ah_spi;
-                               }
-                               else
-                               {
-                                       spi = this->my_esp_spi;
-                               }
-                       }
-                       else /* use proposals spi */
-                       {
-                               spi = proposal->get_spi(proposal, protocols[i]);
-                               if (protocols[i] == PROTO_AH)
-                               {
-                                       this->other_ah_spi = spi;
-                               }
-                               else
-                               {
-                                       this->other_esp_spi = spi;
-                               }
-                       }
-                       
-                       /* derive encryption key first */
-                       if (proposal->get_algorithm(proposal, protocols[i], ENCRYPTION_ALGORITHM, &algo))
-                       {
-                               enc_algo = algo->algorithm;
-                               this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s, ",
-                                                                 mapping_find(protocol_id_m, protocols[i]),
-                                                                 mine ? "me" : "other",
-                                                                 mapping_find(transform_type_m, ENCRYPTION_ALGORITHM),
-                                                                 mapping_find(encryption_algorithm_m, enc_algo));
-                               
-                               /* we must create a (unused) crypter, since its the only way to get the size
-                                * of the key. This is not so nice, since charon must support all algorithms
-                                * the kernel supports...
-                                * TODO: build something of a encryption algorithm lookup function 
-                                */
-                               crypter = crypter_create(enc_algo, algo->key_size);
-                               key_size = crypter->get_key_size(crypter);
-                               crypter->destroy(crypter);
-                               prf_plus->allocate_bytes(prf_plus, key_size, &enc_key);
-                               this->logger->log_chunk(this->logger, PRIVATE, "key:", enc_key);
-                       }
-                       else
-                       {
-                               enc_algo = ENCR_UNDEFINED;
-                       }
-                       
-                       /* derive integrity key */
-                       if (proposal->get_algorithm(proposal, protocols[i], INTEGRITY_ALGORITHM, &algo))
-                       {
-                               int_algo = algo->algorithm;
-                               this->logger->log(this->logger, CONTROL|LEVEL1, "%s for %s: using %s %s,",
-                                                                 mapping_find(protocol_id_m, protocols[i]),
-                                                                 mine ? "me" : "other",
-                                                                 mapping_find(transform_type_m, INTEGRITY_ALGORITHM),
-                                                                 mapping_find(integrity_algorithm_m, algo->algorithm));
-                               
-                               signer = signer_create(int_algo);
-                               key_size = signer->get_key_size(signer);
-                               signer->destroy(signer);
-                               prf_plus->allocate_bytes(prf_plus, key_size, &int_key);
-                               this->logger->log_chunk(this->logger, PRIVATE, "key:", int_key);
-                       }
-                       else
-                       {
-                               int_algo = AUTH_UNDEFINED;
-                       }
-                       /* send keys down to kernel */
-                       this->logger->log(this->logger, CONTROL|LEVEL1, 
-                                                         "installing 0x%.8x for %s, src %s dst %s",
-                                                         ntohl(spi), mapping_find(protocol_id_m, protocols[i]), 
-                                                         src->get_address(src), dst->get_address(dst));
-                       status = charon->kernel_interface->add_sa(charon->kernel_interface,
-                                                                                                         src, dst,
-                                                                                                         spi, protocols[i],
-                                                                                                         this->reqid,
-                                                                                                         enc_algo, enc_key,
-                                                                                                         int_algo, int_key, mine);
-                       /* clean up for next round */
-                       if (enc_algo != ENCR_UNDEFINED)
-                       {
-                               chunk_free(&enc_key);
-                       }
-                       if (int_algo != AUTH_UNDEFINED)
-                       {
-                               chunk_free(&int_key);
+                               charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr, 
+                                               this->alloc_ah_spi, PROTO_AH);
                        }
-                       
-                       if (status != SUCCESS)
+               }
+               else
+               {
+                       this->me.spi = this->alloc_ah_spi;
+                       if (this->alloc_esp_spi)
                        {
-                               return FAILED;
+                               charon->kernel_interface->del_sa(charon->kernel_interface, this->me.addr, 
+                                               this->alloc_esp_spi, PROTO_ESP);
                        }
-                       
-                       
                }
+               spi = this->me.spi;
+               dst = this->me.addr;
+               src = this->other.addr;
        }
-       return SUCCESS;
+       else
+       {
+               this->other.spi = proposal->get_spi(proposal);
+               spi = this->other.spi;
+               src = this->me.addr;
+               dst = this->other.addr;
+       }
+       
+       this->logger->log(this->logger, CONTROL|LEVEL1, "adding %s %s SA",
+                                         mine ? "inbound" : "outbound",
+                                         mapping_find(protocol_id_m, this->protocol));
+       
+       /* select encryption algo */
+       if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_algo))
+       {
+               this->logger->log(this->logger, CONTROL|LEVEL2, "  using %s for encryption",
+                                                       mapping_find(encryption_algorithm_m, enc_algo->algorithm));
+       }
+       else
+       {
+               enc_algo = &enc_algo_none;
+       }
+       
+       /* select integrity algo */
+       if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_algo))
+       {
+               this->logger->log(this->logger, CONTROL|LEVEL2, "  using %s for integrity",
+                                                 mapping_find(integrity_algorithm_m, int_algo->algorithm));
+       }
+       else
+       {
+               int_algo = &int_algo_none;
+       }
+       
+       /* setup nat-t */
+       if (this->use_natt)
+       {
+               natt = alloca(sizeof(natt_conf_t));
+               natt->sport = src->get_port(src);
+               natt->dport = dst->get_port(dst);
+       }
+       else
+       {
+               natt = NULL;
+       }
+       
+       
+       /* send SA down to the kernel */
+       this->logger->log(this->logger, CONTROL|LEVEL2,
+                                               "  SPI 0x%.8x, src %s dst %s",
+                                               ntohl(spi), src->get_address(src), dst->get_address(dst));
+       status = charon->kernel_interface->add_sa(charon->kernel_interface,
+                                                                                         src, dst,
+                                                                                         spi, this->protocol,
+                                                                                         this->reqid,
+                                                                                         mine ? 0 : this->soft_lifetime,
+                                                                                         this->hard_lifetime,
+                                                                                         enc_algo, int_algo,
+                                                                                         prf_plus, natt, mine);
+       
+       this->install_time = time(NULL);
+
+       return status;
 }
 
 static status_t add(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
 {
-       linked_list_t *list;
+       u_int32_t outbound_spi, inbound_spi;
        
-       /* install others (initiators) SAs*/
-       if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
+       /* backup outbound spi, as alloc overwrites it */
+       outbound_spi = proposal->get_spi(proposal);
+       
+       /* get SPIs inbound SAs */
+       if (alloc_proposal(this, proposal) != SUCCESS)
        {
                return FAILED;
        }
+       inbound_spi = proposal->get_spi(proposal);
        
-       /* get SPIs for our SAs */
-       list = linked_list_create();
-       list->insert_last(list, proposal);
-       if (alloc(this, list) != SUCCESS)
+       /* install inbound SAs */
+       if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
        {
-               list->destroy(list);
                return FAILED;
        }
-       list->destroy(list);
        
-       /* install our (responders) SAs */
-       if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
+       /* install outbound SAs, restore spi*/
+       proposal->set_spi(proposal, outbound_spi);
+       if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
        {
                return FAILED;
        }
+       proposal->set_spi(proposal, inbound_spi);
        
        return SUCCESS;
 }
 
 static status_t update(private_child_sa_t *this, proposal_t *proposal, prf_plus_t *prf_plus)
 {
-       /* install our (initator) SAs */
-       if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
+       u_int32_t inbound_spi;
+       
+       /* backup received spi, as install() overwrites it */
+       inbound_spi = proposal->get_spi(proposal);
+       
+       /* install outbound SAs */
+       if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
        {
                return FAILED;
        }
-       /* install his (responder) SAs */
-       if (install(this, proposal, prf_plus, FALSE) != SUCCESS)
+       
+       /* restore spi */
+       proposal->set_spi(proposal, inbound_spi);
+       /* install inbound SAs */
+       if (install(this, proposal, prf_plus, TRUE) != SUCCESS)
        {
                return FAILED;
        }
@@ -391,13 +403,16 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
                        
                        other_iter->current(other_iter, (void**)&other_ts);
                        
-                       /* only set up policies if protocol matches */
-                       if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts))
+                       /* only set up policies if protocol matches, or if one is zero (any) */
+                       if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts) &&
+                               my_ts->get_protocol(my_ts) && other_ts->get_protocol(other_ts))
                        {
+                               this->logger->log(this->logger, ERROR, 
+                                                                 "CHILD_SA policy uses two different protocols, ignored");
                                continue;
                        }
                        policy = malloc_thing(sa_policy_t);
-                       policy->upper_proto = my_ts->get_protocol(my_ts);
+                       policy->upper_proto = max(my_ts->get_protocol(my_ts), other_ts->get_protocol(other_ts));
                
                        /* calculate net and ports for local side */
                        family = my_ts->get_type(my_ts) == TS_IPV4_ADDR_RANGE ? AF_INET : AF_INET6;
@@ -405,8 +420,8 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
                        from_port = my_ts->get_from_port(my_ts);
                        to_port = my_ts->get_to_port(my_ts);
                        from_port = (from_port != to_port) ? 0 : from_port;
-                       policy->my_net = host_create_from_chunk(family, from_addr, from_port);
-                       policy->my_net_mask = my_ts->get_netmask(my_ts);
+                       policy->me.net = host_create_from_chunk(family, from_addr, from_port);
+                       policy->me.net_mask = my_ts->get_netmask(my_ts);
                        chunk_free(&from_addr);
                        
                        /* calculate net and ports for remote side */
@@ -415,41 +430,38 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
                        from_port = other_ts->get_from_port(other_ts);
                        to_port = other_ts->get_to_port(other_ts);
                        from_port = (from_port != to_port) ? 0 : from_port;
-                       policy->other_net = host_create_from_chunk(family, from_addr, from_port);
-                       policy->other_net_mask = other_ts->get_netmask(other_ts);
+                       policy->other.net = host_create_from_chunk(family, from_addr, from_port);
+                       policy->other.net_mask = other_ts->get_netmask(other_ts);
                        chunk_free(&from_addr);
        
                        /* install 3 policies: out, in and forward */
                        status = charon->kernel_interface->add_policy(charon->kernel_interface,
-                                       this->me, this->other,
-                                       policy->my_net, policy->other_net,
-                                       policy->my_net_mask, policy->other_net_mask,
+                                       this->me.addr, this->other.addr,
+                                       policy->me.net, policy->other.net,
+                                       policy->me.net_mask, policy->other.net_mask,
                                        XFRM_POLICY_OUT, policy->upper_proto,
-                                       this->my_ah_spi, this->my_esp_spi,
-                                       this->reqid);
+                                       this->protocol, this->reqid);
        
                        status |= charon->kernel_interface->add_policy(charon->kernel_interface,
-                                       this->other, this->me,
-                                       policy->other_net, policy->my_net,
-                                       policy->other_net_mask, policy->my_net_mask,
+                                       this->other.addr, this->me.addr,
+                                       policy->other.net, policy->me.net,
+                                       policy->other.net_mask, policy->me.net_mask,
                                        XFRM_POLICY_IN, policy->upper_proto,
-                                       this->my_ah_spi, this->my_esp_spi,
-                                       this->reqid);
+                                       this->protocol, this->reqid);
        
                        status |= charon->kernel_interface->add_policy(charon->kernel_interface,
-                                       this->other, this->me,
-                                       policy->other_net, policy->my_net,
-                                       policy->other_net_mask, policy->my_net_mask,
+                                       this->other.addr, this->me.addr,
+                                       policy->other.net, policy->me.net,
+                                       policy->other.net_mask, policy->me.net_mask,
                                        XFRM_POLICY_FWD, policy->upper_proto,
-                                       this->my_ah_spi, this->my_esp_spi,
-                                       this->reqid);
+                                       this->protocol, this->reqid);
                        
                        if (status != SUCCESS)
                        {
                                my_iter->destroy(my_iter);
                                other_iter->destroy(other_iter);
-                               policy->my_net->destroy(policy->my_net);
-                               policy->other_net->destroy(policy->other_net);
+                               policy->me.net->destroy(policy->me.net);
+                               policy->other.net->destroy(policy->other.net);
                                free(policy);
                                return status;
                        }
@@ -458,35 +470,165 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
                        this->policies->insert_last(this->policies, policy);
                }
        }
-
        my_iter->destroy(my_iter);
        other_iter->destroy(other_iter);
        return SUCCESS;
 }
 
 /**
- * Implementation of child_sa_t.log_status.
+ * Implementation of child_sa_t.set_rekeyed.
  */
-static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
+static void set_rekeyed(private_child_sa_t *this)
+{
+       this->rekeyed = TRUE;
+}
+
+/**
+ * Implementation of child_sa_t.get_use_time
+ */
+static status_t get_use_time(private_child_sa_t *this, bool inbound, time_t *use_time)
 {
        iterator_t *iterator;
        sa_policy_t *policy;
        struct protoent *proto;
        char proto_buf[8] = "";
        char *proto_name = proto_buf;
+       status_t status;
+       
+       *use_time = UNDEFINED_TIME;
+
+       iterator = this->policies->create_iterator(this->policies, TRUE);
+       while (iterator->iterate(iterator, (void**)&policy))
+       {
+               time_t ut;
+
+               if (policy->upper_proto)
+               {
+                       proto = getprotobynumber(policy->upper_proto);
+                       if (proto)
+                       {
+                               proto_name = proto->p_name;
+                       }
+                       else
+                       {
+                               snprintf(proto_buf, sizeof(proto_buf), "<%d>", policy->upper_proto);
+                       }
+               }
+               
+               this->logger->log(this->logger, CONTROL|LEVEL1,
+                                       "querying policy:     %s/%d==%s==%s/%d",
+                                       policy->me.net->get_address(policy->me.net), policy->me.net_mask,
+                                       proto_name,
+                                       policy->other.net->get_address(policy->other.net), policy->other.net_mask);
+
+               if (inbound) 
+               {
+                       status = charon->kernel_interface->query_policy(charon->kernel_interface,
+                                               this->other.addr, this->me.addr,
+                                               policy->other.net, policy->me.net,
+                                               policy->other.net_mask, policy->me.net_mask,
+                                               XFRM_POLICY_IN, policy->upper_proto,
+                                               &ut);
+       
+                       /* also check forward policy in tunnel mode */
+                       if (status == SUCCESS /*&& mode == TUNNEL XXX */)
+                       {
+                               time_t fwd;
+
+                               status = charon->kernel_interface->query_policy(charon->kernel_interface,
+                                                       this->other.addr, this->me.addr,
+                                                       policy->other.net, policy->me.net,
+                                                       policy->other.net_mask, policy->me.net_mask,
+                                                       XFRM_POLICY_FWD, policy->upper_proto,
+                                                       &fwd);
+                       
+                               if (status == SUCCESS)
+                               {
+                                       ut = max(ut, fwd);
+                               }
+                       }
+               }
+               else 
+               {
+                       status = charon->kernel_interface->query_policy(charon->kernel_interface,
+                                               this->me.addr, this->other.addr,
+                                               policy->me.net, policy->other.net,
+                                               policy->me.net_mask, policy->other.net_mask,
+                                               XFRM_POLICY_OUT, policy->upper_proto,
+                                               &ut);
+               }
+               
+               if (status != SUCCESS)
+               {
+                       iterator->destroy(iterator);
+                       return FAILED;
+               }
+
+               *use_time = max(*use_time, ut);
+       }
+       iterator->destroy(iterator);
+       
+       return SUCCESS;
+}
+
+/**
+ * Implementation of child_sa_t.log_status.
+ */
+static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
+{
+       iterator_t *iterator;
+       char use_in_str[12] = "unused";
+       char use_out_str[12] = "unused";
+       char rekey_str[12] = "disabled";
+       time_t use_in, use_out, now, rekeying;
        
        if (logger == NULL)
        {
                logger = this->logger;
        }
-       logger->log(logger, CONTROL|LEVEL1, "  \"%s\":   protected with ESP (0x%x/0x%x), AH (0x%x,0x%x):",
+       now = time(NULL);
+       get_use_time(this, TRUE, &use_in);
+       if (use_in)
+       {
+               snprintf(use_in_str, sizeof(use_in_str), "%ds", (int)(now - use_in));
+       }
+       get_use_time(this, FALSE, &use_out);
+       if (use_out)
+       {
+               snprintf(use_out_str, sizeof(use_out_str), "%ds", (int)(now - use_out));
+       }
+       if (this->soft_lifetime)
+       {
+               rekeying = this->soft_lifetime - (now - this->install_time);
+               snprintf(rekey_str, sizeof(rekey_str), "%ds", (int)rekeying);
+       }
+       
+       logger->log(logger, CONTROL|LEVEL1, 
+                               "  \"%s\":   using %s, SPIs (in/out): 0x%x/0x%x, reqid: %d",
                                name,
-                               htonl(this->my_esp_spi), htonl(this->other_esp_spi), 
-                               htonl(this->my_ah_spi), htonl(this->other_ah_spi));
+                               this->protocol == PROTO_ESP ? "ESP" : "AH",
+                               htonl(this->me.spi), htonl(this->other.spi),
+                               this->reqid);
+       
+       logger->log(logger, CONTROL|LEVEL1, 
+                               "  \"%s\":   rekeying: %s, last traffic (in/out): %s/%s",
+                               name, rekey_str, use_in_str, use_out_str);
+       
        iterator = this->policies->create_iterator(this->policies, TRUE);
        while (iterator->has_next(iterator))
        {
+               sa_policy_t *policy;
+               struct protoent *proto;
+               char proto_str[8] = "";
+               char *proto_name = proto_str;
+               char my_net_str[8] = "";
+               char other_net_str[8] = "";
+               char my_port_str[8] = "";
+               char other_port_str[8] = "";
+               u_int16_t my_port, other_port;
+               
                iterator->current(iterator, (void**)&policy);
+               
                if (policy->upper_proto)
                {
                        proto = getprotobynumber(policy->upper_proto);
@@ -496,95 +638,294 @@ static void log_status(private_child_sa_t *this, logger_t *logger, char* name)
                        }
                        else
                        {
-                               snprintf(proto_buf, sizeof(proto_buf), "<%d>", policy->upper_proto);
+                               snprintf(proto_str, sizeof(proto_str), "%d", policy->upper_proto);
                        }
                }
-               logger->log(logger, CONTROL, "  \"%s\":     %s/%d==%s==%s/%d",
+               if (policy->me.net_mask != 32)
+               {
+                       snprintf(my_net_str, sizeof(my_net_str), "/%d", policy->me.net_mask);
+               }
+               if (policy->other.net_mask != 32)
+               {
+                       snprintf(other_net_str, sizeof(other_net_str), "/%d", policy->other.net_mask);
+               }
+               my_port = policy->me.net->get_port(policy->me.net);
+               other_port = policy->other.net->get_port(policy->other.net);
+               if (my_port)
+               {
+                       snprintf(my_port_str, sizeof(my_port_str), ":%d", my_port);
+               }
+               if (other_port)
+               {
+                       snprintf(other_port_str, sizeof(other_port_str), ":%d", other_port);
+               }
+               
+               logger->log(logger, CONTROL, "  \"%s\":     %s%s%s==%s==%s%s%s",
                                        name,
-                                       policy->my_net->get_address(policy->my_net), policy->my_net_mask,
+                                       policy->me.net->get_address(policy->me.net), 
+                                       my_port_str, my_net_str,
                                        proto_name,
-                                       policy->other_net->get_address(policy->other_net), policy->other_net_mask);
+                                       policy->other.net->get_address(policy->other.net), 
+                                       other_port_str, other_net_str);
        }
        iterator->destroy(iterator);
 }
 
 /**
- * Implementation of child_sa_t.destroy.
+ * Update the host adress/port of a SA
  */
-static void destroy(private_child_sa_t *this)
+static status_t update_sa_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other, 
+                                                               int my_changes, int other_changes, bool mine)
 {
-       /* delete all policies in the kernel */
+       host_t *src, *dst, *new_src, *new_dst;
+       int src_changes, dst_changes;
+       status_t status;
+       u_int32_t spi;
+       
+       if (mine)
+       {
+               src = this->me.addr;
+               dst = this->other.addr;
+               new_src = new_me;
+               new_dst = new_other;
+               src_changes = my_changes;
+               dst_changes = other_changes;
+               spi = this->me.spi;
+       }
+       else
+       {
+               src = this->other.addr;
+               dst = this->me.addr;
+               new_src = new_other;
+               new_dst = new_me;
+               src_changes = other_changes;
+               dst_changes = my_changes;
+               spi = this->other.spi;
+       }
+       
+       this->logger->log(this->logger, CONTROL|LEVEL1,
+                                         "updating %s SA 0x%x, from %s:%d..%s:%d to %s:%d..%s:%d",
+                                         mapping_find(protocol_id_m, this->protocol), ntohl(spi),
+                                         src->get_address(src), src->get_port(src),
+                                         dst->get_address(dst), dst->get_port(dst),
+                                         new_src->get_address(new_src), new_src->get_port(new_src),
+                                         new_dst->get_address(new_dst), new_dst->get_port(new_dst));
+       
+       status = charon->kernel_interface->update_sa_hosts(
+                                               charon->kernel_interface,
+                                               src, dst, new_src, new_dst, 
+                                               src_changes, dst_changes,
+                                               spi, this->protocol);
+       
+       if (status != SUCCESS)
+       {
+               return FAILED;
+       }
+       return SUCCESS;
+}
+
+/**
+ * Update the host adress/port of a policy
+ */
+static status_t update_policy_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other)
+{
+       iterator_t *iterator;
        sa_policy_t *policy;
-       while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
+       status_t status;
+       
+       iterator = this->policies->create_iterator(this->policies, TRUE);
+       while (iterator->iterate(iterator, (void**)&policy))
        {
-               charon->kernel_interface->del_policy(charon->kernel_interface,
-                                                                                        this->me, this->other,
-                                                                                        policy->my_net, policy->other_net,
-                                                                                        policy->my_net_mask, policy->other_net_mask,
-                                                                                        XFRM_POLICY_OUT, policy->upper_proto);
-               
-               charon->kernel_interface->del_policy(charon->kernel_interface,
-                                                                                        this->other, this->me,
-                                                                                        policy->other_net, policy->my_net,
-                                                                                        policy->other_net_mask, policy->my_net_mask,
-                                                                                        XFRM_POLICY_IN, policy->upper_proto);
+               this->logger->log(this->logger, CONTROL|LEVEL1,
+                                                 "updating policy:   %s/%d====%s/%d",
+                                                 policy->me.net->get_address(policy->me.net), policy->me.net_mask,
+                                                 policy->other.net->get_address(policy->other.net), policy->other.net_mask);
+
+               status = charon->kernel_interface->add_policy(
+                               charon->kernel_interface,
+                               new_me, new_other,
+                               policy->me.net, policy->other.net,
+                               policy->me.net_mask, policy->other.net_mask,
+                               XFRM_POLICY_OUT, policy->upper_proto,
+                               this->protocol, this->reqid);
                
-               charon->kernel_interface->del_policy(charon->kernel_interface,
-                                                                                        this->other, this->me,
-                                                                                        policy->other_net, policy->my_net,
-                                                                                        policy->other_net_mask, policy->my_net_mask,
-                                                                                        XFRM_POLICY_FWD, policy->upper_proto);
+               status |= charon->kernel_interface->add_policy(
+                               charon->kernel_interface,
+                               new_other, new_me,
+                               policy->other.net, policy->me.net,
+                               policy->other.net_mask, policy->me.net_mask,
+                               XFRM_POLICY_IN, policy->upper_proto,
+                               this->protocol, this->reqid);
                
-               policy->my_net->destroy(policy->my_net);
-               policy->other_net->destroy(policy->other_net);
-               free(policy);
+               status |= charon->kernel_interface->add_policy(
+                               charon->kernel_interface,
+                               new_other, new_me,
+                               policy->other.net, policy->me.net,
+                               policy->other.net_mask, policy->me.net_mask,
+                               XFRM_POLICY_FWD, policy->upper_proto,
+                               this->protocol, this->reqid);
+
+               if (status != SUCCESS)
+               {
+                       iterator->destroy(iterator);
+                       return FAILED;
+               }
        }
-       this->policies->destroy(this->policies);
+       iterator->destroy(iterator);
+
+       return SUCCESS;         
+}
+
+/**
+ * Implementation of child_sa_t.update_hosts.
+ */
+static status_t update_hosts(private_child_sa_t *this, host_t *new_me, host_t *new_other, 
+                                                        int my_changes, int other_changes) 
+{
+       if (!my_changes || !other_changes)
+       {
+               return SUCCESS;
+       }
+
+       /* update our (initator) SAs */
+       if (update_sa_hosts(this, new_me, new_other, my_changes, other_changes, TRUE) != SUCCESS)
+       {
+               return FAILED;
+       }
+
+       /* update his (responder) SAs */
+       if (update_sa_hosts(this, new_me, new_other, my_changes, other_changes, FALSE) != SUCCESS)
+       {
+               return FAILED;
+       }
+       
+       /* update policies */
+       if (my_changes & HOST_DIFF_ADDR || other_changes & HOST_DIFF_ADDR)
+       {
+               if (update_policy_hosts(this, new_me, new_other) != SUCCESS)
+               {
+                       return FAILED;
+               }
+       }
+
+       /* update hosts */
+       if (my_changes)
+       {
+               this->me.addr->destroy(this->me.addr);
+               this->me.addr = new_me->clone(new_me);
+       }
+
+       if (other_changes)
+       {
+               this->other.addr->destroy(this->other.addr);
+               this->other.addr = new_other->clone(new_other);
+       }       
+
+       return SUCCESS;
+}
+
+/**
+ * Implementation of child_sa_t.destroy.
+ */
+static void destroy(private_child_sa_t *this)
+{
+       sa_policy_t *policy;
        
        /* delete SAs in the kernel, if they are set up */
-       if (this->my_ah_spi)
+       if (this->me.spi)
        {
                charon->kernel_interface->del_sa(charon->kernel_interface,
-                                                                                this->other, this->my_ah_spi, PROTO_AH);
+                                                                                this->me.addr, this->me.spi, this->protocol);
+       }
+       if (this->alloc_esp_spi && this->alloc_esp_spi != this->me.spi)
+       {
                charon->kernel_interface->del_sa(charon->kernel_interface,
-                                                                                this->me, this->other_ah_spi, PROTO_AH);
+                                                                                this->me.addr, this->alloc_esp_spi, PROTO_ESP);
        }
-       if (this->my_esp_spi)
+       if (this->alloc_ah_spi && this->alloc_ah_spi != this->me.spi)
        {
                charon->kernel_interface->del_sa(charon->kernel_interface,
-                                                                                this->other, this->my_esp_spi, PROTO_ESP);
+                                                                                this->me.addr, this->alloc_ah_spi, PROTO_AH);
+       }
+       if (this->other.spi)
+       {
                charon->kernel_interface->del_sa(charon->kernel_interface,
-                                                                                this->me, this->other_esp_spi, PROTO_ESP);
+                                                                                this->other.addr, this->other.spi, this->protocol);
        }
+       
+       /* delete all policies in the kernel */
+       while (this->policies->remove_last(this->policies, (void**)&policy) == SUCCESS)
+       {
+               if (!this->rekeyed)
+               {       
+                       /* let rekeyed policies, as they are used by another child_sa */
+                       charon->kernel_interface->del_policy(charon->kernel_interface,
+                                                                                               this->me.addr, this->other.addr,
+                                                                                               policy->me.net, policy->other.net,
+                                                                                               policy->me.net_mask, policy->other.net_mask,
+                                                                                               XFRM_POLICY_OUT, policy->upper_proto);
+                       
+                       charon->kernel_interface->del_policy(charon->kernel_interface,
+                                                                                               this->other.addr, this->me.addr,
+                                                                                               policy->other.net, policy->me.net,
+                                                                                               policy->other.net_mask, policy->me.net_mask,
+                                                                                               XFRM_POLICY_IN, policy->upper_proto);
+                       
+                       charon->kernel_interface->del_policy(charon->kernel_interface,
+                                                                                               this->other.addr, this->me.addr,
+                                                                                               policy->other.net, policy->me.net,
+                                                                                               policy->other.net_mask, policy->me.net_mask,
+                                                                                               XFRM_POLICY_FWD, policy->upper_proto);
+               }
+               policy->me.net->destroy(policy->me.net);
+               policy->other.net->destroy(policy->other.net);
+               free(policy);
+       }
+       this->policies->destroy(this->policies);
+
        free(this);
 }
 
 /*
  * Described in header.
  */
-child_sa_t * child_sa_create(host_t *me, host_t* other)
+child_sa_t * child_sa_create(u_int32_t rekey, host_t *me, host_t* other, 
+                                                        u_int32_t soft_lifetime, u_int32_t hard_lifetime,
+                                                        bool use_natt)
 {
-       static u_int32_t reqid = 0xc0000000;
+       static u_int32_t reqid = REQID_START;
        private_child_sa_t *this = malloc_thing(private_child_sa_t);
 
        /* public functions */
+       this->public.get_reqid = (u_int32_t(*)(child_sa_t*))get_reqid;
+       this->public.get_spi = (u_int32_t(*)(child_sa_t*, bool))get_spi;
+       this->public.get_protocol = (protocol_id_t(*)(child_sa_t*))get_protocol;
        this->public.alloc = (status_t(*)(child_sa_t*,linked_list_t*))alloc;
        this->public.add = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))add;
        this->public.update = (status_t(*)(child_sa_t*,proposal_t*,prf_plus_t*))update;
+       this->public.update_hosts = (status_t (*)(child_sa_t*,host_t*,host_t*,int,int))update_hosts;
        this->public.add_policies = (status_t (*)(child_sa_t*, linked_list_t*,linked_list_t*))add_policies;
+       this->public.get_use_time = (status_t (*)(child_sa_t*,bool,time_t*))get_use_time;
+       this->public.set_rekeyed = (void (*)(child_sa_t*))set_rekeyed;
        this->public.log_status = (void (*)(child_sa_t*, logger_t*, char*))log_status;
        this->public.destroy = (void(*)(child_sa_t*))destroy;
 
        /* private data */
        this->logger = logger_manager->get_logger(logger_manager, CHILD_SA);
-       this->me = me;
-       this->other = other;
-       this->my_ah_spi = 0;
-       this->my_esp_spi = 0;
-       this->other_ah_spi = 0;
-       this->other_esp_spi = 0;
-       this->reqid = reqid++;
+       this->me.addr = me;
+       this->other.addr = other;
+       this->me.spi = 0;
+       this->other.spi = 0;
+       this->alloc_ah_spi = 0;
+       this->alloc_esp_spi = 0;
+       this->use_natt = use_natt;
+       this->soft_lifetime = soft_lifetime;
+       this->hard_lifetime = hard_lifetime;
+       /* reuse old reqid if we are rekeying an existing CHILD_SA */
+       this->reqid = rekey ? rekey : ++reqid;
        this->policies = linked_list_create();
+       this->protocol = PROTO_NONE;
+       this->rekeyed = FALSE;
        
-       return (&this->public);
+       return &this->public;
 }