(racoon 808) Re: Dual, synchronous quick mode

[Yves-Emmanuel Jutard <ye.jutard@gmail.com>]

So, the creation of redundant SA following a rekeying collision is
only a bug ? Great ! How can we solve it ?

My system will consist of 5000 hosts communicating with a server
running racoon. Communications are protected with IPsec, and keys are
negotiated with IKE, transport. The server's ressources are carefully
calculated to handle up to 5000 SP and 5000 IKE_SA+IPsec_SA. Only one
IKE_SA and one IPsec_SA can be stored along their corresponding SP
(it's a custom made SADB). Of course, each host have the same lifetime
infos (giving a different lifetime to each host is unacceptable)

Currently, the redundant SA problem cause my system to hang, because
each host only store the latest IPsec SA it has negociated, and the
redundant SA are negociated in different order on each host (cf. my
diagram in the first mail of this thread)

So each host, after rekeying simultaneously, come up with a different
SA, and thus are unable to communicate any further.

You say that one of the two IPsec SA must be closed, but which one ?
How can I make sure that each host will close the same IPsec SA ? How
do I ensure that I remain compatible with other IKEv1 implementations
?

Eventually, is it possible to discard an Ipsec SA before writing it to
the SADB or must I necessarily make room for several IPsec_SA ?

I've turned this over in my poor mind, without finding an acceptable
solution. I look forward to hear yours.

Yves-Emmanuel.