Fix 963

[TC1977]

Description

Much pain and debugging of #963 over the last several months led me to conclude that the "Connecting..." loop is mainly one of outgoing policies not being deleted properly by strongSwan. It seems to happen most frequently when the client switches between Wi-Fi/LTE, often when there's a poor connection with either. The best way to resolve this may be to make the connection itself longer-lived, by changing settings on both the server and iOS/macOS side.

• .mobileconfig settings restored to the Apple default of 1440m
• server-side settings in /etc/ipsec.conf changed to lifetime=3h, ikelifetime=12h.
• Settings in /etc/strongswan.d/charon.conf changed to close_ike_on_child_failure = yes, half_open_timeout = 5, inactivity_close_ike = yes, and (NAT) keep_alive = 25, reuse_ikesa = yes.

Motivation and Context

Makes strongSwan connections longer-lived, introduces charon.conf installation for future modifications if needed. Read the saga of #963 if you like.

How Has This Been Tested?

Ran Algo server since late November with the current configuration. No "unable to install policy...same policy for reqid xxx exists" errors. Today: cloud installed this branch from a Mac onto AWS, no installation errors, mobileconfigs appropriately modified, /etc/ipsec.conf and /etc/strongswan.d/charon.conf also appropriately installed. mobileconfig installed onto iPhone running 12.1.4, no issues, websites load successfully.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• [] New feature (non-breaking change which adds functionality)
• [] Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• I have read the CONTRIBUTING document.
• My code follows the code style of this project.
• All new and existing tests passed.

[CLAassistant]

Thank you for your submission, we really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
10 out of 13 committers have signed the CLA.

✅ davidemyers
✅ luvpreetsingh
✅ selimsumlu
✅ jackivanov
✅ dguido
✅ bshiznit
✅ tho
✅ faf0
✅ TC1977
✅ adamluk
❌ thde
❌ akerl
❌ tc1977

---

tc1977 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[TC1977]

So, I tried to rebase this and remove the commits by 'tc1977' (no idea why that happened), and it obviously didn't work. Help?

[TC1977]

I was able to use force-push to sync my fork with upstream, but have no idea how to preserve these commits (and change the author). So I made a clean branch. See #1379.