aboutsummaryrefslogtreecommitdiffstats
path: root/man/ipsec.conf.5.in
diff options
context:
space:
mode:
authorMartin Willi <martin@revosec.ch>2013-11-07 09:21:02 +0100
committerMartin Willi <martin@revosec.ch>2014-01-23 16:19:22 +0100
commitd048a319df412ee7966a898caed2ac93f0eae1b1 (patch)
treee8d866167514de48dffd9c6d8b63054d9d6c7580 /man/ipsec.conf.5.in
parent763e035335169872cd9681d46b24fa1120ea925d (diff)
downloadstrongswan-d048a319df412ee7966a898caed2ac93f0eae1b1.tar.bz2
strongswan-d048a319df412ee7966a898caed2ac93f0eae1b1.tar.xz
ike: Restart inactivity counter after doing a CHILD_SA rekey
When doing a rekey for a CHILD_SA, the use counters get reset. An inactivity job is queued for a time unrelated to the rekey time, so it might happen that the inactivity job gets executed just after rekeying. If this happens, inactivity is detected even if we had traffic on the rekeyed CHILD_SA just before rekeying. This change implies that inactivity checks can't handle inactivity timeouts for rekeyed CHILD_SAs, and therefore requires that inactivity timeout is shorter than the rekey time to have any effect.
Diffstat (limited to 'man/ipsec.conf.5.in')
-rw-r--r--man/ipsec.conf.5.in4
1 files changed, 3 insertions, 1 deletions
diff --git a/man/ipsec.conf.5.in b/man/ipsec.conf.5.in
index 92be67000..a0be75536 100644
--- a/man/ipsec.conf.5.in
+++ b/man/ipsec.conf.5.in
@@ -386,7 +386,9 @@ retransmission timeout applies, as every exchange is used to detect dead peers.
.TP
.BR inactivity " = <time>"
defines the timeout interval, after which a CHILD_SA is closed if it did
-not send or receive any traffic.
+not send or receive any traffic. The inactivity counter is reset during CHILD_SA
+rekeying. This means that the inactivity timeout must be smaller than the
+rekeying interval to have any effect.
.TP
.BR eap_identity " = <id>"
defines the identity the client uses to reply to an EAP Identity request.