iked(8) uses 3 hours and 512 megabytes of processed data as default
lifetime hard limits for Child SA. Also it sets 85-95% of these values as
soft limit. iked(8) should perform rekeying before we reach hard limit
otherwise this SA will be killed and the tunnel stopped. With default
values the window is only 25-52 megabytes and we easily consume them
before rekeying and the tunnel stops.
Hrvoje Popovski complained about such stops when he has tested ipsec(4)
related diffs. I also tried iked(8) with my macos and found that simple
"ping -f ..." makes rekeying impossible.
The hard limit could be modified in iked.conf(5) by setting "lifetime
xxx bytes yyy", but the 5% difference between hard and soft limits forces
to set bytes limit big enough, about 4G and more, which could be bad for
security reason.
I propose to increase the default hard limit at least up to 1G. Also I
propose to decrease the soft limit down to 50-60% of hard limit. This
keeps the rekeying frequency but increases the update window to 410-512
megabytes. Also this allow to keep bytes in "lifetime" setting small
enough.
Index: sbin/iked/iked.conf.5
===================================================================
RCS file: /cvs/src/sbin/iked/iked.conf.5,v
retrieving revision 1.85
diff -u -p -r1.85 iked.conf.5
--- sbin/iked/iked.conf.5 11 Apr 2021 23:27:06 -0000 1.85
+++ sbin/iked/iked.conf.5 2 Aug 2021 21:41:55 -0000
@@ -586,8 +586,8 @@ parameter defines the Child SA expiratio
SA was in use and by the number of
.Ar bytes
that were processed using the SA.
-Default values are 3 hours and 512 megabytes which means that SA will be
-rekeyed before reaching the time limit or 512 megabytes of data
+Default values are 3 hours and 1024 megabytes which means that SA will be
+rekeyed before reaching the time limit or 1024 megabytes of data
will pass through.
Zero values disable rekeying.
.Pp
Index: sbin/iked/pfkey.c
===================================================================
RCS file: /cvs/src/sbin/iked/pfkey.c,v
retrieving revision 1.77
diff -u -p -r1.77 pfkey.c
--- sbin/iked/pfkey.c 2 Mar 2021 03:31:25 -0000 1.77
+++ sbin/iked/pfkey.c 2 Aug 2021 21:41:55 -0000
@@ -603,8 +603,8 @@ pfkey_sa(int sd, uint8_t satype, uint8_t
sa_ltime_soft.sadb_lifetime_exttype = SADB_EXT_LIFETIME_SOFT;
sa_ltime_soft.sadb_lifetime_len = sizeof(sa_ltime_soft) / 8;
- /* set randomly to 85-95% */
- jitter = 850 + arc4random_uniform(100);
+ /* set randomly to 50-60% */
+ jitter = 500 + arc4random_uniform(100);
sa_ltime_soft.sadb_lifetime_bytes =
(sa_ltime_hard.sadb_lifetime_bytes * jitter) / 1000;
sa_ltime_soft.sadb_lifetime_addtime =
Index: sbin/iked/types.h
===================================================================
RCS file: /cvs/src/sbin/iked/types.h,v
retrieving revision 1.43
diff -u -p -r1.43 types.h
--- sbin/iked/types.h 13 May 2021 15:20:48 -0000 1.43
+++ sbin/iked/types.h 2 Aug 2021 21:41:55 -0000
@@ -67,7 +67,7 @@
#define IKED_CYCLE_BUFFERS 8 /* # of static buffers for mapping */
#define IKED_PASSWORD_SIZE 256 /* limited by most EAP types */
-#define IKED_LIFETIME_BYTES 536870912 /* 512 Mb */
+#define IKED_LIFETIME_BYTES 1073741824 /* 512 Mb */
#define IKED_LIFETIME_SECONDS 10800 /* 3 hours */
#define IKED_E 0x1000 /* Decrypted flag */
