diff --git a/src/config.c b/src/config.c index f585b1e..d2e2fe6 100644 --- a/src/config.c +++ b/src/config.c @@ -349,7 +349,7 @@ static const char *config_def_udp_port(void) static const char *config_def_dpd_idle(void) { - return "300"; + return "600"; } static const char *config_ca_dir(void) diff --git a/src/tunip.c b/src/tunip.c index 8902868..7c53337 100644 --- a/src/tunip.c +++ b/src/tunip.c @@ -955,7 +955,7 @@ static void vpnc_main_loop(struct sa_block *s) time_t now = time(NULL); if (s->ike.dpd_seqno != s->ike.dpd_seqno_ack) { /* Wake up more often for dpd attempts */ - select_timeout.tv_sec = 5; + select_timeout.tv_sec = s->ike.dpd_idle/10; select_timeout.tv_usec = 0; dpd_ike(s); next_ike_dpd = now + s->ike.dpd_idle; @@ -1029,8 +1029,8 @@ static void vpnc_main_loop(struct sa_block *s) if (s->ike.dpd_seqno != s->ike.dpd_seqno_ack) { dpd_ike(s); next_ike_dpd = now + s->ike.dpd_idle; - if (now + 5 < next_up) - next_up = now + 5; + if (now + s->ike.dpd_idle/10 < next_up) + next_up = now + s->ike.dpd_idle/10; } else if (now >= next_ike_dpd) { dpd_ike(s); diff --git a/src/vpnc.c b/src/vpnc.c index 6ab7a09..840047b 100644 --- a/src/vpnc.c +++ b/src/vpnc.c @@ -801,13 +801,13 @@ void dpd_ike(struct sa_block *s) send_dpd(s, 0, s->ike.dpd_seqno); } else { /* Our last dpd request has not yet been acked. If it's been - ** less than 5 seconds since we sent it do nothing. Otherwise + ** less than 1/10th of idle timeout since we sent it do nothing. Otherwise ** decrement dpd_attempts. If dpd_attempts is 0 dpd fails and we ** terminate otherwise we send it again with the same sequence ** number and record current time. */ time_t now = time(NULL); - if (now < s->ike.dpd_sent + 5) + if (now < s->ike.dpd_sent + s->ike.dpd_idle/10) return; if (--s->ike.dpd_attempts == 0) { DEBUG(2, printf("dead peer detected, terminating\n")); @@ -815,6 +815,8 @@ void dpd_ike(struct sa_block *s) return; } s->ike.dpd_sent = now; + if (s->ike.dpd_attempts == 3) + ++s->ike.dpd_seqno; /* maybe just the dpd reply got lost let's try new seq no */ send_dpd(s, 0, s->ike.dpd_seqno); } DEBUG(3, printf("sent DPD packet\n"));