Set SPI Allocation Timeout to One Hour
This change increases the default expiration length of an SA to 1h. The
IPsec API expects that SPIs are allocated indefinitely, but potential
for instability requires that these get cleaned up automatically. As
such, the duration was chosen as a sane, but long timeout value.
Bug: 72316671
Test: Added CTS tests to enforce this behavior
Merged-In: I47aef9cea4a09da253b2ec048a8797af5fa25529
Change-Id: I47aef9cea4a09da253b2ec048a8797af5fa25529
(cherry picked from commit 00308f85540ec1e3557e991811e220455290e4d3)
diff --git a/rootdir/init.rc b/rootdir/init.rc
index 4d823ea..3bbc506 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -576,6 +576,9 @@
hostname localhost
domainname localdomain
+ # IPsec SA default expiration length
+ write /proc/sys/net/core/xfrm_acq_expires 3600
+
# Memory management. Basic kernel parameters, and allow the high
# level system server to be able to adjust the kernel OOM driver
# parameters to match how it is managing things.