References: <ee5a8207241568cedcccc4f7f2ea5bc8.squirrel@...2257...>
	<b6bac00d6d7260eea944814b0c995806.squirrel@...2257...>
	<53a21cf3f4e04fcf5d6b9798e04be3ce.squirrel@...2257...>
	<20170404064534.GC93896@...1296...>
	<6b3b8a029cd8761642ac3f8174238aa2.squirrel@...2260...>
	<063244418e0b88138db5b490037cb7a4.squirrel@...2257...>
	<267890da-2186-dddb-d4c4-d6374da7e086@...277...>
	<049b9d27-d6a4-41cf-9742-bed02b2cc39b@...2080...>
	<18a96a72-4778-22b3-8a57-ce87d3f7060b@...2080...>
	<11253b26-cb11-8b7a-02e0-d5b1ad89e199@...277...>
	<2465b076-35e8-6144-f1b8-085ad5a016f0@...277...>
	<e09e9fbc1ce629510c439bbc06569b1a.squirrel@...2260...>
From: Arne Schwabe <arne@...1227...>
Message-ID: <f6a87e19-4ac0-4ea2-69f3-2f424cbe8891@...1227...>
Date: Wed, 5 Apr 2017 19:13:26 +0200
MIME-Version: 1.0
In-Reply-To: <e09e9fbc1ce629510c439bbc06569b1a.squirrel@...2260...>
Subject: Re: [Openvpn-devel] [PATCH v2] Add per session pseudo-random
 component to --reneg-sec intervals
List-Id: <openvpn-devel.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/openvpn-devel>, 
	<mailto:openvpn-devel-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=openvpn-devel>
List-Post: <mailto:openvpn-devel@lists.sourceforge.net>
List-Help: <mailto:openvpn-devel-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/openvpn-devel>, 
	<mailto:openvpn-devel-request@lists.sourceforge.net?subject=subscribe>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 7bit
To: Simon Matter <simon.matter@...2249...>, debbie10t <debbie10t@...277...>
Cc: openvpn-devel@lists.sourceforge.net


>>
>> Where RAND indicates that the first-run timer should run from a random
>> integer from 1 upto the value of --reneg-sec.  RAND does not require a
>> user to specify an amount.
> 
> But then, why not just do it always and forget about the additional option?
> 

Optional option does not mean that it is disabled by default. If you
don't the randomness you would need to do:

reneg-sec 3600 3600

the optional argument also allows it to fine tune it to your needs.

Arne