From 2eb110f610c3648ae9ae84217ac031b2cabd4065 Mon Sep 17 00:00:00 2001 From: riccardom Date: Mon, 24 Aug 2026 13:58:22 +0200 Subject: [PATCH] Add comment to explain working boundaries --- client/internal/pqkem/manager.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/client/internal/pqkem/manager.go b/client/internal/pqkem/manager.go index 4e6ce3bbe..22123d2ce 100644 --- a/client/internal/pqkem/manager.go +++ b/client/internal/pqkem/manager.go @@ -27,6 +27,11 @@ const ( // REKEY_AFTER_TIME ~120s) so the rotation's own traffic — which itself renews the // activity signal — ages out before the next rekey, letting an idle tunnel stop // rotating instead of self-sustaining. + // + // INVARIANT: rotationActivityWindow < the gap between OnDataPathRekeyed calls. That + // gap converges to the WireGuard rehandshake interval (REKEY_AFTER_TIME 120s). Setting + // rotationActivityWindow to a value higher than 120s will make the rotation + // self-sustain (preventing going back to idle). Margin here is ~30s. rotationActivityWindow = 90 * time.Second )