config: align default values with sample.config

Several options had hardcoded or named defaults in apply_default_conf()
that diverged from the values documented in doc/sample.config, leading
to silent behaviour differences for servers running without explicit
configuration.

Relates: #680

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

NEWS

@@ -19,6 +19,10 @@
   attempt in the same session (#323)
 - Aligned the default values for 'dpd' and 'mobile-dpd' options with
   the values present in the default configuration (#680)
+- Aligned default values for 'keepalive', 'rekey-time', 'cookie-timeout',
+  'auth-timeout', 'ban-reset-time', 'max-ban-score', and
+  'switch-to-tcp-timeout' with the values documented in sample.config
+
 
 * Version 1.4.1 (released 2026-02-28)
 - [SECURITY] Fixed authentication bypass (medium severity) when combined

doc/sample.config

@@ -291,8 +291,7 @@ mobile-dpd = 1800
 # many seconds, attempt to send future traffic over the TCP
 # connection instead, in an attempt to wake up the client
 # in the case that there is a NAT and the UDP translation
-# was deleted. If this is unset, do not attempt to use this
-# recovery mechanism.
+# was deleted. Set to zero to disable this recovery mechanism.
 # [scope: vhost]
 switch-to-tcp-timeout = 25
 

src/config.c

@@ -651,7 +651,7 @@ static void apply_default_conf(vhost_cfg_st *vhost, unsigned int reload)
 	vhost->perm_config.config->no_compress_limit =
 		DEFAULT_NO_COMPRESS_LIMIT;
 #endif
-	vhost->perm_config.config->rekey_time = 24 * 60 * 60;
+	vhost->perm_config.config->rekey_time = DEFAULT_REKEY_TIME;
 	vhost->perm_config.config->cookie_timeout =
 		DEFAULT_COOKIE_RECON_TIMEOUT;
 	vhost->perm_config.config->auth_timeout = DEFAULT_AUTH_TIMEOUT_SECS;
@@ -668,7 +668,9 @@ static void apply_default_conf(vhost_cfg_st *vhost, unsigned int reload)
 	vhost->perm_config.config->dtls_psk = 1;
 	vhost->perm_config.config->predictable_ips = 1;
 	vhost->perm_config.config->use_utmp = 1;
-	vhost->perm_config.config->keepalive = 3600;
+	vhost->perm_config.config->keepalive = DEFAULT_KEEPALIVE_TIME;
+	vhost->perm_config.config->switch_to_tcp_timeout =
+		DEFAULT_SWITCH_TO_TCP_TIMEOUT;
 	vhost->perm_config.config->mobile_dpd = DEFAULT_MOBILE_DPD_TIME;
 }
 

src/vpn.h

@@ -89,19 +89,23 @@ inline static const char *proto_to_str(fw_proto_t proto)
 #define DEFAULT_PASSWORD_POINTS 10
 #define DEFAULT_CONNECT_POINTS 1
 #define DEFAULT_KKDCP_POINTS 1
-#define DEFAULT_MAX_BAN_SCORE (MAX_PASSWORD_TRIES * DEFAULT_PASSWORD_POINTS)
+#define DEFAULT_MAX_BAN_SCORE 80
 #define DEFAULT_BAN_TIME 300
-#define DEFAULT_BAN_RESET_TIME 300
+#define DEFAULT_BAN_RESET_TIME 1200
 
 #define MIN_NO_COMPRESS_LIMIT 64
 #define DEFAULT_NO_COMPRESS_LIMIT 256
 
 /* The time after which a user will be forced to authenticate
  * or disconnect. */
-#define DEFAULT_AUTH_TIMEOUT_SECS 1800
+#define DEFAULT_AUTH_TIMEOUT_SECS 240
 
 /* The time after a disconnection the cookie is valid */
-#define DEFAULT_COOKIE_RECON_TIMEOUT 120
+#define DEFAULT_COOKIE_RECON_TIMEOUT 300
+
+#define DEFAULT_KEEPALIVE_TIME 32400
+#define DEFAULT_REKEY_TIME 172800
+#define DEFAULT_SWITCH_TO_TCP_TIMEOUT 25
 
 #define DEFAULT_DPD_TIME 90
 #define DEFAULT_MOBILE_DPD_TIME 1800