We already allow to enable TFO without a cookie by using the fastopen-sysctl and setting it to TFO_SERVER_COOKIE_NOT_REQD (or TFO_CLIENT_NO_COOKIE). This is safe to do in certain environments where we know that there isn't a malicous host (aka., data-centers) or when the application-protocol already provides an authentication mechanism in the first flight of data. A server however might be providing multiple services or talking to both sides (public Internet and data-center). So, this server would want to enable cookie-less TFO for certain services and/or for connections that go to the data-center. This patch exposes a socket-option and a per-route attribute to enable such fine-grained configurations.
Showing the changes to include/uapi/linux (2 of 7 files). Show all
Unified · Split
| @@ -430,6 +430,8 @@ enum { · 429 unmodified lines | |||
| 430 | #define RTAX_QUICKACK RTAX_QUICKACK | 430 | #define RTAX_QUICKACK RTAX_QUICKACK |
| 431 | RTAX_CC_ALGO, | 431 | RTAX_CC_ALGO, |
| 432 | #define RTAX_CC_ALGO RTAX_CC_ALGO | 432 | #define RTAX_CC_ALGO RTAX_CC_ALGO |
| 433 | RTAX_FASTOPEN_NO_COOKIE, | ||
| 434 | #define RTAX_FASTOPEN_NO_COOKIE RTAX_FASTOPEN_NO_COOKIE | ||
| 433 | __RTAX_MAX | 435 | __RTAX_MAX |
| 434 | }; | 436 | }; |
| 435 | 437 | ||
| @@ -120,6 +120,7 @@ enum { · 119 unmodified lines | |||
| 120 | #define TCP_ULP 31 /* Attach a ULP to a TCP connection */ | 120 | #define TCP_ULP 31 /* Attach a ULP to a TCP connection */ |
| 121 | #define TCP_MD5SIG_EXT 32 /* TCP MD5 Signature with extensions */ | 121 | #define TCP_MD5SIG_EXT 32 /* TCP MD5 Signature with extensions */ |
| 122 | #define TCP_FASTOPEN_KEY 33 /* Set the key for Fast Open (cookie) */ | 122 | #define TCP_FASTOPEN_KEY 33 /* Set the key for Fast Open (cookie) */ |
| 123 | #define TCP_FASTOPEN_NO_COOKIE 34 /* Enable TFO without a TFO cookie */ | ||
| 123 | 124 | ||
| 124 | struct tcp_repair_opt { | 125 | struct tcp_repair_opt { |
| 125 | __u32 opt_code; | 126 | __u32 opt_code; |