We already allow to enable TFO without a cookie by using the fastopen-sysctl and setting it to TFO_SERVER_COOKIE_NOT_REQD (or TFO_CLIENT_NO_COOKIE). This is safe to do in certain environments where we know that there isn't a malicous host (aka., data-centers) or when the application-protocol already provides an authentication mechanism in the first flight of data. A server however might be providing multiple services or talking to both sides (public Internet and data-center). So, this server would want to enable cookie-less TFO for certain services and/or for connections that go to the data-center. This patch exposes a socket-option and a per-route attribute to enable such fine-grained configurations.
Showing the changes to include/uapi/linux (2 of 7 files). Show all
Unified · Split
| @@ -430,6 +430,8 @@ enum { · 429 unmodified lines | ||
| 430 | 430 | #define RTAX_QUICKACK RTAX_QUICKACK |
| 431 | 431 | RTAX_CC_ALGO, |
| 432 | 432 | #define RTAX_CC_ALGO RTAX_CC_ALGO |
| 433 | + RTAX_FASTOPEN_NO_COOKIE, | |
| 434 | +#define RTAX_FASTOPEN_NO_COOKIE RTAX_FASTOPEN_NO_COOKIE | |
| 433 | 435 | __RTAX_MAX |
| 434 | 436 | }; |
| 435 | 437 | |
| @@ -120,6 +120,7 @@ enum { · 119 unmodified lines | ||
| 120 | 120 | #define TCP_ULP 31 /* Attach a ULP to a TCP connection */ |
| 121 | 121 | #define TCP_MD5SIG_EXT 32 /* TCP MD5 Signature with extensions */ |
| 122 | 122 | #define TCP_FASTOPEN_KEY 33 /* Set the key for Fast Open (cookie) */ |
| 123 | +#define TCP_FASTOPEN_NO_COOKIE 34 /* Enable TFO without a TFO cookie */ | |
| 123 | 124 | |
| 124 | 125 | struct tcp_repair_opt { |
| 125 | 126 | __u32 opt_code; |