Provide setsockopt() key flag that makes TCP-AO exclude hashing TCP header for peers that match the key. This is needed for interraction with middleboxes that may change TCP options, see RFC5925 (9.2).
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -367,6 +367,11 @@ struct tcp_diag_md5sig { · 366 unmodified lines | |||
| 367 | #define TCP_AO_MAXKEYLEN 80 | 367 | #define TCP_AO_MAXKEYLEN 80 |
| 368 | 368 | ||
| 369 | #define TCP_AO_KEYF_IFINDEX (1 << 0) /* L3 ifindex for VRF */ | 369 | #define TCP_AO_KEYF_IFINDEX (1 << 0) /* L3 ifindex for VRF */ |
| 370 | #define TCP_AO_KEYF_EXCLUDE_OPT (1 << 1) /* "Indicates whether TCP | ||
| 371 | * options other than TCP-AO | ||
| 372 | * are included in the MAC | ||
| 373 | * calculation" | ||
| 374 | */ | ||
| 370 | 375 | ||
| 371 | struct tcp_ao_add { /* setsockopt(TCP_AO_ADD_KEY) */ | 376 | struct tcp_ao_add { /* setsockopt(TCP_AO_ADD_KEY) */ |
| 372 | struct __kernel_sockaddr_storage addr; /* peer's address for the key */ | 377 | struct __kernel_sockaddr_storage addr; /* peer's address for the key */ |