Provide setsockopt() key flag that makes TCP-AO exclude hashing TCP header for peers that match the key. This is needed for interraction with middleboxes that may change TCP options, see RFC5925 (9.2).
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -367,6 +367,11 @@ struct tcp_diag_md5sig { · 366 unmodified lines | ||
| 367 | 367 | #define TCP_AO_MAXKEYLEN 80 |
| 368 | 368 | |
| 369 | 369 | #define TCP_AO_KEYF_IFINDEX (1 << 0) /* L3 ifindex for VRF */ |
| 370 | +#define TCP_AO_KEYF_EXCLUDE_OPT (1 << 1) /* "Indicates whether TCP | |
| 371 | + * options other than TCP-AO | |
| 372 | + * are included in the MAC | |
| 373 | + * calculation" | |
| 374 | + */ | |
| 370 | 375 | |
| 371 | 376 | struct tcp_ao_add { /* setsockopt(TCP_AO_ADD_KEY) */ |
| 372 | 377 | struct __kernel_sockaddr_storage addr; /* peer's address for the key */ |