Commit 71c02379 authored by Christoph Paasch's avatar Christoph Paasch Committed by David S. Miller

tcp: Configure TFO without cookie per socket and/or per route

We already allow to enable TFO without a cookie by using the
fastopen-sysctl and setting it to TFO_SERVER_COOKIE_NOT_REQD (or
TFO_CLIENT_NO_COOKIE).
This is safe to do in certain environments where we know that there
isn't a malicous host (aka., data-centers) or when the
application-protocol already provides an authentication mechanism in the
first flight of data.

A server however might be providing multiple services or talking to both
sides (public Internet and data-center). So, this server would want to
enable cookie-less TFO for certain services and/or for connections that
go to the data-center.

This patch exposes a socket-option and a per-route attribute to enable such
fine-grained configurations.
Signed-off-by: default avatarChristoph Paasch <cpaasch@apple.com>
Reviewed-by: default avatarYuchung Cheng <ycheng@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b6f4f848
...@@ -215,7 +215,8 @@ struct tcp_sock { ...@@ -215,7 +215,8 @@ struct tcp_sock {
u8 chrono_type:2, /* current chronograph type */ u8 chrono_type:2, /* current chronograph type */
rate_app_limited:1, /* rate_{delivered,interval_us} limited? */ rate_app_limited:1, /* rate_{delivered,interval_us} limited? */
fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */ fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
unused:4; fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
unused:3;
u8 nonagle : 4,/* Disable Nagle algorithm? */ u8 nonagle : 4,/* Disable Nagle algorithm? */
thin_lto : 1,/* Use linear timeouts for thin streams */ thin_lto : 1,/* Use linear timeouts for thin streams */
unused1 : 1, unused1 : 1,
......
...@@ -1567,7 +1567,8 @@ int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk, ...@@ -1567,7 +1567,8 @@ int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb); void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb);
struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
struct request_sock *req, struct request_sock *req,
struct tcp_fastopen_cookie *foc); struct tcp_fastopen_cookie *foc,
const struct dst_entry *dst);
void tcp_fastopen_init_key_once(struct net *net); void tcp_fastopen_init_key_once(struct net *net);
bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss, bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
struct tcp_fastopen_cookie *cookie); struct tcp_fastopen_cookie *cookie);
......
...@@ -430,6 +430,8 @@ enum { ...@@ -430,6 +430,8 @@ enum {
#define RTAX_QUICKACK RTAX_QUICKACK #define RTAX_QUICKACK RTAX_QUICKACK
RTAX_CC_ALGO, RTAX_CC_ALGO,
#define RTAX_CC_ALGO RTAX_CC_ALGO #define RTAX_CC_ALGO RTAX_CC_ALGO
RTAX_FASTOPEN_NO_COOKIE,
#define RTAX_FASTOPEN_NO_COOKIE RTAX_FASTOPEN_NO_COOKIE
__RTAX_MAX __RTAX_MAX
}; };
......
...@@ -120,6 +120,7 @@ enum { ...@@ -120,6 +120,7 @@ enum {
#define TCP_ULP 31 /* Attach a ULP to a TCP connection */ #define TCP_ULP 31 /* Attach a ULP to a TCP connection */
#define TCP_MD5SIG_EXT 32 /* TCP MD5 Signature with extensions */ #define TCP_MD5SIG_EXT 32 /* TCP MD5 Signature with extensions */
#define TCP_FASTOPEN_KEY 33 /* Set the key for Fast Open (cookie) */ #define TCP_FASTOPEN_KEY 33 /* Set the key for Fast Open (cookie) */
#define TCP_FASTOPEN_NO_COOKIE 34 /* Enable TFO without a TFO cookie */
struct tcp_repair_opt { struct tcp_repair_opt {
__u32 opt_code; __u32 opt_code;
......
...@@ -2836,6 +2836,14 @@ static int do_tcp_setsockopt(struct sock *sk, int level, ...@@ -2836,6 +2836,14 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
err = -EOPNOTSUPP; err = -EOPNOTSUPP;
} }
break; break;
case TCP_FASTOPEN_NO_COOKIE:
if (val > 1 || val < 0)
err = -EINVAL;
else if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
err = -EINVAL;
else
tp->fastopen_no_cookie = val;
break;
case TCP_TIMESTAMP: case TCP_TIMESTAMP:
if (!tp->repair) if (!tp->repair)
err = -EPERM; err = -EPERM;
...@@ -3256,6 +3264,10 @@ static int do_tcp_getsockopt(struct sock *sk, int level, ...@@ -3256,6 +3264,10 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
val = tp->fastopen_connect; val = tp->fastopen_connect;
break; break;
case TCP_FASTOPEN_NO_COOKIE:
val = tp->fastopen_no_cookie;
break;
case TCP_TIMESTAMP: case TCP_TIMESTAMP:
val = tcp_time_stamp_raw() + tp->tsoffset; val = tcp_time_stamp_raw() + tp->tsoffset;
break; break;
......
...@@ -310,13 +310,23 @@ static bool tcp_fastopen_queue_check(struct sock *sk) ...@@ -310,13 +310,23 @@ static bool tcp_fastopen_queue_check(struct sock *sk)
return true; return true;
} }
static bool tcp_fastopen_no_cookie(const struct sock *sk,
const struct dst_entry *dst,
int flag)
{
return (sock_net(sk)->ipv4.sysctl_tcp_fastopen & flag) ||
tcp_sk(sk)->fastopen_no_cookie ||
(dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE));
}
/* Returns true if we should perform Fast Open on the SYN. The cookie (foc) /* Returns true if we should perform Fast Open on the SYN. The cookie (foc)
* may be updated and return the client in the SYN-ACK later. E.g., Fast Open * may be updated and return the client in the SYN-ACK later. E.g., Fast Open
* cookie request (foc->len == 0). * cookie request (foc->len == 0).
*/ */
struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
struct request_sock *req, struct request_sock *req,
struct tcp_fastopen_cookie *foc) struct tcp_fastopen_cookie *foc,
const struct dst_entry *dst)
{ {
bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1; bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen; int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
...@@ -333,7 +343,8 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, ...@@ -333,7 +343,8 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
return NULL; return NULL;
} }
if (syn_data && (tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD)) if (syn_data &&
tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
goto fastopen; goto fastopen;
if (foc->len >= 0 && /* Client presents or requests a cookie */ if (foc->len >= 0 && /* Client presents or requests a cookie */
...@@ -370,6 +381,7 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss, ...@@ -370,6 +381,7 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
struct tcp_fastopen_cookie *cookie) struct tcp_fastopen_cookie *cookie)
{ {
unsigned long last_syn_loss = 0; unsigned long last_syn_loss = 0;
const struct dst_entry *dst;
int syn_loss = 0; int syn_loss = 0;
tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss); tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss);
...@@ -387,7 +399,9 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss, ...@@ -387,7 +399,9 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
return false; return false;
} }
if (sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) { dst = __sk_dst_get(sk);
if (tcp_fastopen_no_cookie(sk, dst, TFO_CLIENT_NO_COOKIE)) {
cookie->len = -1; cookie->len = -1;
return true; return true;
} }
......
...@@ -6332,7 +6332,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, ...@@ -6332,7 +6332,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
tcp_openreq_init_rwin(req, sk, dst); tcp_openreq_init_rwin(req, sk, dst);
if (!want_cookie) { if (!want_cookie) {
tcp_reqsk_record_syn(sk, req, skb); tcp_reqsk_record_syn(sk, req, skb);
fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc); fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc, dst);
} }
if (fastopen_sk) { if (fastopen_sk) {
af_ops->send_synack(fastopen_sk, dst, &fl, req, af_ops->send_synack(fastopen_sk, dst, &fl, req,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment