tcp: Configure TFO without cookie per socket and/or per route

We already allow to enable TFO without a cookie by using the
fastopen-sysctl and setting it to TFO_SERVER_COOKIE_NOT_REQD (or
TFO_CLIENT_NO_COOKIE).
This is safe to do in certain environments where we know that there
isn't a malicous host (aka., data-centers) or when the
application-protocol already provides an authentication mechanism in the
first flight of data.

A server however might be providing multiple services or talking to both
sides (public Internet and data-center). So, this server would want to
enable cookie-less TFO for certain services and/or for connections that
go to the data-center.

This patch exposes a socket-option and a per-route attribute to enable such
fine-grained configurations.

Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Reviewed-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 1d2c44e09e31e5a951a2ef230f4149a959e8a2e9..173a7c2f96368ee6c6da6bbcf0ca6ff7e1150ce8 100644 (file)
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -215,7 +215,8 @@ struct tcp_sock {
        u8      chrono_type:2,  /* current chronograph type */
                rate_app_limited:1,  /* rate_{delivered,interval_us} limited? */
                fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
-               unused:4;
+               fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
+               unused:3;
        u8      nonagle     : 4,/* Disable Nagle algorithm?             */
                thin_lto    : 1,/* Use linear timeouts for thin streams */
                unused1     : 1,

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 2c13484704cb0fbf5c9e46bf4e709531a7d63043..2392f74074e71af6a6f8113f1ba9c13c7ee5c1bc 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1567,7 +1567,8 @@ int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
 void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb);
 struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
                              struct request_sock *req,
-                             struct tcp_fastopen_cookie *foc);
+                             struct tcp_fastopen_cookie *foc,
+                             const struct dst_entry *dst);
 void tcp_fastopen_init_key_once(struct net *net);
 bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
                             struct tcp_fastopen_cookie *cookie);

diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index dab7dad9e01af4b32cdc587f8a9c149eeae98ec4..fe6679268901724f65980d8a5784c734b6a646ff 100644 (file)
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -430,6 +430,8 @@ enum {
 #define RTAX_QUICKACK RTAX_QUICKACK
        RTAX_CC_ALGO,
 #define RTAX_CC_ALGO RTAX_CC_ALGO
+       RTAX_FASTOPEN_NO_COOKIE,
+#define RTAX_FASTOPEN_NO_COOKIE RTAX_FASTOPEN_NO_COOKIE
        __RTAX_MAX
 };
 

diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index 69c7493e42f87c377aae0a4552df84aab38c3267..d67e1d40c6d6e736d76ca73791f696aceba0ded8 100644 (file)
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -120,6 +120,7 @@ enum {
 #define TCP_ULP                        31      /* Attach a ULP to a TCP connection */
 #define TCP_MD5SIG_EXT         32      /* TCP MD5 Signature with extensions */
 #define TCP_FASTOPEN_KEY       33      /* Set the key for Fast Open (cookie) */
+#define TCP_FASTOPEN_NO_COOKIE 34      /* Enable TFO without a TFO cookie */
 
 struct tcp_repair_opt {
        __u32   opt_code;

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index be07e9b6dbdde405ea1f4806df0c062a3b3c9e1f..8f36277e82e9dbea750ce66b73018a81b30b5156 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2836,6 +2836,14 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                        err = -EOPNOTSUPP;
                }
                break;
+       case TCP_FASTOPEN_NO_COOKIE:
+               if (val > 1 || val < 0)
+                       err = -EINVAL;
+               else if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
+                       err = -EINVAL;
+               else
+                       tp->fastopen_no_cookie = val;
+               break;
        case TCP_TIMESTAMP:
                if (!tp->repair)
                        err = -EPERM;
@@ -3256,6 +3264,10 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                val = tp->fastopen_connect;
                break;
 
+       case TCP_FASTOPEN_NO_COOKIE:
+               val = tp->fastopen_no_cookie;
+               break;
+
        case TCP_TIMESTAMP:
                val = tcp_time_stamp_raw() + tp->tsoffset;
                break;

diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 21075ce19cb68ba9ce6e25055c51c1088eff9842..e0a4b56644aa0f8ccd384644fde7e4841da29d3f 100644 (file)
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -310,13 +310,23 @@ static bool tcp_fastopen_queue_check(struct sock *sk)
        return true;
 }
 
+static bool tcp_fastopen_no_cookie(const struct sock *sk,
+                                  const struct dst_entry *dst,
+                                  int flag)
+{
+       return (sock_net(sk)->ipv4.sysctl_tcp_fastopen & flag) ||
+              tcp_sk(sk)->fastopen_no_cookie ||
+              (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE));
+}
+
 /* Returns true if we should perform Fast Open on the SYN. The cookie (foc)
  * may be updated and return the client in the SYN-ACK later. E.g., Fast Open
  * cookie request (foc->len == 0).
  */
 struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
                              struct request_sock *req,
-                             struct tcp_fastopen_cookie *foc)
+                             struct tcp_fastopen_cookie *foc,
+                             const struct dst_entry *dst)
 {
        bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
        int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
@@ -333,7 +343,8 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
                return NULL;
        }
 
-       if (syn_data && (tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD))
+       if (syn_data &&
+           tcp_fastopen_no_cookie(sk, dst, TFO_SERVER_COOKIE_NOT_REQD))
                goto fastopen;
 
        if (foc->len >= 0 &&  /* Client presents or requests a cookie */
@@ -370,6 +381,7 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
                               struct tcp_fastopen_cookie *cookie)
 {
        unsigned long last_syn_loss = 0;
+       const struct dst_entry *dst;
        int syn_loss = 0;
 
        tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss);
@@ -387,7 +399,9 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
                return false;
        }
 
-       if (sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) {
+       dst = __sk_dst_get(sk);
+
+       if (tcp_fastopen_no_cookie(sk, dst, TFO_CLIENT_NO_COOKIE)) {
                cookie->len = -1;
                return true;
        }

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c5e64d4b5839a9340322f89649cde63d7571d0e0..893286db4623773afe75f4e0cfea7ad0d24ea2fe 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6332,7 +6332,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
        tcp_openreq_init_rwin(req, sk, dst);
        if (!want_cookie) {
                tcp_reqsk_record_syn(sk, req, skb);
-               fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc);
+               fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc, dst);
        }
        if (fastopen_sk) {
                af_ops->send_synack(fastopen_sk, dst, &fl, req,