diff options
| author |   Christoph Paasch <cpaasch@apple.com> | 2017-10-23 13:22:23 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2017-10-24 18:48:08 +0900 |
| commit | 71c02379c762cb616c00fd5c4ed253fbf6bbe11b (patch) | |
| tree | 516606a09f6d284d35d2d510fe23b11bf9e69f2a /include/linux/tcp.h | |
| parent | net/sock: Update sk rcu iterator macro. (diff) | |
| download | linux-dev-71c02379c762cb616c00fd5c4ed253fbf6bbe11b.tar.xz linux-dev-71c02379c762cb616c00fd5c4ed253fbf6bbe11b.zip | |
tcp: Configure TFO without cookie per socket and/or per route
We already allow to enable TFO without a cookie by using the
fastopen-sysctl and setting it to TFO_SERVER_COOKIE_NOT_REQD (or
TFO_CLIENT_NO_COOKIE).
This is safe to do in certain environments where we know that there
isn't a malicous host (aka., data-centers) or when the
application-protocol already provides an authentication mechanism in the
first flight of data.
A server however might be providing multiple services or talking to both
sides (public Internet and data-center). So, this server would want to
enable cookie-less TFO for certain services and/or for connections that
go to the data-center.
This patch exposes a socket-option and a per-route attribute to enable such
fine-grained configurations.
Signed-off-by: Christoph Paasch <cpaasch@apple.com>
Reviewed-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/tcp.h')
| -rw-r--r-- | include/linux/tcp.h | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/include/linux/tcp.h b/include/linux/tcp.h index 1d2c44e09e31..173a7c2f9636 100644 --- a/include/linux/tcp.h +++ b/include/linux/tcp.h @@ -215,7 +215,8 @@ struct tcp_sock { u8 chrono_type:2, /* current chronograph type */ rate_app_limited:1, /* rate_{delivered,interval_us} limited? */ fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */ - unused:4; + fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */ + unused:3; u8 nonagle : 4,/* Disable Nagle algorithm? */ thin_lto : 1,/* Use linear timeouts for thin streams */ unused1 : 1, |