From: Jakub Kicinski <kuba@kernel.org>
To: Luke Hsiao <luke.w.hsiao@gmail.com>
Cc: David Miller <davem@davemloft.net>,
netdev@vger.kernel.org, Luke Hsiao <lukehsiao@google.com>,
Neal Cardwell <ncardwell@google.com>,
Yuchung Cheng <ycheng@google.com>,
Eric Dumazet <edumazet@google.com>
Subject: Re: [PATCH net-next] tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
Date: Tue, 17 Aug 2021 06:35:17 -0700 [thread overview]
Message-ID: <20210817063517.410b1233@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com> (raw)
In-Reply-To: <20210816205105.2533289-1-luke.w.hsiao@gmail.com>
On Mon, 16 Aug 2021 20:51:06 +0000 Luke Hsiao wrote:
> From: Luke Hsiao <lukehsiao@google.com>
>
> Since the original TFO server code was implemented in commit
> 168a8f58059a22feb9e9a2dcc1b8053dbbbc12ef ("tcp: TCP Fast Open Server -
> main code path") the TFO server code has supported the sysctl bit flag
> TFO_SERVER_COOKIE_NOT_REQD. Currently, when the TFO_SERVER_ENABLE and
> TFO_SERVER_COOKIE_NOT_REQD sysctl bit flags are set, a server connection
> will accept a SYN with N bytes of data (N > 0) that has no TFO cookie,
> create a new fast open connection, process the incoming data in the SYN,
> and make the connection ready for accepting. After accepting, the
> connection is ready for read()/recvmsg() to read the N bytes of data in
> the SYN, ready for write()/sendmsg() calls and data transmissions to
> transmit data.
>
> This commit changes an edge case in this feature by changing this
> behavior to apply to (N >= 0) bytes of data in the SYN rather than only
> (N > 0) bytes of data in the SYN. Now, a server will accept a data-less
> SYN without a TFO cookie if TFO_SERVER_COOKIE_NOT_REQD is set.
>
> Caveat! While this enables a new kind of TFO (data-less empty-cookie
> SYN), some firewall rules setup may not work if they assume such packets
> are not legit TFOs and will filter them.
>
> Signed-off-by: Luke Hsiao <lukehsiao@google.com>
> Acked-by: Neal Cardwell <ncardwell@google.com>
> Acked-by: Yuchung Cheng <ycheng@google.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Applied, thanks!
prev parent reply other threads:[~2021-08-17 13:35 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-16 20:51 [PATCH net-next] tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD Luke Hsiao
2021-08-17 13:35 ` Jakub Kicinski [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210817063517.410b1233@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com \
--to=kuba@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=luke.w.hsiao@gmail.com \
--cc=lukehsiao@google.com \
--cc=ncardwell@google.com \
--cc=netdev@vger.kernel.org \
--cc=ycheng@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.