net-tcp: Fast Open client - cookie-less mode

In trusted networks, e.g., intranet, data-center, the client does not
need to use Fast Open cookie to mitigate DoS attacks. In cookie-less
mode, sendmsg() with MSG_FASTOPEN flag will send SYN-data regardless
of cookie availability.

Signed-off-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 03964e088180aba20629e5271c9182b47ae6debe..5f3ef7f7fcec079bd7baa911f99a12f73c3e26b6 100644 (file)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -476,6 +476,8 @@ tcp_fastopen - INTEGER
 
        The values (bitmap) are:
        1: Enables sending data in the opening SYN on the client
+       5: Enables sending data in the opening SYN on the client regardless
+          of cookie availability.
 
        Default: 0
 

diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 1edf96afab4479cff13657ea2b46053172615f0d..9febfb685c33d769aa07dbf6cd93f3993c933018 100644 (file)
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -387,6 +387,7 @@ struct tcp_sock {
        u8      repair_queue;
        u8      do_early_retrans:1,/* Enable RFC5827 early-retransmit  */
                early_retrans_delayed:1, /* Delayed ER timer installed */
+               syn_data:1,     /* SYN includes data */
                syn_fastopen:1; /* SYN includes Fast Open option */
 
 /* RTT measurement */

diff --git a/include/net/tcp.h b/include/net/tcp.h
index e07878d246aa3b1affe3dc6c651a48f25004c258..bc7c134ec054b1b839f157ab0a18a9fa0c28ce90 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -214,6 +214,7 @@ extern void tcp_time_wait(struct sock *sk, int state, int timeo);
 
 /* Bit Flags for sysctl_tcp_fastopen */
 #define        TFO_CLIENT_ENABLE       1
+#define        TFO_CLIENT_NO_COOKIE    4       /* Data in SYN w/o cookie option */
 
 extern struct inet_timewait_death_row tcp_death_row;
 

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index c49a4fc175bd3d8880dfb0e65bba1acb5a2e8e65..e67d685a6c0ed39b48a1663963831e98b1412a4c 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5650,7 +5650,7 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
                                    struct tcp_fastopen_cookie *cookie)
 {
        struct tcp_sock *tp = tcp_sk(sk);
-       struct sk_buff *data = tcp_write_queue_head(sk);
+       struct sk_buff *data = tp->syn_data ? tcp_write_queue_head(sk) : NULL;
        u16 mss = tp->rx_opt.mss_clamp;
        bool syn_drop;
 
@@ -5665,6 +5665,9 @@ static bool tcp_rcv_fastopen_synack(struct sock *sk, struct sk_buff *synack,
                mss = opt.mss_clamp;
        }
 
+       if (!tp->syn_fastopen)  /* Ignore an unsolicited cookie */
+               cookie->len = -1;
+
        /* The SYN-ACK neither has cookie nor acknowledges the data. Presumably
         * the remote receives only the retransmitted (regular) SYNs: either
         * the original SYN-data or the corresponding SYN-ACK is lost.
@@ -5816,7 +5819,8 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
 
                tcp_finish_connect(sk, skb);
 
-               if (tp->syn_fastopen && tcp_rcv_fastopen_synack(sk, skb, &foc))
+               if ((tp->syn_fastopen || tp->syn_data) &&
+                   tcp_rcv_fastopen_synack(sk, skb, &foc))
                        return -1;
 
                if (sk->sk_write_pending ||

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index c5cfd5ec31842a3d2df6cf11e3b87a062cd86daa..27a32acfdb6246cb9450e8612bd4bbd744c50d7f 100644 (file)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2864,6 +2864,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
        struct sk_buff *syn_data = NULL, *data;
        unsigned long last_syn_loss = 0;
 
+       tp->rx_opt.mss_clamp = tp->advmss;  /* If MSS is not cached */
        tcp_fastopen_cache_get(sk, &tp->rx_opt.mss_clamp, &fo->cookie,
                               &syn_loss, &last_syn_loss);
        /* Recurring FO SYN losses: revert to regular handshake temporarily */
@@ -2873,7 +2874,9 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
                goto fallback;
        }
 
-       if (fo->cookie.len <= 0)
+       if (sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE)
+               fo->cookie.len = -1;
+       else if (fo->cookie.len <= 0)
                goto fallback;
 
        /* MSS for SYN-data is based on cached MSS and bounded by PMTU and
@@ -2916,6 +2919,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
        fo->copied = data->len;
 
        if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) {
+               tp->syn_data = (fo->copied > 0);
                NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVE);
                goto done;
        }