From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Dumazet Subject: Re: [PATCH net-next 0/5] tcp: Introduce a TFO key-pool for clean cookie-rotation Date: Sun, 16 Dec 2018 21:54:49 -0800 Message-ID: <7e35c197-7271-a754-0014-6a32cde4ea79@gmail.com> References: <20181214224007.54813-1-cpaasch@apple.com> <20181216.121952.1167815839571774345.davem@davemloft.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: netdev@vger.kernel.org, edumazet@google.com, ycheng@google.com To: David Miller , cpaasch@apple.com Return-path: Received: from mail-wr1-f67.google.com ([209.85.221.67]:39798 "EHLO mail-wr1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726426AbeLQFyx (ORCPT ); Mon, 17 Dec 2018 00:54:53 -0500 Received: by mail-wr1-f67.google.com with SMTP id t27so10951621wra.6 for ; Sun, 16 Dec 2018 21:54:52 -0800 (PST) In-Reply-To: <20181216.121952.1167815839571774345.davem@davemloft.net> Content-Language: en-US Sender: netdev-owner@vger.kernel.org List-ID: On 12/16/2018 12:19 PM, David Miller wrote: > From: Christoph Paasch > Date: Fri, 14 Dec 2018 14:40:02 -0800 > >> Currently, TFO only allows a single TFO-secret. This means that whenever >> the secret gets changed for key-rotation purposes, all the previously >> issued TFO-cookies become invalid. This means that clients will fallback >> to "regular" TCP, incurring a cost of one additional round-trip. >> >> This patchset introduces a TFO key-pool that allows to more gracefully >> change the key. The size of the pool is 2 (this could be changed in the >> future through a sysctl if needed). When a client connects with an "old" >> TFO cookie, the server will now accept the data in the SYN and at the >> same time announce a new TFO-cookie to the client. >> >> We have seen a significant reduction of LINUX_MIB_TCPFASTOPENPASSIVEFAIL >> thanks to these patches. Invalid cookies are now solely observed when >> clients behind a NAT are getting a new public IP. > > Yuchung and Eric, please review. > Thanks David, I will do now.