1*e7be843bSPierre Pronchery /* 2*e7be843bSPierre Pronchery * Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved. 3*e7be843bSPierre Pronchery * 4*e7be843bSPierre Pronchery * Licensed under the Apache License 2.0 (the "License"). You may not use 5*e7be843bSPierre Pronchery * this file except in compliance with the License. You can obtain a copy 6*e7be843bSPierre Pronchery * in the file LICENSE in the source distribution or at 7*e7be843bSPierre Pronchery * https://www.openssl.org/source/license.html 8*e7be843bSPierre Pronchery */ 9*e7be843bSPierre Pronchery 10*e7be843bSPierre Pronchery /* 11*e7be843bSPierre Pronchery * Contains definitions for simplifying the use of TCP Fast Open 12*e7be843bSPierre Pronchery * (RFC7413) in OpenSSL socket BIOs. 13*e7be843bSPierre Pronchery */ 14*e7be843bSPierre Pronchery 15*e7be843bSPierre Pronchery /* If a supported OS is added here, update test/bio_tfo_test.c */ 16*e7be843bSPierre Pronchery #if defined(TCP_FASTOPEN) && !defined(OPENSSL_NO_TFO) 17*e7be843bSPierre Pronchery 18*e7be843bSPierre Pronchery # if defined(OPENSSL_SYS_MACOSX) || defined(__FreeBSD__) 19*e7be843bSPierre Pronchery # include <sys/sysctl.h> 20*e7be843bSPierre Pronchery # endif 21*e7be843bSPierre Pronchery 22*e7be843bSPierre Pronchery /* 23*e7be843bSPierre Pronchery * OSSL_TFO_SYSCTL is used to determine if TFO is supported by 24*e7be843bSPierre Pronchery * this kernel, and if supported, if it is enabled. This is more of 25*e7be843bSPierre Pronchery * a problem on FreeBSD 10.3 ~ 11.4, where TCP_FASTOPEN was defined, 26*e7be843bSPierre Pronchery * but not enabled by default in the kernel, and only for the server. 27*e7be843bSPierre Pronchery * Linux does not have sysctlbyname(), and the closest equivalent 28*e7be843bSPierre Pronchery * is to go into the /proc filesystem, but I'm not sure it's 29*e7be843bSPierre Pronchery * worthwhile. 30*e7be843bSPierre Pronchery * 31*e7be843bSPierre Pronchery * On MacOS and Linux: 32*e7be843bSPierre Pronchery * These operating systems use a single parameter to control TFO. 33*e7be843bSPierre Pronchery * The OSSL_TFO_CLIENT_FLAG and OSSL_TFO_SERVER_FLAGS are used to 34*e7be843bSPierre Pronchery * determine if TFO is enabled for the client and server respectively. 35*e7be843bSPierre Pronchery * 36*e7be843bSPierre Pronchery * OSSL_TFO_CLIENT_FLAG = 1 = client TFO enabled 37*e7be843bSPierre Pronchery * OSSL_TFO_SERVER_FLAG = 2 = server TFO enabled 38*e7be843bSPierre Pronchery * 39*e7be843bSPierre Pronchery * Such that: 40*e7be843bSPierre Pronchery * 0 = TFO disabled 41*e7be843bSPierre Pronchery * 3 = server and client TFO enabled 42*e7be843bSPierre Pronchery * 43*e7be843bSPierre Pronchery * macOS 10.14 and later support TFO. 44*e7be843bSPierre Pronchery * Linux kernel 3.6 added support for client TFO. 45*e7be843bSPierre Pronchery * Linux kernel 3.7 added support for server TFO. 46*e7be843bSPierre Pronchery * Linux kernel 3.13 enabled TFO by default. 47*e7be843bSPierre Pronchery * Linux kernel 4.11 added the TCP_FASTOPEN_CONNECT option. 48*e7be843bSPierre Pronchery * 49*e7be843bSPierre Pronchery * On FreeBSD: 50*e7be843bSPierre Pronchery * FreeBSD 10.3 ~ 11.4 uses a single sysctl for server enable. 51*e7be843bSPierre Pronchery * FreeBSD 12.0 and later uses separate sysctls for server and 52*e7be843bSPierre Pronchery * client enable. 53*e7be843bSPierre Pronchery * 54*e7be843bSPierre Pronchery * Some options are purposely NOT defined per-platform 55*e7be843bSPierre Pronchery * 56*e7be843bSPierre Pronchery * OSSL_TFO_SYSCTL 57*e7be843bSPierre Pronchery * Defined as a sysctlbyname() option to determine if 58*e7be843bSPierre Pronchery * TFO is enabled in the kernel (macOS, FreeBSD) 59*e7be843bSPierre Pronchery * 60*e7be843bSPierre Pronchery * OSSL_TFO_SERVER_SOCKOPT 61*e7be843bSPierre Pronchery * Defined to indicate the socket option used to enable 62*e7be843bSPierre Pronchery * TFO on a server socket (all) 63*e7be843bSPierre Pronchery * 64*e7be843bSPierre Pronchery * OSSL_TFO_SERVER_SOCKOPT_VALUE 65*e7be843bSPierre Pronchery * Value to be used with OSSL_TFO_SERVER_SOCKOPT 66*e7be843bSPierre Pronchery * 67*e7be843bSPierre Pronchery * OSSL_TFO_CONNECTX 68*e7be843bSPierre Pronchery * Use the connectx() function to make a client connection 69*e7be843bSPierre Pronchery * (macOS) 70*e7be843bSPierre Pronchery * 71*e7be843bSPierre Pronchery * OSSL_TFO_CLIENT_SOCKOPT 72*e7be843bSPierre Pronchery * Defined to indicate the socket option used to enable 73*e7be843bSPierre Pronchery * TFO on a client socket (FreeBSD, Linux 4.14 and later) 74*e7be843bSPierre Pronchery * 75*e7be843bSPierre Pronchery * OSSL_TFO_SENDTO 76*e7be843bSPierre Pronchery * Defined to indicate the sendto() message type to 77*e7be843bSPierre Pronchery * be used to initiate a TFO connection (FreeBSD, 78*e7be843bSPierre Pronchery * Linux pre-4.14) 79*e7be843bSPierre Pronchery * 80*e7be843bSPierre Pronchery * OSSL_TFO_DO_NOT_CONNECT 81*e7be843bSPierre Pronchery * Defined to skip calling connect() when creating a 82*e7be843bSPierre Pronchery * client socket (macOS, FreeBSD, Linux pre-4.14) 83*e7be843bSPierre Pronchery */ 84*e7be843bSPierre Pronchery 85*e7be843bSPierre Pronchery # if defined(OPENSSL_SYS_WINDOWS) 86*e7be843bSPierre Pronchery /* 87*e7be843bSPierre Pronchery * NO WINDOWS SUPPORT 88*e7be843bSPierre Pronchery * 89*e7be843bSPierre Pronchery * But this is what would be used on the server: 90*e7be843bSPierre Pronchery * 91*e7be843bSPierre Pronchery * define OSSL_TFO_SERVER_SOCKOPT TCP_FASTOPEN 92*e7be843bSPierre Pronchery * define OSSL_TFO_SERVER_SOCKOPT_VALUE 1 93*e7be843bSPierre Pronchery * 94*e7be843bSPierre Pronchery * Still have to figure out client support 95*e7be843bSPierre Pronchery */ 96*e7be843bSPierre Pronchery # undef TCP_FASTOPEN 97*e7be843bSPierre Pronchery # endif 98*e7be843bSPierre Pronchery 99*e7be843bSPierre Pronchery /* NO VMS SUPPORT */ 100*e7be843bSPierre Pronchery # if defined(OPENSSL_SYS_VMS) 101*e7be843bSPierre Pronchery # undef TCP_FASTOPEN 102*e7be843bSPierre Pronchery # endif 103*e7be843bSPierre Pronchery 104*e7be843bSPierre Pronchery # if defined(OPENSSL_SYS_MACOSX) 105*e7be843bSPierre Pronchery # define OSSL_TFO_SYSCTL "net.inet.tcp.fastopen" 106*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_SOCKOPT TCP_FASTOPEN 107*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_SOCKOPT_VALUE 1 108*e7be843bSPierre Pronchery # define OSSL_TFO_CONNECTX 1 109*e7be843bSPierre Pronchery # define OSSL_TFO_DO_NOT_CONNECT 1 110*e7be843bSPierre Pronchery # define OSSL_TFO_CLIENT_FLAG 1 111*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_FLAG 2 112*e7be843bSPierre Pronchery # endif 113*e7be843bSPierre Pronchery 114*e7be843bSPierre Pronchery # if defined(__FreeBSD__) 115*e7be843bSPierre Pronchery # if defined(TCP_FASTOPEN_PSK_LEN) 116*e7be843bSPierre Pronchery /* As of 12.0 these are the SYSCTLs */ 117*e7be843bSPierre Pronchery # define OSSL_TFO_SYSCTL_SERVER "net.inet.tcp.fastopen.server_enable" 118*e7be843bSPierre Pronchery # define OSSL_TFO_SYSCTL_CLIENT "net.inet.tcp.fastopen.client_enable" 119*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_SOCKOPT TCP_FASTOPEN 120*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_SOCKOPT_VALUE MAX_LISTEN 121*e7be843bSPierre Pronchery # define OSSL_TFO_CLIENT_SOCKOPT TCP_FASTOPEN 122*e7be843bSPierre Pronchery # define OSSL_TFO_DO_NOT_CONNECT 1 123*e7be843bSPierre Pronchery # define OSSL_TFO_SENDTO 0 124*e7be843bSPierre Pronchery /* These are the same because the sysctl are client/server-specific */ 125*e7be843bSPierre Pronchery # define OSSL_TFO_CLIENT_FLAG 1 126*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_FLAG 1 127*e7be843bSPierre Pronchery # else 128*e7be843bSPierre Pronchery /* 10.3 through 11.4 SYSCTL - ONLY SERVER SUPPORT */ 129*e7be843bSPierre Pronchery # define OSSL_TFO_SYSCTL "net.inet.tcp.fastopen.enabled" 130*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_SOCKOPT TCP_FASTOPEN 131*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_SOCKOPT_VALUE MAX_LISTEN 132*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_FLAG 1 133*e7be843bSPierre Pronchery # endif 134*e7be843bSPierre Pronchery # endif 135*e7be843bSPierre Pronchery 136*e7be843bSPierre Pronchery # if defined(OPENSSL_SYS_LINUX) 137*e7be843bSPierre Pronchery /* OSSL_TFO_PROC not used, but of interest */ 138*e7be843bSPierre Pronchery # define OSSL_TFO_PROC "/proc/sys/net/ipv4/tcp_fastopen" 139*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_SOCKOPT TCP_FASTOPEN 140*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_SOCKOPT_VALUE MAX_LISTEN 141*e7be843bSPierre Pronchery # if defined(TCP_FASTOPEN_CONNECT) 142*e7be843bSPierre Pronchery # define OSSL_TFO_CLIENT_SOCKOPT TCP_FASTOPEN_CONNECT 143*e7be843bSPierre Pronchery # else 144*e7be843bSPierre Pronchery # define OSSL_TFO_SENDTO MSG_FASTOPEN 145*e7be843bSPierre Pronchery # define OSSL_TFO_DO_NOT_CONNECT 1 146*e7be843bSPierre Pronchery # endif 147*e7be843bSPierre Pronchery # define OSSL_TFO_CLIENT_FLAG 1 148*e7be843bSPierre Pronchery # define OSSL_TFO_SERVER_FLAG 2 149*e7be843bSPierre Pronchery # endif 150*e7be843bSPierre Pronchery 151*e7be843bSPierre Pronchery #endif 152