diff mbox series

[v2,net-next] tcp: Enable TFO without a cookie on a per-socket basis

Message ID 20171020211303.76466-1-cpaasch@apple.com
State Changes Requested, archived
Delegated to: David Miller
Headers show
Series [v2,net-next] tcp: Enable TFO without a cookie on a per-socket basis | expand

Commit Message

Christoph Paasch Oct. 20, 2017, 9:13 p.m. UTC
We already allow to enable TFO without a cookie by using the
fastopen-sysctl and setting it to TFO_SERVER_COOKIE_NOT_REQD (0x200).
This is safe to do in certain environments where we know that there
isn't a malicous host (aka., data-centers).

A server however might be talking to both sides (public Internet and
data-center). So, this server would want to enable cookie-less TFO for
the connections that go to the data-center while enforcing cookies for
the traffic from the Internet.

This patch exposes a socket-option to enable this (protected by
CAP_NET_ADMIN).

Signed-off-by: Christoph Paasch <cpaasch@apple.com>
---

Notes:
    v2: * Rename to fastopen_no_cookie and TCP_FASTOPEN_NO_COOKIE
        * Add per-route attribute for fastopen_no_cookie
        * Get rid of the capability check

 include/linux/tcp.h            |  3 ++-
 include/net/tcp.h              |  3 ++-
 include/uapi/linux/rtnetlink.h |  2 ++
 include/uapi/linux/tcp.h       |  1 +
 net/ipv4/tcp.c                 | 12 ++++++++++++
 net/ipv4/tcp_fastopen.c        | 14 +++++++++++---
 net/ipv4/tcp_input.c           |  2 +-
 7 files changed, 31 insertions(+), 6 deletions(-)

Comments

Yuchung Cheng Oct. 21, 2017, 12:46 a.m. UTC | #1
On Fri, Oct 20, 2017 at 2:13 PM, Christoph Paasch <cpaasch@apple.com> wrote:
>
> We already allow to enable TFO without a cookie by using the
> fastopen-sysctl and setting it to TFO_SERVER_COOKIE_NOT_REQD (0x200).
> This is safe to do in certain environments where we know that there
> isn't a malicous host (aka., data-centers).
>
> A server however might be talking to both sides (public Internet and
> data-center). So, this server would want to enable cookie-less TFO for
> the connections that go to the data-center while enforcing cookies for
> the traffic from the Internet.
>
> This patch exposes a socket-option to enable this (protected by
> CAP_NET_ADMIN).
the protection is removed in this version?

>
> Signed-off-by: Christoph Paasch <cpaasch@apple.com>
> ---
>
> Notes:
>     v2: * Rename to fastopen_no_cookie and TCP_FASTOPEN_NO_COOKIE
>         * Add per-route attribute for fastopen_no_cookie
>         * Get rid of the capability check
>
>  include/linux/tcp.h            |  3 ++-
>  include/net/tcp.h              |  3 ++-
>  include/uapi/linux/rtnetlink.h |  2 ++
>  include/uapi/linux/tcp.h       |  1 +
>  net/ipv4/tcp.c                 | 12 ++++++++++++
>  net/ipv4/tcp_fastopen.c        | 14 +++++++++++---
>  net/ipv4/tcp_input.c           |  2 +-
>  7 files changed, 31 insertions(+), 6 deletions(-)
>
> diff --git a/include/linux/tcp.h b/include/linux/tcp.h
> index 1d2c44e09e31..173a7c2f9636 100644
> --- a/include/linux/tcp.h
> +++ b/include/linux/tcp.h
> @@ -215,7 +215,8 @@ struct tcp_sock {
>         u8      chrono_type:2,  /* current chronograph type */
>                 rate_app_limited:1,  /* rate_{delivered,interval_us} limited? */
>                 fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
> -               unused:4;
> +               fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
> +               unused:3;
>         u8      nonagle     : 4,/* Disable Nagle algorithm?             */
>                 thin_lto    : 1,/* Use linear timeouts for thin streams */
>                 unused1     : 1,
> diff --git a/include/net/tcp.h b/include/net/tcp.h
> index 1efe8365cb28..020b20c3f50a 100644
> --- a/include/net/tcp.h
> +++ b/include/net/tcp.h
> @@ -1562,7 +1562,8 @@ int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
>  void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb);
>  struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
>                               struct request_sock *req,
> -                             struct tcp_fastopen_cookie *foc);
> +                             struct tcp_fastopen_cookie *foc,
> +                             const struct dst_entry *dst);
>  void tcp_fastopen_init_key_once(struct net *net);
>  bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
>                              struct tcp_fastopen_cookie *cookie);
> diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
> index dab7dad9e01a..fe6679268901 100644
> --- a/include/uapi/linux/rtnetlink.h
> +++ b/include/uapi/linux/rtnetlink.h
> @@ -430,6 +430,8 @@ enum {
>  #define RTAX_QUICKACK RTAX_QUICKACK
>         RTAX_CC_ALGO,
>  #define RTAX_CC_ALGO RTAX_CC_ALGO
> +       RTAX_FASTOPEN_NO_COOKIE,
> +#define RTAX_FASTOPEN_NO_COOKIE RTAX_FASTOPEN_NO_COOKIE
>         __RTAX_MAX
>  };
>
> diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
> index 69c7493e42f8..d67e1d40c6d6 100644
> --- a/include/uapi/linux/tcp.h
> +++ b/include/uapi/linux/tcp.h
> @@ -120,6 +120,7 @@ enum {
>  #define TCP_ULP                        31      /* Attach a ULP to a TCP connection */
>  #define TCP_MD5SIG_EXT         32      /* TCP MD5 Signature with extensions */
>  #define TCP_FASTOPEN_KEY       33      /* Set the key for Fast Open (cookie) */
> +#define TCP_FASTOPEN_NO_COOKIE 34      /* Enable TFO without a TFO cookie */
>
>  struct tcp_repair_opt {
>         __u32   opt_code;
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 8b1fa4dd4538..a3d46a781abd 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -2832,6 +2832,14 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
>                         err = -EOPNOTSUPP;
>                 }
>                 break;
> +       case TCP_FASTOPEN_NO_COOKIE:
> +               if (val > 1 || val < 0)
> +                       err = -EINVAL;
> +               else if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
> +                       err = -EINVAL;
> +               else
> +                       tp->fastopen_no_cookie = 1;
> +               break;
>         case TCP_TIMESTAMP:
>                 if (!tp->repair)
>                         err = -EPERM;
> @@ -3252,6 +3260,10 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
>                 val = tp->fastopen_connect;
>                 break;
>
> +       case TCP_FASTOPEN_NO_COOKIE:
> +               val = tp->fastopen_no_cookie;
> +               break;
> +
>         case TCP_TIMESTAMP:
>                 val = tcp_time_stamp_raw() + tp->tsoffset;
>                 break;
> diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
> index 21075ce19cb6..e704bd86fdf9 100644
> --- a/net/ipv4/tcp_fastopen.c
> +++ b/net/ipv4/tcp_fastopen.c
> @@ -316,7 +316,8 @@ static bool tcp_fastopen_queue_check(struct sock *sk)
>   */
>  struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
>                               struct request_sock *req,
> -                             struct tcp_fastopen_cookie *foc)
> +                             struct tcp_fastopen_cookie *foc,
> +                             const struct dst_entry *dst)
>  {
>         bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
>         int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
> @@ -333,7 +334,9 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
>                 return NULL;
>         }
>
> -       if (syn_data && (tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD))
> +       if (syn_data && ((tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD) ||
> +                        tcp_sk(sk)->fastopen_no_cookie ||
> +                        (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE))))
>                 goto fastopen;
>
>         if (foc->len >= 0 &&  /* Client presents or requests a cookie */
> @@ -370,6 +373,7 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
>                                struct tcp_fastopen_cookie *cookie)
>  {
>         unsigned long last_syn_loss = 0;
> +       const struct dst_entry *dst;
>         int syn_loss = 0;
>
>         tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss);
> @@ -387,7 +391,11 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
>                 return false;
>         }
>
> -       if (sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) {
> +       dst = __sk_dst_get(sk);
> +
> +       if ((sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) ||
> +           tcp_sk(sk)->fastopen_no_cookie ||
> +           (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE))) {
perhaps a helper e.g. tcp_fastopen_needs_cookie(syscl_flag) for this
function and tcp_try_fastopen() to tidy the code a bit?

>                 cookie->len = -1;
>                 return true;
>         }
> diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
> index b2390bfdc68f..a6cf6407f780 100644
> --- a/net/ipv4/tcp_input.c
> +++ b/net/ipv4/tcp_input.c
> @@ -6329,7 +6329,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
>         tcp_openreq_init_rwin(req, sk, dst);
>         if (!want_cookie) {
>                 tcp_reqsk_record_syn(sk, req, skb);
> -               fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc);
> +               fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc, dst);
>         }
>         if (fastopen_sk) {
>                 af_ops->send_synack(fastopen_sk, dst, &fl, req,
> --
> 2.14.1
>
Christoph Paasch Oct. 23, 2017, 4:17 p.m. UTC | #2
Hello,

On 20/10/17 - 17:46:06, Yuchung Cheng wrote:
> On Fri, Oct 20, 2017 at 2:13 PM, Christoph Paasch <cpaasch@apple.com> wrote:
> >
> > We already allow to enable TFO without a cookie by using the
> > fastopen-sysctl and setting it to TFO_SERVER_COOKIE_NOT_REQD (0x200).
> > This is safe to do in certain environments where we know that there
> > isn't a malicous host (aka., data-centers).
> >
> > A server however might be talking to both sides (public Internet and
> > data-center). So, this server would want to enable cookie-less TFO for
> > the connections that go to the data-center while enforcing cookies for
> > the traffic from the Internet.
> >
> > This patch exposes a socket-option to enable this (protected by
> > CAP_NET_ADMIN).
> the protection is removed in this version?

yes, removed it upon suggestion by Eric. I missed to update the commit log.
Will do so in the v3.

> 
> >
> > Signed-off-by: Christoph Paasch <cpaasch@apple.com>
> > ---
> >
> > Notes:
> >     v2: * Rename to fastopen_no_cookie and TCP_FASTOPEN_NO_COOKIE
> >         * Add per-route attribute for fastopen_no_cookie
> >         * Get rid of the capability check
> >
> >  include/linux/tcp.h            |  3 ++-
> >  include/net/tcp.h              |  3 ++-
> >  include/uapi/linux/rtnetlink.h |  2 ++
> >  include/uapi/linux/tcp.h       |  1 +
> >  net/ipv4/tcp.c                 | 12 ++++++++++++
> >  net/ipv4/tcp_fastopen.c        | 14 +++++++++++---
> >  net/ipv4/tcp_input.c           |  2 +-
> >  7 files changed, 31 insertions(+), 6 deletions(-)
> >
> > diff --git a/include/linux/tcp.h b/include/linux/tcp.h
> > index 1d2c44e09e31..173a7c2f9636 100644
> > --- a/include/linux/tcp.h
> > +++ b/include/linux/tcp.h
> > @@ -215,7 +215,8 @@ struct tcp_sock {
> >         u8      chrono_type:2,  /* current chronograph type */
> >                 rate_app_limited:1,  /* rate_{delivered,interval_us} limited? */
> >                 fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
> > -               unused:4;
> > +               fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
> > +               unused:3;
> >         u8      nonagle     : 4,/* Disable Nagle algorithm?             */
> >                 thin_lto    : 1,/* Use linear timeouts for thin streams */
> >                 unused1     : 1,
> > diff --git a/include/net/tcp.h b/include/net/tcp.h
> > index 1efe8365cb28..020b20c3f50a 100644
> > --- a/include/net/tcp.h
> > +++ b/include/net/tcp.h
> > @@ -1562,7 +1562,8 @@ int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
> >  void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb);
> >  struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
> >                               struct request_sock *req,
> > -                             struct tcp_fastopen_cookie *foc);
> > +                             struct tcp_fastopen_cookie *foc,
> > +                             const struct dst_entry *dst);
> >  void tcp_fastopen_init_key_once(struct net *net);
> >  bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
> >                              struct tcp_fastopen_cookie *cookie);
> > diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
> > index dab7dad9e01a..fe6679268901 100644
> > --- a/include/uapi/linux/rtnetlink.h
> > +++ b/include/uapi/linux/rtnetlink.h
> > @@ -430,6 +430,8 @@ enum {
> >  #define RTAX_QUICKACK RTAX_QUICKACK
> >         RTAX_CC_ALGO,
> >  #define RTAX_CC_ALGO RTAX_CC_ALGO
> > +       RTAX_FASTOPEN_NO_COOKIE,
> > +#define RTAX_FASTOPEN_NO_COOKIE RTAX_FASTOPEN_NO_COOKIE
> >         __RTAX_MAX
> >  };
> >
> > diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
> > index 69c7493e42f8..d67e1d40c6d6 100644
> > --- a/include/uapi/linux/tcp.h
> > +++ b/include/uapi/linux/tcp.h
> > @@ -120,6 +120,7 @@ enum {
> >  #define TCP_ULP                        31      /* Attach a ULP to a TCP connection */
> >  #define TCP_MD5SIG_EXT         32      /* TCP MD5 Signature with extensions */
> >  #define TCP_FASTOPEN_KEY       33      /* Set the key for Fast Open (cookie) */
> > +#define TCP_FASTOPEN_NO_COOKIE 34      /* Enable TFO without a TFO cookie */
> >
> >  struct tcp_repair_opt {
> >         __u32   opt_code;
> > diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> > index 8b1fa4dd4538..a3d46a781abd 100644
> > --- a/net/ipv4/tcp.c
> > +++ b/net/ipv4/tcp.c
> > @@ -2832,6 +2832,14 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
> >                         err = -EOPNOTSUPP;
> >                 }
> >                 break;
> > +       case TCP_FASTOPEN_NO_COOKIE:
> > +               if (val > 1 || val < 0)
> > +                       err = -EINVAL;
> > +               else if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
> > +                       err = -EINVAL;
> > +               else
> > +                       tp->fastopen_no_cookie = 1;
> > +               break;
> >         case TCP_TIMESTAMP:
> >                 if (!tp->repair)
> >                         err = -EPERM;
> > @@ -3252,6 +3260,10 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
> >                 val = tp->fastopen_connect;
> >                 break;
> >
> > +       case TCP_FASTOPEN_NO_COOKIE:
> > +               val = tp->fastopen_no_cookie;
> > +               break;
> > +
> >         case TCP_TIMESTAMP:
> >                 val = tcp_time_stamp_raw() + tp->tsoffset;
> >                 break;
> > diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
> > index 21075ce19cb6..e704bd86fdf9 100644
> > --- a/net/ipv4/tcp_fastopen.c
> > +++ b/net/ipv4/tcp_fastopen.c
> > @@ -316,7 +316,8 @@ static bool tcp_fastopen_queue_check(struct sock *sk)
> >   */
> >  struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
> >                               struct request_sock *req,
> > -                             struct tcp_fastopen_cookie *foc)
> > +                             struct tcp_fastopen_cookie *foc,
> > +                             const struct dst_entry *dst)
> >  {
> >         bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
> >         int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
> > @@ -333,7 +334,9 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
> >                 return NULL;
> >         }
> >
> > -       if (syn_data && (tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD))
> > +       if (syn_data && ((tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD) ||
> > +                        tcp_sk(sk)->fastopen_no_cookie ||
> > +                        (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE))))
> >                 goto fastopen;
> >
> >         if (foc->len >= 0 &&  /* Client presents or requests a cookie */
> > @@ -370,6 +373,7 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
> >                                struct tcp_fastopen_cookie *cookie)
> >  {
> >         unsigned long last_syn_loss = 0;
> > +       const struct dst_entry *dst;
> >         int syn_loss = 0;
> >
> >         tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss);
> > @@ -387,7 +391,11 @@ bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
> >                 return false;
> >         }
> >
> > -       if (sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) {
> > +       dst = __sk_dst_get(sk);
> > +
> > +       if ((sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) ||
> > +           tcp_sk(sk)->fastopen_no_cookie ||
> > +           (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE))) {
> perhaps a helper e.g. tcp_fastopen_needs_cookie(syscl_flag) for this
> function and tcp_try_fastopen() to tidy the code a bit?

Sure, I will create a helper.


Thanks,
Christoph
diff mbox series

Patch

diff --git a/include/linux/tcp.h b/include/linux/tcp.h
index 1d2c44e09e31..173a7c2f9636 100644
--- a/include/linux/tcp.h
+++ b/include/linux/tcp.h
@@ -215,7 +215,8 @@  struct tcp_sock {
 	u8	chrono_type:2,	/* current chronograph type */
 		rate_app_limited:1,  /* rate_{delivered,interval_us} limited? */
 		fastopen_connect:1, /* FASTOPEN_CONNECT sockopt */
-		unused:4;
+		fastopen_no_cookie:1, /* Allow send/recv SYN+data without a cookie */
+		unused:3;
 	u8	nonagle     : 4,/* Disable Nagle algorithm?             */
 		thin_lto    : 1,/* Use linear timeouts for thin streams */
 		unused1	    : 1,
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 1efe8365cb28..020b20c3f50a 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1562,7 +1562,8 @@  int tcp_fastopen_reset_cipher(struct net *net, struct sock *sk,
 void tcp_fastopen_add_skb(struct sock *sk, struct sk_buff *skb);
 struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
 			      struct request_sock *req,
-			      struct tcp_fastopen_cookie *foc);
+			      struct tcp_fastopen_cookie *foc,
+			      const struct dst_entry *dst);
 void tcp_fastopen_init_key_once(struct net *net);
 bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
 			     struct tcp_fastopen_cookie *cookie);
diff --git a/include/uapi/linux/rtnetlink.h b/include/uapi/linux/rtnetlink.h
index dab7dad9e01a..fe6679268901 100644
--- a/include/uapi/linux/rtnetlink.h
+++ b/include/uapi/linux/rtnetlink.h
@@ -430,6 +430,8 @@  enum {
 #define RTAX_QUICKACK RTAX_QUICKACK
 	RTAX_CC_ALGO,
 #define RTAX_CC_ALGO RTAX_CC_ALGO
+	RTAX_FASTOPEN_NO_COOKIE,
+#define RTAX_FASTOPEN_NO_COOKIE RTAX_FASTOPEN_NO_COOKIE
 	__RTAX_MAX
 };
 
diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index 69c7493e42f8..d67e1d40c6d6 100644
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -120,6 +120,7 @@  enum {
 #define TCP_ULP			31	/* Attach a ULP to a TCP connection */
 #define TCP_MD5SIG_EXT		32	/* TCP MD5 Signature with extensions */
 #define TCP_FASTOPEN_KEY	33	/* Set the key for Fast Open (cookie) */
+#define TCP_FASTOPEN_NO_COOKIE	34	/* Enable TFO without a TFO cookie */
 
 struct tcp_repair_opt {
 	__u32	opt_code;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8b1fa4dd4538..a3d46a781abd 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2832,6 +2832,14 @@  static int do_tcp_setsockopt(struct sock *sk, int level,
 			err = -EOPNOTSUPP;
 		}
 		break;
+	case TCP_FASTOPEN_NO_COOKIE:
+		if (val > 1 || val < 0)
+			err = -EINVAL;
+		else if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
+			err = -EINVAL;
+		else
+			tp->fastopen_no_cookie = 1;
+		break;
 	case TCP_TIMESTAMP:
 		if (!tp->repair)
 			err = -EPERM;
@@ -3252,6 +3260,10 @@  static int do_tcp_getsockopt(struct sock *sk, int level,
 		val = tp->fastopen_connect;
 		break;
 
+	case TCP_FASTOPEN_NO_COOKIE:
+		val = tp->fastopen_no_cookie;
+		break;
+
 	case TCP_TIMESTAMP:
 		val = tcp_time_stamp_raw() + tp->tsoffset;
 		break;
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 21075ce19cb6..e704bd86fdf9 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -316,7 +316,8 @@  static bool tcp_fastopen_queue_check(struct sock *sk)
  */
 struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
 			      struct request_sock *req,
-			      struct tcp_fastopen_cookie *foc)
+			      struct tcp_fastopen_cookie *foc,
+			      const struct dst_entry *dst)
 {
 	bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
 	int tcp_fastopen = sock_net(sk)->ipv4.sysctl_tcp_fastopen;
@@ -333,7 +334,9 @@  struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
 		return NULL;
 	}
 
-	if (syn_data && (tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD))
+	if (syn_data && ((tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD) ||
+			 tcp_sk(sk)->fastopen_no_cookie ||
+			 (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE))))
 		goto fastopen;
 
 	if (foc->len >= 0 &&  /* Client presents or requests a cookie */
@@ -370,6 +373,7 @@  bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
 			       struct tcp_fastopen_cookie *cookie)
 {
 	unsigned long last_syn_loss = 0;
+	const struct dst_entry *dst;
 	int syn_loss = 0;
 
 	tcp_fastopen_cache_get(sk, mss, cookie, &syn_loss, &last_syn_loss);
@@ -387,7 +391,11 @@  bool tcp_fastopen_cookie_check(struct sock *sk, u16 *mss,
 		return false;
 	}
 
-	if (sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) {
+	dst = __sk_dst_get(sk);
+
+	if ((sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_NO_COOKIE) ||
+	    tcp_sk(sk)->fastopen_no_cookie ||
+	    (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE))) {
 		cookie->len = -1;
 		return true;
 	}
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index b2390bfdc68f..a6cf6407f780 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6329,7 +6329,7 @@  int tcp_conn_request(struct request_sock_ops *rsk_ops,
 	tcp_openreq_init_rwin(req, sk, dst);
 	if (!want_cookie) {
 		tcp_reqsk_record_syn(sk, req, skb);
-		fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc);
+		fastopen_sk = tcp_try_fastopen(sk, skb, req, &foc, dst);
 	}
 	if (fastopen_sk) {
 		af_ops->send_synack(fastopen_sk, dst, &fl, req,