Transmission control protocol (TCP) intermediate device implementing a TCP fast open (TFO) connection
A TCP intermediate device receives a SYN packet from a TCP client that is destined for a TCP origin server and indicates support for TCP fast open (TFO). A SYN-ACK packet is transmitted to the TCP client that includes a TFO cookie set by the TCP intermediate device. The TCP intermediate device receives a first ACK packet from the TCP client. A SYN packet is sent to the TCP origin server and a second SYN-ACK packet is received in response that does not indicate support for TFO. An ACK packet to the TCP origin server. Sometime after the TCP connection is completed, the TCP intermediate device receives a SYN packet from the TCP client that includes the TFO cookie and a payload of data. The TCP intermediate device establishes a TCP connection with the TCP origin server and transmits the payload of data to the TCP origin server.
1. A method performed by a Transmission Control Protocol (TCP) intermediate device, comprising:
receiving, from a TCP client, a first SYN packet that is destined for a TCP origin server,
wherein the first SYN packet indicates support for TCP fast open (TFO);
transmitting a first SYN-ACK packet to the TCP client that includes a TFO cookie set by the TCP intermediate device;
receiving a first ACK packet from the TCP client;
transmitting a second SYN packet to the TCP origin server;
receiving, from the TCP origin server, a second SYN-ACK packet, wherein the second SYN-ACK packet does not indicate support for TFO;
transmitting a second ACK packet to the TCP origin server;
receiving, from the TCP client, a third ACK packet that includes a first payload of data;
transmitting, to the TCP origin server, a fourth ACK packet that includes the first payload of data;
receiving, from the TCP client; a third SYN packet that includes the TFO cookie set by the TCP intermediate device and a second payload of data;
validating the TFO cookie;
responsive to validating the TFO cookie, establishing a TCP connection with the TCP origin server including:
transmitting a fourth SYN packet to the TCP origin server,
receiving, from the TCP origin server, a third SYN-ACK packet responsive to the fourth SYN packet, and
transmitting a fifth ACK packet to the TCP origin server; and
transmitting a sixth ACK packet to the TCP origin server that includes the second payload of data.
2. The method of claim 1 , wherein the TCP intermediate device is a transparent proxy.
3. The method of claim 1 , wherein the first SYN packet and the second SYN packet are equivalent.
4. The method of claim 1 , wherein the first SYN-ACK packet is transmitted after the second SYN-ACK packet is received.
5. The method of claim 1 , wherein the first SYN-ACK packet is modified from the second SYN-ACK packet to include the TFO cookie.
6. The method of claim 1 , wherein a destination IP address of the first SYN packet is an IP address of the TCP origin server, wherein a source IP address of the first SYN-ACK packet is the IP address of the TCP origin server.
7. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform operations including:
receiving, from a TCP client, a first SYN packet that is destined for a TCP origin server,
wherein the first SYN packet indicates support for TCP fast open (TFO);
transmitting a first SYN-ACK packet to the TCP client that includes a TFO cookie set by a TCP intermediate device;
receiving a first ACK packet from the TCP client;
transmitting a second SYN packet to the TCP origin server;
receiving, from the TCP origin server, a second SYN-ACK packet, wherein the second SYN-ACK packet does not indicate support for TFO;
transmitting a second ACK packet to the TCP origin server;
receiving, from the TCP client, a third ACK packet that includes a first payload of data;
transmitting, to the TCP origin server, a fourth ACK packet that includes the first payload of data;
receiving, from the TCP client; a third SYN packet that includes the TFO cookie set by the TCP intermediate device and a second payload of data;
validating the TFO cookie;
responsive to validating the TFO cookie, establishing a TCP connection with the TCP origin server including:
transmitting a fourth SYN packet to the TCP origin server,
receiving, from the TCP origin server, a third SYN-ACK packet responsive to the fourth SYN packet, and
transmitting a fifth ACK packet to the TCP origin server; and
transmitting a sixth ACK packet to the TCP origin server that includes the second payload of data.
8. The non-transitory machine-readable storage medium of claim 7 , wherein the TCP intermediate device is a transparent proxy.
9. The non-transitory machine-readable storage medium of claim 7 , wherein the first SYN packet and the second SYN packet are equivalent.
10. The non-transitory machine-readable storage medium of claim 7 , wherein the first SYN-ACK packet is transmitted after the second SYN-ACK packet is received.
11. The non-transitory machine-readable storage medium of claim 7 , wherein the first SYN-ACK packet is modified from the second SYN-ACK packet to include the TFO cookie.
12. The non-transitory machine-readable storage medium of claim 7 , wherein a destination IP address of the first SYN packet is an IP address of the TCP origin server, wherein a source IP address of the first SYN-ACK packet is the IP address of the TCP origin server.
13. An apparatus, comprising:
a processor; and
a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the processor to carry out operations including:
receive, from a TCP client, a first SYN packet that is destined for a TCP origin server, wherein the first SYN packet is to indicate support for TCP fast open (TFO);
transmit a first SYN-ACK packet to the TCP client that includes a TFO cookie set by a TCP intermediate device;
receive a first ACK packet from the TCP client;
transmit a second SYN packet to the TCP origin server;
receive, from the TCP origin server, a second SYN-ACK packet that does not indicate support for TFO;
transmit a second ACK packet to the TCP origin server;
receive, from the TCP client, a third ACK packet that includes a first payload of data;
transmit, to the TCP origin server, a fourth ACK packet that includes the first payload of data;
receive, from the TCP client; a third SYN packet that includes the TFO cookie set by the TCP intermediate device and a second payload of data;
validate the TFO cookie;
responsive to validation of the TFO cookie, establish a TCP connection with the TCP origin server including:
transmit a fourth SYN packet to the TCP origin server,
receive, from the TCP origin server, a third SYN-ACK packet responsive to the fourth SYN packet, and
transmit a fifth ACK packet to the TCP origin server; and
transmit a sixth ACK packet to the TCP origin server that includes the second payload of data.
14. The apparatus of claim 13 , wherein the TCP intermediate device is a transparent proxy.
15. The apparatus of claim 13 , wherein the first SYN packet and the second SYN packet are equivalent.
16. The apparatus of claim 13 , wherein the first SYN-ACK packet is transmitted after the second SYN-ACK packet is received.
17. The apparatus of claim 13 , wherein the first SYN-ACK packet is to be modified from the second SYN-ACK packet to include the TFO cookie.
18. The apparatus of claim 13 , wherein a destination IP address of the first SYN packet is an IP address of the TCP origin server, wherein a source IP address of the first SYN-ACK packet is the IP address of the TCP origin server.