Transparent proxy conversion of transmission control protocol (TCP) fast open connection
A TCP intermediate device receives a SYN packet from a TCP client that is destined for a TCP origin server and indicates support for TCP fast open (TFO). A SYN-ACK packet is transmitted to the TCP client that includes a first TFO cookie set by the TCP intermediate device. An ACK packet is received from the TCP client. A SYN packet is sent to the TCP origin server and a second SYN-ACK packet is received in response that includes a second TFO cookie set by the TCP origin server. An ACK packet to the TCP origin server. Sometime after the TCP connection is completed, a SYN packet from the TCP client is received that includes the first TFO cookie and a payload of data. The TCP intermediate device modifies the SYN packet to include the second TFO cookie and transmits the modified SYN packet to the TCP origin server.
1. A method performed by a Transmission Control Protocol (TCP) intermediate device, comprising:
receiving, from a TCP client, a first SYN packet that is destined for a TCP origin server, wherein the first SYN packet indicates support for TCP fast open (TFO);
transmitting a first SYN-ACK packet to the TCP client that includes a first TFO cookie set by the TCP intermediate device;
receiving a first ACK packet from the TCP client;
transmitting a second SYN packet to the TCP origin server;
receiving, from the TCP origin server, a second SYN-ACK packet that includes a second TFO cookie set by the TCP origin server;
transmitting a second ACK packet to the TCP origin server;
receiving, from the TCP client, a third SYN packet that includes the first TFO cookie set by the TCP intermediate device and a payload of data;
validating the first TFO cookie;
modifying the third SYN packet to swap the first TFO cookie with the second TFO cookie to generate a fourth SYN packet; and
transmitting the fourth SYN packet with the second TFO cookie to the TCP origin server, the fourth SYN packet including the payload of data.
2. The method of claim 1 , wherein the TCP intermediate device is a transparent proxy.
3. The method of claim 1 , wherein the first SYN packet and the second SYN packet are equivalent.
4. The method of claim 1 , wherein the first SYN-ACK packet is transmitted after the second SYN-ACK packet is received.
5. The method of claim 1 , wherein the first SYN-ACK packet is modified from the second SYN-ACK packet to include the first TFO cookie.
6. The method of claim 1 , wherein a destination IP address of the first SYN packet is an IP address of the TCP origin server, wherein a source IP address of the first SYN-ACK packet is the IP address of the TCP origin server.
7. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a Transmission Control Protocol (TCP) intermediate device, will cause said processor to perform operations including:
receiving, from a TCP client, a first SYN packet that is destined for a TCP origin server, wherein the first SYN packet indicates support for TCP fast open (TFO);
transmitting a first SYN-ACK packet to the TCP client that includes a first TFO cookie set by the TCP intermediate device;
receiving a first ACK packet from the TCP client;
transmitting a second SYN packet to the TCP origin server;
receiving, from the TCP origin server, a second SYN-ACK packet that includes a second TFO cookie set by the TCP origin server;
transmitting a second ACK packet to the TCP origin server;
receiving, from the TCP client, a third SYN packet that includes the first TFO cookie set by the TCP intermediate device and a payload of data;
validating the first TFO cookie;
modifying the third SYN packet to swap the first TFO cookie with the second TFO cookie to generate a fourth SYN packet; and
transmitting the fourth SYN packet with the second TFO cookie to the TCP origin server, the fourth SYN packet including the payload of data.
8. The non-transitory machine-readable storage medium of claim 7 , TCP intermediate device that is a transparent proxy.
9. The non-transitory machine-readable storage medium of claim 7 , wherein the first SYN packet and the second SYN packet are equivalent.
10. The non-transitory machine-readable storage medium of claim 7 , wherein the first SYN-ACK packet is transmitted after the second SYN-ACK packet is received.
11. The non-transitory machine-readable storage medium of claim 7 , wherein the first SYN-ACK packet is modified from the second SYN-ACK packet to include the first TFO cookie.
12. The non-transitory machine-readable storage medium of claim 7 , wherein a destination IP address of the first SYN packet is an IP address of the TCP origin server, wherein a source IP address of the first SYN-ACK packet is the IP address of the TCP origin server.
13. A Transmission Control Protocol (TCP) intermediate device, comprising:
a processor; and
a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, will cause the TCP intermediate device to carry out operations including:
receiving, from a TCP client, a first SYN packet that is destined for a TCP origin server, wherein the first SYN packet indicates support for TCP fast open (TFO);
transmitting a first SYN-ACK packet to the TCP client that includes a first TFO cookie set by the TCP intermediate device;
receiving a first ACK packet from the TCP client;
transmitting a second SYN packet to the TCP origin server;
receiving, from the TCP origin server, a second SYN-ACK packet that includes a second TFO cookie set by the TCP origin server;
transmitting a second ACK packet to the TCP origin server;
receiving, from the TCP client, a third SYN packet that includes the first TFO cookie set by the TCP intermediate device and a payload of data;
validating the first TFO cookie;
modifying the third SYN packet to swap the first TFO cookie with the second TFO cookie to generate a fourth SYN packet; and
transmitting the fourth SYN packet with the second TFO cookie to the TCP origin server, the fourth SYN packet including the payload of data.
14. The TCP intermediate device of claim 13 , wherein the TCP intermediate device is a transparent proxy.
15. The TCP intermediate device of claim 13 , wherein the first SYN packet and the second SYN packet are equivalent.
16. The TCP intermediate device of claim 13 , wherein the first SYN-ACK packet is transmitted after the second SYN-ACK packet is received.
17. The TCP intermediate device of claim 13 , wherein the first SYN-ACK packet is modified from the second SYN-ACK packet to include the first TFO cookie.
18. The TCP intermediate device of claim 13 , wherein a destination IP address of the first SYN packet is an IP address of the TCP origin server, wherein a source IP address of the first SYN-ACK packet is the IP address of the TCP origin server.