diff --git a/FEATURES.md b/FEATURES.md index ee54fa65..dc86fb63 100644 --- a/FEATURES.md +++ b/FEATURES.md @@ -117,10 +117,10 @@ This feature is disabled by default and can be enabled via `ARES_FLAG_DNS0x20`. There are some instances where servers do not properly facilitate this feature and unlike in a recursive resolver where it may be possible to determine an authoritative server is incapable, its much harder to come to any reliable -conclusion as a stub resolver where the issue resides. Due to the recent wide -deployment of DNS 0x20 in large public DNS servers, it is expected -compatibility will improve rapidly where this feature, in time, may be able -to be enabled by default. +conclusion as a stub resolver as to where in the path the issue resides. Due to +the recent wide deployment of DNS 0x20 in large public DNS servers, it is +expected compatibility will improve rapidly where this feature, in time, may be +able to be enabled by default. Another feature which can be used to prevent off-path cache poisoning attacks is [DNS Cookies](#dns-cookies). @@ -130,7 +130,7 @@ is [DNS Cookies](#dns-cookies). DNS Cookies are are a method of learned mutual authentication between a server and a client as defined in -[RFC7873](https://datatracker.ietf.org/doc/html/rfc7873), +[RFC7873](https://datatracker.ietf.org/doc/html/rfc7873) and [RFC9018](https://datatracker.ietf.org/doc/html/rfc9018). This mutual authentication ensures clients are protected from off-path cache @@ -177,20 +177,39 @@ Supported systems also need to be configured appropriately on both the client and server systems. ### Linux TFO -sysctl `net.ipv4.tcp_fastopen`: +In linux a single sysctl value is used with flags to set the desired fastopen +behavior. + +It is recommended to make any changes permanent by creating a file in +`/etc/sysctl.d/` with the appropriate key and value. Legacy Linux systems +might need to update `/etc/sysctl.conf` directly. After modifying the +configuration, it can be loaded via `sysctl -p`. + +`net.ipv4.tcp_fastopen`: - `1` = client only (typically default) - `2` = server only - `3` = client and server ### MacOS TFO -sysctl `net.inet.tcp.fastopen` +In MacOS, TCP FastOpen is enabled by default for clients and servers. You can +verify via the `net.inet.tcp.fastopen` sysctl. + +If any change is needed, you should make it persistent as per this guidance: +[Persistent Sysctl Settings](https://discussions.apple.com/thread/253840320?) + +`net.inet.tcp.fastopen` - `1` = client only - `2` = server only - `3` = client and server (typically default) ### FreeBSD TFO -sysctl `net.inet.tcp.fastopen.server_enable` (boolean) and -`net.inet.tcp.fastopen.client_enable` (boolean). +In FreeBSD, server mode TCP FastOpen is typically enabled by default but +client mode is disabled. It is recommended to edit `/etc/sysctl.conf` and +place in the values you wish to persist to enable or disable TCP Fast Open. +Once the file is modified, it can be loaded via `sysctl -f /etc/sysctl.conf`. + +- `net.inet.tcp.fastopen.server_enable` (boolean) - enable/disable server +- `net.inet.tcp.fastopen.client_enable` (boolean) - enable/disable client ## Event Thread