freebsd stable - Sep 2017 - Bind9 + TCP_FASTOPEN => no rndc

I'm trying to configure bind 9.11 as a nameserver on FreeBSD
11-STABLE. When the bind9 port compile it enables TCP_FASTOPEN but the
changes haven't yet been baked into the GENERIC Kernel. I can't find a
way to disable the use of TCP_FASTOPEN in bind at startup. Is the only
way to fix this problem to build a new kernel with TCP_FASTOPEN
enabled?

-- Chris


-- 
Chris

      __o          "All I was trying to do was get home from work."
    _`\<,_           -Rosa Parks
___(*)/_(*)____.___o____..___..o...________ooO..._____________________
Christopher Sean Hilton                    [chris/at/vindaloo/dot/com]

On 09/27/17 at 01:35P, Christopher Sean Hilton wrote:
> I'm trying to configure bind 9.11 as a nameserver on FreeBSD
> 11-STABLE. When the bind9 port compile it enables TCP_FASTOPEN but the
> changes haven't yet been baked into the GENERIC Kernel. I can't
find a
> way to disable the use of TCP_FASTOPEN in bind at startup. Is the only
> way to fix this problem to build a new kernel with TCP_FASTOPEN
> enabled?
afaik, yes. options TCP_RFC7413 in kernconf.
It defaults to off even with the option. net.inet.tcp.fastopen.enabled=1
will enable actual use.

Cheers,
Hiren
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 603 bytes
Desc: not available
URL:
<http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20170927/8e54e8bf/attachment.sig>

On 27 Sep 2017, at 19:35, Christopher Sean Hilton <chris at vindaloo.com>
wrote:
> 
> I'm trying to configure bind 9.11 as a nameserver on FreeBSD
> 11-STABLE. When the bind9 port compile it enables TCP_FASTOPEN but the
> changes haven't yet been baked into the GENERIC Kernel. I can't
find a
> way to disable the use of TCP_FASTOPEN in bind at startup. Is the only
> way to fix this problem to build a new kernel with TCP_FASTOPEN
> enabled?
It looks like bind enables use of TCP_FASTOPEN whenever its configure
script finds the define in the system headers.  But it does not check
whether the functionality actually works with setsockopt.

In any case, the message is harmless noise, as any errors are ignored:

#if defined(ISC_PLATFORM_HAVETFO) && defined(TCP_FASTOPEN)
#ifdef __APPLE__
        backlog = 1;
#else
        backlog = backlog / 2;
        if (backlog == 0)
                backlog = 1;
#endif
        if (setsockopt(sock->fd, IPPROTO_TCP, TCP_FASTOPEN,
                       (void *)&backlog, sizeof(backlog)) < 0) {
                isc__strerror(errno, strbuf, sizeof(strbuf));
                UNEXPECTED_ERROR(__FILE__, __LINE__,
                                 "setsockopt(%d, TCP_FASTOPEN) failed with
%s",
                                 sock->fd, strbuf);
                /* TCP_FASTOPEN is experimental so ignore failures */
        }
#endif

-Dimitry

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 223 bytes
Desc: Message signed with OpenPGP
URL:
<http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20170927/18fa53e3/attachment.sig>