allow server TCP Fast Open and rotate the keys

This needs to be configured by specific services to have any effect. For
now, we're only enabling it for the PowerDNS Authoritative Server and
dnsdist since it's recommended by RFC 9210 and actively used by various
recursive resolver servers when falling back to TCP. TCP Fast Open is
rarely used from end user devices due to it enabling tracking and having
issues with middleboxes. We aren't going to start using it anywhere in
GrapheneOS but may have more server-side uses for it. This functionality
is built into QUIC without the same downsides but QUIC support in the
software we use is not ready for us to enable it, especially the very
primitive support in nginx.

For most servers, a new random TCP Fast Open key is created on a daily
basis and the previous key continues to be accepted. For DNS servers,
the new key is generated via a keyed hash of the current date in order
to keep it consistent across servers providing an anycast IP without it
needing regular synchronization.

tcp-fastopen-rotate-keys

@@ -0,0 +1,20 @@
+#!/bin/bash
+
+set -o errexit -o nounset -o pipefail
+
+umask 077
+
+if [[ -e /etc/tcp_fastopen_seed ]]; then
+    rand=$(b3sum --keyed -l 16 --no-names </etc/tcp_fastopen_seed <(date -uI))
+else
+    rand=$(openssl rand -hex 16)
+fi
+
+new_key=${rand:0:8}-${rand:8:8}-${rand:16:8}-${rand:24:8}
+echo new_key: $new_key
+
+old_key="$(sysctl net.ipv4.tcp_fastopen_key | awk '{ print $3 }' | cut -d ',' -f 1)"
+echo old_key: $old_key
+
+echo "net.ipv4.tcp_fastopen_key=$new_key,$old_key" >/etc/sysctl.d/50-tcp_fastopen_key.conf
+sysctl -p /etc/sysctl.d/50-tcp_fastopen_key.conf