Subject: Re[4]: IPv4 header modifications

From: [email-masked]
Date: Wed, 12 Nov 1997 16:46:07 -0600

I disagree.  Quoting Roy from an earlier e-mail,

"If we make the assumption that we perform tunneling during ESP or AH, and since
we must perform compression before security, then we wouldn't compress the inner
IP header."

In this situation, a compressed and encrypted packet would look like:

        IP ESP IP IPComp TCP

Obviously, IP will compute the header checksum for the outer IP header only.

The inner IP header is the one modified by IPComp, but without the checksum 
updated.  At the receiver, ESP extracts the inner IP packet and gives it to the 
IP stack.  Before processing the packet, IP always checks the header.  Since the
checksum is invalid, the packet will be dropped.

I feel that the IPComp draft should explicitly mention updating the IP header 
checksum.  An implied reference to anything is not good enough for a document 
that's going to become an Internet standard.

Sumit

______________________________ Reply Separator _________________________________
Subject: Re: Re[2]: IPv4 header modifications
Author:  Avram Shacham <[email-masked]> at Internet
Date:    11/12/97 10:05 PM

In reality, the IP header checksum field is calculated just before leaving 
the IP layer. For example, if ESP follows IPComp, the IP header checksum 
will be calculated after ESP. There is no point in mandating the checksum 
calculation in IPComp is such scenario. 
     
Unless the WG feels strongly that the obvious definition of the checksum is 
really missing, I suggest to keep the reference implied.
     
avram
     
At 11:52 AM 11/12/97 -0600, [email-masked] wrote: 
>     
>Yes, its not in there.
>
>Sumit
>
>______________________________ Reply Separator 
_________________________________
>Subject: RE: IPv4 header modifications
>Author:  Roy Pereira <[email-masked]> at Internet 
>Date:    11/12/97 12:45 PM
>
>
>Of course.  If it isn't in the draft then it was assumed.  (but it 
>should be in the draft)
>     
>On Wednesday, November 12, 1997 11:43 AM, [email-masked] 
>[SMTP:[email-masked]] wrote:
>>      Since IPComp changes the total length and protocol fields in the IP 
>>      header, shouldn't the header checksum be re-computed?
>>      
>>      Thanks,
>>      
>>      Sumit A. Vakil
>>      Tunneling and Security
>>      3ComContent-Type: text/plain; charset=US-ASCII; name="RFC822 message 
headers"
>Content-Transfer-Encoding: 7bit
>Content-Description: cc:Mail note part
>Content-Disposition: attachment; filename="RFC822 message headers" 
>
>Attachment Converted: C:\Program Files\Eudora\RFC822 message headers8 
>

---

From: "Michael C. Richardson" <[email-masked]>
Date: Wed, 12 Nov 1997 18:33:20 -0500

-----BEGIN PGP SIGNED MESSAGE-----

- ->>>>> "svakil" == svakil  <[email-masked]> writes:
    svakil> I disagree.  Quoting Roy from an earlier e-mail,

    svakil> "If we make the assumption that we perform tunneling during ESP or AH, and since
    svakil> we must perform compression before security, then we wouldn't compress the inner
    svakil> IP header."

    svakil> In this situation, a compressed and encrypted packet would look like:

    svakil>         IP ESP IP IPComp TCP

  Why would we want to make the above assumption?
	  IP ESP IPComp IP TCP

  makes much more sense to me. Most of the savings, I would think,
would be in compressing the IP header.

    svakil> I feel that the IPComp draft should explicitly mention updating the IP header 
    svakil> checksum.  An implied reference to anything is not good enough for a document 
    svakil> that's going to become an Internet standard.

  By strict layering, IPComp doesn't create the IP header. It gets
added afterwards, so the length and the size is correct. If you do
things by putting wedges in the stack, then you need to know this. 

   :!mcr!:            |  Network and security consulting/contract programming
   Michael Richardson |   I do IPsec policy code for SSH <http://www.ssh.fi/>
 Personal: <A HREF="http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html">[email-masked]</A>. PGP key available.
 Corporate: <A HREF="http://www.sandelman.ottawa.on.ca/SSW/">[email-masked]</A>. 
	ON HUMILITY: To err is human, to moo bovine.

---

From: Daniel Harkins <[email-masked]>
Date: Wed, 12 Nov 1997 16:04:44 -0800

Sumit,

> that's going to become an Internet standard.

  By following this road an incredibly pedantic document can be produced.
Shall a description of computing the checksum also be included or can we
just imply reference to RFC791? If you change the header (the length for
instance) then you recompute the checksum. A certain level of knowledge
on the part of the reader must be assumed.

  This whole thread begs the question: where are you doing IPComp? Is
this a bump-in-the-wire compressor?

  Dan.