Subject: Re: [MBONED] WGLC for <draft-ietf-mboned-auto-multicast-08.txt> - UDP checksum?

From: Magnus Westerlund <[email-masked]>
Date: Wed, 05 Dec 2007 12:12:05 -0800

Hi,

I have discussed the issue with setting the UDP checksum to 0 for
IPv6/UDP with some people. And I actually have a suggestion on how to
resolve the issue. It is based on my current understanding of the
problem. I do hope it will hold up to public scrutiny.

I think it will be acceptable to update RFC 2460 to say that the UDP
checksum may be turned of under the following restrictions:

1. The UDP payload must have the capability to verify its integrity by
itself, for example by being a complete IP packet in itself.

2. That IP packet fragmentation must not be used.

In addition to define these exception rules the document should discuss
the following issues with using the exception rules:

1. The removal of the first line defense against errors in address
fields leading to missdelivery of IP packets. What implications this
have and how likely this is going to happen

2. The risk that some network entity on the source actually verify the
checksum and upholds the current rule that IPv6/UDP packet with
checksum=0 is illegal and thus erroneous and should be dropped. I
basically guess that the only entity that realistically could do this is
an firewall that goes rather far in verifying packets. I don't think
this is likely is happen, but one needs to be aware of this could
potentially happen. I would also recommend that it mentions that any
control protocol for this usage preferably could help detect and
indicate that this issue has occurred on a particular path.

I don't think the update to RFC 2460 can be included in the AMT
document, as this is a general change and applicable to also other
tunneling solutions. Also having a separate document makes clearer for
the IETF community that this change is proposed. This needs to be
progress no later than the AMT document.

Is this a reasonable solution to the issue?

Cheers

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone +46 8 4048287
Torshamsgatan 23           | Fax   +46 8 7575550
S-164 80 Stockholm, Sweden | mailto: [email-masked]
----------------------------------------------------------------------

_______________________________________________
MBONED mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mboned

---

From: Magnus Westerlund <[email-masked]>
Date: Wed, 05 Dec 2007 12:12:05 -0800

Hi,

Cheers

Magnus Westerlund

---

From: Stig Venaas <[email-masked]>
Date: Wed, 05 Dec 2007 21:29:10 +0100

Magnus Westerlund wrote:
[...]
> Is this a reasonable solution to the issue?

All this looks fine to me. I assume that the default behaviour in
stacks must be to still treat checksum 0 as a genuine checksum.
For those applications using some protocol with no integrity check
for checksum 0, there needs to be some way for them to signal that
to the stack. This could be e.g. setsockopt() option for signalling
this per socket.

Stig

---

From: Stig Venaas <[email-masked]>
Date: Wed, 05 Dec 2007 21:29:10 +0100

Magnus Westerlund wrote:
[...]

Stig

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 06 Dec 2007 13:04:41 -0800

> to the stack. This could be e.g. setsockopt() option for signalling

I don't know how people actually implemented things, but currently you
definitely can argue that checksum=0 in a IPv6/UDP packet is an illegal
value. I assume that if this change is done, you can implement the same
mechanism that exist for IPv4 to turn the checksum for IPv6/UDP

Cheers

Magnus Westerlund

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 06 Dec 2007 13:04:41 -0800

Cheers

Magnus Westerlund

---

From: Stig Venaas <[email-masked]>
Date: Thu, 06 Dec 2007 22:28:42 +0100

> mechanism that exist for IPv4 to turn the checksum for IPv6/UDP

Oops, my bad. I somehow thought 0 was not illegal since the checksum
is mandatory, but you are right. Hence as you say, the mechanism can
be the same as for IPv4.

Stig

---

From: Stig Venaas <[email-masked]>
Date: Thu, 06 Dec 2007 22:28:42 +0100

Stig