Subject: [MBONED] UDP Header draft for IPv6 AMT

From: Marshall Eubanks <[email-masked]>
Date: Tue, 16 Dec 2008 21:17:22 -0500

Hello;

Brian, Phil and I had lunch today and discussed the draft to allow  
zero checksums in IPv6 UDP under
certain circumstances.

Upon a careful reading of the AMT I-D it seems, based on discussions in
Minneapolis, that some people might be confused as to the situation  
and the proposed solution. In order to make things clear, I
wanted to go over this from the beginning. As one of those confused  
people might be me, please
feel free to correct me if I state it wrong.

AMT is a tunneling protocol which places an entire original Multicast  
UDP packet
inside another UDP packet. Both of these packets therefore have UDP  
headers and fields for UDP checksums. To make
it clear which we are referring to, we have been speaking of the  
"inner" header (the header of the
multicast data packet being encapsulated) and the "outer" header (the  
header of the packet encapsulating
the original data packet). The draft draft-ietf-mboned-auto- 
multicast-09.txt
refers to the inner packet as the "Multicast Data" and the outer  
packet as the "AMT Data message." Section 6.6 says :
6.6. AMT IP Multicast Data
The AMT Data message is a UDP packet encapsulating the IP Multicast  
data requested by the originator based on a previous AMT Membership  
Update message. It is sent from the unicast destination address of the  
Membership update to the source address of the Membership Update. The  
UDP source and destination port numbers should be the same ones sent  
in the original Query. The UDP checksum SHOULD be 0 in the AMT IP  
Multicast Data message.
-----
Now, it seems to me that this is a little unclear and needs  
amplification. If you read it carefully, it says that the _outer_  
headerUDP checksum should be zero, while the _inner_ header UDP  
checksum continues to protect the original multicast data (i.e., the  
contents of the original multicast packet), but it seemed clear to me  
in Minneapolis that some people thought that the _inner_ header  
checksum should be zero, while the _outer_ header checksum would  
protect the data against alteration. So

1.) I would suggest changing 6.6 to say
  The UDP checksum SHOULD be 0 in the AMT IP Multicast Data message  
(i.e., the packet encapsulating the original Multicast data
message).

2.) The above behavior is not currently allowed in IPv6. RFC2460 in  
Section 8.1 says
o Unlike IPv4, when UDP packets are originated by an IPv6 node, the  
UDP checksum is not optional. That is, whenever originating a UDP  
packet, an IPv6 node must compute a UDP checksum over the packet and  
the pseudo-header, and, if that computation yields a result of zero,  
it must be changed to hex FFFF for placement in the UDP header. IPv6  
receivers must discard UDP packets containing a zero checksum, and  
should log the error.

The whole point of our current effort is to allow this for AMT, and I  
wanted to make it clear that this will entail sending of unprotected  
IPv6 UDP packets across the Internet with checksums = 0. The reason  
for this is that the inner packet is still protected; the AMT authors  
feel strongly that routers receiving AMT IP Multicast Data messages  
should not be required to perform checksum operations, and that these  
are already done by the source and receivers of the "inner" Multicast  
packet. We understand that it is necessary that this exemption to 2460  
be very narrowly focused.

In Minneapolis, various people told me that they thought that there  
were other protocols that might need this or find it useful, but  
Brian, Phil and I were unable to come up with any examples we regarded  
as valid today.
If anyone feels that they know of other such protocols, please let us  
know.

Regards
Marshall

_______________________________________________
MBONED mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mboned

---

From: Dino Farinacci <[email-masked]>
Date: Tue, 16 Dec 2008 18:48:19 -0800

> contents of the original multicast packet), but it seemed clear to  
> me in Minneapolis that some people thought that the _inner_ header  

I don't remember anyway commenting on the inner UDP header. We were  
solely talking about the encapsulated or outer header.

> (i.e., the packet encapsulating the original Multicast data

Agree. And parenthetically say "(the outer UDP header)".

It should also say that a decapsulator of such a UDP 0-checksum  
message MUST not check the checksum.

> The whole point of our current effort is to allow this for AMT, and  
> I wanted to make it clear that this will entail sending of  
> unprotected IPv6 UDP packets across the Internet with checksums = 0.  
> The reason for this is that the inner packet is still protected; the  
> AMT authors feel strongly that routers receiving AMT IP Multicast  
> Data messages should not be required to perform checksum operations,  
> and that these are already done by the source and receivers of the  
> "inner" Multicast packet. We understand that it is necessary that  
> this exemption to 2460 be very narrowly focused.
>
> Brian, Phil and I were unable to come up with any examples we  
> regarded as valid today.
> If anyone feels that they know of other such protocols, please let  
> us know.

UPnP?

Dino

---

From: Dino Farinacci <[email-masked]>
Date: Tue, 16 Dec 2008 18:48:19 -0800

UPnP?

Dino

---

From: Magnus Westerlund <[email-masked]>
Date: Thu, 18 Dec 2008 18:43:22 +0100

Hi,

I think it is reasonably to make this document a generic one. I do think
we will see more IP/UDP based tunneling schemes that it makes sense to
allow this generically for any tunnel head end that sends
IPv6/UDP1/IPvX/UDP2 to skip the checksum in UDP1. Doing a special update
for one single protocol of a core document seems strange.

There will be more that selects IP/UDP for there tunnels for similar
reasons that AMT chose that solution.

cheers

Magnus

Dino Farinacci skrev:
>> contents of thFrom [email-masked]  Thu Dec 18 09:43:33 2008
Date: Thu, 18 Dec 2008 18:43:22 +0100
From: Magnus Westerlund <[email-masked]>
To: Dino Farinacci <[email-masked]>
Cc: [email-masked], "Chimento, Philip F." <[email-masked]>
Subject: Re: [MBONED] UDP Header draft for IPv6 AMT
Sender: [email-masked]

Hi,

I think it is reasonably to make this document a generic one. I do think
we will see more IP/UDP based tunneling schemes that it makes sense to
allow this generically for any tunnel head end that sends
IPv6/UDP1/IPvX/UDP2 to skip the checksum in UDP1. Doing a special update
for one single protocol of a core document seems strange.

There will be more that selects IP/UDP for there tunnels for similar
reasons that AMT chose that solution.

cheers

Magnus

Dino Farinacci skrev:
>> contents of the e original multicast packet), but it seemed clear to me
> It should also say that a decapsulator of such a UDP 0-checksum message
> MUST not check the checksum.
> 

-- 

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: [email-masked]
----------------------------------------------------------------------
_______________________________________________
MBONED mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mboned

original multicast packet), but it seemed clear to me
> It should also say that a decapsulator of such a UDP 0-checksum message
> MUST not check the checksum.
> 

-- 

Magnus Westerlund

IETF Transport Area Director & TSVWG Chair
----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: [email-masked]
----------------------------------------------------------------------
_______________________________________________
MBONED mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mboned

---

From: Marshall Eubanks <[email-masked]>
Date: Thu, 18 Dec 2008 12:55:37 -0500

Dear Magnus;

On Dec 18, 2008, at 12:43 PM, Magnus Westerlund wrote:

> Hi,
>
> I think it is reasonably to make this document a generic one.

That has been our assumption all along. I am trying get these  
assumptions
all out on the table before we get too far in the weeds.

> I do think

Can you (or anyone else) think of any other WG that might appreciate  
seeing this ? The
draft itself will go to 6Man but you can be sure I will keep MBONED in  
the loop.

Regards
Marshall

>>> me
>>> regarded
>>> us

---

From: Marshall Eubanks <[email-masked]>
Date: Thu, 18 Dec 2008 12:55:37 -0500

Dear Magnus;

Regards
Marshall

---

From: Thomas Narten <[email-masked]>
Date: Fri, 19 Dec 2008 09:44:11 -0500

FWIW, my take is that the IPv6 WG will resist attempts to allow UDP
packets with no checksums. We've had this discussion more than once in
the past.

Why not use UDPLite instead? Yes, there is still a minimal checksum,
but it *is* minimal enough that the cost of processing it should be
acceptable.

Thomas

---

From: Thomas Narten <[email-masked]>
Date: Fri, 19 Dec 2008 09:44:11 -0500

Thomas

---

From: "Greg Shepherd" <[email-masked]>
Date: Fri, 19 Dec 2008 07:41:48 -0800

> packets with no checksums. We've had this discussion more than once in

First, we're not suggesting "no checksums". We already had this
discussion both the folks from the IPv6 WG and transport area and
everyone agreed that for encapsulation where the interior packet
already has a checksum, an additional checksum over the full
encapsulation provides little benefit and over-burdens the
encapsulating device. We just have not yet followed through with the
draft to make the change.

Greg

---

From: "Greg Shepherd" <[email-masked]>
Date: Fri, 19 Dec 2008 07:41:48 -0800

Greg

---

From: Thomas Narten <[email-masked]>
Date: Fri, 19 Dec 2008 10:57:48 -0500

> draft to make the change.

I understand the plan to be for the outer header (when it is IPv6)
would NOT have a checksum.

Can you remind me of when the discussion with the IPv6 WG took place?
I'd like to review the archive a bit.

Thanks!

Thomas

---

From: Thomas Narten <[email-masked]>
Date: Fri, 19 Dec 2008 10:57:48 -0500

Thanks!

Thomas

---

From: "Greg Shepherd" <[email-masked]>
Date: Fri, 19 Dec 2008 07:59:12 -0800

> I'd like to review the archive a bit.

In the halls and over dinner meetings during the last Vancouver IETF.
There may also be an email trail but I'd have to dig.

Greg

---

From: "Greg Shepherd" <[email-masked]>
Date: Fri, 19 Dec 2008 07:59:12 -0800

Greg

---

From: Thomas Narten <[email-masked]>
Date: Fri, 19 Dec 2008 11:02:18 -0500

> There may also be an email trail but I'd have to dig.

Not to be overdramatic, but while "in the halls and over dinner" is a
fine start, it is hardly sufficient. Was the entire WG at that dinner?
:-)

Thomas

---

From: Thomas Narten <[email-masked]>
Date: Fri, 19 Dec 2008 11:02:18 -0500

Thomas

---

From: Marshall Eubanks <[email-masked]>
Date: Fri, 19 Dec 2008 11:07:40 -0500

I think at this time the thing to do is to wait for us to turn around  
the draft.

Regards
Marshall

---

From: Marshall Eubanks <[email-masked]>
Date: Fri, 19 Dec 2008 11:07:40 -0500

Regards
Marshall

---

From: "Greg Shepherd" <[email-masked]>
Date: Fri, 19 Dec 2008 08:10:43 -0800

On Fri, Dec 19, 2008 at 8:02 AM, Thomas Narten <[email-masked]> wrote:
> fine start, it is hardly sufficient.

Exactly. Now we are taking the next step with the draft.

> Was the entire WG at that dinner?
> :-)

The dinner was with the transport area WG chairs.

Greg

---

From: "Greg Shepherd" <[email-masked]>
Date: Fri, 19 Dec 2008 08:10:43 -0800

Greg

---

From: Dino Farinacci <[email-masked]>
Date: Fri, 19 Dec 2008 08:53:07 -0800

> but it *is* minimal enough that the cost of processing it should be

Sorry, it's not minimal enough. No checksum computation is better than  
any UDPLite.

Please consider hardware implementations that would have to  
encapsulate and replicate out 1000s of tunnels. The less unnecessary  
work the better. And the cost of building hardware is reduced as well.

Dino

P.S. We have talked this thing to death. We (cisco) have silicon built  
on the latest AMT draft.

---

From: Dino Farinacci <[email-masked]>
Date: Fri, 19 Dec 2008 08:53:07 -0800

Dino

---

From: Marshall Eubanks <[email-masked]>
Date: Fri, 19 Dec 2008 15:24:57 -0500

>> would NOT have a checksum.

To be clear, neither the outer header would not have a checksum in  
either Ivp4 and v6.
This only presents a problem with v6 and so our draft is focusing only  
on v6.

The inner header SHOULD have a checksum in my opinion, and if  
necessary I think that the
AMT draft should be amended to make this explicit.

Regards
Marshall

---

From: Marshall Eubanks <[email-masked]>
Date: Fri, 19 Dec 2008 15:24:57 -0500

Regards
Marshall

---

From: Marshall Eubanks <[email-masked]>
Date: Fri, 19 Dec 2008 18:37:02 -0500

>>>> I'd like to review the archive a bit.

By the way, this is planned to go to 6Man. The IPv6 WG itself has been  
closed.

Regards
Marshall

---

From: Marshall Eubanks <[email-masked]>
Date: Fri, 19 Dec 2008 18:37:02 -0500

Regards
Marshall