Subject: (ngtrans) csum update in NAT-PT

From: [email-masked]
Date: Wed, 18 Apr 2001 15:28:50 +0300

hello all,

I think i found something missing in NAT-PT rfc regarding checksum update of
ICMP packets...

for icmpv4 to icmpv6, the rfc states:

   ICMPv6, unlike ICMPv4, uses a pseudo-header, just like UDP and TCP
   during checksum computation. As a result, when the ICMPv6 header
   checksum is computed [SIIT], the checksum needs to be adjusted to
   account for the additional pseudo-header. Note, there may also be
   adjustments required to the checksum due to changes in the source and
   destination addresses (and changes in TCP/UDP/ICMP identifiers in the
   case of NAPT-PT) of the payload carried within ICMP.

it doesn't say anything about the modifications to the checksum to take into
account the change in the icmp headers..

for icmpv6 to icmpv4, the rfc states:

   The checksum calculation for a V4 ICMP header needs to be derived
   from the V6 ICMP header by running the checksum adjustment algorithm
   [NAT] to remove the V6 pseudo header from the computation. Note, the
   adjustment must additionally take into account changes to the
   checksum as a result of updates to the source and destination
   addresses (and transport ports in the case of NAPT-PT) made to the
   payload carried within ICMP.

again it doesn't say anything about the modifications to the checksum to
take into account the change in the icmp headers..

imran

---

From: [email-masked]
Date: Mon, 23 Apr 2001 13:58:23 +0300

> I think you can directly calculate the checksum for icmpv4 to 
> icmpv6, and most situations in icmpv6 to icmpv4 simply. There 

What about fragmented Echo Request and Reply messages?? You need to use the
incremental checksum update algorithm there. Checksum from scratch doesn't
work in this case. 

> is only one special case during computation the checksum for 
> icmpv6 to icmpv4 with the error message of destination 
> unreachable, for this case you should use the adjustment 

Well, in the case of ICMP error messages, I think it is much wiser to
calculate the checksum from scratch since there are so many changes in the
headers + payload .....of course, you could use incremental checksum update
algorithm in this case....but it doesn't need to be used since there are
almost never going to be fragmented icmp error messages...

imran

---

From: [email-masked]
Date: Mon, 23 Apr 2001 09:14:22 +0300

Hi, Imran

I think you can directly calculate the checksum for icmpv4 to icmpv6, and
most situations in icmpv6 to icmpv4 simply. There is only one special case
during computation the checksum for icmpv6 to icmpv4 with the error message
of destination unreachable, for this case you should use the adjustment
algorithm otherwise you can not get your result.
I had done it in my implementation and my implementation work well now.
Do everyone agree with me?

BR
Howard

-----Original Message-----
From: ext [email-masked] [mailto:[email-masked]]
Sent: Wednesday, April 18, 2001 8:29 PM
To: [email-masked]
Subject: (ngtrans) csum update in NAT-PT

hello all,

imran

---

From: [email-masked]
Date: Wed, 25 Apr 2001 11:31:35 +0300

> About the coming fragmented messages, you need to buffer 
> their contents and generate a complete new package which may 
> not need fragment in other IP version, or just do fragment 
> with these contents. This is the time you can do Checksum 
> from scratch without using the incremental checksum update algorithm.

The NAT-PT/SIIT RFC does not say to re-assemble fragments..make the original
packet...and then translate. It says to perform translation independently on
each fragment....no re-assembly is required to be done by the NAT-PT/SIIT
router (except for a special & rare case of frag UDP packet with 0 csum).
So, i guess incremental checksum update has to be used in case of fragmented
packets (as specified by the RFC).

> The reason of using incremental checksum update algorithm for 
> ICMP error message is base on that you need to keep 
> unchanging the checksum of IP in payload so as to identify 
> the original application, in that case you can not calculate 
> the checksum from scratch. It is not matter if it is fragmented.

I didn't get your point properly. But i can say that even the IP header in
the payload of ICMP error messages undergoes translation ...so its checksum
has to be re-calculated and regarding the transport header inside the
payload.....you just need to do the translation of transport identifiers
(port no, or the echo seq id) & the header (if it is icmp header)....and no
checksum is to be re-calculated for this inner transport header...because
the application is never going to have a look at it.....

ip

---

From: [email-masked]
Date: Wed, 25 Apr 2001 09:46:06 +0300

>-----Original Message-----
From: Patel Imran (NET/Espoo) 
>Sent: 2001Äê4ÔÂ23ÈÕ 18:58
>Subject: RE: (ngtrans) csum update in NAT-PT

>What about fragmented Echo Request and Reply messages?? You need to use the
incremental checksum update algorithm there. Checksum from scratch
> doesn't work in this case. 

About the coming fragmented messages, you need to buffer their contents and
generate a complete new package which may not need fragment in other IP
version, or just do fragment with these contents. This is the time you can
do Checksum from scratch without using the incremental checksum update
algorithm.

headers
> + payload .....of course, you could use incremental checksum update
almost never
> going to be fragmented icmp error messages...

The reason of using incremental checksum update algorithm for ICMP error
message is base on that you need to keep unchanging the checksum of IP in
payload so as to identify the original application, in that case you can not
calculate the checksum from scratch. It is not matter if it is fragmented.

 Your sincerely
 Hao Wang --- Howard
 ============================
 Advanced Internet Technologies Group
 Nokia (China) R&D Center, 6th floor
 No.11, Hepingli Dongjie, Beijing
 Beijing China, 100013
 
 E-mail:[email-masked]
 
 Tel : +86 10 84229922 Ext. 2873
 MP: +86 13601028312
 =============================

---

From: [email-masked]
Date: Thu, 26 Apr 2001 10:31:59 +0300

read the section 5.3 in RFC 2766 carefully and do some experiment. 

Howard

-----Original Message-----
From: Patel Imran (NET/Espoo) 
Sent: Wednesday, April 25, 2001 4:32 PM
To: Wang Hao.H (Nokia-RD/Beijing)
Cc: [email-masked]'
Subject: RE: (ngtrans) csum update in NAT-PT

>The NAT-PT/SIIT RFC does not say to re-assemble fragments..make the
original packet...and then translate. It says
> to perform translation independently on each fragment....no re-assembly is
required to be done by the NAT-PT/SIIT
> router (except for a special & rare case of frag UDP packet with 0 csum).
So, i guess incremental checksum update
> has to be used in case of >fragmented packets (as specified by the RFC).