Subject: [BEHAVE] Checksum-neutral algorithms

From: Dave Thaler <[email-masked]>
Date: Wed, 10 Jun 2009 01:36:56 +0000

The topic of checksum neutrality has come up a couple times on this list,
but I don't believe I've seen much discussion, so starting this thread.

Some points:

1) Checksum-neutral translation only benefits stateless translators that
   maintain a 1:1 mapping between an IPv4 address and an IPv6 address
   (because otherwise you have to have transport-specific behavior anyway).

2) For stateless 1:1 translators, there's been no reasons given so far to
   standarize a NON-checksum-neutral scheme.  Relying on an admin to
   choose a checksum-neutral prefix is tricky and hence error-prone.
   An algorithm that automatically compensated no matter what the admin
   types is less harmful than one that doesn't.

3) Checksum-neutral compensation bits could be either before or after
   the portion derived from an IPv4 address.

Personally I think checksum neutrality should be at least a strong SHOULD
for any stateless 1:1 algorithm, and I would prefer to make it a MUST.

-Dave

---

From: Rémi Després <[email-masked]>
Date: Wed, 10 Jun 2009 09:33:06 +0200

Dave,

During a previous discussion on higher-layer checksums in v4-v6  
translations, I proposed a comprehensive description of what could  
be, in my understanding, a recommended behavior.
Here is what it was (where adds stands for addresses, and v4-to-v6  
stands for v4-to-v6 translation):
<<<
1. Adjust transport checksum in datagrams if all of:
- v4-to-v6 or v6-to-v4
- first or only fragment of a datagram
- TCP, UDP, or DCCP
- [(Cksm of v6 adds) - (cksm of v4 adds)] is NOT 0xOOOO or 0xFFFF

2. Adjust transport checksum in ICMP error message if all of the  
following:
- v4-to-v6 or v6-to-v4
- single fragment datagram
- ICMP error message for a TCP, UDP, or DCCP datagram
- [(Cksm of returned v6 adds) - (cksm of returned v4 adds)] is NOT  
0xOOOO or 0xFFFF

3. Compute UDP checksum if all of:
- v4 to v6
- single fragment datagram
- UDP
- v4 transport checksum is 0x0000

4. Compute ICMP checksum, possibly after rule 2. if all of:
- v4 to v6
- ICMP

5. Discard packet if all of the following:
- v4-to-v6
- first fragment of a multi-fragment datagram
- UDP
- v4 transport checksum is 0x0000
- the translator doesn't try to reassemble the datagram, or if it  
tries doesn't succeed

6. Forward without higher layer checksum modification if none of the
above rules applies

There may be remaining errors in this, which better specialists of these
subjects will find, but I suggest that this kind of comprehensive
presentation may help to understand what we really recommend.

NOTE: This leaves a problem if an IPv4  single fragment UDP datagram
with a 0x0000 UDP checksum is discarded after a v4-to-v6 translation.
In this case, the UDP checksum in the returned ICMP error message  
cannot, after a stateless v4-to-v6 translation, be the same as that  
of the original packet.

Unfortunately, starting this morning and until June 26, I will hardly  
be able to process my e-mails.
If an answer is needed, it may therefore be after this date.
Thank you for your understanding.

Regards,

RD

Le 10 juin 09 à 03:36, Dave Thaler a écrit :

> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave