Subject: Re: [BEHAVE] I-D Action:draft-ietf-behave-v6v4-xlate-21.txt

From: Magnus Westerlund <[email-masked]>
Date: Tue, 14 Sep 2010 13:45:32 +0200

Dan Wing skrev 2010-08-18 22:54:
> 
> 
>> -----Original Message-----
>> From: [email-masked] [mailto:[email-masked]] On
>> Behalf Of Ramji Vaithianathan (rvaithia)
>> Sent: Wednesday, August 18, 2010 1:25 AM
>> To: [email-masked]; [email-masked]
>> Cc: [email-masked]
>> Subject: Re: [BEHAVE] I-D Action:draft-ietf-behave-v6v4-xlate-21.txt
>>
>> I have questions on few things that changed as part of version 21, with
>> regards to UDP checksum.
>>
>>> 3.1 Translation IPv4 headers into IPv6 headers
>>> ...
>>> 3.5 Transport-layer Header Translation
>>> If the address translation algorithm is not checksum neutral (Section
>> 3 of [I-D.ietr-behave-address-format]), the
>>> recalculation and updating of the transport-layer headers which
>> contain pseudo headers need to be performed.
>>> Translators MUST do this for TCP and ICMP.  For UDP, the translator
>> SHOULD provide a configuration function to turn
>>> on/off the updating of the checksum in the UDP headers.  This also
>> includes the case when the translator receives an
>>> unfragmented UDP IPv4 packet and the checksum field is zero.
>>>
>>> 4.1 Translating IPv6 Headers into IPv4 headers
>>> ...
>>> 4.5 Transport-layer Header Translation
>>> If the address translation algorithm is not checksum neutral (Section
>> 3 of [I-d.ietf-behave-address-format]), the
>>> recalculation and updating of the transport-layer headers which
>> contain pseudo headers need to be performed.
>>> Translators MUST do this for TCP and ICMP.  For UDP, the translator
>> SHOULD provide a configuration function to turn
>>> on/off the updating of the checksum in the UDP headers.
>>
>> When we translate the packet from IPv6 to IPv4, we can have a
>> configuration function to either calculate the UDP checksum or set it
>> to
>> 0, because UDP checksum is not mandatory in IPv4.  Is there an
>> advantage
>> not calculating the UDP checksum - only advantage I can see is to save
>> CPU cycles in the translator.  We can always do incremental
>> recalculation which does not look at the entire packet.
>>
>> However when we translate the packet from IPv4 to IPv6, we need to
>> calculate UDP checksum unless we plan to drop the pkt.  Here it is
>> mentioned that there should be a configuration function to turn on/off
>> the updating of checksum even for unfragmented UDP IPv4 packet.  Any
>> reason why there should be an option to turn off updating checksum for
>> unfragmented UDP IPv4 packet - is it to save the CPU cycles in
>> translator?  Do we drop these pkts if the configuration function is set
>> to OFF (no calculation of UDP checksum)?   If yes can this be
>> documented
>> clearly?
> 
> For IPv6, there is a work-in-progress I-D that allows a zero UDP checksum
> in some cases (mostly for tunnels where there is another checksum), see 
> draft-ietf-6man-udpzero.  This is what caused that change in -21.
> 
> An informational reference to that work might be sufficient in Section 3.5 
> of draft-ietf-behave-v6v4-xlate to explain the reason for this configuration
> function, like:
> 
> OLD:
>    For UDP, the translator SHOULD provide a configuration function to 
>    turn on/off the updating of the checksum in the UDP headers.
> NEW:
>    For UDP, the translator SHOULD provide a configuration function to 
>    turn on/off the updating of the checksum in the UDP headers
>    [I-D.ietf-6man-udpzero].
> ...^^^^^^^^^^^^^^^^^^^^^^^
> 
> Would that be sufficient?
> 
> 
> (draft-ietf-behave-v6v4-xlate is being processed by IESG, so we can't make
> that change without our AD's approval.)
> 

Dan,

Still catching up on what has transpired during my parental leave.
However, I think you are overstating what the 6man draft currently does.
So far it is an analysis of what it means to turn off UDP checksum. To
my knowledge no consensus decision has been made to allow it to be
turned off.

Therefore I think xlate is jumping the gun with that 3rd option in the
spec. Currently it creates illegal packet if the option is used in
v4->v6 direction. Also if we change the rules in RFC 2460 regarding v6
UDP checksums there will be clear restrictions on when it is usable.
Thus I think a translator will be forced to ensure that these
restrictions are followed. Which will require some spec text.

Because of that I would suggest that the 3rd option is removed from the
list. I think it also affects text in section 5.5 of version 22.

>    For UDP, if an IPv6 UDP packet arrives with a 0 checksum, a UDP
>    checksum SHOULD NOT be generated for that IPv4 packet.  Otherwise,
>    the translator SHOULD recalculate and update the transport-layer
>    checksum.  The translator MAY have a configuration option permitting
>    it to zero the UDP checksum in some or all traffic.
> 

The reason is that is argues to handle what currently is an illegal
packet that shouldn't occur.

Cheers

Magnus Westerlund

----------------------------------------------------------------------
Multimedia Technologies, Ericsson Research EAB/TVM
----------------------------------------------------------------------
Ericsson AB                | Phone  +46 10 7148287
Färögatan 6                | Mobile +46 73 0949079
SE-164 80 Stockholm, Sweden| mailto: [email-masked]
----------------------------------------------------------------------