Subject: Re: [MBONED] AMT, IPv6 and zero checksums

From: Marshall Eubanks <[email-masked]>
Date: Mon, 12 Mar 2012 17:56:55 -0400

On Thu, Nov 10, 2011 at 3:38 AM,  <[email-masked]> wrote:
> Dino, Ron,
>
> I understand your frustration, but work on this issue is not finished
> until we have the text in the AMT draft consistent with what is done in
> 6man, which looks to me as a prerequisite if we want to pass IESG
> review. Just saying that the UDP checksum "MAY be zero for AMT IP
> Multicast Data messages carried over IPv6" is, I fear, not good enough
> in this respect.
>
> My thinking is that if people think/know that boxes dropping zero
> checksum'd UPDv6 don't exist or aren't a problem, then they should try
> to modify [I-D.ietf-6man-udpchecksums] so that a few MUSTs are made into
> MAYs.

http://www.ietf.org/id/draft-ietf-6man-udpchecksums-02.txt is out now
and should be discussed in Paris.

If you could be specific about which MUSTs need to become MAYs it
would be good, as this should go to WGLC soon.

Regards
Marshall

> -Thomas
>
>
> Dino Farinacci:
>>> Folks,
>>>
>>> Somehow, it feels like we have been here before. More than once! Let's dedicate some time to resolving this issue at the next MBONED meeting.
>>>
>>>                                                  Ron
>> (1) Stockholm IETF
>> (2) Vancouver IETF
>> (3) Vancouver IETF before that.
>>
>> Dino
>>
>>>
>>>
>>>> Why do we have to bring this up every 18 months?
>>>>
>>>> Dino
>>>>
> _______________________________________________
> MBONED mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mboned

---

From: <[email-masked]>
Date: Tue, 13 Mar 2012 17:46:32 +0100

Hi Marshall,

(below)

2012-03-12, Marshall Eubanks:
> On Thu, Nov 10, 2011 at 3:38 AM,<[email-masked]>  wrote:
>> Dino, Ron,
>>

Thanks for the heads up, but let me clarify: I don't have a stand on 
what need to be changed in draft-ietf-6man-udpchecksums.

What I think we should do is identify what may be inconsistent between 
draft-ietf-6man-udpchecksums and AMT specs.

The following items in draft-ietf-6man-udpchecksums are to consider:

       1.  IPv6 protocol stack implementations SHOULD NOT by default
           allow the new method.  The default node receiver behavior MUST
           discard all IPv6 packets carrying UDP packets with a zero
           checksum.

       2.  Implementations MUST provide a way to signal the set of ports
           that will be enabled to receive UDP datagrams with a zero
           checksum.  An IPv6 node that enables reception of UDP packets
           with a zero-checksum, MUST enable this only for a specific
           port or port-range.  This may be implemented via a socket API
           call, or similar mechanism.

If the above is kept, gateways that do not yet satisfy these two bullets 
will break when talking with non checksumming AMT relays (will not 
receive packets without identifying where the error comes from), which 
raises the question of whether AMT specs are acceptable or not.

Again, I don't have any opinion of what should be done, but I would see 
some approaches that may be considered:
- relax even more the 6man specs, to allow a device to not discard 
zero-checksummed UDPv6 packets even in the absence of bullet (2) above
- modify AMT specs to ensure AMT will work in this case: nothing has 
been done in revision -12 published by Greg last week, we will need to 
decide whether or not we should do something
- do not change any of these specs and only document the case that breaks

-Thomas

---

From: Marshall Eubanks <[email-masked]>
Date: Tue, 13 Mar 2012 13:25:48 -0400

Dear Thomas;

>           discard all IPv6 packets carrying UDP packets with a zero

I think we would have a hard time getting a total relaxation (all
ports all the time)  through the IESG.
This is intended to be for a specific case, tunneling type protocols,
which can avoid the
SHOULD. However, I see no reason, based on this, why AMT couldn't just say,
ALL AMT gateways and Relays MUST allow UDP packets with a zero checksum for
the purposes of AMT.

> raises the question of whether AMT specs are acceptable or not.

How many such gateways are there in the field ? Is backwards IPv6 AMT
compatibility really a serious constraint ?

As far as the port range is concerned, I could certainly see some
protocol saying
"ignore UPD Checksums for port X only," which would arguably be better
for the Internet.
Even for AMT, I don't see why AMT has to allow zero UDP checksums for
(say) port 25.

But, "signaling" here could just be "using AMT" and  I see no reason
why AMT couldn't just say AMT gateways and relays MUST allow for
zero checksums for (say) all ports > 1024 for all AMT traffic. (If it
is built in, the mere fact that you are using AMT signals that UDP
checksums may be zero, and there is no real restriction on the port
range, except that it be specific.)

> - do not change any of these specs and only document the case that breaks

I would like to put this to bed, one way or the other. It's been long enough.

Regards
Marshall

---

From: Greg Shepherd <[email-masked]>
Date: Tue, 13 Mar 2012 10:28:36 -0700

Inline:

> ALL AMT gateways and Relays MUST allow UDP packets with a zero checksum for

Agreed.

> range, except that it be specific.)

Brilliant interpretation! :) I vote for this approach.

Greg

---

From: <[email-masked]>
Date: Tue, 20 Mar 2012 10:32:12 +0100

Hi Marshall, Greg,

2012-03-13, Marshall Eubanks:
>>>>> [email-masked]> :
>>>> Dino, Ron,
>>>>
> which can avoid the SHOULD. However, I see no reason, based on this, why
 > AMT couldn't just say, ALL AMT gateways and Relays MUST allow UDP 
packets
 > with a zero checksum for the purposes of AMT.
 >
>

The compatibility issue, as I understand is the following: what if you 
implement the AMT gateway function and run it on a platform on which 
item (2) above is not implemented ? (for instance the kernel supports 
the new feature, but the socket API extension isn't ready)

> Even for AMT, I don't see why AMT has to allow zero UDP checksums for

Well, we could add to AMT specs that "an AMT Gateway MUST allow for zero 
checksums for UDP traffic coming from port 2268". That would be specific 
enough.

> zero checksums for (say) all ports>  1024 for all AMT traffic. (If it

See above: as I understand it the "signalling" needed is between the 
userland software and the IP stack.  I don't think that "using AMT" can 
fit this role, unless you want IP stacks to carry a built-in list of 
port ranges for which zero checksums are allowed.

> I would like to put this to bed, one way or the other. It's been long enough.

Ok, let me suggest the following text for AMT specs:

  x.x UDP Checksum of AMT Data messages carried over IPv6

   An AMT Relay MAY set the UDP checksum of AMT Data messages carried
   over IPv6 to zero, if is known that the gateway implementation can
   receive UDP packets with a zero checksum. Such will be the case if
   the IP stack over which this implementation runs has the ability to
   not drop zero-checksummed packets for specified UDP ports (as
   documented in [I.D-ietf-6man-udpchecksums]) and if intermediate
   devices on the path do not drop UDP with a zero checksum.

   In the case where an AMT Relay sets the UDP checksum to zero of AMT
   Data packets carried over IPv6 and there exists an IP stack on the
   path that drops such packets (for instance the host IP stack of the
   gateway if it does not comply with [I.D-ietf-6man-udpchecksums]),
   then the AMT Gateway will not receive the AMT Data packets but will
   not be able to detect that. Letting Gateways detect such an issue and
   eventually attempt to find another Relay is left up for a further
   revision of AMT.

Comments ?

-Thomas