Re: [Int-area] Call for adoption of draft-xu-intarea-ip-in-udp-03

[Xuxiaohu <[e-mail]>]

Hi Joe,

The draft is only intended to introduce one additional Softwires encapsulation technology referred to as IP-in-UDP.  In other words, this encapsulation is only intended to be used within Softwires networks which are well-managed by a service provider. This encapsulation technology is not intended to be used within the Internet. As such, it seems absolutely possible to configure the I-IP transit core to carry an MTU at least large enough to accommodate the added encapsulation headers.

Although it has been said in the draft that "IP-in-UDP is just  applicable in those Softwires network environments where fragmentation on the tunnel layer is not needed." I can add a dedicated Applicability Statement section to emphasize that this Softwires encapsulation technology must only be used within Softwires networks which are well-managed by a service provider and must not be used within the Internet. Can this application statement address your concerns on fragmentation and reassembly?

Best regards,
Xiaohu

From: Joe Touch [mailto:[e-mail]]
Sent: Tuesday, May 24, 2016 12:48 PM
To: Xuxiaohu; Fred Baker (fred); Wassim Haddad
Cc: [e-mail]
Subject: Re: [Int-area] Call for adoption of draft-xu-intarea-ip-in-udp-03


Hi Xiaohu,
On 5/23/2016 7:59 PM, Xuxiaohu wrote:
Hi Joe,

Thanks for your response. Please see my response with [Xiaohu] inline.

From: Joe Touch [mailto:[e-mail]]
Sent: Tuesday, May 24, 2016 12:31 AM
To: Xuxiaohu; Fred Baker (fred); Wassim Haddad
Cc: [e-mail]<mailto:[e-mail]>
Subject: Re: [Int-area] Call for adoption of draft-xu-intarea-ip-in-udp-03


On 5/22/2016 7:44 PM, Xuxiaohu wrote:
Hi Joe,,

As for the four things that you have pointed out (see below),


We know of at least four things that tunnels need that IP-in-UDP ignores:



        - stronger checksums



[Xiaohu] it said in the draft that


" For IPv4 UDP encapsulation, this field is RECOMMENDED to be set
         to zero for performance or implementation reasons because the
         IPv4 header includes a checksum and use of the UDP checksum is
         optional with IPv4.  For IPv6 UDP encapsulation, the IPv6
         header does not include a checksum, so this field MUST contain
         a UDP checksum that MUST be used as specified in [RFC0768<https://tools.ietf.org/html/rfc0768>] and
         [RFC2460<https://tools.ietf.org/html/rfc2460>] unless one of the exceptions that allows use of UDP
         zero-checksum mode (as specified in [RFC6935<https://tools.ietf.org/html/rfc6935>]) applies."


In other words, the stronger checksum (i.e., non-zero checksum of UDP) is strongly recommended especially for IPv6 UDP case. Furthermore, as stated in RFC6935, "Tunnel protocols that encapsulate IP will generally be safe for
   deployment, because all IPv4 and IPv6 packets include at least one

   checksum at either the network or transport layer."  This statement is just applied to the IP-in-UDP case.

The problem is that this advice overlooks the need to account for errors of fragmentation and reassembly (see below). Something stronger than the Internet checksum is typically useful, e.g., as was developed for SEAL (e.g., RFC5320).







        - fragmentation support



[Xiaohu] It said in the draft that

              "   Ingress AFBRs MUST NOT fragment I-IP packets (i.e., UDP encapsulated
   IP packets), and when the outer IP header is IPv4, ingress AFBRs MUST
   set the DF bit in the outer IPv4 header.  It is strongly RECOMMENDED
   that I-IP transit core be configured to carry an MTU at least large
   enough to accommodate the added encapsulation headers.  Meanwhile, it
   is strongly RECOMMENDED that Path MTU Discovery [RFC1191<https://tools.ietf.org/html/rfc1191>] [RFC1981<https://tools.ietf.org/html/rfc1981>]
   is used to prevent or minimize fragmentation.  Once an ingress AFBR
   needs to perform fragmentation on an E-IP packet before
   encapsulating, it MUST use the same source UDP port for all
  fragmented packets so as to ensures these fragmented packets are



Xu, et al.               Expires August 3, 2016                 [Page 5]
________________________________
Internet-Draft           Encapsulating IP in UDP            January 2016


   always forwarded on the same path.  In a word, IP-in-UDP is just
   applicable in those Softwire network environments where fragmentation
   on the tunnel layer is not needed."

In other words,  fragmentation on I-IP packets (i.e., UDP encapsulated IP packets) must be avoided. fragmentation on E-IP packets should be avoided by some means (e.g., I-IP transit core is configured to carry an MTU at least large enough to accommodate the added encapsulation headers or Path MTU discovery is enabled on the UDP tunnels). Fragmentation on E-IP packets is possible only when the E-IP packets are IPv4 packets and the DF bit is not set.

While this is a nice goal, it's not viable. In order to provide a viable IPv6 tunnel, the payload MUST transit IPv6 payloads of at least 1280 bytes.However, there's no reason to assume that the UDP/IPv6 tunnel can support 1280 + UDP + IPv6. So you have only one choice - you can deploy these tunnels only where you can guarantee paths that support 1280+8+40 byte payloads over the tunnel path. However, there's no way to ensure that solely by assuming IPv6 along that path.

I.e., you MUST support source fragmentation at the ingress at the outer IPv6 layer (because UDP doesn't have support for fragmentation and reassembly). If you make this requirement, you can handle IPv6 over the tunnel.

IPv4 will work over a UDP/IPv6 tunnel fairly easily, even assuming the common typical IPv4 MTU (576, even though that's really the reassembled MTU, not the path MTU).

IPv4 over IPv4 is much more difficult, and not only requires fragmentation at the outer packet but also additional reassembly requirements at the egress above and beyond the IPv4 minimums.





        - signalling support (e.g., to test whether a tunnel is up or

        to measure MTUs)


[Xiaohu] It said in the draft that
"it is strongly RECOMMENDED that Path MTU Discovery [RFC1191<https://tools.ietf.org/html/rfc1191>] [RFC1981<https://tools.ietf.org/html/rfc1981>]

   is used to prevent or minimize fragmentation."





        - support for robust ID fields (related to fragmentation,

        e.g., to overcome the limits of IPv4 ID as per RFC 6864)

in other words, the PMTUD signaling is recommended to be supported.

PMTUD is a recipe for black-holing. PLPMTUD is preferred for many reasons.

However, PLPMTUD only ensures proper discovery of the tunnel MTU. It does not describe how the ICMPs inside the tunnel relate to those that are generated by the ingress.

Again, for all of these, see draft-ietf-intarea-tunnels

Joe





[Xiaohu] Is it enough to add a sentence like "to overcome the limits of IPv4 ID as per RFC 6864 when performing fragmentation on E-IP IPv4 packets, the specifications as described in RFC6864 MUST be followed."?



Best regards,

Xiaohu




I'm wondering whether those issues are specific to IP-in-UDP or not. In other words, are those issue also applicable to other X-in-UDP approaches (where X could be LISP, TRILL, VXLAN, VXLAN-GPE, GENEVE, GUE, NSH or MPLS)?

That set of issues applies to all IP-in-(xlist), where xlist includes IP again. The issue is what IP expects and what the tunnel exports.

The other items I pointed out are specific to transport-in-UDP or this specific approach.

Joe