Re: [Int-dir] [tsvwg] Intdir early review of draft-ietf-tsvwg-udp-options-19

[Gorry Fairhurst <[e-mail]>]

On 14/02/2023 17:50, Tom Herbert wrote:
> On Mon, Feb 13, 2023 at 3:08 PM C. M. Heard <[e-mail]> wrote:
>> On Mon, Feb 13, 2023 at 11:07 AM Tom Herbert wrote:
>>> On Mon, Feb 13, 2023 at 10:28 AM C. M. Heard wrote:
>>>> Those servers can (and probably should) be configured to reject UDP
>>>> options with OCS=0, if they are not already configured to reject UDP
>>>> packets with CS=0.
>>> I agree, but that suggests that there are conditions when it's
>>> acceptable to not use OCS=0. What guidance is given for that? Just
>>> saying the user needs to figure this out themselves seems like a
>>> disservice; this is not the same risk as enabling a CS=0 for UDP. How
>>> can a user determine what is safe and what is not in their network?
>>> Note that it took two RFCs to describe the necessary conditions in
>>> detail to enable CS=0 for UDPv6. Do we need an equivalent discussion
>>> on when it's safe not to have the checksum in surplus space?
>> Section 7 of the draft currently says:
>>
>>     Like the UDP checksum, the OCS is optional under certain
>>     circumstances and contains zero when not used. UDP checksums can be
>>     zero for IPv4 [RFC791] and for IPv6 [RFC8200] when UDP payload
>>     already covered by another checksum, as might occur for tunnels
>>     [RFC6935]. The same exceptions apply to the OCS when used to detect
>>     bit errors; an additional exception occurs for its use in the UDP
>>     datagram prior to fragmentation or after reassembly (see Section
>>     9.4).
>>
>> If this guidance is too slender, how should it be improved?
> Mike,
>
> The casual reference to RFC6935 is a good example of why this text is
> insufficient. RFC6935 and RFC6936 were created to allow UDPv6 packets
> to have a zero checksum. The UDP checksum was required in IPv6
> (RFC2460) because, unlike IPv4, the IPv6 header doesn't contain a
> header checksum; the UDP checksum includes the pseudo header that
> covers the IPv6 address. So the UDPv6 checksum is needed as an
> integrity check of the IPv6 addresses, and the primary risk of using
> CS=0 with UPDv6 is the potential for misdelivery when addresses are
> corrupted. That is the primary consideration of RFC6935 and RFC6936.
> Note that it is a misnomer that those RFCs allow a zero UDPv6 checksum
> for all packets, in fact it is a narrowly defined exception applicable
> to tunnel protocols under specific circumstances. Also note, in
> RFC8086 (GRE over UDP), it still took three pages of requirements to
> show how the specific protocol meets the requirements of RFC6935 and
> RFC6936. IMO an offhand statement that the exceptions of RFC6935 and
> RFC6936 are applicable for a new protocol is trite.
>
> While the risk RFC6935 and RFC6936 is packet misdelivery, the risk of
> UDP options is misinterpretation of protocol in a packet. UDP options
> present an entirely different problem and the means to address it will
> be different. The UDP checksum is completely independent and has no
> correlation to the bits of the surplus space, the UDP checksum does
> not cover the surplus space and neither is there any coverage if "UDP
> payload is already covered by another checksum". So the "The same
> exceptions apply to the OCS" are not valid since the exceptions refer
> to the UDP checksum which has different properties and different
> risks. Without a proper code point, the protocol of the surplus space
> needs to be determined solely based on the contents of the space, not
> the UDP checksum nor anything else in the packet, and any means of
> this determination is probabilistically correct. The probability of
> misinterpretation with a checksum is 1/65,536 which is presumably
> sufficient. If the idea is to forgo the checksum, then one would
> expect a quantitative analysis of both the probability of
> misinterpretation and the risks of misinterpretation.
>
> That being said, I see no zero value in making the checksum optional.
> Aside from its critical role in validating the surplus is indeed UDP
> options, UDPv6 packets are required to have a non-zero checksum so the
> OCS is required for all of IPv6 (again RFC6935 and RFC6936 are narrow
> exceptions). Furthermore, TCP, the original transport layer protocol
> with options, and IPv4 have had a checksums since the beginning and we
> don't see people complaining about the performance of those.
>
> Tom
>
>> Mike Heard

I for one also think that last para on whether OCS needs to be required 
in all cases is something that needs to be considered carefuly.

Gorry