Re: [Softwires] WG last call on the security document

Florent Parent writes:
> >   So there is only options to recompute checksum (might be
> >   expensive), or make the implementation so it will not check the UDP
> >   checksum of the L2TPv2 packet. This should not matter, as we do
> >   have ESP outside providing much better validation of the received
> >   packet and there is also another checksum inside the packet inside
> >   the L2TPv2+PPP packet.
> 
> In the scenario where IPv4 over IPv6 is used (3.5.4.2), L2TP/UDP is  
> transported over IPv6, so UDP checksum must be enabled:

Not necessarely.

What happens there is that packet comes in:

IPV6 hdr, UDP(4500,4500), ESP, UDP(1701,1701), L2TP, PPP, IPv4, ESP AUTH

There is now multiple checksums. The UDP(4500, 4500) header do have
checksum, and that is checked and is correct. The ESP covers the
packet from UDP(1701, 1701) to the end, so it knows there cannot be
bit errors in that part.

The UDP(1701 1701) header has wrong UDP checksum as it is not fixed by
the NAT (it is inside the ESP). The IPv4 packet inside has also more
checksums. When we strip the UDP encapsulation and ESP, we get packet:

IPV6 hdr, UDP(1701,1701), L2TP, PPP, IPv4

which have wrong checksum for the UDP(1701, 1701) header, but we are
not really interested in that, as we are going to give that the local
L2TP application, that will throw the IPv6 header, UDP(1701, 1701)
header away, and take the IPv4 packet from inside. What we can do
there,  is to simply set the bit on in the kernel internal packet
context saying that UDP checksum is already checked, and there is no
need to recheck it anymore (there is usuallu such bit because the same
thing is used when the ethernet hardware does UDP/TCP checksum
calculations instead of IP stack. If there is no such option in the
kernel, then we must use the "recompute checksum", but in most
environments it is very easy to do the "do not check".

The recompatation does not help at all, as it does not protect againts
any errors or attacks.

Anyways, in the IPv4 we can set UDP checksum to 0, and IPv6 NATs are
not that common, so if you really want you can force them do
recomputations if you want. Or just say that RFC 3948 section 3.1.2
option 1 cannot be done, so either option 2 or 3 MUST be used. 
-- 
kivinen@safenet-inc.com

_______________________________________________
Softwires mailing list
Softwires@ietf.org
https://www1.ietf.org/mailman/listinfo/softwires