Re: [Softwires] WG last call on the security document

Le 07-12-04 à 09:48, Tero Kivinen a écrit :

> Florent Parent writes:
>>>  So there is only options to recompute checksum (might be
>>>  expensive), or make the implementation so it will not check the UDP
>>>  checksum of the L2TPv2 packet. This should not matter, as we do
>>>  have ESP outside providing much better validation of the received
>>>  packet and there is also another checksum inside the packet inside
>>>  the L2TPv2+PPP packet.
>>
>> In the scenario where IPv4 over IPv6 is used (3.5.4.2), L2TP/UDP is
>> transported over IPv6, so UDP checksum must be enabled:
>
> Not necessarely.
>
> What happens there is that packet comes in:
>
> IPV6 hdr, UDP(4500,4500), ESP, UDP(1701,1701), L2TP, PPP, IPv4, ESP  
> AUTH
>
> There is now multiple checksums. The UDP(4500, 4500) header do have
> checksum, and that is checked and is correct. The ESP covers the
> packet from UDP(1701, 1701) to the end, so it knows there cannot be
> bit errors in that part.
>
> The UDP(1701 1701) header has wrong UDP checksum as it is not fixed by
> the NAT (it is inside the ESP). The IPv4 packet inside has also more
> checksums. When we strip the UDP encapsulation and ESP, we get packet:
>
> IPV6 hdr, UDP(1701,1701), L2TP, PPP, IPv4
>
> which have wrong checksum for the UDP(1701, 1701) header, but we are
> not really interested in that, as we are going to give that the local
> L2TP application, that will throw the IPv6 header, UDP(1701, 1701)
> header away, and take the IPv4 packet from inside. What we can do
> there,  is to simply set the bit on in the kernel internal packet
> context saying that UDP checksum is already checked, and there is no
> need to recheck it anymore (there is usuallu such bit because the same
> thing is used when the ethernet hardware does UDP/TCP checksum
> calculations instead of IP stack. If there is no such option in the
> kernel, then we must use the "recompute checksum", but in most
> environments it is very easy to do the "do not check".

Understood.

>
>
> The recompatation does not help at all, as it does not protect againts
> any errors or attacks.
>
> Anyways, in the IPv4 we can set UDP checksum to 0, and IPv6 NATs are
> not that common, so if you really want you can force them do
> recomputations if you want. Or just say that RFC 3948 section 3.1.2
> option 1 cannot be done, so either option 2 or 3 MUST be used.

This is also a very valid point: UDP encapsulation of ESP may very  
well not by used on IPv6 networks. But if it is, the above  
considerations on UDP checksum will provide the implementation  
guidelines.

Thanks for the comprehensive response.

Florent

_______________________________________________
Softwires mailing list
Softwires@ietf.org
https://www1.ietf.org/mailman/listinfo/softwires