Re: [Tofoo] VXLAN (UDP tunnel protocols) and non-zero checksums

[Tom Herbert <[e-mail]>]

> I think your objection may be that you don't think we can assume that
> zero-checksum packets arrive at VXLAN, because of how RFC1122 is worded.
No, I expect zero checksums will be the common case.

> However, RFC768 permits zero-checksum packets as valid and useful to the
> upper layer, so I interpret RFC 1122 as saying "the app might be able to
> configure UDP to discard zero-checksum packets", but if it doesn't, those
> packets already will end up at the application.
>
My interpretation of the VXLAN draft precludes the possibility of an
implementation being able to reject received zero-checksums even as a
configuration option, or even for select senders. So if we receive a
zero checksum from a sender that we know has not disabled checksums,
per the draft we need to accept even though we know this is a
corrupted packet. This may not break the standard, but it doesn't seem
robust either. Is my interpretation correct?

My core concern in all of this is still whether the vni in VXLAN in
being adequately protected against corruption (this would apply to
other encapsulation protocols that carry vni also). The integrity of
the vni is paramount in supporting the isolation requirements of
network virtualization.

Thanks,
Tom






> Joe