Re: [Tofoo] VXLAN (UDP tunnel protocols) and non-zero checksums

[Tom Herbert <[e-mail]>]

On Fri, May 2, 2014 at 3:25 PM, Joe Touch <[e-mail]> wrote:
>
>
>
> On 5/2/2014 2:34 PM, Tom Herbert wrote:
> ...
>>
>>            VXLAN draft also breaks this by making accepting packets with
>>
>>         zero checksums a MUST.
>>
>>     That's not "breaking" anything; VXLAN is - to UDP - an application.
>>
>> Perhaps not, but making it a MUST in the encapsulation protocol
>> definition to always accept UDP packets with zero checksums seems a bit
>> austere. For instance, if I know within my deployment that all senders
>> are configured to use checksums, then receiving a packet with zero
>> checksum should be considered an invalid packet.
>
>
> Sorry if I'm missing something here - this started with the following, from draft-mahalingam-dutt-dcops-vxlan-09, which focuses on the non-zero checksum case:
>
>
> "When a decapsulating endpoint receives a packet with a non-zero
> checksum it MAY choose to verify the checksum"
>
> The point is that this is NOT an option. If the UDP checksum is nonzero, it MUST be validated.
>
> (this isn't open to interpretation; if you want to have VXLAN accept non-zero checksums that are invalid, then you are not compliant with what few standards the Internet has)
>
I am referring to:

"When a packet is received with a UDP checksum of zero, it MUST be
accepted for decapsulation."

>
> ---
>
> When the UDP checksum is zero, RFC1122 says that:
>
>         - an app MAY optionally be able to configure a system
>         to accept zero-checksum UDP packets up or discard them
>
> It would be a bad idea for VXLAN to assume that this configuration is available. However, that leaves only two cases:
>
>         1) if accept/discard of zero-checksum IS available, then
>         VXLAN would configure it to accept
>
>         2) if accept/discard of zero-checksum is NOT available,
>         then UDP *MUST* pass the zero-checksum packets to VXLAN.
>         It's up to VXLAN to decide how to handle them - and it's
>         OK to require VXLAN to MUST accept them (i.e., to treat
>         them the same way as a valid non-zero checksum)
>
> When you have a stronger validation mechanism, I see no reason to drop packets with zero checksums for that reason alone - however, VXLAN really needs to say that *it* will do that drop if necessary, not to assume that UDP can be configured to do so.
>
> Joe
>
>
>
>
>
>