[tsvwg] OCS option in draft-ietf-tsvwg-udp-options-07

["C. M. Heard" <[e-mail]>]

Greetings,

In an off-list e-mail, Gorry Fairhust brought to my attention the fact that
the errant middleboxes that CCO is designed to work around do not use the
correct length value in their (re)computation of the UDP checksum. Quoting
from draft-fairhurst-udp-options-cco-00:

   These middleboxes use the IP Payload Length (obtained as IP Total
   Length - IP Header Length) to fill UDP pseudo-header Length field and
   also compute the checksum over the all IP Payload bytes.

The genesis of this bug is discussed in the maprg presentation given by the
Tom Jones at IETF 103 (
https://datatracker.ietf.org/meeting/103/materials/slides-103-maprg-a-tale-of-two-checksums-tom-jones-00
).

So, besides compensating for the contents of the surplus area, it is
also necessary to compensate for the incorrect length value in the
UDP pseudo-header. The way that CCO does this is to add a 16-bit
pseudo-header of its own that consists of the length of the surplus
area. This pseudo-header needs to be aligned with the UDP pseudo-header
in order to do its job. Aligning the checksum in the CCO option to a
half-word boundary achieves this.

These are the points that Rafaele Zullo was trying to make in the message at
https://mailarchive.ietf.org/arch/msg/tsvwg/ikg4zLMvejJZERWh4hQTAGUrLGY
that escaped both Joe and me.

So, it would seem that the OCS text in draft-ietf-tsvwg-udp-options-07
needs some more editing work to take this into account. The objectives
can still be achieved with an option that has kind = 2 followed by a
16-bit checksum and no length value, but the calculation has to take
into account the fact that the fact that the 16-bit pseudo-header needs
to be aligned with the UDP header. Rafaele Zullo's message discusses
some of the options. One is to use a NOP to force half-word alignment,
but there are other ways to accomplish that objective.

Another point is that it is necessary either for the OCS to cover the
entire surplus area or else for any padding after the UDP options
to be checksum-neutral (e.g., consist of zeroes) in order to properly
compensate for the middlebox behavior described above.

Besides these matters of substance, there are some editorial matters
that need to be attended to. In Section 4 I see:

   UDP options are defined using a TLV (type, length, and optional
   value) syntax similar to that of TCP [RFC793]. They are typically a
   minimum of two bytes in length as shown in Figure 4, excepting only
   the one byte options "No Operation" (NOP) and "End of Options List"
   (EOL) described below.

If OCS is to have no length field (i.e., have an implicit length of 3),
then some text needs to be added to that paragraph. Also, Figure 7 in
Section 5.3 needs to be updated to something like this:

                   +--------+--------+--------+
                   | Kind=2 |     Checksum    |
                   +--------+--------+--------+


The modifications to OCS requested above would not, AFAICT, cause any
significant additional complication. They would also not address the
fact that errant middle box traversal for LITE or FRAG+LITE remains
unaddressed, but I see those as separate issues.

Mike Heard