Re: [tsvwg] Intdir early review of draft-ietf-tsvwg-udp-options-19

[Tom Herbert <[e-mail]>]

On Mon, Feb 13, 2023 at 3:08 PM C. M. Heard <[e-mail]> wrote:
>
> On Mon, Feb 13, 2023 at 11:07 AM Tom Herbert wrote:
> > On Mon, Feb 13, 2023 at 10:28 AM C. M. Heard wrote:
> > > Those servers can (and probably should) be configured to reject UDP
> > > options with OCS=0, if they are not already configured to reject UDP
> > > packets with CS=0.
> >
> > I agree, but that suggests that there are conditions when it's
> > acceptable to not use OCS=0. What guidance is given for that? Just
> > saying the user needs to figure this out themselves seems like a
> > disservice; this is not the same risk as enabling a CS=0 for UDP. How
> > can a user determine what is safe and what is not in their network?
> > Note that it took two RFCs to describe the necessary conditions in
> > detail to enable CS=0 for UDPv6. Do we need an equivalent discussion
> > on when it's safe not to have the checksum in surplus space?
>
> Section 7 of the draft currently says:
>
>    Like the UDP checksum, the OCS is optional under certain
>    circumstances and contains zero when not used. UDP checksums can be
>    zero for IPv4 [RFC791] and for IPv6 [RFC8200] when UDP payload
>    already covered by another checksum, as might occur for tunnels
>    [RFC6935]. The same exceptions apply to the OCS when used to detect
>    bit errors; an additional exception occurs for its use in the UDP
>    datagram prior to fragmentation or after reassembly (see Section
>    9.4).
>
> If this guidance is too slender, how should it be improved?

Mike,

The casual reference to RFC6935 is a good example of why this text is
insufficient. RFC6935 and RFC6936 were created to allow UDPv6 packets
to have a zero checksum. The UDP checksum was required in IPv6
(RFC2460) because, unlike IPv4, the IPv6 header doesn't contain a
header checksum; the UDP checksum includes the pseudo header that
covers the IPv6 address. So the UDPv6 checksum is needed as an
integrity check of the IPv6 addresses, and the primary risk of using
CS=0 with UPDv6 is the potential for misdelivery when addresses are
corrupted. That is the primary consideration of RFC6935 and RFC6936.
Note that it is a misnomer that those RFCs allow a zero UDPv6 checksum
for all packets, in fact it is a narrowly defined exception applicable
to tunnel protocols under specific circumstances. Also note, in
RFC8086 (GRE over UDP), it still took three pages of requirements to
show how the specific protocol meets the requirements of RFC6935 and
RFC6936. IMO an offhand statement that the exceptions of RFC6935 and
RFC6936 are applicable for a new protocol is trite.

While the risk RFC6935 and RFC6936 is packet misdelivery, the risk of
UDP options is misinterpretation of protocol in a packet. UDP options
present an entirely different problem and the means to address it will
be different. The UDP checksum is completely independent and has no
correlation to the bits of the surplus space, the UDP checksum does
not cover the surplus space and neither is there any coverage if "UDP
payload is already covered by another checksum". So the "The same
exceptions apply to the OCS" are not valid since the exceptions refer
to the UDP checksum which has different properties and different
risks. Without a proper code point, the protocol of the surplus space
needs to be determined solely based on the contents of the space, not
the UDP checksum nor anything else in the packet, and any means of
this determination is probabilistically correct. The probability of
misinterpretation with a checksum is 1/65,536 which is presumably
sufficient. If the idea is to forgo the checksum, then one would
expect a quantitative analysis of both the probability of
misinterpretation and the risks of misinterpretation.

That being said, I see no zero value in making the checksum optional.
Aside from its critical role in validating the surplus is indeed UDP
options, UDPv6 packets are required to have a non-zero checksum so the
OCS is required for all of IPv6 (again RFC6935 and RFC6936 are narrow
exceptions). Furthermore, TCP, the original transport layer protocol
with options, and IPv4 have had a checksums since the beginning and we
don't see people complaining about the performance of those.

Tom

>
> Mike Heard