Re: [tsvwg] UDP Options: on forcing the use of UDP CS=0 in connection with FRAG+LITE

["C. M. Heard" <[e-mail]>]

On Fri, Jun 28, 2019 at 2:30 PM Tom Herbert <[e-mail]> wrote:

> On Fri, Jun 28, 2019 at 9:23 AM C. M. Heard <[e-mail]> wrote:
>
...

> .For IPv6, at least, it seems that UDP CS=0 does not have very good
>> middlebox
>> traversal properties. Raffaele Zullo has shared with me the results of
>> some
>> (admittedly small-scale) measurements he did to look specifically at this,
>> and the results were not especially encouraging: depending on the test
>> case,
>> between 26% and 36% of the paths blocked UDP CS=0 over IPv6 from reaching
>> the final router before the  destination (see results for test cases B1
>> below). By contrast, a UDP packet with a properly compensated checksum was
>> seen in previous measurements to have around a 94% chance of getting to
>> the
>> destination under comparable circumstances (see results for IPv6 HTTP in
>>
>> https://datatracker.ietf.org/meeting/103/materials/slides-103-maprg-a-tale-of-two-checksums-tom-jones-00
>> <https://datatracker..ietf.org/meeting/103/materials/slides-103-maprg-a-tale-of-two-checksums-tom-jones-00>
>> ).
>>
>> Also, this is would be violation of RFC8200: "IPv6 receivers must
> discard UDP packets containing a zero checksum and should log the error".
> So it's not just middleboxes, end hosts will also have problems with UDPv6
> zero checksums.
>

Yes, of course -- the low DNS response rate in Raffaele's data below bear
that out -- but if the intent is to use it for the FRAG option, then hosts
would need modifications anyway.


> > On 2019-04-07 16:11, C. M. Heard wrote:
>> > > Hello Raffaele,
>> > >
>> > > Thank you for taking the time to dig out this information.
>> > >
>> > > I see that the response rates for UDP CS=0 over IPv6 are quite low,
>> > > with
>> > > or without UDP options.  However, as you point out, the measurements
>> > > cannot distinguish cases where middleboxes in the path discard CS=0
>> > > packets from cases where the server itself does so.  In order to draw
>> > > firm conclusions about the the proportion of paths that drop IPv6 UDP
>> > > CS=0,
>> > > it seems that one would need some independent means to estimate
>> > > the proportion of servers that discard IPv6 UDP CS=0..
>> > >
>> > > Do you think it would be useful to share this data with the TSVWG
>> list?
>> > >
>> > > Good luck on the job hunt.
>> > >
>> > > Mike Heard
>> > >
>> > > On Sun, Apr 7, 2019 at 6:25 AM Raffaele Zullo wrote:
>> > > >
>> > > > Hello Gorry,
>> > > > Hello Mike,
>> > > >
>> > > > Sorry for the late reply.
>> > > > I've got lost in a few other things (basically job hunting is a
>> job).
>> > > >
>> > > > Anyway I finally got my VPN access to the lab network restored so I
>> > > > could retrieve measurements data.
>> > > >
>> > > >
>> > > > We tested a limited number of (paths to) IPv6 servers, obtained from
>> > > > Alexa top-1m:
>> > > > 17110 authoritative DNS servers
>> > > > and
>> > > > 12184 HTTP servers.
>> > > >
>> > > > DNS servers were tested with well-crafted DNS queries.
>> > > > The first packet was a regular UDP packet with correct CS.
>> > > > If the server replied to the query then it was tested with CS=0,
>> > > > Options, etc.
>> > > >
>> > > > Paths to HTTP servers were instead tested with padded packets sent
>> to
>> > > > UDP port 80.
>> > > > The first packet was again a regular UDP packet with correct CS.
>> > > > If the server replied with ICMP Port Unreachable, then it was tested
>> > > > with CS=0, Options, etc.
>> > > >
>> > > > Out of 17110 DNS servers
>> > > > 1.75% replied to UDP CS=0
>> > > > 1.43% replied to UDP+Opt CS=0
>> > > >
>> > > > Out of 12184 HTTP servers
>> > > > 17.21% replied to UDP CS=0
>> > > > 16.67% replied to UDP+Opt CS=0
>> > > >
>> > > >
>> > > > These are the raw data.
>> > > >
>> > > >
>> > > > I would add that the portion of paths OK with IPv6 UDP CS=0 can be
>> > > > underestimated.
>> > > > Since we are measuring paths to servers, the server itself can
>> affect
>> > > > the measurement,
>> > > > for instance if the path is clean but the server's stack discards
>> IPv6
>> > > > with UDP CS=0, the outcome of the measurement will be negative.
>> > > >
>> > > >
>> > > > Cheers,
>> > > > Raffaele
>> > > >
>> > >
>> >
>>
>