Re: [IPv6] Requiring Tunneling - subject change
"Martin Vigoureux \(Nokia\)" <[email protected]>
| Newsgroups | gmane.ietf.spring,gmane.ietf.ipv6 |
|---|---|
| Message-ID | <[email protected]> |
Hi Joel, Le 2024-03-28 à 16:46, Joel Halpern a écrit : > > CAUTION:This is an external email. Please be very careful when clicking > links or opening attachments. See the URL nok.it/ext for additional > information. > > Robert, as far as I can tell, you are asking for a different change than > any of the other proposals. If I understand, you are proposing that > even end hosts inside an SRv6 domain should encapsulate the underlying > IPv6 packet. In order to help the chairs keep track, and tell if there > are other folks who also support such a change, I have changed the > subject line and ask that if there is more to say, people use this > subject line. > > I look forward to comments from folks beyond Tom and Robert on this subject. before talking about a potential solution, could you confirm that the issue is about respecting a convention? regards -m > > Yours, > > Joel M. Halpern > > On 3/28/2024 11:40 AM, Robert Raszuk wrote: >> Hi Tom, >> >> Not really. >> >> RFC8200 defines an exception which is tunneling and says: >> As an exception to the default behavior, protocols that use UDP >> as a tunnel encapsulation may enable zero-checksum mode for a >> specific port (or set of ports) for sending and/or receiving. >> Any node implementing zero-checksum mode must follow the >> requirements specified in "Applicability Statement for the Use >> of IPv6 UDP Datagrams with Zero Checksums" [RFC6936 <https://datatracker.ietf.org/doc/html/rfc6936>]. >> >> So in practice if we always tunnel SRv6 there is no issue. >> >> Even Andrew agreed with that :) >> >> Cheers, >> Robert >> >> On Thu, Mar 28, 2024 at 4:36 PM Tom Herbert <[email protected]> wrote: >> >> On Thu, Mar 28, 2024 at 7:46 AM Robert Raszuk <[email protected]> >> wrote: >> > >> > Hi Tom, >> > >> > > because of SRH >> > >> > Ok I buy this that there are devices which do check checksum and >> are not final destination of the packets ... I was more talking >> about plain forwarding devices (aka P routers). Then I doubt >> firewalls would be sitting in the core of the networks. >> > >> > But let me come black to what I believe is the main disconnect. >> > >> > Why SRH would cause an issue ? I think there is claimed issue >> *ONLY* with SRv6 packets which are not encapsulated - call it raw >> - sent by the hosts which talk SRv6 and sent with more then one >> SID/uSID which may get swapped on the way. >> > >> > Because only in those cases the destination address will be >> changing while checksum of the tunnel header will not be zero. >> > >> > So what we should I think discuss are really B.1 and B.2.2 cases. >> >> Robert, >> >> The scenario that I'm talking about is really simple, and it's not >> specific to segment routing. If someone sends a TCP in an IPv6 packet >> with no routing header then the convention is that the TCP checksum is >> valid end to end. So if the addresses are changed in flight, like in >> NAT, then we expect that some part of the packet covered by the >> checksum is adjusted to offset the change. If a packet is sent in >> segment routing without an SRH with EtherType 0x86DD then it IS an >> IPv6 packet to the network so all the conventions and requirements of >> IPv6 should be applied. IMO, if SRv6 can't maintain these conventions >> and requirements then it should fork from IPv6 and use a different >> EtherType. >> >> Tom >> >> > >> > Francois, Pablo - could you comment on this how often do we see >> those type of SRv6 deployments ? And also could you comment if >> operator who enables SRv6 in the first place sees those checksum >> errors how difficult is to address it ? >> > >> > Thx, >> > Robert >> > >> > >> > On Thu, Mar 28, 2024 at 3:29 PM Tom Herbert >> <[email protected]> wrote: >> >> >> >> On Thu, Mar 28, 2024 at 6:26 AM Robert Raszuk >> <[email protected]> wrote: >> >> > >> >> > Hi Alvaro, >> >> > >> >> > On this specific topic I think you have flatted it a bit too >> much. >> >> > >> >> > These are apparently the options on the table: >> >> > >> >> > A) Original packet get's encapsulated with IPv6 header >> >> > >> >> > A.1 SHR is added to it >> >> > >> >> > A.1.1. Regular SIDs are used >> >> > A.1.2 Compresses SIDs are used >> >> > >> >> > A.2 SRH is not added to it >> >> > >> >> > A.2.1. Regular SID is used as destination >> >> > A.2.2 Compresses SIDs are used in a container >> >> > A.2.3 Compresses SID is used >> >> > >> >> > B) Original packet get's send from SRv6 host (without >> encapsulation) >> >> > >> >> > B.1 SHR is added to it >> >> > >> >> > B.1.1. Regular SIDs are used >> >> > B.1.2 Compresses SIDs are used >> >> > >> >> > B.2 SRH is not added to it >> >> > >> >> > B.2.1. Regular SID is used as destination >> >> > B.2.2 Compresses SIDs are used in a container >> >> > B.2.3 Compresses SID is used >> >> > >> >> > So within all checksum related discussions so far it seems >> that the only concern is about B.2.2 and perhaps B.1 however folks >> did state that if there is SRH added there is no issue so I am not >> sure how the presence of SRH fixes it. >> >> > >> >> > Maybe there was some assumption that presence of SRH mandates >> encapsulation, but I do not believe this is the case for native >> SRv6 hosts. >> >> > >> >> > All in all I think it should be no business for transit nodes >> to verify packet's upper layer checksum. I do not know if there is >> any RFC which would describe what is an expected behavior for >> transit nodes or even say that they MAY do it. >> >> >> >> Robert, >> >> >> >> I can go further than that. I believe that intermediate nodes >> have no >> >> business parsing into the transport layer, and yet firewalls do >> that >> >> all the time even though there is no standard RFC on it (I've asked >> >> for someone to formalize the requirements of firewalls, but to no >> >> avail). Validating the checksum in flight is an instance of >> this, and >> >> there are devices that commonly do this in deployment. Protocol >> >> specific checksum offload in NICs is one example. Also, if >> someone is >> >> seeing checksum failures in their network, an obvious action is to >> >> sample packets from routers in the path and look at the traces. >> If the >> >> checksum is incorrect on the wire because of SRH then the operator >> >> sees a whole bunch of checksum errors at the router, but has no >> way to >> >> distinguish those packets that are actually good from those >> that are >> >> bad. >> >> >> >> It's a long established convention in IP that the transport >> checksum >> >> is maintained to be correct on the wire-- this is done in NAT by >> >> adjusting the checksum directly, there's also checksum neutral NAT >> >> that adjusts another part of the IPv6 header to keep the transport >> >> layer checksum correct. IMO, deviating from this convention is >> risky, >> >> not just to SRH packets but that can have collateral damage like >> >> breaking the user's ability to debug bad links as I described >> above. >> >> >> >> Tom >> >> >> >> > >> >> > Kind regards, >> >> > Robert >> >> > >> >> > >> >> > >> >> > On Thu, Mar 28, 2024 at 1:06 PM Alvaro Retana >> <[email protected]> wrote: >> >> >> >> >> >> Focusing on the C-SID draft, some have suggested requiring the >> >> >> presence of the SRH whenever C-SIDs are used. Please discuss >> whether >> >> >> that is the desired behavior (or not) -- please be specific when >> >> >> debating the benefits or consequences of either behavior. >> >> >> >> >> >> Please keep the related (but independent) discussion of >> requiring the >> >> >> SRH whenever SRv6 is used separate. This larger topic may impact >> >> >> several documents and is better handled in a different >> thread (with >> >> >> 6man and spring included). >> >> >> >> >> >> Thanks! >> >> >> >> >> >> Alvaro >> >> >> -- for spring-chairs >> >> >> >> >> >> >> -------------------------------------------------------------------- >> >> >> IETF IPv6 working group mailing list >> >> >> [email protected] >> >> >> Administrative Requests: >> https://www.ietf.org/mailman/listinfo/ipv6 >> >> >> >> -------------------------------------------------------------------- >> >> > >> >> > >> -------------------------------------------------------------------- >> >> > IETF IPv6 working group mailing list >> >> > [email protected] >> >> > Administrative Requests: >> https://www.ietf.org/mailman/listinfo/ipv6 >> >> > >> -------------------------------------------------------------------- >> > > -------------------------------------------------------------------- > IETF IPv6 working group mailing list > [email protected] > Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6 > -------------------------------------------------------------------- _______________________________________________ spring mailing list [email protected] https://www.ietf.org/mailman/listinfo/spring