Subject: [Syslog] Discuss - UDP Checksum

From: Chris Lonvick <[email-masked]>
Date: Thu, 5 Jul 2007 07:56:39 -0700 (PDT)

Discuss - UDP Checksum

===
Magnus:
Discuss [2007-06-19]:
UDP transport:

Section 3.6:

    It is RECOMMENDED that syslog senders use valid UDP checksums when
    sending messages over IPv4 and IPv6.

    It is RECOMMENDED that syslog receivers check the checksums whenever
    they are present (i.e. the UDP header checksum field value is not 0)
    and discard messages with incorrect checksums.  Note that this is
    typically accomplished by the UDP layer implementation, and some UDP
    implementations allow for checksum validation to be enabled or
    disabled.

Why isn't these MUST? For IPv6 it is an MUST and for IPv4 does there exist 
a single reason not to use the UDP checksum?
===
Lars:
draft-ietf-syslog-transport-udp-09, Section 3.6., paragraph 2:
>    It is RECOMMENDED that syslog senders use valid UDP checksums when
>    sending messages over IPv4 and IPv6.

   Agree with Tim's DISCUSS - this language weakens the MUST for IPv6.
===
Tim:
Discuss [2007-06-19]:
In syslog-transport-udp-09, Section 3.6  (UDP Checksums):

The second and third paragraphs could be read as relaxing the
requirements (specified in RFC 2460) for IPv6 nodes to generate
and verify UDP checksums.

It would be clearer if the text described the recommendations for IPv4
independently, and then noted the requirements inherited from
RFC 2460 with respect to IPv6.
===

Discussion w/ Magnus:
If I understand this correctly the issue that the first paragraph tries to 
address is the usage of the UDP checksum,
rather than people setting checksums not matching the content of the 
packet. Because of that I would like to replace
"valid" with "the" and remove the plural on checksums.

By this response I assume that you had no motivation why one shouldn't use 
the checksum. If that is true, I would
recommend staying at MUST strength. In fact I would probably prefer to 
have the RECOMMENDED to be a MUST also. Unless you
have a reason why one wouldn't checksum the UDP syslog packets I would 
strongly recommend that it is turned on.

> Our motivation was to not get too far into the way that UDP is known to
> work.  If the proper way to write the document is to say that UDP MUST 
be
> checked then we'll gladly do that.

Well, UDP for IPv4 does have this option of turning of the checksum. 
However, I am a strong believer that in most cases it
is not the right thing to do. In the syslog case, bit-errors in the text 
message part may be fine. However, you don't want
to have errors in the priority field. Thus throwing away thus packet is 
probably better than to have them end up in the
wrong queue.

As I see it moving form RECOMMENDED to MUST will probably not make much 
difference. You anyway need to write syslog
receivers that are handling malformed messages. But it does allow a sender 
to not use the checksum if they want to. And if
the WG is fine with that, having understood the potential issues with that 
then I am fine. I simply want to ensure that
you are aware of the implications of what you write.

Proposed resolution (Anton)

Ok. If syslog receiver MUST check checksums, we need to also say what it 
must do in two cases:
(a) checksum is not there (value 0) and

(b) checksum is wrong.
We used to recommend discard only for case B (when it is present and
wrong) like this:

"It is RECOMMENDED that syslog receivers check the checksums whenever
    they are present (i.e. the UDP header checksum field value is not 0)
    and discard messages with incorrect checksums. "

I suggest we say something stronger in line with a MUST:

    syslog senders MUST use UDP checksums when sending messages over IPv4.
    syslog senders MUST use UDP checksums when sending messages over IPv6.

    syslog receivers MUST check the checksums and MUST discard messages
    with missing or incorrect checksums.  Note that this is typically
    accomplished by the UDP layer implementation, and some UDP
    implementations allow for checksum validation to be enabled or
    disabled.

Agreed?

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 5 Jul 2007 19:25:27 +0200

>    implementations allow for checksum validation to be enabled or

Stupid question: Why is UDP checksumming discussed at all in the
SYSLOG UDP transport mapping? People implementing syslog hardly have
control over the UDP layer (and for sure not exclusively) and so if at
all it only makes sense to me to have operational guidelines that UDP
checksums are a good idea - but then again this would not be very much
SYSLOG specific - so why discuss this at all in this document?

Do we from now on want to have every UDP transport document state that
UDP checksums are a good idea?

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Chris Lonvick <[email-masked]>
Date: Thu, 5 Jul 2007 11:29:27 -0700 (PDT)

Hi Juergen,

Good question.  ..and not something that we'll be able to answer in our 
WG.  I'll bring it up in the ietf@ietf list.

Thanks,
Chris

---

From: Chris Lonvick <[email-masked]>
Date: Thu, 5 Jul 2007 11:51:13 -0700 (PDT)

Hi,

On the other hand...
ftp://ftp.rfc-editor.org/in-notes/internet-drafts/draft-ietf-tsvwg-udp-guidelines-01.txt
"UDP Usage Guidelines for Application Designers" (Lars Eggert is 
co-author).

Section 3.4 is "Checksum Guidelines".  It appears that there is enough 
question about this that specific guidance should be given in RFCs.

Which brings us back to our original question.  Is the proposed language 
below what the WG wants?

A quick (and not thorough) check of RFCs which have "UDP" in their titles
shows that RFC 3948, "UDP Encapsulation of IPsec ESP Packets ", pub. Jan
2005, does have specific guidance on the UDP checksum.  To wit:
===
       The UDP header is a standard [RFC0768] header, where

    o  the Source Port and Destination Port MUST be the same as that used
       by IKE traffic,
    o  the IPv4 UDP Checksum SHOULD be transmitted as a zero value, and
    o  receivers MUST NOT depend on the UDP checksum being a zero value.
===

I'd like to hear from people who have current syslog/udp code.  What works 
for you?

Thanks,
Chris

On Thu, 5 Jul 2007, Chris Lonvick wrote:

> Hi Juergen,
>
> Good question.  ..and not something that we'll be able to answer in our WG. 
> I'll bring it up in the ietf@ietf list.
>
> Thanks,
> Chris
>
>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 5 Jul 2007 21:23:48 +0200

> Which brings us back to our original question.  Is the proposed language 

As an implementor, I have a problem with the statement

  syslog senders MUST use UDP checksums when sending messages over IPv4

since on several platforms, I simply can't ensure this when I write a
portable SYSLOG implementation. So I can either claim my code to be
RFC compliant while in a real deployment it might not behave
conforming to the RFC (depending on the kernel settings for example),
or I tell the truth that I can never guarantee compliant behaviour of
my implementation.

So if we need to have language at all, what about

  syslog senders MUST NOT disable UDP checksums

This is something I can implement much more easily since the default
seems to be enabled on those platforms I am familiar with. ;-) 

Or alternatively go back to SHOULD

  syslog senders SHOULD use UDP checksums when sending messages over IPv4

with the likely non-obvious interpretation that you should enable /
not disable checksums in your code but if the kernel bites you, you
are still fine.

My point is that if we put out requirements for implementations, lets
do this in a way that a coder can reasonably implement them.

/js

[No, I am not implementing SYSLOG right now - but I am familiar with
 other protocols running over UDP and hence this got my attention.]

---

From: "Rainer Gerhards" <[email-masked]>
Date: Thu, 5 Jul 2007 22:29:22 +0200

[Strictly speaking as an implementor, not as a draft editor]

I second Juergen's point of view.

I go even further. When receiving, I take great care not to loose any
message. Under stress conditions (e.g. low system memory), I accept lage
deformations of the message. Checksums are my least concern and I
wouldn't discard a message "just" because the checksum is invalid. I
will defintely ignore any such MUST in a RFC, at least by default. I
may, however, flag this message as being in error (which possibly means
it ends up in a different bin). The reasoning behind all this is that a
vital message might be lost forever and it is better to receive it in
some degraded state. At least this is what my *actual* users are
requesting.

Rainer

> -----Original Message-----
> From: Juergen Schoenwaelder 
> [mailto:[email-masked]] 
> Sent: Thursday, July 05, 2007 9:24 PM
> To: Chris Lonvick
> Cc: [email-masked]
> Subject: Re: [Syslog] Discuss - UDP Checksum
>

---

From: Chris Lonvick <[email-masked]>
Date: Thu, 5 Jul 2007 14:14:06 -0700 (PDT)

Hi,

How about the following:

    syslog senders MUST NOT disable UDP checksums.  syslog senders SHOULD
    use UDP checksums when sending messages over IPv4.  syslog senders MUST
    use UDP checksums when sending messages over IPv6.

    syslog receivers should be lenient in what they receive.  IPv4
    receivers SHOULD check the UDP checksums.  They SHOULD accept a
    syslog message with a zero checksum.  They MAY discard messages
    with invalid checksums, or they MAY accept them and attempt to process
    them.  IPv6 receivers MUST check the UDP checksums and MUST discard UDP
    packets containing a zero checksum.

As a point to this, does anyone actually control the UDP subprocess so 
that their syslogd will receive corrupt syslog messages?  That third 
sentence of the second paragraph could use some scrutiny.

Thanks,
Chris

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 6 Jul 2007 01:16:29 +0200

>    use UDP checksums when sending messages over IPv6.

The last sentence is a bit like requiring that the IPv6 implementation
your code happens to run on MUST be correct (and I have no clue how to
turn this requirement into syslog code).

>    packets containing a zero checksum.

I am not sure the MAY discard or MAY accept sentence is needed.

My proposal would be:

    syslog senders MUST NOT disable UDP checksums.  IPv4 syslog
    senders SHOULD use UDP checksums when sending messages. Note that
    RFC 2460 [RFC2460] mandates the use of UDP checksums when sending
    UDP datagrams over IPv6.

    syslog receivers MUST NOT disable UDP checksum checks. IPv4 syslog
    receivers SHOULD check UDP checksums and they SHOULD accept a
    syslog message with a zero checksum. Note that RFC 2460 [RFC2460]
    mandates the use of checksums for UDP over IPv6.

By simply refering to the IPv6 requirement for UDP checksums, we avoid
making this also a syslog requirement. I think we should not use MUST
language for something that can only be implemented correctly below
the syslog software layer.

[Enough hair splitting for today. ;-]

/js

---

From: "Anton Okmyanskiy \(aokmians\)" <[email-masked]>
Date: Tue, 10 Jul 2007 13:57:55 -0400

I agree with Juergen and Rainer that we could use less specification
here since it is a different layer.  How about we replace both
paragraphs with this:

"Syslog senders are RECOMMENDED to use UDP checksums when sending
messages over IPv4. Proper UDP checksum insertion and verification is
already required by IPv6 RFC 1883."

Let's be silent on what the receiver has to do since it may not have any
control.  I think if we put something like "Syslog receivers MAY accept
syslog message with invalid or zero checksums", it would directly
contradict IPv6 RFC, which says:

"IPv6 receivers must discard UDP packets containing a zero checksum, and
should log the error."

Anton.   

> Sent: Thursday, July 05, 2007 4:16 PM
> To: Chris Lonvick (clonvick)
> Cc: [email-masked]
> The last sentence is a bit like requiring that the IPv6 
> implementation your code happens to run on MUST be correct 
> (and I have no clue how to turn this requirement into syslog code).
> 
> By simply refering to the IPv6 requirement for UDP checksums, 
> we avoid making this also a syslog requirement. I think we 
> should not use MUST language for something that can only be 
> implemented correctly below the syslog software layer.
>

---

From: Chris Lonvick <[email-masked]>
Date: Wed, 11 Jul 2007 07:12:03 -0700 (PDT)

Hi,

I don't think that addresses the IESG concerns as well as Juergen's 
proposal.

I'd like to wrap this up.  I don't think that there's any disagreement 
that we need something like this.  Would anyone with any other thoughts 
please send them in.  David and I will determine consensus tomorrow.  :-)

Thanks,
Chris