Subject: RE: [Pana] Issue126: Clarify PANA-Error-Request msgwithPANA-Reauth-Request

From: [email-masked]
Date: Mon, 20 Dec 2004 11:26:15 +0200

In addition to the MAY, how about making the retransmission optional
in case if there is no session? 

This way PAA would not need to keep state AND in case of a DoS attack
it may stop sending the PER messages.

Br,
- Dan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On 
> Behalf Of ext Yoshihiro Ohba
> Sent: 17 December, 2004 15:12
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; 'Tschofenig Hannes'; [email-masked]
> Subject: Re: [Pana] Issue126: Clarify PANA-Error-Request 
> msgwithPANA-Reauth-Request
> 
> 
> On Fri, Dec 17, 2004 at 03:47:37PM -0800, Alper Yegin wrote:
> > 
> > Good point.
> > 
> > Than how about making it a MAY with a warning notice on 
> potential DoS
> > threat? A deployment that is concerned about DoS does not have to
> > generate PER on unknown session IDs.
> 
> "MAY" works for me.
> 
> Yoshihiro Ohba
> 
> 
> > 
> > Alper
> > 
> > 
> > > -----Original Message-----
> > > From: Yoshihiro Ohba [mailto:[email-masked]]
> > > Sent: Friday, December 17, 2004 3:34 AM
> > > To: Alper Yegin
> > > Cc: 'Yoshihiro Ohba'; [email-masked]; 'Tschofenig Hannes'
> > > Subject: Re: [Pana] Issue126: Clarify PANA-Error-Request 
> msg withPANA-
> > > Reauth-Request
> > > 
> > > On Fri, Dec 17, 2004 at 11:51:51AM -0800, Alper Yegin wrote:
> > > > Yoshi,
> > > >
> > > > > > > I think you are right.  The PAA could send a PER with the
> > unknown
> > > > > > > session id, but it does not have a state to 
> receive a PEA from
> > the
> > > > > > > PaC.
> > > > > >
> > > > > > What do you mean by that? You mean PAA cannot set a 
> timer and
> > wait
> > > > for a
> > > > > > matching PEA?
> > > > >
> > > > > Yes.  I think there is no state in the PAA to wait 
> for a matching
> > PEA
> > > > > for the unknown session id.
> > > >
> > > > There is nothing in the spec that prevents an 
> implementation to keep
> > > > track of PERs sent for unknown sessions and match incoming PEAs.
> > This is
> > > > an implementation issue.
> > > 
> > > PANA session attributes in the specification include 
> retransmission
> > > states.  I don't think those attributes should be maintained for
> > > non-existing sessions.  If we maintain attributes for non-existing
> > > sessions, an attacker could send a lot of 
> PANA-ReAuth-Requests with
> > > randomly generated bogus session ids, and if the PAA 
> needs to return
> > > PER and create retransmission states for each of such 
> PRARs, then the
> > > PAA's retransmission queue would easily be flooded.  MAC AVP
> > > pretection will not work for this, because there is no 
> way to validate
> > > messages with unknown session.
> > > 
> > > >
> > > >
> > > > > Yes.  On the other hand, I am wondering if this error code is
> > really
> > > > > needed
> > > > > for the above reason.
> > > >
> > > > It is useful for being informative, and for network diagnostics.
> > Same
> > > > reason for sending any other error message.
> > > 
> > > But it can open a DoS attack.
> > > 
> > > Yoshihiro Ohba
> > > 
> > > >
> > > > Alper
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > >
> > > > >
> > > > > Yoshihiro Ohba
> > > > >
> > > > >
> > > > > >
> > > > > > Alper
> > > > > >
> > > > > >
> > > > > >
> > > > > > >
> > > > > > > Yoshihiro Ohba
> > > > > > >
> > > > > > >
> > > > > > > >
> > > > > > > > Alper
> > > > > > > >
> > > > > > > >
> > > > > > > > > -----Original Message-----
> > > > > > > > > From: [email-masked] 
> [mailto:[email-masked]]
> > On
> > > > > > Behalf
> > > > > > > > Of
> > > > > > > > > Tschofenig Hannes
> > > > > > > > > Sent: Monday, December 13, 2004 4:40 AM
> > > > > > > > > To: [email-masked]
> > > > > > > > > Subject: [Pana] Issue126: Clarify 
> PANA-Error-Request msg
> > > > > > > > withPANA-Reauth-
> > > > > > > > > Request
> > > > > > > > >
> > > > > > > > > hi all,
> > > > > > > > >
> > > > > > > > > i would like to close issue#126.
> > > > > > > > >
> > > > > > > > > initially the rafa has send a comment on the
> > re-authentication
> > > > > > > > handling:
> > > > > > > > >
> > > > > > > > > > Rafa:
> > > > > > > > > >
> > > > > > > > > > Section 4.4.
> > > > > > > > > >
> > > > > > > > > > -- "If PAA cannot identify the session, it 
> MUST respond
> > with
> > > > a
> > > > > > > > > > PANA-Error-Request with the error code
> > > > PANA_UNKNOWN_SESSION_ID.
> > > > > > > > > > PANA-Reauth-Request/Answer messages MUST 
> contain a MAC
> > AVP
> > > > when
> > > > > > PANA
> > > > > > > > SA
> > > > > > > > > > is available. "
> > > > > > > > > >
> > > > > > > > > > Taking into account section 5.7 PaC should 
> restransmit
> > > > > > > > > > PANA-Reauth-Request but however I think same answer
> > would be
> > > > > > > > received
> > > > > > > > > > becuase this error cannot be solved. On the 
> other hand I
> > > > think
> > > > > > PAA
> > > > > > > > > > should initiate reauthentication.
> > > > > > > > >
> > > > > > > > > yoshi responded:
> > > > > > > > >
> > > > > > > > > When the PAA returns the PER with the error code
> > > > > > > > > PANA_UNKNOWN_SESSION_ID, it should terminate 
> the session.
> > > > > > > > > After that, subsequent PANA-Reauth-Request will not be
> > > > > > > > > answered.
> > > > > > > > >
> > > > > > > > > the suggested change therefore is to change 
> the following
> > > > > > paragraph
> > > > > > > > > (section
> > > > > > > > > 4.4 on 'Re-authentication Phase', first 
> paragraph) from:
> > > > > > > > >
> > > > > > > > > "
> > > > > > > > > If PAA cannot identify the session, it MUST
> > > > > > > > >    respond with a PANA-Error-Request with the 
> error code
> > > > > > > > >    PANA_UNKNOWN_SESSION_ID.  
> PANA-Reauth-Request/Answer
> > > > messages
> > > > > > MUST
> > > > > > > > >    contain a MAC AVP when PANA SA is available.
> > > > > > > > > "
> > > > > > > > >
> > > > > > > > > to:
> > > > > > > > >
> > > > > > > > > "
> > > > > > > > >    If the PAA cannot identify the session based on the
> > > > received
> > > > > > > > Session-Id,
> > > > > > > > > it MUST respond with a
> > > > > > > > >    PANA-Error-Request with the error code
> > > > PANA_UNKNOWN_SESSION_ID.
> > > > > > The
> > > > > > > > PAA
> > > > > > > > > MUST
> > > > > > > > >    terminate the session once it receives a
> > PANA-Error-Answer
> > > > for
> > > > > > the
> > > > > > > > >    PANA-Error-Request. A denial of service 
> attack is not
> > > > possible
> > > > > > if
> > > > > > > > the
> > > > > > > > > PANA exchange is protected
> > > > > > > > >    with a keyed message digest (MAC AVP).
> > > > > > > > > "
> > > > > > > > >
> > > > > > > > > ciao
> > > > > > > > > hannes
> > > > > > > > >
> > > > > > > > > _______________________________________________
> > > > > > > > > Pana mailing list
> > > > > > > > > [email-masked]
> > > > > > > > > https://www1.ietf.org/mailman/listinfo/pana
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > _______________________________________________
> > > > > > > > Pana mailing list
> > > > > > > > [email-masked]
> > > > > > > > https://www1.ietf.org/mailman/listinfo/pana
> > > > > >
> > > > > >
> > > > > >
> > > > > > _______________________________________________
> > > > > > Pana mailing list
> > > > > > [email-masked]
> > > > > > https://www1.ietf.org/mailman/listinfo/pana
> > > >
> > > >
> > 
> > 
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 20 Dec 2004 12:48:22 -0500

Hi Dan,

> it may stop sending the PER messages.

I understand the pros for making the PER retransmission optional in
the above case.  On the other hand, this will make a special case for
retransmission rule described in section "Retransmission Timers" in
which all requests need to follow the same retransmission rule with
the same set of the parameter values (i.e., REQ_IRT, REQ_MRT, REQ_MRC
and REQ_MRD).  I am not sure this optional feature (i.e., making PER
retransmission MAY) in addition to the optional transmission of PER in
case of unknown session id is worth defining.

Yoshihiro Ohba