Subject: [Pana] Issue126: Clarify PANA-Error-Request msg with PANA-Reauth-Request

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 13 Dec 2004 13:39:55 +0100

hi all, 

i would like to close issue#126. 

initially the rafa has send a comment on the re-authentication handling:

> Rafa: 
> 
> Section 4.4.
> 
> -- "If PAA cannot identify the session, it MUST respond with a
> PANA-Error-Request with the error code PANA_UNKNOWN_SESSION_ID.
> PANA-Reauth-Request/Answer messages MUST contain a MAC AVP when PANA SA
> is available. "
> 
> Taking into account section 5.7 PaC should restransmit
> PANA-Reauth-Request but however I think same answer would be received
> becuase this error cannot be solved. On the other hand I think PAA
> should initiate reauthentication.

yoshi responded: 

When the PAA returns the PER with the error code
PANA_UNKNOWN_SESSION_ID, it should terminate the session. 
After that, subsequent PANA-Reauth-Request will not be
answered.  

the suggested change therefore is to change the following paragraph (section
4.4 on 'Re-authentication Phase', first paragraph) from: 

"
If PAA cannot identify the session, it MUST
   respond with a PANA-Error-Request with the error code
   PANA_UNKNOWN_SESSION_ID.  PANA-Reauth-Request/Answer messages MUST
   contain a MAC AVP when PANA SA is available.
"

to:

"
   If the PAA cannot identify the session based on the received Session-Id,
it MUST respond with a
   PANA-Error-Request with the error code PANA_UNKNOWN_SESSION_ID. The PAA
MUST
   terminate the session once it receives a PANA-Error-Answer for the
   PANA-Error-Request. A denial of service attack is not possible if the
PANA exchange is protected 
   with a keyed message digest (MAC AVP). 
"

ciao
hannes

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 13 Dec 2004 01:31:06 -0500

Hi Hannes,

>    with a keyed message digest (MAC AVP). 

I think the last sentence should specify a behavior rather than describing 
the characteristics.  How about this?

" 
If the PAA cannot identify the session based on the received
Session-Id, it MUST respond with a PANA-Error-Request with the error
code PANA_UNKNOWN_SESSION_ID.  The PAA MUST terminate the session once
it receives a PANA-Error-Answer for the PANA-Error-Request.  The
PANA-Reauth-Request/Answer messages MUST contain a MAC AVP when there
is a PANA SA in order to avoid a denial of service attack.
"

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Mon, 13 Dec 2004 13:39:00 -0800

If a session-id is unknown, which sessions gets terminated?

I don't think there would be any termination of sessions in here.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
Of
> Tschofenig Hannes
> Sent: Monday, December 13, 2004 4:40 AM
> To: [email-masked]
> Subject: [Pana] Issue126: Clarify PANA-Error-Request msg
withPANA-Reauth-
> Request
Session-Id,

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 16 Dec 2004 17:43:41 -0500

> I don't think there would be any termination of sessions in here.

I think you are right.  The PAA could send a PER with the unknown
session id, but it does not have a state to receive a PEA from the
PaC.  So PER-PEA exchange does not seem to make sense for this error.

The right behavior might be just silently discarding the
PANA-Reauth-Request if the session id is unknown.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Thu, 16 Dec 2004 18:12:29 -0800

> PaC. 

What do you mean by that? You mean PAA cannot set a timer and wait for a
matching PEA? 

> So PER-PEA exchange does not seem to make sense for this error.
> 

Btw, I noticed this:

  PANA_UNKNOWN_SESSION_ID                 5002

      Error code from PAA to PaC or from PaC to PAA.  The message
      contained an unknown Session-Id.  PAA MUST NOT send this error
      result code value to PaC if PaC sent an unknown Session-Id in the
      PANA-Start-Answer message (session resumption).

We should remove the last sentence. This is a leftover from mobility
optimization removal.

Alper

> > > > PANA-Reauth-Request/Answer messages MUST contain a MAC AVP when
PANA
> > SA
> > > the suggested change therefore is to change the following
paragraph
> > > (section
The
> > PAA
> > >    PANA-Error-Request. A denial of service attack is not possible
if
> > the

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 16 Dec 2004 17:49:06 -0500

> What do you mean by that? You mean PAA cannot set a timer and wait for a

Yes.  I think there is no state in the PAA to wait for a matching PEA
for the unknown session id.

> We should remove the last sentence. This is a leftover from mobility

Yes.  On the other hand, I am wondering if this error code is really needed
for the above reason.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Fri, 17 Dec 2004 11:51:51 -0800

Yoshi,

> for the unknown session id.

There is nothing in the spec that prevents an implementation to keep
track of PERs sent for unknown sessions and match incoming PEAs. This is
an implementation issue. 

> Yes.  On the other hand, I am wondering if this error code is really

It is useful for being informative, and for network diagnostics. Same
reason for sending any other error message.

Alper

> > > > > > becuase this error cannot be solved. On the other hand I
think
> > > > >    PANA_UNKNOWN_SESSION_ID.  PANA-Reauth-Request/Answer
messages
> > > > >    terminate the session once it receives a PANA-Error-Answer
for

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 17 Dec 2004 06:34:06 -0500

> track of PERs sent for unknown sessions and match incoming PEAs. This is

PANA session attributes in the specification include retransmission
states.  I don't think those attributes should be maintained for
non-existing sessions.  If we maintain attributes for non-existing
sessions, an attacker could send a lot of PANA-ReAuth-Requests with
randomly generated bogus session ids, and if the PAA needs to return
PER and create retransmission states for each of such PRARs, then the
PAA's retransmission queue would easily be flooded.  MAC AVP
pretection will not work for this, because there is no way to validate
messages with unknown session.

> reason for sending any other error message.

But it can open a DoS attack.

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Fri, 17 Dec 2004 15:47:37 -0800

Good point.

Than how about making it a MAY with a warning notice on potential DoS
threat? A deployment that is concerned about DoS does not have to
generate PER on unknown session IDs.

Alper

> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Friday, December 17, 2004 3:34 AM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; [email-masked]; 'Tschofenig Hannes'
> Subject: Re: [Pana] Issue126: Clarify PANA-Error-Request msg withPANA-
> Reauth-Request
> 
> > > > What do you mean by that? You mean PAA cannot set a timer and
wait
> > for a
> > > Yes.  On the other hand, I am wondering if this error code is
really
> > > needed
> > > > > > > From: [email-masked] [mailto:[email-masked]]
On
> > > > Behalf
> > > > > > > initially the rafa has send a comment on the
re-authentication
> > > > > > handling:
> > > > > > >
> > > > > > > > Rafa:
> > > > > > > >
> > > > > > > > Section 4.4.
> > > > > > > >
> > > > > > > > -- "If PAA cannot identify the session, it MUST respond
with
> > a
> > > > > > > > PANA-Reauth-Request/Answer messages MUST contain a MAC
AVP
> > when
> > > > > > > > PANA-Reauth-Request but however I think same answer
would be
> > > > > > received

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 17 Dec 2004 08:12:02 -0500

> generate PER on unknown session IDs.

"MAY" works for me.

Yoshihiro Ohba