Subject: RE: [Pana] Issue126: Clarify PANA-Error-Request msgwithPANA-Reauth-Request

From: [email-masked]
Date: Fri, 17 Dec 2004 14:16:35 +0200

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On 
> Behalf Of ext Yoshihiro Ohba
> Sent: 17 December, 2004 00:49
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; 'Tschofenig Hannes'; [email-masked]
> Subject: Re: [Pana] Issue126: Clarify PANA-Error-Request 
> msgwithPANA-Reauth-Request
> 
> 
> On Thu, Dec 16, 2004 at 06:12:29PM -0800, Alper Yegin wrote:
> > > > If a session-id is unknown, which sessions gets terminated?
> > > >
> > > > I don't think there would be any termination of 
> sessions in here.
> > > 
> > > I think you are right.  The PAA could send a PER with the unknown
> > > session id, but it does not have a state to receive a PEA from the
> > > PaC. 

[This for example could happen if the PAA uses the liveness test to
purge a session and PaC doesn't respond in time.]

> > 
> > What do you mean by that? You mean PAA cannot set a timer 
> and wait for a
> > matching PEA? 
> 
> Yes.  I think there is no state in the PAA to wait for a matching PEA
> for the unknown session id.

Without looking into the state machines I would say that
retransmission of messages is different issue than handling session
states (different layers). An implementation issue and based on the
pana protocol spec, this can not be assumed (not possible to send PEA
for unknown session id).

On the other hand I think this error helps identifying the problems
and may help to recover from error situations (restart PANA for
example).

- Dan

> > 
> > > So PER-PEA exchange does not seem to make sense for this error.
> > > 
> > > The right behavior might be just silently discarding the
> > > PANA-Reauth-Request if the session id is unknown.
> > 
> > 
> > Btw, I noticed this:
> > 
> >   PANA_UNKNOWN_SESSION_ID                 5002
> > 
> >       Error code from PAA to PaC or from PaC to PAA.  The message
> >       contained an unknown Session-Id.  PAA MUST NOT send this error
> >       result code value to PaC if PaC sent an unknown 
> Session-Id in the
> >       PANA-Start-Answer message (session resumption).
> > 
> > We should remove the last sentence. This is a leftover from mobility
> > optimization removal.
> 
> Yes.  On the other hand, I am wondering if this error code is 
> really needed
> for the above reason.
> 
> Yoshihiro Ohba
> 
> 
> > 
> > Alper
> > 
> > 
> > 
> > > 
> > > Yoshihiro Ohba
> > > 
> > > 
> > > >
> > > > Alper
> > > >
> > > >
> > > > > -----Original Message-----
> > > > > From: [email-masked] [mailto:[email-masked]] On
> > Behalf
> > > > Of
> > > > > Tschofenig Hannes
> > > > > Sent: Monday, December 13, 2004 4:40 AM
> > > > > To: [email-masked]
> > > > > Subject: [Pana] Issue126: Clarify PANA-Error-Request msg
> > > > withPANA-Reauth-
> > > > > Request
> > > > >
> > > > > hi all,
> > > > >
> > > > > i would like to close issue#126.
> > > > >
> > > > > initially the rafa has send a comment on the re-authentication
> > > > handling:
> > > > >
> > > > > > Rafa:
> > > > > >
> > > > > > Section 4.4.
> > > > > >
> > > > > > -- "If PAA cannot identify the session, it MUST 
> respond with a
> > > > > > PANA-Error-Request with the error code 
> PANA_UNKNOWN_SESSION_ID.
> > > > > > PANA-Reauth-Request/Answer messages MUST contain a 
> MAC AVP when
> > PANA
> > > > SA
> > > > > > is available. "
> > > > > >
> > > > > > Taking into account section 5.7 PaC should restransmit
> > > > > > PANA-Reauth-Request but however I think same answer would be
> > > > received
> > > > > > becuase this error cannot be solved. On the other 
> hand I think
> > PAA
> > > > > > should initiate reauthentication.
> > > > >
> > > > > yoshi responded:
> > > > >
> > > > > When the PAA returns the PER with the error code
> > > > > PANA_UNKNOWN_SESSION_ID, it should terminate the session.
> > > > > After that, subsequent PANA-Reauth-Request will not be
> > > > > answered.
> > > > >
> > > > > the suggested change therefore is to change the following
> > paragraph
> > > > > (section
> > > > > 4.4 on 'Re-authentication Phase', first paragraph) from:
> > > > >
> > > > > "
> > > > > If PAA cannot identify the session, it MUST
> > > > >    respond with a PANA-Error-Request with the error code
> > > > >    PANA_UNKNOWN_SESSION_ID.  
> PANA-Reauth-Request/Answer messages
> > MUST
> > > > >    contain a MAC AVP when PANA SA is available.
> > > > > "
> > > > >
> > > > > to:
> > > > >
> > > > > "
> > > > >    If the PAA cannot identify the session based on 
> the received
> > > > Session-Id,
> > > > > it MUST respond with a
> > > > >    PANA-Error-Request with the error code 
> PANA_UNKNOWN_SESSION_ID.
> > The
> > > > PAA
> > > > > MUST
> > > > >    terminate the session once it receives a 
> PANA-Error-Answer for
> > the
> > > > >    PANA-Error-Request. A denial of service attack is 
> not possible
> > if
> > > > the
> > > > > PANA exchange is protected
> > > > >    with a keyed message digest (MAC AVP).
> > > > > "
> > > > >
> > > > > ciao
> > > > > hannes
> > > > >
> > > > > _______________________________________________
> > > > > Pana mailing list
> > > > > [email-masked]
> > > > > https://www1.ietf.org/mailman/listinfo/pana
> > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > Pana mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/pana
> > 
> > 
> > 
> > _______________________________________________
> > Pana mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/pana
> 
> _______________________________________________
> Pana mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/pana
> 

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 17 Dec 2004 03:02:36 -0500

Hi, Dan

> purge a session and PaC doesn't respond in time.]

In the case of failure of the liveness test, the PAA MUST immediately
delete the session without performing PER/PEA exchange.

> pana protocol spec, this can not be assumed (not possible to send PEA

In the case of Diameter, connection state and session state are
different and defining an UNKNOWN_SESSION_ID result code that is
handled within an established connection state and outside any session
state makes sense.  In the case of PANA, there is no "connection", and
there is no "different layer" in PANA that can easily handle an
UNKNOWN_SESSION_ID error indication if the indication needs to be
acknowledged with PEA.

I think PANA_UNKNOWN_SESSION_ID result code would make sense only when
we define unacknowledged error indication.

Yoshihiro Ohba