Subject: [Pana] Comments on draft-ietf-pana-statemachine-00

From: Vijayarajan <[email-masked]>
Date: Fri, 17 Jun 2005 13:58:55 +0530

Hi,
            Here are some comments on draft-ietf-pana-statemachine-00.
 
PaC State Machine
-------------------
 
In OFFLINE State
      1. EAP_Restart() is not required as an initialization action
      since it is already done for all exit conditions where
      PSR is received
 
      2. Nonce is required to be added for PSR. Also, optionally, 
      PPAC and PCAP AVP could be added
 
In WAIT_EAP_MSG_IN_DISC State
      3. Optionally, PSA could include ISP-Information

In WAIT_EAP_RESULT State
      4. Suppose separate NAP and ISP is being performed and the
      first EAP authentication succeeds but second EAP authentication
      fails. Depending on network policy, say the PAA decided that
      network access should be allowed i.e PBR.RESULT_CODE ==
PANA_SUCCESS  
      at the end of 2nd EAP authentication. But the EAP Payload
      within PBR will be EAP_FAILURE.
      
      According to the state machine, after receiving PBR, PaC will
      move from WAIT_PAA to WAIT_EAP_RESULT state. On receiving
EAP_FAILURE
      event in WAIT_EAP_RESULT, it will just send PBA and go to CLOSED
state
      whereas it should send PBA and go to OPEN state.
 
      One possible way of handling this would be to add the following
      state transition
 
      EAP_FAILURE &&           if (key_available())               OPEN
      (SEPARATE == Set) &&        PBA.insert_avp("MAC");
      (1ST_EAP != UNSET) &&    if (CARRY_DEVICE_ID)
      ppac_available()           PBA.insert_avp("Device-Id");
                               PBA.insert_avp("PPAC");
                               Tx:PBA();
                               Authorize();
                               SessionTimerStart();
 
      And, the following state transition
      
      EAP_FAILURE             if (key_available())                CLOSED
                                 PBA.insert_avp("MAC");
                              Tx:PBA();
 
      would then change to
      
      EAP_FAILURE &&             if (key_available())
CLOSED
        ((SEPARATE == Unset) ||       PBA.insert_avp("MAC");
      (1ST_EAP == Unset) ||      Tx:PBA();
      (!ppac_available()))

      5. In draft-ietf-pana-pana-08.txt, the following text is present
 
      PANA_PROTECTION_CAPABILITY_UNSUPPORTED  5016
 
      This error is returned when the PaC receives a PANA-Bind-Request
      message with a Protection-Capability AVP and a valid MAC AVP but
      does not support the protection capability specified in the
      Protection-Capability AVP.  Only the PaC can generate this code.
 
      But I could not find any mention of the same in section
4.3(Authentication
      and Authorization phase). If the PaC is required to send this
error
      when it receives a PBR with PBR.RESULT_CODE == PANA_SUCCESS and
MAC AVP,
      then a state transition like the one below would need to be added.

      EAP_SUCCESS &&                      if (key_available())
WAIT_PEA
      PBR.RESULT_CODE==PANA_SUCCESS &&          PER.insert_avp("MAC");
      PBR.exist_avp                             PER.RESULT_CODE=
        ("MAC")
PANA_PROTECTION_CAPABILITY_UNSUPPORTED
      !pcap_available()               Tx:PER();
                                        RtxTimerStart();
 
      And some of the Exit conditions would also require changes like
 
      EAP_SUCCESS &&
      PBR.exist_avp 
      ("Key-Id") && 
      ppac_available()      
 
      becomes 
      
      EAP_SUCCESS &&
      PBR.exist_avp 
      ("Key-Id") && 
      ppac_available() &&
      pcap_available()    
 
      etc

PAA State Machine
------------------
In STATEFUL_DISC State
      6. After receiving PSA, re-transmission timer has to be stopped
 
In WAIT_SUCC_PBA State
      7. 
       Rx:PBA &&                SessionTimerStart();
OPEN
       (CARRY_DEVICE_ID==Unset ||   
       (CARRY_DEVICE_ID==Set &&     
       PBA.exit_avp("Device-Id")))

      Should'nt pana_sm_ep_enable_protection() and
pana_sm_ep_install_filter() be there
      after SessionTimerStart() ? They were present in
draft-ohba-pana-statemachine-01.txt

In OPEN State
      8. When PRAR is received or REAUTH is triggered, the session timer
has to be
      stopped

Regards,
Vijayarajan R
 
_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana