Subject: [Pana] pana-pana dual-stack issue: resolution

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 20 Jun 2005 16:26:51 -0400

Change section 7.3.11 to:

"
7.3.11  Post-PANA-Address-Configuration (PPAC) AVP

   The PPAC AVP (AVP Code 11) is used for conveying the available
   types of post-PANA IP address configuration mechanisms when sent by
   the PAA, and the chosen one when sent by the PaC.  Each possible
   mechanisms is represented by a flag.  At least either N-flag or one
   or more of the other flags MUST be set when sent by the PAA, and
   exactly one or two flags among those set by the PAA MUST be set
   when sent by the PaC (see detailed flag setting rules below).  The
   AVP data is of type Unsigned32.

   The format of the AVP data is as follows:

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |N|D|D|A|T|I|                   Reserved                        |
      | |4|6| | | |                                                   |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

   PPAC Flags

      N (No configuration)

         The PaC does not have to (if sent by PAA) or will not (if
         sent by PaC) configure a new IP address after PANA.

      D4 (DHCPv4)

         The PaC can (if sent by PAA) or will (if sent by PaC) use
         DHCPv4 [RFC3315] to configure a new IPv4 address after PANA.

      D6 (DHCPv6)

         The PaC can (if sent by PAA) or will (if sent by PaC) use
         DHCPv6 [RFC3315] to configure a new IPv6 address after PANA.

      A (stateless autoconfiguration)

         The PaC can/will use stateless IPv6 address autoconfiguration
         [RFC2462] to configure a new IPv6 address after PANA.

      T (DHCP with IPsec tunnel mode)

         The PaC can/will use [RFC3456] to configure a new IPv4
         address after PANA.

      I (IKEv2)

         The PaC can/will use [I-D.ietf-ipsec-ikev2] to configure (a)
         new IPv4 and/or IPv6 address(es) after PANA.

      Reserved

         These flag bits are reserved for future use, and MUST be set to
         zero, and ignored by the receiver.

   Unless the N-flag is set, the PaC MUST configure (a) new IPv4
   and/or IPv6 address(es) using one or two methods indicated by the
   other flags as follows.  When IPsec-based access control is used,
   only the T-flag or I-flag MUST be set when sent by the PAA, and
   only one of the flags among those are set by the PAA MUST be set
   when sent by the PaC.  Otherwise, only the D4-flag, D6-flag or
   A-flag MUST be set when sent by the PAA, and only one or two of the
   flags among those set by the PAA MUST be sent when sent by the PaC,
   except that the D6-flag and A-flag MUST be exclusively set when
   sent by the PaC.  Refer to [I-D.ietf-pana-framework] for a detailed
   discussion on when each configuration method can be used.  
"

Comments are appreciated.

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 21 Jun 2005 15:37:21 -0700

Hi Yoshi,

>    mechanisms is represented by a flag. << At least either N-flag or
one
>    when sent by the PaC (see detailed flag setting rules below).>>
The
>    AVP data is of type Unsigned32.

I think we can omit the parts between << >> as we discuss it in more
detail later.

>       |N|D|D|A|T|I|                   Reserved
|
>       | |4|6| | | |
|

This is just for cosmetics, but I think we can get away without adding
two-letter flag names. I cannot come up with a descriptive flan name,
but to me any letter is OK.

>    discussion on when each configuration method can be used.

Let me work in some additional conditions:

   PAA MUST set either the N-flag, or one or more of the other flags. 
   If the N-flag is set, the PaC MUST only set its N-flag in its
response.

   If the N-flag is not set by the PAA, that means the PaC MUST
configure
   POPA(s) using the methods indicated by the flags. When IPsec-based
   access control is used, PAA can set only the T-flag or the I-flag.
PaC
   MUST set only one of these flags in its response. If IPsec-based
access 
   control is not used, D4-flag or either one of the D6-flag and A-flag
MUST
   be set. PaC MUST echo the same flag(s) in its response. Refer to 
   [I-D.ietf-pana-framework] for a detailed discussion on when each 
   configuration method can be used.

How does this look?

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 22 Jun 2005 08:33:38 -0400

> I think we can omit the parts between << >> as we discuss it in more

OK.

> >    The format of the AVP data is as follows:

Then I'd propose F ('F'our) for D4 and S ('S'ix) for D6.

> >          DHCPv4 [RFC3315] to configure a new IPv4 address after PANA.

Sorry, there is one correction: s/3315/2131/.

>    be set. PaC MUST echo the same flag(s) in its response. 

The last sentence is for the case where IPsec-based access control is
not used, not for the other case, right?  If so, it is better to
combine the last two sentences like:

"
If IPsec-based access control is not used, D4-flag or either one of
the D6-flag and A-flag MUST be set by the PAA, and the PaC MUST echo
the same flag(s) in its response.
"

One issue: 

I was assuming that use of both stateless and stateful mechanisms to
obtain multiple IPv6 POPAs is not supported.  But I think we can
support it.  If that is OK, we can further revise the text like:

"
If IPsec-based access control is not used, D4-flag, D6-flag or A-flag
MUST be set by the PAA, and the PaC MUST echo the same flag(s) in its
response.
"

Yoshihiro Ohba

> Refer to

---

From: Alper Yegin <[email-masked]>
Date: Wed, 22 Jun 2005 09:55:18 -0700

Yoshi,

OK.

> MUST be set by the PAA, and the PaC MUST echo the same flag(s) in its

Yes, I think we can be liberal on that. I agree.

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 22 Jun 2005 13:12:17 -0400

I forgot to mention one thing:

On Tue, Jun 21, 2005 at 03:37:21PM -0700, Alper Yegin wrote:
>    POPA(s) using the methods indicated by the flags. 

I think the "MUST" in the above sentence should be "can". 

Yoshihiro Ohba

> When IPsec-based

---

From: Alper Yegin <[email-masked]>
Date: Wed, 22 Jun 2005 16:03:03 -0700

Yoshi,

> -----Original Message-----
> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Wednesday, June 22, 2005 10:12 AM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; [email-masked]
> Subject: Re: [Pana] pana-pana dual-stack issue: resolution
> 

The I-D already says:

   Additionally, the PANA-Bind-Request message with a PANA_SUCCESS
   result code MUST include a Post-PANA-Address-Configuration (PPAC)
   AVP, which helps the PAA to inform the PaC about whether a new IP
   address MUST be configured and the available methods to do so.

I think this one is a MUST too.

Alper