Subject: [Pana] NEW: [issue78] PBR without EAP-Payload AVP

From: [email-masked]
Date: Mon, 26 Apr 2004 10:14:17 +0300

New submission from Dan Forsberg <[email-masked]>:

From Yoshihiro Ohba:
--------------------
In the EAP state machine draft, there is a case in which a EAP
pass-through authenticator fails authentication without an EAP-Failure
message being forwarded to the EAP peer, i.e., when it enters
TIMEOUT_FAILURE2 state in Figure 7 of
draft-ietf-eap-statemachine-03.pdf.

This means that PANA should allow a PANA-Bind-Request message without
carrying EAP-Payload AVP.  (Another alternative is using a PANA-Error
message instead of PANA-Bind-Request for this case, but PANA-Error
message is not acknowledged and thus not an appropriate solution.)

Proposed changes:

- Add the following paragraph at the end of section 4.3
(Authentication Phase):

"EAP authentication can fail at a pass-through authenticator without
sending an EAP-Failure message [EAP-STATE].  When this occurs, the PAA
MUST send a PANA-Bind-Request message without carrying an EAP-Payload
AVP.  In this case, the Result-Code in the PANA-Bind-Request MUST be
PANA_AUTHENTICATION_REJECTED."

(Is any other error code possible for this case?)

- Add a reference to the EAP state machine draft.

- Make the EAP-Payload AVP optional in the ABNF for PBR, and 
  update the AVP occurrence table accordingly.

----------
category: Technical
document: draft-ietf-pana-pana-xx.txt
messages: 256
nosy: dforsber
priority: Must Fix
status: Text Proposed
title: PBR without EAP-Payload AVP
__________________________________________________
PANA Issues <[email-masked]>
<http://danforsberg.info:8080/pana-issues/issue78>
__________________________________________________
=�ڙ���x%��Ojv�z��m��?�0�'�~���f��f��X��)ߣ�Z�

---

From: Alper Yegin <[email-masked]>
Date: Tue, 27 Apr 2004 17:46:56 -0700

Isn't a relying on a timeout on the PaC more appropriate approach here?

I say this because:
- Somebody has to timeout. Either PAA times out and notifies PaC, or PaC times out on its own.
- Such a PBR cannot be secured. Hence we'd advise it to be ignored on networks with MitM threat, effectively disabling this feature.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> [email-masked]
> Sent: Monday, April 26, 2004 12:14 AM
> To: [email-masked]
> Subject: [Pana] NEW: [issue78] PBR without EAP-Payload AVP
> 
> =ڙx%Ojvˢz m?
> 0 '~ ffX) Z

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Tue, 27 Apr 2004 17:46:56 -0700

I say this because:

Alper

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 28 Apr 2004 16:12:10 -0700

> - Such a PBR cannot be secured. Hence we'd advise it to be ignored on networks with MitM threat, effectively disabling this feature.

OK, I agree.  Then I think using PANA-Error message is simpler.

Proposed changes:

  "EAP authentication can fail at a pass-through authenticator without
  sending an EAP-Failure message [EAP-STATE].  When this occurs, the
  PAA SHOULD send a PANA-Error message to the PaC with using 
  PANA_AUTHENTICATION_REJECTED result code.  The PaC SHOULD ignore the
  message unless it is secured by PANA or lower layer.  In any
  case, a more appropriate way is to rely on a timeout on the PaC."

(Note: This PANA-Error message can be secured by PANA during EAP-based
re-authentication, with using the current PANA-MAC-Key.)

- Update the state machine accordingly.

Yoshihiro Ohba

> > =??x%Ojv??z m?

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 28 Apr 2004 16:12:10 -0700

Proposed changes:

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Wed, 28 Apr 2004 19:58:39 -0700

Yoshi,

I found this in the current draft:

PANA_UNABLE_TO_COMPLY                   5012

      This error is returned when a request is rejected for unspecified
      reasons.  For example, when an EAP authentication fails at an EAP
      pass-through authenticator without passing an EAP-Failure message
      to the PAA, a Result-Code AVP with this error code is carried in
      PANA-Bind-Request message without an EAP-Payload AVP.

Alper

> > - Somebody has to timeout. Either PAA times out and notifies PaC, or
PaC
> times out on its own.
> > - Such a PBR cannot be secured. Hence we'd advise it to be ignored
on
> networks with MitM threat, effectively disabling this feature.
> 
PAA

---

From: Alper Yegin <[email-masked]>
Date: Wed, 28 Apr 2004 19:58:39 -0700

Yoshi,

Alper

PaC
on
PAA

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Apr 2004 06:07:43 -0700

>       PANA-Bind-Request message without an EAP-Payload AVP.

Sorry, I overlooked that.  So the text to be added in section 4.3 would
be:

"EAP authentication can fail at a pass-through authenticator without
sending an EAP-Failure message [EAP-STATE].  When this occurs, the PAA
SHOULD send a PANA-Error message to the PaC with using
PANA_UNABLE_TO_COMPLY result code.  The PaC SHOULD ignore the message
unless it is secured by PANA or lower layer.  In any case, a more
appropriate way is to rely on a timeout on the PaC."

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Apr 2004 06:07:43 -0700

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Thu, 29 Apr 2004 11:58:34 -0700

Your text looks good.

But I think we should also replace "PANA-Bind-Request" with "PANA-Error"
and remove "without an EAP-Payload AVP" in the description of the
PANA_UNABLE_TO_COMPLY, to be in synch with your text.

Alper

> From: Yoshihiro Ohba [mailto:[email-masked]]
> Sent: Thursday, April 29, 2004 6:08 AM
> To: Alper Yegin
> Cc: 'Yoshihiro Ohba'; [email-masked]
> Subject: Re: [Pana] NEW: [issue78] PBR without EAP-Payload AVP
> 
> > > > Isn't a relying on a timeout on the PaC more appropriate
approach
> > here?
> > > > > From: [email-masked] [mailto:[email-masked]] On
Behalf
> > Of
> > > > > AVP.  In this case, the Result-Code in the PANA-Bind-Request
MUST
> > be

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Apr 2004 12:17:31 -0700

OK, I'll do that.

Thanks,

Yoshihiro Ohba

---

From: Alper Yegin <[email-masked]>
Date: Thu, 29 Apr 2004 11:58:34 -0700

Your text looks good.

Alper

approach
Behalf
MUST

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Apr 2004 12:17:31 -0700

OK, I'll do that.

Thanks,

Yoshihiro Ohba