Subject: [Pana] Issues 17, 18, 19 and 21.

From: [email-masked]
Date: Mon, 29 Sep 2003 09:26:34 +0300

Hi,

Check these issues and send comments to the list if any by 2nd of 
October. Otherwise these issues will be closed and texts proposed 
incorporated into the next version of pana draft.

- Dan

------------------------------------------------
http://danforsberg.info:8080/pana-issues/issue17
------------------------------------------------
Error message handling:
PANA-error message MAY be sent by either PaC or PAA when a
badly formed PANA message is received or in case of other
errors.  If the cause of this error message was a request
message (e.g., PANA-PAA-Discover or *-Request), then the
request MAY be retransmitted immediately without waiting for
its retransmission timer to go off. If the cause of the
error was a response message, the receiver of the PANA-error
SHOULD NOT resend the same response until it receives the
next request.

To defend against DoS attacks a timer MAY be used. One (1)
error notification is sent to each different sender each N
seconds. N is a configurable parameter.
 
When an error message is sent unprotected with MAC AVP and
the lower-layer is insecure, the error message is treated as
an informational message.  The receiver of such an error
message MUST NOT change its state unless the error persists
and the PANA session is not making any progress.

Error message format:
   PANA-Error ::= < PANA-Header: 12 >
                  < Session-Id > 
                  < Result-Code >
                   { Failed-AVP }
                 * [ AVP ] 
               0*1 < MAC >

------------------------------------------------
http://danforsberg.info:8080/pana-issues/issue18
------------------------------------------------
Termination-Cause AVP values? 
These are from Diameter spec (17):

      LOGOUT                   1  (PaC -> PAA)
         The user initiated a disconnect

      BAD_ANSWER               3  (PaC -> PAA)
         This value indicates that the authorization answer
         received by the access device was not processed
         successfully.

      ADMINISTRATIVE           4  (PAA -> Pac)
         The user was not granted access, or was 
         disconnected, due to administrative reasons, 
         such as the receipt of a Abort-Session-Request
         message.

      AUTH_EXPIRED             6  (PAA -> PaC)
         The user's access was terminated since its 
         authorized session time has expired.

      SESSION_TIMEOUT          8  (PAA -> PaC)
         The user's session has timed out, and service 
         has been terminated.

------------------------------------------------
http://danforsberg.info:8080/pana-issues/issue19
------------------------------------------------
Result-Code AVP values? 
   The Result-Code AVP is defined in [DIAMETER]. 
    
         SUCCESS                            2001 
         COMMAND_UNSUPPORTED                3001 
         UNABLE_TO_DELIVER                  3002 
         REALM_NOT_SERVED                   3003 
         TOO_BUSY                           3004 
         INVALID_HDR_BITS                   3008 
         INVALID_AVP_BITS                   3009 
         AUTHENTICATION_REJECTED            4001 
         AVP_UNSUPPORTED                    5001 
         UNKNOWN_SESSION_ID                 5002 
         AUTHORIZATION_REJECTED             5003 
         INVALID_AVP_VALUE                  5004 
         MISSING_AVP                        5005 
         RESOURCES_EXCEEDED                 5006 
         CONTRADICTING_AVPS                 5007
         AVP_NOT_ALLOWED                    5008
         AVP_OCCURS_TOO_MANY_TIMES          5009 
         UNSUPPORTED_VERSION                5011 
         INVALID_AVP_LENGTH                 5014 
         INVALID_MESSAGE_LENGTH             5015 

------------------------------------------------
http://danforsberg.info:8080/pana-issues/issue21
------------------------------------------------
PANA co-exists with NAS when necessary. Thus, NAS can provide EAP-Request
retransmissions. This should be clarified in the draft. I.e. update:

   "PANA relies on EAP-layer retransmission for retransmitting EAP 
   Request based on timer."

to:

   "PANA relies on EAP-layer retransmissions, or for example NAS 
   functionality, for retransmitting EAP Requests based on timer."

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Alper Yegin <[email-masked]>
Date: Mon, 29 Sep 2003 14:43:25 -0700

The offending message is not necessarily an "answer". In most of the cases,
as it is sent by the PAA, it is a request. So, calling this AVP "BAD_ANSWER"
is a bit confusing. Maybe we should call it BAD_MESSAGE?

Also, I suggest we use "client" instead of "user" in this context. We use
mostly the former in the text... Similarly, "access device" can be "client".

>        The user's session has timed out, and service

These last two seem redundant to me. Is there a difference between them?

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 29 Sep 2003 14:43:25 -0700

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 29 Sep 2003 14:46:00 -0700

I think it'd be useful to include brief explanations (few sentences like the
DIAMETER spec does)...

I don't think direct cut-and-paste or providing reference helps, as the
applicability of each situation and some details might be different.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 29 Sep 2003 14:46:00 -0700

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 29 Sep 2003 14:51:15 -0700

A reference to draft-ietf-aaa-eap-02.txt would clarify the NAS
functionality.

Alper

---

From: Alper Yegin <[email-masked]>
Date: Mon, 29 Sep 2003 14:51:15 -0700

Alper