Subject: [Pana] issue85 (initial text)

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 18 May 2004 18:51:23 -0700

This is the initial text for issue 85.

Comments are appreciated.

----------

[1] Add the following item in section 4.1.1

"   
   o  IP-Address AVP: Conveys an IP-Address of a PaC.  
"

[2] Add the following items in section 4.1.5:

"
      *  IP address of PaC (may be the same as the Device-Id of PaC)
                                                                             
      *  IP address of PAA (may be the same as the Device-Id of PAA)
"

[3] Add the following item in section section 4.1.7:

"
      When an IP-Address AVP is included, the AVP is valid if (i) the
      Address type contained in the AVP matches the expected one
      (i.e., either IPv4 or IPv6) that is used for the current PANA
      session and (ii) the AVP value matches the one extracted from
      the IP header.
"

[4] Update the following paragraph of section 4.4 

"
   The second type of re-authentication is based on a single protected
   message exchange without entering the authentication phase.
   PANA-Reauth-Request and PANA-Reauth-Answer messages are used for this
   purpose.  If there is an established PANA SA, both the PaC and the
   PAA are allowed to send a PANA-Reauth-Request message to the
   communicating peer whenever it needs to make sure the availability of
   the PANA SA on the peer and expect the peer to return a PANA-
   Reauth-Answer message.  Both PANA-Reauth-Request/ PANA-Reauth-Answer
   messages MUST be protected with a MAC AVP.
"

to:

"
   The second type of re-authentication is based on a single protected
   message exchange without entering the authentication phase.
   PANA-Reauth-Request and PANA-Reauth-Answer messages are used for
   this purpose.  If there is an established PANA SA, both the PaC and
   the PAA are allowed to send a PANA-Reauth-Request message to the
   communicating peer whenever it needs to make sure the availability
   of the PANA SA on the peer and expect the peer to return a
   PANA-Reauth-Answer message.  In this case, both
   PANA-Reauth-Request/PANA-Reauth-Answer messages MUST be protected
   with a MAC AVP.  If there is an established PANA session but
   without an established PANA SA, both the PaC and the PAA are
   allowed to send a PANA-Reauth-Request message to the communicating
   peer whenever it needs to make sure the availability of the PANA
   session on the peer and expect the peer to return a
   PANA-Reauth-Answer message.  In this case, both
   PANA-Reauth-Request/PANA-Reauth-Answer messages are not protected
   with a MAC AVP.
"

[5] Insert the following section after section 4.7:

"
4.8. Updating PaC's Address

A PaC's address can change in certain situations.  For example, the
PANA framework [I-D.ietf-pana-framework] describes a case in which a
PaC replaces a pre-PANA address (PRPA) a post-PANA address (POPA), and
the PaC and PAA create host routes to each other in order to maintain
on-link communication based on the POPA where the link-layer address
of the PaC is used as the device identifier.  Also, a PaC's device
identifier may change regardless of whether a link-layer address or an
IP address is used as the device identifier.  As a result, it is
possible when a link-layer address is used as the device identifier
that both the device identifier and an IP address change.  In any
case, the PAA needs to be notified about the change of address(es).

After the PaC has changed its address(es), it MUST send a
PANA-Address-Update-Request message to the PAA.  The message carries
the new address(es) in a Device-Id AVP and/or an IP-Address AVP.  At
least one of these AVPs MUST appear in the request.  If an IP address
is used as the device identifier, a Device-Id AVP MUST be used and an
IP-Address AVP MUST NOT be used.  If an address contained in the
request is invalid, the PAA sends a PANA-Error message with a result
code PANA_INVALID_DEVICE_ID or PANA_INVALID_IP_ADDRESS depending on
whether the device identifier or the IP address is invalid (in case
both a Device-Id AVP and an IP-Address AVP are included and both are
invalid, whichever result code is returned).  Otherwise, the PAA
updates the address(es) of the PaC of the session attributes and
returns a PANA-Address-Update-Answer message.  If there is an
established PANA SA, both PANA-Address-Update-Request and
PANA-Address-Update-Answer messages MUST be protected with a MAC AVP.
"

[6] Change Figure 10 to:

"
                 Message                     Direction: 
                                             PaC---PAA
                 ----------------------------------------
                 PANA-PAA-Discover           -------->
                                                                                
                 PANA-Start-Request          <--------
                 PANA-Start-Answer           -------->
                                                                                
                 PANA-Auth-Request           <--------
                 PANA-Auth-Answer            -------->
                                                                                
                 PANA-FirstAuth-End-Request  <--------
                 PANA-FirstAuth-End-Answer   -------->
                                                                                
                 PANA-Bind-Request           <--------
                 PANA-Bind-Answer            -------->
                                                                                
                 PANA-Reauth-Request         <------->
                 PANA-Reauth-Answer          <------->
                                                                                
                 PANA-Termination-Request    <------->
                 PANA-Termination-Answer     <------->
                                                                                
                 PANA-Address-Update-Request -------->
                 PANA-Address-Update-Answer  <--------

                 PANA-Error                  <------->
"

[7] Change sections 6.4.9 and 6.4.10 from:

"
6.4.9 PANA-Reauth-Request (PRAR)
                                                                            
   PANA-Reauth-Request (PRAR) is either sent by the PaC or the PAA.
                                                                            
         PANA-Reauth-Request ::= < PANA-Header: 5, REQ >
                       < Session-Id >
                       [ Device-Id ]
                    *  [ AVP ]
                   0*1 < MAC >

6.4.10 PANA-Reauth-Answer (PRAA)
                                                                            
   PANA-Reauth-Answer (PRAA) is sent in response to a
   PANA-Reauth-Request.
                                                                            
         PANA-Reauth-Answer ::= < PANA-Header: 5 >
                       < Session-Id >
                       [ Device-Id ]
                    *  [ AVP ]
                   0*1 < MAC >
"

to:

"
6.4.9 PANA-Reauth-Request (PRAR)
                                                                            
   PANA-Reauth-Request (PRAR) is either sent by the PaC or the PAA.
                                                                            
         PANA-Reauth-Request ::= < PANA-Header: 5, REQ >
                       < Session-Id >
                    *  [ AVP ]
                   0*1 < MAC >

6.4.10 PANA-Reauth-Answer (PRAA)
                                                                            
   PANA-Reauth-Answer (PRAA) is sent in response to a
   PANA-Reauth-Request.
                                                                            
         PANA-Reauth-Answer ::= < PANA-Header: 5 >
                       < Session-Id >
                    *  [ AVP ]
                   0*1 < MAC >
"

[8] Add the following sections:

"
6.4.16 PANA-Address-Update-Request (PAUR)
                                                                                
   PANA-Address-Update-Request (PAUR) is sent by the PaC to the PAA.
                                                                                
         PANA-Address-Update-Request ::= < PANA-Header: 9, REQ >
                       < Session-Id >
                   0*1 { Device-Id }
                   0*1 { IP-Address }
                   0*1 < MAC >

6.4.17 PANA-Address-Update-Answer (PAUA)
                                                                                
   PANA-Address-Update-Answer (PAUA) is sent by the PAA to the PaC in
   response to a PANA-Address-Update-Request.
                                                                                
         PANA-Address-Update-Answer ::= < PANA-Header: 9 >
                       < Session-Id >
                   0*1 < MAC >
"

"
6.5.19 IP-Address AVP
                                                                                
   The IP-Address (AVP Code: 1041) contains an IP address of a PaC.
   The payload format of the IP-Address AVP is the same as that of the
   Device-Id AVP (see See section Section 6.5.2).  Address families
   for IPv4 or IPv6 MUST be used for this AVP.
"

[9] Add the following result code in section 6.5.7.2:

"
   PANA_INVALID_DEVICE_ID  5019
                                                                                
      Error code from PAA to PaC or from PaC to PAA.  This error is
      returned in a PANA-Error message when the Device-Id AVP
      contained in a received PANA-Bind-Request, PANA-Bind-Answer or
      PANA-Address-Update-Request message is invalid.

   PANA_INVALID_IP_ADDRESS  5020
                                                                                
      Error code from PAA to PaC.  This error is returned in a
      PANA-Error message when the IP-Address AVP in the received
      PANA-Address-Update-Request message is invalid.

"

[10]  Modify the AVP occurrence table as:

"
                          +-----------------------------------------+
                          |        Message                          |
                          |          Type                           |
                          +-----+-----+-----+-----+-----+-----+-----+
      Attribute Name      | PSR | PSA | PAR | PAN | PBR | PBA | PDI |
      --------------------+-----+-----+-----+-----+-----+-----+-----+
      Result-Code         |  0  |  0  |  0  |  0  |  1  |  1  |  0  |
      Session-Id          |  0  | 0-1 |  1  |  1  |  1  |  1  | 0-1 |
      Termination-Cause   |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      EAP-Payload         | 0-1 | 0-1 |  1  |  1  | 0-1 |  0  |  0  |
      MAC                 |  0  | 0-1 | 0-1 | 0-1 | 0-1 | 0-1 |  0  |
      Nonce               |  0  | 0-1 |  0  |  0  | 0-1 |  0  |  0  |
      Device-Id           |  0  |  0  |  0  |  0  | 0-1 | 0-1 |  0  |
      Cookie              | 0-1 | 0-1 |  0  |  0  |  0  |  0  |  0  |
      Protection-Cap.     | 0-1 |  0  |  0  |  0  | 0-1 |  0  |  0  |
      PPAC                | 0-1 |  0  |  0  |  0  |  1  | 0-1 |  0  |
      Session-Lifetime    |  0  |  0  |  0  |  0  | 0-1 |  0  |  0  |
      Failed-AVP          |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      ISP-Information     |  0+ | 0-1 |  0  |  0  |  0  |  0  |  0  |
      NAP-Information     | 0-1 |  0  |  0  |  0  |  0  |  0  |  0  |
      EP-Device-Id        |  0  |  0  |  0  |  0  |  0+ |  0  |  0  |
      Key-Id              |  0  |  0  |  0  |  0  | 0-1 | 0-1 |  0  |
      IP-Address          |  0  |  0  |  0  |  0  |  0  |  0  |  0  |
      --------------------+-----+-----+-----+-----+-----+-----+-----+
                                                                                
                 Figure 11: AVP Occurrence Table (1/3)

                          +---------------------------------------------+
                          |      Message                                |
                          |       Type                                  |
                          +------+------+-----+-----+-----+------+------+
      Attribute Name      | PRAR | PRAA | PTR | PTA | PER | PFER | PFEA |
      --------------------+------+------+-----+-----+-----+------+------+
      Result-Code         |  0   |  0   |  0  |  0  |  1  |  1   |  0   |
      Session-Id          |  1   |  1   |  1  |  1  |  1  |  1   |  1   |
      Termination-Cause   |  0   |  0   |  1  |  0  |  0  |  0   |  0   |
      EAP-Payload         |  0   |  0   |  0  |  0  |  0  |  1   |  0   |
      MAC                 | 0-1  | 0-1  | 0-1 | 0-1 | 0-1 | 0-1  | 0-1  |
      Nonce               |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      Device-Id           |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      Cookie              |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      Protection-Cap.     |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      PPAC                |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      Session-Lifetime    |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      Failed-AVP          |  0   |  0   |  0  |  0  |  1  |  0   |  0   |
      ISP-Information     |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      NAP-Information     |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      EP-Device-Id        |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      Key-Id              |  0   |  0   |  0  |  0  |  0  | 0-1  | 0-1  |
      IP-Address          |  0   |  0   |  0  |  0  |  0  |  0   |  0   |
      --------------------+------+------+-----+-----+-----+------+------+
                                                                                
                 Figure 12: AVP Occurrence Table (2/3)

                          +-------------+
                          |   Message   |
                          |     Type    |
                          +------+------+
      Attribute Name      | PAUR | PAUA |
      --------------------+------+------+
      Result-Code         |  0   |  0   |
      Session-Id          |  1   |  1   |
      Termination-Cause   |  0   |  0   |
      EAP-Payload         |  0   |  0   |
      MAC                 | 0-1  | 0-1  |
      Nonce               |  0   |  0   |
      Device-Id           | 0-1  |  0   |
      Cookie              |  0   |  0   |
      Protection-Cap.     |  0   |  0   |
      PPAC                |  0   |  0   |
      Session-Lifetime    |  0   |  0   |
      Failed-AVP          |  0   |  0   |
      ISP-Information     |  0   |  0   |
      NAP-Information     |  0   |  0   |
      EP-Device-Id        |  0   |  0   |
      Key-Id              |  0   |  0   |
      IP-Address          | 0-1  |  0   |
      --------------------+------+------+
                                                                                
                 Figure 13: AVP Occurrence Table (3/3)
"

[11]  Change the text in section 7 from:

"
         PANA-PAA-Discover (PDI)
         PANA-Start-Request (PSR)*
         PANA-Start-Answer (PSA)**
         PANA-Bind-Request (PBR)
         PANA-FirstAuth-End-Request (PFER)
         PANA-Reauth-Request (PRAR)
         PANA-Termination-Request (PTR)
                                                                                
         *)  PSR that carries a Cookie AVP is not retransmitted.
         **) PSA that does not carry a Cookie AVP is not retransmitted.
"

to:

"
         PANA-PAA-Discover (PDI)
         PANA-Start-Request (PSR)*
         PANA-Start-Answer (PSA)**
         PANA-Bind-Request (PBR)
         PANA-FirstAuth-End-Request (PFER)
         PANA-Reauth-Request (PRAR)
         PANA-Termination-Request (PTR)
         PANA-Address-Update-Request (PAUR)
                                                                                
         *)  PSR that carries a Cookie AVP is not retransmitted.
         **) PSA that does not carry a Cookie AVP is not retransmitted.
"
                                                                                
[12]  Add the folliwng text in section 8:

"
   j) Updating PaC's address
                                                                                
   An attacker can generate a PANA-Address-Update-Request with an
   invalid Device-Id AVP or an IP-Address AVP.  There are several
   threats:

   - An attacker spoofs an address and registers itself with the
   address.  If the registered address is not assigned to any PaC,
   subsequent PANA messages sent from the PAA to the attacker will not
   reach any node and this is not a significant harm.  If the
   registered address is assigned to some PaC, subsequent PANA
   messages sent from the PAA to the attacker will reach the PaC, but
   will be silently discarded because the Session-Id is different.

   - An attacker registers other PaC with any address.  As a result,
   subsequent PANA messages sent from the PAA to the PaC will not
   reach the PaC.

   To avoid all those attacks against an address update, an additional
   mechanism may be defined outside the PANA protocol for the PAA to
   validate ownership of the address.
"

Best regards,

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana