Subject: [Pana] host route

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 06 May 2004 06:59:29 -0700

I came up with an issue after submitting
draft-ietf-pana-framework-00.txt.

In section 5 of draft-ietf-pana-framework-00.txt:

      "PRPA and the IP address of PAA are assumed to be on the same IP
      subnet, hence the PaC and PAA can perform on-link communication as
      required by PANA.  When the PaC replaces its IPv4 PRPA with POPA,
      this assumption may not hold true. In order to maintain the same
      on-link communication, the PaC and PAA SHOULD create host routes
      to each other upon PaC's IP address change.  The PaC SHOULD create
      a host route to the PAA, and the PAA SHOULD create a host route to
      the PaC (POPA)."

In order to create a host route to the PaC, the PAA needs to know the
POPA.  However, when MAC address is used as the device-id, no
device-id update occurs in PANA, and I am wondering how the PAA can
know the POPA.  There would be several ways to deal with this:

- PAA listens to DHCP or data traffic on the link to know the POPA.

- PAA communicates with DHCP server (by using some other protocol such
as SNMP) to know the POPA.

- After obtaining POPA, the PaC sends a PANA-Reauth-Request with a
  new AVP that carries the POPA.

Which is better or any other ways?

Yoshihiro Ohba

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 6 May 2004 10:05:11 -0700

>   new AVP that carries the POPA.
This sounds like a better option so that we can keep the device-Id update and POPA
update separate. I never understood the reason for using Reauth request for updates.
Why isn't this a generic update mechanism protected by PANA SA ?

> Which is better or any other ways?

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 6 May 2004 10:05:11 -0700

-mohan

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 06 May 2004 10:41:36 -0700

> Why isn't this a generic update mechanism protected by PANA SA ?

As far as I remember, one usage of PANA-Reauth exchange has been to
allow PaC to its its Device-Id in a secure way.  It seems that sending
the POPA is not much different from updating Device-Id, and that is
why I mentioned PANA-Reauth exchange.  But we could define a separate
mechanism/message for updating an address if we want.  In my
experiance, having a separate mechanism/message might be good for
reducing the chance of mis-implementation coming from using the same
message for many purposes.

Yoshihiro Ohba

---

From: Rafael Marin Lopez <[email-masked]>
Date: Thu, 06 May 2004 20:00:38 +0200

Hi Yoshihiro

>  new AVP that carries the POPA.
I think third option could be more suitable because PaC and PAA talks
PANA , so they should use it to communicate these issues. However, this
new AVP would be really used only to solve this particular case.

-- 
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968367645    e-mail: [email-masked]
------------------------------------------------------

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 06 May 2004 10:41:36 -0700

Yoshihiro Ohba

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 6 May 2004 11:12:55 -0700

> message for many purposes.
As we have more than one update now, it might make sense to provide a separate
mechanism instead of over-loading the reauth.

There is a difference between device-ID update and POPA update. There is not
much incentive for the PaC to update with a device-ID that belongs to someone else.
But PaC can always update the PAA with invalid POPAs consuming host routes.
There is really no redirection attack as the route is not used until the packets are
sent that would use the route. So, the only possibility is to generate invalid host
routes. How can PAA check to make sure that this is not happening ? Can the same
happen with device-ID update consuming some other resource ? The framework
document is still not clear on what happens during a device-Id update.

-mohan

-mohan

---

From: Rafael Marin Lopez <[email-masked]>
Date: Thu, 06 May 2004 20:00:38 +0200

Hi Yoshihiro

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 6 May 2004 11:12:55 -0700

-mohan

-mohan

---

From: Alper Yegin <[email-masked]>
Date: Thu, 06 May 2004 17:29:15 -0700

Do we still have device ID update via PANA reauth in the spec? We don't
have device ID update anymore.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
Mohan
> Parthasarathy
> Sent: Thursday, May 06, 2004 11:13 AM
> To: Yoshihiro Ohba
> Cc: [email-masked]
> Subject: Re: [Pana] host route
> 
> 
> > > >       "PRPA and the IP address of PAA are assumed to be on the
same
> IP
> > > >       required by PANA.  When the PaC replaces its IPv4 PRPA
with
> POPA,
> > > >       this assumption may not hold true. In order to maintain
the
> same
> > > >       to each other upon PaC's IP address change.  The PaC
SHOULD
> create
> > > > In order to create a host route to the PaC, the PAA needs to
know
> the
> > > > - PAA communicates with DHCP server (by using some other
protocol
> such
> There is a difference between device-ID update and POPA update. There
is
> not
> There is really no redirection attack as the route is not used until
the
> packets are
> routes. How can PAA check to make sure that this is not happening ?
Can
> the same

---

From: Alper Yegin <[email-masked]>
Date: Thu, 06 May 2004 17:29:15 -0700

Alper

Mohan
same
with
the
SHOULD
know
protocol
is
the
Can

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 06 May 2004 20:20:36 -0700

> have device ID update anymore.

In draft-ietf-pana-framework-00.txt, Case D of IPv4 in Appendix A.1
and Case C of IPv6 in Appendix A.2 use the device id update mechanism.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 06 May 2004 20:20:36 -0700

Yoshihiro Ohba

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 7 May 2004 10:22:03 -0700

> and Case C of IPv6 in Appendix A.2 use the device id update mechanism.
I think the base spec should mention the update mechanism somewhere.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 7 May 2004 10:22:03 -0700

-mohan

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 10 May 2004 07:21:47 -0700

> routes. How can PAA check to make sure that this is not happening ? 

I think the only way for PAA to check this is, as PANA is doing for
Device-Id checking, to compare the POPA aganst the source IP address
of the IP packet that carries the POPA in a PANA payload.  This
checking does not work if the PaC uses someone else's address for both
the POPA and the source IP address of the IP packet.  However, this
would not harm IF (i) the PAA does not allow the POPA update when the
POPA is already associated with someone else and (ii) the PAA does not
allow multiple host route entries per PaC.

> Can the same
> happen with device-ID update consuming some other resource ? 

I think so.  However, this would not harm as described above.

> The framework

I think describing something on a device-id and POPA update in PANA
specification should be sufficient.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 10 May 2004 07:21:47 -0700

Yoshihiro Ohba

---

From: Rafael Marin Lopez <[email-masked]>
Date: Mon, 10 May 2004 17:00:51 +0200

Hi Yoshihiro...
Yoshihiro Ohba wrote:

>would not harm

> IF (i) the PAA does not allow the POPA update when the
Must both conditions be honored? Because I think Mohan exposes invalid
POPAs and those could not belong to someone else...

---

From: Rafael Marin Lopez <[email-masked]>
Date: Mon, 10 May 2004 17:00:51 +0200

Hi Yoshihiro...

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 10 May 2004 09:04:51 -0700

Hi Rafa,

> POPAs and those could not belong to someone else...

Condition (ii) is needed to avoid consuming host routes.

Condition (i) is needed to avoid redirection attack for PANA messages.
As Mohan mentioned, this redirection would not occur until a (PANA)
message is sent from the PAA, but it might be better to avoid such a
redirection attack in the PANA protocol.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 10 May 2004 09:04:51 -0700

Hi Rafa,

Yoshihiro Ohba

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 10 May 2004 14:37:55 -0700

> allow multiple host route entries per PaC.
I think so. Are you ssuming that POPA never changes during the lifetime ? Otherwise,
there has to be state about when PaC can update its POPA/POPA has already
been updated by PaC etc. Also, how is the PaC identified (to check whether
a given PaC can update only once or not) ?

My usage of redirection attack in my previous mail is not right.  PAA needs
to have a "host" route for sending packets to PaC. Even if a wrong entry
is setup, it does not redirect traffic from one address to another address.
The only harm is the consumption of memory. Even if a malicious PaC1
sets up an entry for a different PaC2 before that PaC is seen on the network,
it does not cause any problems. When PaC2 authenticates, the route will
already be there.

> specification should be sufficient.
Ok.

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 10 May 2004 14:37:55 -0700

Ok.

-mohan

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 10 May 2004 15:06:52 -0700

On Mon, May 10, 2004 at 02:37:55PM -0700, Mohan Parthasarathy wrote:
> I think so. Are you ssuming that POPA never changes during the lifetime ? 

POPA may change if DHCP assigns a new address when the lease period 
of the current address expires.  So I don't think we should assume 
that POPA never changes during the lifetime.

> Otherwise,

I think the state could be maintained outside the PANA protocol, e.g.,
by consulting the DHCP server about the state through SNMP, if needed.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 10 May 2004 15:06:52 -0700

Yoshihiro Ohba

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 10 May 2004 16:03:08 -0700

> by consulting the DHCP server about the state through SNMP, if needed.
So, whenever you get a POPA update, you query the external DHCP server to see
whether this "PaC", can use this address or not ? It can be a third POPA update,
but it is okay as long as it is valid for the "PaC". Now, how do you identify this
PaC to the DHCP server ? I think the "client identifier" could be different when used
with DHCP Vs PANA. 

-mohan

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 10 May 2004 16:03:08 -0700

-mohan

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 10 May 2004 18:53:28 -0700

> PaC to the DHCP server ? I think the "client identifier" could be different when used

I think we could use client hardware address carried in DHCP message
for this purpose, instead of relying on DHCP client identifier.

Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 10 May 2004 18:53:28 -0700

Yoshihiro Ohba