Subject: Re: [netlmm] Lack of session indication

From: Sri Gundavelli <[email-masked]>
Date: Wed, 13 Aug 2008 18:41:58 -0700 (PDT)

Hi Rajeev,

On Wed, 13 Aug 2008, Koodli, Rajeev wrote:

>
> Hi Sri,
>
> For some reason, I didn't get your reply directly..
>
> I am not suggesting that the datapath signal the control plane upon loss
> of every packet. We don't want to do that. An indication along the lines
> of ICMP unreachable (in the kernel) or an event that's triggered upon
> loss of some configurable number of packets could be couple of options.
>

Doing this data plane is complex. Its better to handle this scenarios
in the context of general session management, IMO.

Thanks
Sri

_______________________________________________
netlmm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netlmm

---

From: "Soininen Jonne (NSN FI/Espoo)" <[email-masked]>
Date: Fri, 22 Aug 2008 00:30:06 +0300

Hello,

Sorry to be late in this. However, I'll try to summarize some things here
and understand what should be done going forward. Please, tell me if I got
it right:

The issue is that there may be situations where LMA may lose the binding
cache for a user or a complete MAG:

1) Session revocation in the LMA without notification to the MAG
2) LMA reboot
3) A different software error.

Some of the people in the discussion feel that it is a problem that the MAG
keeps on sending traffic to the LMA until the timer kicks in and the MAG
tries to do a new PBU.

What has been proposed is a notification from the LMA to the MAG to tell
there is no binding cache.

I have myself some questions on this topic. Would a possible notification
trigger a new PBU or dropping the connection at MAG? What would be the
security model? (Basically, how to make sure there is not a DoS attack by
spoofing a fake notification?) How would this work together with the other
heart beat mechanisms, etc?

Cheers,

Jonne.

-- 
Jonne Soininen
Nokia Siemens Networks

Tel: +358 40 527 46 34
E-mail: [email-masked]

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 21 Aug 2008 16:51:40 -0500

Hi Jonne,

> Subject: Re: [netlmm] Lack of session indication
> 
> Hello,
> 
> Sorry to be late in this. However, I'll try to summarize some 
> things here and understand what should be done going forward. 
> Please, tell me if I got it right:
> 
> The issue is that there may be situations where LMA may lose 
> the binding cache for a user or a complete MAG:
> 
> Some of the people in the discussion feel that it is a 
> problem that the MAG keeps on sending traffic to the LMA 
> until the timer kicks in and the MAG tries to do a new PBU.
> 
> What has been proposed is a notification from the LMA to the 
> MAG to tell there is no binding cache.
> 
> I have myself some questions on this topic. Would a possible 
> notification trigger a new PBU or dropping the connection at 
> MAG? 

[Ahmad]
This can be worked out in many different ways and one of them a Binding
Revocation with a specific Revocation Trigger. "example: No BCE Exist or
something like that"

> What would be the security model? 
[Ahmad]
I am not sure if there is a security model that can work here. However,
the only one I could think of is that the data path has to be secure and
that something which is not pretty but possible.

>(Basically, how to make sure there is not a DoS attack by spoofing a
fake 
> notification?)

[Ahmad]
The DoS attack here is not related to the notification message, it is
related to the fact that an unsecured data packet can trigger a
notification message. The notification message itself could be secure,
but the fact that the attacker is able to trigger this message by
sending an unsecured data packet is a candidate for causing a DoS
attack. 

> How would this work together with the other 

[Ahmad]
AFAIK, Heart beat mechanism use the same security model as PMIPv6. In
that case, either the MAG or the LMA is able to validate the heart beat
message before taking action.

Regards,
Ahmad
> >> I am not suggesting that the datapath signal the control 
> plane upon 
> >> loss of every packet. We don't want to do that. An 
> indication along 
> >> the lines of ICMP unreachable (in the kernel) or an event that's 
> >> triggered upon loss of some configurable number of packets 
> could be couple of options.
> >> 
> >

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 29 Aug 2008 11:01:08 -0700

Hi Jonne,

> 1) Session revocation in the LMA without notification to the MAG

This should trigger a binding revocation from the LMA to the MAG. If the 
binding revocation indication message is lost, it is re-transmitted.

> 2) LMA reboot

If the PMIPv6 session state survives reboots, then there is nothing to 
do. If it does not, the loss of session state is detected by the 
unsolicited Heartbeat response message with the restart counter 
incremented by 1. In fact, it would be very bad if the LMA has to 
respond with a "lack of session indication" message for each of the 
mobile nodes it had a binding for.

> 3) A different software error.

You mean a bug? Since when did we extend protocols to handle bugs. ;)

> heart beat mechanisms, etc?

I don't think we have yet come up with a scenario where the "MN-specific 
lack of session indication" would be needed.

Then there is an issue of whether the LMA should silently drop the 
messages or should send some sort of message back to the MAG. We haven't 
resolved that yet.

Finally, if we do conclude that the LMA should send a message back, we 
need to decide between sending a Binding Error and an ICMP error 
message. Sending a Heartbeat message seems to be a poor choice, since 
Heartbeat messages are for testing path reachability between the MAG and 
the LMA and are not specific to any particular mobile node's session.

Hope that helps.

Vijay