Subject: RE: PANA and IP address configuration

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 4 Dec 2002 12:32:21 -0800

> 
> Current requirements draft says:
> 
>    PANA does not perform any address assignment functions but
>    MUST only be invoked after the client has a usable IP address.
> 
> Here is the proposed text replacement:
> 
>    Providing address assignment functionality is outside the scope 
>    of PANA. PANA protocol design MAY require the PaC to configure 
>    an IP address before using this protocol. Allocating an IP address
>    to unauthenticated PaCs may enable security 
> vulnerabilities, such as
>    IP address depletion attacks on the access network. This threat may
>    not be an issue for IPv6 because of the large address space, but it

In IPv6 one can use link local address. It might be better to mention
that
rather than exhaustion of large address space I think.

>    can effect IPv4 deployments. Such a threat can be 
> mitigated by allowing
>    the protocol to run without an IP address on the PaC (e.g., using
>    unspecified source address), but this choice might limit the re-use
>    of existing security mechanisms, and impose additional 
> implementation
>    complexity. This trade off should be taken into consideration in
>    designing PANA. 
> 
> So, one proposal might choose to require an IP address be 
> configured on the PaC before PANA, and therefore possibly 
> open to address depletion attacks. Another proposal might 
> work without 
> IP address, but may have some protocol complexity (in addition to 
> implementation complexity). Both proposals should be acceptible for 
> consideration. And it would be ideal if we had identified a proposal 
> that works the same way with or without an IP address. That 
> means, it could be just an implementation exercise to provide 
> both modes of operation.
> 
Sounds okay to me.

-mohan

> Comments?
> alper

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Wed, 4 Dec 2002 18:29:51 -0800

> rather than exhaustion of large address space I think.

Actually link-local addresses are also available with IPv4:

http://ietf.org/internet-drafts/draft-ietf-zeroconf-ipv4-linklocal-07.txt

alper

---

From: "Fredrik Nyman" <[email-masked]>
Date: Thu, 5 Dec 2002 14:07:49 +0100

On 3 Dec 2002 at 17:16, Alper E. YEGIN wrote:

> configured on the PaC before PANA, and therefore possibly open to
> address depletion attacks. Another proposal might work without 
> consideration. 

For IPv4, in my view, the protocol should not require an IP address 
assignment on the PaC. Such requirement would limit the useability of the 
protocol when facing the question "should the PaC device be assigned an IP 
address at all". If it already has an IP address, it's is too late.

The question can also be rephrased as "from which IP subnet should I 
assign the IP address" considering situations with filtering, CoS, rate-
limiting or other actions in the network partly or in whole based on IP 
subnet.

-- 
Fredrik Nyman
PacketFront Sweden AB
http://www.packetfront.com/

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 5 Dec 2002 14:07:14 -0500

> address at all". If it already has an IP address, it's is too late.

Is it too late if the PaC has a link-local IPv4 address but does not
have a global IPv4 address when performing PANA?  I guess the answer
is "no", because the usage is equivalent to performing PANA with IPv6
link-local address, which has been an acceptable scenario for PANA.

IMHO, the demand for PANA with unspecified IP address would depend on
the deployment level of IPv4 link-local address implementation.

> limiting or other actions in the network partly or in whole based on IP 

Yoshihiro Ohba