Subject: [Pana] Re: Comments on draft-ietf-pana-statemachine-00

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 07 Jul 2005 18:04:28 -0400

I have some comments in line.

On Fri, Jun 17, 2005 at 10:37:21AM -0400, Victor Fajardo wrote:
> Hi,
> 
> >PaC State Machine
> >-------------------
> > 
> >In OFFLINE State
> >      1. EAP_Restart() is not required as an initialization action
> >      since it is already done for all exit conditions where
> >      PSR is received
> 
> good point.
> 
> >
> > 
> >      2. Nonce is required to be added for PSR. Also, optionally,
> >      PPAC and PCAP AVP could be added
> 
> Nonce is required, however the inclusion of the Nonce does not cause the 
> statemachine to migrate to a new state or generate an event (no effect 
> on the statemachine) as per pana-draft-08. Including it would not 
> provide support more functionality in the fsm just more information 
> already contained in the pana-draft-08.

Just a note that in pana-pana-09d, Nonce is now optional for PSR in
the case of stateless PAA discovery.

> 
> >
> > 
> >In WAIT_EAP_MSG_IN_DISC State
> >      3. Optionally, PSA could include ISP-Information
> 
> same as above.

I think we should provide all possible optional AVP switches.

Thus inserting the action "if (choose_isp())
PSA.insert_avp("ISP");" is needed as Vijayarajan mentioned.

> 
> >
> > 
> > 
> >In WAIT_EAP_RESULT State
> >      4. Suppose separate NAP and ISP is being performed and the
> >      first EAP authentication succeeds but second EAP authentication
> >      fails. Depending on network policy, say the PAA decided that
> >      network access should be allowed i.e PBR.RESULT_CODE == 
> >PANA_SUCCESS 
> >      at the end of 2nd EAP authentication. But the EAP Payload
> >      within PBR will be EAP_FAILURE.
> >     
> >      According to the state machine, after receiving PBR, PaC will
> >      move from WAIT_PAA to WAIT_EAP_RESULT state. On receiving 
> >EAP_FAILURE
> >      event in WAIT_EAP_RESULT, it will just send PBA and go to CLOSED 
> >state
> >      whereas it should send PBA and go to OPEN state.
> 
> good point.
> 
> >
> > 
> >      One possible way of handling this would be to add the following
> >      state transition
> > 
> >      EAP_FAILURE &&           if (key_available())               OPEN
> >      (SEPARATE == Set) &&        PBA.insert_avp("MAC");
> >      (1ST_EAP != UNSET) &&    if (CARRY_DEVICE_ID)
> >      ppac_available()           PBA.insert_avp("Device-Id");
> >                               PBA.insert_avp("PPAC");
> >                               Tx:PBA();
> >                               Authorize();
> >                               SessionTimerStart();
> 
> I generally agree though I'd like to change the exit condition just for 
> clarity ...
> 
> EAP_FAILURE &&
> (SEAPARATE == Set) &&
> PBR.RESULT_CODE == PANA_SUCCESS &&
> ppac_available()
> 
> also we may also have to introduce the following:
> 
>   EAP_FAILURE &&          PBA.insert_avp("MAC");      OPEN
>   (SEAPARATE == Set) &&   PBA.insert_avp("Key-Id");
>   PBR.RESULT_CODE ==      if (CARRY_DEVICE_ID)
>   PANA_SUCCESS &&           PBA.insert_avp
>   PBR.exist_avp           ("Device-Id");
>   ("Key-Id") &&           PBA.insert_avp("PPAC");
>   ppac_available()        Tx:PBA();
>                           Authorize();
>                           SessionTimerStart();
> 
>   EAP_FAILURE &&          if (key_available())        OPEN
>   (SEAPARATE == Set) &&     PBA.insert_avp("MAC");
>   PBR.RESULT_CODE ==      if (CARRY_DEVICE_ID)
>   PANA_SUCCESS &&           PBA.insert_avp
>   !PBR.exist_avp            ("Device-Id");
>   ("Key-Id") &&           PBA.insert_avp("PPAC");
>   ppac_available()        Tx:PBA();
>                           Authorize();
>                           SessionTimerStart();

In the case of separate NAP and ISP authentication, both EAP runs must
generate a AAA-Key in order to avoid man-in-the-middle attacks.  So
the session must be terminated in this case (missing Key-Id means no
AAA-Key generated.) instead of becomes OPEN state.

> 
>   EAP_FAILURE &&          if (key_available())        WAIT_PEA
>   (SEAPARATE == Set) &&     PER.insert_avp("MAC");
>   PBR.RESULT_CODE ==      PER.RESULT_CODE=
>   PANA_SUCCESS &&            PANA_PPAC_CAPABILITY_
>   !ppac_available()            UNSUPPORTED
>                           Tx:PER();
>                           RtxTimerStart();
> 
> >
> > 
> >      And, the following state transition
> >     
> >      EAP_FAILURE             if (key_available())                CLOSED
> >                                 PBA.insert_avp("MAC");
> >                              Tx:PBA();
> > 
> >      would then change to
> >     
> >      EAP_FAILURE &&             if (key_available())             
> >       CLOSED
> >        ((SEPARATE == Unset) ||       PBA.insert_avp("MAC");
> >      (1ST_EAP == Unset) ||      Tx:PBA();
> >      (!ppac_available()))
> 
> I'm not sure if we need this entry anymore. EAP_FAILURE in 
> WAIT_EAP_RESULT can only occur when one EAP auth or the sole EAP auth 
> succeeds and PBR.RESULT_CODE == PANA_SUCCESS.
> 
> >
> >     
> > 
> > 
> >      5. In draft-ietf-pana-pana-08.txt, the following text is present
> > 
> >      PANA_PROTECTION_CAPABILITY_UNSUPPORTED  5016
> > 
> >      This error is returned when the PaC receives a PANA-Bind-Request
> >      message with a Protection-Capability AVP and a valid MAC AVP but
> >      does not support the protection capability specified in the
> >      Protection-Capability AVP.  Only the PaC can generate this code.
> > 
> >      But I could not find any mention of the same in section 
> >4.3(Authentication
> >      and Authorization phase). If the PaC is required to send this error
> >      when it receives a PBR with PBR.RESULT_CODE == PANA_SUCCESS and 
> >MAC AVP,
> >      then a state transition like the one below would need to be added.
> > 
> > 
> >      EAP_SUCCESS &&                      if (key_available())     
> >            WAIT_PEA
> >      PBR.RESULT_CODE==PANA_SUCCESS &&          PER.insert_avp("MAC");
> >      PBR.exist_avp                             PER.RESULT_CODE=
> >        ("MAC")                                 
> >PANA_PROTECTION_CAPABILITY_UNSUPPORTED
> >      !pcap_available()               Tx:PER();
> >                                        RtxTimerStart();
> > 
> >      And some of the Exit conditions would also require changes like
> > 
> >      EAP_SUCCESS &&
> >      PBR.exist_avp
> >      ("Key-Id") &&
> >      ppac_available()     
> > 
> >      becomes
> >     
> >      EAP_SUCCESS &&
> >      PBR.exist_avp
> >      ("Key-Id") &&
> >      ppac_available() &&
> >      pcap_available()   
> > 
> >      etc
> 
> I agree that there needs to be some support for this though as you 
> mentioned pana-draft-08 does not seem very clear about this. With PPAC, 
> the draft was explicit in terminating the session when PPAC_UNSUPPORTED 
> is sent. The question is how is the severity of pcap_available() error 
> treated. I guessing it should be as sever ... and should we start 
> assuming that.

I think we should support pcap_available() error.

I think the specification should be clear about what should be done
upon the PANA_PROTECTION_CAPABILITY_UNSUPPORTED error.  Terminating
the session is the right behavior.  I'll try to provide revised text
for the specification.

Yoshihiro Ohba

> 
> > 
> > 
> >PAA State Machine
> >------------------
> >In STATEFUL_DISC State
> >      6. After receiving PSA, re-transmission timer has to be stopped
> 
> agree.
> 
> > 
> >In WAIT_SUCC_PBA State
> >      7.
> >       Rx:PBA &&                SessionTimerStart();                   
> > OPEN
> >       (CARRY_DEVICE_ID==Unset ||  
> >       (CARRY_DEVICE_ID==Set &&    
> >       PBA.exit_avp("Device-Id")))
> >       
> >       
> >      Should'nt pana_sm_ep_enable_protection() and 
> >pana_sm_ep_install_filter() be there
> >      after SessionTimerStart() ? They were present in 
> >draft-ohba-pana-statemachine-01.txt
> 
> Are you sure it was in draft-ohba-pana-statemachine-01.txt ? I dont 
> remember adding any of those functionality.
> 
> > 
> > 
> >In OPEN State
> >      8. When PRAR is received or REAUTH is triggered, the session 
> >timer has to be
> >      stopped
> >                 
> > 
> 
> I think there are more bugs than that since SessionStopTimer() was not 
> provided at all.
> 
> regards,
> -- victor

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 07 Jul 2005 18:17:23 -0400

I have one correction to my previous comment and one additionl comment
(see below).

> >   ppac_available()        Tx:PBA();

Why is Key-Id carried with EAP_FAIURE?

> AAA-Key generated.) instead of becomes OPEN state.

Correction: Since this is EAP_FAILURE case, it is valid not carrying 
Key-Id AVP.  So we should keep this transition.

Yoshihiro Ohba

---

From: Victor Fajardo <[email-masked]>
Date: Thu, 07 Jul 2005 19:53:49 -0400

Hi,

>the case of stateless PAA discovery.
ok

>PSA.insert_avp("ISP");" is needed as Vijayarajan mentioned.
Ah yes, I missed that. In the case of the ISP AVP in
WAIT_EP_MSG_IN_DISC, the fsm is incomplete. It should be as follows:

EAP_RESPONSE PSA.insert_avp WAIT_PAA
("EAP-Payload"))
if (choose_isp())
PSA.insert_avp("ISP");
Tx:PSA();

I'll mark this as issue #06 of the pana-statemachine-00 issue list.

>AAA-Key generated.) instead of becomes OPEN state.
ok. This will be issue#07 and I'll try to provide a resolution ASAP.

>the session is the right behavior.  I'll try to provide revised text
Yes, the proposed resolution on issue #04 of the issue list follows your
proposed text for pana-pana-09 with regards to this item.

regards,
-- victor

---

From: Victor Fajardo <[email-masked]>
Date: Thu, 07 Jul 2005 20:52:37 -0400

Hi,

>Why is Key-Id carried with EAP_FAIURE?
I agree. Comments below.

>Key-Id AVP.  So we should keep this transition.
ok. The corrections for these state transitions also affect #04. The
Key-Id checks should also not be present on EAP_FAILURE so both state
transitions from the above should be consolidated as follows.

EAP_FAILURE &&       if (key_available())    OPEN
(SEPARATE==Set) &&      PBA.insert_avp("MAC");
ppac_available() &&  if (CARRY_DEVICE_ID)
(!PBR.exist_avp         PBA.insert_avp
("Protection-           ("Device-Id");
Capability") ||      PBA.insert_avp("PPAC");
(PBR.exist_avp       Tx:PBA();
("Protection-        Authorize();
Capability") &&      SessionTimerStart();
pcap_supported()))

regards,
-- victor