Subject: Re: [Pana] PANA interop at IETF63

From: Victor Fajardo <[email-masked]>
Date: Fri, 12 Aug 2005 08:48:13 -0400

During, IETF63 we had an ad-hoc interoperability testing between Toshiba 
and Samsung implementations of PANA. Attached is a detailed report on 
the result of the test. Hopefully this will be helpful to the wg.
-- victor

>We are going to do an interoperability testing between Toshiba and
>Samsung implementations of PANA during IETF 63. If there are other
>implementations that would like to participate, please let us know.
>(Sorry for the late notice).
>
>Alper
>
>  
>

Document     : PANA Ad-hoc interopt at IETF 63 - Paris
Author       : Victor Fajardo
Last Updated : Aug 10, 2005 - Created
               Aug 11, 2005 - Comments from Suraj

This is a prelimenary report on the results of pana 
ad-hoc inter-operability testing. Due to time constraints, 
we were only able to setup the following basic testbed:

1. Testbed

1.1 Topology
    Peer-to-peer ethernet connection with static IP's
1.2 EAP support
    1.2.1 EAP method is limited to md5. This limited the
          tests that can be performed. Separate authentication
          and key derivation is excluded from the test.
    1.2.2 EAP Implementation Notes
        1.2.2.1 Samsung	
           Uses EAP implementation present in xsupplicant at PaC.
           Uses EAP implementation present in hostapd at PAA.
           PAA implementation is incorporated within the
           hostap deamon. PaC implementation is integrated within
           xsupplicant and is running as a standalone application           
        1.2.2.2 Toshiba
           Uses OpenDiameter EAP library implementation. PAA
           implementation is integrated in a NAS deamon. PaC
           is a standalone PANA dialer application.
1.3 AAA support
    1.3.1 Samsung
          Uses EAP/RADIUS client present in the hostap deamon. PAA 
          is integrated within this deamon. In Backend ,RADIUS server 
          is running. All deamons are running locally on the same 
          machine.
    1.3.2 Toshiba 
          Uses EAP/DIAMETER present in an OpenDiameter NAS and AAA
          deamon. PAA is a integrated in the NAS deamon. Backend
          DIAMETER is integrated in the AAA deamon. Both deamons are 
          running locally on the same machine.
1.4 PANA 
    a. Version draft-pana-pana-10 of the protocol.
    b. Test is limited to single auth because of md5     
    c. IPv4 only
      
2. Test Results

Notes:
    All test are for positive test only. No error recoverability
    or negative test was performed.
    
Legend:
  Ok  - Test was successful, no modifications/debugging/fixing required
  NT  - Test was not performed
  Fix - Test was initially not successful but eventually fixed
  Prb - Problem that has not been solved

                          +-------------+-----------+
                          |   Samsung   | Toshiba   |
+-------------------------+------+------+-----+-----+-------+
|         Test            | PAA  | PaC  | PAA | PaC | Notes |
+-------------------------+------+------+-----+-----+-------+
                          | 
Discovery                 |
                          |
a. Stateful               |  Ok    Ok      Ok    Ok
   a.1 With Cookie        |  Ok    Ok      Ok    Ok
   b.2 No Cookie          |  Ok    NT      NT    Ok
   b.3 With Nonce         |  Ok    Ok      Ok    Ok
   b.4 No Nocnce          |  Ok    NT      NT    Ok
                          |
b. Stateless              |
    b.1 No EAP in PSR/PSA |  Ok    Ok      Ok    Ok
    b.2 EAP in PSR/PSA    |  Ok    Ok      Ok    Ok
                          | 
c. Multicast PDI          |  Ok    Ok      Ok    Ok
                          |
d. Unicast PDI            |  Ok    Ok      Ok    Ok
                          |
e. ISP selection          |  Ok    Ok      Ok    Ok   (static selection
                          |                            only, i.e. cfg file)
f. EP initiated PSR       |  NT    NT      NT    NT
                          |
+-------------------------+
                          |
Authentication and        |
Authorization             |
                          |
a. No EAP in PAN          | Ok     Ok      Ok    Ok             
b. With EAP in PAN        | Ok     NT      NT    Ok              
c. Device-Id checks       | Fix    Ok      Ok    Fix   (Sec 3.1)
d. Pcap checks            | Ok     Ok      Ok    Ok
e. Lifetime checks        | Ok     Ok      Ok    Ok
f. Ppac checks            | Ok     Ok      Ok    Fix   (Sec 3.2)
                          |
+-------------------------+
                          |
Access                    |
                          |
a. Lifetime expire        | Prb    NT      NT    Prb   (Sec 3.3)
    (re-auth sent)        |
b. Ping exchange          | Ok     Ok      Ok    Ok
c. PUR/PUA exchange       | Ok     NT      NT    Ok
d. Re-auth exchange       | NT     NT      NT    NT    (Sec 3.3)
                          |
+-------------------------+
                          |
Termination               |
                          |
a. PTR/PTA                | Ok    NT       Ok    NT             
                          |
+-------------------------+
                          |
General                   |
                          |
a. Retransmission         | Ok    Ok       Ok    Ok
b. Sequence #'s           | Ok    Ok       Ok    Ok
c. Notification           | Ok    Ok       Ok    Ok
d. Session id check       | Ok    Ok       Ok    Ok
f. Message validation     |
    f.1 msg flags         | Ok    Ok       Ok    Ok
    f.2 avp occurance     | Ok    Ok       Ok    Ok
    f.3 avp flags         | Ok    Ok       Ok    Ok
g. PER transmission       | NT    NT       NT    NT    (no negative test done)

3. Result Notes
   
3.1 Device-Id problems

   During the PBR/PBA exchange, there was a device id problems on both
   Toshiba and Samsung implementation. The Toshiba PaC was sending an
   a wrong device id type (IPv6 type instead of IPv4) in the device-id
   AVP of the PBA message. When the Samsung PAA receives an invalid 
   device id type, it will cause a segmentation fault. Both problems
   was eventually fixed with debugging and code changes.

3.2 Ppac problems

   The Toshiba implementation has an older definition of the PPAC-AVP.
   So the bit-flags in the AVP was incorrect. When the Toshiba PaC
   sends this PPAC to the Samsung PAA, authentication always fails 
   and the PAA would send the proper PER. This problem was eventually
   fixed with code updates.
   
3.3 Lifetime expiration problems

   An issue was found when a Samsung PAA detects an lifetime expiration 
   and attempts to send a re-auth request. At approximately the same 
   moment, the PaC detects session lifetime and releases the session. 
   This problem is still under investigation and was left unresolve due 
   to lack of time. Re-auth was left untested because of this. 
   
_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana