Subject: [Pana] pana-pana Issue227: Comments on Access Phase

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 27 Dec 2005 11:59:38 -0500

>4.5  Access Phase
>
>   Once the authentication and authorization phase or the re-
>   authentication phase successfully completes, the PaC gains access to
>   the network and can send and receive IP data traffic through the
>   EP(s) and the PANA session enters the access phase.  In this phase,
>   PANA-Ping-Request and PANA-Ping-Answer messages can be used for
>   testing the liveness of the PANA session on the PANA peer.  Both the
>   PaC and the PAA are allowed to send a PANA-Ping-Request message to
>   the communicating peer whenever they need to make sure the
>   availability of the session on the peer and expect the peer to
return
>   a PANA-Ping-Answer message.  Both PANA-Ping-Request and PANA-Ping-
>   Answer messages MUST be protected with a MAC AVP when a PANA SA is
>   available.
>
>   Implementations MUST limit the rate of performing this test.  The
PaC
>   and the PAA can handle rate limitation on their own, they do not
have
>   to perform any coordination with each other.  There is no
negotiation
>   of timers for this purpose.
>  
>
How about rate limitation on responding to a PING request? Is that
allowed?

>   Figure 5 and Figure 6 show liveness tests as they are initiated by
>   the PaC and the PAA respectively.
>
>   PaC      PAA     Message(sequence number)[AVPs]
>   ------------------------------------------------------
>      ----->        PANA-Ping-Request(q)[Session-Id, MAC]
>      <-----        PANA-Ping-Answer(q)[Session-Id, MAC]
>
>
>        Figure 5: Example sequence for PaC-initiated liveness test
>
>
>   PaC      PAA     Message(sequence number)[AVPs]
>   ------------------------------------------------------
>      <-----        PANA-Ping-Request(p)[Session-Id, MAC]
>      ----->        PANA-Ping-Answer(p)[Session-Id, MAC]
>
>        Figure 6: Example sequence for PAA-initiated liveness test
>  
>
I assume ping requests can overlap answers, with the sequence number 
being used to match up requests with answers?

What are the ramifications of an unanswered ping request? Is it 
retransmitted? Is the sequence number listed here part of the same 
number space as other PANA messages (I would suggest it NOT being a part

of the same number space)?

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Jari Arkko <[email-masked]>
Date: Thu, 29 Dec 2005 08:49:06 +0200

Yoshihiro Ohba wrote:

>>  Implementations MUST limit the rate of performing this test.  The PaC
>>    
>>
>>  and the PAA can handle rate limitation on their own, they do not have
>>    
>>
>>  to perform any coordination with each other.  There is no negotiation
>>    
>>
I believe this is what the above is trying to say, but maybe it would
be better if this was said in a more explicit manner:

Implementations MUST limit the rate of performing this test.
=>
The rate at which PANA-Ping-Requests are generated and the
rate at which responses to them can be sent MUST be limited.

>being used to match up requests with answers?
Apparently, no. The spec (Section 5.2) says that a peer can only have one
outstanding request at a time. So one side can not send a new ping
before it has gotten an answer. But both sides may be pinging
simultaneously,
though, because the sequence number space is always the request
initiator's space.

>of the same number space)?
Apparently it is the same space. Given that no more than one
outstanding request may exist at any time, an unanswered ping
essentially kills the session (unless retransmissions succeed in
getting a ping answer).

This could be changed, but appears to have a significant effect
on message structures etc because then the ping messages would
be different from other PANA messages, and treated differently.

By the way, text in 5.2 (" The PaC and PAA MUST respond to
duplicate requests.") may be in conflict with the rate limitation
requirement.

--Jari

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Dec 2005 10:55:50 -0500

> rate at which responses to them can be sent MUST be limited.

I agree.

> be different from other PANA messages, and treated differently.

I agree with Jari.  Having a separate sequence number space for
PANA-Ping will significantly impact the protocol design.  IMO, we
should avoid significant design change unless the change is expected
to significantly improve performance or security.

> duplicate requests.") may be in conflict with the rate limitation

Hmm, it looks like that.  How about the following change?

In Section 5.2, change:

"
   The PaC and PAA MUST respond to duplicate requests.  The last
   transmitted answer MAY be cached in case it is not received by the
   peer and that generates a retransmission of the last request.  When
   available, the cached answer can be used instead of fully processing
   the retransmitted request and forming a new answer from scratch.
"

to:

"
   The PaC and PAA MUST respond to duplicate requests as long as the
   responding rate does not exceed a certain threshold value.  The
   last transmitted answer MAY be cached in case it is not received by
   the peer and that generates a retransmission of the last request.
   When available, the cached answer can be used instead of fully
   processing the retransmitted request and forming a new answer from
   scratch.
"

Yoshihiro Ohba

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 30 Dec 2005 12:51:14 +0200

I'm not sure if we really need to allow rate limiting the Ping-Answer.

If the sender is misbehaving and sending bursts of Ping-Requests, the value
of rate limiting the answers is diminished (processing and bandwidth is
already taxed).

Also, when in a system absence of Ping-Answers lead to termination of the
session, the rate limiting leads to unintended session break down.

I'm thinking that suggesting rate limiting the Ping-Request is the right
choice.

Alper

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Yoshihiro Ohba
> Sent: Thursday, December 29, 2005 5:56 PM
> To: Jari Arkko
> Cc: W. Mark Townsley; Yoshihiro Ohba; [email-masked]
> Subject: Re: [Pana] pana-pana Issue227: Comments on Access Phase
>