Re: [pcp] PANA implementatinos to consider

[Margaret Wasserman <[e-mail]>]

Hi Alper,

On Sep 14, 2012, at 2:52 AM, Alper Yegin wrote:
> As for the implementation complexity, I don't quite understand why PANA (which is basically EAP over UDP) would ever be more complicated then to-be-designed "EAP over UDP within PCP framework". While I don't see a reason for former being more complicated, I see reasons for seeing the latter being more complicated, as the whole thing now needs to live within another protocol framework (read: format, flow, state machine harmonization between the two).

I don't understand how you get away from coupling PANA and PCP, even in the demultiplexing case where they run side-by-side on the same port.  I think a number of details are being glossed over in your latest document when you refer to a need for an "API" between PANA and PCP...

Let's start with a simple case where the PCP Client wants to initiate and authenticated PCP request...

The Client needs to ask the PANA Client to initiate authentication.  How?  Will that request include any details about the mapping request that is being made?  i.e. will the PANA Client be asking for authentication _and authorization_ to perform a particular action?  Or do we assume that a PCP client is authenticated via PANA, and that authorization for a particular action is a separate step that is performed as part of PCP?  If they are separate, do we need a new set of PCP error codes for the situation where an authenticated PCP client performs an unauthorized action, or is that already covered in the PCP spec?

When the PCP Client asks the PANA Client to perform authentication, what are the possible results that can be returned from that request, and how are they communicated back to the PCP Client?  You have only described the success case in your document.

How does this work in the case where the PCP Server is not running a PANA Server?  I _think_ that if a PCP Client asks its PANA Client to perform authentication, and the PCP Server does support authentication, some sort of "unsupported version" error code will be returned to the _PCP Client_ (due to the details of your proposed demultiplexing scheme), and that nothing will be returned to the PANA Client, at all.  We would need to make sure that secure PCP clients are specified to handle an "unsupported version" error differently when the PANA Client is in this particular state, but how does the PCP Client know that this is why that error was returned?  If this does happen, how does the PCP client inform the PANA Client that it should stop trying to perform authentication with that particular PCP Server?  

Also, how does the PCP Client know when the _PCP Server_ is ready to receive its request?  Are we assuming that the PANA Server will not return an indication to the PANA Client that the client has been authenticated until _after_ it has provisioned the necessary SA on the PANA Server?  

What if an additional application on the same PCP Client system wants to perform an authenticated request with the same PCP Server in the meantime?  Will that second request result in a second (interleaved) PANA negotiation, or will the PCP Client be told that a PANA negotiation is already pending?  If the latter, how will the second PCP Client thread by informed when the PANA negotiation has completed?  (Note:  The right answer here depends heavily on whether the PANA authentication depends, in any way, on the contents of a specific PCP request -- the authentication vs. authentication/authorization question above).

All of these questions will need to be answered, IMO, in a full specification of the PCP/PANA demultiplexing mechanism, precisely _because_ PCP and PANA are running separately.  The "API" is where this coupling is provided between the two "state machines", as you refer to them.  Why is this any simpler if PANA and PCP are running side-by side than if we run PANA encapsulated in PCP?  (or, if we run PCP directly over EAP, for that matter)

Margaret