Subject: RE: [AAA-WG]: Can CER from unknown hosts cause Peer Table entries

From: <[email-masked]>
Date: Wed, 6 Mar 2002 10:20:51 +0200

Hi,

By peer table entry, I meant an entry that would allow to recreate a connection. As this is not possible, should the specification say, 
"If a CER from and unknown peer is answered with a successful CEA, the lifetime of the peer entry is equal to the lifetime of the transport connection. In case of a transport failure, all the pending transactions destied to the unknown per can be discarded."

Regards,
Kishore

-----Original Message-----
From: ext David Spence [mailto:[email-masked]]
Sent: 05. March 2002 18:39
To: Ghadiyaram Venkata (EXT-TataConsultancy/Helsinki)
Cc: [email-masked]
Subject: Re: [AAA-WG]: Can CER from unknown hosts cause Peer Table
entries

[email-masked] wrote:
> 
> Hi,
> 
> Referring section 5.3 on capabilities-exchange which says,
> 
> "If the local policy permits receiving CERs from unknown hosts, a successful CEA MAY be returned."
> I have the following queries, if someone can clarify.
> 
> If a node accepts CER from an unknown host and returns a successful CEA, does it amount to a peer discovery and can an entry be made in the peer table.

Yes, this means that you have either been "discovered" or redirected to. 
You will need to decide whether you want to accept a connection from the
originator of the CER.  I think there are definite security concerns here
which I will raise in a separate message.

> If this is possible, I have further questions. The information present in a CER may not be sufficient to make a peer table entry. For example the CER does not contain the port on which the peer listens for connections, the transport protocols that the peer supports etc.

If, by a peer table entry, you mean do you have enough information to create
an entry that would allow you to recreate the connection if the connection
you are establishing now gets broken, the answer is no.  In this case, he
wanted to talk to you, so it's his responsiblity to re-establish the
connection.  As far as the current connection is concerned, however, you
don't need any further information.  You don't need the port number on which
he listens.  You know what transport protocol is in use for this
connection.  And whatever security needs to be established has already been
established, you hope, because, by CER/CEA time, the security stuff has
already happened.

> Thanks in advance.
> Regards,
> Kishore
>...

---

From: David Spence <[email-masked]>
Date: Wed, 06 Mar 2002 12:13:14 -0500

I think I understand.  How about if I state this in terms of an issue and
you can check and see if I have it right?