Subject: [AAA-WG]: Issue 163: Error codes (recap)

From: Pat Calhoun <[email-masked]>
Date: Sun, 7 Oct 2001 08:45:06 -0700

The author of this issue has listed a set of error conditions, and the
following request:

a) Decide if all the situations quoted in which no error codes is
mentioned needs a new error code (if so create them)

[ed: and now the list of these error codes]

6. A Diameter node not supporting certificate revocation checks has
calculated a safe period based on the expiration dates of the
certificates. Once this safe period has finished, a CMS-Signed-Data
arrives without any certificate.

Q: How is this *any* different from a message that doesn't include a cert?
It seems like if the cert has expired, so is the DSA (as per other rules
in the spec). Therefore, the correct error is that the DSA has expired.

8. A Diameter message containing a CMS-Signed-Data AVP but with a different
set of AVPs with its 'P' bit set to the ones chosen in the DSA establishment.

Q: We've already agreed that if more than what was requested is present,
it is ok. So this doesn't appear to be a problem

14. A Diameter message containing a CMS-Encrypted-Data AVP. The recipient
isn't on the list of recipients specified in the RecipientInfos of the
EnvelopedData and decides to indicate an error.

Q: Why would this be an error? More likely, if there are AVPs missing (because
they are encrypted for another node), DIAMETER_MISSING_AVPs would be
returned. Don't believe a separate error is required here.

15. A Diameter message containing a CMS-Encrypted-Data AVP. An error
occurs during decryption.

Q: I belive you've stated after this issue was submitted that this is an
invalid case.

So, given the above, it looks like this issue should be rejected.

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 09 Oct 2001 11:57:00 +0200

> in the spec). Therefore, the correct error is that the DSA has expired.

Right. 

> it is ok. So this doesn't appear to be a problem

You're supposing that more AVPs than the specified by means of
Expected-Signed-AVP AVPs are being signed. In such a scenario, your
comment is true. What happens if not all the AVPs requested as signed
are actually signed (that is, they don't have its 'P' bit set).

> returned. Don't believe a separate error is required here.

OK. I was only quoting the previous version of specification that
said:

  "the recipient
   MUST check to see if it is on the list of recipients specified in
the
   RecipientInfos of the EnvelopedData. If not, the recipient MAY
choose
   to process the message or indicate an error."

Nowadays it has been changed using an specific error code:
DIAMETER_NO_DSA_RECIPIENT

> Q: I belive you've stated after this issue was submitted that this is an

Yes...

> So, given the above, it looks like this issue should be rejected.

Yes. It only remains some obscurity on error situation #8. The rest is
fine.

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Ombú 3, 10th. 28045 Madrid - SPAIN -