Subject: [AAA-WG]: Issue 362: Clarification of Proxy, Relay and Redirect Usage

From: Bernard Aboba <[email-masked]>
Date: Tue, 10 Sep 2002 18:26:50 -0700 (PDT)

Issue 362: Clarification of Proxy, Relay, and Redirect Usage
Submitter: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: September 9, 2002
Reference:
Document: BASE-12
Comment type: E
Priority: S
Section: many
Rationale/Explanation of issue:

Throughout the document, the term "proxy" is used when actually it is
intended refer to proxies, relays and redirects. Also, the term "stateful"
is unclear; sometimes this refers to session state, sometimes to
transaction state.

Section 2.8.1, page 24, last paragraph, change to:

"Relays modify Diameter messages by inserting and removing routing
information, but do not modify any other portion of a message.
Relays SHOULD NOT maintain session state but MUST maintain
transaction state."

Section 2.8.2, page 25, third paragraph, change to:

"Proxies that wish to limit resources MUST maintain session state.
All proxies MUST maintain transaction state."

Section 2.8.3, page 27, first paragraph, change to:

"Since Redirect agents do not perform any application level
processing, the provide services for all Diameter applications,
and therefore MUST advertise the Relay Application Identifier."

Page 28, first second and third paragraphs, change to:

"End-to-end security services include confidentiality
and message origin authentication. These services are provided
by supporting AVP integrity and confidentiality between two
peers, communicating through agents.

End-to-end security is provided via the End-to-End security
extension, described in [AAACMS]. The circumstances requiring
the use of end-to-end security are determined by policy on
each of the peers. Security policies, which are not the
subject of standardization, may be applied by next hop
Diameter peer or by destination realm. For example, where
TLS or IPsec transmission-level security is sufficient,
there may be no need for end-to-end security.

End-to-end security policies include:"

Page 30, last paragraph. Change

"The End-to-End Identifier MUST NOT be modified by relay agents"

to:

"The End-to-End Identifier MUST NOT be modified by Diameter agents
of any kind."

Page 49, second to last paragraph:

Change "be sent via proxy/agent" to:
"be sent via a Diameter agent (proxy, redirect or relay)"

Page 68, third paragraph

Change

"Proxiable request messages MUST also contain an
Acct-Application-Id AVP, an Auth-Application-Id AVP or a
Vendor-Specific-Application-Id AVP. A message that MUST NOT
be relayed, proxied or redirect MUST not include..."

To:

"Request messages that may be forwarded by Diameter agents
(proxies, redirects or relays) MUST also contain an
Acct-Application-Id AVP, an Auth-Application-Id AVP or a
Vendor-Specific-Application-Id AVP. A message that MUST NOT
be forwarded by Diameter agents (proxies, redirects or
relays) MUST not include..."

Page 70, Section 6.1.6

Change:

"A Diameter message that is able to be proxied MUST
include..."

to:

"A Diameter message that may be forwarded by Diameter
agents (proxies, redirects or relays) MUST include..."

---

From: <[email-masked]>
Date: Thu, 12 Sep 2002 13:20:46 +0300

Hi Bernard,

I think these changes are good.

John

> -----Original Message-----
> From: ext Bernard Aboba [mailto:[email-masked]]
> Sent: 11 September, 2002 04:27
> To: [email-masked]
> Subject: [AAA-WG]: Issue 362: Clarification of Proxy, Relay 
> and Redirect
> Usage
> 
>