Subject: [Dime] [Fwd: Re: [Diameter-developers] Question on mismatching realm and host FQDNs]

From: Anders Kristensen <[email-masked]>
Date: Sun, 05 Feb 2006 21:34:47 -0500

On the subject of open Diameter issues, the attached email is Victor's 
response to a question I raised on the diameter-developers list 
recently. I'd be very interested in hearing opionions about what the 
right thing to do in the different cases.

Thanks,
Anders

Subject: Re: [Diameter-developers] Question on mismatching realm and host FQDNs
From: Victor Fajardo <[email-masked]>
To: Anders Kristensen <[email-masked]>
Cc: [email-masked]
Date: Sun, 29 Jan 2006 22:06:35 -0500

Hi Anders,

Comments inline:

> I was wondering how OpenDiameter handles the case where it opens a 
> connection to a peer and the peer advertises Origin-Realm and 
> Origin-Host names for itself in the the CEA that do not match what the 
> local OpenDiameter stack was expecting.
>
> For example, suppose we have the following OpenDiameter config file 
> (from the documentation):
>
>           <route>
>              <realm>other.research.org</realm>
>              <role>0</role>
>              <application>
>                   <application_id>1</application_id>
>                   <vendor_id>0</vendor_id>
>                   <peer_entry>
>                       <server>server1.research.org</server>
>                       <metric>1</metric>
>                   </peer_entry>
>              </application>
>           </route>
>
> Presumably this means that requests with a Destination-Realm of 
> other.research.org will be routed to the Diameter node 
> server1.research.org. But what happens if the node with that name 
> returns a CEA with Origin-Realm foo.example.com and/or Origin-Host 
> bar.example.com?

Good question. Unfortunately, I did not check the validity of the 
origin-host in the CEA. We may need to do that. Since the rfc is not 
clear about the issue, I think it is possible to keep up the connection 
and treat the new origin host and/or origin realm as new routes. This 
means adding the new host and/or realm addresses (dynamic route updates) 
to peer and realm route table respectively. Security threats posed by 
entities mis-representing the peer you initially contacted can be 
thwarted if using TLS or IPSec. However, this also means the peer entry 
from the original configuration should be marked as an in-active peer 
(run-time only) since there should be no inter-dependent routes. This 
also means that sebsequent new sessions sending messages to the original 
peer will fail to route so some notification to session level states 
regarding host/realm changes may also be needed. Subsequent messages 
sent to the original realm may not need the same treatment can be routed 
to other active peers (or even the new peer). In short:

a. If origin host is different, add new peer entry, add new entry to 
existing realm entry. Mark old peer entry as in-active
b. if origin realm is different, add new realm, add new host as handlers 
for new realm.
c. If both are different, perform (a) then (b).

>
> Will the connection be allowed to be used or will it be torn down? If 
> it's kept up what requests will be routed to the peer, e.g. requests 
> with what Destination-Realm?

See above. Though, maybe further discussion can reveal flaws in the 
above scheme of keeping the connection alive and updating routes.

Victor

>
> Thanks,
> Anders
>
>
> -------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc. Do you grep through log 
> files
> for problems?  Stop!  Download the new AJAX search engine that makes
> searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=103432&bid=230486&dat=121642
> _______________________________________________
> Diameter-developers mailing list
> [email-masked]
> https://lists.sourceforge.net/lists/listinfo/diameter-developers
>
>

_______________________________________________
DiME mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dime