Subject: [AAA-WG]: [issue] Failed-AVP should be Grouped

From: Mark Eklund <[email-masked]>
Date: Thu, 24 May 2001 15:28:51 -0400 (EDT)

Submitter name: Mark Eklund
Submitter email address: [email-masked]
Date first submitted: 24-May-2001
Reference: 
Document: Base
Comment type: T
Priority: 2
Section:
Rationale/Explanation of issue:
  With the change of the grouped type AVP to allow ABNF in
  the form of 1* {AVP}, the information held by the Failed-Vendor-Id 
  and Offending-AVP may sent by simply putting the failed AVP in the
  Failed-AVP group.

Requested change:
  Eliminate Offending-AVP and Failed-Vendor-Id, change
  Failed-AVP to be of type grouped.

Resolution:

Section 9.3 will be changed to:

9.3  Failed-AVP AVP

   The Failed-AVP AVP (AVP Code 279) is of type Grouped and provides
   debugging information in cases where a request is rejected or not
   fully processed due to erroneous information in a specific AVP. The
   value of the Result-Code AVP will provide information on the reason
   for the Failed-AVP AVP.

   The possible reasons for this AVP are the presence of an improperly
   constructed AVP, an unsupported or unrecognized AVP, an invalid AVP
   value, the omission of a required AVP, the presence of an explicitly
   excluded AVP (see table 13.0), or the presence of two or more
   occurrences of an AVP which table 15.1 restricts to 0, 1, or 0-1
   occurrences.

   A Diameter message MAY contain one Failed-AVP AVP, containing 
   the entire AVP that could not be processed successfully.  If the 
   failure reason is omission of a required AVP, an AVP with the 
   missing command code, the missing vendor id, and a zero filled 
   payload will be added.

   AVP format:   
      <Failed-AVP> ::= (AVP Code = 279)
		       1* {AVP}

====================================================================

---

From: Mark Eklund <[email-masked]>
Date: Thu, 24 May 2001 15:55:17 -0400 (EDT)

Hmm,  it is quite possible that one thing was said and I heard
another.  I thought we had decided to put the entire AVP into
the Failed-AVP as type grouped.  I also thought we discussed
placing a dummy zero fill as the value if it were a missing
AVP.

How would you implement an octetstring?  Would you convert it
from your internal AVP representation to what is sent over the
wire and then add it to the data portion of the octetstring?

Here is a sample AA-Answer with type grouped for the Failed-AVP.  
You could make the Failed-AVP octetstring, but its data would
then be printed like I have shown the Proxy-State AVP.

AA-Answer =
 Session-Id = "a unique identifier",
 Auth-Extension-Id = NASREQ,
 Result-Code = DIAMETER_INVALID_AVP_VALUE,
 Origin-FQDN = "server.my.org",
 Origin-Realm = "cash-cow",
 Service-Type = 5000,
 Destination-FQDN = "nas1.your.com",
 Failed-AVP = {
  Service-Type = 5000
 }
 Route-Record = {
  Proxy-Address = "1.2.3.4",
  Proxy-State = AA AB 08 09 77 44 DE AD
 }

-mark

On Thu, 24 May 2001, Pat Calhoun wrote:

> On Thu, May 24, 2001 at 03:28:51PM -0400, Mark Eklund wrote:
> 
> Mark,
> 
> I am confused. I *thought* we agreed that it could remain an OctetString,
> since it contains the whole AVP header (and data), and therefore includes
> the vendor id. No grouping is required.
> 
> Is my recollection incorrect?
> 
> PatC
>

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 24 May 2001 12:53:52 -0700

On Thu, May 24, 2001 at 03:55:17PM -0400, Mark Eklund wrote:
> another.
ditto.

>  I thought we had decided to put the entire AVP into
> the Failed-AVP as type grouped. 

But why do you need a group, if you can fit the whole AVP into the Failed-AVP
The Group was to hold the Vendor-Id, but this is already part of the 
AVP header that would comprise the Failed-AVP's data.

> I also thought we discussed

The agreement was that one would create an AVP header, with the fields
set to the missing AVP (meaning the AVP Code and Vendor ID would be set
to the values of the missing AVP).

> wire and then add it to the data portion of the octetstring?

That's what I thought we had agreed upon. Of course, we could include
the actual AVP (as the AVP itself, and not an octetstring) as an
element of the Grouped-AVP, which we can now do now that Grouped-AVPs
aren't constrained anymore.

>   Proxy-State = AA AB 08 09 77 44 DE AD

ok, perhaps this is a better approach. I agree that parsers would most
likely like this better than my proposed. Keep in mind, though, that AVPs
cannot have zero (or NULL) data, so *some* data will have to be added when
creating the dummy AVP if it was missing from a message.

PatC

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 24 May 2001 12:20:28 -0700

Mark,

PatC

---

From: Mark Eklund <[email-masked]>
Date: Thu, 24 May 2001 17:19:59 -0400 (EDT)

Pat,

> aren't constrained anymore.

Are we saying the same thing differently?

Using the version 4 AVP header, let us assume the offending AVP is
Vendor University of Tennessee (13) AVP 53 which is of type integer
and only allows values from 0-99.  The value sent was 255.  Having
a grouped AVP, the reply would be:

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           AVP Code  =  53                     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |          AVP Length = 24      |     Reserved = 0    |.|.|.|.|M|
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                           AVP Code  =  53                     |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |          AVP Length = 16      |     Reserved = 0    |.|.|V|.|M|
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                        Vendor-ID = 13                         |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |                             255				      |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

How would the implementation of octetstring be different?

> creating the dummy AVP if it was missing from a message.

Thanks :)  Also, if you use my explanation in the issue resolution, you 
probably should change

    If the failure reason is omission of a required AVP, an AVP with
    the missing command code, the missing vendor id, and a zero filled
    payload will be added.

to 

    If the failure reason is omission of a required AVP, an AVP with
    the missing AVP code, the missing vendor id, and a zero filled
    payload of the minimum required length for the ommitted AVP will be
    added.

-mark