Subject: [AAA-WG]: comments on base -03

From: Tony Johansson <[email-masked]>
Date: Mon, 07 May 2001 14:57:58 -0700

Hi Pat and all,

Here are some editorial stuff that I have found in the new base protocol
-03.

   * section 2.1 second paragraph:
     " A Diameter node MAY send packets from any source port, but MUST
     be
        prepared to receive packets on port TBD. When a request is
     received,
        the source and destination ports in the reply are reversed."

I think text reflects what was needed in the case of UDP. With SCTP and
TCP I think this statement is no longer valid.

   * section 6.2 third paragraph:
     "If a Diameter node receives a DRI message that results in an
     error, a
        Message-Reject-Ind message MUST be returned."

Shouldn't this be a DSI that MUST be returned. I guess this will be
changed anyway if we agree on discard the use of MRIs.

   * section 6.2:
     <Device-Reboot-Ind> ::= < Diameter Header: 257 >
                                   { Origin-FQDN }
                                   { Origin-Realm }
                                1* { Host-IP-Address }
                                   { Vendor-Id }
                                   { Product-Name }
                                 * { Supported-Vendor-Id }
                                 * [ Auth-Extension-Id ]
                                 * [ Acct-Extension-Id ]
                                   [ Destination-FQDN ]
                                   [ Firmware-Revision ]
                                 * [ AVP ]

I believe the Supported-Vendor-Id should be optional, i.e * [
Supported-Vendor-Id ] and the Auth-Extension-Id and the
Acct-Extension-Id should be mandatory, i.e *{ Acct-Extension-Id } and *
{ Auth-Extension-Id }.

   * section 9.1.1.2 or section 12.3 Redirect

I think we need some more text in either 9.1.1.2 or 12.3 that clarifies
what the redirect server MUST include in the redirect response. I'm
mean, should the redirect server include all AVPs from the request
message. This means that the server that receives the redirect could use
the received AVPs from the redirect message to create and resent the
request on the redirected path.

The other way would be that the redirect server doesn't send back all
the received AVPs. The server that receives the redirect would in this
case have to use his message queue to create and resent the request on
the redirected path.

I'm not really sure which one to favor. I guess you will have support
for the last one anyway in the case of failover, so it maybe unnecessary
to require that all AVPs MUST included in the redirect. Comments?

   * section 11.7 Max-Wait-Time AVP:

I assume the maximum amount of time is in msec. Right?

BR,

/Tony

---

From: Pat Calhoun <[email-masked]>
Date: Wed, 9 May 2001 14:07:43 -0700

> TCP I think this statement is no longer valid.

Partly. The new text will read:

"A Diameter node MAY initiate connections from any source port, but MUST be
prepared to receive connections on port TBD."

> changed anyway if we agree on discard the use of MRIs.

Correct, but no agreement was made on an approach. I proposed a somewhat
radical approach where a command req/answ would have only a single command
code, but the bits in the header would be used to specify whether it was a
request or answer.

I would like some feedback on this on. I think that this will also solve
some extensibility issues.

> Supported-Vendor-Id ] 

Correct.
> and the Auth-Extension-Id and the

I had a hard time with this one, and I am glad you caught this. If I make
the change you are proposing, a server will ALWAYS have to be both an auth
*and* an accounting server. The reason why they are split is to allow a
server to ONLY do one of the two. Making the AVPs mandatory will no longer
permit that :(

> to require that all AVPs MUST included in the redirect. Comments?

The message to be re-directed is in the message queue, and that is the
one that is re-directed.

I have added the last sentence to the second paragraph, which now reads:

"Successful routing table lookups will return one or more home Diameter
servers that could satisfy the message. The home servers are encoded in one
or more Redirect-Host AVPs, and the Command-Code field is set to
Device-Status-Ind. The Hop-by-Hop field in the Diameter header is set to
the value found in the message causing the redirect."

And added a new paragraph at the end of the section:

"The receiver of the DSI message with the DSI-Event AVP set to
DIAMETER_REDIRECT_INDICATION uses the hop-by-hop field in the Diameter
header to identify the message in the pending message queue (see 
Section 7.3) that is to be redirected."

> I assume the maximum amount of time is in msec. Right?

yes, and the text has been updated.

PatC

---

From: Tony Johansson <[email-masked]>
Date: Wed, 09 May 2001 15:42:55 -0700

> server to ONLY do one of the two. Making the AVPs mandatory will no longer

Uoops, I think I was to quick here. I do think it should be possible for a
server to be configured to do only one of them. So please keep them within [].

/Tony