Subject: [AAA-WG]: [Issue] DiameterIdentity

From: Jacques Caron <[email-masked]>
Date: Mon, 06 Aug 2001 02:27:10 +0200

Submitter name:		Jacques Caron
Submitter email address:	[email-masked]
Date first submitted:		August 5, 2001
Reference:
Document:			Base-07
Comment type:			T
Priority:			1
Section:			throughout
Rationale/Explanation of issue:

There apparently is a lot of confusion surrounding DiameterIdentity, due to 
its two very different uses:
1. as a way to designate some way to access a Diameter agent, by (implicity 
or explicitly) specifying a FQDN, port, protocol and transport. This shall 
be used in configuration files, Alternate-Host and Redirect-Host AVPs, etc. 
Note that there might be *a lot* of different DiameterIdentity values that 
actually designate the same Diameter agent (as an agent might listen on 
multiple ports and addresses, using multiple protocols, and there might be 
many FQDNs pointing to any of those addresses).

2. as a way to uniquely identify a given agent for the purposes of 
duplicate connection detection, loop detection, etc. In this case, the 
identifier must be unique, and should be considered completely opaque by 
other servers that should do a pure binary comparison.

To alleviate this confusion, I propose to separate the current 
DiameterIdentity derived AVP format into two different formats:

1. the DiameterURI format, using the existing syntax. Used in config files, 
Alternate-Host and Redirect-Host AVPs...

2. the DiameterIdentity format, using a new syntax, the only purpose of 
which is to make sure it is unique (and as a side effect, a lot shorter, 
which should help a lot in Route-Record and Source-Route AVPs).

Proposed changes:

In 2.6, replace the Host identity section with:
       - Host URI, following the conventions described for the
	DiameterURI derived AVP data format in section 4.4. This MAY be
	found by static configuration, or dynamically updated via any of
	the methods described in section 5.2. Note that there might be
	multiple DiameterURIs resolving to the same peer.
       - Host Identity. Following the conventions described for the
         DiameterIdentity derived AVP data format in section 4.4. This
         is copied from the Origin-Host AVP of the CER or CEA message
	received from the peer.

In 4.4, replace the DiameterIdentity section with:

       DiameterURI
          The DiameterURI format is derived from the OctetString AVP
          Base Format.  It uses the UTF-8 encoding and has the same
          requirements as the UTF8String.  In addition, it must follow
          the Uniform Resource Identifiers (URI) syntax [29] rules
          specified below:

             Diameter-URI       = fqdn [ port ] [ transport ]
                                  [ protocol ]

             aaa-protocol       = ( "diameter" | "radius" | "tacacs+" )

             protocol           = ";protocol=" aaa-protocol
                                  ; If absent, the default AAA protocol
                                  ; is diameter.

             fqdn               = Fully Qualified Host Name

             port               = ":" 1*DIGIT
                                  ; One of the ports used to listen for
                                  ; incoming connections. ; If absent,
                                  ; the default Diameter port (TBD) is
                                  ; assumed.

             transport-protocol = ( "tcp" | "sctp" | "udp" )

             transport          = ";transport=" transport-protocol

                                  ; One of the transports used to listen
                                  ; for incoming connections. If absent,
                                  ; the default SCTP [26] protocol is
                                  ; assumed. UDP MUST NOT be used when
                                  ; the aaa-protocol field is set to
                                  ; diameter.

             The following are examples of valid Diameter host
             identities:

                host.abc.com;transport=tcp
                host.abc.com:6666;transport=tcp
                aaa://host.abc.com;protocol=diameter
                aaa://host.abc.com:6666;protocol=diameter
                aaa://host.abc.com:6666;transport=tcp;protocol=diameter
                aaa://host.abc.com:1813;transport=udp;protocol=radius

	 A DiameterURI describes a way to connect to any Diameter agent.
	 It shall be used in configuration files, Alternate-Host and
	 Redirect-Host AVPs, etc.

       DiameterIdentity
	 The DiameterIdentity format is derived from the OctetString AVP
	 Base Format.  It uniquely identifies a Diameter agent, for the
	 purposes of loop and duplication connection detection.  Upon
	 startup, the agent must select one specific (address,
	 transport, port) tuple it is listening on for new connections,
	 and encode the associated information in one of the formats
	 described below. Since only one single process can be listening
	 on a given (address, transport, port) tuple, the identity is
	 guaranteed to be unique (see below for non-unique addresses).
	
        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Reserved(0) |    Protocol   |           Port                |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                           IPv4 Address                        |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 This format is used for agents listening on IPv4 addresses
	 only.  Protocol is the protocol number of the transport used,
	 i.e. XXX for TCP or XXX for SCTP. The 'Port' and 'IPv4 Address'
	 fields contain the port and IPv4 address selected,
	 respectively, in network byte order.

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |   Reserved(0) |    Protocol   |           Port                |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |                           IPv6 Address                        |
       +                                                               +
       |                                                               |
       +                                                               +
       |                                                               |
       +                                                               +
       |                                                               |
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

	 This format is used for agents listening on at least one unique
	 (i.e.  not link-local, etc.) IPv6 address. If the agent is
	 listening on both IPv4 and IPv6 addresses, it should select a
	 tuple with an IPv6 address. 'IPv6 address' contains that value.
	 The other fields have the same meaning as above.

	 Note that these formats are guaranteed to be unique only for
	 hosts that have unique IP addresses, i.e. not for hosts that
	 use RFC1918 "private" IP addresses. Hosts using RFC1918
	 addresses MUST append a unique IP addresses (administratively
	 configurable) that is related to the routing domain they're
	 part of, such as the public IP address of the host acting as a
	 gateway to the public Internet.

	 A DiameterIdentity value is thus either 8, 20, 24, or 36 bytes
	 long, depending on the presence of one or two addresses, each
	 of which can be 4 bytes (IPv4) or 16 bytes (IPv6) long.

	 Other formats can be used, as long as the binary
	 reprensentation is globally unique for any given host. This
	 requires the use of values other than 0 for the "reserved"
	 field, which should then be registered with IANA.

	 Any use of AVPs using the DiameterIdentity format MUST consider
	 their contents as opaque. Any comparison MUST be purely binary
	 (i.e. two values are equal if they have the same length and all
	 bytes match; in all other cases they're not equal). An ordered
	 comparison is also defined in section 5.6.4.
			
In 5.3.8, s/Identity/URI/

In 6.4, remove 3rd paragraph.

Replace 6.8.1 with:
    The Route-Record AVP (AVP Code 282) is of type DiameterIdentity.  The
    identity added in this AVP MUST be the same as the one received in the
    Origin-Host of the CER or CEA message received from the peer.

In 6.12, s/Identity/URI/

In 8.8, either:
- s/Identity/URI/ + some wording to say it's one of the URIs designated the 
host,
- or use decimal-encoded Identity
- or move to purely binary

Some other changes might be needed in the other drafts.

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com