Subject: RE: [Q] COPS Error Obj Location

From: "Durham, David" <[email-masked]>
Date: Thu, 2 Aug 2001 10:51:21 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> 
> Hi.
> 
> According to RFC 2748, two possible locations that COPS Error Obj can 
> be located are COPS CC message and DEC message.
> 
> So, I think that two different error-handling actions are 
> possible when 
> PDP processes REQ message. 
> 
> But I know know in what situation the DEC with Error Obj 
> should be used,
> and in what situation the CC with Error Obj should be used 
> during the REQ
> processing.

[Dave] The only situation specified in the RFC to use the CC + Error during
REQ processing is when there is an authentication failure (bad or missing
integrity, when integrity is enabled)... And that should be your first
processing step. *Really* malformed REQ messages (ie. even the COPS header
is garbled) may also logically result in a CC + Error if they are so
malformed the TCP stream becomes completely un-interpretable. But so will
any COPS message with a bad COPS header, an implementation simply has no
other recourse in this case. 

> 
> Is there any guideline or this is implementation-specific problem?

[Dave] In both cases above, the error should be caught even before REQ
processing begins, so it is safe to assume that all other errors specific
to the REQ processing step will result in a DEC + Error.
> 
> Thank you in advance.
> 
> - - - 
> Byung-Joon Lee, 
> Network Architecture Team of ETRI
> [email-masked] +82 42 860 1728
> http://oopsla.snu.ac.kr/~bjlee
> 
> 
> 
>

---

From: 이병준 <[email-masked]>
Date: Mon, 6 Aug 2001 11:42:56 +0900

Thank you for your kind reply.

But I think there is one more case that the CC+Error should
be replied during the COPS REQ message processing.

When Client Handle is Missing in REQ, (Client Handle is not part
of the COPS header), there is no way to include that obj
in the DEC message. So, I Think that DEC+Error can only
be sent after the existence checkup of the Client Handle obj
in the REQ message.

I think that This case is not the 'bad cops header' situation, and
not the 'incorrect security information' situation.

I'm not sure that I'm saying it again that you have already
pointed out, but only wanted to make sure.

Regards,