Subject: Capabilities Negotiation and proxies

From: Pat Calhoun <[email-masked]>
Date: Wed, 10 Jan 2001 16:56:08 -0800 (PST)

All,

As discussed a few days ago, a proxy MAY wish to proxy ANY type of message,
regardless of the extension. Therefore, the current text in the base protocol
does not allow this behavior since it would require that proxies advertise ALL
possible extensions.

Therefore, I am proposing adding the last paragraph to section 2.5.3.
Furthermore, I believe that ALL messages MUST include the extension ID of the
particular message. The reason being that a proxy would need to identify a
server in the home domain that can handle the message, but it may not recognize
the command.

Comments? Objections? Proposed Text?

PatC

2.5.3  Extension-Id AVP

   The Extension-Id AVP (AVP Code 258) is of type Unsigned32 and is used
   in order to identify a specific DIAMETER extension. This AVP is used
   in the Device-Reboot-Ind message in order to inform the peer what
   extensions are locally supported. The Extension-Id MUST also be present
   in all messages that are defined in a separate DIAMETER specification
   and have an Extension ID assigned.

   Each DIAMETER extension draft MUST have an IANA assigned extension
   Idenfier (see section 8.3). The base protocol does not require an
   Extension-Id since its support is mandatory.

   There MAY be more than one Extension-Id AVP within a DIAMETER
   Device-Reboot-Ind message. The following values are recognized:

      NASREQ              1 [7]
      Strong Security     2 [11]
      Resource Management 3 [29]
      Mobile-IP           4 [10]
      Accounting          5 [15]

      Furthermore, servers acting as Redirect or Proxy servers (see
      Section 6.0) MAY wish to advertise support for ALL possible
      extensions. Such servers are then responsible for finding a
      downstream server that supports the extension of a particular
      message. This is done by including the Extension-Id AVP with a
      value of zero (0).

---

From: David Spence <[email-masked]>
Date: Thu, 11 Jan 2001 14:59:43 -0500

Suppose an AAA server acts as home server for some realms and proxy for
others.  Then what does it advertise?  (Assume that as home server it does
not support all extensions, but as a routing proxy it is willing to proxy
all extensions.)

-- 
David Spence                            email: [email-masked]
Interlink Networks, Inc.                phone: (734) 821-1203
775 Technology Drive, Suite 200         fax:   (734) 821-1235
Ann Arbor, MI 48108           
U.S.A.

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 11 Jan 2001 12:38:14 -0800 (PST)

Then it would return the error code stating that the extension was not
supported. Furthermore, I sent some text early this week (or was it last
week), that would solve this problem, but it was a major change. It would
require that all home servers advertise their local domains. The proxy could
then use this information to figure out whether the next hop is a proxy, or a
home server for a given domain.

btw, I am NOT attempting to create a routing protocol for NAIs. This is a
one-hop only thing.

Still not really sure that I like this approach either, but I am willing to
listen to suggestions.

PatC

---

From: Barney Wolff <[email-masked]>
Date: Thu, 11 Jan 2001 16:40:05 -0500

Tell us why a requester should know or care whether its "server"
is actually a home server or another proxy.  IMHO, that would
be a really bad thing.

We're running into the downside of session-oriented AAA, when
the underlying situation is independent transactions.  I suggest
we simply ignore it - the AAA requester should be configured for
the server it talks to "most of the time" and just recover in
real time from what should be very rare cases, that a Mandatory
AVP, or even a whole extension, is not understood by some
roamer's home server.

Barney

---

From: "Fredrik Johansson" <[email-masked]>
Date: Fri, 12 Jan 2001 10:24:46 +0100

Hi Pat,

If there MUST be an Extension-Id AVP in all messages defined in other
DIAMETER specifications, the the section below:

"There MAY be more than one Extension-Id AVP within a DIAMETER
   Device-Reboot-Ind message. The following values are recognized:"

should be changed to:

"There MAY be more than one Extension-Id AVP within a DIAMETER message. The
following values are recognized:"

Since one can for example use Strong Security together with another
extension in the same message.

B.R.
/Fredrik

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]]On Behalf
>Of Pat Calhoun
>Sent: den 11 januari 2001 01:56
>To: [email-masked]; [email-masked]
>Subject: Capabilities Negotiation and proxies
>
>
>All,
>

---

From: Pat Calhoun <[email-masked]>
Date: Fri, 12 Jan 2001 05:51:05 -0800 (PST)

Agreed, but I am still waiting for some level of affirmation from the list
that including the Extension Id would benefit proxies that only support
forwarding and/or redirecting of messages, and extensions are supported on the
home servers.

Anyone??

PatC