Subject: [AAA-WG]: Re: Route-Record AVP in Indication message

From: Patrice Calhoun <[email-masked]>
Date: Wed, 11 Apr 2001 08:59:10 -0700

>In base protocol 12.4.1
>  "A Diameter server that proxies a message or type Request, Query or
>   Indication MUST append a Route-Record AVP, which includes its
>   identity.  Diameter Servers that receive messages MUST validate the
>   last Route-Record AVP in the message and ensure that the host
>   identified in the AVP is the same as the sender of the message."
>
>My suggestin to add text, something like this:
>The FIRST creater(AAA3 in my example) of an Indication Message MUST remove all
>the Route-Rrecord AVPs before return to the sender of the request to avoid LOOP
>DETECTION.
>If it's correct, the Indication might not send the same route back as the
>request
>message.
>Well, if it's very obvious, just ignore this email.
>
>Here is an example
>
> AAA1(a.com) AAA2(b.com)  AAA3(c.com)   AAA4(d.com)
>----------  -----------  -----------   ------------
>
>     ----------->
>     route-record=aaa1.a.com
>
>                 ------------->
>                 route-record=aaa1.a.com
>                 route-record=aaa2.b.com
>
>                               -----link broken---
>
>                 <-------------
>                 route-record=aaa3.c.com
>     <-------------
>     route-record=aaa3.c.com
>     route-record=aaa2.b.com

Michael,

At first, I thought this was covered in the following text in section 12.4.2:

   A proxy server MUST only process messges of type Response or Answer
   whose last Route-Record AVP matches one of its addresses. Any
   responses that do not conform to this rule MUST be dropped. The last
   Route-Record AVP MUST be removed from the message before it is
   forwarded to the next hop, which is identified by the second to last
   Route-Record AVP.

and then realized this only applied to responses, and not indication messages.

However, since the DSI message you mention here is *not* a response to the
request that generated the message, it MUST NOT include the route-record AVPs
that were present in the request.

This just seems logical, but if you believe that some clarifying text is
required, then please let me know.

PatC

---

From: Michael Chen <[email-masked]>
Date: Wed, 11 Apr 2001 10:34:22 -0700

> that were present in the request.

OK. The DSI message is NOT a response to the request.    That's say the
AAA3 use Destination-Realm to route the DSI message and send the
DSI "directly" to AAA1 instead of AAA2.   Here is the problem.  AAA2
would NEVER receive any RESPONSE after send out the request.