Subject: [AAA-WG]: [Issue] DiameterIdentity (host descriptor) matching & values

From: Jacques Caron <[email-masked]>
Date: Thu, 14 Jun 2001 14:56:27 +0200

Submitter name: Jacques Caron
Submitter email address: [email-masked]
Date first submitted: 14-Jun-2001
Reference:
Document: Base
Comment type: T
Priority: 2
Section: throughout, but clarification to be added in 2.7
Rationale/Explanation of issue:

We need to clarify how two host descriptors are matched, e.g. in loop 
matching. Options are:
- exact lexical match (strcmp)
- expand (add defaults such as diameter://, :port, and ;transport=sctp), 
then exact lexical match (or match on protocol+name+port+transport)
- expand name to IP addresses, and match on protocol+IP+port+transport (if 
name resolves to multiple IP addresses, any match between the two 
expansions is a match)

First is possible only if any given process picks a unique identity at 
startup, sends it in Origin-Host AVPs in all messages (including CER/CEAs, 
which allows direct peers to learn that value), and uses that value in 
Record-Route AVPs, and if other hosts use that value only for other 
DiameterIdentity-based AVPs (such as Destination-Host).

Note that this works since server always put their identity themselves in 
those AVPs. It would also work if a server can put a DiameterIdentity 
received in CER/CEA in an AVP. It cannot work when the DiameterIdentity 
comes from another source (e.g. from a configuration file listing peers).

At the moment, I don't think there is any problem with that one. It might 
become a problem if we wanted to perform loop matching upon receipt of a 
Redirect-Host, rather than forward blindly and expect the next host to do 
the check.

Requested changes:

At the end of section 2.7, add:
    The port and protocol listed above are those that a node uses to
    listen for incoming connections.

    When a process listens on multiple different addresses or ports or 
using different
    protocols, it should select a single combination of those, and always
    use the same value as its identity for the lifetime of all
    connections to peers. This value should be sent in Origin-Host in
    CER/CEA and other messages, used in Route-Record AVPs, and any other
    AVPs containing DiameterIdentity.

    For the purposes of loop checking and other comparison purposes, two
    DiameterIdentity values match if they are lexically identical (i.e.
    the two strings are the same).

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: Erik Guttman <[email-masked]>
Date: Mon, 18 Jun 2001 09:54:40 +0200 (MET DST)

> then exact lexical match (or match on protocol+name+port+transport)

Host names are case insensitive.

> name resolves to multiple IP addresses, any match between the two 

The (set of) addresses that a name resolves to may not be the same each
time - if some load balancing tricks are done.  Why not match on the name?

>     the two strings are the same).

believe that case insensitive comparison should be done for elements in
the DiameterIdentity to determine equality.

Erik