Subject: RE: [AAA-WG]: [Issue] Routing of session messages defined in base

From: <[email-masked]>
Date: Wed, 27 Feb 2002 08:48:59 +0200

Hi all,

Please give exact text for this issue to be added / modified to the
base spec.

John

> -----Original Message-----
> From: ext David Spence [mailto:[email-masked]]
> Sent: 27 February, 2002 00:25
> To: Johan Johansson
> Cc: Bob Kopacz; aaa-wg
> Subject: Re: [AAA-WG]: [Issue] Routing of session messages defined in
> base
> 
> 
> I think I agree that Auth-Application-Id should be present in 
> these messages
> assuming it is known.  It could help in the routing.
> 
> One reason that these messages may not have included the 
> Auth-Application-Id
> AVP is that it was thought that this AVP would most likely be 
> used at the
> last hop, and the messages under discussion here would 
> usually contain a
> Destination-Host AVP to be used at the last hop instead.  However, the
> presence of the Destination-Host AVP does not help in Johan's 
> scenario:
> 
> >     S----------------X------------X------------N
> >     |
> >     +------------X------------M
> 
> This scenario might describe a roaming broker (running the 
> Xs) who deploys
> separate proxy agents for different applications.
> 
> Johan Johansson wrote:
> > 
> > Yes, the issue has been cloned. Sorry about that. I even 
> looked at the
> > issues list first but I guess I wasn't paying attention 
> closely enough.
> > Nice to see that we are suggesting the same resolution at least.
> > 
> > j
> > 
> > Bob Kopacz wrote:
> > 
> > >Hi Johan,
> > >
> > >I think your issue is very similar to an existing one:
> > >
> > >>-----Original Message-----
> > >>
> > >From: Bob Kopacz [[email-masked]]
> > >Sent: Friday, January 25, 2002 2:49 PM
> > >To: aaa-wg
> > >Subject: [AAA-WG]: [issue] Proxiable messages MUST contain 
> Axxx-Application-Id
> > >AVP
> > >
> > >Issue : Proxiable messages MUST contain Axxx-Application-Id AVP
> > >Submitter name:          Bob Kopacz
> > >Submitter email address: [email-masked]
> > >Date first submitted:    01-25-2002
> > >Reference:
> > >Document:                Base
> > >Comment type:            Technical
> > >Priority:                1
> > >Section:
> > >
> > >  [I know last-call is over, but pending issues haven't 
> been resolved
> > >  yet, and I think this is a bug].
> > >
> > >Rationale/Explanation of issue:
> > >
> > >  Accounting messages and application-specific messages have an
> > >  Axxx-Application-Id AVP which identifies the application (e.g.
> > >  Mobile IP).
> > >
> > >  The Auth-Application-Id AVP is currently prohibited from 
> being present
> > >  in the Session-Terminate-Request, Abort-Session-Request, and
> > >  Re-Auth-Request messages.
> > >
> > >  This creates a routing problem for intermediate proxy or 
> relay servers
> > >  when receiving an STR/ASR/RAR.  The intermediate server's routing
> > >  table may indicate that, say, Mobile-IP messages route 
> to a different
> > >  next hop than NASREQ messages.  An STR message, however, 
> contains no
> > >  application-id AVP indicating NASREQ-v-MobileIp, so the 
> intermediate
> > >  server doesn't know how to route it.
> > >
> > >
> > >Requested change:
> > >
> > >  1. Require an Auth-Application-Id AVP in 
> Session-Terminate-Request,
> > >  Abort-Session-Request, and Re-Auth-Request messages.
> > >
> > >  2. Update occurrence rule tables for the 
> "Auth-Application-Id AVP"
> > >  row, from "0" to "1", for STR and ASR and RAR.
> > >
>

---

From: David Spence <[email-masked]>
Date: Wed, 27 Feb 2002 14:42:41 -0500

[email-masked] wrote:
>...

The Requested change section of Bob Kopacz' issue: 

   Proxiable messages MUST contain Axxx-Application-Id AVP

reads as follows:

   Requested change: 

     1. Require an Auth-Application-Id AVP in Session-Terminate-Request,
     Abort-Session-Request, and Re-Auth-Request messages.  

     2. Update occurrence rule tables for the "Auth-Application-Id AVP"
     row, from "0" to "1", for STR and ASR and RAR.

For item 1, the STR syntax currently reads:

      <STR> ::= < Diameter Header: 275, REQ, PXY >
                < Session-Id >
                { Origin-Host }
                { Origin-Realm }
                { Destination-Realm }
                { Termination-Cause }
                [ User-Name ]
                [ Destination-Host ]
              * [ Class ]
                [ Origin-State-Id ]
              * [ AVP ]
              * [ Proxy-Info ]
              * [ Route-Record ]

You need to add "{ Auth-Application-Id }":

      <STR> ::= < Diameter Header: 275, REQ, PXY >
                < Session-Id >
                { Origin-Host }
                { Origin-Realm }
                { Destination-Realm }
                { Auth-Application-Id }
                { Termination-Cause }
                [ User-Name ]
                [ Destination-Host ]
              * [ Class ]
                [ Origin-State-Id ]
              * [ AVP ]
              * [ Proxy-Info ]
              * [ Route-Record ]

Do the same for ASR and RAR.

For item 2, the table in base-08 section 10.1 currently begins:

                       +-----------------------------------------------+
                       |                  Command-Code                 |
                       |---+---+---+---+---+---+---+---+---+---+---+---+
   Attribute Name      |CER|CEA|DPR|DPA|DWR|DWA|RAR|RAA|ASR|ASA|STR|STA|
   --------------------|---+---+---+---+---+---+---+---+---+---+---+---|
   Acct-Application-Id |0+ |0+ |0  |0  |0  |0  |0  |0  |0  |0  |0  |0  |
   Auth-Application-Id |0+ |0+ |0  |0  |0  |0  |0  |0  |0  |0  |0  |0  |

Change it to:

                       +-----------------------------------------------+
                       |                  Command-Code                 |
                       |---+---+---+---+---+---+---+---+---+---+---+---+
   Attribute Name      |CER|CEA|DPR|DPA|DWR|DWA|RAR|RAA|ASR|ASA|STR|STA|
   --------------------|---+---+---+---+---+---+---+---+---+---+---+---|
   Acct-Application-Id |0+ |0+ |0  |0  |0  |0  |0  |0  |0  |0  |0  |0  |
   Auth-Application-Id |0+ |0+ |0  |0  |0  |0  |1  |0  |1  |0  |1  |0  |

Additionally, Bob Kopacz recommends adding text to sections 6.1 and 6.1.1.

The first sentence of the fourth paragraph of sec. 6.1 reads:

   The Destination-Realm AVP MUST be present if the message is routable.

Replace with:

   The Destination-Realm AVP MUST be present if the message is 
   proxiable.  Proxiable request messages MUST also contain either an 
   Acct-Application-Id AVP or an Auth-Application-Id AVP.
   
Note that the term proxiable is defined in the draft.  The term routable 
is not.  So I changed routable to proxiable.  Also note that the draft 
is inconsistent with respect to the spelling of proxiable, sometimes 
spelling it proxyable.  It should be spelled consistently.

Section 6.1.1 currently reads:

   When creating a request, in addition to any other procedures
   described in the application definition for that specific request,
   the following procedures MUST be followed:

      - the Command-Code should be set to the appropriate value
      - the 'R' bit should be set
      - the End-to-End Identifier should be set to a locally unique
        value
      - the Origin-Host and Origin-Realm AVPs MUST be set to the
        appropriate values, used to identify the source of the message
      - the Destination-Host and Destination-Realm AVPs MUST be set to
        the appropriate values as described in section 6.1.

Add an additional bullet:

      - either an Acct-Application-Id AVP or an Auth-Application-Id 
        AVP must be included if the request is proxiable.