Subject: RE: [AAA-WG]: [issue] AAA URI is Overloaded

From: Jacques Caron <[email-masked]>
Date: Wed, 27 Feb 2002 16:14:30 +0100

Hi John,

I think the separation is good (though it must probably be clarified where 
each one is used), but I think the definition of the DiameterIdentity is 
not clear enough.

The two important points are that:
- it must be unique for any diameter process
- it must be constant for any diameter process
These two points must be stated very clearly.

This implies:
- the format itself is not necessarily relevant, what is important is that 
its format makes it unique
- I don't think we need the aaa:// prefix at all (this would only introduce 
confusion with DiameterURIs)
- I'm not sure FQDNs are unique enough (one FQDN can point to multiple IPs 
and vice versa), but it should work as long as the value picked is unique 
for a given server, and kept constant for that server
- same remark for port numbers: if the process listens on multiple ports, 
it can use the value for any one of those ports, as long as it keeps that 
value as long as the server is running.
- port numbers are not unique enough, the protocol (TCP or SCTP) should be 
added (even though I doubt anyone would be running two servers, one using 
TCP and the other SCTP, both listening on the same IP and port, this could 
happen)

One other point is that DiameterIdentity values are used quite a lot in all 
exchanges (for loop detection, routing, etc.) and hence the shorter it is, 
the better. Which is why I proposed using a binary format including 
protocol, port and IP address (8 bytes in the best case, 36 in the worst 
case), which has less ambiguity and is a lot shorter, but that's really open.

One issue I don't remember if it was solved, though, is that diameter 
servers might be subject to DoS attacks: A could connect to B pretending to 
be C. C would then be unable to connect to B (which would think it's 
already connected), and B would send messages for C to A. I guess some 
certificate checking might be needed, in which case the DiameterIdentity 
format used would need to be able to be matched to that certificate (and 
no, I don't know where the certificate would come from -- I guess it should 
be easy with TLS, but over IPsec I think a mechanism to present a 
certificate and prove that a server has the associated secret key would 
need to be included in the CER/CEA packets).

Is there a "recent" version of the draft available somewhere? I haven't 
followed all the changes over the recent months... It might be a good idea 
to make it available via cvs :-)

Jacques.

At 15:28 27/02/2002, [email-masked] wrote:
>Hi Jacques,
>
>Can you comment on what I have proposed?  Is my seperation OK?
>
>John
>
> > -----Original Message-----
> > From: ext Jacques Caron [mailto:[email-masked]]
> > Sent: 27 February, 2002 15:59
> > To: Loughney John (NRC/Helsinki)
> > Cc: [email-masked]; [email-masked]
> > Subject: RE: [AAA-WG]: [issue] AAA URI is Overloaded
> >
> >
> > Hi John,
> >
> > Indeed, the URI (used in config files and in redirects to
> > find another
> > diameter server, possibly via DNS NAPTR, SRV etc.) and the
> > Identity (used
> > to uniquely identify a host for loop and duplicate connection
> > detection)
> > are two entirely different things.
> >
> > You may want to look at the issue I filed a long time ago,
> > which proposes
> > the separation of the two, with a proposed DiameterIdentity format:
> >
> > http://www.merit.edu/mail.archives/aaa-wg/2001-08/msg00033.html
> >
> > Of course, some of the text changes are not in sync with the
> > current text
> > anymore :-(
> >
> > Jacques.
> >
> > At 12:36 27/02/2002, [email-masked] wrote:
> > >David,
> > >
> > > > So as you deal with your changes regarding how server
> > discovery works,
> > > > keep in mind the AVPs of type DiameterIndentity which are
> > used for message
> > > > routing and make sure their requirements are met, to wit:
> > > >
> > > > 1) A value of type DiameterIdentity must uniquely identify a
> > > >    "Diameter node", which is an instance of a Diameter
> > process running
> > > >    on an IP host.
> > > >
> > > > 2) There may be more than one "Diameter node" running on
> > the same host
> > > >    and sharing the same IP address.
> > > >
> > > > 3) It must be possible to express a value of type
> > DiameterIdentity in a
> > > >    canonical form so that each "Diameter node" will only
> > have a single
> > > >    identifier in a domain.  Thus the type must not
> > contain any parameters
> > > >    that are specific to a particular peer-to-peer connection.
> > >
> > >Thinking deeply about this, I have come to the conclusing
> > that the Diameter
> > >URI, DNS discovery and DiameterIdentity are not the same
> > thing.  Therefore,
> > >while these are related, we may need to seperate these
> > within the draft.
> > >
> > >Please comment on the text that I have sent to the list.
> > >
> > >John
> >
> >
> >
> > _________________________________________________________
> >
> > Do You Yahoo!?
> >
> > Get your free @yahoo.com address at http://mail.yahoo.com
> >
> >
> >
> >

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: David Spence <[email-masked]>
Date: Wed, 27 Feb 2002 11:01:11 -0500

Yes!  I completely agree with everything you say here.