Subject: Re: [Dime] wrong diameter Identity in CEA

From: jouni korhonen <[email-masked]>
Date: Thu, 1 Mar 2012 17:15:45 +0200

Hi,

I don't quite understand what you mean by "wrong identity". Receiving
a CER or CEA from a "wrong" peer is different from what RFC3588 says
"unknown" peer, at least to me.

Section 5.3 says:

   CERs received from unknown peers MAY be silently discarded, or a CEA
   MAY be issued with the Result-Code AVP set to DIAMETER_UNKNOWN_PEER.
   In both cases, the transport connection is closed.  If the local
   ^^^^^^^^^^^^^^

Which is pretty clear to me.

- Jouni

On Mar 1, 2012, at 8:26 AM, Krishna Prasad wrote:

> Hi All,
>     The base RFC (and also the bis) says that if a CER is received from an unexpected peer (wrong diameter identity in Orig host AVP) CEA will be sent with unknown peer error.
> But if the diameter Identity in CEA is wrong (i.e. the initiator is expecting some other identity in CEA) what is the expected behavior; does the node silently close the connection or this is not at all an error? I think RFC is silent on this.
>  
> Regards
> Prasad.
> _______________________________________________
> DiME mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dime

---

From: Krishna Prasad <[email-masked]>
Date: Fri, 2 Mar 2012 03:59:28 +0000

When we say the 'unknown peer', the receiver of CER will identify the peer is known or unknown by checking or validating the Orig host AVP value in CER (this is my understanding). Similarly when CEA is received does the receiver of CEA need not verify if the Orig host AVP value is as expected or not?  

-----Original Message-----
From: jouni korhonen [mailto:[email-masked]] 
Sent: Thursday, March 01, 2012 8:46 PM
To: Krishna Prasad
Cc: [email-masked]
Subject: Re: [Dime] wrong diameter Identity in CEA

Hi,

Section 5.3 says:

- Jouni

---

From: Glen Zorn <[email-masked]>
Date: Fri, 02 Mar 2012 11:44:52 +0700

>    In both cases, the transport connection is closed.  If the local

It's quite clear, but it also doesn't have anything to do w/the question
which I believe had to do with the handling of a CEA containing a
Diameter identity that was incorrect (possibly due to a masquerade
attack).

---

From: Krishna Prasad <[email-masked]>
Date: Fri, 2 Mar 2012 05:22:38 +0000

-----Original Message-----
From: Glen Zorn [mailto:[email-masked]] 
Sent: Friday, March 02, 2012 10:15 AM
To: jouni korhonen
Cc: Krishna Prasad; [email-masked]
Subject: Re: [Dime] wrong diameter Identity in CEA

Yes, Glen has summarized my question in a more clear way, the incorrect Diameter identity in CEA may be due to wrong configurations also.

---

From: Jouni <[email-masked]>
Date: Fri, 2 Mar 2012 16:21:33 +0200

Right, thanks for clarification.. I agree the RFC is silent of this but do
you have other choices than dropping the connection if the peer you talk
to is not who you think it should be? Either silently or preferably using
Disconnect.

- Jouni

---

From: Krishna Prasad <[email-masked]>
Date: Mon, 5 Mar 2012 10:39:52 +0000

-----Original Message-----
From: Jouni [mailto:[email-masked]] 
Sent: Friday, March 02, 2012 7:52 PM
To: Krishna Prasad
Cc: Glen Zorn; [email-masked]
Subject: Re: [Dime] wrong diameter Identity in CEA

- Jouni

Probably sending DPR with proper disconnect-cause (nearest will be DO_NOT_WANT_TO_TALK_TO_YOU) can be a good idea.
Not sure what others think.