Subject: [Dime] Auth-Session-State (WGLC comments of draft-ietf-dime-nat-control-03)

From: "Frank Brockners (fbrockne)" <[email-masked]>
Date: Mon, 6 Sep 2010 15:03:17 +0200

Hi Jouni,

Thanks for your detailed review of draft-ietf-dime-nat-control-03. 

Wrt/ your comment on the use of " Auth-Session-State AVP", I agree that
the use of this AVP is redundant and not really useful, because I'll
have the default value in all cases, given that in DNCA both manager and
agent are stateful. In order to avoid confusion, I'd follow your
implicit suggestion to remove the AVP - and - more importantly add
additional details on how state is maintained.

Simply referring back to RFC 3588 for a description of state machines
unfortunately does not work here. Per our earlier discussions in the
working group, the nomenclature of "server" and "client" does not really
apply to the DNCA use case, hence the use of "manager" and "agent" for
the two involved Diameter entities. 

My suggestion would be that we add another section which show state
machines at agent and manager in detail (obviously reusing the format in
RFC 3588). Would that be an agreeable way forward?

Thanks & regards, Frank

> Ticket #9: http://trac.tools.ietf.org/wg/dime/trac/ticket/9
>
> During the WGLC review of draft-ietf-dime-nat-control-03 I started to
> think about the Auth-Session-State AVP and the associated semantics.
> The draft should state, even if it seems obvious, whether the state is
> maintained or not. And whether it applies to all possible messages
> exchanges. Can Auth-Session-State be on NCA or in NCR during
> QUERY_REQUEST?
> 
> How well the DNCA "view" of the session state goes along with RFC3588
> authz session state machine?

---

From: jouni korhonen <[email-masked]>
Date: Mon, 20 Sep 2010 17:54:35 +0300

Hi Frank,

Sorry for the delay (actually the email filter put the mail into wrong folder using some unknown logic).

> additional details on how state is maintained.

Ok good.

> RFC 3588). Would that be an agreeable way forward?

That would be good. Please, propose some text and if that is a separate section we could check it before shipping a new revision of the document.

- Jouni

---

From: "Shwetha Bhandari (shwethab)" <[email-masked]>
Date: Tue, 28 Sep 2010 12:51:22 +0530

Hi Jouni,

We are planning to modify draft-ietf-dime-nat-control as per our last
email discussion, appreciate if you could review and provide you
comments on the text being proposed.  

Following is the new section to be added to define State machine for
DNCA manager and agent:

7.  NAT Control Application Session State Machine

   This section contains a set of finite state machines, representing
   the life cycle of DNCA session, which MUST be observed by all
   implementations of the DNCA Diameter application.  DNCA Agent and
   Manager are stateful and the state machine maintained is similar to
   the stateful Client and Server authorization state machine described
   in RFC3588.  When a session is moved to the Idle state, any resources
   that were allocated for the particular session must be released.  Any
   event not listed in the state machines MUST be considered as an error
   condition, and an answer, if applicable, MUST be returned to the
   originator of the message.

   In the state table, the event 'Failure to send NCR' means that the
   DNCA Manager is unable to send command NCR to the desired
   destination.  This could be due to the peer being down, or due to the
   peer sending back a transient failure or temporary protocol error
   notification DIAMETER_TOO_BUSY or DIAMETER_LOOP_DETECTED in the
   Result-Code AVP of NCA.

   In the state table "FAILED NCA" means that the DNCA Agent was not
   able to honor corresponding NCR.  This can happen due to any of the
   transient and permanent error at DNCA Agent indicated by the
   following error Result-Code values - RESOURCE_FAILURE,
   UNKNOWN_BINDING_RULE_NAME, BINDING_FAILURE,
   MAXIMUM_BINDINGS_REACHED_FOR_ENDPOINT, SESSION_EXISTS,
   INSUFFICIENT_CLASSIFIERS

   The following state machine is observed by a DNCA Manager:
                              MANAGER
      State     Event                          Action     New State
      -------------------------------------------------------------
      Idle      New Host detected that         Send       Pending
                requires NAT Control           NCR
                                               Initial
                                               Request

      Idle      ASR Received                   Send ASA   Idle
                for unknown session            with
                                               Result-Code
                                               = UNKNOWN_
                                               SESSION_ID

      Pending   Successful NCA                 Setup      Open
                received                       complete

      Pending   Successful NCA                 Sent STR   Discon
                received
                but Agent unable to provide
                service

      Pending   Error processing successful    Sent STR   Discon
                NCA

      Pending   Failed                         Cleanup    Idle
                NCA received

      Open      NAT control                    Send       Open
                update required                NCR Update
                                               Request

      Open      Successful                                Open
                NCA received

      Open      Failed                         Cleanup    Idle
                NCA received.

      Open      Access Session end detected    Send STR   Discon

      Open      ASR Received,                  Send ASA   Discon
                client will comply with        with
                request to end the session     Result-Code
                                               = SUCCESS,
                                               Send STR.

      Open      ASR Received,                  Send ASA   Open
                client will not comply with    with
                request to end the session     Result-Code
                                               != SUCCESS

      Discon    ASR Received                   Send ASA   Idle

      Discon    STA Received                   Discon.    Idle
                                               user/device

   The following state machine is observed by a DNCA Agent:

                             AGENT
      State     Event                          Action     New State
      -------------------------------------------------------------
      Idle      NCR request                    Send       Open
                received, and                  successful
                able to provide requested      NCA
                NAT control service

      Idle      NCR request                    Send       Idle
                received, and                  failed
                unable to provide requested    NCA
                NAT control service

      Open      NCR  request                    Send       Open
                received, and                   successful
                able to provide requested       NCA
                NAT control service

      Open      NCR request                    Send       Idle
                received, and                  failed
                unable to provide requested    NCA,
                NAT control service            Cleanup

      Open      Unable to continue             Send ASR   Discon
                providing requested
                NAT control service

      Discon    Failure to send ASR            Wait,      Discon
                                               resend ASR

      Discon    ASR successfully sent and      Cleanup    Idle
                ASA Received with Result-Code

      Not       ASA Received                   None       No Change.
      Discon

      Any       STR Received                   Send STA,  Idle
                                               Cleanup.

We are reusing STR/STA and following is the modified section for session
termination:

4.5.  Session Termination

   The DNCA Manager generates a Session Terminate Request (STR) message
   to the DNCA Agent upon receiving a trigger signal.  The source of the
   trigger signal is outside the scope of this document.  The DNCA Agent
   sends accounting stop record reporting all the bindings and notifies
   the DNCA Manager about successful session termination using a Session
   Terminate Answer (STA) message with Result-Code set to
   DIAMETER_SUCCESS.  Figure 8 shows the protocol interaction between
   the DNCA Manager and the DNCA Agent.

   If a DNCA Agent receives STR from a DNCA Manager and fails to find a
   matching session, the DNCA Agent returns STA with Result-Code set to
   DIAMETER_UNKNOWN_SESSION_ID.

            DNCA Manager                             DNCA Agent
               |                                            |
               |                                            |
            Trigger                                         |
               |                                            |
               |                   STR                      |
               |------------------------------------------->|
               |               (session id)                 |
               |                                            |
               |                                            |
               |                                  Remove NAT bindings
               |                                       of session
               |                                            |
               |                                            |
               |           Send accounting stop             |
               |<-------------------------------------------|
               |           for all session bindings         |
               |                                            |
               |                                  Terminate Session /
               |                                 Remove session state
               |                                            |
               |                                            |
               |                                            |
               |                  STA                       |
               |<-------------------------------------------|
               |             (Result-Code)                  |
               |                                            |

                  Figure 8: Terminate NAT Control session

Thanks,
Shwetha

-----Original Message-----

From: [email-masked] [mailto:[email-masked]] On Behalf Of
jouni korhonen
Sent: Monday, September 20, 2010 8:25 PM
To: Frank Brockners (fbrockne)
Cc: [email-masked]
Subject: Re: [Dime] Auth-Session-State (WGLC comments
ofdraft-ietf-dime-nat-control-03)

Hi Frank,

Sorry for the delay (actually the email filter put the mail into wrong
folder using some unknown logic).

On Sep 6, 2010, at 4:03 PM, Frank Brockners (fbrockne) wrote:

> Wrt/ your comment on the use of " Auth-Session-State AVP", I agree 
> that the use of this AVP is redundant and not really useful, because 
> I'll have the default value in all cases, given that in DNCA both 
> manager and agent are stateful. In order to avoid confusion, I'd 
> follow your implicit suggestion to remove the AVP - and - more 
> importantly add additional details on how state is maintained.

Ok good.

> working group, the nomenclature of "server" and "client" does not 
> really apply to the DNCA use case, hence the use of "manager" and 
> "agent" for the two involved Diameter entities.
> 
> machines at agent and manager in detail (obviously reusing the format 
> in RFC 3588). Would that be an agreeable way forward?

That would be good. Please, propose some text and if that is a separate
section we could check it before shipping a new revision of the
document.

- Jouni

>> The draft should state, even if it seems obvious, whether the state 
>> is maintained or not. And whether it applies to all possible messages

>> authz session state machine?

_______________________________________________
DiME mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dime

---

From: jouni korhonen <[email-masked]>
Date: Tue, 28 Sep 2010 12:12:25 +0300

Hi Shwetha,

Section 7 is actually much more I was expecting and looks good to me. Just remember to remove the Auth-Session-State from NCR ABNF and Section 7.1.

- Jouni