Subject: [AAA-WG]: List of error situations

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Tue, 11 Sep 2001 17:39:55 +0200

Hi all,

I've compiled a comprehensive list of error situations I've found when
dealing wiht the CMS draft. Most of them has been listed in previous
list but I think that a full list will be interesting.

After each error I've included four items:

Error code issued: the result code issued in every situation.
Definition of the error: where the definition of the error is stated.
Included in CMS-02 draft: whether it has been considered in CMS-02
Included in CMS-03 draft: whether it has been considered in CMS-02
Status: what I consider that should be done.

====================================================================

1 PROTECTION MISMATCH

1. A Diameter message arrives containing a CMS-Signed-Data AVP and no
AVPs with its 'P' bit set.
Error code issued: DIAMETER_AVP_NOT_ALLOWED
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: not necessary to add any information to the drafts.

2. A Diameter message arrives containing some AVPs with its 'P' bit
set and without any CMS-Signed-Data AVP.
Error code issued: DIAMETER_MISSING_AVP
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: not necessary to add any information to the drafts.

3. A Diameter message arrives containing AVPs with its 'P' bit set
without being authorised for being protected.
Error code issued: DIAMETER_INVALID_AVP_BIT_COMBINATION
Definition of the error: suggested in base (7.1.5) (resolution of
issue 169)
Included in CMS-02 draft: No
Included in CMS-03 draft: Yes (suggested at the end of section 2.0)
Status: agreed on WG (issue 169).

4. A Diameter message arrives containing AVPs with its 'P' set when it
was not agreed on the DSA establishment that they should be protected:
Error code issued: DIAMETER_INVALID_AVP_BIT_COMBINATION
Definition of the error: suggested in base (7.1.5) (resolution of
issue 169)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: confirmation needed.

5. A Diameter message arrives containing AVPs which were agreed on the
DSA establishment as being encrypted (that is, they should not be
present in plain in the message):
Error code issued: DIAMETER_AVP_NOT_ALLOWED
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: confirmation needed.

6. A CMS-Encrypted-Data AVP arrives within a Diameter message
containing AVPs that are not authorised to be encrypted:
Error code issued: DIAMETER_INVALID_AVP_VALUE
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: confirmation needed.

7. A CMS-Encrypted-Data AVP arrives within a Diameter message
containing AVPs that were not agreed on the DSA establishment as
encryptable:
Error code issued: DIAMETER_INVALID_AVP_VALUE
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: confirmation needed.

8. A CMS-Signed-Data AVP arrives within a Diameter message containing
a digital signature on a set of AVPs different from the AVPs with its
'P' bit set:
Error code issued: DIAMETER_INVALID_AVP_VALUE
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: confirmation needed.

2 NO DSA AVAILABLE

9. A Diameter message arrives including some Diameter CMS Security
Application AVPs (CMS-Signed-Data, CMS-Encrypted-Data or CMS-Cert)
with no DSA established.
Error code issued: DIAMETER_NO_DSA_ESTABLISHED
Definition of the error: CMS-03 (7.2)
Included in CMS-02 draft: No
Included in CMS-03 draft: Just as result code definition (resolution
of issue 169 proposes its explicit mention but regarding error
situation 11)
Status: confirmation needed.

10. A Diameter message arrives including some Diameter CMS Security
Application AVPs (CMS-Signed-Data, CMS-Encrypted-Data or CMS-Cert)
with an expired DSA (if the implementation is able to detect that the
AVPs come from a node with which a former DSA was established).
Error code issued: DIAMETER_DSA_EXPIRED
Definition of the error: CMS-03 (7.2)
Included in CMS-02 draft: No
Included in CMS-03 draft: Just as result code definition.
Status: confirmation needed.

3 ERRORS IN DSA ESTABLISHMENT

11. A Diameter server can not set up a DSA upon receiving a
DSA-Request since it is not able to construct a DSA-Answer according
to the rules listed in section 3.1: 
Error code issued: DIAMETER_NO_DSA_ESTABLISHED
Definition of the error: CMS-03 (7.2)
Included in CMS-02 draft: No
Included in CMS-03 draft: Yes
Status: agreed on WG (issue 156).

12. A Diameter proxy or client can not set up a DSA upon receiving a
DSA-Answer since it is not able to verify all the conditions listed in
section 3.1:
Error code issued: DIAMETER_NO_DSA_ESTABLISHED
Definition of the error: CMS-03 (7.2)
Included in CMS-02 draft: No
Included in CMS-03 draft: Just as result code definition.
Status: discussion on the WG (issue 170, still not approved).

13. A Diameter node can not set up a DSA upon receiving a DSA-Request
or a DSA-Answer because the requested protection on certain AVPs is
not allowed (that is, requesting as signed an AVP which may not set
its 'P' bit or as encrypted an AVP which may not be encrypted).
Error code issued: DIAMETER_INVALID_AVP_VALUE
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: Yes (section 3.1).
Status: discussion on the WG (issue 170, still not approved).

4 ERRORS REGARDING CRYPTOGRAPHIC AVPS VERIFICATION

14. A Diameter message arrives containing a CMS-Signed-Data AVP that
does not include any digital signature made by the node included in
the Origin-Host AVP.
Error code issued: DIAMETER_INVALID_AUTH
Definition of the error: CMS-03 (7.1)
Included in CMS-02 draft: No
Included in CMS-03 draft: No.
Status: confirmation needed.

15. A Diameter message arrives containing a CMS-Signed-Data AVP. No
appropriate digital certificate (regarding the identity included in
the Origin-Host AVP) is available, neither included in the Diameter
message as a CMS-Cert AVP nor available in the local cache.
Error code issued: DIAMETER_INVALID_AUTH
Definition of the error: CMS-03 (7.1)
Included in CMS-02 draft: No
Included in CMS-03 draft: No.
Status: confirmation needed.

16. A Diameter message arrives containing a CMS-Signed-Data AVP. The
digital signature is invalid.
Error code issued: DIAMETER_INVALID_AUTH
Definition of the error: CMS-03 (7.1)
Included in CMS-02 draft: No
Included in CMS-03 draft: No.
Status: agreed on WG (issue 156).

17. A Diameter message arrives containing a CMS-Encrypted-Data AVP.
The recipient is not on the list of recipients specified in the
RecipientInfos of the CMS EnvelopedData object and the node decides to
indicate an error.
Error code issued: 
Definition of the error: 
Included in CMS-02 draft: No
Included in CMS-03 draft:
Status: proposal needed.

18. A Diameter message arrives containing a CMS-Encrypted-Data AVP and
does not have the required shared secret: 
Error code issued: DIAMETER_KEY_UNKNOWN
Definition of the error: CMS-02 (7.1)
Included in CMS-02 draft: Yes
Included in CMS-03 draft: Yes
Status: no discussion needed.

19. A Diameter message arrives containing a CMS-Encrypted-Data AVP and
an error occurs during decryption.
Error code issued: 
Definition of the error: 
Included in CMS-02 draft: No
Included in CMS-03 draft:
Status: proposal needed.

20. A Diameter message arrives containing a CMS-Signed-Data AVP with
an invalid ContentInfo object.
Error code issued: DIAMETER_INVALID_CMS_DATA
Definition of the error: CMS-02 (7.1)
Included in CMS-02 draft: Yes
Included in CMS-03 draft: Yes
Status: no discussion needed.

21. A Diameter message arrives containing a CMS-Encrypted-Data AVP
with an invalid ContentInfo object.
Error code issued: DIAMETER_INVALID_CMS_DATA
Definition of the error: CMS-02 (7.1)
Included in CMS-02 draft: Yes
Included in CMS-03 draft: Yes
Status: no discussion needed.

22. A Diameter message arrives containing a CMS-Cert AVP with an
invalid ContentInfo object.
Error code issued: DIAMETER_INVALID_CMS_DATA
Definition of the error: CMS-02 (7.1)
Included in CMS-02 draft: Yes
Included in CMS-03 draft: Yes
Status: no discussion needed.

5 REVALIDATION ERRORS

23. A Diameter node that does not support certificate revocation
checks has calculated a safe period based on the expiration dates of
the certificates. Once this safe period has finishing, a Diameter
message including a CMS-Signed-Data AVP arrives without any
certificate:
Error code issued: 
Definition of the error: 
Included in CMS-02 draft: No
Included in CMS-03 draft:
Status: proposal needed.

6 OCPS SUPPORT

24. OCSP responses for every certificate are requested by means of the
OCSP-Request-Flags AVP. The Diameter server supports OCSP querying but
the OCSP responder is not available (the server gets a timeout, for
instance).
Error code issued: DIAMETER_OCSP_NOT_SUPPORTED
Definition of the error: CMS-02
Included in CMS-02 draft: Yes
Included in CMS-03 draft: Yes
Status: confirmation needed.

25. OCSP responses for every certificate are requested by means of the
OCSP-Request-Flags AVP. The Diameter server does not support OCSP
querying.
Error code issued: DIAMETER_OCSP_NOT_SUPPORTED
Definition of the error: CMS-02
Included in CMS-02 draft: Yes
Included in CMS-03 draft: Yes
Status: no discussion needed.

7 CMS PROXY MODE

26. A Diameter proxy receives a DSAR. The protection levels are not
compatible with the local policy.
Error code issued: DIAMETER_NO_CMS_THROUGH_PROXY
Definition of the error: CMS-02
Included in CMS-02 draft: Yes
Included in CMS-03 draft: Yes
Status: no discussion needed.

27. A Diameter proxy receives a DSAR. The protection levels are
compatible with the local policy.
Error code issued: DIAMETER_CAN_ACT_AS_CMS_PROXY
Definition of the error: CMS-02
Included in CMS-02 draft: Yes
Included in CMS-03 draft: Yes
Status: no discussion needed.

28. A Diameter proxy receives a PDSR for which it has no common trust
with the sender, which is required to establish the DSA.
Error code issued: DIAMETER_NO_COMMON_TRUST
Definition of the error: CMS-03 (7.2)
Included in CMS-02 draft: No
Included in CMS-03 draft: Yes
Status: clarification needed.

8 MISCELLANEOUS

29. The DSA participant in the home network does not belong to the
same realm as the user being authorized.
Error code issued: DIAMETER_AUTHORIZATION_REJECTED
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: confirmation needed.

30. No more than one CMS-Signed-Data AVP must be present in any given
Diameter message: DIAMETER_AVP_NOT_ALLOWED
Error code issued: DIAMETER_AVP_NOT_ALLOWED
Definition of the error: base (7.1.5)
Included in CMS-02 draft: No
Included in CMS-03 draft: No
Status: confirmation needed.

====================================================================

The different status mean the following:

- Confirmation needed (4, 5, 6, 7, 8, 9, 10, 14, 15, 24, 29 and 30).
I've supposed that a determinate result code must be used but I'd need
a explicit confirmation about it. If my suppositions are correct, some
text on the draft might be added to make it clearer.
- Proposal needed (17, 19 and 23). No idea about which result code
must be used (I suspect that a newly defined result code should be
used)
- Clarification needed (28). It regards issue 168.

As I understand that this can be a tedious task, I offer my help to
Pat to add the suggested clarification text to the draft once the
confirmations have been issued.

Regards

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Fri, 14 Sep 2001 14:40:18 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-09-14
Reference: http://www.merit.edu/mail.archives/aaa-wg/msg02095.html
Document: CMS-02
Comment type: T
Priority: 2
Section: 6.2
Rationale/Explanation of issue: 

In the list of errors provided in the reference message, the error

> Included in CMS-03 draft:

After some reflexion time, I've noticed that there is no way to
distinguish between an error decryption and an error in the AVPs
extracted. As far as I know, the extracted AVPs are just a bit stream
that has to be parsed. If the CMS-Encrypted-Data AVP has been
modified, the only result is that the bit stream would be parsed since
the extracted AVPs would be invalid.

My proposal is that only a DIAMENTER_INVALID_AVP_VALUE would be
issued, including the CMS-Encrypted-Data AVP as Failed-AVP AVP.

Requested change: 

Replace the following sentence in 6.2:

   ...and an error occurs during decryption, then the
   recipient MUST indicate an error.

with the following:

   ...and an error occurs during decryption, then the
   recipient MUST indicate an error by means of the 
   DIAMETER_INVALID_AVP_VALUE result code and including
   the CMS-Encrypted-Data AVP as Failed-AVP AVP.

Regards

  // M.A.

---

From: Pat Calhoun <[email-masked]>
Date: Sun, 16 Sep 2001 07:37:41 -0700

I have addressed this issue, which conflicted with another issue by Miguel.
I assume that this issue overrides a portion of issue 158, to which I posted
proposed text at http://www.merit.edu/mail.archives/aaa-wg/msg02114.html.

PatC

---

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Mon, 17 Sep 2001 14:05:43 +0200

> proposed text at http://www.merit.edu/mail.archives/aaa-wg/msg02114.html.

Yes. The proposed resolution of issue 158 looks fine, but as stated in
the previous mail, the key point is that I don't know if we've got the
possibility of deciding whether a given CMS-Encrypted-AVP has been
modified or not. If we've got a CMS-Encrypted-Data AVP encrypting an
only AVP, once we decrypt and parse we find that the AVP doesn't match
any defined AVP. We can deduce that the AVP has been modified (but
actually there's no way to decide if it's a question of modification,
bad encryption or bad encoding or the original AVP). Of course that if
we find two or more supposed AVPs that don't match any defined AVP, it
quite probable that some modification has been suffered.

My proposal is to keep the DIAMETER_DSA_DECRYPTION_FAILED as proposed
by Pat, but taking into account that probably CMS implementations
wouldn't be able to distiguish between a failed decryption and other
type of errors related to decryption.

Regards

  // M.A.

  Ombú 3, 10th. 28045 Madrid - SPAIN -