Subject: [AAA-WG]: [issue] Error codes (recap)

From: Miguel Ángel Monjas Llorente <[email-masked]>
Date: Wed, 05 Sep 2001 19:18:18 +0200

Submitter name: Miguel A. Monjas
Submitter email address: [email-masked] 
Date first submitted: 2001-08-22
Reference: 
Document: CMS-02
Comment type: T|E
Priority: S|1|2
Section: 
Rationale/Explanation of issue: 

Some errors and its result codes (not exhaustive):

1. A Diameter message with a CMS-Signed-Data AVP including a digital
signature and no AVP with its 'P' bit set:
DIAMETER_AVP_NOT_ALLOWED (existing in base draft)

2. A Diameter message without any CMS-Signed-Data AVP and some AVPs
with its 'P' bit set:
DIAMETER_MISSING_AVP (existing in base draft)

3. A Diameter message including CMS Security Application AVPs with no
DSA established:
DIAMETER_NO_DSA_ESTABLISHED (existing in CMS-03)

4. A Diameter node not being able to set up a DSA upon receiving a
DSA-Request due to problems different from digital signature
verification
DIAMETER_NO_DSA_ESTABLISHED (existing in CMS-03)

5. A Diameter node not being able to set up a DSA upon receiving a
DSA-Answer due to any problem
DIAMETER_NO_DSA_ESTABLISHED (in subsequent Diameter messages if a
CMS-related message is received) (existing in CMS-03)

6. A Diameter node not supporting certificate revocation checks has
calculated a safe period based on the expiration dates of the
certificates. Once this safe period has finishing, a CMS-Signed-Data
arrives without any certificate
?? 

7. A Diameter message including CMS Security Application AVPs with the
DSA expired (only if the Diameter node can "remember" past DSAs)
DIAMETER_DSA_EXPIRED (existing in CMS-03)

8. A Diameter message containing a CMS-Signed-Data AVP but with a
different set of AVPs with its 'P' bit set to the ones chosen in the
DSA establishment.
??

9. A Diameter message containing a CMS-Signed-Data AVP that doesn't
include any digital signature made by the node included in the
Origin-Host AVP
DIAMETER_CONTRADICTING_AVPS?? (existing in base draft)

10. A Diameter message containing a CMS-Signed-Data AVP. No
appropriate digital certificate (regarding the identity included in
the Origin-Host AVP) is available, neither included in the Diameter
message as CMS-Cert AVP nor available in the local cache.
DIAMETER_INVALID_AUTH?? (existing in CMS-03)

11. A Diameter message containing a CMS-Signed-Data AVP. The digital
signature is invalid.
DIAMETER_INVALID_AUTH (existing in CMS-03)

12. The DSA participant in the home network doesn't belong to the same
realm as the user being authorized.
DIAMETER_AUTHORIZATION_REJECTED?? (existing in base draft)

13. An OCSP response is requested. The Diameter server supports OCSP
querying. However, the OCSP responder isn't available (the server gets
a timeout)
DIAMETER_OCSP_NOT_SUPPORTED?? (existing in CMS-03)

14. A Diameter message containing a CMS-Encrypted-Data AVP. The
recipient isn't on the list of recipients specified in the
RecipientInfos of the EnvelopedData and decides to indicate an error.
DIAMETER_NO_DSA_RECIPIENT??

15. A Diameter message containing a CMS-Encrypted-Data AVP. An error
occurs during decryption
DIAMETER_DSA_DECRYPTION_FAILED??

Requested change: 

a) Decide if all the situations quoted in which no error code is
mentioned needs a new error code (if so create them)
b) Decide whether the suggested result codes are correct
c) Once decided the result code for any situation, include a mention
of such result code (or the section) in the proper place.
d) Clarify what happens when a DSA can't be established because the
initiator (once received the DSAA) fails to check the conditions
listed in 3.1. Is is necessary to issue a NAK containing a
DIAMETER_NO_DSA_ESTABLISHED? Or it sufficient to issue such result
code only when another CMS-related AVP is inserted in subsequent
messages? It's important to take into account that the following
paragraph (from 6.1) states that a Diameter message must be issued
after any failed verification of a digital signature: 

   If the signature cannot be verified correctly, a response with the
   Result-Code AVP set to DIAMETER_INVALID_AUTH MUST be returned.

e) Clarify the meaning of the following paragraph in 6.1

   If a receiver detects that the contents of the CMS-Signed-Data AVP
   are invalid, it SHOULD return the new Result-Code AVP value defined
   in section 7.0.

Which contents are we talking about (maybe 9 above)? Because, if it
isn't the condition, a DIAMETER_INVALID... should be the appropriate
result code.

Regards

  // M.A.

-- 
  Miguel Angel Monjas Llorente
  Systems Engineer, GSM/UMTS Systems Management
  Ericsson España, S.A. (EEM) UMTS/GSM Databases
  Tel: +34 91 3393605                 Mob: +34 629 570196
  <mailto:[email-masked]>  Fax: +34 91 3392538
  Retama 1, 4th. 28045 Madrid - SPAIN -