Subject: RE: NEW [issue17] Error handling

From: <[email-masked]>
Date: Mon, 23 Jun 2003 17:50:46 +0300

We could have (A) a separate PANA-Error message or (B) include E bit in the PANA hdr with existing messages? If E bit is on, Result-Code AVP includes error code.

PAA SHOULD send error messages after PANA-Start-Request/Reponse message exchange to prevent too easy DoS?

Here are example error cases from Diameter spec (draft17) for the Result-Code AVP:

      COMMAND_UNSUPPORTED       3001
      UNABLE_TO_DELIVER         3002
      REALM_NOT_SERVED          3003
      TOO_BUSY                  3004
      INVALID_HDR_BITS          3008
      INVALID_AVP_BITS          3009
      AVP_UNSUPPORTED           5001
      UNKNOWN_SESSION_ID        5002
      INVALID_AVP_VALUE         5004
      MISSING_AVP               5005
      RESOURCES_EXCEEDED        5006
      AVP_OCCURS_TOO_MANY_TIMES 5009
      UNSUPPORTED_VERSION       5011
      INVALID_AVP_LENGTH        5014
      INVALID_MESSAGE_LENGTH    5015

- Dan

> -----Original Message-----
> From: ext [mailto:[email-masked]]
> Sent: 23 June, 2003 16:51
> To: [email-masked]
> Subject: NEW [issue17] Error handling
> 
> 
> New submission from Dan Forsberg <[email-masked]>:
> 
> How can PaC or PAA inform each other about errors?
> 
> 
> ----------
> category: Technical
> document: draft-ietf-pana-pana-xx.txt
> messages: 42
> nosy: dforsber
> priority: Must Fix
> status: No Discussion
> title: Error handling
> ________________________________________________
> PANA Issues <[email-masked]>
> http://danforsberg.info:8080/pana-issues/issue17
> ________________________________________________
> 
>

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 23 Jun 2003 08:53:48 -0700

> We could have (A) a separate PANA-Error message or (B) include E bit in the PANA hdr with existing messages? If E bit is on, Result-Code AVP includes error code.

The error messages should be separated from regular messages, and
should be an optional feature when the errors occur before PANA
messages are protected with using MAC AVPs, as there is a trade-off
between helping diagnosis and helping DoS attackers, by sending such
messages.  If an error message is sent unprocted with a MAC AVP or
with containing an invalid MAC AVP value, the receiver of the message
MUST NOT change its state or send a message in response to it.

Yoshihiro Ohba