RFC 5729
Clarifications on the Routing of Diameter Requests Based on the Username and the Realm
RFC 5729 📜✨ Clarifications on the Routing of Diameter Requests Based on the Username and the Realm
Okay bestie, this one's from the Network Working Group 💅 It's written by J. Korhonen, Ed. (Nokia Siemens Networks), M. Jones (Bridgewater Systems), L. Morand (Orange Labs), and T. Tsou (Huawei). It's dated December 2009, and it's on the Standards Track 🔥 It updates RFC 3588 (the Diameter Base Protocol). There's no Obsoletes line in the header, so it doesn't replace anything.
Abstract
This spec is all about how Diameter agents have to route requests when the User-Name AVP holds a Network Access Identifier with multiple realms in it. These are called "Decorated" NAIs 🎀 Decorated NAIs are used to force the request messages to go through a predefined list of mediating realms. Super specific, super iconic 💖
Status of This Memo
This document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🦋 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈
Copyright Notice
Copyright (c) 2009 IETF Trust and the persons identified as the document authors. All rights reserved ✨
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stand on the publication date. Read those carefully, because they spell out your rights and restrictions for this document 📖 Any Code Components pulled out of this document have to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, same as the BSD License says 🫶
Heads up: if you copy code out of this doc, the Simplified BSD License text has to come along for the ride! 💜
Table of Contents 🧚
1. Introduction ....................................................2
2. Terminology and Abbreviations ...................................2
3. Problem Overview ................................................3
4. Solution Overview ...............................................5
4.1. Interpretation of Decorated NAIs ...........................5
4.2. Internationalization of Decorated NAIs .....................5
4.3. Ensuring Backwards Compatibility ...........................6
4.4. Enhanced Request Routing Solution ..........................7
5. Security Considerations .........................................8
6. Acknowledgements ................................................8
7. References ......................................................9
7.1. Normative References .......................................9
7.2. Informative References .....................................91. Introduction ✨
Okay so this spec defines the behavior Diameter agents need when they route requests and the User-Name Attribute Value Pair (AVP) holds a Network Access Identifier (NAI) with multiple realms. We're calling those Decorated NAIs 💅 They're used to force request messages through a predefined list of mediating realms. Main character routing energy 👑
This doc doesn't make a brand new Diameter application. Instead, it spells out behavior that every new Diameter application needing Decorated-NAI-based request routing would share 🫶
The Diameter Base Protocol [RFC3588] NAI usage started out based on [RFC2486], which has since been revised to [RFC4282]. Using multiple realms is generally discouraged, but RFC 4282 does allow it 🙈 You can see the feature show up in [RFC4284], for instance. The catch is that RFC 4282 doesn't say how Diameter agents should handle Decorated NAIs. So this spec exists to capture those requirements 💖
2. Terminology and Abbreviations 🌸
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].
Network Access Identifier (NAI): The user identity the client submits during access authentication. When roaming, the NAI's job is to identify the user and also help route the authentication request 🦋
Decorated NAI: An NAI that contains multiple realms, used to specify a source route, and formatted according to Section 2.7 in RFC 4282 ✨
Network Access Provider (NAP): A business entity that provides network access infrastructure to one or more realms. A NAP infrastructure is made up of one or more network access servers 🍓
Network Access Server (NAS): The device that peers connect to in order to get access to the network 💜
3. Problem Overview 🔥
Section 6.1 of "The Diameter Base Protocol" (RFC 3588) goes into detail on request routing. That spec only covers the cases where a Destination-Realm AVP is included in a Diameter request message. As RFC 3588 Section 6.1 describes, a Diameter peer that originates a request message MAY pull the realm information out of the User-Name AVP and use that realm to fill in the Destination-Realm AVP 👀 In that case, the User-Name AVP is in the form of an NAI that includes the realm part.
Decorated NAIs force messages to route through a predefined list of realms, and that's how they force certain inter-realm roaming arrangements. See Section 2.7 of RFC 4282 🎀 Here's an example: a terminal (like a mobile host) might learn, through some application- or implementation-specific method, that its network access authentication signaling has to traverse certain realms to reach its home realm. In that case, the terminal would decorate its NAI during network access authentication with the list of intermediating realms and the home realm. Then the network access server (NAS) and the intermediating Diameter agents make sure all the Diameter request messages go through the desired realms, as long as the request messages contain the User-Name AVP with a Decorated NAI 🧚
NAI decoration has been used before in RADIUS-based [RFC2865] roaming networks, using RFC 2486 NAIs in a proprietary way. Diameter-based roaming networks need to replicate that same NAI-based routing enforcement. Also, there are public specs (see [3GPP.23.234], [3GPP.24.234], [3GPP.23.003], [3GPP.29.273], and [WiMAX], for example) that assume NAI-decoration-based request routing enforcement is fully supported by RFC 3588. That same assumption carried over to the Network Access Server Application Requirements (NASREQ) [RFC4005] and Extensible Authentication Protocol (EAP) [RFC4072] Diameter applications 😭
Figure 1 shows an example deployment where Decorated NAIs get used to force a certain route through the desired realms 🗺️ A roaming terminal (like a mobile host) finds two Network Access Providers (NAP): NAP A and NAP B. Neither NAP can give direct connectivity to the roaming terminal's home realm (aka h.example.com). But the roaming terminal somehow learns that NAP B can connect it to h.example.com through x.example.com (the visited realm from the roaming terminal's point of view). During network access authentication, the roaming terminal would decorate its NAI as h.example.com!username@x.example.com. The roaming terminal also has an alternative route home through NAP A: z.example.com and x.example.com. If it chose NAP A, it would decorate its NAI as x.example.com!h.example.com!username@z.example.com. Diameter agents could then route the request message through the desired realms using the Decorated NAI that was originally in the User-Name AVP 💖
.--. .--. .--.
_(. `) _(. `) _(. `)
_( Visited`)_ _( Visited`)_ _( Home `)_
(z.example.com`)<---->(x.example.com`)<------>(h.example.com`)
( ` . ) ) ( ` . ) ) ( ` . ) )
`--(_______)---' `--(_______)---' `--(_______)---'
| __ /
| /
.--. .--.
_( `. _( `.
( NAP A ) ( NAP B )
( ` . ) ) ( ` . ) )
`--(___.-' `--(___.-'
)
( ( )
( |
+-+
|M|
+-+
Figure 1: Example roaming scenario with intermediating realms. The
mobile host authenticates to the home realm through one or more
visited realms.NAI decoration isn't limited to network access authentication and authorization procedures. It works with any Diameter application whose commands are proxiable and include the User-Name AVP with an NAI 🙌 Generally, NAI decoration can force a certain route for all Diameter request messages at a realm granularity. Iconic 🌈
So, the problem summary has two main issues:
- Updating both the Destination-Realm and User-Name AVPs based on the Decorated NAI taken from the User-Name AVP. The update is done by intermediating Diameter agents that take part in realm-based request routing. Specifically, this concerns Diameter proxies 🎀
- Figuring out how Diameter agents can handle NAI-decoration-based routing enforcement while staying backwards compatible with RFC 3588 🫶
Section 2.3 of [RFC5113] also covers NAI-decoration-related issues with EAP [RFC3748] in general 💅
4. Solution Overview ✨
This spec defines a solution for Diameter realm-based request routing with routing enforcement that uses User-Name AVP NAI decoration. Diameter proxy agent implementations can claim compliance with the solution described here. The Diameter answer processing stays unmodified and follows the procedures in Section 6.2 of RFC 3588 🌸
4.1. Interpretation of Decorated NAIs 🦋
Implementations compliant with this specification MUST have a uniform way of interpreting decorated NAIs. That means that when decoration is present, the character '!' (hexadecimal 0x21) is used to separate realms in the list of decorated realms in the NAI (as the examples in [RFC4282] show) 🍓
🎀 That wraps up part 1 of 2! Sections 4.2 onward (the internationalization stuff, the backwards compatibility bit, the enhanced routing solution, security, and the references) are coming in part 2 💖🧚
4.2. Internationalization of Decorated NAIs ✨
Okay bestie, so RFC 3588, Section 1.3 says NAI realm names are required to be unique and piggyback on the administration of the Domain Name System (DNS) ([RFC1034], [RFC1035]) namespace. Simple enough, right? But here's the tea 🍵: an NAI, decorated or not, can contain international characters as allowed by RFC 4282. That's a problem, because international characters as such aren't supported by RFC 1034 and RFC 1035. Converting International Domain Names (IDN), which in this document's scope are NAI realms, is discussed in [RFC3490] and is further to be revised in [IDNA]. 🌍
The general guidance for NAI realms with international characters is in Section 2.4 of RFC 4282, and [NAI] digs into it more based on recent operational experiences. This spec does not try to fix the internationalization of NAIs, because the problem space is huge and covers way more than just NAI realms and NAI decoration. 💅 It does make these assumptions, though:
- The conversion from a realm name with international characters to ASCII-compatible encoding should only take place when DNS infrastructure needs to be queried, and not, for example, during the realm-placement processing of Decorated NAIs. The conversion is normally handled by a DNS resolver library on the local Diameter agent or, when that isn't available in the resolver library, by the Diameter agent itself. In both cases, the realm in the NAI stays unchanged.
- It's the responsibility of the operators administrating their realm and domain name spaces to make sure the DNS is provisioned properly for all realms that may appear in Decorated NAIs. This implicitly requires that the conversion from any realm with international characters to a domain name cannot fail (i.e., the realms conform to the preconditions for internationalized domain names). 🫠
From all of that, we can conclude that avoiding international characters in realms contained in NAIs is the best way to avoid problems with internationalized domain names and Decorated NAI handling in general. Main character energy is keeping it ASCII 🎀
4.3. Ensuring Backwards Compatibility 🦋
The NAI-decoration-based routing enforcement described in this specification will be supported by any new Diameter application. So backwards compatibility with existing Diameter implementations, applications, and deployments is guaranteed, which is so iconic of them 🥹 Existing Diameter agents that aren't compliant with this specification won't advertise support for the new applications that implement the enhanced routing solution based on Decorated NAIs, so they'll just get bypassed. Not me being left on read by a router 💀
4.4. Enhanced Request Routing Solution 🧚
When a Diameter client originates a request message, the Destination-Realm AVP gets filled in with the realm part of the NAI in the User-Name AVP (the bit after the '@' character of the NAI). That NAI may or may not be decorated, no cap.
When a Diameter agent gets a request message with a Destination-Realm AVP holding a realm it's configured to process locally (and, in the case of proxies, the Diameter application is locally supported), it MUST do the following extra processing before handling the message locally:
- If the
User-NameAVP is available in the request message, then the Diameter agent MUST inspect whether theUser-NameAVP contains a Decorated NAI. If the NAI isn't decorated, then the Diameter agent proceeds with normal RFC 3588 message processing. - If the
User-NameAVP contains a Decorated NAI, then the Diameter agent MUST process the NAI as defined in RFC 4282 and update the value of theUser-NameAVP accordingly. Furthermore, the Diameter agent MUST update theDestination-RealmAVP to match the new realm in theUser-NameAVP. - The request message is then sent to the next hop using the normal request routing rules as defined in RFC 3588.
Figure 2 shows a roaming terminal that originates signaling with its home realm (h.example.com), going through a NAP and two intermediating realms (z.example.com, x.example.com) before it reaches the home realm. It's giving step-by-step glow-up 🌸 It shows how the User-Name AVP and the Destination-Realm AVP change at each realm on the way to the final destination. If the signaling were originated from the NAS/NAP only, then step 1 can be omitted.
1) Roaming Terminal -> NAS/NAP
Identity/NAI = x.example.com!h.example.com!username@z.example.com
2) NAS/NAP -> z.example.com
User-Name = x.example.com!h.example.com!username@z.example.com
Destination-Realm = z.example.com
3) Realm-Z -> x.example.com
User-Name = h.example.com!username@x.example.com
Destination-Realm = x.example.com
4) Realm-X -> h.example.com
User-Name = username@h.example.com
Destination-Realm = h.example.com
Figure 2: The roaming terminal decides that the Diameter messages
must be routed via z.example.com and x.example.com to h.example.com.5. Security Considerations 💀
Okay, this one is serious, so listen up 👀 A malicious node that initiates (or indirectly causes the initiation of) a Diameter request may purposely create a malformed list of realms in the NAI. That can cause the routing of requests through realms that would normally have nothing to do with the initiated Diameter message exchange. Furthermore, a malformed list of realms may contain non-existing realms, which causes the routing of Diameter messages that can't ultimately be routed anywhere. The request message might get routed several hops before those non-existing realms are discovered, though, which creates unnecessary overhead for the routing system in general. Not it. 😤
The NAI decoration is used in Authentication, Authorization, and Accounting (AAA) infrastructures, where Diameter messages are transported between the NAS and the Diameter server via one or more AAA brokers or Diameter proxies. In that setup, the AAA communication between the NAS and the Diameter server relies on the security properties of the intermediate AAA brokers and Diameter proxies. So those middlemen had better be trustworthy 🫣
6. Acknowledgements 🫶
The authors would like to thank Victor Fajardo, Stefan Winter, Jari Arkko, and Avi Lior for their detailed comments on this document. Iconic behaviour 👑
Jouni Korhonen would like to thank the TEKES WISEciti project for providing funding to work on this document while he was at TeliaSonera's employ. 💜
7. References 📚
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3588] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and
J. Arkko, "Diameter Base Protocol", RFC 3588, September
2003.
[RFC4282] Aboba, B., Beadles, M., Arkko, J., and P. Eronen, "The
Network Access Identifier", RFC 4282, December 2005.7.2. Informative References
[3GPP.23.003] 3GPP, "Numbering, addressing and identification", 3GPP
TS 23.003 8.5.0, June 2009.
[3GPP.23.234] 3GPP, "3GPP system to Wireless Local Area Network
(WLAN) interworking; System description", 3GPP TS
23.234 6.10.0, October 2006.
[3GPP.24.234] 3GPP, "3GPP system to Wireless Local Area Network
(WLAN) interworking; WLAN User Equipment (WLAN UE) to
network protocols; Stage 3", 3GPP TS 24.234 6.7.0,
October 2006.
[3GPP.29.273] 3GPP, "Evolved Packet System (EPS); 3GPP EPS AAA
interfaces", 3GPP TS 29.273 8.3.0, September 2009.
[NAI] DeKok, A., "The Network Access Identifier", Work in
Progress, September 2009.
[IDNA] Klensin, J., "Internationalized Domain Names in
Applications (IDNA): Protocol", Work in Progress,
October 2009.
[RFC1034] Mockapetris, P., "Domain names - concepts and
facilities", STD 13, RFC 1034, November 1987.
[RFC1035] Mockapetris, P., "Domain names - implementation and
specification", STD 13, RFC 1035, November 1987.
[RFC2486] Aboba, B. and M. Beadles, "The Network Access
Identifier", RFC 2486, January 1999.
[RFC2865] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)",
RFC 2865, June 2000.
[RFC3490] Faltstrom, P., Hoffman, P., and A. Costello,
"Internationalizing Domain Names in Applications
(IDNA)", RFC 3490, March 2003.
[RFC3748] Aboba, B., Blunk, L., Vollbrecht, J., Carlson, J., and
H. Levkowetz, Ed., "Extensible Authentication Protocol
(EAP)", RFC 3748, June 2004.
[RFC4005] Calhoun, P., Zorn, G., Spence, D., and D. Mitton,
"Diameter Network Access Server Application", RFC 4005,
August 2005.
[RFC4072] Eronen, P., Ed., Hiller, T., and G. Zorn, "Diameter
Extensible Authentication Protocol (EAP) Application",
RFC 4072, August 2005.
[RFC4284] Adrangi, F., Lortz, V., Bari, F., and P. Eronen,
"Identity Selection Hints for the Extensible
Authentication Protocol (EAP)", RFC 4284, January 2006.
[RFC5113] Arkko, J., Aboba, B., Korhonen, J., Ed., and F. Bari,
"Network Discovery and Selection Problem", RFC 5113,
January 2008.
[WiMAX] WiMAX Forum, "WiMAX Forum Network Architecture (Stage
2: Architecture Tenets, Reference Model and Reference
Points)", Release 1 Version 1.2, January 2008.Authors' Addresses ✨
Jouni Korhonen (editor)
Nokia Siemens Networks
Linnoitustie 6
Espoo FIN-02600
Finland
EMail: jouni.nospam@gmail.com
Mark Jones
Bridgewater Systems
303 Terry Fox Drive
Ottawa, Ontario K2K 3J1
Canada
EMail: Mark.Jones@bridgewatersystems.com
Lionel Morand
Orange Labs
38-40 rue du general Leclerc
Issy-moulineaux Cedex 9, 92794
France
EMail: Lionel.morand@orange-ftgroup.com
Tina Tsou (Ting ZOU)
Huawei
R&D Center, Huawei Technologies Co., Ltd
Bantian, Shenzhen
P.R. China
EMail: tena@huawei.com📦 where this page comes from
- ietf: rfc5729 2009-12
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms