RFC 8581
Diameter Agent Overload and the Peer Overload Report
RFC 8581: Diameter Agent Overload and the Peer Overload Report 🦋
Who wrote it: S. Donovan from Oracle 💅 Date: August 2019 🌸 Category: Standards Track (this is a real Internet standard, bestie!) ✨ Stream: Internet Engineering Task Force (IETF) 💜 Updates: RFC 7683 🔥 (this doc extends the base DOIC spec) Obsoletes: nothing is listed in the header 🙈 ISSN: 2070-1721
Abstract ✨
okay so this spec adds an extension to the Diameter Overload Indication Conveyance (DOIC), which is the base solution for Diameter overload from RFC 7683. 🎀 The extension defines a brand new report type called the Peer Overload report. The first thing it's built for is handling the moments when a Diameter Agent gets overloaded. 💖
Status of This Memo 🌈
This is an Internet Standards Track document. 🔥
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). You can find more info on Internet Standards in Section 2 of RFC 7841. 📚
Info about the current status of this document, any errata, and how to send feedback is at https://www.rfc-editor.org/info/rfc8581. 💌
Copyright Notice 💜
Copyright (c) 2019 IETF Trust and the persons identified as the document authors. All rights reserved. ©️
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Please actually read these, because they spell out your rights and restrictions for this document. 🙈 Code Components pulled out of this document must include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Simplified BSD License describes. 🫶
Table of Contents 🍓
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Requirements Language . . . . . . . . . . . . . . . . . . . . 4
3. Terminology and Abbreviations . . . . . . . . . . . . . . . . 4
4. Peer-Report Use Cases . . . . . . . . . . . . . . . . . . . . 5
4.1. Diameter Agent Overload Use Cases . . . . . . . . . . . . 5
4.1.1. Single Agent . . . . . . . . . . . . . . . . . . . . 5
4.1.2. Redundant Agents . . . . . . . . . . . . . . . . . . 6
4.1.3. Agent Chains . . . . . . . . . . . . . . . . . . . . 7
4.2. Diameter Endpoint Use Cases . . . . . . . . . . . . . . . 8
4.2.1. Hop-by-Hop Abatement Algorithms . . . . . . . . . . . 8
5. Interaction Between Host/Realm and Peer Overload Reports . . 9
6. Peer-Report Behavior . . . . . . . . . . . . . . . . . . . . 9
6.1. Capability Announcement . . . . . . . . . . . . . . . . . 9
6.1.1. Reacting-Node Behavior . . . . . . . . . . . . . . . 9
6.1.2. Reporting-Node Behavior . . . . . . . . . . . . . . . 9
6.2. Peer Overload Report Handling . . . . . . . . . . . . . . 10
6.2.1. Overload Control State . . . . . . . . . . . . . . . 10
6.2.2. Reporting-Node Maintenance of Peer-Report OCS . . . . 11
6.2.3. Reacting-Node Maintenance of Peer-Report OCS . . . . 12
6.2.4. Peer-Report Reporting-Node Behavior . . . . . . . . . 13
6.2.5. Peer-Report Reacting-Node Behavior . . . . . . . . . 13
7. Peer-Report AVPs . . . . . . . . . . . . . . . . . . . . . . 14
7.1. OC-Supported-Features AVP . . . . . . . . . . . . . . . . 14
7.1.1. OC-Feature-Vector AVP . . . . . . . . . . . . . . . . 15
7.1.2. OC-Peer-Algo AVP . . . . . . . . . . . . . . . . . . 15
7.2. OC-OLR AVP . . . . . . . . . . . . . . . . . . . . . . . 15
7.2.1. OC-Report-Type AVP . . . . . . . . . . . . . . . . . 16
7.3. SourceID AVP . . . . . . . . . . . . . . . . . . . . . . 16
7.4. Attribute-Value Pair Flag Rules . . . . . . . . . . . . . 16
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 17
9. Security Considerations . . . . . . . . . . . . . . . . . . . 17
10. References . . . . . . . . . . . . . . . . . . . . . . . . . 18
10.1. Normative References . . . . . . . . . . . . . . . . . . 18
10.2. Informative References . . . . . . . . . . . . . . . . . 18
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 18
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 191. Introduction ✨
okay so this spec documents an extension to the Diameter Overload Indication Conveyance (DOIC), which is the base solution for Diameter overload [RFC7683]. 💖 It defines the Peer Overload report type, and the first real use case is handling the times when a Diameter Agent gets overloaded. 🔥
This document spells out how Diameter nodes behave when Diameter Agents hit an overload condition and send an Overload report asking for less traffic. 🫶 It also introduces the new Peer Overload report type, which is what handles those agent overload situations. The Peer Overload report type is defined generically, so other Diameter overload scenarios can use it too. 🌈
The base Diameter overload spec [RFC7683] covers what happens when a Diameter endpoint (a Diameter Client or Diameter Server, as defined in [RFC6733]) gets overloaded. 🎀
In the base spec, the goal is to handle overload abatement as close to the source of the Diameter traffic as feasible. 🦋 Most of the time that happens at the originator of the traffic, which is usually called a Diameter Client. 💅 A Diameter Agent can also do the overload mitigation, for example when it knows that a Diameter Client doesn't support the DOIC extension. 🙈
This document extends the base endpoint overload spec so it also covers the case where Diameter Agents become overloaded. 💜 Just like Diameter Clients and Diameter Servers, Diameter Agents can get surges in traffic that push them to handle more than they were configured for. ⭐ If you want a deeper look at what can cause overload in Diameter nodes, check out the Diameter overload requirements in [RFC7068]. 📚
This document defines a new Overload report type for communicating agent overload. 🔥 It works with the Diameter overload loss abatement algorithm defined in [RFC7683], and it's expected to work with other overload abatement algorithms defined in extensions to the DOIC solution. 👑
2. Requirements Language 💜
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 🎀 So if you see them in caps, that's the official BCP 14 meaning, and if they're lowercase, they're just regular English. 🙈
3. Terminology and Abbreviations 🧚
Here are the terms the spec uses. 🍓
- AVP: Attribute-Value Pair. 💖
- Diameter Node: A Diameter Client, Diameter Server, or Diameter Agent [RFC6733]. 🌸
- Diameter Endpoint: A Diameter Client or Diameter Server [RFC6733]. 🦋
- Diameter Agent: A Diameter node that provides relay, proxy, redirect, or translation services [RFC6733]. 💅
- Reporting Node: A DOIC node that sends an Overload report in a Diameter answer message. 📣
- Reacting Node: A DOIC node that receives and acts on a DOIC Overload report. 🫶
- DOIC Node: A Diameter node that supports the DOIC solution defined in [RFC7683]. 👑
4. Peer-Report Use Cases 🌈
This section lays out some representative use cases for the peer report used to communicate agent overload. ✨
There are two main classes of use cases identified so far: ones involving overloaded agents, and ones involving overloaded Diameter endpoints. 💜 In both, the goal is to use an overload algorithm that controls the traffic sent towards peers. 🔥
4.1. Diameter Agent Overload Use Cases 🦋
The peer report needs to support the use cases described below. 🎀
In the figures in this section, elements labeled "c" are Diameter Clients, elements labeled "a" are Diameter Agents, and elements labeled "s" are Diameter Servers. 🧚
4.1.1. Single Agent 💖
This use case is shown in Figure 1. 🌸 Here, the client sends all of its traffic through the single agent. 💅 If the agent fails, the client can't send Diameter traffic toward the server at all. 🙈
+-+ +-+ +-+
|c|----|a|----|s|
+-+ +-+ +-+
Figure 1A more likely setup is shown in Figure 2. 🌈 In this one, there are multiple servers sitting behind the single agent. ✨ The client sends everything through the agent, and the agent decides how to spread the traffic across the servers based on local routing and load distribution policy. 👑
+-+
--|s|
+-+ +-+ / +-+
|c|----|a|- ...
+-+ +-+ \ +-+
--|s|
+-+
Figure 2In both of these cases, overload in the single agent has to be handled by the client in a similar way to how it would handle overload of a directly connected server. 🎀 When the agent becomes overloaded, it inserts an Overload report into answer messages flowing back to the client. 🔥 That Overload report contains a requested reduction in the amount of traffic sent to the agent. 🫶 The client applies overload abatement behavior as defined in the base Diameter overload spec [RFC7683], or in the extension document that defines the overload abatement algorithm that was indicated. 💜 This ends up throttling the traffic that would have gone to the agent, because there's no alternative route. 🦋 The client then sends an appropriate error response back to the originator of the request. 💌
4.1.2. Redundant Agents ✨
Okay so Figure 3 and Figure 4 show the second, and honestly more likely, deployment scenario with agents 🫶 In both of these, the client has Diameter connections to two agents. Bestie, the vibes are so organized 💅
Figure 3 is the one with a primary connection to one agent (agent a1) and a secondary connection to the other (agent a2). Under normal circumstances, the client uses the primary connection for all traffic. The secondary connection only kicks in when something fails 🦋
+--+ +-+
--|a1|---|s|
+-+ / +--+\ /+-+
|c|- x
+-+ . +--+/ \+-+
..|a2|---|s|
+--+ +-+Figure 3
Figure 4 is the one where both connections are actively used 🔥 The client has local distribution policy deciding what traffic goes through each connection, so it's giving teamwork.
+--+ +-+
--|a1|---|s|
+-+ / +--+\ /+-+
|c|- x
+-+ \ +--+/ \+-+
--|a2|---|s|
+--+ +-+Figure 4
Now, if one of the agents gets overloaded in either of these setups, the client should reduce the traffic it sends to that agent by the amount requested 🌸 That traffic should instead get routed through the non-overloaded agent. For example, say the overloaded agent asks for a 10 percent reduction. The client should send 10 percent of the traffic that would have gone to the overloaded agent through the non-overloaded agent. Iconic math, no notes 🧚
When the client has both an active and a standby connection to the two agents, there's another option for responding to an Overload report from an agent: switch the standby connection to active. Then all the traffic flows through the new active connection 💖
If both agents are reporting overload, the client may need to start cutting down the total traffic it sends to the agents 😭 This works in a similar way to what we covered in Section 4.1.1. The amount depends on the combined reduction the two agents are asking for.
4.1.3. Agent Chains 🌈
There are also deployments where there can be multiple Diameter Agents between Diameter Clients and Diameter Servers. One example is when there are Diameter Agents between administrative domains. Main character energy for the agents, honestly 👑
Figure 5 shows one of these setups. This figure only has a maximum of two agents in a Diameter transaction, but it's possible for more than two agents to be in the path of a transaction 🍓
+---+ +---+ +-+
--|a11|-----|a21|---|s|
+-+ / +---+ \ / +---+\ /+-+
|c|- x x
+-+ \ +---+ / \ +---+/ \+-+
--|a12|-----|a22|---|s|
+---+ +---+ +-+Figure 5
Handling overload for one or both of the agents, a11 or a12 in this case, works the same way as in Section 4.1.2 ✨
The overload of agents a21 and a22 has to be handled by the previous-hop agents 💅 So agents a11 and a12 need to handle the overload mitigation logic when they receive an Agent Overload report from agents a21 and a22. Passing the baton, but make it responsible 🫶
Handling Peer Overload reports is similar to what we covered in Section 4.1.2. If the overload can be addressed using diversion, then that approach should be taken.
If both agents have requested a reduction in traffic, the previous-hop agent must start throttling the appropriate number of transactions 😭 When throttling requests, an agent uses the same error responses defined in the base DOIC specification [RFC7683].
4.2. Diameter Endpoint Use Cases 💜
This section lays out use cases for the Peer Overload report involving Diameter Clients and Diameter Servers 🎀
4.2.1. Hop-by-Hop Abatement Algorithms 🦋
It's envisioned that abatement algorithms will be defined that support the option for Diameter endpoints to send peer reports. For instance, it's envisioned that one usage scenario for the rate algorithm [RFC8582] will involve abatement happening on a hop-by-hop basis. Lowkey so cool 🌸
In this rate-deployment scenario, Diameter endpoints generate peer reports and select the rate algorithm for abatement of overload conditions 💖
5. Interaction Between Host/Realm and Peer Overload Reports 🔥
It's possible for both an agent and an endpoint in the path of a transaction to be overloaded at the same time 😭 When this happens, Diameter entities need to handle multiple Overload reports. In this scenario, the reacting node should first handle throttling of the overloaded Host or Realm. Any messages that survive throttling due to Host or Realm reports should then go through abatement for the Peer Overload report. When doing abatement on the peer report, the reacting node SHOULD take into consideration the number of messages already throttled by the handling of the host/realm report abatement. Don't double-dip on the throttling, bestie 🙈
Note: The goal is to avoid traffic oscillations that might result from throttling of messages for both the host/realm Overload reports and the PEER Overload reports. This is especially a concern if both reports indicate the loss abatement algorithm.
6. Peer-Report Behavior 👑
This section defines the normative behavior for the Peer-Report extension to the DOIC solution 💅
6.1. Capability Announcement 🫶
6.1.1. Reacting-Node Behavior 🦋
When sending a Diameter request, a DOIC node that supports the OC_PEER_REPORT feature (as defined in Section 7.1.1) MUST include an OC-Feature-Vector AVP with the OC_PEER_REPORT bit set in the OC-Supported-Features AVP. Main character energy for the feature bit 🌟
When sending a request, a DOIC node that supports the OC_PEER_REPORT feature MUST include a SourceID AVP in the OC-Supported-Features AVP, with its own DiameterIdentity. 🎀
When a Diameter Agent relays a request that includes a SourceID AVP in the OC-Supported-Features AVP, and the Diameter Agent supports the OC_PEER_REPORT feature, then it MUST remove the received SourceID AVP and replace it with a SourceID AVP containing its own DiameterIdentity. Swap that ID like it's nothing 🔥
6.1.2. Reporting-Node Behavior 🌈
When receiving a request, a DOIC node that supports the OC_PEER_REPORT feature MUST update its transaction state with an indication of whether or not the peer the request came from supports the OC_PEER_REPORT feature 🧚
Note: The transaction state is used when the DOIC node is acting as a peer-report reporting node and needs to send OC-OLR AVP reports of type "PEER-REPORT" in answer messages. Peer Overload reports are only included in answer messages sent to peers that support the OC_PEER_REPORT feature.
The peer supports the OC_PEER_REPORT feature if the received request contains an OC-Supported-Features AVP with the OC-Feature-Vector with the OC_PEER_REPORT feature bit set, and with a SourceID AVP whose value matches the DiameterIdentity of the peer the request came from 💖
When an agent relays an answer message, a reporting node that supports the OC_PEER_REPORT feature MUST strip any SourceID AVP from the OC-Supported-Features AVP 😭
When sending an answer message, a reporting node that supports the OC_PEER_REPORT feature MUST determine whether the peer the answer is going to supports the OC_PEER_REPORT feature 👀
If the peer supports the OC_PEER_REPORT feature, then the reporting node MUST indicate support for the feature in the OC-Supported-Features AVP. 🫶
If the peer supports the OC_PEER_REPORT feature, then the reporting node MUST insert the SourceID AVP in the OC-Supported-Features AVP in the answer message. 💅
If the peer supports the OC_PEER_REPORT feature, then the reporting node MUST insert the OC-Peer-Algo AVP in the OC-Supported-Features AVP. The OC-Peer-Algo AVP MUST indicate the overload abatement algorithm that the reporting node wants the reacting nodes to use, should the reporting node send a Peer Overload report as a result of becoming overloaded. Ngl this whole section is so organized it's giving 🍓
6.2. Peer Overload Report Handling 🌸
This section defines the behavior for handling Overload reports of type "PEER-REPORT" ✨
6.2.1. Overload Control State 💜
This section describes the Overload Control State (OCS) that might be maintained by both the peer-report reporting node and the peer-report reacting node 🦋
This is an extension of the OCS handling defined in [RFC7683] 🫶
6.2.1.1. Reporting-Node Peer-Report OCS 🔥
A DOIC node that supports the OC_PEER_REPORT feature SHOULD maintain Reporting-Node OCS, as defined in [RFC7683] and extended here 💖
If different abatement-specific contents are sent to each peer, then the reporting node MUST maintain a separate reporting-node peer-report OCS entry for each peer that a Peer Overload report is sent to. 🌈
Note: The rate-overload abatement algorithm allows for different rates to be sent to each peer.
6.2.1.2. Reacting-Node Peer-Report OCS 🎀
In addition to the OCS maintained as defined in [RFC7683], a reacting node that supports the OC_PEER_REPORT feature maintains the following OCS per supported Diameter application:
- A peer-report OCS entry for each peer to which it sends requests
A peer-report OCS entry is identified by both the Application-ID and the peer's DiameterIdentity 🧚
The peer-report OCS entry includes the following information (the actual information stored is an implementation decision):
- Sequence number (as received in the
OC-OLRAVP) - Time of expiry (derived from the
OC-Validity-DurationAVP received in theOC-OLRAVP and the time of reception of the message carrying theOC-OLRAVP) - Selected abatement algorithm (as received in the
OC-Supported-FeaturesAVP) - Input data specific to the abatement algorithm (as received in the
OC-OLRAVP, e.g.,OC-Reduction-Percentagefor the loss abatement algorithm)
6.2.2. Reporting-Node Maintenance of Peer-Report OCS 💅
All rules for managing the reporting-node OCS entries defined in [RFC7683] apply to the peer report 👑
6.2.3. Reacting-Node Maintenance of Peer-Report OCS ✨
okay bestie, this is where the reacting node gets to be the responsible one 💅 when it gets an OC-OLR AVP with a report type of "PEER-REPORT", it MUST figure out if the report actually came from the Diameter peer that sent it to you 🕵️♀️
if the SourceID matches the DiameterIdentity of the Diameter peer that the response message came from, then yep, the report was generated by a Diameter peer 🫶
but if the SourceID does NOT match that DiameterIdentity, the reacting node MUST ignore the Overload report. no cap, that's a sus report 🙈
Note: Under normal circumstances, a Diameter node will not add a peer report when sending to a peer that does not support this extension. This requirement is to handle the case where peer reports are erroneously or maliciously inserted into response messages.
once you know the report came from a real peer, the reacting node MUST work out whether it's for an existing or a brand-new overload condition 👀
it's for an existing one if the reacting node already has an OCS that matches the received peer report. for a peer report, that means the Application-ID and the peer's DiameterIdentity line up with an existing OCS entry 💖
if it's an existing overload condition, the reacting node MUST determine if the peer report is a retransmission or an update to the existing OLR 🔁
- if the sequence number on the received peer report is greater than the sequence number stored in the matching OCS entry, the reacting node MUST update the matching OCS entry ✨
- if the sequence number is less than or equal to the sequence number in the matching OCS entry, the reacting node MUST silently ignore the received peer report, and the matching OCS MUST NOT be updated in this case 🙅♀️
if the received peer report is for a new overload condition, the reacting node MUST generate a new OCS entry for it 🎀 for a peer report, that means making an OCS entry with a DiameterIdentity taken from the SourceID AVP in the received OC-OLR AVP 🧚
and if the received peer report has a validity duration of zero ("0"), the reacting node MUST update the OCS entry as being expired. the end of the overload, served 🌸
also, the reacting node does NOT delete an OCS just because it got an answer message with no OC-OLR AVP in it. no OLR just means "no change", so chill 😌
last thing: the reacting node sets the abatement algorithm based on the OC-Peer-Algo AVP in the received OC-Supported-Features AVP 🦋
6.2.4. Peer-Report Reporting-Node Behavior 💅
when there's an existing reporting-node peer-report OCS entry, the reporting node MUST include an OC-OLR AVP with a report type of "PEER-REPORT" using the contents of that OCS entry, and it has to do this in all answer messages it sends to peers that support the OC_PEER_REPORT feature 🎀
Note: The reporting node figures out whether a peer supports the OC_PEER_REPORT feature from the indication recorded in the reporting node's transaction state. 🧠
the reporting node MUST include its DiameterIdentity in the SourceID AVP inside the OC-OLR AVP 🪪 DOIC nodes that support OC_PEER_REPORT use this to check whether the report came from a Diameter peer, so it's a big deal 💜
the reporting agent must follow all the other overload reporting-node behaviors spelled out in the DOIC specification too 📜
6.2.5. Peer-Report Reacting-Node Behavior 🔥
a reacting node that supports this extension MUST be able to receive multiple Overload reports in one message 🫧 that message might have a Host Overload report, a Realm Overload report, and/or a Peer Overload report, so it's giving buffet energy 🍓
when a reacting node sends a request, it MUST check whether that request matches an active OCS 👀
in every case, if the reacting node is an agent, it MUST strip the Peer-Report OC-OLR AVP from the message 🧹
if the request matches an active OCS, the reacting node MUST apply abatement treatment to it. the treatment depends on the abatement algorithm in that OCS 💫
for Peer Overload Reports, diversion is the preferred abatement treatment. so the reacting node SHOULD try to divert the requests that need abatement to other peers 🦋
if there's not enough capacity to divert the abated traffic, the reacting node MUST throttle the necessary requests so they fit within the available capacity of the peers that can handle them 🌊
if the abatement treatment ends up throttling a request and the reacting node is an agent, then the agent MUST send an appropriate error response, as defined in [RFC7683] 💌
and if the OCS entry's validity duration runs out, or has a validity duration of zero ("0"), which means the reporting node has explicitly signaled the end of the overload condition, then the abatement tied to that OCS entry MUST be ended in a controlled fashion 🌈
7. Peer-Report AVPs 🎀
7.1. OC-Supported-Features AVP 💖
this extension adds a brand-new feature to the OC-Feature-Vector AVP 🧚 this feature shows that a node can handle Peer Overload reports, and agents use those to say "hey, my peer needs to abate" 🫶
a supporting node must also include the SourceID AVP in the OC-Supported-Features capability AVP 🪪
this AVP holds the DiameterIdentity of the node that supports the OC_PEER_REPORT feature 🙌 it's how you figure out whether an adjacent node supports Peer Overload reports. the value should be the same Diameter identity that's used in the Diameter Capabilities Exchange procedure from [RFC7683] ✨
this extension also adds the OC-Peer-Algo AVP to the OC-Supported-Features AVP 🌸 a reporting node uses it to say which abatement algorithm it'll use for Peer Overload reports 💜
OC-Supported-Features ::= < AVP Header: 621 >
[ OC-Feature-Vector ]
[ SourceID ]
[ OC-Peer-Algo]
* [ AVP ]7.1.1. OC-Feature-Vector AVP 🦋
the Peer-Report feature defines a new feature bit for the OC-Feature-Vector AVP 🫧
OC_PEER_REPORT (0x0000000000000010)
When this flag is set by a DOIC node, it indicates that the DOIC node supports the Peer Overload report type. 🎯
7.1.2. OC-Peer-Algo AVP 🍓
the OC-Peer-Algo AVP (AVP code 648) is of type Unsigned64 and holds a 64-bit flags field of announced capabilities for a DOIC node 💅 the value zero ("0") is reserved, so don't use it, bestie 🚫
feature bits that are defined for the OC-Feature-Vector AVP and linked to overload abatement algorithms get reused for this AVP 🔁
7.2. OC-OLR AVP 🌈
this extension doesn't change the OC_Sequence_Number or OC_Validity_Duration AVPs in the OC-OLR AVP 🙌 they can be used in Peer Overload reports too 💖
the OC_PEER_REPORT feature extends the base Diameter overload spec by defining a brand-new Overload report type, "PEER-REPORT" ✨ check Section 7.6 of [RFC7683] for the description of the OC-Report-Type AVP 📖
the peer report MUST also include the Diameter identity of the agent that generated the report 🪪 this matters for the case where there's a non-supporting agent between the reporting node and the reacting node. without the agent that generated the peer report, the reacting node could wrongly assume the report applied to that non-supporting node 😬 that could mean unnecessary traffic gets diverted or throttled, and nobody wants that 🙈
the SourceID AVP is what carries this DiameterIdentity inside the OC-OLR AVP 🫶
OC-OLR ::= < AVP Header: 623 >
< OC-Sequence-Number >
< OC-Report-Type >
[ OC-Reduction-Percentage ]
[ OC-Validity-Duration ]
[ SourceID ]
* [ AVP ]7.2.1. OC-Report-Type AVP 👑
this is the new report type defined for the OC-Report-Type AVP 💫
PEER_REPORT 2: the overload treatment should apply to all requests bound for the peer identified in the Overload report. if the peer identified in the peer report is not a peer of the reacting endpoint, then the peer report should be stripped and not acted upon 🧹
7.3. SourceID AVP 🪪
the SourceID AVP (AVP code 649) is of type DiameterIdentity, and a Diameter node inserts it to show where the AVP it's part of came from 🌷
for peer reports, the SourceID AVP shows either the node that supports this feature (in the OC-Supported-Features AVP), or the node that generated an overload report with a report type of "PEER-REPORT" (in the OC-OLR AVP) 💖
it holds the DiameterIdentity of the node that inserted it. other Diameter nodes use this to figure out which node inserted the enclosing AVP that contains the SourceID AVP 🧚
7.4. Attribute-Value Pair Flag Rules 📋
+---------+
|AVP flag |
|rules |
+----+----+
AVP Section | |MUST|
Attribute Name Code Defined Value Type |MUST| NOT|
+--------------------------------------------------------+----+----+
|OC-Peer-Algo 648 7.1.2 Unsigned64 | | V |
|SourceID 649 7.3 DiameterIdentity | | V |
+--------------------------------------------------------+----+----+8. IANA Considerations 🌸
IANA has registered the following values in the "Authentication, Authorization, and Accounting (AAA) Parameters" registry 📝
two new AVP codes are defined in Section 7.4 ✨
the values used for the OC-Peer-Algo AVP are a subset of the "OC-Feature-Vector AVP Values (code 622)" registry 🦋 only the values in that registry that apply to overload abatement algorithms apply to the OC-Peer-Algo AVP 🫶
a new OC-Feature-Vector AVP value is defined in Section 7.1.1 💖
a new OC-Report-Type AVP value is defined in Section 7.2.1 👑
9. Security Considerations 🔐
okay, this part is serious, so let's be real 🙏 agent overload is an extension to the base Diameter Overload mechanism. because of that, all of the security considerations outlined in [RFC7683] apply to the agent overload scenarios 💀
it's possible that the malicious insertion of a peer report could have a bigger impact on a Diameter network, because agents can be concentration points in a Diameter network 😭 where an endpoint report would only impact the traffic sent to a single Diameter Server, for example, a peer report could throttle all traffic to the Diameter network 🚨
this impact is amplified in a Diameter agent that sits at the edge of a Diameter network and serves as the entry point from all other Diameter networks 🫠
the impacts of this attack, as well as the mitigation strategies, are the same as those outlined in [RFC7683] 🛡️
10. References 📚
10.1. Normative References
okay so these are the docs this spec literally can't work without 🎀 you need all three to actually build it, no skipping!
[RFC6733] Fajardo, V., Ed., Arkko, J., Loughney, J., and G. Zorn,
Ed., "Diameter Base Protocol", RFC 6733,
DOI 10.17487/RFC6733, October 2012,
<https://www.rfc-editor.org/info/rfc6733>.[RFC7683] Korhonen, J., Ed., Donovan, S., Ed., Campbell, B., and L.
Morand, "Diameter Overload Indication Conveyance",
RFC 7683, DOI 10.17487/RFC7683, October 2015,
<https://www.rfc-editor.org/info/rfc7683>.[RFC8582] Donovan, S., Ed. and E. Noel, "Diameter Overload Rate
Control", RFC 8582, DOI 10.17487/RFC8582, August 2019,
<https://www.rfc-editor.org/info/rfc8582>.10.2. Informative References
these ones are more like the backstage pass 🌸 super good context, not required reading to ship the thing
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.[RFC7068] McMurry, E. and B. Campbell, "Diameter Overload Control
Requirements", RFC 7068, DOI 10.17487/RFC7068, November
2013, <https://www.rfc-editor.org/info/rfc7068>.[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.Acknowledgements 🫶
bestie, the author has to shout out the people who came before 😭 Adam Roach and Eric McMurry did the big work of defining a full, comprehensive Diameter overload solution in draft-roach-dime-overload-ctrl-03.txt, and that's giving foundation energy 👑
The author also thanks Ben Campbell for his insights and for reviewing early versions of this document. iconic supportive friend behavior 💜
Author's Address 🦋
Steve Donovan
Oracle
7460 Warren Parkway, Suite 300
Frisco, Texas 75034
United States of America
Email: srdonovan@usdonovans.com📦 where this page comes from
- ietf: rfc8581 2019-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms