Diameter caps update: The Diameter Capabilities Update Application
A Diameter application that lets two peers update their advertised capabilities without tearing down the connection.
Jiao, K. and G. Zorn, "The Diameter Capabilities Update Application", RFC 6737, DOI 10.17487/RFC6737, October 2012, <https://www.rfc-editor.org/info/rfc6737>.
@misc{rfc6737,
series = {Request for Comments},
number = 6737,
howpublished = {RFC 6737},
publisher = {RFC Editor},
doi = {10.17487/RFC6737},
url = {https://www.rfc-editor.org/info/rfc6737},
author = {K. Jiao and G. Zorn},
title = {{The Diameter Capabilities Update Application}},
pagetotal = 6,
year = 2012,
month = oct,
} RFC text
Contents
Internet Engineering Task Force (IETF) K. Jiao
Request for Comments: 6737 Huawei
Category: Standards Track G. Zorn
ISSN: 2070-1721 Network Zen
October 2012
The Diameter Capabilities Update Application
Abstract
This document defines a new Diameter application and associated
Command Codes. The Capabilities Update application is intended to
allow the dynamic update of certain Diameter peer capabilities while
the peer-to-peer connection is in the open state.
Status of This Memo
This is an Internet Standards Track document.
This document is a product of the Internet Engineering Task Force
(IETF). It represents the consensus of the IETF community. It has
received public review and has been approved for publication by the
Internet Engineering Steering Group (IESG). Further information on
Internet Standards is available in Section 2 of RFC 5741.
Information about the current status of this document, any errata,
and how to provide feedback on it may be obtained at
http://www.rfc-editor.org/info/rfc6737.
Copyright Notice
Copyright (c) 2012 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Specification of Requirements . . . . . . . . . . . . . . . . . 2
3. Diameter Protocol Considerations . . . . . . . . . . . . . . . 3
4. Capabilities Update . . . . . . . . . . . . . . . . . . . . . . 3
4.1. Command Code Values . . . . . . . . . . . . . . . . . . . . 4
4.1.1. Capabilities-Update-Request . . . . . . . . . . . . . . 4
4.1.2. Capabilities-Update-Answer . . . . . . . . . . . . . . 5
5. Security Considerations . . . . . . . . . . . . . . . . . . . . 5
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 5
6.1. Application Identifier . . . . . . . . . . . . . . . . . . 5
6.2. Command Codes . . . . . . . . . . . . . . . . . . . . . . . 5
7. Contributors . . . . . . . . . . . . . . . . . . . . . . . . . 5
8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 5
9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 6
9.1. Normative References . . . . . . . . . . . . . . . . . . . 6
9.2. Informative References . . . . . . . . . . . . . . . . . . 6
1. Introduction
Capabilities exchange is an important component of the Diameter base
protocol [RFC6733], allowing peers to exchange identities and
Diameter capabilities (protocol version number, supported Diameter
applications, security mechanisms, etc.). As defined in RFC 3588,
however, the capabilities exchange process takes place only once, at
the inception of a transport connection between a given pair of
peers. Therefore, if a peer's capabilities change (due to a software
update, for example), the existing connection(s) must be torn down
(along with all of the associated user sessions) and restarted before
the modified capabilities can be advertised.
This document defines a new Diameter application intended to allow
the dynamic update of a subset of Diameter peer capabilities over an
existing connection. Because the Capabilities Update application
specified herein operates over an existing transport connection,
modification of certain capabilities is prohibited. Specifically,
modifying the security mechanism in use is not allowed; if the
security method used between a pair of peers is changed, the affected
connection MUST be restarted.
2. Specification of Requirements
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [RFC2119].
3. Diameter Protocol Considerations
This section details the relationship of the Diameter Capabilities
Update application to the Diameter base protocol.
This document specifies Diameter Application-Id 10. Diameter nodes
conforming to this specification MUST advertise support by including
the value 10 in the Auth-Application-Id of the Capabilities-Exchange-
Request (CER) and Capabilities-Exchange-Answer (CEA) commands
[RFC6733].
4. Capabilities Update
When the capabilities of a Diameter node conforming to this
specification change, the node MUST notify all of the nodes with
which it has an open transport connection and which have also
advertised support for the Capabilities Update application using the
Capabilities-Update-Request (CUR) message (Section 4.1.1). This
message allows the update of a peer's capabilities (supported
Diameter applications, etc.).
A Diameter node only issues a given command to those peers that have
advertised support for the Diameter application that defines the
command; a Diameter node must cache the supported applications in
order to ensure that unrecognized commands and/or Attribute-Value
Pairs (AVPs) are not unnecessarily sent to a peer.
The receiver of the CUR MUST determine common applications by
computing the intersection of its own set of supported Application
Ids against all of the Application-Id AVPs (Auth-Application-Id,
Acct-Application-Id, and Vendor-Specific-Application-Id) present in
the CUR. The value of the Vendor-Id AVP in the Vendor-Specific-
Application-Id MUST NOT be used during computation.
If the receiver of a CUR does not have any applications in common
with the sender, then it MUST return a Capabilities-Update-Answer
(CUA) (Section 4.1.2) with the Result-Code AVP set to
DIAMETER_NO_COMMON_APPLICATION [RFC6733], and it SHOULD disconnect
the transport-layer connection. However, if active sessions are
using the connection, peers MAY delay disconnection until the
sessions can be redirected or gracefully terminated. Note that
receiving a CUA from a peer advertising itself as a relay (see
[RFC6733], Section 2.4) MUST be interpreted as having common
applications with the peer.
As for CER/CEA messages, the CUR and CUA messages MUST NOT be
proxied, redirected, or relayed.
Even though the CUR/CUA messages cannot be proxied, it is still
possible for an upstream agent to receive a message for which there
are no peers available to handle the application that corresponds to
the Command Code. This could happen if, for example, the peers are
too busy or down. In such instances, the 'E' bit MUST be set in the
answer message with the Result-Code AVP set to
DIAMETER_UNABLE_TO_DELIVER to inform the downstream peer to take
action (e.g., re-routing requests to an alternate peer).
4.1. Command Code Values
This section defines Command Code [RFC6733] values that MUST be
supported by all Diameter implementations conforming to this
specification. The following Command Codes are defined in this
document: Capabilities-Update-Request (CUR, Section 4.1.1), and
Capabilities-Update-Answer (CUA, Section 4.1.2). The Diameter
Command Code Format (CCF) ([RFC6733], Section 3.2) is used in the
definitions.
4.1.1. Capabilities-Update-Request
The Capabilities-Update-Request (CUR), indicated by the Command Code
set to 328 and the Command Flags' 'R' bit set, is sent to update
local capabilities. Upon detection of a transport failure, this
message MUST NOT be sent to an alternate peer.
When Diameter is run over the Stream Control Transmission Protocol
(SCTP) [RFC4960], which allows connections to span multiple
interfaces and multiple IP addresses, the Capabilities-Update-Request
message MUST contain one Host-IP-Address AVP for each potential IP
address that may be locally used when transmitting Diameter messages.
Message Format
<CUR> ::= < Diameter Header: 328, REQ >
{ Origin-Host }
{ Origin-Realm }
1* { Host-IP-Address }
{ Vendor-Id }
{ Product-Name }
[ Origin-State-Id ]
* [ Supported-Vendor-Id ]
* [ Auth-Application-Id ]
* [ Acct-Application-Id ]
* [ Vendor-Specific-Application-Id ]
[ Firmware-Revision ]
* [ AVP ]
4.1.2. Capabilities-Update-Answer
The Capabilities-Update-Answer, indicated by the Command Code set to
328 and the Command Flags' 'R' bit cleared, is sent in response to a
CUR message.
Message Format
<CUA> ::= < Diameter Header: 328 >
{ Origin-Host }
{ Origin-Realm }
{ Result-Code }
[ Error-Message ]
* [ AVP ]
5. Security Considerations
The security considerations applicable to the Diameter base protocol
[RFC6733] are also applicable to this document.
6. IANA Considerations
This section explains the criteria to be used by the IANA for
assignment of numbers within namespaces used within this document.
6.1. Application Identifier
This specification assigns the value 10 (Diameter Capabilities
Update) from the Application Identifiers namespace [RFC6733]. See
Section 3 for the assignment of the namespace in this specification.
6.2. Command Codes
This specification assigns the value 328 (Capabilities-Update-
Request/Capabilities-Update-Answer (CUR/CUA)) from the Command Codes
namespace [RFC6733]. See Section 4.1 for the assignment of the
namespace in this specification.
7. Contributors
This document is based upon work done by Tina Tsou.
8. Acknowledgements
Thanks to Sebastien Decugis, Niklas Neumann, Subash Comerica, Lionel
Morand, Dan Romascanu, Dan Harkins, and Ravi for helpful review and
discussion.
9. References
9.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC6733] Fajardo, V., Arkko, J., Loughney, J., and G. Zorn,
"Diameter Base Protocol", RFC 6733, October 2012.
9.2. Informative References
[RFC4960] Stewart, R., "Stream Control Transmission Protocol",
RFC 4960, September 2007.
Authors' Addresses
Jiao Kang
Huawei Technologies
Section F1, Huawei Industrial Base
Bantian, Longgang District
Shenzhen 518129
P.R. China
EMail: kangjiao@huawei.com
Glen Zorn
Network Zen
227/358 Thanon Sanphawut
Bang Na, Bangkok 10260
Thailand
Phone: +66 (0) 909-201060
EMail: glenzorn@gmail.com
AI ELI5
On this page
§1The Problem With One-Time Capabilities Exchange
Capabilities exchange is an important part of the Diameter base protocol, RFC 6733. Peers swap identities and capabilities such as the protocol version number, supported Diameter applications and security mechanisms. As defined in RFC 3588, this happens only once, when a transport connection between a pair of peers begins.
So if a peer's capabilities change, for example after a software update, the existing connections must be torn down along with all their user sessions and restarted before the new capabilities can be advertised. This document avoids that by defining a new application for updating a subset of capabilities over an existing connection.
Imagine you could only tell your friends what games you own when you first walk in. To announce a new game you would have to leave and come back in. This memo lets you just say it.
§1.1What Cannot Be Updated
Because the application runs over an already open transport connection, changing some capabilities is prohibited. Specifically, the security mechanism in use cannot be modified this way. If the security method between a pair of peers changes, the affected connection MUST be restarted.
You can announce new skills while talking, but if you want to switch to a secret code, you have to start the conversation over.
§2Advertising Support
The application uses Diameter Application-Id 10. A node that conforms to this specification MUST advertise support by putting the value 10 in the Auth-Application-Id of its Capabilities-Exchange-Request (CER) and Capabilities-Exchange-Answer (CEA) commands from RFC 6733.
A node only sends a given command to peers that advertised support for the application that defines it. It must cache the supported applications so that unrecognized commands and Attribute-Value Pairs (AVPs) are not sent to a peer needlessly.
When two peers first meet, each says "I know the capabilities-update trick" by listing the number 10. Only then do they use it with each other.
§3How an Update Works
When the capabilities of a conforming node change, it MUST notify every node that has an open transport connection to it and has also advertised support for this application. The notice is a Capabilities-Update-Request (CUR).
The receiver works out the common applications by intersecting its own supported Application Ids with all the Application-Id AVPs in the CUR (Auth-Application-Id, Acct-Application-Id and Vendor-Specific-Application-Id). The Vendor-Id inside the Vendor-Specific-Application-Id MUST NOT be used in this computation.
If there are no applications in common, the receiver MUST return a Capabilities-Update-Answer (CUA) with Result-Code set to DIAMETER_NO_COMMON_APPLICATION and SHOULD disconnect the transport connection. If active sessions use the connection, peers MAY delay disconnecting until the sessions can be redirected or gracefully terminated. A CUA from a peer that advertises itself as a relay MUST be treated as meaning there are common applications.
When something changes, you tell each friend who knows the trick. They check which games you both still have. If you share none, they politely end the chat.
- CUR (328, R bit set)Sent over the open connection to announce new capabilities.
- CUA (328)Answer with a Result-Code.
§3.1No Proxying and Delivery Failures
Like CER and CEA, the CUR and CUA messages MUST NOT be proxied, redirected or relayed. Even so, an upstream agent might receive a message for which no peer is available to handle the application for that Command Code, for example because peers are too busy or down. In that case the E bit MUST be set in the answer, with Result-Code set to DIAMETER_UNABLE_TO_DELIVER, so the downstream peer can act, for instance by re-routing requests to an alternate peer.
Upon detection of a transport failure, a CUR MUST NOT be sent to an alternate peer.
This message is only for the two friends talking directly, so nobody may pass it along. If a middleman cannot reach anyone, it says so and the sender can try another route for normal requests.
§4The CUR and CUA Messages
Both messages use Command Code 328. The Capabilities-Update-Request has the R bit set. It requires Origin-Host, Origin-Realm, Vendor-Id and Product-Name, and at least one Host-IP-Address. It may also carry Origin-State-Id, Supported-Vendor-Id, the application id AVPs, Firmware-Revision and further AVPs.
When Diameter runs over SCTP, which lets connections span multiple interfaces and IP addresses, the CUR MUST contain one Host-IP-Address AVP for each IP address that may be used locally when sending Diameter messages.
The Capabilities-Update-Answer has the R bit cleared and carries Origin-Host, Origin-Realm and Result-Code, with optional Error-Message. All conforming implementations MUST support both commands.
The request is a short note listing who you are and what you can do now. The answer is a short reply saying whether that worked.
- Application-Id 10Advertised in CER and CEA.
- Command Code 328Shared by CUR and CUA.
- No relayingCUR and CUA MUST NOT be proxied, redirected or relayed.
- Security changesChanging the security mechanism requires restarting the connection.
§5Security and IANA
The security considerations of the Diameter base protocol, RFC 6733, also apply to this document.
IANA assigned the value 10 (Diameter Capabilities Update) from the Application Identifiers namespace and the value 328 (CUR/CUA) from the Command Codes namespace.
The same safety rules as ordinary Diameter apply. The two numbers 10 and 328 were officially reserved for this feature.