RFC 3588
Diameter Base Protocol
2.8. Role of Diameter Agents
In addition to client and servers, the Diameter protocol introduces relay, proxy, redirect, and translation agents, each of which is defined in Section 1.3. These Diameter agents are useful for several reasons: - They can distribute administration of systems to a configurable grouping, including the maintenance of security associations. - They can be used for concentration of requests from an number of co-located or distributed NAS equipment sets to a set of like user groups. - They can do value-added processing to the requests or responses.
- They can be used for load balancing.
- A complex network will have multiple authentication sources, they
can sort requests and forward towards the correct target.
The Diameter protocol requires that agents maintain transaction
state, which is used for failover purposes. Transaction state
implies that upon forwarding a request, its Hop-by-Hop identifier is
saved; the field is replaced with a locally unique identifier, which
is restored to its original value when the corresponding answer is
received. The request's state is released upon receipt of the
answer. A stateless agent is one that only maintains transaction
state.
The Proxy-Info AVP allows stateless agents to add local state to a
Diameter request, with the guarantee that the same state will be
present in the answer. However, the protocol's failover procedures
require that agents maintain a copy of pending requests.
A stateful agent is one that maintains session state information; by
keeping track of all authorized active sessions. Each authorized
session is bound to a particular service, and its state is considered
active either until it is notified otherwise, or by expiration. Each
authorized session has an expiration, which is communicated by
Diameter servers via the Session-Timeout AVP.
Maintaining session state MAY be useful in certain applications, such
as:
- Protocol translation (e.g., RADIUS <-> Diameter)
- Limiting resources authorized to a particular user
- Per user or transaction auditing
A Diameter agent MAY act in a stateful manner for some requests and
be stateless for others. A Diameter implementation MAY act as one
type of agent for some requests, and as another type of agent for
others.
2.8.1. Relay Agents
Relay Agents are Diameter agents that accept requests and route
messages to other Diameter nodes based on information found in the
messages (e.g., Destination-Realm). This routing decision is
performed using a list of supported realms, and known peers. This is
known as the Realm Routing Table, as is defined further in Section
2.7.
Relays MAY be used to aggregate requests from multiple Network Access Servers (NASes) within a common geographical area (POP). The use of Relays is advantageous since it eliminates the need for NASes to be configured with the necessary security information they would otherwise require to communicate with Diameter servers in other realms. Likewise, this reduces the configuration load on Diameter servers that would otherwise be necessary when NASes are added, changed or deleted. Relays modify Diameter messages by inserting and removing routing information, but do not modify any other portion of a message. Relays SHOULD NOT maintain session state but MUST maintain transaction state. +------+ ---------> +------+ ---------> +------+ | | 1. Request | | 2. Request | | | NAS | | DRL | | HMS | | | 4. Answer | | 3. Answer | | +------+ <--------- +------+ <--------- +------+ example.net example.net example.com Figure 2: Relaying of Diameter messages The example provided in Figure 2 depicts a request issued from NAS, which is an access device, for the user bob@example.com. Prior to issuing the request, NAS performs a Diameter route lookup, using "example.com" as the key, and determines that the message is to be relayed to DRL, which is a Diameter Relay. DRL performs the same route lookup as NAS, and relays the message to HMS, which is example.com's Home Diameter Server. HMS identifies that the request can be locally supported (via the realm), processes the authentication and/or authorization request, and replies with an answer, which is routed back to NAS using saved transaction state. Since Relays do not perform any application level processing, they provide relaying services for all Diameter applications, and therefore MUST advertise the Relay Application Identifier.2.8.2. Proxy Agents
Similarly to relays, proxy agents route Diameter messages using the Diameter Routing Table. However, they differ since they modify messages to implement policy enforcement. This requires that proxies maintain the state of their downstream peers (e.g., access devices) to enforce resource usage, provide admission control, and provisioning.
It is important to note that although proxies MAY provide a value-add function for NASes, they do not allow access devices to use end-to- end security, since modifying messages breaks authentication. Proxies MAY be used in call control centers or access ISPs that provide outsourced connections, they can monitor the number and types of ports in use, and make allocation and admission decisions according to their configuration. Proxies that wish to limit resources MUST maintain session state. All proxies MUST maintain transaction state. Since enforcing policies requires an understanding of the service being provided, Proxies MUST only advertise the Diameter applications they support.2.8.3. Redirect Agents
Redirect agents are useful in scenarios where the Diameter routing configuration needs to be centralized. An example is a redirect agent that provides services to all members of a consortium, but does not wish to be burdened with relaying all messages between realms. This scenario is advantageous since it does not require that the consortium provide routing updates to its members when changes are made to a member's infrastructure. Since redirect agents do not relay messages, and only return an answer with the information necessary for Diameter agents to communicate directly, they do not modify messages. Since redirect agents do not receive answer messages, they cannot maintain session state. Further, since redirect agents never relay requests, they are not required to maintain transaction state. The example provided in Figure 3 depicts a request issued from the access device, NAS, for the user bob@example.com. The message is forwarded by the NAS to its relay, DRL, which does not have a routing entry in its Diameter Routing Table for example.com. DRL has a default route configured to DRD, which is a redirect agent that returns a redirect notification to DRL, as well as HMS' contact information. Upon receipt of the redirect notification, DRL establishes a transport connection with HMS, if one doesn't already exist, and forwards the request to it.
+------+ | | | DRD | | | +------+ ^ | 2. Request | | 3. Redirection | | Notification | v +------+ ---------> +------+ ---------> +------+ | | 1. Request | | 4. Request | | | NAS | | DRL | | HMS | | | 6. Answer | | 5. Answer | | +------+ <--------- +------+ <--------- +------+ example.net example.net example.com Figure 3: Redirecting a Diameter Message Since redirect agents do not perform any application level processing, they provide relaying services for all Diameter applications, and therefore MUST advertise the Relay Application Identifier.2.8.4. Translation Agents
A translation agent is a device that provides translation between two protocols (e.g., RADIUS<->Diameter, TACACS+<->Diameter). Translation agents are likely to be used as aggregation servers to communicate with a Diameter infrastructure, while allowing for the embedded systems to be migrated at a slower pace. Given that the Diameter protocol introduces the concept of long-lived authorized sessions, translation agents MUST be session stateful and MUST maintain transaction state. Translation of messages can only occur if the agent recognizes the application of a particular request, and therefore translation agents MUST only advertise their locally supported applications. +------+ ---------> +------+ ---------> +------+ | | RADIUS Request | | Diameter Request | | | NAS | | TLA | | HMS | | | RADIUS Answer | | Diameter Answer | | +------+ <--------- +------+ <--------- +------+ example.net example.net example.com Figure 4: Translation of RADIUS to Diameter
2.9. End-to-End Security Framework
End-to-end security services include confidentiality and message origin authentication. These services are provided by supporting AVP integrity and confidentiality between two peers, communicating through agents. End-to-end security is provided via the End-to-End security extension, described in [AAACMS]. The circumstances requiring the use of end-to-end security are determined by policy on each of the peers. Security policies, which are not the subject of standardization, may be applied by next hop Diameter peer or by destination realm. For example, where TLS or IPsec transmission- level security is sufficient, there may be no need for end-to-end security. End-to-end security policies include: - Never use end-to-end security. - Use end-to-end security on messages containing sensitive AVPs. Which AVPs are sensitive is determined by service provider policy. AVPs containing keys and passwords should be considered sensitive. Accounting AVPs may be considered sensitive. Any AVP for which the P bit may be set or which may be encrypted may be considered sensitive. - Always use end-to-end security. It is strongly RECOMMENDED that all Diameter implementations support end-to-end security.2.10. Diameter Path Authorization
As noted in Section 2.2, Diameter requires transmission level security to be used on each connection (TLS or IPsec). Therefore, each connection is authenticated, replay and integrity protected and confidential on a per-packet basis. In addition to authenticating each connection, each connection as well as the entire session MUST also be authorized. Before initiating a connection, a Diameter Peer MUST check that its peers are authorized to act in their roles. For example, a Diameter peer may be authentic, but that does not mean that it is authorized to act as a Diameter Server advertising a set of Diameter applications.
Prior to bringing up a connection, authorization checks are performed at each connection along the path. Diameter capabilities negotiation (CER/CEA) also MUST be carried out, in order to determine what Diameter applications are supported by each peer. Diameter sessions MUST be routed only through authorized nodes that have advertised support for the Diameter application required by the session. As noted in Section 6.1.8, a relay or proxy agent MUST append a Route-Record AVP to all requests forwarded. The AVP contains the identity of the peer the request was received from. The home Diameter server, prior to authorizing a session, MUST check the Route-Record AVPs to make sure that the route traversed by the request is acceptable. For example, administrators within the home realm may not wish to honor requests that have been routed through an untrusted realm. By authorizing a request, the home Diameter server is implicitly indicating its willingness to engage in the business transaction as specified by the contractual relationship between the server and the previous hop. A DIAMETER_AUTHORIZATION_REJECTED error message (see Section 7.1.5) is sent if the route traversed by the request is unacceptable. A home realm may also wish to check that each accounting request message corresponds to a Diameter response authorizing the session. Accounting requests without corresponding authorization responses SHOULD be subjected to further scrutiny, as should accounting requests indicating a difference between the requested and provided service. Similarly, the local Diameter agent, on receiving a Diameter response authorizing a session, MUST check the Route-Record AVPs to make sure that the route traversed by the response is acceptable. At each step, forwarding of an authorization response is considered evidence of a willingness to take on financial risk relative to the session. A local realm may wish to limit this exposure, for example, by establishing credit limits for intermediate realms and refusing to accept responses which would violate those limits. By issuing an accounting request corresponding to the authorization response, the local realm implicitly indicates its agreement to provide the service indicated in the authorization response. If the service cannot be provided by the local realm, then a DIAMETER_UNABLE_TO_COMPLY error message MUST be sent within the accounting request; a Diameter client receiving an authorization response for a service that it cannot perform MUST NOT substitute an alternate service, and then send accounting requests for the alternate service instead.
3. Diameter Header
A summary of the Diameter header format is shown below. The fields are transmitted in network byte order. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Version | Message Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | command flags | Command-Code | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Application-ID | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Hop-by-Hop Identifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | End-to-End Identifier | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AVPs ... +-+-+-+-+-+-+-+-+-+-+-+-+- Version This Version field MUST be set to 1 to indicate Diameter Version 1. Message Length The Message Length field is three octets and indicates the length of the Diameter message including the header fields. Command Flags The Command Flags field is eight bits. The following bits are assigned: 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ |R P E T r r r r| +-+-+-+-+-+-+-+-+ R(equest) - If set, the message is a request. If cleared, the message is an answer. P(roxiable) - If set, the message MAY be proxied, relayed or redirected. If cleared, the message MUST be locally processed. E(rror) - If set, the message contains a protocol error, and the message will not conform to the ABNF described for this command. Messages with the 'E'
bit set are commonly referred to as error
messages. This bit MUST NOT be set in request
messages. See Section 7.2.
T(Potentially re-transmitted message)
- This flag is set after a link failover procedure,
to aid the removal of duplicate requests. It is
set when resending requests not yet acknowledged,
as an indication of a possible duplicate due to a
link failure. This bit MUST be cleared when
sending a request for the first time, otherwise
the sender MUST set this flag. Diameter agents
only need to be concerned about the number of
requests they send based on a single received
request; retransmissions by other entities need
not be tracked. Diameter agents that receive a
request with the T flag set, MUST keep the T flag
set in the forwarded request. This flag MUST NOT
be set if an error answer message (e.g., a
protocol error) has been received for the earlier
message. It can be set only in cases where no
answer has been received from the server for a
request and the request is sent again. This flag
MUST NOT be set in answer messages.
r(eserved) - these flag bits are reserved for future use, and
MUST be set to zero, and ignored by the receiver.
Command-Code
The Command-Code field is three octets, and is used in order to
communicate the command associated with the message. The 24-bit
address space is managed by IANA (see Section 11.2.1).
Command-Code values 16,777,214 and 16,777,215 (hexadecimal values
FFFFFE -FFFFFF) are reserved for experimental use (See Section
11.3).
Application-ID
Application-ID is four octets and is used to identify to which
application the message is applicable for. The application can be
an authentication application, an accounting application or a
vendor specific application. See Section 11.3 for the possible
values that the application-id may use.
The application-id in the header MUST be the same as what is
contained in any relevant AVPs contained in the message.
Hop-by-Hop Identifier
The Hop-by-Hop Identifier is an unsigned 32-bit integer field (in
network byte order) and aids in matching requests and replies.
The sender MUST ensure that the Hop-by-Hop identifier in a request
is unique on a given connection at any given time, and MAY attempt
to ensure that the number is unique across reboots. The sender of
an Answer message MUST ensure that the Hop-by-Hop Identifier field
contains the same value that was found in the corresponding
request. The Hop-by-Hop identifier is normally a monotonically
increasing number, whose start value was randomly generated. An
answer message that is received with an unknown Hop-by-Hop
Identifier MUST be discarded.
End-to-End Identifier
The End-to-End Identifier is an unsigned 32-bit integer field (in
network byte order) and is used to detect duplicate messages.
Upon reboot implementations MAY set the high order 12 bits to
contain the low order 12 bits of current time, and the low order
20 bits to a random value. Senders of request messages MUST
insert a unique identifier on each message. The identifier MUST
remain locally unique for a period of at least 4 minutes, even
across reboots. The originator of an Answer message MUST ensure
that the End-to-End Identifier field contains the same value that
was found in the corresponding request. The End-to-End Identifier
MUST NOT be modified by Diameter agents of any kind. The
combination of the Origin-Host (see Section 6.3) and this field is
used to detect duplicates. Duplicate requests SHOULD cause the
same answer to be transmitted (modulo the hop-by-hop Identifier
field and any routing AVPs that may be present), and MUST NOT
affect any state that was set when the original request was
processed. Duplicate answer messages that are to be locally
consumed (see Section 6.2) SHOULD be silently discarded.
AVPs
AVPs are a method of encapsulating information relevant to the
Diameter message. See Section 4 for more information on AVPs.
3.1. Command Codes
Each command Request/Answer pair is assigned a command code, and the sub-type (i.e., request or answer) is identified via the 'R' bit in the Command Flags field of the Diameter header. Every Diameter message MUST contain a command code in its header's Command-Code field, which is used to determine the action that is to be taken for a particular message. The following Command Codes are defined in the Diameter base protocol: Command-Name Abbrev. Code Reference -------------------------------------------------------- Abort-Session-Request ASR 274 8.5.1 Abort-Session-Answer ASA 274 8.5.2 Accounting-Request ACR 271 9.7.1 Accounting-Answer ACA 271 9.7.2 Capabilities-Exchange- CER 257 5.3.1 Request Capabilities-Exchange- CEA 257 5.3.2 Answer Device-Watchdog-Request DWR 280 5.5.1 Device-Watchdog-Answer DWA 280 5.5.2 Disconnect-Peer-Request DPR 282 5.4.1 Disconnect-Peer-Answer DPA 282 5.4.2 Re-Auth-Request RAR 258 8.3.1 Re-Auth-Answer RAA 258 8.3.2 Session-Termination- STR 275 8.4.1 Request Session-Termination- STA 275 8.4.2 Answer
3.2. Command Code ABNF specification
Every Command Code defined MUST include a corresponding ABNF specification, which is used to define the AVPs that MUST or MAY be present. The following format is used in the definition: command-def = command-name "::=" diameter-message command-name = diameter-name diameter-name = ALPHA *(ALPHA / DIGIT / "-") diameter-message = header [ *fixed] [ *required] [ *optional] [ *fixed] header = "<" Diameter-Header:" command-id [r-bit] [p-bit] [e-bit] [application-id]">" application-id = 1*DIGIT command-id = 1*DIGIT ; The Command Code assigned to the command r-bit = ", REQ" ; If present, the 'R' bit in the Command ; Flags is set, indicating that the message ; is a request, as opposed to an answer. p-bit = ", PXY" ; If present, the 'P' bit in the Command ; Flags is set, indicating that the message ; is proxiable. e-bit = ", ERR" ; If present, the 'E' bit in the Command ; Flags is set, indicating that the answer ; message contains a Result-Code AVP in ; the "protocol error" class. fixed = [qual] "<" avp-spec ">" ; Defines the fixed position of an AVP required = [qual] "{" avp-spec "}" ; The AVP MUST be present and can appear ; anywhere in the message.
optional = [qual] "[" avp-name "]"
; The avp-name in the 'optional' rule cannot
; evaluate to any AVP Name which is included
; in a fixed or required rule. The AVP can
; appear anywhere in the message.
qual = [min] "*" [max]
; See ABNF conventions, RFC 2234 Section 6.6.
; The absence of any qualifiers depends on whether
; it precedes a fixed, required, or optional
; rule. If a fixed or required rule has no
; qualifier, then exactly one such AVP MUST
; be present. If an optional rule has no
; qualifier, then 0 or 1 such AVP may be
; present.
;
; NOTE: "[" and "]" have a different meaning
; than in ABNF (see the optional rule, above).
; These braces cannot be used to express
; optional fixed rules (such as an optional
; ICV at the end). To do this, the convention
; is '0*1fixed'.
min = 1*DIGIT
; The minimum number of times the element may
; be present. The default value is zero.
max = 1*DIGIT
; The maximum number of times the element may
; be present. The default value is infinity. A
; value of zero implies the AVP MUST NOT be
; present.
avp-spec = diameter-name
; The avp-spec has to be an AVP Name, defined
; in the base or extended Diameter
; specifications.
avp-name = avp-spec / "AVP"
; The string "AVP" stands for *any* arbitrary
; AVP Name, which does not conflict with the
; required or fixed position AVPs defined in
; the command code definition.
The following is a definition of a fictitious command code:
Example-Request ::= < "Diameter-Header: 9999999, REQ, PXY >
{ User-Name }
* { Origin-Host }
* [ AVP
3.3. Diameter Command Naming Conventions
Diameter command names typically includes one or more English words
followed by the verb Request or Answer. Each English word is
delimited by a hyphen. A three-letter acronym for both the request
and answer is also normally provided.
An example is a message set used to terminate a session. The command
name is Session-Terminate-Request and Session-Terminate-Answer, while
the acronyms are STR and STA, respectively.
Both the request and the answer for a given command share the same
command code. The request is identified by the R(equest) bit in the
Diameter header set to one (1), to ask that a particular action be
performed, such as authorizing a user or terminating a session. Once
the receiver has completed the request it issues the corresponding
answer, which includes a result code that communicates one of the
following:
- The request was successful
- The request failed
- An additional request must be sent to provide information the peer
requires prior to returning a successful or failed answer.
- The receiver could not process the request, but provides
information about a Diameter peer that is able to satisfy the
request, known as redirect.
Additional information, encoded within AVPs, MAY also be included in
answer messages.
4. Diameter AVPs
Diameter AVPs carry specific authentication, accounting,
authorization, routing and security information as well as
configuration details for the request and reply.
Some AVPs MAY be listed more than once. The effect of such an AVP is
specific, and is specified in each case by the AVP description.
Each AVP of type OctetString MUST be padded to align on a 32-bit boundary, while other AVP types align naturally. A number of zero- valued bytes are added to the end of the AVP Data field till a word boundary is reached. The length of the padding is not reflected in the AVP Length field.4.1. AVP Header
The fields in the AVP header MUST be sent in network byte order. The format of the header is: 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | AVP Code | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |V M P r r r r r| AVP Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Vendor-ID (opt) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Data ... +-+-+-+-+-+-+-+-+ AVP Code The AVP Code, combined with the Vendor-Id field, identifies the attribute uniquely. AVP numbers 1 through 255 are reserved for backward compatibility with RADIUS, without setting the Vendor-Id field. AVP numbers 256 and above are used for Diameter, which are allocated by IANA (see Section 11.1). AVP Flags The AVP Flags field informs the receiver how each attribute must be handled. The 'r' (reserved) bits are unused and SHOULD be set to 0. Note that subsequent Diameter applications MAY define additional bits within the AVP Header, and an unrecognized bit SHOULD be considered an error. The 'P' bit indicates the need for encryption for end-to-end security. The 'M' Bit, known as the Mandatory bit, indicates whether support of the AVP is required. If an AVP with the 'M' bit set is received by a Diameter client, server, proxy, or translation agent and either the AVP or its value is unrecognized, the message MUST be rejected. Diameter Relay and redirect agents MUST NOT reject messages with unrecognized AVPs.
The 'M' bit MUST be set according to the rules defined for the AVP
containing it. In order to preserve interoperability, a Diameter
implementation MUST be able to exclude from a Diameter message any
Mandatory AVP which is neither defined in the base Diameter
protocol nor in any of the Diameter Application specifications
governing the message in which it appears. It MAY do this in one
of the following ways:
1) If a message is rejected because it contains a Mandatory AVP
which is neither defined in the base Diameter standard nor in
any of the Diameter Application specifications governing the
message in which it appears, the implementation may resend the
message without the AVP, possibly inserting additional standard
AVPs instead.
2) A configuration option may be provided on a system wide, per
peer, or per realm basis that would allow/prevent particular
Mandatory AVPs to be sent. Thus an administrator could change
the configuration to avoid interoperability problems.
Diameter implementations are required to support all Mandatory
AVPs which are allowed by the message's formal syntax and defined
either in the base Diameter standard or in one of the Diameter
Application specifications governing the message.
AVPs with the 'M' bit cleared are informational only and a
receiver that receives a message with such an AVP that is not
supported, or whose value is not supported, MAY simply ignore the
AVP.
The 'V' bit, known as the Vendor-Specific bit, indicates whether
the optional Vendor-ID field is present in the AVP header. When
set the AVP Code belongs to the specific vendor code address
space.
Unless otherwise noted, AVPs will have the following default AVP
Flags field settings:
The 'M' bit MUST be set. The 'V' bit MUST NOT be set.
AVP Length
The AVP Length field is three octets, and indicates the number of
octets in this AVP including the AVP Code, AVP Length, AVP Flags,
Vendor-ID field (if present) and the AVP data. If a message is
received with an invalid attribute length, the message SHOULD be
rejected.
4.1.1. Optional Header Elements
The AVP Header contains one optional field. This field is only present if the respective bit-flag is enabled. Vendor-ID The Vendor-ID field is present if the 'V' bit is set in the AVP Flags field. The optional four-octet Vendor-ID field contains the IANA assigned "SMI Network Management Private Enterprise Codes" [ASSIGNNO] value, encoded in network byte order. Any vendor wishing to implement a vendor-specific Diameter AVP MUST use their own Vendor-ID along with their privately managed AVP address space, guaranteeing that they will not collide with any other vendor's vendor-specific AVP(s), nor with future IETF applications. A vendor ID value of zero (0) corresponds to the IETF adopted AVP values, as managed by the IANA. Since the absence of the vendor ID field implies that the AVP in question is not vendor specific, implementations MUST NOT use the zero (0) vendor ID.4.2. Basic AVP Data Formats
The Data field is zero or more octets and contains information specific to the Attribute. The format and length of the Data field is determined by the AVP Code and AVP Length fields. The format of the Data field MUST be one of the following base data types or a data type derived from the base data types. In the event that a new Basic AVP Data Format is needed, a new version of this RFC must be created. OctetString The data contains arbitrary data of variable length. Unless otherwise noted, the AVP Length field MUST be set to at least 8 (12 if the 'V' bit is enabled). AVP Values of this type that are not a multiple of four-octets in length is followed by the necessary padding so that the next AVP (if any) will start on a 32-bit boundary. Integer32 32 bit signed value, in network byte order. The AVP Length field MUST be set to 12 (16 if the 'V' bit is enabled). Integer64 64 bit signed value, in network byte order. The AVP Length field MUST be set to 16 (20 if the 'V' bit is enabled).
Unsigned32
32 bit unsigned value, in network byte order. The AVP Length
field MUST be set to 12 (16 if the 'V' bit is enabled).
Unsigned64
64 bit unsigned value, in network byte order. The AVP Length
field MUST be set to 16 (20 if the 'V' bit is enabled).
Float32
This represents floating point values of single precision as
described by [FLOATPOINT]. The 32-bit value is transmitted in
network byte order. The AVP Length field MUST be set to 12 (16 if
the 'V' bit is enabled).
Float64
This represents floating point values of double precision as
described by [FLOATPOINT]. The 64-bit value is transmitted in
network byte order. The AVP Length field MUST be set to 16 (20 if
the 'V' bit is enabled).
Grouped
The Data field is specified as a sequence of AVPs. Each of these
AVPs follows - in the order in which they are specified -
including their headers and padding. The AVP Length field is set
to 8 (12 if the 'V' bit is enabled) plus the total length of all
included AVPs, including their headers and padding. Thus the AVP
length field of an AVP of type Grouped is always a multiple of 4.
4.3. Derived AVP Data Formats
In addition to using the Basic AVP Data Formats, applications may
define data formats derived from the Basic AVP Data Formats. An
application that defines new AVP Derived Data Formats MUST include
them in a section entitled "AVP Derived Data Formats", using the same
format as the definitions below. Each new definition must be either
defined or listed with a reference to the RFC that defines the
format.
The below AVP Derived Data Formats are commonly used by applications.
Address
The Address format is derived from the OctetString AVP Base
Format. It is a discriminated union, representing, for example a
32-bit (IPv4) [IPV4] or 128-bit (IPv6) [IPV6] address, most
significant octet first. The first two octets of the Address
AVP represents the AddressType, which contains an Address Family
defined in [IANAADFAM]. The AddressType is used to discriminate
the content and format of the remaining octets.
Time
The Time format is derived from the OctetString AVP Base Format.
The string MUST contain four octets, in the same format as the
first four bytes are in the NTP timestamp format. The NTP
Timestamp format is defined in chapter 3 of [SNTP].
This represents the number of seconds since 0h on 1 January 1900
with respect to the Coordinated Universal Time (UTC).
On 6h 28m 16s UTC, 7 February 2036 the time value will overflow.
SNTP [SNTP] describes a procedure to extend the time to 2104.
This procedure MUST be supported by all DIAMETER nodes.
UTF8String
The UTF8String format is derived from the OctetString AVP Base
Format. This is a human readable string represented using the
ISO/IEC IS 10646-1 character set, encoded as an OctetString using
the UTF-8 [UFT8] transformation format described in RFC 2279.
Since additional code points are added by amendments to the 10646
standard from time to time, implementations MUST be prepared to
encounter any code point from 0x00000001 to 0x7fffffff. Byte
sequences that do not correspond to the valid encoding of a code
point into UTF-8 charset or are outside this range are prohibited.
The use of control codes SHOULD be avoided. When it is necessary
to represent a new line, the control code sequence CR LF SHOULD be
used.
The use of leading or trailing white space SHOULD be avoided.
For code points not directly supported by user interface hardware
or software, an alternative means of entry and display, such as
hexadecimal, MAY be provided.
For information encoded in 7-bit US-ASCII, the UTF-8 charset is
identical to the US-ASCII charset.
UTF-8 may require multiple bytes to represent a single character /
code point; thus the length of an UTF8String in octets may be
different from the number of characters encoded.
Note that the AVP Length field of an UTF8String is measured in
octets, not characters.
DiameterIdentity
The DiameterIdentity format is derived from the OctetString AVP
Base Format.
DiameterIdentity = FQDN
DiameterIdentity value is used to uniquely identify a Diameter
node for purposes of duplicate connection and routing loop
detection.
The contents of the string MUST be the FQDN of the Diameter node.
If multiple Diameter nodes run on the same host, each Diameter
node MUST be assigned a unique DiameterIdentity. If a Diameter
node can be identified by several FQDNs, a single FQDN should be
picked at startup, and used as the only DiameterIdentity for that
node, whatever the connection it is sent on.
DiameterURI
The DiameterURI MUST follow the Uniform Resource Identifiers (URI)
syntax [URI] rules specified below:
"aaa://" FQDN [ port ] [ transport ] [ protocol ]
; No transport security
"aaas://" FQDN [ port ] [ transport ] [ protocol ]
; Transport security used
FQDN = Fully Qualified Host Name
port = ":" 1*DIGIT
; One of the ports used to listen for
; incoming connections.
; If absent,
; the default Diameter port (3868) is
; assumed.
transport = ";transport=" transport-protocol
; One of the transports used to listen
; for incoming connections. If absent,
; the default SCTP [SCTP] protocol is
; assumed. UDP MUST NOT be used when
; the aaa-protocol field is set to
; diameter.
transport-protocol = ( "tcp" / "sctp" / "udp" )
protocol = ";protocol=" aaa-protocol
; If absent, the default AAA protocol
; is diameter.
aaa-protocol = ( "diameter" / "radius" / "tacacs+" )
The following are examples of valid Diameter host identities:
aaa://host.example.com;transport=tcp
aaa://host.example.com:6666;transport=tcp
aaa://host.example.com;protocol=diameter
aaa://host.example.com:6666;protocol=diameter
aaa://host.example.com:6666;transport=tcp;protocol=diameter
aaa://host.example.com:1813;transport=udp;protocol=radius
Enumerated
Enumerated is derived from the Integer32 AVP Base Format. The
definition contains a list of valid values and their
interpretation and is described in the Diameter application
introducing the AVP.
IPFilterRule
The IPFilterRule format is derived from the OctetString AVP Base
Format. It uses the ASCII charset. Packets may be filtered based
on the following information that is associated with it:
Direction (in or out)
Source and destination IP address (possibly masked)
Protocol
Source and destination port (lists or ranges)
TCP flags
IP fragment flag
IP options
ICMP types
Rules for the appropriate direction are evaluated in order, with
the first matched rule terminating the evaluation. Each packet is
evaluated once. If no rule matches, the packet is dropped if the
last rule evaluated was a permit, and passed if the last rule was
a deny.
IPFilterRule filters MUST follow the format:
action dir proto from src to dst [options]
action permit - Allow packets that match the rule.
deny - Drop packets that match the rule.
dir "in" is from the terminal, "out" is to the
terminal.
proto An IP protocol specified by number. The "ip"
keyword means any protocol will match.
src and dst <address/mask> [ports]
The <address/mask> may be specified as:
ipno An IPv4 or IPv6 number in dotted-
quad or canonical IPv6 form. Only
this exact IP number will match the
rule.
ipno/bits An IP number as above with a mask
width of the form 1.2.3.4/24. In
this case, all IP numbers from
1.2.3.0 to 1.2.3.255 will match.
The bit width MUST be valid for the
IP version and the IP number MUST
NOT have bits set beyond the mask.
For a match to occur, the same IP
version must be present in the
packet that was used in describing
the IP address. To test for a
particular IP version, the bits part
can be set to zero. The keyword
"any" is 0.0.0.0/0 or the IPv6
equivalent. The keyword "assigned"
is the address or set of addresses
assigned to the terminal. For IPv4,
a typical first rule is often "deny
in ip! assigned"
The sense of the match can be inverted by
preceding an address with the not modifier (!),
causing all other addresses to be matched
instead. This does not affect the selection of
port numbers.
With the TCP, UDP and SCTP protocols, optional
ports may be specified as:
{port/port-port}[,ports[,...]]
The '-' notation specifies a range of ports
(including boundaries).
Fragmented packets that have a non-zero offset
(i.e., not the first fragment) will never match
a rule that has one or more port
specifications. See the frag option for
details on matching fragmented packets.
options:
frag Match if the packet is a fragment and this is not
the first fragment of the datagram. frag may not
be used in conjunction with either tcpflags or
TCP/UDP port specifications.
ipoptions spec
Match if the IP header contains the comma
separated list of options specified in spec. The
supported IP options are:
ssrr (strict source route), lsrr (loose source
route), rr (record packet route) and ts
(timestamp). The absence of a particular option
may be denoted with a '!'.
tcpoptions spec
Match if the TCP header contains the comma
separated list of options specified in spec. The
supported TCP options are:
mss (maximum segment size), window (tcp window
advertisement), sack (selective ack), ts (rfc1323
timestamp) and cc (rfc1644 t/tcp connection
count). The absence of a particular option may
be denoted with a '!'.
established
TCP packets only. Match packets that have the RST
or ACK bits set.
setup TCP packets only. Match packets that have the SYN
bit set but no ACK bit.
tcpflags spec
TCP packets only. Match if the TCP header
contains the comma separated list of flags
specified in spec. The supported TCP flags are:
fin, syn, rst, psh, ack and urg. The absence of a
particular flag may be denoted with a '!'. A rule
that contains a tcpflags specification can never
match a fragmented packet that has a non-zero
offset. See the frag option for details on
matching fragmented packets.
icmptypes types
ICMP packets only. Match if the ICMP type is in
the list types. The list may be specified as any
combination of ranges or individual types
separated by commas. Both the numeric values and
the symbolic values listed below can be used. The
supported ICMP types are:
echo reply (0), destination unreachable (3),
source quench (4), redirect (5), echo request
(8), router advertisement (9), router
solicitation (10), time-to-live exceeded (11), IP
header bad (12), timestamp request (13),
timestamp reply (14), information request (15),
information reply (16), address mask request (17)
and address mask reply (18).
There is one kind of packet that the access device MUST always
discard, that is an IP fragment with a fragment offset of one. This
is a valid packet, but it only has one use, to try to circumvent
firewalls.
An access device that is unable to interpret or apply a deny rule
MUST terminate the session. An access device that is unable to
interpret or apply a permit rule MAY apply a more restrictive
rule. An access device MAY apply deny rules of its own before the
supplied rules, for example to protect the access device owner's
infrastructure.
The rule syntax is a modified subset of ipfw(8) from FreeBSD, and the
ipfw.c code may provide a useful base for implementations.
QoSFilterRule
The QosFilterRule format is derived from the OctetString AVP Base
Format. It uses the ASCII charset. Packets may be marked or
metered based on the following information that is associated with
it:
Direction (in or out)
Source and destination IP address (possibly masked)
Protocol
Source and destination port (lists or ranges)
DSCP values (no mask or range)
Rules for the appropriate direction are evaluated in order, with
the first matched rule terminating the evaluation. Each packet is
evaluated once. If no rule matches, the packet is treated as best
effort. An access device that is unable to interpret or apply a
QoS rule SHOULD NOT terminate the session.
QoSFilterRule filters MUST follow the format:
action dir proto from src to dst [options]
tag - Mark packet with a specific DSCP
[DIFFSERV]. The DSCP option MUST be
included.
meter - Meter traffic. The metering options
MUST be included.
dir The format is as described under IPFilterRule.
proto The format is as described under
IPFilterRule.
src and dst The format is as described under
IPFilterRule.
4.4. Grouped AVP Values
The Diameter protocol allows AVP values of type 'Grouped.' This
implies that the Data field is actually a sequence of AVPs. It is
possible to include an AVP with a Grouped type within a Grouped type,
that is, to nest them. AVPs within an AVP of type Grouped have the
same padding requirements as non-Grouped AVPs, as defined in Section
4.
The AVP Code numbering space of all AVPs included in a Grouped AVP is the same as for non-grouped AVPs. Further, if any of the AVPs encapsulated within a Grouped AVP has the 'M' (mandatory) bit set, the Grouped AVP itself MUST also include the 'M' bit set. Every Grouped AVP defined MUST include a corresponding grammar, using ABNF [ABNF] (with modifications), as defined below. grouped-avp-def = name "::=" avp name-fmt = ALPHA *(ALPHA / DIGIT / "-") name = name-fmt ; The name has to be the name of an AVP, ; defined in the base or extended Diameter ; specifications. avp = header [ *fixed] [ *required] [ *optional] [ *fixed] header = "<" "AVP-Header:" avpcode [vendor] ">" avpcode = 1*DIGIT ; The AVP Code assigned to the Grouped AVP vendor = 1*DIGIT ; The Vendor-ID assigned to the Grouped AVP. ; If absent, the default value of zero is ; used.4.4.1. Example AVP with a Grouped Data type
The Example-AVP (AVP Code 999999) is of type Grouped and is used to clarify how Grouped AVP values work. The Grouped Data field has the following ABNF grammar: Example-AVP ::= < AVP Header: 999999 > { Origin-Host } 1*{ Session-Id } *[ AVP ] An Example-AVP with Grouped Data follows. The Origin-Host AVP is required (Section 6.3). In this case: Origin-Host = "example.com".
One or more Session-Ids must follow. Here there are two:
Session-Id =
"grump.example.com:33041;23432;893;0AF3B81"
Session-Id =
"grump.example.com:33054;23561;2358;0AF3B82"
optional AVPs included are
Recovery-Policy = <binary>
2163bc1d0ad82371f6bc09484133c3f09ad74a0dd5346d54195a7cf0b35
2cabc881839a4fdcfbc1769e2677a4c1fb499284c5f70b48f58503a45c5
c2d6943f82d5930f2b7c1da640f476f0e9c9572a50db8ea6e51e1c2c7bd
f8bb43dc995144b8dbe297ac739493946803e1cee3e15d9b765008a1b2a
cf4ac777c80041d72c01e691cf751dbf86e85f509f3988e5875dc905119
26841f00f0e29a6d1ddc1a842289d440268681e052b30fb638045f7779c
1d873c784f054f688f5001559ecff64865ef975f3e60d2fd7966b8c7f92
Futuristic-Acct-Record = <binary>
fe19da5802acd98b07a5b86cb4d5d03f0314ab9ef1ad0b67111ff3b90a0
57fe29620bf3585fd2dd9fcc38ce62f6cc208c6163c008f4258d1bc88b8
17694a74ccad3ec69269461b14b2e7a4c111fb239e33714da207983f58c
41d018d56fe938f3cbf089aac12a912a2f0d1923a9390e5f789cb2e5067
d3427475e49968f841
The data for the optional AVPs is represented in hex since the format
of these AVPs is neither known at the time of definition of the
Example-AVP group, nor (likely) at the time when the example instance
of this AVP is interpreted - except by Diameter implementations which
support the same set of AVPs. The encoding example illustrates how
padding is used and how length fields are calculated. Also note that
AVPs may be present in the Grouped AVP value which the receiver
cannot interpret (here, the Recover-Policy and Futuristic-Acct-Record
AVPs).
This AVP would be encoded as follows:
0 1 2 3 4 5 6 7
+-------+-------+-------+-------+-------+-------+-------+-------+
0 | Example AVP Header (AVP Code = 999999), Length = 468 |
+-------+-------+-------+-------+-------+-------+-------+-------+
8 | Origin-Host AVP Header (AVP Code = 264), Length = 19 |
+-------+-------+-------+-------+-------+-------+-------+-------+
16 | 'e' | 'x' | 'a' | 'm' | 'p' | 'l' | 'e' | '.' |
+-------+-------+-------+-------+-------+-------+-------+-------+
24 | 'c' | 'o' | 'm' |Padding| Session-Id AVP Header |
+-------+-------+-------+-------+-------+-------+-------+-------+
32 | (AVP Code = 263), Length = 50 | 'g' | 'r' | 'u' | 'm' |
+-------+-------+-------+-------+-------+-------+-------+-------+
. . .
+-------+-------+-------+-------+-------+-------+-------+-------+
64 | 'A' | 'F' | '3' | 'B' | '8' | '1' |Padding|Padding|
+-------+-------+-------+-------+-------+-------+-------+-------+
72 | Session-Id AVP Header (AVP Code = 263), Length = 51 |
+-------+-------+-------+-------+-------+-------+-------+-------+
80 | 'g' | 'r' | 'u' | 'm' | 'p' | '.' | 'e' | 'x' |
+-------+-------+-------+-------+-------+-------+-------+-------+
. . .
+-------+-------+-------+-------+-------+-------+-------+-------+
104 | '0' | 'A' | 'F' | '3' | 'B' | '8' | '2' |Padding|
+-------+-------+-------+-------+-------+-------+-------+-------+
112 | Recovery-Policy Header (AVP Code = 8341), Length = 223 |
+-------+-------+-------+-------+-------+-------+-------+-------+
120 | 0x21 | 0x63 | 0xbc | 0x1d | 0x0a | 0xd8 | 0x23 | 0x71 |
+-------+-------+-------+-------+-------+-------+-------+-------+
. . .
+-------+-------+-------+-------+-------+-------+-------+-------+
320 | 0x2f | 0xd7 | 0x96 | 0x6b | 0x8c | 0x7f | 0x92 |Padding|
+-------+-------+-------+-------+-------+-------+-------+-------+
328 | Futuristic-Acct-Record Header (AVP Code = 15930), Length = 137|
+-------+-------+-------+-------+-------+-------+-------+-------+
336 | 0xfe | 0x19 | 0xda | 0x58 | 0x02 | 0xac | 0xd9 | 0x8b |
+-------+-------+-------+-------+-------+-------+-------+-------+
. . .
+-------+-------+-------+-------+-------+-------+-------+-------+
464 | 0x41 |Padding|Padding|Padding|
+-------+-------+-------+-------+
4.5. Diameter Base Protocol AVPs
The following table describes the Diameter AVPs defined in the base protocol, their AVP Code values, types, possible flag values and whether the AVP MAY be encrypted. For the originator of a Diameter message, "Encr" (Encryption) means that if a message containing that AVP is to be sent via a Diameter agent (proxy, redirect or relay) then the message MUST NOT be sent unless there is end-to-end security between the originator and the recipient and integrity / confidentiality protection is offered for this AVP OR the originator has locally trusted configuration that indicates that end-to-end security is not needed. Similarly, for the originator of a Diameter message, a "P" in the "MAY" column means that if a message containing that AVP is to be sent via a Diameter agent (proxy, redirect or relay) then the message MUST NOT be sent unless there is end-to-end security between the originator and the recipient or the originator has locally trusted configuration that indicates that end-to-end security is not needed. Due to space constraints, the short form DiamIdent is used to represent DiameterIdentity.
+---------------------+
| AVP Flag rules |
|----+-----+----+-----|----+
AVP Section | | |SHLD| MUST| |
Attribute Name Code Defined Data Type |MUST| MAY | NOT| NOT|Encr|
-----------------------------------------|----+-----+----+-----|----|
Acct- 85 9.8.2 Unsigned32 | M | P | | V | Y |
Interim-Interval | | | | | |
Accounting- 483 9.8.7 Enumerated | M | P | | V | Y |
Realtime-Required | | | | | |
Acct- 50 9.8.5 UTF8String | M | P | | V | Y |
Multi-Session-Id | | | | | |
Accounting- 485 9.8.3 Unsigned32 | M | P | | V | Y |
Record-Number | | | | | |
Accounting- 480 9.8.1 Enumerated | M | P | | V | Y |
Record-Type | | | | | |
Accounting- 44 9.8.4 OctetString| M | P | | V | Y |
Session-Id | | | | | |
Accounting- 287 9.8.6 Unsigned64 | M | P | | V | Y |
Sub-Session-Id | | | | | |
Acct- 259 6.9 Unsigned32 | M | P | | V | N |
Application-Id | | | | | |
Auth- 258 6.8 Unsigned32 | M | P | | V | N |
Application-Id | | | | | |
Auth-Request- 274 8.7 Enumerated | M | P | | V | N |
Type | | | | | |
Authorization- 291 8.9 Unsigned32 | M | P | | V | N |
Lifetime | | | | | |
Auth-Grace- 276 8.10 Unsigned32 | M | P | | V | N |
Period | | | | | |
Auth-Session- 277 8.11 Enumerated | M | P | | V | N |
State | | | | | |
Re-Auth-Request- 285 8.12 Enumerated | M | P | | V | N |
Type | | | | | |
Class 25 8.20 OctetString| M | P | | V | Y |
Destination-Host 293 6.5 DiamIdent | M | P | | V | N |
Destination- 283 6.6 DiamIdent | M | P | | V | N |
Realm | | | | | |
Disconnect-Cause 273 5.4.3 Enumerated | M | P | | V | N |
E2E-Sequence AVP 300 6.15 Grouped | M | P | | V | Y |
Error-Message 281 7.3 UTF8String | | P | | V,M | N |
Error-Reporting- 294 7.4 DiamIdent | | P | | V,M | N |
Host | | | | | |
Event-Timestamp 55 8.21 Time | M | P | | V | N |
Experimental- 297 7.6 Grouped | M | P | | V | N |
Result | | | | | |
-----------------------------------------|----+-----+----+-----|----|
+---------------------+
| AVP Flag rules |
|----+-----+----+-----|----+
AVP Section | | |SHLD| MUST|MAY |
Attribute Name Code Defined Data Type |MUST| MAY | NOT| NOT|Encr|
-----------------------------------------|----+-----+----+-----|----|
Experimental- 298 7.7 Unsigned32 | M | P | | V | N |
Result-Code | | | | | |
Failed-AVP 279 7.5 Grouped | M | P | | V | N |
Firmware- 267 5.3.4 Unsigned32 | | | |P,V,M| N |
Revision | | | | | |
Host-IP-Address 257 5.3.5 Address | M | P | | V | N |
Inband-Security | M | P | | V | N |
-Id 299 6.10 Unsigned32 | | | | | |
Multi-Round- 272 8.19 Unsigned32 | M | P | | V | Y |
Time-Out | | | | | |
Origin-Host 264 6.3 DiamIdent | M | P | | V | N |
Origin-Realm 296 6.4 DiamIdent | M | P | | V | N |
Origin-State-Id 278 8.16 Unsigned32 | M | P | | V | N |
Product-Name 269 5.3.7 UTF8String | | | |P,V,M| N |
Proxy-Host 280 6.7.3 DiamIdent | M | | | P,V | N |
Proxy-Info 284 6.7.2 Grouped | M | | | P,V | N |
Proxy-State 33 6.7.4 OctetString| M | | | P,V | N |
Redirect-Host 292 6.12 DiamURI | M | P | | V | N |
Redirect-Host- 261 6.13 Enumerated | M | P | | V | N |
Usage | | | | | |
Redirect-Max- 262 6.14 Unsigned32 | M | P | | V | N |
Cache-Time | | | | | |
Result-Code 268 7.1 Unsigned32 | M | P | | V | N |
Route-Record 282 6.7.1 DiamIdent | M | | | P,V | N |
Session-Id 263 8.8 UTF8String | M | P | | V | Y |
Session-Timeout 27 8.13 Unsigned32 | M | P | | V | N |
Session-Binding 270 8.17 Unsigned32 | M | P | | V | Y |
Session-Server- 271 8.18 Enumerated | M | P | | V | Y |
Failover | | | | | |
Supported- 265 5.3.6 Unsigned32 | M | P | | V | N |
Vendor-Id | | | | | |
Termination- 295 8.15 Enumerated | M | P | | V | N |
Cause | | | | | |
User-Name 1 8.14 UTF8String | M | P | | V | Y |
Vendor-Id 266 5.3.3 Unsigned32 | M | P | | V | N |
Vendor-Specific- 260 6.11 Grouped | M | P | | V | N |
Application-Id | | | | | |
-----------------------------------------|----+-----+----+-----|----|