From 951e8fecc4641a2ab62653c56adc74d54fafd83a Mon Sep 17 00:00:00 2001
From: Anders Svensson
The only diameter_sctp-specific argument is the options list.
Options
diameter_sctp uses the
The only diameter_tcp-specific argument is the options list.
Options
--
cgit v1.2.3
From 7d38b593e8b1624e1ce2cda8fa57a42cdf2d3068 Mon Sep 17 00:00:00 2001
From: Anders Svensson
+An invalid option will cause
eval([{M,F,A} | T]) ->
apply(M, F, T ++ A);
+eval([[F|A] | T]) ->
+ eval([F | T ++ A]);
eval([F|A]) ->
apply(F, A);
eval(F) ->
@@ -461,14 +467,14 @@ or any peer if the request does not contain
a Destination-Realm AVP.
-{host, any|UTF8String()}
+{host, any|DiameterIdentity()}
-
Matches only those peers whose Origin-Host has the
specified value, or all peers if the atom any .
-{realm, any|UTF8String()
+{realm, any|DiameterIdentity()
-
Matches only those peers whose Origin-Realm has the
@@ -478,8 +484,9 @@ value, or all peers if the atom any .
{eval, evaluable()}
-
-Matches only those peers for which the specified evaluable() evaluates
-to true on the peer's diameter_caps record.
+Matches only those peers for which the specified evaluable() returns
+true on the connection's diameter_caps record.
+Any other return value or exception is equivalent to false .
{neg, peer_filter()}
@@ -503,6 +510,21 @@ specified list.
+
+Note that the host and realm filters examine the
+outgoing request as passed to call/4 ,
+assuming that this is a record- or list-valued message() as documented
+in diameter_app(3) , and that
+the message contains at most one of each AVP.
+If this is not the case then the {host|realm, DiameterIdentity()}
+filters must be used to achieve the desired result.
+Note also that an empty host/realm (which should not be typical)
+is equivalent to an unspecified one for the purposes of filtering.
+
+
+An invalid filter is equivalent to {any, []} , a filter
+that matches no peer.
+
@@ -787,7 +809,7 @@ transports.
SvcName = service_name()
App = application_alias()
-Request = diameter_app:message()
+Request = diameter_app:message() | term()
Answer = term()
Options = [call_opt()]
@@ -819,9 +841,8 @@ If there are no suitable peers, or if
pick_peer/4
rejects them by returning 'false', then {error, no_connection}
is returned.
-If pick_peer/4
-selects a candidate peer then a request process is spawned for the
-outgoing request, in which there is a
+Otherwise pick_peer/4
+is followed by a
prepare_request/3
callback, the message is encoded and sent.
diff --git a/lib/diameter/doc/src/diameter_app.xml b/lib/diameter/doc/src/diameter_app.xml
index fc359b9d1d..f2bada84ae 100644
--- a/lib/diameter/doc/src/diameter_app.xml
+++ b/lib/diameter/doc/src/diameter_app.xml
@@ -269,7 +269,12 @@ The candidate peers list will only include those
which are selected by any filter option specified in the call to
diameter:call/4 , and only
those which have indicated support for the Diameter application in
-question.
+question.
+The order of the elements is unspecified except that any
+peers whose Origin-Host and Origin-Realm matches that of the
+outgoing request (in the sense of a {filter, {all, [host, realm]}}
+option to diameter:call/4 )
+will be placed at the head of the list.
The return values false and {false, State} are
--
cgit v1.2.3
From fbb8586af3dd74b52ecdfa74d758f14cb82683fd Mon Sep 17 00:00:00 2001
From: Anders Svensson
Date: Mon, 26 Sep 2011 00:21:08 +0200
Subject: Fix and clarify relay behaviour
Leave it up to a handle_request callback to decide whether or
not to filter the peer from which the incoming request was sent.
Reply with 3002 (DIAMETER_UNABLE_TO_DELIVER) on anything but an
answer from the peer.
---
lib/diameter/doc/src/diameter_app.xml | 40 ++++++++++++++++++-----------------
1 file changed, 21 insertions(+), 19 deletions(-)
(limited to 'lib/diameter/doc/src')
diff --git a/lib/diameter/doc/src/diameter_app.xml b/lib/diameter/doc/src/diameter_app.xml
index fc359b9d1d..a3d9a8eeac 100644
--- a/lib/diameter/doc/src/diameter_app.xml
+++ b/lib/diameter/doc/src/diameter_app.xml
@@ -467,11 +467,11 @@ callback returned false.
Packet = packet()
SvcName = term()
Peer = peer()
-Action = Reply | {relay, Opts} | discard | {eval, Action, ContF}
+Action = Reply | {relay, Opts} | discard | {eval, Action, PostF}
Reply = {reply, message()}
| {protocol_error, 3000..3999}
Opts = diameter:call_opts()
-ContF = diameter:evaluable()
+PostF = diameter:evaluable()
@@ -559,26 +559,28 @@ will cause the request process in question to fail.
{relay, Opts}
-
-Relay a request to another peer.
-The appropriate Route-Record AVP will be added to the relayed request
-by diameter and pick_peer/4
-and prepare_request/3
-callback will take place just as if pick_peer/4
+and subsequent callbacks take place just as if diameter:call/4 had been called
explicitly.
-However, returning a relay tuple also causes the End-to-End
-Identifier to be preserved in the header of the relayed request as
-required by RFC 3588.
+The End-to-End Identifier of the incoming request is preserved in the
+header of the relayed request.
-The returned Opts should not specify detach and
-the handle_answer/4
-callback following from a relayed request must return its first
+The returned Opts should not specify detach .
+A subsequent handle_answer/4
+callback for the relayed request must return its first
argument, the diameter_packet record containing the answer
message.
Note that the extra option can be specified to supply arguments
-that can distinguish the relay case from others if so desired,
-although the form of the request message may be sufficient.
+that can distinguish the relay case from others if so desired.
+Any other return value (for example, from a
+handle_error/4 callback)
+causes the request to be answered with 3002 (DIAMETER_UNABLE_TO_DELIVER).
discard
@@ -587,18 +589,18 @@ although the form of the request message may be sufficient.
Discard the request.
-{eval, Action, ContF}
+{eval, Action, PostF}
-
Handle the request as if Action has been returned and then
-evaluate ContF in the request process.
+evaluate PostF in the request process.
-Note that diameter will respond to protocol errors in an incoming
-request without invoking handle_request/3 .
+Note that protocol errors detected by diameter will result in an
+answer message without handle_request/3 being invoked.
--
cgit v1.2.3
From b6dc1a844eab061d0a7153d46e7e68296f15a504 Mon Sep 17 00:00:00 2001
From: Erlang/OTP
Date: Tue, 4 Oct 2011 12:06:58 +0200
Subject: Prepare release
---
lib/diameter/doc/src/notes.xml | 129 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 129 insertions(+)
(limited to 'lib/diameter/doc/src')
diff --git a/lib/diameter/doc/src/notes.xml b/lib/diameter/doc/src/notes.xml
index eafddd7d1e..e2723f3e99 100644
--- a/lib/diameter/doc/src/notes.xml
+++ b/lib/diameter/doc/src/notes.xml
@@ -36,6 +36,135 @@ first.
+Diameter 0.10
+
+ Fixed Bugs and Malfunctions
+
+ -
+
+ Handle #sctp_paddr_change and #sctp_pdapi_event from
+ gen_sctp.
+
+ The events are enabled by default but diameter_sctp
+ neither disabled nor dealt with them. Reception of such
+ an event caused a transport process to crash.
+
+ Own Id: OTP-9538
+
+ -
+
+ Fix header folding bug.
+
+ A prepare_request callback from diameter can return a
+ diameter_header record in order to set values in the
+ header of an outgoing request. A fault in
+ diameter_lib:fold_tuple/3 caused the subsequent encode of
+ the outgoing request to fail.
+
+ Own Id: OTP-9577
+
+ -
+
+ Fix bugs in sending of answer-message replies.
+
+ 3001 (DIAMETER_COMMAND_UNSUPPORTED) was not sent since
+ the decode placed the AVP list in the wrong field of the
+ diameter_packet, causing the subsequent encode to fail.
+ Session-Id was also set improperly, causing encode to
+ fail even in this case.
+
+ Own Id: OTP-9578
+
+ -
+
+ Fix improper use of error_logger:info_report/2.
+
+ Function doesn't take a format string and arguments as it
+ was called. Instead use error_logger:info_report/1 and
+ use the same report format as used for warning and error
+ reports.
+
+ Own Id: OTP-9579
+
+ -
+
+ Fix and clarify semantics of peer filters.
+
+ An eval filter returning a non-true value caused the call
+ process to fail and the doc was vague on how an exception
+ was treated. Clarify that the non-tuple host/realm
+ filters assume messages of a certain form.
+
+ Own Id: OTP-9580
+
+ -
+
+ Fix and clarify relay behaviour.
+
+ Implicit filtering of the sending peer in relaying a
+ request could cause loop detection to be preempted in a
+ manner not specified by RFC3588. Reply with 3002
+ (DIAMETER_UNABLE_TO_DELIVER) on anything but an answer to
+ a relayed request.
+
+ Own Id: OTP-9583
+
+
+
+
+
+ Improvements and New Features
+
+ -
+
+ @id required in dictionary files only when @messages is
+ specified.
+
+ @id defines an application identifier and this is used
+ only when sending or receiving messages. A dictionary can
+ define only AVP's however, to be included by other
+ dictionaries using @inherits, in which case it makes no
+ sense to require @id.
+
+ Note that message definitions are not inherited with
+ @inherits, only AVP's
+
+ Own Id: OTP-9467
+
+ -
+
+ Allow @enum when AVP is defined in an inherited
+ dictionary.
+
+ 3GPP standards (for one) extend the values allowed for
+ RFC 3588 AVP's of type Enumerated. Previously, extending
+ an AVP was only possible by completely redefining the
+ AVP.
+
+ Own Id: OTP-9469
+
+ -
+
+ Migrate testsuites to pure common test and add both
+ suites and testcases.
+
+ Own Id: OTP-9553
+
+ -
+
+ Requests of arbitrary form.
+
+ diameter:call/4 can be passed anything, as long as the
+ subsequent prepare_request callback returns a term that
+ can be encoded.
+
+ Own Id: OTP-9581
+
+
+
+
+
+
diameter 0.9
--
cgit v1.2.3
From 30a7d3935e57bd4c6b7e64f8b25eb0a11c0e7c80 Mon Sep 17 00:00:00 2001
From: Anders Svensson
Date: Mon, 3 Oct 2011 15:31:27 +0200
Subject: Documentation updates
---
lib/diameter/doc/src/diameter.xml | 21 ++++++++++++++++
lib/diameter/doc/src/diameter_soc.xml | 10 +++++---
lib/diameter/doc/src/diameter_tcp.xml | 34 +++++++++++++++++++++++---
lib/diameter/doc/src/diameter_transport.xml | 38 +++++++++++++++++++++++++++++
4 files changed, 97 insertions(+), 6 deletions(-)
(limited to 'lib/diameter/doc/src')
diff --git a/lib/diameter/doc/src/diameter.xml b/lib/diameter/doc/src/diameter.xml
index 2cad70e3bc..43c497f50a 100644
--- a/lib/diameter/doc/src/diameter.xml
+++ b/lib/diameter/doc/src/diameter.xml
@@ -367,6 +367,19 @@ capabilities exchange message.
Optional, defaults to the empty list.
+{'Inband-Security-Id', [Unsigned32()]}
+-
+
+Values of Inband-Security-Id AVPs sent in an outgoing
+capabilities exchange message.
+Optional, defaults to the empty list, which is equivalent to a
+list containing only 0 (= NO_INBAND_SECURITY).
+
+
+If 1 (= TLS) is specified then TLS is selected if the CER/CEA received
+from the peer offers it.
+
+
{'Acct-Application-Id', [Unsigned32()]}
-
@@ -683,6 +696,14 @@ in question.
AVP's used to construct outgoing CER/CEA messages.
Any AVP specified takes precedence over a corresponding value specified
for the service in question.
+
+
+Specifying a capability as a transport option
+may be particularly appropriate for Inband-Security-Id in case
+TLS is desired over TCP as implemented by
+diameter_tcp(3) but
+not over SCTP as implemented by
+diameter_sctp(3) .
{watchdog_timer, TwInit}
diff --git a/lib/diameter/doc/src/diameter_soc.xml b/lib/diameter/doc/src/diameter_soc.xml
index 4f8581a904..6b9ef9f756 100644
--- a/lib/diameter/doc/src/diameter_soc.xml
+++ b/lib/diameter/doc/src/diameter_soc.xml
@@ -57,9 +57,13 @@ including the P Flag in the AVP header.
-
-There is no TLS support.
-It's unclear (aka uninvestigated) how TLS would impact
-diameter but IPsec can be used without it needing to know.
+There is no TLS support over SCTP.
+RFC 3588 requires that a Diameter server support TLS but in
+practise this seems to mean TLS over SCTP since there are limitations
+with running over SCTP: see RFC 6083 (DTLS over SCTP), which is a
+response to RFC 3436 (TLS over SCTP).
+The current RFC 3588 draft acknowledges this by equating
+TLS with TLS/TCP and DTLS/SCTP but we do not yet support DTLS.
-
diff --git a/lib/diameter/doc/src/diameter_tcp.xml b/lib/diameter/doc/src/diameter_tcp.xml
index a502e53972..916700927f 100644
--- a/lib/diameter/doc/src/diameter_tcp.xml
+++ b/lib/diameter/doc/src/diameter_tcp.xml
@@ -43,7 +43,9 @@ It can be specified as the value of a transport_module option to
diameter:add_transport/2
and implements the behaviour documented in
-diameter_transport(3) .
+diameter_transport(3) .
+TLS security is supported, a connection being upgraded if
+TLS is negotiated during capabilities exchange.
@@ -60,10 +62,14 @@ and implements the behaviour documented in
Type = connect | accept
Ref = reference()
Svc = #diameter_service{}
-Opt = {raddr, ip_address()} | {rport, integer()} | term()
+Opt = OwnOpt | TlsOpt | TcpOpt
Pid = pid()
LAddr = ip_address()
Reason = term()
+OwnOpt = {raddr, ip_address()}
+ | {rport, integer()}
+TlsOpt = {ssl_options, list()}
+TcpOpt = term()
@@ -74,8 +80,11 @@ marker="diameter_transport#start">diameter_transport(3).
The only diameter_tcp-specific argument is the options list.
Options raddr and rport specify the remote address
-and port for a connecting transport and not valid for a listening
+and port for a connecting transport and are not valid for a listening
transport.
+Option ssl_options specifies options to be passed
+to ssl:connect/2 of ssl:ssl_accept/2 in case capabilities exchange
+results in TLS being chosen for inband security.
Remaining options are any accepted by gen_tcp:connect/3 for
a connecting transport, or gen_tcp:listen/2 for a listening transport,
with the exception of binary , packet and active .
@@ -84,6 +93,24 @@ to specify the local listening port, the default being the standardized
3868 if unspecified.
Note that option ip specifies the local address.
+
+The ssl_options option must be specified if and only if
+the transport in question has specified an Inband-Security-Id
+AVP with value TLS on the relevant call to
+start_service/2 or
+add_transport/2 ,
+so that the transport process will receive notification of
+whether or not to commence with a TLS handshake following capabilities
+exchange.
+Failing to specify ssl_options on a TLS-capable transport
+for which TLS is negotiated will cause TLS handshake to fail.
+Failing to specify TLS capability when ssl_options has been
+specified will cause the transport process to wait for a notification
+that will not be forthcoming, which will eventually cause the RFC 3539
+watchdog to take down the connection.
+
If the service specifies more than one Host-IP-Address and
option ip is unspecified then then the
@@ -104,6 +131,7 @@ The returned local address list has length one.
SEE ALSO
+diameter(3) ,
diameter_transport(3)
diff --git a/lib/diameter/doc/src/diameter_transport.xml b/lib/diameter/doc/src/diameter_transport.xml
index 37cc871e75..087a90b099 100644
--- a/lib/diameter/doc/src/diameter_transport.xml
+++ b/lib/diameter/doc/src/diameter_transport.xml
@@ -143,6 +143,34 @@ connection.
Pid is the pid() of the parent process.
+{diameter, {tls, Ref, Type, Bool}}
+-
+
+Indication of whether or not capabilities exchange has selected
+inband security using TLS.
+Ref is a reference() that must be included in the
+{diameter, {tls, Ref}} reply message to the transport's
+parent process (see below).
+Type is either connect or accept depending on
+whether the process has been started for a connecting or listening
+transport respectively.
+Bool is a boolean() indicating whether or not the transport connection
+should be upgraded to TLS.
+
+
+If TLS is requested (Bool = true) then a connecting process should
+initiate a TLS handshake with the peer and an accepting process should
+prepare to accept a handshake.
+A successful handshake should be followed by a {diameter, {tls, Ref}}
+message to the parent process.
+A failed handshake should cause the process to exit.
+
+
+This message is only sent to a transport process over whose
+Inband-Security-Id configuration has indicated support for
+TLS.
+
+
@@ -184,6 +212,16 @@ How the transport_data is used/interpreted is up to the
transport module.
+{diameter, {tls, Ref}}
+-
+
+Acknowledgment of a successful TLS handshake.
+Ref is the reference() received in the
+{diameter, {tls, Ref, Type, Bool}} message in response
+to which the reply is sent.
+A transport must exit if a handshake is not successful.
+
+
--
cgit v1.2.3
From 82934adca7cd26777025bc9ae1b87b45d2a55fe2 Mon Sep 17 00:00:00 2001
From: Anders Svensson
Date: Tue, 4 Oct 2011 17:28:57 +0200
Subject: Add tls support at connection establishment
This is the method added in draft-ietf-dime-rfc3588bis, whereby
a TLS handshake immediately follows connection establishment and
CER/CEA is sent over the secured connection.
---
lib/diameter/doc/src/diameter_tcp.xml | 34 ++++++++++++++++++++--------------
1 file changed, 20 insertions(+), 14 deletions(-)
(limited to 'lib/diameter/doc/src')
diff --git a/lib/diameter/doc/src/diameter_tcp.xml b/lib/diameter/doc/src/diameter_tcp.xml
index 916700927f..210ae9fdfe 100644
--- a/lib/diameter/doc/src/diameter_tcp.xml
+++ b/lib/diameter/doc/src/diameter_tcp.xml
@@ -44,8 +44,9 @@ It can be specified as the value of a transport_module option to
marker="diameter#add_transport">diameter:add_transport/2
and implements the behaviour documented in
diameter_transport(3) .
-TLS security is supported, a connection being upgraded if
-TLS is negotiated during capabilities exchange.
+TLS security is supported, both as an upgrade following
+capabilities exchange as specified by RFC 3588 and
+at connection establishment as in the current draft standard.
@@ -62,14 +63,15 @@ TLS is negotiated during capabilities exchange.
Type = connect | accept
Ref = reference()
Svc = #diameter_service{}
-Opt = OwnOpt | TlsOpt | TcpOpt
+Opt = OwnOpt | SslOpt | OtherOpt
Pid = pid()
LAddr = ip_address()
Reason = term()
OwnOpt = {raddr, ip_address()}
- | {rport, integer()}
-TlsOpt = {ssl_options, list()}
-TcpOpt = term()
+ | {rport, integer()}
+ | {port, integer()}
+SslOpt = {ssl_options, true | list()}
+OtherOpt = term()
@@ -82,19 +84,23 @@ The only diameter_tcp-specific argument is the options list.
Options raddr and rport specify the remote address
and port for a connecting transport and are not valid for a listening
transport.
-Option ssl_options specifies options to be passed
-to ssl:connect/2 of ssl:ssl_accept/2 in case capabilities exchange
-results in TLS being chosen for inband security.
-Remaining options are any accepted by gen_tcp:connect/3 for
-a connecting transport, or gen_tcp:listen/2 for a listening transport,
-with the exception of binary , packet and active .
+Option ssl_options must be specified for a transport
+that must be able to support TLS: a value of true results in a
+TLS handshake immediately upon connection establishment while
+list() specifies options to be passed to ssl:connect/2 of ssl:ssl_accept/2
+after capabilities exchange if TLS is negotiated.
+Remaining options are any accepted by ssl:connect/3 or gen_tcp:connect/3 for
+a connecting transport, or ssl:listen/3 or gen_tcp:listen/2 for
+a listening transport, depending on whether or not {ssl_options, true}
+has been specified.
+Options binary , packet and active cannot be specified.
Also, option port can be specified for a listening transport
to specify the local listening port, the default being the standardized
3868 if unspecified.
Note that option ip specifies the local address.
-The ssl_options option must be specified if and only if
+An ssl_options list must be specified if and only if
the transport in question has specified an Inband-Security-Id
AVP with value TLS on the relevant call to
add_transport/2 ,
so that the transport process will receive notification of
whether or not to commence with a TLS handshake following capabilities
exchange.
-Failing to specify ssl_options on a TLS-capable transport
+Failing to specify an options list on a TLS-capable transport
for which TLS is negotiated will cause TLS handshake to fail.
Failing to specify TLS capability when ssl_options has been
specified will cause the transport process to wait for a notification
--
cgit v1.2.3
From c002a636022d9910288a8612d03c6edd5c1a6962 Mon Sep 17 00:00:00 2001
From: Anders Svensson
Date: Tue, 4 Oct 2011 18:06:53 +0200
Subject: Clarify that ssl must be started for TLS support
Also update app testsuite to allow for "undefined" calls
from diameter_tcp to ssl.
---
lib/diameter/doc/src/diameter_tcp.xml | 4 ++++
1 file changed, 4 insertions(+)
(limited to 'lib/diameter/doc/src')
diff --git a/lib/diameter/doc/src/diameter_tcp.xml b/lib/diameter/doc/src/diameter_tcp.xml
index 210ae9fdfe..e6b53383c0 100644
--- a/lib/diameter/doc/src/diameter_tcp.xml
+++ b/lib/diameter/doc/src/diameter_tcp.xml
@@ -48,6 +48,10 @@ TLS security is supported, both as an upgrade following
capabilities exchange as specified by RFC 3588 and
at connection establishment as in the current draft standard.
+
+Note that the ssl application is required for TLS and must be started
+before configuring TLS capability on diameter transports.
+
--
cgit v1.2.3
From dce08a5f07935e89f8d049376ff660cf59184e85 Mon Sep 17 00:00:00 2001
From: Anders Svensson
Date: Thu, 18 Aug 2011 11:58:45 +0200
Subject: Simplify depend.sed for better compatibility
Sed on Solaris doesn't remember matches after branching.
---
lib/diameter/doc/src/depend.sed | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
(limited to 'lib/diameter/doc/src')
diff --git a/lib/diameter/doc/src/depend.sed b/lib/diameter/doc/src/depend.sed
index 5973c4586e..42de597f15 100644
--- a/lib/diameter/doc/src/depend.sed
+++ b/lib/diameter/doc/src/depend.sed
@@ -21,14 +21,18 @@
# massaged in Makefile.
#
-/^\([^<]*\)<\/com>/b rf
-/^\([^<]*\)<\/module>/b rf
+/^/b c
+/^/b c
/^/!d
+# Chapter: html basename is same as xml.
s@@$(HTMLDIR)/%FILE%.html: %FILE%.xml@
q
-:rf
-s@@$(HTMLDIR)/\1.html: %FILE%.xml@
+# Reference: html basename is from contents of com/module element.
+:c
+s@^[^>]*>@@
+s@<.*@@
+s@.*@$(HTMLDIR)/&.html: %FILE%.xml@
q
--
cgit v1.2.3