TOC 
Network Working GroupA. Lior
Internet-DraftM. Jones
Intended status: Standards TrackBridgewater Systems
Expires: August 28, 2008February 25, 2008


Diameter Claissifier
draft-lior-diameter-classifier-01.txt

Status of this Memo

By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work in progress.”

The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt.

The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html.

This Internet-Draft will expire on August 28, 2008.

Abstract

Many Diameter applications require to classify packets. Diameter base protocols provides an IP Filter Rule type and a QoS Filter Rule type that is being used to classify packets. However, because these types were defined for specific uses and defined in ways that are hard to extend and therefore are not generally applicable for those applications that require packet classifiers.

This document describes a set of Diameter types that are useful to create packet classifiers. The packet classier type can be used by various applications to express packet classifiers that best match the application's specific needs.



Table of Contents

1.  Introduction
2.  Terminology
3.  Classifier Attribute Overview
    3.1.  Classifier AVP
    3.2.  Classifier-ID AVP
    3.3.  Protocol AVP
    3.4.  Direction AVP
    3.5.  From-Spec AVP
    3.6.  To-Spec AVP
4.  Source and Destination AVPs
    4.1.  Negated AVP
    4.2.  IP-Address AVP
    4.3.  IP-Address-Range AVP
    4.4.  IP-Address-Start AVP
    4.5.  IP-Address-End AVP
    4.6.  IP-Address-Mask AVP
    4.7.  IP-Mask-Bit-Mask-Width AVP
    4.8.  MAC-Address AVP
    4.9.  Port AVP
    4.10.  Port-Range AVP
    4.11.  Port-Start AVP
    4.12.  Port-End AVP
    4.13.  Assigned AVP
5.  Header Option AVPs
    5.1.  Diffserv-Code-Point AVP
    5.2.  Fragmentation-Flag AVP
    5.3.  IP-Option AVP
    5.4.  IP-Option-Type AVP
    5.5.  IP-Option-Value AVP
    5.6.  TCP-Option AVP
    5.7.  TCP-Option-Type AVP
    5.8.  TCP-Option-Value AVP
    5.9.  TCP-Flags AVP
    5.10.  TCP-Flag-Type AVP
    5.11.  ICMP-Type
    5.12.  ICMP-Type-Number AVP
    5.13.  ICMP-Code AVP
6.  References
    6.1.  Normative References
    6.2.  Informative References
§  Authors' Addresses
§  Intellectual Property and Copyright Statements




 TOC 

1.  Introduction

The Diameter base protocol [7] (Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. Arkko, “Diameter Base Protocol,” September 2003.) defines two data formats, IPFilterRule and QoSFilterRule. IPFilterRule is designed to implement packet filters and QoSFilterRule tagging and metering of packets. Both of these data formats are expressed as an ASCII string which makes it impossible to extend and also makes it difficult to parse and thus equipment suffer a performance hit.

Many applications require the ability to express packet classifiers. QoS based applications need to be able to express which packets to apply a certain QoS treatment. Charging applications need to be able to express which packets should be have certain charging rules applied to them. Some applications need to be able to redirect certain packets.

The packet classifiers need to be able to classify packets at the various layers and various protocols. For example, it should be possible to build a classifier to work on layer 2 protocols and build another classifier that works on layer 3 protocols such as IPv4 or IPv6. Classifiers must also be able to utilize various attributes that are utilized in these layers and protocols.



 TOC 

2.  Terminology

The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [1] (Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” March 1997.).



 TOC 

3.  Classifier Attribute Overview

Classifiers are used in many applications to specify how to classify packets. For example in a QoS application, if a packet matches a classifier then that packet will be treated in accordance with a QoS specification associated with that classifier.

The Classifiers are sent to on on-path element (e.g. a router) which uses the classifier to match packets. Figure 1 (Example of a Classifier Architecture) shows a typical deployement.



                                                        +-----------+
                                                       +-----------+|
    +--------+          +-------------+              +------------+||
    |        |   IN     |             |              |            |||
    |        +--------->|             +------------->|            |||
    |Managed |          | Classifying  |              | Unmanaged  |||
    |Terminal|   OUT    | Entity      |              | Terminal   |||
    |        |<---------+             |<-------------+            ||+
    |        |          |             |              |            |+
    +--------+          +-------------+              +------------+
                                ^
                                | Classifiers
                                |
                         +------+-------+
                         |              |
                         |      AAA     |
                         |              |
                         +--------------+
 Figure 1: Example of a Classifier Architecture 

The managed terminal, the terminal for which the classifiers are being specified is located on the left of the Classifer Entity. The unmanged terminal, the terminal that recieves packets from the Managed terminal or sends packets to the managed terminal is located to the right side of the Classifier Entity.

The Classifying Entity is reponsible for classifying packets that are incoming (IN) from the Managed Terminal or packets outgoing (OUT) to the Managed Terminal.

A Classifier consists of a group of attributes that specify how to match a packet. Each set of attributes expresses values about aspects of the packet - typically the packet header. Different protocols therefore would use different attributes.

In general a Classifier consists of the following:

Identifier:

The identifier uniquely identifies this classifier and maybe used to reference the classifier from another structure.
From:

Specifies the rule for matching the source part of the packet.
To:

Specifies the rule for matching the destination part of the packet.
Protocol

Specifies the matching protocol of the packet.
Direction:

Specifies whether the classifier is to apply to packets flowing from the Managed Terminal (IN) or to packets flowing to the Managed Terminal (OUT), or packets flowing in both direction.
Options:

Associated with each protocol or layer, or various values specific to the header of the protocol or layer. Options allow matching on those values.

Each protocol type will have a specific set of attributes that can be used to specify a classifier for that protocol. These attributes will be grouped under a grouped AVP called a Classifier AVP.



 TOC 

3.1.  Classifier AVP

The Classifier AVP (AVP Code TBD) is a grouped AVP that consists of a set of attributes that specify how to match a packet.

Classifier ::= < AVP Header: XXX >
               { Classifier-ID }
               { Protocol }
               { Direction }
             * [ From-Spec ]
             * [ To-Spec ]
             * [ Diffserv-Code-Point ]
               [ Fragmentation-Flag ]
             * [ IP-Option ]
             * [ TCP-Option ]
               [ TCP-Flags ]
             * [ ICMP-Type ]
             * [ AVP ]



 TOC 

3.2.  Classifier-ID AVP

The Classifier-ID AVP (AVP Code TBD) is of type OctetString and uniquely identifies the classifier. Each application will define the uniqueness scope of this identifier, e.g. unique per terminal or globally unique. Exactly one Classifier-ID AVP MUST be contained within a Classifier AVP.



 TOC 

3.3.  Protocol AVP

The Protocol AVP (AVP Code TBD) is of type Enumerated and specifies the protocol being matched. The attributes included in the Classifier AVP must be consistent with the value of the Protocol AVP. Exactly one Protocol AVP MUST be contained within a Classifier AVP. The values for this AVP are managed by IANA under the Protocol Numbers registry [2] (IANA,, “Protocol Types,” .).



 TOC 

3.4.  Direction AVP

The Direction AVP (AVP Code TBD) is of type Enumerated that specifies in which direction to apply the Classifier. The values of the enumeration are: "IN","OUT","BOTH". In the "IN" and "BOTH" directions, the From-Spec refers to the address of the Managed Terminal and the To-Spec refers to the unmanaged terminal. In the "OUT" direction, the From-Spec refers to the Unmanaged Terminal whereas the To-Spec refers to the Managed Terminal.

  Value | Name and Semantic
  ------+------------------------------------------------------------
    0   | RESERVED
    1   | IN - The classifier applies to downlink flows only.
    2   | OUT - The classifier applies to uplink flows only.
    3   | BOTH - The classifier applies to both downlink
        | and uplink flows.



 TOC 

3.5.  From-Spec AVP

The From-Spec AVP (AVP Code TBD) is a grouped AVP that specifies the Source Specification used to match the packet. Zero or more of these attributes may appear in the classifier. If this AVP is absent from the classifier then the source address is not being matched (wild card). If more than one instance of this AVP appears in the Classifier then the source of the packet can match any From-Spec AVP. The contents of this AVP are protocol specific.

From-Spec ::= < AVP Header: XXX >
              [ IP-Address ]
              [ IP-Address-Range ]
              [ IP-Address-Mask ]
              [ MAC-Address ]
              [ Port ]
              [ Port-Range ]
              [ Negated ]
              [ Assigned ]
            * [ AVP ]



 TOC 

3.6.  To-Spec AVP

The To-Spec AVP (AVP Code TBD) is a grouped AVP that specifies the Destination Specification used to match the packet. Zero or more of these attributes may appear in the classifier. If the attribute is absent from the classifier then the destination address is not being matched (wild card). If more than one instance of this AVP appears in the Classifier then the destination of the packet can match any To-Spec AVP. The contents of this AVP are protocol specific.

To-Spec ::= < AVP Header: XXX >
            [ IP-Address ]
            [ IP-Address-Range ]
            [ IP-Address-Mask ]
            [ MAC-Address ]
            [ Port ]
            [ Port-Range ]
            [ Negated ]
            [ Assigned ]
          * [ AVP ]



 TOC 

4.  Source and Destination AVPs

For packet classification the contents of the From-Spec and To-Spec can contain the following AVPs.

By combining several of these attributes within a From-Spec or To-Spec AVP and using more than one From-Spec or To-Spec AVP in the Classifier AVP, one can express many different types of address pools.



 TOC 

4.1.  Negated AVP

The Negated AVP (AVP Code TBD) of type Enumerated containing the values of True or False. Exactly zero or one of these attributes may appear in the From-Spec or To-Spec AVP. When set to True the meaning of the match in the To-Spec and From-Spec are negated, causing all other addresses to be matched instead.

When set to False, or when the attribute is not included in the From-Spec or To-Spec AVP then the meaning of the match is not inverted, causing only the addresses specified to be matched.

Note that the negation does not impact the port comparisons.

  Value | Name
  ------+--------
    0   | False
    1   | True



 TOC 

4.2.  IP-Address AVP

The IP-Address AVP (AVP Code TBD) is of type Address and specifies a single IP address (IPv4 or IPv6) address to match.



 TOC 

4.3.  IP-Address-Range AVP

The IP-Address-Range AVP (AVP Code TBD) is of type Grouped and specifies an inclusive IP address range.

IP-Address-Range ::= < AVP Header: XXX >
                     [ IP-Address-Start ]
                     [ IP-Address-End ]
                   * [ AVP ]

If the IP-Address-Start AVP is not included then the address range starts from the first valid IP address up to and including the specified IP-Address-End address.

If the IP-Address-End AVP is not included then the address range starts at the address specified by the IP-Address-Start AVP and includes all the remaining valid IP addresses.



 TOC 

4.4.  IP-Address-Start AVP

The IP-Address-Start AVP (AVP Code TBD) is of type Address and specifies the first IP address (IPv4 or IPv6) address of an IP address range.



 TOC 

4.5.  IP-Address-End AVP

The IP-Address-End AVP (AVP Code TBD) is of type Address and specifies the last IP address (IPv4 or IPv6) address of an address range.



 TOC 

4.6.  IP-Address-Mask AVP

The IP-Address-Mask AVP (AVP Code TBD) is of type Grouped and specifies an IP address range using a base IP address and the bit-width of the mask. For example, a range expressed as 1.2.3.0/24 will match all IP addresses from 1.2.3.0 up to and including 1.2.3.255. The bit-width MUST be valid for the type of IP address.

IP-Address-Mask ::= < AVP Header: XXX >
                    [ IP-Address ]
                    [ IP-Bit-Mask-Width ]
                  * [ AVP ]



 TOC 

4.7.  IP-Mask-Bit-Mask-Width AVP

The IP-Bit-Mask-Width AVP (AVP Code TBD) is of type OctetString. The value is a single octet and specifies the width of an IP address bit-mask.



 TOC 

4.8.  MAC-Address AVP

The MAC-Address AVP (AVP Code TBD) is of type OctetString and specifies a single MAC address. The value is a 6 octets encoding of the MAC address as it would appear in the frame header.



 TOC 

4.9.  Port AVP

The Port AVP (AVP Code TBD) is of type Integer32 in the range of 0 to 65535 and specifies the TCP or UDP port number to match.



 TOC 

4.10.  Port-Range AVP

The Port-Range AVP (AVP Code TBD) is of type Grouped and specifies an inclusive range of ports.

Port-Range ::= < AVP Header: XXX >
               [ Port-Start ]
               [ Port-End ]
             * [ AVP ]

If the Port-Start AVP is omitted then port 0 is assumed. If the Port-End AVP is omitted then port 65535 is assumed.



 TOC 

4.11.  Port-Start AVP

The Port-Start AVP (AVP Code TBD) is of type Integer32 and specifies the first port number of an IP port range.



 TOC 

4.12.  Port-End AVP

The Port-End AVP (AVP Code TBD) is of type Integer32 and specifies the last port number of an IP port range.



 TOC 

4.13.  Assigned AVP

In some scenarios, the AAA does not know the IP address assigned to the Managed Terminal at the time that the Classifier is sent to the Classifying Entity. The Assigned AVP (AVP Code TBD) is of type Enumerated and consists of the value "Assigned". When present, it represents the IP address assigned to the Managed Terminal.



 TOC 

5.  Header Option AVPs

The Classifer AVP may contain one or more of the following AVPs to match on the various possible IP, TCP or ICMP header options.



 TOC 

5.1.  Diffserv-Code-Point AVP

The Diffserv-Code-Point AVP (AVP Code TBD) is of type Enumerated and specifies the Differentiated Services Field Codepoints to match in the IP header. The values are managed by IANA under the Differentiated Services Field Codepoints registry [3] (IANA,, “Differentiated Services Field Codepoints,” .).



 TOC 

5.2.  Fragmentation-Flag AVP

The Fragmentation-Flag AVP (AVP Code TBD) is of type Enumerated and specifies the packet fragmentation flags to match in the IP header.

  Value | Name and Semantic
  ------+------------------------------------------------------------
    0   | RESERVED
    1   | Don't Fragment (DF)
    2   | More Fragments (MF)



 TOC 

5.3.  IP-Option AVP

The IP-Option AVP (AVP Code TBD) is of type Grouped and specifies an IP header option that must be matched.

IP-Option ::= < AVP Header: XXX >
              { IP-Option-Type }
            * [ IP-Option-Value ]
              [ Negated ]
            * [ AVP ]

If one or more IP-Option-Value AVPs are present, one of the values MUST match the value in the IP header option. If the IP-Option-Value AVP is absent, the option type MUST be present in the IP header but the value is wildcarded.

The Negated AVP is used in conjuction with the IP-Option-Value AVPs to specify IP header options which do not match specific values. The Negated AVP is used without the IP-Option-Value AVP to specify IP headers which do not contain the option type.



 TOC 

5.4.  IP-Option-Type AVP

The IP-Option-Type AVP (AVP Code TBD) is of type Enumerated and the values are managed by IANA under the IP Option Numbers registry [4] (IANA,, “IP Option Numbers,” .).



 TOC 

5.5.  IP-Option-Value AVP

The IP-Option-Value AVP (AVP Code TBD) is of type OctetString and contains the option value that must be matched.



 TOC 

5.6.  TCP-Option AVP

The TCP-Option AVP (AVP Code TBD) is of type Grouped and specifies a TCP header option that must be matched.

TCP-Option ::= < AVP Header: XXX >
               { TCP-Option-Type }
             * [ TCP-Option-Value ]
               [ Negated ]
             * [ AVP ]

If one or more TCP-Option-Value AVPs are present, one of the values MUST match the value in the TCP header option. If the TCP-Option-Value AVP is absent, the option type MUST be present in the TCP header but the value is wildcarded.

The Negated AVP is used in conjuction which the TCP-Option-Value AVPs to specify TCP header options which do not match specific values. The Negated AVP is used without the TCP-Option-Value AVP to specify TCP headers which do not contain the option type.



 TOC 

5.7.  TCP-Option-Type AVP

The TCP-Option-Type AVP (AVP Code TBD) is of type Enumerated and the values are managed by IANA under the TCP Option Numbers registry [5] (IANA,, “TCP Option Numbers,” .).



 TOC 

5.8.  TCP-Option-Value AVP

The TCP-Option-Value AVP (AVP Code TBD) is of type OctetString and contains the option value that must be matched.



 TOC 

5.9.  TCP-Flags AVP

The TCP-Flags AVP (AVP Code TBD) is of type Grouped and specifies a set of TCP control flags that must be matched.

TCP-Flags ::= < AVP Header: XXX >
            * [ TCP-Flag-Type ]
              [ Negated ]
            * [ AVP ]

If the Negated AVP is not present, the TCP-Flag-Type AVPs specifies which flags MUST be set. If the Negated AVP is present, the TCP-Flag-Type AVPs specifies which flags MUST be cleared.



 TOC 

5.10.  TCP-Flag-Type AVP

The TCP-Flag-Type AVP (AVP Code TBD) is of type Enumerated and specifies a TCP control flag type that must be matched.

  Value | Name and Semantic
  ------+------------------------------------------------------------
    0   | RESERVED
    1   | CWR - Congestion Window Reduced.
    2   | ECE - ECN-Echo. TCP peer is ECN capable.
    3   | URG - URGent pointer field is significant.
    4   | ACK - ACKnowledgment field is significant.
    5   | PSH - Push function.
    6   | RST - Reset the connection.
    7   | SYN - Synchronize sequence numbers.
    8   | FIN - No more data from sender.



 TOC 

5.11.  ICMP-Type

The ICMP-Type AVP (AVP Code TBD) is of type Grouped and specifies a ICMP message type that must be matched.

ICMP-Type ::= < AVP Header: XXX >
              { ICMP-Type-Number }
            * [ ICMP-Code ]
            * [ AVP ]

If the ICMP-Code AVP is present, the value MUST match that in the ICMP header. If the ICMP-Code AVP is absent, the ICMP type MUST be present in the ICMP header but the code is wildcarded.



 TOC 

5.12.  ICMP-Type-Number AVP

The ICMP-Type-Number AVP (AVP Code TBD) is of type Enumerated and the values are managed by IANA under the ICMP Type Numbers registry [6] (IANA,, “ICMP Type Numbers,” .).



 TOC 

5.13.  ICMP-Code AVP

The ICMP-Code AVP (AVP Code TBD) is of type Enumerated and the values are managed by IANA under the ICMP Type Numbers registry [6] (IANA,, “ICMP Type Numbers,” .).



 TOC 

6.  References



 TOC 

6.1. Normative References

[1] Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” BCP 14, RFC 2119, March 1997 (TXT, HTML, XML).
[2] IANA,, “Protocol Types,”  http://www.iana.org/assignments/protocol-numbers.
[3] IANA,, “Differentiated Services Field Codepoints,”  http://www.iana.org/assignments/dscp-registry.
[4] IANA,, “IP Option Numbers,”  http://www.iana.org/assignments/ip-parameters.
[5] IANA,, “TCP Option Numbers,”  http://www.iana.org/assignments/tcp-parameters.
[6] IANA,, “ICMP Type Numbers,”  http://www.iana.org/assignments/icmp-parameters.


 TOC 

6.2. Informative References

[7] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and J. Arkko, “Diameter Base Protocol,” RFC 3588, September 2003 (TXT).


 TOC 

Authors' Addresses

  Avi Lior
  Bridgewater Systems
  303 Terry Fox Drive, Suite 500
  Ottawa, Ontario
  Canada K2K 3J1
Phone:  +1 613-591-6655
Email:  avi@bridgewatersystems.com
  
  Mark Jones
  Bridgewater Systems
  303 Terry Fox Drive, Suite 500
  Ottawa, Ontario K2K 3J1
  Canada
Phone:  +1 613-591-6655
Email:  mark.jones@bridgewatersystems.com


 TOC 

Full Copyright Statement

Intellectual Property