SORT BY:

LIST ORDER
THREAD
AUTHOR
SUBJECT


SEARCH

IPS HOME


    [Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

    Re: iSCSI login phasing



    All:
    
    Attached are 2 ASCII text files.  Once contains a state diagram
    for the iSCSI Initiator login phase, the other a state diagram
    for the iSCSI Target login phase.
    
    The Initiator state machine has only 6 states with 10 allowed
    transitions, and the Target state machine has only 5 states
    with 7 allowed transitions.  Both diagrams have the form of
    a single "spine" with minimal branching.  Error/failure
    transitions are not shown, since they always result in
    closing the connection during login (on the target side
    a reject message may be sent first).
    
    Both of these diagrams are based on draft 7 with simplifications
    suggested by Julian, Rod Harrison, Steve Senum, Eddy Quicksall,
    Stephen Bailey, Barry Reinhold, myself and others.
    
    These include:
    
    1. Every login is split into 2 distinct subphases (security and
       operational) with a required demarcation line between them.
    
    1. Every login starts in the security subphase and must contain
       at least the keys: TargetName, InitiatorName, HeaderDigest,
       DataDigest, AuthMethod, and optionally SessionType=Normal.
    
    2. No operational parameters can be negotiated before or during
       the security subphase (informational parameters, like
       TargetName, although listed in Appendix D, do not require
       negotiation and are not considered "operational" here).
    
    3. The security subphase ends with a required 2- or 3-way handshake of
       Text and Text Response PDUs containing only the
       SecurityContextComplete=yes key and ending with a message from
       the target to the initiator.  The negotiated security functions
       become effective only at the successful conclusion of this handshake.
    
    4. The operational subphase always begins immediately after the
       handshake had been completed.  No security parameters can be
       negotiated during or after the operational subphase.
    
    5. The operational subphase ends with a Login Response with F=1 from
       the target to the initiator, at which time both target and
       initiator are in Full Feature Phase (the final state in both
       diagrams).
    
    Comments please.
    
    Bob Russell
    InterOperability Lab
    University of New Hampshire
    rdr@iol.unh.edu
    603-862-3774
    
    
    
    On Fri, 27 Jul 2001, Julian Satran wrote:
    
    > Dear colleagues,
    > 
    > As some of you have complained about difficulty in implementing the login
    > phase I thought it might be worthwhile to consider a slight departure from
    > the current description.
    > 
    > The current text assumes that negotiations are forming one tree and the
    > "login machine" has to parse the tree.
    > A leaf node will completely define a state and some pathes may get you to
    > error.
    > 
    > I was driven to this design by the need to keep the parsing tree minimal
    > (under the assumption that any split in subtrees
    > will result is some parameters needing to appear in several subtrees).
    > 
    > However - after the noisy (mostly UPPERCASE) debate - I came to realize
    > that few if any have done the generalized mapping I started with, and
    > implemented a parser,  and ad-hoc, man-glued, engines have to have smaller
    > trees for the next plugfest (although by then some bright undergraduate
    > student may take onto himself to give us  an open-source yacc definition of
    > the login phase!).
    > 
    > I looked at the 2 phases and the number of key=values that they share are
    > probably limited today at initiator and target names (some
    > organizations/configurations want them for authentication while some others
    > will object to them being revealed in the "open phase") and as such we may
    > want to slit the login in 2, completely bracketed, phases each of them
    > optional but not both:
    > 
    > 
    >    a security phase that if present must start with the login command and
    >    is bracketed by the pairs SecurityPhase=start and ended by
    >    SecurityPhase=end (on both initiator and target)
    >    an operational-parameter-negotiation phase that must follow security
    >    phase (if there is a security phase) and is bracketed by the pairs
    >    OperationalPhase=start and OperationalPhase=end (on both initiator and
    >    target)
    > 
    > 
    > Some additional rules will apply:
    > 
    >    No request/response will span phases
    >    The phase closing handshake can start on both sides but if started at
    >    target will be followed by an "full initiator target handshake" - i.e a
    >    new phase or the "curtain close" end always with the target having the
    >    last word.
    >    keys will be clearly segregated and only a few (like names) should be
    >    allowed in both.
    > 
    > 
    > Comments?
    > 
    > Julo
    > 
    > 
    > 
    
    Login Phase Processing for an iSCSI Initiator
    
    The initiator has 6 states:
    
        I1: Await Connection
        I2: Await LPR
        I3: Negotiate Security
        I4: Leave Security
        I5: Negotiate Operational
        I6: Full Feature Phase
    
    There are 10 allowed transitions:
    
     From \ To->    I1  |   I2  |   I3  |   I4  |   I5  |   I6  |
     ------\---+--------+-------+-------+-------+-------+-------+
        I1     |        |   X1  |       |       |       |       |
        -------+--------+-------+-------+-------+-------+-------+
        I2     |        |       |   X2  |   X3  |       |       |
        -------+--------+-------+-------+-------+-------+-------+
        I3     |        |       |   X4  |   X5  |       |       |
        -------+--------+-------+-------+-------+-------+-------+
        I4     |        |       |   X6  |   X7  |   X8  |       |
        -------+--------+-------+-------+-------+-------+-------+
        I5     |        |       |       |       |   X9  |   X10 |
        -------+--------+-------+-------+-------+-------+-------+
        I6     |        |       |       |       |       |       |
        -------+--------+-------+-------+-------+-------+-------+
    
    Initial state:
        I1  - entered when Initiator tries to open a TCP connection to a target
    
    
    Final state:
        I6  - a transition into this state enters Full Feature Phase
    
    
    Transitions:
    
    X1: Taken when:     Connection to target is successfully established
    
        Action:         Send Login Command
                        with F=0
                    and with TargetName= key
                    and with InitiatorName= key
                    and if desired, with SessionType=Normal key
                    and with HeaderDigest= key
                    and with DataDigest= key
                    and with AuthMethod= key
    
    X2: Taken when:     Initiator receives Login Response from target with F=0,
                        with status=0x0001, with replies to security keys
                        initiator offered on X1, and with any security keys
                        offered by target
                    and Initiator must reply to security keys from target
                        and/or Initiator wants to offer additional security
                        keys to target
    
        Action:         Send Text Command
                        with F=0
                    and with any replies to security keys offered by target
                    and with any additional security keys to offer to target
    
    X3: Taken when:     Initiator receives Login Response from target with F=0,
                        with status=0x0001, with replies to security keys
                        initiator offered on X1, and with any security keys
                        offered by target
                    and Initiator does not need to reply to security keys from
                        target
                    and Initiator does not want to offer security keys to target
    
        Action:         Same as Action on X5
    
    X4: Taken when:     Initiator receives Text Response from target with F=0,
                        with replies to security keys initiator offered on X2,
                        X4 or X6, and with any security keys offered by target
                    and Initiator needs to reply to security keys from target
                        and/or Initiator wants to offer additional security
                        keys to target 
    
        Action:         Same as Action on X2
    
    X5: Taken when:     Initiator receives Text Response from target with F=0,
                    either  with replies to security keys initiator offered on
                            X2, X4 or X6, and with any security keys offered
                            by target
                    or      with SecurityContextComplete=yes as only key from
                            target
                    and Initiator does not need to reply to security keys from
                        target
                    and Initiator does not want to offer additional security
                        keys to target
    
        Action:         Send Text Command
                        with F=0
                    and with SecurityContextComplete=yes as only key
    
    X6: Taken when:     Initiator receives Text Response from target with F=0,
                        and with any security keys offered by target
                    and Initiator needs to reply to security keys from target
                        and/or Initiator wants to offer security keys to target
    
        Action:         Same as Action on X2
    
    X7: Taken when:     Initiator receives Text Response from target with F=0,
                        and with security keys offered by target
                    and Initiator does not need to reply to security keys from
                        target
    
        Action:         Same as Action on X5
    
    X8: Taken when:     Initiator receives Text Response from target with F=0
                        and with SecurityContextComplete=yes as only key
    
        Action: 1.      Put negotiated security measures into effect
                2.      Send Text Command
                        with F=1
                    and with all operational keys to offer to target
                        (can be empty)
    
    X9: Taken when:     Initiator receives Text Response from target with F=0,
                        with any replies to operational keys initiator offered
                        on X8 or X9, and with any operational keys offered by
                        target
                    and Initiator needs to reply to operational keys from target
                        and/or Initiator needs to offer operational keys to
                        target
    
        Action:         Send Text Command
                        with F=1
                    and with any replies to operational keys offered by target
                    and with all additional operational keys to offer to target
    
    X10:Taken when:     Initiator receives Login Response from target with F=1,
                        with status=0x0000, with any replies to operational keys
                        initiator offered on X8 or X9, and with no operational
                        keys offered by target that require a reply
    
        Action:         enter Full Feature Phase
    
    Login Phase Processing for an iSCSI Target
    
    The target has 5 states:
    
        T1: Await Login
        T2: Negotiate Security
        T3: Leave Security
        T4: Negotiate Operational
        T5: Full Feature Phase
    
    There are 7 allowed transitions:
    
     From \ To->    T1  |   T2  |   T3  |   T4  |   T5  |
     ------\---+--------+-------+-------+-------+-------+
        T1     |    Z1  |       |       |       |       |
        -------+--------+-------+-------+-------+-------+
        T2     |        |   Z2  |   Z3  |   Z4  |       |
        -------+--------+-------+-------+-------+-------+
        T3     |        |       |       |   Z5  |       |
        -------+--------+-------+-------+-------+-------+
        T4     |        |       |       |   Z6  |   Z7  |
        -------+--------+-------+-------+-------+-------+
        T5     |        |       |       |       |       |
        -------+--------+-------+-------+-------+-------+
    
    Initial state:
        T1  - entered when Target successfully accepts a TCP connection with an
              initiator
    
    
    Final state:
        T5  - a transition into this state enters Full Feature Phase
    
    
    Transitions:
    
    Z1: Taken when:     Target receives Login Command from initiator with F=0,
                        with TargetName= key, with InitiatorName= key,
                        optionally with SessionType=Normal key, and with
                        security keys offered by initiator
    
        Action:         Send Login Response
                        with F=0
                    and with status=0x0001
                    and with replies to security keys offered by initiator
                    and with any additional security keys to offer to initiator
    
    Z2: Taken when:     Target receives Text Command from initiator with F=0,
                    either  with any replies to security keys offered on Z1 or
                            Z2, and with any security keys offered by initiator
                        or  with SecurityContextComplete=yes as only key
                    and Target needs to reply to security keys from initiator
                        and/or Target wants to offer security keys to initiator
    
        Action:         Send Text Response
                        with F=0
                    and with any replies to security keys offered by initiator
                    and with any additional security keys to offer to initiator
    
    Z3: Taken when:     Target receives Text Command from initiator with F=0,
                        with any replies to security keys offered on Z1 or Z2,
                        and with any security keys offered by initiator
                    and Target does not need to reply to security keys from
                        initiator
                    and Target does not want to offer additional security keys
                        to initiator
    
        Action:         Send Text Response
                        with F=0
                    and with SecurityContextComplete=yes as only key
    
    Z4: Taken when:     Target receives Text Command from initiator with F=0
                        and with SecurityContextComplete=yes as only key
                    and Target does not want to offer additional security keys
                        to initiator
    
        Action:         Same as actions on Z5
    
    Z5: Taken when:     Target receives Text Command from initiator with F=0
                        and with SecurityContextComplete=yes as only key
    
        Action: 1.      Send Text Response
                        with F=0
                    and with SecurityContextComplete=yes as only key
                2.      Put all negotiated security measures into effect
    
    Z6: Taken when:     Target receives Text Command from initiator with F=1,
                        with any replies to operational keys target offered
                        on Z6, and with any operational keys offered by
                        initiator
                    and Target wants to offer additional operational keys
                        that require a reply from initiator
    
        Action:         Send Text Response
                        with F=0
                    and with any replies to operational keys offered by
                        initiator
                    and with all additional operational keys to offer to
                        initiator
    
    Z7: Taken when:     Target receives Text Command from initiator with F=1,
                        with any replies to operational keys target offered
                        on Z6, and with any operational keys offered by
                        initiator
                    and Target does not want to offer additional operational
                        keys that require a reply from initiator
    
        Action:         Send Login Response
                        with F=1
                    and with any replies to operational keys offered by
                        initiator (can be empty)
    


Home

Last updated: Tue Sep 04 01:04:10 2001
6315 messages in chronological order