RE: iscsi - InitiatorName key during login

["John Hufferd" <hufferd@us.ibm.com>]

Marjorie is correct.  Without the Initiator Name on all Logins  a Secondary
Connection can spoof its way in.  The appendix needs to be corrected.

.
.
.
John L. Hufferd
Senior Technical Staff Member (STSM)
IBM/SSG San Jose Ca
Main Office (408) 256-0403, Tie: 276-0403,  eFax: (408) 904-4688
Home Office (408) 997-6136
Internet address: hufferd@us.ibm.com


"KRUEGER,MARJORIE (HP-Roseville,ex1)" <marjorie_krueger@hp.com>@ece.cmu.edu
on 10/08/2001 10:57:28 AM

Sent by:  owner-ips@ece.cmu.edu


To:   ips@ece.cmu.edu
cc:
Subject:  RE: iscsi - InitiatorName key during login



I would think InitiatorName is required on the first login PDU of every
connection - InitiatorName is required for target authentication of the
initiator, and that happens each time a connection joins the session.  To
behave otherwise seems an opportunity for identity spoofing?

In any case, this needs to be clarified in the next revision...

Marjorie Krueger
Networked Storage Architecture
Networked Storage Solutions Org.
Hewlett-Packard
tel: +1 916 785 2656
fax: +1 916 785 0391
email: marjorie_krueger@hp.com

> -----Original Message-----
> From: andy currid [mailto:andy@windriver.com]
> Sent: Monday, October 08, 2001 9:34 AM
> To: ips@ece.cmu.edu
> Subject: iscsi - InitiatorName key during login
>
>
>
> iSCSI version 8 is unclear as to whether InitiatorName is required
> in the first login PDU of every login in a session, or just the
> leading login.
>
> Chapter 5, Login Phase, states -
>
>  "The login phase sequence of commands and responses proceeds
> as follows:
>
>    - login initial request
>    - login partial response (optional)
>    - more login requests and responses (optional)
>    - login final-response (mandatory)
>
>   The initial login request MUST include the InitiatorName and
>   SessionType key=value pairs."
>
> Taken in the context, this wording implies that for any login, the
> first login PDU must contain the InitiatorName key.
>
> Appendix D.13, InitiatorName, states that InitiatorName is Leading
> Only and that "this key MUST be provided by the initiator of the TCP
> connection to the remote endpoint before the end of the login phase".
>
> This wording implies that InitiatorName is supplied in the leading
> login only, and need not necessrily appear in the first login PDU
> of the leading login.
>
> So which is correct?
>
> It seems to me that requiring that InitiatorName be present in the
> first PDU of the leading login is a must, to allow targets to verify
> up front whether or not they wish to proceed further with this
> initiator. I don't think there's much incremental benefit to having
> InitiatorName appear in the first login PDU of every login.
>
> Andy
> --
> Andy Currid                                       andy@windriver.com
> Server Products Group                       http://www.windriver.com
> Wind River Networks                         Phone : (1) 510 749 2191
> 500 Wind River Way, Alameda, CA 94501       Fax   : (1) 510 749 2560
>