Subject: iscsi - InitiatorName key during login

From: andy currid <[email-masked]>
Date: Mon, 8 Oct 2001 09:34:07 -0700 (PDT)

iSCSI version 8 is unclear as to whether InitiatorName is required
in the first login PDU of every login in a session, or just the
leading login.

Chapter 5, Login Phase, states -

 "The login phase sequence of commands and responses proceeds as follows:

   - login initial request
   - login partial response (optional)
   - more login requests and responses (optional)
   - login final-response (mandatory)

  The initial login request MUST include the InitiatorName and
  SessionType key=value pairs."

Taken in the context, this wording implies that for any login, the
first login PDU must contain the InitiatorName key.

Appendix D.13, InitiatorName, states that InitiatorName is Leading
Only and that "this key MUST be provided by the initiator of the TCP
connection to the remote endpoint before the end of the login phase".

This wording implies that InitiatorName is supplied in the leading
login only, and need not necessrily appear in the first login PDU
of the leading login.

So which is correct?

It seems to me that requiring that InitiatorName be present in the
first PDU of the leading login is a must, to allow targets to verify
up front whether or not they wish to proceed further with this
initiator. I don't think there's much incremental benefit to having
InitiatorName appear in the first login PDU of every login.

Andy
--
Andy Currid                                       [email-masked]
Server Products Group                       http://www.windriver.com
Wind River Networks                         Phone : (1) 510 749 2191
500 Wind River Way, Alameda, CA 94501       Fax   : (1) 510 749 2560

---

From: "KRUEGER,MARJORIE (HP-Roseville,ex1)" <[email-masked]>
Date: Mon, 8 Oct 2001 13:57:28 -0400

I would think InitiatorName is required on the first login PDU of every
connection - InitiatorName is required for target authentication of the
initiator, and that happens each time a connection joins the session.  To
behave otherwise seems an opportunity for identity spoofing?

In any case, this needs to be clarified in the next revision...

Marjorie Krueger
Networked Storage Architecture
Networked Storage Solutions Org.
Hewlett-Packard
tel: +1 916 785 2656
fax: +1 916 785 0391
email: [email-masked] 

> -----Original Message-----
> From: andy currid [mailto:[email-masked]]
> Sent: Monday, October 08, 2001 9:34 AM
> To: [email-masked]
> Subject: iscsi - InitiatorName key during login
> 
> 
>

---

From: "John Hufferd" <[email-masked]>
Date: Mon, 8 Oct 2001 13:36:41 -0700

Marjorie is correct.  Without the Initiator Name on all Logins  a Secondary
Connection can spoof its way in.  The appendix needs to be corrected.

.
.
.
John L. Hufferd
Senior Technical Staff Member (STSM)
IBM/SSG San Jose Ca
Main Office (408) 256-0403, Tie: 276-0403,  eFax: (408) 904-4688
Home Office (408) 997-6136
Internet address: [email-masked]

"KRUEGER,MARJORIE (HP-Roseville,ex1)" <[email-masked]>@ece.cmu.edu
on 10/08/2001 10:57:28 AM

Sent by:  [email-masked]

To:   [email-masked]
cc:
Subject:  RE: iscsi - InitiatorName key during login

Marjorie Krueger

---

From: "Julian Satran" <[email-masked]>
Date: Tue, 9 Oct 2001 00:09:36 +0300

You are the naming team so you must be right!  The current authentication 
schemes do not make specific use of the InitiatorName but some 
authentication has to be used. What makes InitiaatorName needed that you 
did consider earlier?

Julo

John Hufferd@IBMUS
08-10-01 22:36

        To:     Julian Satran/Haifa/IBM@IBMIL@IBMDE, "KRUEGER,MARJORIE (HP-Roseville,ex1)" 
<[email-masked]>, [email-masked]]
        cc:     [email-masked]
        From:   John Hufferd/San Jose/IBM@IBMUS
        Subject:        RE: iscsi - InitiatorName key during login

Marjorie is correct.  Without the Initiator Name on all Logins  a 
Secondary Connection can spoof its way in.  The appendix needs to be 
corrected.

.
.
.
John L. Hufferd

Marjorie Krueger

---

From: "KRUEGER,MARJORIE (HP-Roseville,ex1)" <[email-masked]>
Date: Mon, 8 Oct 2001 15:14:05 -0700

In any implementation, there may be a separation between authentication and
authorization.

I admit insufficient data WRT iSCSI security draft, but I am assuming that
regardless what authentication scheme is in use, an implementation may or
may not have some association between authentication "userId" and an
initiator access control list consisting of InitiatorNames.  So even if an
initiator is "authenticated", this InitiatorName may not be allowed access
to this target?  The earlier list discussion seemed to indicate "userId" is
separate from "InitiatorName"

For instance, IPSec authenticates based on IP address.  But there is no
requirement that there be a one-one association between an IP address and an
InitiatorName, so while the IP address may authenticate, the InitiatorName
may not be allowed access to the target.  

Perhaps on a connection joining a session, it is enough that the connection
knows the correct ISID, TSID?  But I am thinking that requiring the correct
InitiatorName is a small price to pay for an added check.  ISID=1, TSID=1 is
easy to "guess", but correct InitiatorName is not.

Please correct me if you see a flaw in my thinking...

Marjorie  
-----Original Message-----
From: Julian Satran [mailto:[email-masked]]
Sent: Monday, October 08, 2001 2:10 PM
To: [email-masked]
Subject: RE: iscsi - InitiatorName key during login

You are the naming team so you must be right!  The current authentication
schemes do not make specific use of the InitiatorName but some
authentication has to be used. What makes InitiaatorName needed that you did
consider earlier? 

Julo 

John Hufferd@IBMUS 
08-10-01 22:36 

        To:        Julian Satran/Haifa/IBM@IBMIL@IBMDE, "KRUEGER,MARJORIE
(HP-Roseville,ex1)" <[email-masked]>, [email-masked]] 
        cc:        [email-masked] 
        From:        John Hufferd/San Jose/IBM@IBMUS 
        Subject:        RE: iscsi - InitiatorName key during loginLink 

.
.
.
John L. Hufferd

Marjorie Krueger

---

From: "John Hufferd" <[email-masked]>
Date: Mon, 8 Oct 2001 15:14:05 -0700

Julian,
Even on Secondary connections Security Authentication is required.   As
part of this Authentication, the implementation needs to validate the
UserID has the right to Use a specific iSCSI Initiator Name, therefore it
needs to have the iSCSI Initiator Name.

Now it is possible that the implementation has kept, the Initiator Node
Name some where associated with the primary connection.   In this case, if
the other information in the PDU was sufficient to obtain the correlation
to a specific Session, and thereby extract the iSCSI Initiator Name, then
it would be possible to compare that to the list of iSCSI Initiators which
the UserID is allowed to use.

So, I guess I over spoke, it is possible to come up with an approach that
works without the iSCSI Initiator Name being Sent on the Secondary
Connection, but, it would be a non standard compare path with the normal
ACL interaction.

I still believe, however, that the iSCSI Initiator Name should be required
on each connection to keep the implementations easier.

.
.
.
John L. Hufferd

"Julian Satran" <[email-masked]>@ece.cmu.edu on 10/08/2001
02:09:36 PM

To:   [email-masked]
cc:

Julo

                             John Hufferd@IBMUS               To:           
                                                      Julian                
                             08-10-01 22:36           Satran/Haifa/IBM@IBMI 
                                                      L@IBMDE,              
                                                      "KRUEGER,MARJORIE     
                                                      (HP-Roseville,ex1)"   
                                                      <marjorie_krueger@hp. 
                                                      com>,                 
                                                      [email-masked]]   
                                                              cc:           
                                                      [email-masked]       
                                                              From:         
                                                      John Hufferd/San      
                                                      Jose/IBM@IBMUS        
                                                              Subject:      
                                                      RE: iscsi -           
                                                      InitiatorName key     
                                                      during loginLink      

                                                                            

.
.
.
John L. Hufferd

To:        [email-masked]
cc:

Marjorie Krueger

---

From: "Julian Satran" <[email-masked]>
Date: Tue, 9 Oct 2001 07:01:19 +0300

Marjorie,

I am not an expert in names :-)
It is up to your team to tell me what to do.  I can object (as any list 
member) but I do not have any strong belief on this.
IMHO it is an overkill to have it on any connection since this requires 
the target to check it against SSID but that
is only an opinion (and I have been know not to agree with my own opinions 
sometime).

Julo

"KRUEGER,MARJORIE (HP-Roseville,ex1)" <[email-masked]>
Sent by: [email-masked]
09-10-01 00:14
Please respond to "KRUEGER,MARJORIE (HP-Roseville,ex1)"

        To:     Julian Satran/Haifa/IBM@IBMIL, [email-masked]
        cc: 
        Subject:        RE: iscsi - InitiatorName key during login

In any implementation, there may be a separation between authentication 
and
authorization.

to this target?  The earlier list discussion seemed to indicate "userId" 
is

For instance, IPSec authenticates based on IP address.  But there is no
requirement that there be a one-one association between an IP address and 
an
InitiatorName, so while the IP address may authenticate, the InitiatorName
may not be allowed access to the target. 

Perhaps on a connection joining a session, it is enough that the 
connection
knows the correct ISID, TSID?  But I am thinking that requiring the 
correct
InitiatorName is a small price to pay for an added check.  ISID=1, TSID=1 
is
easy to "guess", but correct InitiatorName is not.

Marjorie 
-----Original Message-----
From: Julian Satran [mailto:[email-masked]]
Sent: Monday, October 08, 2001 2:10 PM
To: [email-masked]
Subject: RE: iscsi - InitiatorName key during login

did
consider earlier? 

Julo 

John Hufferd@IBMUS 
08-10-01 22:36 

Secondary

.
.
.
John L. Hufferd

Marjorie Krueger

---

From: "Julian Satran" <[email-masked]>
Date: Tue, 9 Oct 2001 20:36:12 +0300

08 has some contradictory statements. InitiatorName is mandatory on every 
first login on every connection.

Julo

andy currid <[email-masked]>
Sent by: [email-masked]
08-10-01 18:34
Please respond to andy currid

        To:     [email-masked]
        cc: 

   - login initial request

So which is correct?

Andy