Subject: Invalid Pdus received during Login phase

From: "Praveen madhavan" <[email-masked]>
Date: Tue, 30 Jul 2002 04:37:40 -0700

Hi,
 I would like to know the behavior of Target, when it receives invalid Pdu's during login phase. 
   Will target generates login response with Error of status detail -"Invalid during login" and terminates the connections. 
Or Reject command with reason code- "Protocol Error/Invalid PDU".

 If Invalid Pdus are received by Target, even before login phase
( I mean just before first login request from initiator), i think target can't send login response for it since it was not aware of ISID. In such senario how will target react ?

regards
Praveen.M 

------------------------------------------------------------
NEW - FREE Nettaxi 56kbs Dial-up INTERNET ACCESS with NO ADS or Ad Bars!
http://www.nettaxi.com/isp/

---

From: [email-masked]
Date: Tue, 30 Jul 2002 13:55:20 -0600

Praveen,

This appears to be covered in 2.3 Last paragraph on page 33. "Before the Full Feature Phase is established, only Login Request and Login Response PDUs are allowed. Any other PDU, when received at initiator or target, is a protocol error and MUST result in the connection being terminated." 

So, if the target gets PDU that isn't a Login Request PDU during login, it closes the TCP connection (it might be more clear to say "TCP connection" rather than just "connection" in the text quoted above). It can't send a Login Response PDU because it hasn't gotten a Login Request to respond to. This response should be valid even if no Login PDUs have been received.

In researching this, I noticed that an earlier discussion on the use of protocol error vs negotiation failure seems to have been incompletely applied.

4.2.1 last sentence is confusing. It reads: "The selection of a value not proposed is considered a negotiation failure and MUST be handled as a protocol error." 5.10 and 5.11 cover Negotiation Failures and Protocol errors, respectively, so this sentence makes it unclear which applies. It should say "The selection of a value not proposed MUST be handled as a negotiation failure."

4.2.2 The same edit applies to the third paragraph of 4.2.2.

4.3 Page 70 fifth paragraph "is considered a protocol error" should be "MUST be handled as a negotiation failure."

4.4 Page 78 second paragraph from bottom. Should "Reject" be "Reject PDU"? "Reject" could be misunderstood to be the value "Reject" but then there isn't any way to return "protocol error".

Regards,
Pat

-----Original Message-----
From: Praveen madhavan [mailto:[email-masked]]
Sent: Tuesday, July 30, 2002 4:38 AM
To: [email-masked]
Subject: Invalid Pdus received during Login phase

Hi,

regards
Praveen.M

---

From: Eddy Quicksall <[email-masked]>
Date: Wed, 31 Jul 2002 12:44:29 -0400

IMHO if the target gets anything before the initial login request, it should
just drop the connection without any reply. I have two reasons for saying
this:

1) The "initiator" may not even be iSCSI ... if it was, it would do a login.
You should not respond because it may be a hacker trying to figure things
out and you don't want to give him any clues. Also, if it is not an iSCSI
initiator, you would be sending "garbage" and who know what the client will
do next.

2) More importantly, some hardware implementations may not be able to even
send anything at all without a session and you can't get a session until you
get the initial login request.

So, the spec should not mandate a response and leave that up to the
implementer.

Eddy

-----Original Message-----
From: Praveen madhavan [mailto:[email-masked]]
Sent: Tuesday, July 30, 2002 7:38 AM
To: [email-masked]
Subject: Invalid Pdus received during Login phase

Hi,
 I would like to know the behavior of Target, when it receives invalid Pdu's
during login phase. 
   Will target generates login response with Error of status detail
-"Invalid during login" and terminates the connections. 
Or Reject command with reason code- "Protocol Error/Invalid PDU".

 If Invalid Pdus are received by Target, even before login phase
( I mean just before first login request from initiator), i think target
can't send login response for it since it was not aware of ISID. In such
senario how will target react ?

regards
Praveen.M