Subject: Re: [Ips] PDUs allowed on discovery sessions

From: "Eddy Quicksall" <[email-masked]>
Date: Mon, 18 Oct 2004 14:59:07 -0400

Given what you said below, in a long lived discovery, the initiator and target can still ping each other to verify that the connection is still active; except that the target will always "answer" the ping with a reject.

Is that correct?

Eddy
  ----- Original Message ----- 
  From: Julian Satran 
  To: Dean Scoville 
  Cc: [email-masked] 
  Sent: Wednesday, September 01, 2004 1:05 PM
  Subject: RE: [Ips] PDUs allowed on discovery sessions

  Dean - that is the least it should do. I think that a target implementation is also free to close the session if it is "abused" (avoid a DOS attack). 

  Julo 

        "Dean Scoville" <[email-masked]> 
        01/09/04 17:14 
       To Julian Satran/Haifa/IBM@IBMIL  
              cc <[email-masked]>  
              Subject RE: [Ips] PDUs allowed on discovery sessions 

  Julian, 
  Thanks for the correction. Just so I understand, when the target 
  rejects other PDUs... does it do so by sending a Reject PDU? 

  Thank you. 
  Dean 
    
  -----Original Message-----
  From: Julian Satran [mailto:[email-masked]]
  Sent: Tuesday, August 31, 2004 11:59 PM
  To: Dean Scoville
  Cc: [email-masked]
  Subject: Re: [Ips] PDUs allowed on discovery sessions

  Dean, 

  [email-masked] wrote on 31/08/2004 19:39:50:

  > Section 3.3:
  > 
  >    b) Discovery-session - a session only opened for target 
  >       discovery. The target MUST ONLY accept text requests with the
  >       SendTargets key and a logout request with the reason "close 
  >       the session". All other requests MUST be rejected.
  > 
  > Section 12.21:
  > 
  >    A discovery session indicates to the Target that the only purpose of
  >    this Session is discovery. The only requests a target accepts in
  >    this type of session are a text request with the SendTargets key and a
  >    logout request with reason "close the session".
  > 
  > I originally interpreted the above statements to mean that PDU types
  > such as NOPs
  > could not be sent on discovery sessions. After reading more closely,the above
  > statements only limit what the target is allowed to received (not PDUs the 
  > target can send--such as Asynchronous Messages), and if NOPs aren't considered
  > requests, then the initiator can send them as well.
  > 

  Your interpretation is too liberal. 
  NOPs are forbidden (there was a long discussion about allowing or not long lived discovery sessions as a means of "discovering" changes and the consensus was not to support them. You may argue that a target may send NOPs (and the text does not forbid it) but it MUST reject incoming NOPs. 

  AM was left in as it is required for "logout signals" and if you are sneaky you can use it to signal changes as well. 

  All other PDUs are expressly forbidden. 

  > Is it correct to say that the following PDUs are allowed/disallowed
  > on discovery sessions? 
  > 
  > PDUs allowed on discovery sessions: 
  >    - Asynchronous Message
  >    - SendTargets Text Request/Response
  >    - Login Request/Response
  >    - Logout Request/Response with reason "close the session"
  >    - Reject
  >    - NOP-Out/NOP-In
  > 
  > PDUs not allowed on discovery sessions:  
  >    - SCSI Command/Response
  >    - Task Management Function Request/Response
  >    - SCSI Data-Out/Data-In
  >    - non-SendTargets Text Request/Response
  >    - Ready To Transfer
  >    - Logout Request/Response with reason other than "close the session"
  >    - SNACK Request
  > 
  > 
  > thanks,
  > 
  > Dean Scoville
  > 
  > _______________________________________________
  > Ips mailing list
  > [email-masked]
  > https://www1.ietf.org/mailman/listinfo/ips 

------------------------------------------------------------------------------

  _______________________________________________
  Ips mailing list
  [email-masked]
  https://www1.ietf.org/mailman/listinfo/ips
_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: Paul Koning <[email-masked]>
Date: Mon, 18 Oct 2004 17:01:45 -0400

>>>>> "Eddy" == Eddy Quicksall <[email-masked]> writes:

 Eddy> Given what you said below, in a long lived discovery, the
 Eddy> initiator and target can still ping each other to verify that
 Eddy> the connection is still active; except that the target will
 Eddy> always "answer" the ping with a reject.  Is that correct?

That doesn't sound like what Julian said, and I wouldn't have said
it.  If the protocol prohibits the sending of  PDU type X, it is wrong
to assume that a node will always respond to such illegal PDUs in the
way you wanted.  If you want a fixed well-defined answer to a PDU,
that PDU would be defined as allowed -- not as prohibited -- with a
fixed action on receipt.

If you're committing a protocol violation, don't be surprised to see
your connection summarily deleted.

     paul

 >> Eddy ----- Original Message ----- From: Julian Satran To: Dean
 >> Scoville Cc: [email-masked] Sent: Wednesday, September 01, 2004
 >> 1:05 PM Subject: RE: [Ips] PDUs allowed on discovery sessions

 >> Dean - that is the least it should do. I think that a target
 >> implementation is also free to close the session if it is
 >> "abused" (avoid a DOS attack).

 >> "Dean Scoville" <[email-masked]> 01/09/04 17:14 To
 >> Julian Satran/Haifa/IBM@IBMIL cc <[email-masked]> Subject RE:
 >> [Ips] PDUs allowed on discovery sessions

 >>> Julian, Thanks for the correction. Just so I understand, when
 >>> the target rejects other PDUs... does it do so by sending a
 >>> Reject PDU?
    
 >>> Thank you.  Dean

---

From: Julian Satran <[email-masked]>
Date: Mon, 18 Oct 2004 20:50:14 -0600

Paul is correct. A target that is felt abused may abort the connection. 
I think that the consensus of the group was that we don't want to 
encourage long-lived discovery although we should not outright forbid them 
(that would require more checks).

Julo

Paul Koning <[email-masked]> 
18/10/04 16:01

To
[email-masked]
cc
Julian Satran/Haifa/IBM@IBMIL, [email-masked]
Subject
Re: [Ips] PDUs allowed on discovery sessions

     paul

---

From: "Eddy Quicksall" <[email-masked]>
Date: Thu, 21 Oct 2004 17:12:41 -0400

I asked this because the protocol does not prohibit the initiator from sending a NOP-out. And you actually implied it in your response: "You may argue that a target may send NOPs (and the text does not forbid it) but it MUST reject incoming NOPs." [I assume you meant outgoing]

Can you point out where the protocol prohibits it? In fact, I think the protocol requires the initiator to respond with a NOP-Out:

   Upon receipt of a NOP-In with the Target Transfer Tag set to a valid

   value (not the reserved 0xffffffff), the initiator MUST respond with

   a NOP-Out.  In this case, the NOP-Out Target Transfer Tag MUST

   contain a copy of the NOP-In Target Transfer Tag.

If the target can't send a NOP-in to see if the initiator is still alive, how should it determine this?

If there is an initiator that has a long lived discovery session (and I think  you said they do exist), then where does the protocol say how long the target should wait before it drops the connection? 

Eddy

  ----- Original Message ----- 
  From: Julian Satran 
  To: Paul Koning 
  Cc: [email-masked] ; [email-masked] 
  Sent: Monday, October 18, 2004 10:50 PM
  Subject: Re: [Ips] PDUs allowed on discovery sessions

  Paul is correct. A target that is felt abused may abort the connection. 
  I think that the consensus of the group was that we don't want to encourage long-lived discovery although we should not outright forbid them (that would require more checks). 

  Julo

        Paul Koning <[email-masked]> 
        18/10/04 16:01 
       To [email-masked]  
              cc Julian Satran/Haifa/IBM@IBMIL, [email-masked]  
              Subject Re: [Ips] PDUs allowed on discovery sessions 

      paul

---

From: "Eddy Quicksall" <[email-masked]>
Date: Thu, 21 Oct 2004 18:59:29 -0400

How long would you say I should keep the connection active?

Eddy
  ----- Original Message ----- 
  From: Julian Satran 
  To: Paul Koning 
  Cc: [email-masked] ; [email-masked] 
  Sent: Monday, October 18, 2004 10:50 PM
  Subject: Re: [Ips] PDUs allowed on discovery sessions

  Julo 

       

      paul

---

From: Paul Koning <[email-masked]>
Date: Thu, 21 Oct 2004 19:41:08 -0400

>>>>> "Eddy" == Eddy Quicksall <[email-masked]> writes:

 Eddy> How long would you say I should keep the connection active?

The common practice seems to be to open the connection, ask for what
you want to know, and close it.  That seems like a good choice.

If you're told (out of band -- perhaps through a management UI) that
something might have changed, repeat the operation.  If you need to be
notified of change as it happens, use iSNS, it's meant for that job.

Yes, you could try to keep the discovery session open and poll for
news every little while.  But that isn't the approach I would pick.

     paul

---

From: "Eddy Quicksall" <[email-masked]>
Date: Fri, 22 Oct 2004 08:18:57 -0400

I'm a target. Can you please give me a reference in the spec that says:

1) an initiator can't keep a discover session open
2) if it does, how long does the target wait before dropping the connection

Eddy

---

From: Paul Koning <[email-masked]>
Date: Fri, 22 Oct 2004 09:53:55 -0400

>>>>> "Eddy" == Eddy Quicksall <[email-masked]> writes:

 Eddy> I'm a target. Can you please give me a reference in the spec
 Eddy> that says: 1) an initiator can't keep a discover session open
 Eddy> 2) if it does, how long does the target wait before dropping
 Eddy> the connection

I never implied #1, because the spec says that an initiator CAN keep a
discovery session open.  What I said is that this is not common
practice and not a particularly useful thing to do, and I would not do
it if I were implementing an iniatiator.

As for #2, the spec does not say, and I see no reason why it should.
That's a matter of local choice.

       paul

---

From: Paul Koning <[email-masked]>
Date: Fri, 22 Oct 2004 10:07:48 -0400

>>>>> "Eddy" == Eddy Quicksall <[email-masked]> writes:

 Eddy> I asked this because the protocol does not prohibit the
 Eddy> initiator from sending a NOP-out. And you actually implied it
 Eddy> in your response: "You may argue that a target may send NOPs
 Eddy> (and the text does not forbid it) but it MUST reject incoming
 Eddy> NOPs." [I assume you meant outgoing] Can you point out where
 Eddy> the protocol prohibits it? In fact, I think the protocol
 Eddy> requires the initiator to respond with a NOP-Out...

Section 3.3 says only that "Send Targets" and "Logout, close session"
are legal in discovery sections, and nothing else is.

       paul

---

From: "Eddy Quicksall" <[email-masked]>
Date: Fri, 22 Oct 2004 10:49:33 -0400

> discovery session open.

For a long discovery session, what procedure would you suggest that the 
target use to determine if the initiator is still active?

e.g., for a normal session, section 10.18 says:
   A NOP-Out may be used by an initiator as a "ping request" to verify

   that a connection/session is still active and all its components are

   operational.

and 10.19 says:
   NOP-In is either sent by a target ..., as a  "ping" to an initiator, or 
...

BTW, I have no problem if some words were added to the spec that say 
something like:

An initiator MUST not leave a discover session open for longer than 
Time2Retain seconds.

Or---

Allow NOP-out in discovery sessions.

Eddy

---

From: Julian Satran <[email-masked]>
Date: Fri, 22 Oct 2004 12:51:59 -0500

Eddy,

The protocol does not forbid you to keep a session open.
It just doesn't allow you to do anything to make it really work :-) (i.e., 
usefull to sense changes).
As to all your other questions (how long, what is abuse) it is all up to 
the implementer.

Julo

"Eddy Quicksall" <[email-masked]> 
22/10/04 10:49

To
"Paul Koning" <[email-masked]>
cc
<[email-masked]>, Julian Satran/Haifa/IBM@IBMIL
Subject
Re: [Ips] PDUs allowed on discovery sessions

   operational.

and 10.19 says:

...

Or---

Eddy

----- Original Message ----- 
From: "Paul Koning" <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Friday, October 22, 2004 9:53 AM
Subject: Re: [Ips] PDUs allowed on discovery sessions

>>>>>> "Eddy" == Eddy Quicksall <[email-masked]> 

>>>>>> writes:

---

From: Paul Koning <[email-masked]>
Date: Fri, 22 Oct 2004 14:33:31 -0400

>> I never implied #1, because the spec says that an initiator CAN
 >> keep a discovery session open.

 Eddy> For a long discovery session, what procedure would you suggest
 Eddy> that the target use to determine if the initiator is still
 Eddy> active?

Why do anything?  It seems perfectly ok to keep it open for a bit if
that's the initiators's choice, and then to disconnect it when the
resources could be better used elsewhere.  Or just always after some
number of seconds.

I don't know what useful information I'd get out of a NOP that might
change my decisionmaking in the case of discovery sessions.

 Eddy> BTW, I have no problem if some words were added to the spec
 Eddy> that say something like:

 Eddy> An initiator MUST not leave a discover session open for longer
 Eddy> than Time2Retain seconds.

I suppose we could do that, but would it make the standard better?
It's not clear to me.

 Eddy> Allow NOP-out in discovery sessions.

Same comment.  Yes, that would be possible -- but I don't understand
how it adds value.

    paul

---

From: "Eddy Quicksall" <[email-masked]>
Date: Fri, 22 Oct 2004 17:00:23 -0400

In a normal session the standard has given a method (the ping) so the 
initiator and/or target can determine if the partner is still active. I see 
no reason why a discovery session should be an exception to this.

Yes, it would make the standard better if this was made clear. i.e. if it 
said that long discovery sessions are illegal and how long the initiator 
should wait to close the connection or even better, to allow the NOP ping. 
It seems to me that this was simply an oversight in the text of the spec.

Eddy

---

From: Julian Satran <[email-masked]>
Date: Fri, 22 Oct 2004 21:29:48 -0500

Eddy,

I can assure you that it was no oversight. Saying that long sessions are 
illegal would have required us to specify what is "long".
As this is very much application and implementation dependent we just made 
illegal using the means by which long idle sessions are maintained.
The standard does not say either at what interval, and if at all, NOPs mus 
be used in regular sessions.

Julo

"Eddy Quicksall" <[email-masked]> 
Sent by: [email-masked]
22/10/04 17:00

To
"Paul Koning" <[email-masked]>
cc
[email-masked], Julian Satran/Haifa/IBM@IBMIL
Subject
Re: [Ips] PDUs allowed on discovery sessions

In a normal session the standard has given a method (the ping) so the 
initiator and/or target can determine if the partner is still active. I 
see 
no reason why a discovery session should be an exception to this.

Eddy