Subject: [Ips] WG Last Call Review: DA

From: [email-masked]
Date: Fri, 3 Jun 2005 19:12:38 -0400

I have reviewed the DA draft, draft-ietf-ips-iwarp-da-02.txt,
and in addition to a number of editorial comments that I will
send to Mallikarjun, I have one important technical comment -

The Security Considerations section essentially says "there
are no new security considerations because DA does not define
a wire protocol."  That is not correct because DA introduces
at least two architectural concepts to iSCSI that do have
security implications:
- Control/Data separation.  The mechanisms for transmission
	of iSCSI control vs. data are deliberately split by
	DA, and there is no requirement that they even use
	the same transport medium.  This introduces new
	opportunities for an attacker to fiddle with things,
	and may place additional security responsibility on
	an iSCSI-DA implementation over and above an iSCSI
	implementation.
- Explicit resource management/control.  DA introduces
	explicit management of resources at the DI interface,
	including data buffers and Datamover connection resources.
	The latter in particular is likely to be a limited class
	of resource in some anticipated implementations.  Some
	discussion is needed on the possibility of a denial-of-
	service attack via resource exhaustion and the functional
	responsibility of an iSCSI-DA implementation to defend
	against this.
A new Security Considerations section will be needed to address
at least these areas.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

_______________________________________________
Ips mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ips

---

From: "Mallikarjun C." <[email-masked]>
Date: Tue, 07 Jun 2005 12:16:30 -0700

David,

Thanks for the review.

In clear hindsight, I think not referencing RFC 3723 in this section is 
a mistake.  I will put that in.

 > 	the same transport medium.

RFC 3720 defines several MUST requirements on ordering relationships 
across control & data for a given task besides a mandatory deterministic 
task allegiance model - DA is not changing any of that (DA has a 
normative reference on RFC 3720), nor allowing any additional 
flexibility in compliance here.

Sending bulk data transfers (prompted by Put/Get_Data Primitives) on a 
different transport medium would be as ill-advised as sending just the 
iSCSI-3720 Data-out/Data-in PDUs on a different TCP connection in 
traditional iSCSI implementations.

 >DA introduces
 > 	of resource in some anticipated implementations.

By "Datamover connection resources", I assume you mean the logical 
equivalent of posted receive buffers.  The potential for DoS attack, 
IMHO, is qualitatively not different from the iSCSI-3720 case, and so 
appealing to RFC 3723 should address this basic concern.  Would you agree?

Another option is to informationally reference the RDDP security draft 
to direct the reader's attention to suitable remedies for the case of 
RDDP-based Datamovers.

Thanks.

Mallikarjun

Mallikarjun Chadalapaka
Networked Storage Architecture
StorageWorks Division
Hewlett-Packard MS 5668
Roseville CA 95747
cbm [at] rose.hp.com