[storm] Invalidation (was RE: iSER - another try)

[<[e-mail]>]

Tom,

> The "invalidate" form is, however, sensible to allow after carefully documenting the requirement.
> The initiator MUST verify that the appropriate memory region was invalidated, if any. However,
> whether it MUST or SHOULD perform some additional action is going to be a tough choice. A MUST
> could be too strong of a requirement, if the implementation chooses to cache or share mappings.
> On the other hand, SHOULD can introduce security vulnerabilities. Thoughts?

I think a SHOULD requirement would be ok if text is added to the security considerations section
to discuss exposure of initiator memory via STags, the initiator's responsibility to manage that
exposure via STag invalidation, and the potential security consequences of lazy invalidation that
an initiator implementation may choose to trade off against performance benefits.  This would be
in addition to new security considerations text that warns that an initiator MUST NOT rely upon
responder use of "invalidate" forms of Send (your "MUST verify" stated as a "MUST NOT" requirement).

Thanks,
--David

From: Tom Talpey [mailto:[e-mail]]
Sent: Monday, April 23, 2012 5:31 PM
To: Michael Ko; Black, David
Cc: [e-mail]
Subject: RE: [storm] iSER - another try

We need to separate the issues of Solicited Events from Invalidations.

I don't believe that the use of SendSE is somehow detectable with this approach. The conclusion from item ii) is that the iSER initiator SHOULD NOT arm for solicited events - it MUST be prepared for any event, whether solicited or not. This in turn implies that senders (targets) SHOULD NOT use SendSE at all - unless it's certain that *both* the RCaP and the initiator support them. This feature can neither be detected, nor is it negotiated by iSER.

The "invalidate" form is, however, sensible to allow after carefully documenting the requirement. The initiator MUST verify that the appropriate memory region was invalidated, if any. However, whether it MUST or SHOULD perform some additional action is going to be a tough choice. A MUST could be too strong of a requirement, if the implementation chooses to cache or share mappings. On the other hand, SHOULD can introduce security vulnerabilities. Thoughts?

Also,  isn't the following a new requirement on the RDMA layer?

>(lack of receiver support MUST result in an error send back to the sender).



From: [e-mail] [mailto:[e-mail]] On Behalf Of Michael Ko
Sent: Monday, April 23, 2012 11:55 AM
To: [e-mail]
Cc: [e-mail]
Subject: Re: [storm] iSER - another try

David,

I agree with this position.

Mike
On Mon, Apr 23, 2012 at 6:02 AM, <[e-mail]<mailto:[e-mail]>> wrote:
We don't seem to be making progress on definitive requirements that
vary by RCaP, so here's another suggestion (would be [4] if I were
numbering it ...)

It's clear that at least one implementation has diverged from the
requirements in RFC 5046 for use of SendSE, SendInv and SendInvSE.
I suggest documenting this and applying the IETF approach of "be
conservative in what you send, be liberal in what you accept",
roughly as follows:

i) Some iSER implementations have not followed RFC 5046's strict requirements
       for use of SendSE, SendInv and SendInvSE; they use Send instead.
ii) For interoperability, iSER implementations SHOULD accept and correctly
       process SendSE, SendInv and SendInvSE messages.
iii) SendSE, SendInv and SendInvSE should be regarded as optimizations or
       enhancements to the basic Send message, and their support varies by
       RCaP.  If these messages are used, the implementation SHOULD be
       capable of reverting to use of Send in order to work with a receiver
       that does not support these messages (lack of receiver support MUST
       result in an error send back to the sender).  These messages
       SHOULD NOT be used with the InfiniBand RCaP because InfiniBand does
       not require support for their functionality.
iv) New iSER implementations SHOULD use Send (and not these three additional
       messages) unless there are compelling reasons for doing otherwise
       (latter is implicit in use of "SHOULD", but worth saying explicitly,
       IMHO).
v) Some new text will be needed (including Security Considerations) to
       make it clear that STag invalidation is necessary for security
       reasons, and has to be performed independent of whether an
       Invalidate version of Send was used or not.

Is this workable?

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
[phone]<tel:%2B1%20%28508%29%20293-7953>             FAX: [phone]<tel:%2B1%20%28508%29%20293-7786>
[e-mail]<mailto:[e-mail]>        Mobile: [phone]<tel:%2B1%20%28978%29%20394-7754>
----------------------------------------------------

_______________________________________________
storm mailing list
[e-mail]<mailto:[e-mail]>
https://www.ietf.org/mailman/listinfo/storm