Subject: RE: [rddp] STag validation semantics

From: [email-masked]
Date: Tue, 1 Oct 2002 17:37:20 -0400

>   In IB terms,  the STag=R_Key.  The RDMAP must provide a mechanism
> for associating a STag to a RDMA Stream.  The association may be 1
> STag to 1, and only 1,  RDMA Stream  or  it may be 1 STag to Multiple
> RDMA Streams.  We've left that semantic up to the ULP.  The main
> reason being that specifying that semantic in more detail would have
> caused us, in my view, to describe PDs and QP Contexts.
>
>   However, I guess we could:
> - Add in the definition of a PD;
> - Describe how it must be associated with a RDMA Stream and a STag;
> - Describe how one STag can be used on more than one RDMA Stream
>   if the PDs are the same on both RDMA Streams.
>
>  In my view, it is not necessary to document the above three
> semantics in the RDMAP specification.  However, if most folks feel
> it is absolutely necessary for completeness/correctness,  I will not
> object.

With my WG chair hat on, I believe that this is necessary - if this
is not done, the result is to allow an implementation with a single
global PD across all connections in a multi-user environment,
which would open unacceptable security holes for both memory
access and remote STag Invalidates.  I believe the folks who
pointed out that iSCSI ITTs and IPsec SPIs are restricted to
individual connections/sessions whereas STags have no restrictions
as currently specified are supporting this point (thanks).

Anticipating the "... but, but ... this is a verbs issue" response,
I have a few more comments:
(1) If the RDMAP and DDP protocol specs can only be understood by
    also reading the verbs material, the verbs material needs to
    be submitted as an Internet-Draft ASAP.  Until this is done,
    further discussion of verbs is questionable here.
(2) If there are security properties of the protocols that are
    enforced by the verbs interface, the result will be a
    requirement that implementations MUST NOT provide access
    to the protocols through any interface that doesn't conform
    to the verbs.
I would prefer that the security properties of the protocols
and the restrictions/requirements on implementation behavior
necessary to achieve them be documented in the protocol specs
themselves, but am prepared to be convinced that the only reasonable
way to do this is to specify the verb interface and require its
use.

Thanks,
--David
_______________________________________________
rddp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rddp

---

From: Caitlin Bestler <[email-masked]>
Date: Tue, 1 Oct 2002 21:57:22 -0500

On 10/1/02, [email-masked] wrote:

>
>With my WG chair hat on, I believe that this is necessary
>- if this is not done, the result is to allow an
>implementation with a single global PD across all
>connections in a multi-user environment, which would open
>unacceptable security holes for both memory access and
>remote STag Invalidates.  I believe the folks who pointed
>out that iSCSI ITTs and IPsec SPIs are restricted to
>individual connections/sessions whereas STags have no
>restrictions as currently specified are supporting this
>point (thanks).
>
>Anticipating the "... but, but ... this is a verbs issue"
>response, I have a few more comments:
> also reading the verbs material, the verbs material needs
> to be submitted as an Internet-Draft ASAP.  Until this is
> done, further discussion of verbs is questionable here.
> to the protocols through any interface that doesn't
> conform to the verbs.
>
>I would prefer that the security properties of the
>protocols and the restrictions/requirements on
>implementation behavior necessary to achieve them be
>documented in the protocol specs themselves, but am
>prepared to be convinced that the only reasonable way to
>do this is to specify the verb interface and require its
>use.
>

What is the extent to which verb specification is
permissable and/or desirable?

My assumption has been that the *capabilities* of the local
interface are fully in scope because they are needed to
establish semantics and clarify security issues. But
something that made assumptions about the local programming
model, even to the extent that InfiniBand verbs do, was
going to far.

How close to a correct guideline is that?

Caitlin Bestler
http://asomi.com/CaitlinBestler/
_______________________________________________
rddp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rddp