Re: CHAP with Open-iSCSI
Ulrich Windl wrote: On 28 Jan 2009 at 12:06, Mike Christie wrote: Arvind Jain wrote: Hi Mike, We are using Open iSCSI initiator with our iSCSI target. I have a question on CHAP. I did some experiment and it appears to me that OneWay-CHAP does not work with open-iscsi, Mutual-CHAP does work fine for me. Have others seen the same behavior? Not really. I have the opposite. I have seen a report where Mutual-CHAP does not work, but OneWay-CHAP works fine with LSI targets. Hi! This brings up the basic question: How to debug/trace CHAP (assuming you have an installation using precompiled software)? wireshark/ethereal. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
Re: CHAP with Open-iSCSI
Arvind Jain wrote: Hi Mike, We are using Open iSCSI initiator with our iSCSI target. I have a question on CHAP. I did some experiment and it appears to me that OneWay-CHAP does not work with open-iscsi, Mutual-CHAP does work fine for me. Have others seen the same behavior? What version are you using? I noticed in git one way chap is broken. 870.1 works though. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
RE: CHAP with Open-iSCSI
Mike, This explains it. We are using: iscsid: transport class version 2.0-867. iscsid version 2.0-869 I will see how to upgrade it. We have patches for bidirectional and large CBDs. Thx, Arvind. -Original Message- From: open-iscsi@googlegroups.com [mailto:open-is...@googlegroups.com] On Behalf Of Mike Christie Sent: Thursday, January 29, 2009 1:34 PM To: open-iscsi@googlegroups.com Subject: Re: CHAP with Open-iSCSI Arvind Jain wrote: Hi Mike, We are using Open iSCSI initiator with our iSCSI target. I have a question on CHAP. I did some experiment and it appears to me that OneWay-CHAP does not work with open-iscsi, Mutual-CHAP does work fine for me. Have others seen the same behavior? What version are you using? I noticed in git one way chap is broken. 870.1 works though. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
Re: CHAP with Open-iSCSI
Arvind Jain wrote: Mike, This explains it. We are using: iscsid: transport class version 2.0-867. iscsid version 2.0-869 No, this is fine. Newer tools support older kernels. That combo should work fine (all login is in userspace anyways so the kernel does not even come into play at this point). Let me do some more debugging and see what is up. I see one bug in the chap code right now. I will see how to upgrade it. We have patches for bidirectional and large CBDs. Thx, Arvind. -Original Message- From: open-iscsi@googlegroups.com [mailto:open-is...@googlegroups.com] On Behalf Of Mike Christie Sent: Thursday, January 29, 2009 1:34 PM To: open-iscsi@googlegroups.com Subject: Re: CHAP with Open-iSCSI Arvind Jain wrote: Hi Mike, We are using Open iSCSI initiator with our iSCSI target. I have a question on CHAP. I did some experiment and it appears to me that OneWay-CHAP does not work with open-iscsi, Mutual-CHAP does work fine for me. Have others seen the same behavior? What version are you using? I noticed in git one way chap is broken. 870.1 works though. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
Re: CHAP with Open-iSCSI
Mike Christie wrote: Arvind Jain wrote: Mike, This explains it. We are using: iscsid: transport class version 2.0-867. iscsid version 2.0-869 No, this is fine. Newer tools support older kernels. That combo should work fine (all login is in userspace anyways so the kernel does not even come into play at this point). Let me do some more debugging and see what is up. I see one bug in the chap code right now. I fixed the problem I was hitting. It was only in git head and never in a open-iscsi.org release, so you probably would not have seen it. If you were using iscsid version 2.0-869 you would not have seen it. Let me do some more digging for your issue. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
RE: CHAP with Open-iSCSI
Mike, Thanks for this excellent support. Let me know if I can do anything. I can send you wire shark trace with MS initiator oneway-CHAP if this will help. Thx, Arvind. -Original Message- From: open-iscsi@googlegroups.com [mailto:open-is...@googlegroups.com] On Behalf Of Mike Christie Sent: Thursday, January 29, 2009 3:08 PM To: open-iscsi@googlegroups.com Subject: Re: CHAP with Open-iSCSI Arvind Jain wrote: Mike, I have attached the wire shark trace for OneWay-CHAP and Mutual-CHAP. I am not sure how helpful this is. In case of OneWay-CHAP, Open-iscsi initiator does not continues with the login step and gives and error as follows: Logging in to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260] iscsiadm: Could not login to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260]: iscsiadm: initiator reported error (5 - encountered iSCSI login failure) Target discovery or login failed It looks a normal old interop bug. It looks like the initiator and target do not agree what stage/phase we should be in. The initiator thinks you guys goof and the target thinks we should be continuing on with chap. I have not touched the login acl code in 6 years, so it will take me a bit to look over it and figure out who is wrong. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
Re: CHAP with Open-iSCSI
Arvind Jain wrote: Mike, Thanks for this excellent support. Let me know if I can do anything. I can send you wire shark trace with MS initiator oneway-CHAP if this will help. I do not need it yet. I think I can see where you guys differ from what I get with other targets. I just need to read the spec about what is correct. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
Re: CHAP with Open-iSCSI
Mike Christie wrote: Arvind Jain wrote: Hi Mike, We are using Open iSCSI initiator with our iSCSI target. I have a question on CHAP. I did some experiment and it appears to me that OneWay-CHAP does not work with open-iscsi, Mutual-CHAP does work fine for me. Have others seen the same behavior? Not really. I have the opposite. I have seen a report where Mutual-CHAP does not work, but OneWay-CHAP works fine with LSI targets. Mutual-CHAP or OneWay-CHAP works fine with IET, Netapp and Equallogic Actually not sure about Equallogic. I think we just tested one way. I am not sure if we tested 2 way. and some box you probably never heard of here. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
RE: CHAP with Open-iSCSI
Mike, I have attached the wire shark trace for OneWay-CHAP and Mutual-CHAP. I am not sure how helpful this is. In case of OneWay-CHAP, Open-iscsi initiator does not continues with the login step and gives and error as follows: Logging in to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260] iscsiadm: Could not login to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260]: iscsiadm: initiator reported error (5 - encountered iSCSI login failure) Target discovery or login failed BTW, Microsoft initiator works fine with OneWay-CHAP and Mutual-CHAP with our target. So I think it something subtle. Thx, Arvind. -Original Message- From: open-iscsi@googlegroups.com [mailto:open-is...@googlegroups.com] On Behalf Of Mike Christie Sent: Wednesday, January 28, 2009 1:25 PM To: open-iscsi@googlegroups.com Subject: Re: CHAP with Open-iSCSI Mike Christie wrote: Arvind Jain wrote: Hi Mike, We are using Open iSCSI initiator with our iSCSI target. I have a question on CHAP. I did some experiment and it appears to me that OneWay-CHAP does not work with open-iscsi, Mutual-CHAP does work fine for me. Have others seen the same behavior? Not really. I have the opposite. I have seen a report where Mutual-CHAP does not work, but OneWay-CHAP works fine with LSI targets. Mutual-CHAP or OneWay-CHAP works fine with IET, Netapp and Equallogic Actually not sure about Equallogic. I think we just tested one way. I am not sure if we tested 2 way. and some box you probably never heard of here. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~--- open_iscsi_MutualCHAP.pcap Description: Binary data open_iscsi_OnewayCHAP.pcap Description: Binary data
Re: CHAP with Open-iSCSI
Arvind Jain wrote: Mike, I have attached the wire shark trace for OneWay-CHAP and Mutual-CHAP. I am not sure how helpful this is. In case of OneWay-CHAP, Open-iscsi initiator does not continues with the login step and gives and error as follows: Logging in to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260] iscsiadm: Could not login to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260]: iscsiadm: initiator reported error (5 - encountered iSCSI login failure) Target discovery or login failed Could you give me the output of iscsiadm -m node -T iqn.2008-07.com.wasabi:osd.1 -p 192.168.0.90,3260 And could you run iscsid by hand with debugging and give me that output when you try to login # iscsid -d 8 -f will print it out to the console. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
RE: CHAP with Open-iSCSI
Mike, I have the following info as you requested: [r...@localhost ~]# iscsid -d 8 -f iscsid: sysfs_init: sysfs_path='/sys' iscsid: sysfs_attr_get_value: open '/module/scsi_transport_iscsi'/'version' iscsid: sysfs_attr_get_value: new uncached attribute '/sys/module/scsi_transport_iscsi/version' iscsid: sysfs_attr_get_value: add to cache '/sys/module/scsi_transport_iscsi/version' iscsid: sysfs_attr_get_value: cache '/sys/module/scsi_transport_iscsi/version' with attribute value '2.0-867' iscsid: transport class version 2.0-867. iscsid version 2.0-869 iscsid: in ctldev_open iscsid: created NETLINK_ISCSI socket... iscsid: InitiatorName==iqn.2005-03.org.open-iscsi:1bd5bc7d3378 iscsid: InitiatorName=iqn.2005-03.org.open-iscsi:1bd5bc7d3378 iscsid: InitiatorAlias=localhost.localdomain iscsid: in ctldev_close iscsid: Max file limits 1024 1024 iscsid: reaped pid 3625, reap_count now 0 [r...@localhost ~]# iscsiadm -m node -T iqn.2008-07.com.wasabi:osd.1 -p 192.168.0.90,3260 node.name = iqn.2008-07.com.wasabi:osd.1 node.tpgt = -1 node.startup = manual iface.hwaddress = default iface.iscsi_ifacename = default iface.net_ifacename = default iface.transport_name = tcp iface.initiatorname = empty node.discovery_address = 192.168.0.90 node.discovery_port = 3260 node.discovery_type = send_targets node.session.initial_cmdsn = 0 node.session.initial_login_retry_max = 4 node.session.cmds_max = 128 node.session.queue_depth = 32 node.session.auth.authmethod = CHAP node.session.auth.username = user0 node.session.auth.password = node.session.auth.username_in = empty node.session.auth.password_in = empty node.session.timeo.replacement_timeout = 120 node.session.err_timeo.abort_timeout = 15 node.session.err_timeo.lu_reset_timeout = 20 node.session.err_timeo.host_reset_timeout = 60 node.session.iscsi.FastAbort = Yes node.session.iscsi.InitialR2T = No node.session.iscsi.ImmediateData = No node.session.iscsi.FirstBurstLength = 262144 node.session.iscsi.MaxBurstLength = 16776192 node.session.iscsi.DefaultTime2Retain = 0 node.session.iscsi.DefaultTime2Wait = 2 node.session.iscsi.MaxConnections = 1 node.session.iscsi.MaxOutstandingR2T = 1 node.session.iscsi.ERL = 0 node.conn[0].address = 192.168.0.90 node.conn[0].port = 3260 node.conn[0].startup = manual node.conn[0].tcp.window_size = 524288 node.conn[0].tcp.type_of_service = 0 node.conn[0].timeo.logout_timeout = 15 node.conn[0].timeo.login_timeout = 15 node.conn[0].timeo.auth_timeout = 45 node.conn[0].timeo.noop_out_interval = 30 node.conn[0].timeo.noop_out_timeout = 30 node.conn[0].iscsi.MaxRecvDataSegmentLength = 131072 node.conn[0].iscsi.HeaderDigest = None node.conn[0].iscsi.DataDigest = None node.conn[0].iscsi.IFMarker = No node.conn[0].iscsi.OFMarker = No [r...@localhost ~]# The above info is with the Oneway-CHAP. Let me know if you need any other info. Thx, Arvind. -Original Message- From: open-iscsi@googlegroups.com [mailto:open-is...@googlegroups.com] On Behalf Of Mike Christie Sent: Wednesday, January 28, 2009 3:31 PM To: open-iscsi@googlegroups.com Subject: Re: CHAP with Open-iSCSI Arvind Jain wrote: Mike, I have attached the wire shark trace for OneWay-CHAP and Mutual-CHAP. I am not sure how helpful this is. In case of OneWay-CHAP, Open-iscsi initiator does not continues with the login step and gives and error as follows: Logging in to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260] iscsiadm: Could not login to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260]: iscsiadm: initiator reported error (5 - encountered iSCSI login failure) Target discovery or login failed Could you give me the output of iscsiadm -m node -T iqn.2008-07.com.wasabi:osd.1 -p 192.168.0.90,3260 And could you run iscsid by hand with debugging and give me that output when you try to login # iscsid -d 8 -f will print it out to the console. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
RE: CHAP with Open-iSCSI
Oops, forgot to attach the login debug info using iscsid -d 8 -f last time. Debug output attached for oneway-CHAP and Mutual-CHAP. Mutual-CHAP works fine with our target. Thx, Arvind. -Original Message- From: open-iscsi@googlegroups.com [mailto:open-is...@googlegroups.com] On Behalf Of Arvind Jain Sent: Wednesday, January 28, 2009 8:43 PM To: open-iscsi@googlegroups.com Subject: RE: CHAP with Open-iSCSI Mike, I have the following info as you requested: [r...@localhost ~]# iscsid -d 8 -f iscsid: sysfs_init: sysfs_path='/sys' iscsid: sysfs_attr_get_value: open '/module/scsi_transport_iscsi'/'version' iscsid: sysfs_attr_get_value: new uncached attribute '/sys/module/scsi_transport_iscsi/version' iscsid: sysfs_attr_get_value: add to cache '/sys/module/scsi_transport_iscsi/version' iscsid: sysfs_attr_get_value: cache '/sys/module/scsi_transport_iscsi/version' with attribute value '2.0-867' iscsid: transport class version 2.0-867. iscsid version 2.0-869 iscsid: in ctldev_open iscsid: created NETLINK_ISCSI socket... iscsid: InitiatorName==iqn.2005-03.org.open-iscsi:1bd5bc7d3378 iscsid: InitiatorName=iqn.2005-03.org.open-iscsi:1bd5bc7d3378 iscsid: InitiatorAlias=localhost.localdomain iscsid: in ctldev_close iscsid: Max file limits 1024 1024 iscsid: reaped pid 3625, reap_count now 0 [r...@localhost ~]# iscsiadm -m node -T iqn.2008-07.com.wasabi:osd.1 -p 192.168.0.90,3260 node.name = iqn.2008-07.com.wasabi:osd.1 node.tpgt = -1 node.startup = manual iface.hwaddress = default iface.iscsi_ifacename = default iface.net_ifacename = default iface.transport_name = tcp iface.initiatorname = empty node.discovery_address = 192.168.0.90 node.discovery_port = 3260 node.discovery_type = send_targets node.session.initial_cmdsn = 0 node.session.initial_login_retry_max = 4 node.session.cmds_max = 128 node.session.queue_depth = 32 node.session.auth.authmethod = CHAP node.session.auth.username = user0 node.session.auth.password = node.session.auth.username_in = empty node.session.auth.password_in = empty node.session.timeo.replacement_timeout = 120 node.session.err_timeo.abort_timeout = 15 node.session.err_timeo.lu_reset_timeout = 20 node.session.err_timeo.host_reset_timeout = 60 node.session.iscsi.FastAbort = Yes node.session.iscsi.InitialR2T = No node.session.iscsi.ImmediateData = No node.session.iscsi.FirstBurstLength = 262144 node.session.iscsi.MaxBurstLength = 16776192 node.session.iscsi.DefaultTime2Retain = 0 node.session.iscsi.DefaultTime2Wait = 2 node.session.iscsi.MaxConnections = 1 node.session.iscsi.MaxOutstandingR2T = 1 node.session.iscsi.ERL = 0 node.conn[0].address = 192.168.0.90 node.conn[0].port = 3260 node.conn[0].startup = manual node.conn[0].tcp.window_size = 524288 node.conn[0].tcp.type_of_service = 0 node.conn[0].timeo.logout_timeout = 15 node.conn[0].timeo.login_timeout = 15 node.conn[0].timeo.auth_timeout = 45 node.conn[0].timeo.noop_out_interval = 30 node.conn[0].timeo.noop_out_timeout = 30 node.conn[0].iscsi.MaxRecvDataSegmentLength = 131072 node.conn[0].iscsi.HeaderDigest = None node.conn[0].iscsi.DataDigest = None node.conn[0].iscsi.IFMarker = No node.conn[0].iscsi.OFMarker = No [r...@localhost ~]# The above info is with the Oneway-CHAP. Let me know if you need any other info. Thx, Arvind. -Original Message- From: open-iscsi@googlegroups.com [mailto:open-is...@googlegroups.com] On Behalf Of Mike Christie Sent: Wednesday, January 28, 2009 3:31 PM To: open-iscsi@googlegroups.com Subject: Re: CHAP with Open-iSCSI Arvind Jain wrote: Mike, I have attached the wire shark trace for OneWay-CHAP and Mutual-CHAP. I am not sure how helpful this is. In case of OneWay-CHAP, Open-iscsi initiator does not continues with the login step and gives and error as follows: Logging in to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260] iscsiadm: Could not login to [iface: default, target: iqn.2008-07.com.wasabi:osd.1, portal: 192.168.0.90,3260]: iscsiadm: initiator reported error (5 - encountered iSCSI login failure) Target discovery or login failed Could you give me the output of iscsiadm -m node -T iqn.2008-07.com.wasabi:osd.1 -p 192.168.0.90,3260 And could you run iscsid by hand with debugging and give me that output when you try to login # iscsid -d 8 -f will print it out to the console. --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~--- [r...@localhost ~]# iscsid -d 8 -f iscsid: sysfs_init: sysfs_path='/sys' iscsid: sysfs_attr_get_value: open '/module/scsi_transport_iscsi'/'version' iscsid: sysfs_attr_get_value: new uncached
Re: CHAP with Open-iSCSI
On 28 Jan 2009 at 12:06, Mike Christie wrote: Arvind Jain wrote: Hi Mike, We are using Open iSCSI initiator with our iSCSI target. I have a question on CHAP. I did some experiment and it appears to me that OneWay-CHAP does not work with open-iscsi, Mutual-CHAP does work fine for me. Have others seen the same behavior? Not really. I have the opposite. I have seen a report where Mutual-CHAP does not work, but OneWay-CHAP works fine with LSI targets. Hi! This brings up the basic question: How to debug/trace CHAP (assuming you have an installation using precompiled software)? Regards, Ulrich --~--~-~--~~~---~--~~ You received this message because you are subscribed to the Google Groups open-iscsi group. To post to this group, send email to open-iscsi@googlegroups.com To unsubscribe from this group, send email to open-iscsi+unsubscr...@googlegroups.com For more options, visit this group at http://groups.google.com/group/open-iscsi -~--~~~~--~~--~--~---
