xref: /illumos-gate/usr/src/uts/common/io/scsi/adapters/iscsi/iscsi_login.c (revision 9fe633fd)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2000 by Cisco Systems, Inc.  All rights reserved.
 * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
 *
 * iSCSI protocol login and enumeration
 */

#include "iscsi.h"
#include <sys/iscsi_protocol.h>
#include <sys/scsi/adapters/iscsi_door.h>

boolean_t iscsi_login_logging = B_FALSE;

/* internal login protocol interfaces */
static iscsi_status_t iscsi_login(iscsi_conn_t *icp,
    uint8_t *status_class, uint8_t *status_detail);
static int iscsi_add_text(idm_pdu_t *text_pdu,
    int max_data_length, char *param, char *value);
static int iscsi_find_key_value(char *param, char *ihp, char *pdu_end,
    char **value_start, char **value_end);
static void iscsi_null_callback(void *user_handle, void *message_handle,
    int auth_status);
static iscsi_status_t iscsi_process_login_response(iscsi_conn_t *icp,
    iscsi_login_rsp_hdr_t *ilrhp, char *data, int max_data_length);
static iscsi_status_t iscsi_make_login_pdu(iscsi_conn_t *icp,
    idm_pdu_t *text_pdu, char *data, int max_data_length);
static iscsi_status_t iscsi_update_address(iscsi_conn_t *icp,
    char *address);
static char *iscsi_login_failure_str(uchar_t status_class,
    uchar_t status_detail);
static void iscsi_login_end(iscsi_conn_t *icp,
    iscsi_status_t status, iscsi_task_t *itp);
static iscsi_status_t iscsi_login_connect(iscsi_conn_t *icp);
static void iscsi_login_disconnect(iscsi_conn_t *icp);
static void iscsi_notice_key_values(iscsi_conn_t *icp);

#define	ISCSI_LOGIN_RETRY_DELAY		5	/* seconds */

#define	ISCSI_LOGIN_TRANSIT_FFP(flags) \
	(!(flags & ISCSI_FLAG_LOGIN_CONTINUE) && \
	(flags & ISCSI_FLAG_LOGIN_TRANSIT) && \
	(ISCSI_LOGIN_CURRENT_STAGE(flags) == \
	ISCSI_OP_PARMS_NEGOTIATION_STAGE) && \
	(ISCSI_LOGIN_NEXT_STAGE(flags) == \
	ISCSI_FULL_FEATURE_PHASE))

/*
 * +--------------------------------------------------------------------+
 * | External Login Interface						|
 * +--------------------------------------------------------------------+
 */

void
iscsi_login_cb(void *arg)
{
	(void) iscsi_login_start(arg);
}

/*
 * iscsi_login_start - connect and perform iscsi protocol login
 */
iscsi_status_t
iscsi_login_start(void *arg)
{
	iscsi_task_t		*itp = (iscsi_task_t *)arg;
	iscsi_status_t		rval	= ISCSI_STATUS_LOGIN_FAILED;
	iscsi_conn_t		*icp;
	iscsi_sess_t		*isp;
	iscsi_hba_t		*ihp;
	unsigned char		status_class;
	unsigned char		status_detail;

	ASSERT(itp != NULL);
	icp = (iscsi_conn_t *)itp->t_arg;
	ASSERT(icp != NULL);
	isp = icp->conn_sess;
	ASSERT(isp != NULL);
	ihp = isp->sess_hba;
	ASSERT(ihp != NULL);

login_start:
	ASSERT((icp->conn_state == ISCSI_CONN_STATE_IN_LOGIN) ||
	    (icp->conn_state == ISCSI_CONN_STATE_FAILED) ||
	    (icp->conn_state == ISCSI_CONN_STATE_POLLING));

	icp->conn_state_ffp = B_FALSE;
	icp->conn_login_status = ISCSI_INITIAL_LOGIN_STAGE;

	/* reset connection statsn */
	icp->conn_expstatsn = 0;
	icp->conn_laststatsn = 0;

	/* sync up authentication information */
	(void) iscsi_sess_set_auth(isp);

	/* sync up login and session parameters */
	if (!ISCSI_SUCCESS(iscsi_conn_sync_params(icp))) {
		/* unable to sync params.  fail connection attempts */
		iscsi_login_end(icp, ISCSI_STATUS_LOGIN_FAILED, itp);
		return (ISCSI_STATUS_LOGIN_FAILED);
	}

	/*
	 * Attempt to open TCP connection, associated IDM connection will
	 * have a hold on it that must be released after the call to
	 * iscsi_login() below.
	 */
	if (!ISCSI_SUCCESS(iscsi_login_connect(icp))) {
		if ((isp->sess_boot == B_TRUE) &&
		    (ihp->hba_service_status_overwrite == B_TRUE) &&
		    (isp->sess_boot_nic_reset == B_FALSE)) {
			/*
			 * The connection to boot target failed
			 * before the system fully started.
			 * Reset the boot nic to the settings from
			 * firmware before retrying the connect to
			 * save the the system.
			 */
			if (iscsi_net_interface(B_TRUE) ==
			    ISCSI_STATUS_SUCCESS) {
				isp->sess_boot_nic_reset = B_TRUE;
			}
		}
		/* retry this failure */
		goto login_retry;
	}

	/*
	 * allocate response buffer with based on default max
	 * transfer size.  This size might shift during login.
	 */
	icp->conn_login_max_data_length =
	    icp->conn_params.max_xmit_data_seg_len;
	icp->conn_login_data = kmem_zalloc(icp->conn_login_max_data_length,
	    KM_SLEEP);

	/*
	 * Start protocol login, upon return we will be either logged in
	 * or disconnected
	 */
	rval = iscsi_login(icp, &status_class, &status_detail);

	/* done with buffer */
	kmem_free(icp->conn_login_data, icp->conn_login_max_data_length);

	/* Release connection hold */
	idm_conn_rele(icp->conn_ic);

	/* hard failure in login */
	if (!ISCSI_SUCCESS(rval)) {
		/*
		 * We should just give up retry if these failures are
		 * detected.
		 */
		switch (rval) {
		/*
		 * We should just give up retry if these
		 * failures are detected.
		 */
		case ISCSI_STATUS_AUTHENTICATION_FAILED:
		case ISCSI_STATUS_INTERNAL_ERROR:
		case ISCSI_STATUS_VERSION_MISMATCH:
		case ISCSI_STATUS_NEGO_FAIL:
		case ISCSI_STATUS_LOGIN_TPGT_NEGO_FAIL:
			/* we don't want to retry this failure */
			iscsi_login_end(icp, ISCSI_STATUS_LOGIN_FAILED, itp);
			return (ISCSI_STATUS_LOGIN_FAILED);
		default:
			/* retry this failure */
			goto login_retry;
		}
	}

	/* soft failure with reason */
	switch (status_class) {
	case ISCSI_STATUS_CLASS_SUCCESS:
		/* login was successful */
		iscsi_login_end(icp, ISCSI_STATUS_SUCCESS, itp);
		return (ISCSI_STATUS_SUCCESS);
	case ISCSI_STATUS_CLASS_REDIRECT:
		/* Retry at the redirected address */
		goto login_start;
	case ISCSI_STATUS_CLASS_TARGET_ERR:
		/* retry this failure */
		cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
		    "%s (0x%02x/0x%02x)", icp->conn_oid,
		    iscsi_login_failure_str(status_class, status_detail),
		    status_class, status_detail);
		goto login_retry;
	case ISCSI_STATUS_CLASS_INITIATOR_ERR:
	default:
		/* All other errors are hard failures */
		cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
		    "%s (0x%02x/0x%02x) Target: %s, TPGT: %d",
		    icp->conn_oid,
		    iscsi_login_failure_str(status_class, status_detail),
		    status_class, status_detail, isp->sess_name,
		    isp->sess_tpgt_conf);

		/* we don't want to retry this failure */
		iscsi_login_end(icp, ISCSI_STATUS_LOGIN_FAILED, itp);
		break;
	}

	return (ISCSI_STATUS_LOGIN_FAILED);

login_retry:
	/* retry this failure if we haven't run out of time */
	if (icp->conn_login_max > ddi_get_lbolt()) {

		if (icp->conn_state == ISCSI_CONN_STATE_POLLING) {
			icp->conn_login_min = ddi_get_lbolt() +
			    SEC_TO_TICK(icp->conn_tunable_params.
			    polling_login_delay);
		} else {
			icp->conn_login_min = ddi_get_lbolt() +
			    SEC_TO_TICK(ISCSI_LOGIN_RETRY_DELAY);
		}

		if (itp->t_blocking == B_TRUE) {
			goto login_start;
		} else {
			if (ddi_taskq_dispatch(isp->sess_login_taskq,
			    iscsi_login_cb, itp, DDI_SLEEP) !=
			    DDI_SUCCESS) {
				iscsi_login_end(icp,
				    ISCSI_STATUS_LOGIN_TIMED_OUT, itp);
			}
			return (ISCSI_STATUS_SUCCESS);
		}
	} else {
		/* Retries exceeded */
		iscsi_login_end(icp, ISCSI_STATUS_LOGIN_TIMED_OUT, itp);
	}

	return (ISCSI_STATUS_LOGIN_FAILED);
}

static void
iscsi_login_end(iscsi_conn_t *icp, iscsi_status_t status, iscsi_task_t *itp)
{
	iscsi_sess_t	*isp;
	uint32_t	event_count;

	ASSERT(icp != NULL);
	isp = icp->conn_sess;
	ASSERT(isp != NULL);

	if (status == ISCSI_STATUS_SUCCESS) {
		/* Inform IDM of the relevant negotiated values */
		iscsi_notice_key_values(icp);

		/* We are now logged in */
		iscsi_conn_update_state(icp, ISCSI_CONN_STATE_LOGGED_IN);

		/* startup TX thread */
		(void) iscsi_thread_start(icp->conn_tx_thread);

		/*
		 * Move login state machine to LOGIN_FFP.  This will
		 * release the taskq thread handling the CN_FFP_ENABLED
		 * allowing the IDM connection state machine to resume
		 * processing events
		 */
		iscsi_login_update_state(icp, LOGIN_FFP);

		/* Notify the session that a connection is logged in */
		event_count = atomic_inc_32_nv(&isp->sess_state_event_count);
		iscsi_sess_enter_state_zone(isp);
		iscsi_sess_state_machine(isp, ISCSI_SESS_EVENT_N1, event_count);
		iscsi_sess_exit_state_zone(isp);
	} else {
		/* If login failed reset nego tpgt */
		isp->sess_tpgt_nego = ISCSI_DEFAULT_TPGT;

		mutex_enter(&icp->conn_state_mutex);
		switch (icp->conn_state) {
		case ISCSI_CONN_STATE_IN_LOGIN:
			iscsi_conn_update_state_locked(icp,
			    ISCSI_CONN_STATE_FREE);
			mutex_exit(&icp->conn_state_mutex);
			break;
		case ISCSI_CONN_STATE_FAILED:
			if (status == ISCSI_STATUS_LOGIN_FAILED) {
				iscsi_conn_update_state_locked(icp,
				    ISCSI_CONN_STATE_FREE);
			} else {
				/* ISCSI_STATUS_LOGIN_TIMED_OUT */
				iscsi_conn_update_state_locked(icp,
				    ISCSI_CONN_STATE_POLLING);
			}
			mutex_exit(&icp->conn_state_mutex);
			event_count = atomic_inc_32_nv(
			    &isp->sess_state_event_count);
			iscsi_sess_enter_state_zone(isp);
			iscsi_sess_state_machine(isp, ISCSI_SESS_EVENT_N6,
			    event_count);
			iscsi_sess_exit_state_zone(isp);

			if (status == ISCSI_STATUS_LOGIN_TIMED_OUT) {
				iscsi_conn_retry(isp, icp);
			}
			break;
		case ISCSI_CONN_STATE_POLLING:
			if (status == ISCSI_STATUS_LOGIN_FAILED) {
				iscsi_conn_update_state_locked(icp,
				    ISCSI_CONN_STATE_FREE);
				mutex_exit(&icp->conn_state_mutex);
				event_count = atomic_inc_32_nv(
				    &isp->sess_state_event_count);
				iscsi_sess_enter_state_zone(isp);

				iscsi_sess_state_machine(isp,
				    ISCSI_SESS_EVENT_N6, event_count);

				iscsi_sess_exit_state_zone(isp);
			} else {
				/* ISCSI_STATUS_LOGIN_TIMED_OUT */
				if (isp->sess_type == ISCSI_SESS_TYPE_NORMAL) {
					mutex_exit(&icp->conn_state_mutex);

					iscsi_conn_retry(isp, icp);
				} else {
					iscsi_conn_update_state_locked(icp,
					    ISCSI_CONN_STATE_FREE);
					mutex_exit(&icp->conn_state_mutex);
				}
			}
			break;
		case ISCSI_CONN_STATE_FREE:
			mutex_exit(&icp->conn_state_mutex);
			break;
		default:
			mutex_exit(&icp->conn_state_mutex);
			ASSERT(0);
			break;
		}
	}

	if (itp->t_blocking == B_FALSE) {
		kmem_free(itp, sizeof (iscsi_task_t));
	}

	isp->sess_boot_nic_reset = B_FALSE;
}

/*
 * +--------------------------------------------------------------------+
 * | Begin of protocol login routines					|
 * +--------------------------------------------------------------------+
 */

/*
 * iscsi_login - Attempt to login to the target.  The caller
 * must check the status class to determine if the login succeeded.
 * A return of 1 does not mean the login succeeded, it just means
 * this function worked, and the status class is valid info.  This
 * allows the caller to decide whether or not to retry logins, so
 * that we don't have any policy logic here.
 */
iscsi_status_t
iscsi_login(iscsi_conn_t *icp, uint8_t *status_class, uint8_t *status_detail)
{
	iscsi_status_t		rval		= ISCSI_STATUS_INTERNAL_ERROR;
	struct iscsi_sess	*isp		= NULL;
	IscsiAuthClient		*auth_client	= NULL;
	int			max_data_length	= 0;
	char			*data		= NULL;
	idm_pdu_t		*text_pdu;
	char			*buffer;
	size_t			bufsize;
	iscsi_login_rsp_hdr_t	*ilrhp;
	clock_t			response_timeout, timeout_result;

	buffer = icp->conn_login_data;
	bufsize = icp->conn_login_max_data_length;

	ASSERT(icp != NULL);
	ASSERT(buffer != NULL);
	ASSERT(status_class != NULL);
	ASSERT(status_detail != NULL);
	isp = icp->conn_sess;
	ASSERT(isp != NULL);

	/*
	 * prepare the connection, hold IDM connection until login completes
	 */
	icp->conn_current_stage = ISCSI_INITIAL_LOGIN_STAGE;
	icp->conn_partial_response = 0;

	if (isp->sess_auth.auth_buffers &&
	    isp->sess_auth.num_auth_buffers) {

		auth_client = (IscsiAuthClient *)isp->
		    sess_auth.auth_buffers[0].address;

		/*
		 * prepare for authentication
		 */
		if (iscsiAuthClientInit(iscsiAuthNodeTypeInitiator,
		    isp->sess_auth.num_auth_buffers,
		    isp->sess_auth.auth_buffers) !=
		    iscsiAuthStatusNoError) {
			cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
			    "unable to initialize authentication",
			    icp->conn_oid);
			icp->conn_login_status = ISCSI_STATUS_INTERNAL_ERROR;
			iscsi_login_disconnect(icp);
			iscsi_login_update_state(icp, LOGIN_DONE);
			return (ISCSI_STATUS_INTERNAL_ERROR);
		}

		if (iscsiAuthClientSetVersion(auth_client,
		    iscsiAuthVersionRfc) != iscsiAuthStatusNoError) {
			cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
			    "unable to set authentication", icp->conn_oid);
			goto iscsi_login_done;
		}

		if (isp->sess_auth.username &&
		    (iscsiAuthClientSetUsername(auth_client,
		    isp->sess_auth.username) !=
		    iscsiAuthStatusNoError)) {
			cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
			    "unable to set username", icp->conn_oid);
			goto iscsi_login_done;
		}

		if (isp->sess_auth.password &&
		    (iscsiAuthClientSetPassword(auth_client,
		    isp->sess_auth.password, isp->sess_auth.password_length) !=
		    iscsiAuthStatusNoError)) {
			cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
			    "unable to set password", icp->conn_oid);
			goto iscsi_login_done;
		}

		if (iscsiAuthClientSetIpSec(auth_client, 1) !=
		    iscsiAuthStatusNoError) {
			cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
			    "unable to set ipsec", icp->conn_oid);
			goto iscsi_login_done;
		}

		if (iscsiAuthClientSetAuthRemote(auth_client,
		    isp->sess_auth.bidirectional_auth) !=
		    iscsiAuthStatusNoError) {
			cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
			    "unable to set remote authentication",
			    icp->conn_oid);
			goto iscsi_login_done;
		}
	}

	/*
	 * exchange PDUs until the login stage is complete, or an error occurs
	 */
	do {
		/* setup */
		bzero(buffer, bufsize);
		data = buffer;
		max_data_length = bufsize;
		rval = ISCSI_STATUS_INTERNAL_ERROR;

		text_pdu = idm_pdu_alloc(sizeof (iscsi_hdr_t), 0);
		idm_pdu_init(text_pdu, icp->conn_ic, NULL, NULL);

		/*
		 * fill in the PDU header and text data based on the
		 * login stage that we're in
		 */
		rval = iscsi_make_login_pdu(icp, text_pdu, data,
		    max_data_length);
		if (!ISCSI_SUCCESS(rval)) {
			cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
			    "unable to make login pdu", icp->conn_oid);
			goto iscsi_login_done;
		}

		mutex_enter(&icp->conn_login_mutex);
		/*
		 * Make sure we are still in LOGIN_START or LOGIN_RX
		 * state before switching to LOGIN_TX.  It's possible
		 * for a connection failure to move us to LOGIN_ERROR
		 * before we get to this point.
		 */
		if (((icp->conn_login_state != LOGIN_READY) &&
		    (icp->conn_login_state != LOGIN_RX)) ||
		    !icp->conn_state_idm_connected) {
			/* Error occurred */
			mutex_exit(&icp->conn_login_mutex);
			rval = (ISCSI_STATUS_INTERNAL_ERROR);
			goto iscsi_login_done;
		}

		icp->conn_login_resp_hdr.opcode = 0;
		iscsi_login_update_state_locked(icp, LOGIN_TX);
		icp->conn_login_data = data;
		icp->conn_login_max_data_length = max_data_length;

		/*
		 * send a PDU to the target.  This is asynchronous but
		 * we don't have any particular need for a TX completion
		 * notification since we are going to block waiting for the
		 * receive.
		 */
		response_timeout = ddi_get_lbolt() +
		    SEC_TO_TICK(icp->conn_tunable_params.
		    recv_login_rsp_timeout);
		idm_pdu_tx(text_pdu);

		/*
		 * Wait for login failure indication or login RX.
		 * Handler for login response PDU will copy any data into
		 * the buffer pointed to by icp->conn_login_data
		 */
		while (icp->conn_login_state == LOGIN_TX) {
			timeout_result = cv_timedwait(&icp->conn_login_cv,
			    &icp->conn_login_mutex, response_timeout);
			if (timeout_result == -1)
				break;
		}

		/*
		 * We have either received a login response or the connection
		 * has gone down or both.  If a login response is present,
		 * then process it.
		 */
		ilrhp = (iscsi_login_rsp_hdr_t *)&icp->conn_login_resp_hdr;
		if (icp->conn_login_state != LOGIN_RX && ilrhp->opcode == 0) {
			/* connection down, with no login response */
			mutex_exit(&icp->conn_login_mutex);
			rval = (ISCSI_STATUS_INTERNAL_ERROR);
			goto iscsi_login_done;
		}
		mutex_exit(&icp->conn_login_mutex);

		/* check the PDU response type */
		if (ilrhp->opcode != ISCSI_OP_LOGIN_RSP) {
			cmn_err(CE_WARN, "iscsi connection(%u) login failed - "
			    "received invalid login response (0x%02x)",
			    icp->conn_oid, ilrhp->opcode);
			rval = (ISCSI_STATUS_PROTOCOL_ERROR);
			goto iscsi_login_done;
		}

		/*
		 * give the caller the status class and detail from the
		 * last login response PDU received
		 */
		if (status_class) {
			*status_class = ilrhp->status_class;
		}
		if (status_detail) {
			*status_detail = ilrhp->status_detail;
		}

		switch (ilrhp->status_class) {
		case ISCSI_STATUS_CLASS_SUCCESS:
			/*
			 * process this response and possibly continue
			 * sending PDUs
			 */
			rval = iscsi_process_login_response(icp,
			    ilrhp, (char *)icp->conn_login_data,
			    icp->conn_login_max_data_length);
			/* pass back whatever error we discovered */
			if (!ISCSI_SUCCESS(rval)) {
				if (ISCSI_LOGIN_TRANSIT_FFP(ilrhp->flags)) {
					/*
					 * iSCSI connection transit to next
					 * FFP stage while iscsi params
					 * ngeotiate error, LOGIN_ERROR
					 * marked so CN_FFP_ENABLED can
					 * be fully handled before
					 * CN_FFP_DISABLED can be processed.
					 */
					iscsi_login_update_state(icp,
					    LOGIN_ERROR);
				}
				goto iscsi_login_done;
			}

			break;
		case ISCSI_STATUS_CLASS_REDIRECT:
			/*
			 * we need to process this response to get the
			 * TargetAddress of the redirect, but we don't
			 * care about the return code.
			 */
			(void) iscsi_process_login_response(icp,
			    ilrhp, (char *)icp->conn_login_data,
			    icp->conn_login_max_data_length);
			rval = ISCSI_STATUS_SUCCESS;
			goto iscsi_login_done;
		case ISCSI_STATUS_CLASS_INITIATOR_ERR:
			if (ilrhp->status_detail ==
			    ISCSI_LOGIN_STATUS_AUTH_FAILED) {
				cmn_err(CE_WARN, "iscsi connection(%u) login "
				    "failed - login failed to authenticate "
				    "with target", icp->conn_oid);
			}
			rval = ISCSI_STATUS_SUCCESS;
			goto iscsi_login_done;
		default:
			/*
			 * some sort of error, login terminated unsuccessfully,
			 * though this function did it's job. the caller must
			 * check the status_class and status_detail and decide
			 * what to do next.
			 */
			rval = ISCSI_STATUS_SUCCESS;
			goto iscsi_login_done;
		}

	} while (icp->conn_current_stage != ISCSI_FULL_FEATURE_PHASE);

	rval = ISCSI_STATUS_SUCCESS;

iscsi_login_done:
	if (auth_client) {
		if (iscsiAuthClientFinish(auth_client) !=
		    iscsiAuthStatusNoError) {
			cmn_err(CE_WARN, "iscsi connection(%u) login "
			    "failed - login failed to authenticate "
			    "with target", icp->conn_oid);
			if (ISCSI_SUCCESS(rval))
				rval = ISCSI_STATUS_INTERNAL_ERROR;
		}
	}

	icp->conn_login_status = rval;
	if (ISCSI_SUCCESS(rval) &&
	    (*status_class == ISCSI_STATUS_CLASS_SUCCESS)) {
		mutex_enter(&icp->conn_state_mutex);
		while (!icp->conn_state_ffp)
			cv_wait(&icp->conn_state_change,
			    &icp->conn_state_mutex);
		mutex_exit(&icp->conn_state_mutex);
	} else {
		iscsi_login_disconnect(icp);
	}

	iscsi_login_update_state(icp, LOGIN_DONE);

	return (rval);
}


/*
 * iscsi_make_login_pdu -
 *
 */
static iscsi_status_t
iscsi_make_login_pdu(iscsi_conn_t *icp, idm_pdu_t *text_pdu,
    char *data, int max_data_length)
{
	struct iscsi_sess	*isp		= NULL;
	int			transit		= 0;
	iscsi_hdr_t		*ihp		= text_pdu->isp_hdr;
	iscsi_login_hdr_t	*ilhp		=
	    (iscsi_login_hdr_t *)text_pdu->isp_hdr;
	IscsiAuthClient		*auth_client	= NULL;
	int			keytype		= 0;
	int			rc		= 0;
	char			value[iscsiAuthStringMaxLength];

	ASSERT(icp != NULL);
	ASSERT(text_pdu != NULL);
	isp = icp->conn_sess;
	ASSERT(isp != NULL);

	auth_client =
	    (isp->sess_auth.auth_buffers && isp->sess_auth.num_auth_buffers) ?
	    (IscsiAuthClient *)isp->sess_auth.auth_buffers[0].address : NULL;

	/*
	 * initialize the PDU header
	 */
	bzero(ilhp, sizeof (*ilhp));
	ilhp->opcode = ISCSI_OP_LOGIN_CMD | ISCSI_OP_IMMEDIATE;
	ilhp->cid = icp->conn_cid;
	bcopy(&isp->sess_isid[0], &ilhp->isid[0], sizeof (isp->sess_isid));
	ilhp->tsid = 0;

	/*
	 * Set data buffer pointer.  The calls to iscsi_add_text will update the
	 * data length.
	 */
	text_pdu->isp_data = (uint8_t *)data;

	/* don't increment on immediate */
	ilhp->cmdsn = htonl(isp->sess_cmdsn);

	ilhp->min_version = ISCSI_DRAFT20_VERSION;
	ilhp->max_version = ISCSI_DRAFT20_VERSION;

	/*
	 * we have to send 0 until full-feature stage
	 */
	ilhp->expstatsn = htonl(icp->conn_expstatsn);

	/*
	 * the very first Login PDU has some additional requirements,
	 * * and we need to decide what stage to start in.
	 */
	if (icp->conn_current_stage == ISCSI_INITIAL_LOGIN_STAGE) {
		if ((isp->sess_hba->hba_name) &&
		    (isp->sess_hba->hba_name[0])) {
			if (!iscsi_add_text(text_pdu, max_data_length,
			    "InitiatorName",
			    (char *)isp->sess_hba->hba_name)) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}
		} else {
			cmn_err(CE_WARN, "iscsi connection(%u) login "
			    "failed - initiator name is required",
			    icp->conn_oid);
			return (ISCSI_STATUS_INTERNAL_ERROR);
		}

		if ((isp->sess_hba->hba_alias) &&
		    (isp->sess_hba->hba_alias[0])) {
			if (!iscsi_add_text(text_pdu, max_data_length,
			    "InitiatorAlias",
			    (char *)isp->sess_hba->hba_alias)) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}
		}

		if (isp->sess_type == ISCSI_SESS_TYPE_NORMAL) {
			if (isp->sess_name[0] != '\0') {
				if (!iscsi_add_text(text_pdu, max_data_length,
				    "TargetName", (char *)isp->sess_name)) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
			}

			if (!iscsi_add_text(text_pdu, max_data_length,
			    "SessionType", "Normal")) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}
		} else if (isp->sess_type == ISCSI_SESS_TYPE_DISCOVERY) {
			if (!iscsi_add_text(text_pdu, max_data_length,
			    "SessionType", "Discovery")) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}
		} else {
			return (ISCSI_STATUS_INTERNAL_ERROR);
		}

		if (auth_client) {
			/* we're prepared to do authentication */
			icp->conn_current_stage =
			    ISCSI_SECURITY_NEGOTIATION_STAGE;
		} else {
			/* can't do any authentication, skip that stage */
			icp->conn_current_stage =
			    ISCSI_OP_PARMS_NEGOTIATION_STAGE;
		}
	}

	/*
	 * fill in text based on the stage
	 */
	switch (icp->conn_current_stage) {
	case ISCSI_OP_PARMS_NEGOTIATION_STAGE:
		/*
		 * we always try to go from op params to full
		 * feature stage
		 */
		icp->conn_next_stage	= ISCSI_FULL_FEATURE_PHASE;
		transit			= 1;

		/*
		 * The terminology here may have gotten dated.  A partial
		 * response is a login response that doesn't complete a
		 * login.  If we haven't gotten a partial response, then
		 * either we shouldn't be here, or we just switched to
		 * this stage, and need to start offering keys.
		 */
		if (!icp->conn_partial_response) {
			/*
			 * request the desired settings the first time
			 * we are in this stage
			 */
			switch (icp->conn_params.header_digest) {
			case ISCSI_DIGEST_NONE:
				if (!iscsi_add_text(text_pdu,
				    max_data_length, "HeaderDigest", "None")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
				break;
			case ISCSI_DIGEST_CRC32C:
				if (!iscsi_add_text(text_pdu,
				    max_data_length,
				    "HeaderDigest", "CRC32C")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
				break;
			case ISCSI_DIGEST_CRC32C_NONE:
				if (!iscsi_add_text(text_pdu,
				    max_data_length, "HeaderDigest",
				    "CRC32C,None")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
				break;
			default:
			case ISCSI_DIGEST_NONE_CRC32C:
				if (!iscsi_add_text(text_pdu,
				    max_data_length, "HeaderDigest",
				    "None,CRC32C")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
				break;
			}

			switch (icp->conn_params.data_digest) {
			case ISCSI_DIGEST_NONE:
				if (!iscsi_add_text(text_pdu,
				    max_data_length, "DataDigest", "None")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
				break;
			case ISCSI_DIGEST_CRC32C:
				if (!iscsi_add_text(text_pdu,
				    max_data_length, "DataDigest", "CRC32C")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
				break;
			case ISCSI_DIGEST_CRC32C_NONE:
				if (!iscsi_add_text(text_pdu,
				    max_data_length, "DataDigest",
				    "CRC32C,None")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
				break;
			default:
			case ISCSI_DIGEST_NONE_CRC32C:
				if (!iscsi_add_text(text_pdu,
				    max_data_length, "DataDigest",
				    "None,CRC32C")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}
				break;
			}

			(void) sprintf(value, "%d",
			    icp->conn_params.max_recv_data_seg_len);
			if (!iscsi_add_text(text_pdu, max_data_length,
			    "MaxRecvDataSegmentLength", value)) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}

			(void) sprintf(value, "%d",
			    icp->conn_params.default_time_to_wait);
			if (!iscsi_add_text(text_pdu,
			    max_data_length, "DefaultTime2Wait", value)) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}

			(void) sprintf(value, "%d",
			    icp->conn_params.default_time_to_retain);
			if (!iscsi_add_text(text_pdu,
			    max_data_length, "DefaultTime2Retain", value)) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}

			(void) sprintf(value, "%d",
			    icp->conn_params.error_recovery_level);
			if (!iscsi_add_text(text_pdu,
			    max_data_length, "ErrorRecoveryLevel", "0")) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}

			if (!iscsi_add_text(text_pdu,
			    max_data_length, "IFMarker",
			    icp->conn_params.ifmarker ? "Yes" : "No")) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}

			if (!iscsi_add_text(text_pdu,
			    max_data_length, "OFMarker",
			    icp->conn_params.ofmarker ? "Yes" : "No")) {
				return (ISCSI_STATUS_INTERNAL_ERROR);
			}

			/*
			 * The following login parameters are "Irrelevant"
			 * for discovery sessions
			 */
			if (isp->sess_type != ISCSI_SESS_TYPE_DISCOVERY) {

				if (!iscsi_add_text(text_pdu,
				    max_data_length, "InitialR2T",
				    icp->conn_params.initial_r2t ?
				    "Yes" : "No")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}

				if (!iscsi_add_text(text_pdu,
				    max_data_length, "ImmediateData",
				    icp->conn_params.immediate_data ?
				    "Yes" : "No")) {
					return (ISCSI_STATUS_INTERNAL_ERROR);
				}

				(void)