RFC 3822
Finding Fibre Channel over TCP/IP (FCIP) Entities Using Service Location Protocol version 2 (SLPv2)
RFC 3822: Finding Fibre Channel over TCP/IP (FCIP) Entities Using Service Location Protocol version 2 (SLPv2) 🎀
Okay bestie, this one is the Standards Track spec from July 2004 by D. Peterson over at Computer Network Technology (CNT) 💅 It's all about how FCIP Entities find each other with SLPv2, and it doesn't list anything it obsoletes or updates, so no drama there ✨
Status of This Memo 📝
Real talk, this is an Internet standards track protocol for the Internet community, and it's openly asking for discussion and suggestions for improvements 🫶 If you want to know where it stands in the official standardization state, check the current edition of the "Internet Official Protocol Standards" (STD 1) 🧐 Also, distribution of this memo is unlimited, so share away 🦋
Copyright Notice 🌈
Copyright (C) The Internet Society (2004).
Abstract 🌸
This doc defines how FCIP Entities use Service Location Protocol version 2 (SLPv2) 🧚
1. Introduction ✨
So this doc explains how SLPv2 gets used to dynamically discover participating FCIP Entities 👑 It also covers implementation guidelines, service type templates, and security considerations 💜
2. Notation Conventions 🎀
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Those are the BCP 14 words, and they mean what [RFC2119] says they mean 🔥
3. Terminology 📚
Here are some definitions to help you if you're new to SLP or FCIP 🥹 A few of them were reproduced from [RFC2608] and [RFC3105].
User Agent (UA) A process working on the client's behalf
to establish contact with some service.
The UA retrieves service information from
the Service Agents or Directory Agents.
Service Agent (SA) A process working on behalf of one or more
services to advertise the services and
their capabilities.
Directory Agent (DA) A process which collects service
advertisements. There can only be one DA
present per given host.
Scope A named set of services, typically making
up a logical administrative group.
Service Advertisement A URL, attributes, and a lifetime
(indicating how long the advertisement is
valid), providing service access
information and capabilities description
for a particular service.
FCIP Entity The principle FCIP interface point to the
IP network.
FCIP Entity Name The world wide name of the switch if the
FCIP Entity resides in a switch or the
world wide node name of the associated
Nx_Port.
FCIP Discovery Domain The FCIP Discovery Domain specifies which
FCIP Entities are allowed to discover each
other within the bounds of the scope.4. Using SLPv2 for FCIP Service Discovery 🔍
Okay so, at least two FCIP Entities have to be in the entity discovery process 👯 The whole point is that an FCIP Entity ends up discovering one or more peer FCIP Entities 💖
4.1. Discovering FCIP Entities using SLPv2 🦋
Here's the vibe check: Figure 1 shows how FCIP Entities connect to their SLPv2 agents 📸
+--------------------------------------+
| FCIP Entity |
+----------------------------------+ |
| FCIP Control and Services Module | |
+----------------+ | |
| SA | UA | | |
+----------------+-----------------+ |
| TCP/UDP/IP | |
+----------------+-----------------+ |
| Interface | |
| 192.0.2.10 | |
+----------------+-----------------+---|
|
+------------+ |
| SLPv2 DA |----+ IP Network
+------------+ |
|
+----------------+-----------------+---|
| Interface | |
| 192.0.2.20 | |
+----------------+-----------------+ |
| TCP/UDP/IP | |
+----------------+-----------------+ |
| SA | UA | | |
+----------------+ | |
| FCIP Control and Services Module | |
+--------------------------------- + |
| FCIP Entity |
+--------------------------------------+Figure 1: FCIP Entity and SLPv2 Agent Relationship.
As Figure 1 shows, every FCIP Entity has an FCIP Control and Services Module, and that module plugs into an SLPv2 SA and UA 🧩
The SA builds a service advertisement of the type service:fcip:entity for each service URL it wants to register 📣 That advertisement comes with a lifetime, plus any other attributes the service template defines 🎀
The rest of the discovery process is exactly the same as any client/server pair running SLPv2 💅
- Okay so, if an SLPv2 DA is found [RFC2608], the SA contacts the DA and registers the service advertisement. Whether or not any SLPv2 DAs are discovered, the SA still maintains the service advertisement itself and answers multicast UA queries directly 🫶
- When the FCIP Entity needs contact info for a peer FCIP Entity, the UA either contacts the DA using unicast or contacts the SA using multicast, sending an SLPv2 service request 📡 That request includes a query based on the attributes, so the UA can say what kind of peer FCIP Entities it's looking for 😌
- Once the UA has the IP address and port number of a peer FCIP Entity, it may begin the normal connection procedure to that peer, as described in [RFC3821] ✨
The use of a DA is RECOMMENDED for SLPv2 operations in an FCIP environment 👑
4.1.1. FCIP Discovery Domains 🌈
A discovery domain gives you even more control over which FCIP Entities are allowed to discover each other inside a specific SLPv2 scope 🔐
Figure 2 shows an example of how FCIP Entities and their discovery domains relate inside a specified SLPv2 scope 🧁
=================fcip=======================================
= =
= *************************purple*********************** =
= * * =
= * #####orange###################### * =
= * # ------------ //////blue//////+/////////////// * =
= * # | FCIP | / # / * =
= * # | Entity A | / # / * =
= * # ------------ / # ------------ / * =
= * # / # | FCIP | / * =
= * # / # | Entity C | / * =
= * # / ------------ # ------------ / * =
= * # / | FCIP | # / * =
= * # / | Entity B | # / * =
= * # / ------------ # / * =
= * ################+################ / * =
= * //////////////////////////////// * =
= * * =
= ****************************************************** =
= =
============================================================Figure 2: FCIP Entity and Discovery Domain Example.
In scope "fcip", the admin set up a discovery domain called "purple" 💜 It lets FCIP Entities A, B, and C all discover each other, and it's drawn with the "*" character 🌸
In scope "fcip", the admin also set up a discovery domain called "orange" 🍊 It lets FCIP Entity A discover FCIP Entity B, but NOT FCIP Entity C 🙈 It's drawn with the "#" character 🦋
In scope "fcip", there's a discovery domain called "blue" 💙 It lets FCIP Entity C discover FCIP Entity B, but NOT FCIP Entity A 💀 It's drawn with the "/" character 🧚
For the setup in Figure 2, the fcip-discovery-domain attribute for each FCIP Entity looks like this 📋
FCIP Entity A = orange,purple
FCIP Entity B = orange,blue,purple
FCIP Entity C = blue,purple
5. FCIP SLPv2 Templates 🧁
There are two templates: an FCIP Entity template, and an abstract template 💅 The abstract one is there so people can add other FCIP-related templates later on 🔮
5.1. The FCIP Abstract Service Type Template 👑
This template defines the abstract service service:fcip. It's the top-level service that wraps up all the other FCIP-related services 🎀
Name of submitter: David Peterson Language of service template: en Security Considerations: see section 6.
Template Text:
-------------------------template begins here-----------------------
template-type=fcip
template-version=0.1
template-description=
This is an abstract service type. The purpose of the fcip service
type is to encompass all of the services used to support the FCIP
protocol.
template-url-syntax =
url-path= ; Depends on the concrete service type.
--------------------------template ends here------------------------5.2. The FCIP Entity Concrete Service Type Template ✨
okay so this template defines the service "service:fcip:entity" 💖 A device that has FCIP Entities and wants them discovered through SLPv2 registers each one with each of its addresses, using this service type 🦋
FCIP Entities that want to find other FCIP Entities this way will usually use one of these example query strings 🔍
- Find a specific FCIP Entity, given its FCIP Entity Name:
Service: service:fcip:entity
Scope: fcip-entity-scope-list
Query: (fcip-entity-name=\ff\10\00\00\60\69\20\34\0C)- Find all of the FCIP Entities within a specified FCIP Discovery Domain:
Service: service:fcip:entity
Scope: fcip-entity-scope-list
Query: (fcip-discovery-domain=fcip-discovery-domain-name)- In addition, a management application may wish to discover all FCIP Entities 🧚
Service: service:fcip:entity
Scope: management-service-scope-list
Query: noneHere's the metadata for this template 🎀
Name of submitter: David Peterson
Language of service template: en
Security Considerations: see section 6.Now the template text itself, copied exactly 💅
-------------------------template begins here-----------------------
template-type=fcip:entity
template-version=0.1
template-description=
This is a concrete service type. The fcip:entity service type is
used to register individual FCIP Entity addresses to be discovered
by others. UAs will generally search for these by including one of
the following:
- the FCIP Entity Name for which an address is needed
- the FCIP Discovery Domain Name for which addresses are requested
- the service URL
template-url-syntax =
url-path = hostport
hostport = host [ ":" port ]
host = hostname / hostnumber
hostname = *( domainlabel "." ) toplabel
alphanum = ALPHA / DIGIT
domainlabel = alphanum / alphanum * [alphanum / "-"] alphanum
toplabel = ALPHA / ALPHA * [ alphanum / "-" ] alphanum
hostnumber = ipv4-number
ipv4-number = 1*3DIGIT 3("." 1*3DIGIT)
port = 1*DIGIT
;
; A DNS host name should be used along with the well-known
; IANA FCIP port number for operation with NAT/NAPT devices.
;
; Examples:
; service:fcip:entity://host.example.com
; service:fcip:entity://192.0.2.0:4000
;
fcip-entity-name = opaque L
# If the FCIP Entity is a VE_Port/B_Access implementation [FC-BB-2]
# residing in a switch, the fcip-entity-name is the Fibre Channel
# Switch Name [FC-SW-3]. Otherwise, the fcip-entity-name is the
# Fibre Channel Node Name [FC-FS] of the port (e.g., an Nx_Port)
# associated with the FCIP Entity.
# An entity representing multiple endpoints must register each of
# the endpoints using SLPv2.
transports = string M L
tcp
# This is a list of transport protocols that the registered entity
# supports. FCIP is currently supported over TCP only.
tcp
mgmt-entity = string M O L
# The URL's of the management interface(s) are appropriate for SNMP,
# web-based, or telnet management of the FCIP Entity.
# Examples:
# http://fcipentity.example.com:1080/
# telnet://fcipentity.example.com
fcip-discovery-domain = string M L
fcip
# The fcip-discovery-domain string contains the name(s) of the FCIP
# discovery domain(s) to which this FCIP Entity belongs.
--------------------------template ends here------------------------6. Security Considerations 🔒
This part is seriously important, bestie 😭 The SLPv2 security model from [RFC2608] doesn't give you confidentiality. What it does give you is an authentication mechanism, so UAs can make sure service advertisements only come from trusted SAs. The catch is that it has no way to authenticate "zero-result responses". See [RFC3723] for a discussion of the SLPv2 [RFC2608] security model 💜
Once an FCIP Entity has been discovered, authentication and authorization are handled by the FCIP protocol. The providers of these services are responsible for making sure that an inappropriately advertised or discovered service can't compromise their security 🛡️
When no security is used for SLPv2, there's a risk of false discovery information getting distributed. The main countermeasure is authentication. When that risk is a big concern, IPsec SAs SHOULD be used for the FCIP traffic that is subject to this risk, so FCIP traffic only flows between endpoints that have gone through IKE authentication. For example, if an attacker spreads discovery information falsely claiming to be an FCIP endpoint, it won't have the secret information needed to finish IKE authentication, so it gets blocked from sending or receiving FCIP traffic 🙅♀️
There's also still a risk of a denial of service attack. An attacker can keep using false discovery information to force the start of IKE negotiations. The countermeasures are:
- Administrative configuration of each FCIP Entity to limit the peers it is willing to talk to (by IP address range and/or DNS domain).
- Maintaining a negative authentication cache, so you don't keep contacting an FCIP Entity that fails to authenticate.
These three measures (i.e., IP address range limits, DNS domain limits, negative authentication cache) MUST be implemented 🚨
6.1. Security Implementation 🔐
Security for SLPv2 in an IP storage environment is specified in [RFC3723]. IPsec is mandatory-to-implement for IPS clients and servers. So all IP storage clients, including the ones invoking SLP, can be assumed to support IPsec. SLP servers, however, can't be assumed to implement IPsec, because standard SLP has no such requirement. In particular, SLP Directory Agents (DA) may be running on machines other than the ones running the IPS protocols 🖥️
IPsec SHOULD be implemented for SLPv2 as specified in [RFC3723]. This includes ESP with a non-null transform, which gives you both authentication and confidentiality 💪
Because the IP storage services have their own authentication capabilities once located, SLPv2 authentication is OPTIONAL to implement and use (as discussed in more detail in [RFC3723]) ✨
7. IANA Considerations 🌸
This document describes two SLP Templates in Section 5. They should be registered in the IANA "SVRLOC Templates" registry. This process is described in the IANA Considerations section of [RFC2609] 📋
8. Internationalization Considerations 🌍
SLP lets internationalized strings be registered and retrieved. Attributes in the template that are not marked with an 'L' (literal) will be registered in a localized manner. An "en" (English) localization MUST be registered, and others MAY be registered 🇬🇧
9. Summary 🍓
This document describes how SLPv2 can be used by FCIP Entities to find other FCIP Entities. It also presents service type templates for FCIP Entities 🦋
10. Acknowledgements 🫶
This document was produced by the FCIP discovery team: Todd Sperry (Adaptec), Larry Lamars (SanValley), Robert Snively (Brocade), Ravi Natarajan (Lightsand), Anil Rijhsinghani (McData), and Venkat Rangan (Rhapsody Networks). Thanks also to Mark Bakke (Cisco) for initial help and consultation, and to David Black, Erik Guttman, and James Kempf for assistance during expert review 👑
11. References 📚
11.1. Normative References
[RFC2608] Guttman, E., Perkins, C., Veizades, J. and M. Day, "Service Location Protocol, Version 2", RFC 2608, June 1999.
[RFC2609] Guttman, E., Perkins, C. and J. Kempf, "Service Templates and Service: Schemes", RFC 2609, June 1999.
[RFC2119] Bradner, S., "Key Words for Use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC3821] Rajagopal, M., Bhagwat, R. and R. Weber, "Fibre Channel Over TCP/IP (FCIP)", RFC 3821, July 2004.
[FC-SW-3] Fibre Channel Switch Fabric - 3, ANSI INCITS 384-2004.
[FC-BB-2] Fibre Channel Backbone - 2, ANSI INCITS 372-2003.
[FC-FS] Fibre Channel Framing and Signaling, T11 Project 1331-D, Rev 1.90, April 9, 2003.
[RFC3723] Aboba, B., Tseng, J., Walker, J., Rangan, V. and F. Travostino, "Securing Block Storage Protocols over IP", RFC 3723, April 2004.
11.2. Informative References
[RFC3105] Kempf, J. and G. Montenegro, "Finding an RSIP Server with SLP", RFC 3105, October 2001.
12. Author's Address 📮
David Peterson
Computer Network Technology (CNT)
6000 Nathan Lane North
Minneapolis, MN 55442
Phone: 763-268-6139
EMail: dap@cnt.com13. Full Copyright Statement ©️
Copyright (C) The Internet Society (2004). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🎀
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat, any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
Acknowledgement 💜
Funding for the RFC Editor function is currently provided by the Internet Society 🌈
📦 where this page comes from
- ietf: rfc3822 2004-07
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms