RFC 4174
The IPv4 Dynamic Host Configuration Protocol (DHCP) Option for the Internet Storage Name Service
The IPv4 Dynamic Host Configuration Protocol (DHCP) Option for the Internet Storage Name Service 🎀
okay bestie, this one is the RFC for a DHCP option that lets iSNS clients find their iSNS server automatically 🧚💖 it's from September 2005, it's on the Standards Track (so it's a real, official protocol spec, not just a vibe), and the authors are C. Monia (Consultant), J. Tseng (Riverbed Technology), and K. Gibbons (McDATA Corporation). this header doesn't have any Obsoletes or Updates lines, so it isn't replacing or changing any other RFC 🫶
Status of This Memo 📜
ok so this document is an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🌸 for the current standardization state and status, check the "Internet Official Protocol Standards" (STD 1) edition. and yes, distribution of this memo is unlimited 💅
Copyright Notice ⭐
Copyright (C) The Internet Society (2005).
Abstract 🦋
so this doc describes the Dynamic Host Configuration Protocol (DHCP) option that lets Internet Storage Name Service (iSNS) clients discover the location of the iSNS server automatically using DHCP for IPv4 🍓 iSNS handles discovery and management for Internet SCSI (iSCSI) and Internet Fibre Channel Protocol (iFCP) storage devices in enterprise-scale IP storage networks. it brings intelligent storage management, the kind you'd find on Fibre Channel networks, so a regular IP network can act like a storage area network. iconic 👑
Table of Contents 🗂️
1. Introduction ................................................. 2
1.1. Conventions Used in This Document ...................... 2
2. iSNS Option for DHCP ......................................... 3
2.1. iSNS Functions Field ................................... 5
2.2. Discovery Domain Access Field .......................... 6
2.3. Administrative Flags Field ............................. 7
2.4. iSNS Server Security Bitmap ............................ 8
3. Security Considerations ...................................... 9
4. IANA Considerations .......................................... 11
5. Normative References ......................................... 11
6. Informative References ....................................... 111. Introduction ✨
okay so DHCP for IPv4 gives hosts a way to get configuration info, and it's super useful for hosts and devices that use iSCSI and iFCP to reach block-level storage over a TCP/IP network 💖
the iSNS Protocol is basically a framework for automated discovery, management, and configuration of iSCSI and iFCP devices on a TCP/IP network 🧚 it does stuff similar to what Fibre Channel networks have, except iSNS works inside an IP network. so it gives IP networks the storage intelligence that Fibre Channel networks already have. main character energy 🎀
but existing DHCP options can't be used to find iSNS servers, and here's why 👀
- a) iSNS is really different from other protocols that use DHCP options. iSNS is a big superset of what typical name resolution protocols like DNS do. it's built for client devices that let themselves be configured and managed from one central iSNS server 🫶
- b) iSNS needs a DHCP option format that gives more than just the location of the iSNS server. the option has to say which subset of iSNS services the iSNS client is allowed to actively use 🔥
the DHCP option number for iSNS is what iSCSI and iFCP devices use to find the location and role of the iSNS server. IANA assigned the number 83 to iSNS 🌈
1.1. Conventions Used in This Document 💅
so "iSNS" refers to the Internet Storage Name Service framework, which is made up of the storage network model and its associated services 🦋
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. 🌸
all frame formats are in big-endian network byte order 🍓 and RESERVED fields SHOULD be set to zero 🙈
this doc uses these terms:
- "iSNS Client": iSNS clients are processes living inside iSCSI and iFCP devices. they start transactions with the iSNS server using the iSNS Protocol 🧚
- "iSNS Server": the iSNS server answers iSNS protocol query and registration messages, and it kicks off asynchronous notification messages. it stores whatever info the iSNS clients registered 💜
- "iSCSI (Internet SCSI)": iSCSI is SCSI encapsulated for a new generation of storage devices that are connected with TCP/IP 🫶
- "iFCP (Internet Fibre Channel Protocol)": iFCP is a gateway-to-gateway protocol designed to connect existing Fibre Channel devices over TCP/IP. it maps the Fibre Channel transport and fabric services onto TCP/IP ✨
2. iSNS Option for DHCP 🎀
this option tells you where the primary and backup iSNS servers are, plus which iSNS services the iSNS client can use 💖 here's the layout:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Code = 83 | Length | iSNS Functions |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| DD Access | Administrative FLAGS |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| iSNS Server Security Bitmap |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| a1 | a2 | a3 | a4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| b1 | b2 | b3 | b4 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| . . . . |
| Additional Secondary iSNS Servers |
| . . . . |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 1. iSNS Server Optionso the iSNS Option is basically a list of IP addresses used by iSNS servers 🦋 it has these parameters:
- Length: the number of bytes that come after the Length field 🌈
- iSNS Functions: a bitmapped field that defines the functions the iSNS servers support. the format is in section 2.1 🧚
- Discovery Domain Access: a bit field showing which types of iSNS clients are allowed to change Discovery Domains. see section 2.2 for the details 🔥
- Administrative Flags field: holds the admin settings for the iSNS servers that were found through the DHCP query. see section 2.3 💅
- iSNS Server Security Bitmap: holds the iSNS server security settings from section 2.4 🫶
- a1...a4: this one depends on the Heartbeat bit in the Administrative Flags field (see section 2.3). it's either the IP address the iSNS heartbeat comes from (see [iSNS]) or the IP address of the primary iSNS server 👑
- b1...b4: again depends on the Heartbeat bit in the Administrative Flags field (see section 2.3). it's either the IP address of the primary iSNS server or the one of a secondary iSNS server 💜
- Additional Secondary iSNS Servers: every set of four octets is the IP address of one secondary iSNS server 🍓
ok this part is important so pay attention 🙈 the Code field through the IP address field a1...a4 MUST be present in every response to the iSNS query, so the Length field has a minimum value of 14.
if the Heartbeat bit is set in the Administrative Flags field (see section 2.3), then b1...b4 MUST also be present. in that case, the minimum value of the Length field is 18 ✨
and if you include Additional Secondary iSNS Servers in the response, the MUST rule says you have to show that by increasing the Length field accordingly 🌸
2.1. iSNS Functions Field 🧚
the iSNS Functions Field tells you the iSNS server's operational role, meaning how the iSNS server is supposed to be used 💖 a role can be as basic as simple discovery info, or as big as providing IKE/IPSec security policies and certificates for iSCSI and iFCP devices to use 🎀 the format is in Figure 2:
0 1 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| RESERVED |S|A|E|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 2. iSNS Functions Fieldthese are the bits in the field 🦋
Bit Field Significance
--------- ------------
15 Function Fields Enabled
14 DD-Based Authorization
13 Security Policy Distributionand here's what each one means 💅
- Function Fields Enabled: this tells you whether the other iSNS Function fields are valid. if it's set to one, the contents of all the other iSNS Function fields are valid. if it's set to zero, the contents of all the other iSNS Function fields MUST be ignored 🌈
- DD-based Authorization: this one says whether devices in a common Discovery Domain (DD) are automatically allowed to access each other. discovery domains control how far device discovery goes, but they don't necessarily mean a domain member is authorized to access the devices it finds 🔥 if this bit is set to one, devices in a common Discovery Domain are automatically allowed to access each other, as long as they're successfully authenticated. if it's set to zero, domain membership doesn't imply access authorization, and each device has to explicitly do that itself. either way, devices that aren't in a common discovery domain are not allowed to access each other 🫶
- Security Policy Distribution: this says whether the iSNS client is supposed to download and use the security policy configuration stored on the iSNS server 🧚 if it's set to one, the policy is stored in the iSNS server and the iSNS client must use it for its own security policy. if it's set to zero, the iSNS client has to get its security policy configuration some other way ✨
2.2. Discovery Domain Access Field ✨
okay so the DD Access bit field has its own little layout, and it's giving very organized 💅 Here's Figure 3:
0 1 1 1 1 1 1
0 ... 9 0 1 2 3 4 5
+---+---+---+---+---+---+---+---+---+
| RESERVED | if| tf| is| ts| C | E |
+---+---+---+---+---+---+---+---+---+
Figure 3. Discovery Domain Access FieldEach bit has a job, and here's the breakdown 🎀
Bit Field Significance
--------- ------------
15 Enabled
14 Control Node
13 iSCSI Target
12 iSCSI Initiator
11 iFCP Target Port
10 iFCP Initiator PortNow the fun part, the definitions 🦋
- Enabled: this one decides whether the rest of the DD Access bit field is valid. If it's set to one, the remainder of the field is valid. If it's set to zero, the contents of the remainder of this field MUST be ignored.
- Control Node: this tells you whether the iSNS server lets Discovery Domains get added, modified, or deleted through Control Nodes. Set to one means Control Nodes are allowed to modify the Discovery Domain configuration 🙌. Set to zero means they are not allowed to modify Discovery Domain configurations 🙅♀️.
- iSCSI Target, iSCSI Initiator, iFCP Target Port, iFCP Initiator Port: these decide whether the matching registered iSNS client is allowed to add, delete, or modify Discovery Domains. The client type gets figured out from the iSCSI Node Type or the iFCP Port Role. One means that client type is allowed to modify things, and zero means it's not allowed 💜.
(A node may implement multiple node types. 🧚)
2.3. Administrative Flags Field 💖
the Administrative Flags bit field is next, and it's a whole vibe 🌸 Check out Figure 4:
0 1 1
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| RESERVED |D|M|H|E|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4. Administrative Flagsand the bits look like this 🍓
Bit Field Significance
--------- ------------
15 Enabled
14 Heartbeat
13 Management SCNs
12 Default Discovery Domainhere's the tea on each one ☕
- Enabled: this says whether the rest of the Administrative Flags field is valid. If it's one, the remaining flags are valid. If it's zero, the remaining contents MUST be ignored, which basically means iSNS administrative settings get sorted out some other way than DHCP 🤷♀️.
- Heartbeat: this one is about whether the first IP address is the multicast address where the iSNS heartbeat message gets sent. If it's one, a1-a4 holds the heartbeat multicast address, and b1-b4 holds the IP address of the primary iSNS server, followed by the IP address(es) of any backup servers (see Figure 1). If it's zero, a1-a4 holds the IP address of the primary iSNS server, followed by the IP address(es) of any backup servers 🫶.
- Management SCNs: this covers whether control nodes are authorized to register for Management State Change Notifications (SCNs). Management SCNs are a special kind of State Change Notification, and their scope is the entire iSNS database 🌈. One means control nodes are authorized to register for Management SCNs. Zero means they're not authorized to receive them, though they can still get normal SCNs.
- Default Discovery Domain: this one is about what happens to a newly registered device that doesn't get explicitly placed into a Discovery Domain (DD) and Discovery Domain Set (DDS). If it's one, a default DD shall contain all devices in the iSNS database that haven't been explicitly placed into a DD by an iSNS client 👑. If it's zero, devices that weren't explicitly placed into a DD are not members of any DD 💀.
2.4. iSNS Server Security Bitmap 🔐
this bitmap is the security settings check-in for the iSNS server, and it's super important 💅 If it's valid, it tells the DHCP client which security settings it needs to talk to that particular iSNS server. Here's Figure 5:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| RESERVED |T|X|P|A|M|S|E|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 5. iSNS Server Security Bitmapand the bits are 🧚
Bit Field Significance
--------- ----------------
31 Enabled
30 IKE/IPSec
29 Main Mode
28 Aggressive Mode
27 PFS
26 Transport Mode
25 Tunnel Modethe definitions go like this ✨
- Enabled: this says whether the rest of the iSNS server security bitmap is valid. If it's one, the rest of the field is valid. If it's zero, the contents of the rest of the field are undefined and MUST be ignored 🙈.
- IKE/IPSec: 1 = IKE/IPSec enabled; 0 = IKE/IPSec disabled.
- Main Mode: 1 = Main Mode enabled; 0 = Main Mode disabled.
- Aggressive Mode: 1 = Aggressive Mode enabled; 0 = Aggressive Mode disabled.
- PFS: 1 = PFS enabled; 0 = PFS disabled.
- Transport Mode: 1 = Transport Mode preferred; 0 = No preference.
- Tunnel Mode: 1 = Tunnel Mode preferred; 0 = No preference.
okay so if IKE/IPSec is disabled, that means the Internet Key Exchange (IKE) Protocol isn't available to set up IPSec keys for iSNS sessions to this iSNS server 🥺. It doesn't necessarily rule out other key exchange methods (e.g., manual keying) from setting up an IPSec security association for the iSNS session, though 🦋.
If IKE/IPsec is enabled, then for each of the bit pairs <Main Mode, Aggressive Mode> and <Transport Mode, Tunnel Mode>, one of the two bits MUST be set to 1, and the other MUST be set to 0 💖. no sneaking both on or both off, bestie 🙅♀️.
3. Security Considerations 🛡️
okay this section is seriously important, so pay attention 👀
For protecting the iSNS option, the DHCP Authentication security option as specified in [RFC3118] might be a problem, because the DHCP authentication option isn't really implemented or deployed much 😭. The IPsec security mechanisms for iSNS itself are specified in [iSNS] to provide confidentiality when sensitive information gets distributed via iSNS. See the Security Considerations section of [iSNS] for details and specific requirements for implementing IPsec 🔥.
In addition, [iSNS] describes an authentication block that provides message integrity for multicast or broadcast iSNS messages (i.e., for heartbeat/discovery messages only). See [RFC3723] for further discussion of security for these protocols 🌸.
If no sensitive information, as described in [iSNS], is being distributed via iSNS, and an Entity is discovered via iSNS, then authentication and authorization are handled by the IP Storage protocols whose endpoints got discovered via iSNS. Specifically, that means iFCP [iFCP] and iSCSI [RFC3720] 🧚. It's the responsibility of the providers of these services to make sure an inappropriately advertised or discovered service doesn't compromise their security 🙅♀️.
When no DHCP security is used, there's a risk of false discovery information getting distributed. For example, that could happen through the iSNS DHCP option pointing at a false iSNS server that spreads the false discovery information 😱. The primary countermeasure for this risk is authentication by the IP storage protocols discovered through iSNS. When this risk is a significant concern, IPsec SAs SHOULD be used (as specified in RFC 3723). For example, if an attacker uses DHCP and iSNS to distribute discovery information that falsely identifies an iSCSI endpoint, that endpoint won't have the credentials it needs to complete IKE authentication successfully, so it'll be stopped from falsely sending or receiving iSCSI traffic 🔒. When this risk of false discovery information is a significant concern and IPsec is implemented for iSNS, IPsec SAs SHOULD also be used for iSNS traffic to prevent use of a false iSNS server 💅. That's more robust than only relying on the IP Storage protocols to catch false discovery information ✨.
When IPsec is implemented for iSNS, there's a risk of a denial-of-service attack based on repeated use of false discovery information that causes IKE negotiation to start over and over 💀. The countermeasures for this are administrative configuration of each iSNS Entity to limit the peers it's willing to communicate with (i.e., by IP address range and/or DNS domain), and maintaining a negative authentication cache so it stops repeatedly contacting an iSNS Entity that fails to authenticate 🛑. These three measures (i.e., IP address range limits, DNS domain limits, negative authentication cache) MUST be implemented for iSNS entities when this DHCP option is used 🚨. An analogous argument applies to the IP storage protocols that can be discovered via iSNS, as discussed in RFC 3723 🦋.
In addition, using the techniques described in [RFC2827] and [RFC3833] may also be relevant for reducing denial-of-service attacks 🌈.
4. IANA Considerations 🎀
In accordance with the policy defined in [DHCP], IANA has assigned a value of 83 for this option 💖.
There are no other IANA-assigned values defined by this specification 🫶.
5. Normative References ✨
okay so these are the docs you have to read to get this one, no skipping bestie 📚
- [DHCP] Droms, R., "Dynamic Host Configuration Protocol", RFC 2131, March 1997.
- [iSNS] Tseng, J., Gibbons, K., Travostino, F., Du Laney, C., and J. Souza, "Internet Storage Name Service (iSNS)", RFC 4171, September 2005.
- [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
- [RFC3118] Droms, R. and W. Arbaugh, "Authentication for DHCP Messages", RFC 3118, June 2001.
- [RFC3720] Satran, J., Meth, K., Sapuntzakis, C., Chadalapaka, M., and E. Zeidner, "Internet Small Computer Systems Interface (iSCSI)", RFC 3720, April 2004.
- [RFC3723] Aboba, B., Tseng, J., Walker, J., Rangan, V., and F. Travostino, "Securing Block Storage Protocols over IP", RFC 3723, April 2004.
6. Informative References 🧚
these ones are more like bonus reading, the vibe is "good to know" not "must know" 💅
- [iFCP] Monia, C., Mullendore, R., Travostino, F., Jeong, W., and M. Edwards, "iFCP - A Protocol for Internet Fibre Channel Storage Networking", RFC 4172, September 2005.
- [RFC2827] Ferguson, P. and D. Senie, "Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing", BCP 38, RFC 2827, May 2000.
- [RFC3833] Atkins, D. and R. Austein, "Threat Analysis of the Domain Name System (DNS)", RFC 3833, August 2004.
Authors' Addresses 🎀
here are the people who made this happen, aka the girlies behind the doc 🫶
Kevin Gibbons
McDATA Corporation
4555 Great America Parkway
Santa Clara, CA 95054-1208
Phone: (408) 567-5765
EMail: kevin.gibbons@mcdata.com
Charles Monia
7553 Morevern Circle
San Jose, CA 95135
EMail: charles_monia@yahoo.com
Josh Tseng
Riverbed Technology
501 2nd Street, Suite 410
San Francisco, CA 94107
Phone: (650)274-2109
EMail: joshtseng@yahoo.comFull Copyright Statement 🌈
the legal bit, but make it cute 🙈
Copyright (C) The Internet Society (2005). The authors keep their rights, but this document is covered by BCP 78 and the rights, licenses and restrictions in it.
This is provided "as is," and the contributor, the organization they represent or are sponsored by (if any), the Internet Society and the IETF all disclaim every warranty, express or implied. That includes no promise that using the info won't infringe any rights, and no implied warranty of merchantability or fitness for a particular purpose.
THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 💜
the IETF doesn't take a side on patents or who owns what, and it's not saying it looked for any 🔍
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document, or the extent to which any license under such rights might or might not be available. It also doesn't say it went out and checked for any such rights. For the procedures around rights in RFC documents, check out BCP 78 and BCP 79.
Copies of IPR disclosures sent to the IETF Secretariat, plus any assurances of licenses that will be available, or the results of an attempt to get a general license or permission to use those proprietary rights for implementers or users of this spec, can be found in the IETF's online IPR repository at http://www.ietf.org/ipr.
The IETF invites anyone to flag any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org 📨
Acknowledgement 🍓
shoutout to the folks keeping the RFC Editor running 👑
Funding for the RFC Editor function is currently provided by the Internet Society. ✨
📦 where this page comes from
- ietf: rfc4174 2005-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms