Fibre Channel Over TCP/IP (FCIP)
updated by
- rfc-7146 — Securing Block Storage Protocols over IP: RFC 3723 Requirements Update for IPsec v3
Extracted elements (33)
FSF-based configuration discovery (using a zero Destination WWN to ask 'who am I talking to?') was defined as a policy option rather than a default because it lacks the broad security capabilities of SLPv2, making it inappropriate for all environments.
The FSF usage during TCP Connection setup is deliberately not a login or parameter negotiation mechanism. Because FCIP is only a tunnel for a FC Fabric, and the Fabric has its own complex link setup algorithm, complexity was delegated to FC-layer processes rather than duplicated in FCIP.
Transit time measurement (for FC latency compliance) was placed on the FC Entity rather than the FCIP Entity so that the transit time through the FCIP Entities themselves is included in the measured IP Network transit time, giving a more accurate end-to-end figure.
Both FC and IETF standards use the same byte transmission order, but bit and byte numbering conventions differ between them. Implementors combining FC and IETF specifications must account for this difference (see Appendix A).
FC Primitive Signals, Primitive Sequences, and Class 1 FC Frames are NOT transmitted across an FCIP Link because they cannot be encoded using FC Frame Encapsulation. FCIP is also explicitly not a replacement for the FC Arbitrated Loop interconnect.
In simultaneous open (both FCIP Entities initiate TCP connects concurrently), two TCP Connections and two FCIP Links are formed between the same FCIP Entities. This is not an error; Fibre Channel can handle two approximately equal connections between FC Fabric elements.
A product that tunnels an FC Fabric through an IP Network MUST combine an FCIP Entity with an FC Entity to form a complete interface between the FC Fabric and IP Network.
After a TCP connect request is accepted, the FCIP Entity SHALL wait for the FSF echo; if echoed FSF bytes (words 7–17) do not exactly match the sent FSF or the echoed Destination FC Fabric Entity WWN is zero, the FCIP Entity SHALL close the TCP Connection.
An FCIP Link SHALL contain at least one TCP Connection and MAY contain more than one TCP Connection. The endpoints of a single TCP Connection are FCIP Data Engines.
At least 3 of the 16 specified encapsulation validation tests SHALL be performed; failure of any test actually performed SHALL indicate an encapsulation error and the FC Frame SHALL NOT be forwarded to the FC Entity.
Each FC Frame entering the FCIP_DE SHALL be accompanied by a time stamp, which the FCIP_DE SHALL place in the Time Stamp fields of the encapsulation header. If no synchronized time stamp is available, a value of zero SHALL be used.
FCIP Entities SHOULD implement PAWS (Protection Against Wrapped Sequence Numbers) per RFC 793/1323, as TCP sequence numbers may wrap within a timeout window on high-speed FCIP links.
If a received Connection Nonce is identical to the most recently received nonce from the same IP Address, or if a duplicate FSF is received during FCIP Link formation, the FCIP Entity SHALL close the TCP Connection to prevent replay attacks.
If an FCIP_DE loses synchronization with the FC Frame stream, it SHALL either close the TCP Connection and notify the FC Entity, or attempt resynchronization by scanning for a valid FCIP Frame header and discarding bytes until one is found.
If dynamic discovery of participating FCIP Entities is supported, the function SHALL be performed using the Service Location Protocol (SLPv2) in the manner defined for FCIP usage.
The FC Entity SHALL use internal clocks and either Fibre Channel services or an SNTP Version 4 server to establish and maintain the required synchronized time value, and SHALL verify both sides of an FCIP Link use the same synchronized time source.
The FCIP Entity SHALL listen for new TCP Connection requests on the FCIP Well-Known Port (3225) and SHALL generate TCP connect requests to port 3225 (or a configured alternate port) when establishing new connections.
The FSF (FCIP Special Frame) SHALL only be sent as the first bytes transmitted in each direction on a newly formed TCP Connection, and only one FSF SHALL be transmitted in each direction. After that, all FCIP Frames SHALL have the SF bit set to 0.
The Protocol# field in the FC Frame Encapsulation header SHALL contain 1 (the IANA-assigned value for FCIP), and the CRCV flag and CRC field SHALL both be set to 0 in FCIP encapsulation.
Three synchronization tests SHALL be performed to validate the incoming byte stream: (1) Frame Length in range 15 < Length < 545, (2) Frame Length equals ones complement, and (3) a valid EOF is found at the location indicated by the Frame Length field.
To support IP Network security, FCIP Entities MUST implement cryptographically protected authentication with data integrity keyed to the authentication process, and MUST implement data confidentiality security features.
The Connection Nonce is a 64-bit random number in the FSF that uniquely identifies a single TCP connect request. It SHALL differ from any recently used nonce value; implementors SHOULD follow RFC 4086 (Randomness Recommendations for Security) when generating it.
The Connection Usage Flags field (8 bits in the FSF word 14) identifies the FC SOF frame types intended on the connection via four bits: SOFf, SOF?2, SOF?3, and SOF?4. The FCIP Entity SHALL NOT enforce these types but SHALL use them to select QoS settings.
The FCIP Well-Known Port is 3225, assigned by IANA. FCIP Entities SHALL listen on this port and SHALL direct outbound TCP connect requests to this port unless an alternate port is configured.
The pFlags field contains two defined bits: SF (bit 7) indicates whether the FCIP Frame is an FSF (SF=1) or an encapsulated FC Frame (SF=0), and Ch (bit 0) indicates whether an echoed FSF was intentionally altered by the recipient (Ch=1). The -pFlags field SHALL contain the ones complement of pFlags.
IANA assigned Protocol# value 1 to FCIP in the FC Frame Encapsulation Protocol# registry (defined in the FC Frame Encapsulation specification). The FCIP Protocol# field in every FCIP Frame encapsulation header SHALL contain 0x01.
An attacker can exploit the FSF authentication mechanism by observing the nonce and entity identifiers sent on an initial TCP Connection, then forming a new FCIP Link using those observed values while resetting or blocking the original connection. IPsec ESP mitigates this; a timeout on FSF reception reduces but does not eliminate the risk.
FCIP Entities MUST implement IPsec ESP for authentication and confidentiality, and IKE as the key management protocol. The TCP checksum, FCIP ones-complement checks, and FC CRC do not protect against malicious alteration because all can be recomputed by an adversary with IP-level access.
Identified threat classes include: unauthorized FC element access via IP, traffic monitoring/manipulation, TCP Connection hijacking to instantiate invalid FCIP Links, valid/invalid frame injection, payload alteration, masquerade as valid FCIP Entities, DoS via TCP connection exhaustion, and attacks on the SLPv2 discovery process.
FCIP TCP Connection establishment proceeds through: (1) TCP connect issued to port 3225; (2) FSF sent as first bytes with Source WWN, Entity ID, Nonce, and Destination WWN; (3) wait up to 90 s for echoed FSF (words 7–17 must match exactly); (4) on match, FCIP_LEP and FCIP_DE created and FC Entity notified; on mismatch or timeout, TCP Connection closed.
The FCIP Protocol Specific field (words 1–2 of the FC Frame Encapsulation header) consists of: word 1 as an exact replica of encapsulation word 0, and word 2 containing pFlags (bits 31–24), Reserved=0x00 (bits 23–16), -pFlags ones complement (bits 15–8), and -Reserved=0xFF (bits 7–0).
The FCIP Special Frame (FSF) is 18 32-bit words: words 0–6 are the standard FC Frame Encapsulation header (with Protocol#=0x01, Version=0x01, Frame Length=19 words), followed by words 7 (Reserved/complement), 8–9 (Source FC Fabric Entity WWN, 64 bits), 10–11 (Source FC/FCIP Entity Identifier, 64 bits), 12–13 (Connection Nonce, 64 bits), 14 (Connection Usage Flags + Connection Usage Code), 15–16 (Destination FC Fabric Entity WWN, 64 bits), 17 (K_A_TOV), and 18 (Reserved/complement).
Valid FCIP Frame Length values satisfy 15 < Frame Length < 545 (units: 32-bit words). The minimum of 16 derives from 7 (encapsulation header) + 1 (SOF) + 1 (EOF) + 6 (FC header) + 1 (FC CRC); the maximum of 544 adds the maximum 528-word FC payload.