The IPv4 Dynamic Host Configuration Protocol (DHCP) Option for the Internet Storage Name Service
updated by
- rfc-7146 — Securing Block Storage Protocols over IP: RFC 3723 Requirements Update for IPsec v3
Extracted elements (19)
Existing DHCP options cannot be used to find iSNS servers because (a) iSNS functionality is a significant superset of typical name resolution protocols such as DNS, and (b) the DHCP option must specify not just the server location but also which subset of iSNS services may be actively used by the client.
When IPsec is implemented for iSNS and the risk of false discovery information is a significant concern, IPsec SAs SHOULD also be used for iSNS traffic itself — relying solely on IP Storage protocols to detect false discovery information is less robust.
If IKE/IPSec is enabled, then for each bit pair <Main Mode, Aggressive Mode> and <Transport Mode, Tunnel Mode>, one of the two bits MUST be set to 1 and the other MUST be set to 0.
If the Function Fields Enabled bit (bit 15 of the iSNS Functions Field) is set to zero, the contents of all other iSNS Function fields MUST be ignored.
If the Heartbeat bit is set in the Administrative Flags field, then b1...b4 MUST also be present, making the minimum value of the Length field 18.
RESERVED fields SHOULD be set to zero.
The Code field through IP address field a1...a4 MUST be present in every response to the iSNS query; therefore the Length field has a minimum value of 14.
The inclusion of Additional Secondary iSNS Servers in the response MUST be indicated by increasing the Length field accordingly.
The 16-bit Administrative Flags Field is a bitmap with four bits: bit 15 (Enabled), bit 14 (Heartbeat), bit 13 (Management SCNs), bit 12 (Default Discovery Domain). If the Enabled bit is zero, the remaining contents MUST be ignored, meaning iSNS administrative settings are obtained by other means.
The 16-bit Discovery Domain Access Field is a bitmap controlling which iSNS client types may modify Discovery Domains: bit 15 (Enabled), bit 14 (Control Node), bit 13 (iSCSI Target), bit 12 (iSCSI Initiator), bit 11 (iFCP Target Port), bit 10 (iFCP Initiator Port). If bit 15 is zero, the remaining bits MUST be ignored.
The 16-bit iSNS Functions Field is a bitmap with three defined bits: bit 15 (Function Fields Enabled), bit 14 (DD-Based Authorization), and bit 13 (Security Policy Distribution). If bit 15 is zero, all other function field contents MUST be ignored.
The 32-bit iSNS Server Security Bitmap communicates the security settings required to communicate with the indicated iSNS server: bit 31 (Enabled), bit 30 (IKE/IPSec), bit 29 (Main Mode), bit 28 (Aggressive Mode), bit 27 (PFS), bit 26 (Transport Mode), bit 25 (Tunnel Mode).
The Default Discovery Domain bit (bit 12) controls whether newly registered devices not explicitly placed into a Discovery Domain are automatically added to a default DD and DDS. If set to one, a default DD contains all unassigned devices; if zero, such devices are not members of any DD.
The Heartbeat bit (bit 14) in the Administrative Flags Field controls the interpretation of a1–a4 and b1–b4: if set to one, a1–a4 contains the heartbeat multicast address and b1–b4 contains the primary iSNS server address; if zero, a1–a4 contains the primary iSNS server address.
IANA has assigned DHCP option code 83 to the iSNS option. There are no other IANA-assigned values defined by this specification.
The DHCP Authentication security option (RFC 3118) may present a problem for protecting the iSNS DHCP option due to limited implementation and deployment of DHCP authentication. IPsec security mechanisms for iSNS itself are specified in RFC 4171.
When IPsec is implemented for iSNS, there is a risk of a DoS attack based on repeated false discovery information triggering IKE negotiation. Countermeasures — IP address range limits, DNS domain limits, and a negative authentication cache — MUST be implemented for iSNS entities when this DHCP option is used.
When no DHCP security is used, there is a risk of distribution of false discovery information via a spoofed iSNS server. The primary countermeasure is authentication by the IP storage protocols (iFCP, iSCSI) discovered through iSNS. When this risk is significant, IPsec SAs SHOULD be used as specified in RFC 3723.
The iSNS DHCP option (Code=83) carries: a Length field, a 16-bit iSNS Functions field, a 16-bit DD Access field, a 16-bit Administrative Flags field, a 32-bit iSNS Server Security Bitmap, and one or more 4-octet IPv4 addresses for primary, heartbeat, and secondary iSNS servers. All fields are in big-endian network byte order.