draft-ietf-dhc-isnsoption-03.txt		draft-ietf-dhc-isnsoption-04.txt
	DHC Working Group Josh Tseng		DHC Working Group Josh Tseng
	INTERNET DRAFT Kevin Gibbons		INTERNET DRAFT Kevin Gibbons
	Expires: March 2003 Charles Monia		Expires: June 2003 Charles Monia
	Internet Draft		Internet Draft
	Document: <draft-ietf-dhc-isnsoption-03.txt> Nishan Systems		Document: <draft-ietf-dhc-isnsoption-04.txt> Nishan Systems
	Category: Standards Track September 2002		Category: Standards Track December 2002
	DHCP Options for Internet Storage Name Service		DHCP Options for Internet Storage Name Service
	Status of this Memo		Status of this Memo
	This document is an Internet-Draft and is in full conformance with		This document is an Internet-Draft and is in full conformance with
	all provisions of Section 10 of [RFC2026].		all provisions of Section 10 of [RFC2026].
	Internet-Drafts are working documents of the Internet Engineering		Internet-Drafts are working documents of the Internet Engineering
	Task Force (IETF), its areas, and its working groups. Note that		Task Force (IETF), its areas, and its working groups. Note that
	skipping to change at page 2, line 4		skipping to change at page 2, line 4
	The list of Internet-Draft Shadow Directories can be accessed at		The list of Internet-Draft Shadow Directories can be accessed at
	http://www.ietf.org/shadow.html.		http://www.ietf.org/shadow.html.
	Comments		Comments
	Comments should be sent to the IPS mailing list (ips@ece.cmu.edu) or		Comments should be sent to the IPS mailing list (ips@ece.cmu.edu) or
	to the authors.		to the authors.
	Table of Contents		Table of Contents
	DHCP Option Number for iSNS Revision 3 September 2002		DHCP Option Number for iSNS Revision 4 December 2002
	Status of this Memo...................................................1		Status of this Memo...................................................1
	Comments..............................................................1		Comments..............................................................1
	Abstract..............................................................3		Abstract..............................................................3
	Conventions used in this document.....................................3		Conventions used in this document.....................................3
	1.Introduction.......................................................3		1.Introduction.......................................................3
	2.iSNS Option for DHCP...............................................4		2.iSNS Option for DHCP...............................................4
	2.1 iSNS Functions Field.............................................5		2.1 iSNS Functions Field.............................................5
	2.2 Discovery Domain Access Field....................................6		2.2 Discovery Domain Access Field....................................6
	2.3 Administrative Flags Field.......................................7		2.3 Administrative Flags Field.......................................7
	2.4 iSNS Server Security Bitmap......................................9		2.4 iSNS Server Security Bitmap......................................9
	3.Security Considerations...........................................10		3.Security Considerations...........................................10
	4.Normative References..............................................10		4.Normative References..............................................10
	5.Non-Normative References..........................................10		5.Non-Normative References..........................................11
	6.Author's Addresses................................................11		6.Author's Addresses................................................11
	Full Copyright Statement.............................................12		Full Copyright Statement.............................................12
	DHCP Option Number for iSNS Revision 3 September 2002		DHCP Option Number for iSNS Revision 4 December 2002
	Abstract		Abstract
	This document describes the DHCP option to allow iSNS clients using		This document describes the DHCP option to allow iSNS clients using
	DHCP to automatically discover the location of the iSNS server. iSNS		DHCP to automatically discover the location of the iSNS server. iSNS
	provides discovery and management capabilities for iSCSI and Fibre		provides discovery and management capabilities for iSCSI and Fibre
	Channel (FCP) storage devices in an enterprise-scale IP storage		Channel storage devices in an enterprise-scale IP storage network.
	network. iSNS provides intelligent storage management services		iSNS provides intelligent storage management services comparable to
	comparable to those found in Fibre Channel networks, allowing a		those found in Fibre Channel networks, allowing a commodity IP
	commodity IP network to function in a similar capacity as a storage		network to function in a similar capacity as a storage area network.
	area network.
	Conventions used in this document		Conventions used in this document
	iSNS refers to the framework consisting of the storage network model		iSNS refers to the framework consisting of the storage network model
	and associated services.		and associated services.
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",		The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
	"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in		"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in
	this document are to be interpreted as described in [RFC2119].		this document are to be interpreted as described in [RFC2119].
	skipping to change at page 4, line 4		skipping to change at page 3, line 58
	The Dynamic Host Configuration Protocol provides a framework for		The Dynamic Host Configuration Protocol provides a framework for
	passing configuration information to hosts. Its usefulness extends		passing configuration information to hosts. Its usefulness extends
	to hosts and devices using the iSCSI and iFCP protocols to connect		to hosts and devices using the iSCSI and iFCP protocols to connect
	to block level storage assets over a TCP/IP network.		to block level storage assets over a TCP/IP network.
	The iSNS Protocol provides a framework for automated discovery,		The iSNS Protocol provides a framework for automated discovery,
	management, and configuration of iSCSI and iFCP devices on a TCP/IP		management, and configuration of iSCSI and iFCP devices on a TCP/IP
	network. It provides functionality similar to that found on Fibre		network. It provides functionality similar to that found on Fibre
	Channel networks, except that iSNS works within the context of an IP		Channel networks, except that iSNS works within the context of an IP
	DHCP Option Number for iSNS Revision 3 September 2002
	network. iSNS thereby provides the requisite storage intelligence		network. iSNS thereby provides the requisite storage intelligence
	to IP networks that are standard on existing Fibre Channel networks.		to IP networks that are standard on existing Fibre Channel networks.
			DHCP Option Number for iSNS Revision 4 December 2002
	Existing DHCP option numbers are not plausible due to the following		Existing DHCP option numbers are not plausible due to the following
	reasons:		reasons:
	a) iSNS functionality is distinctly different from other protocols		a) iSNS functionality is distinctly different from other protocols
	using existing DHCP option numbers. Specifically, iSNS provides		using existing DHCP option numbers. Specifically, iSNS provides
	a significant superset of capabilities compared to typical name		a significant superset of capabilities compared to typical name
	resolution protocols such as DNS. It is designed to support		resolution protocols such as DNS. It is designed to support
	client devices that allow themselves to be configured and		client devices that allow themselves to be configured and
	managed from a central iSNS server		managed from a central iSNS server
	skipping to change at page 5, line 5		skipping to change at page 4, line 58
	Figure 1 -- iSNS Server Option		Figure 1 -- iSNS Server Option
	The iSNS Option specifies a list of IP addresses used by iSNS		The iSNS Option specifies a list of IP addresses used by iSNS
	servers. The option contains the following parameters:		servers. The option contains the following parameters:
	Length: the number of bytes that follow the Length field. The		Length: the number of bytes that follow the Length field. The
	minimum value for the Length field is 6 in order to account		minimum value for the Length field is 6 in order to account
	for the iSNS Functions, Discovery Domain Access, and		for the iSNS Functions, Discovery Domain Access, and
	Administrative Flags fields.		Administrative Flags fields.
	DHCP Option Number for iSNS Revision 3 September 2002
	iSNS Functions: A bitmapped field defining the functions supported		iSNS Functions: A bitmapped field defining the functions supported
	by the iSNS servers. The format of this field is described		by the iSNS servers. The format of this field is described
	in section 2.1.		in section 2.1.
			DHCP Option Number for iSNS Revision 4 December 2002
	Discovery Domain Access: A bit field indicating the types of iSNS		Discovery Domain Access: A bit field indicating the types of iSNS
	clients that are allowed to modify Discovery Domains. The		clients that are allowed to modify Discovery Domains. The
	field contents are described in section 2.2.		field contents are described in section 2.2.
	Administrative Flags field: Contains the administrative settings for		Administrative Flags field: Contains the administrative settings for
	the iSNS servers discovered through the DHCP query. The		the iSNS servers discovered through the DHCP query. The
	contents of this field are described in section 2.3.		contents of this field are described in section 2.3.
	iSNS Server Security Bitmap: Contains the iSNS server security		iSNS Server Security Bitmap: Contains the iSNS server security
	settings specified in section 2.4.		settings specified in section 2.4.
	skipping to change at page 6, line 4		skipping to change at page 5, line 47
	significant as providing IKE/IPSec security policies and		significant as providing IKE/IPSec security policies and
	certificates for the use of iSCSI and iFCP devices. The format of		certificates for the use of iSCSI and iFCP devices. The format of
	the iSNS Role bit field is shown in Figure 2:		the iSNS Role bit field is shown in Figure 2:
	1 2 3		1 2 3
	6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1		6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
	+--+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+--+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	|Vendor-Specific |RESERVED |S|A|E|		|Vendor-Specific |RESERVED |S|A|E|
	+--+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+--+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	Figure 2 -- iSNS Functions		Figure 2 -- iSNS Functions
	DHCP Option Number for iSNS Revision 3 September 2002
	Bit field Significance		Bit field Significance
	--------- ------------		--------- ------------
	31 Function Fields Enabled		31 Function Fields Enabled
	30 DD-Based Authorization		30 DD-Based Authorization
	29 Security policy distribution		29 Security policy distribution
	28 - 24 Reserved		28 - 24 Reserved
	23 - 16 Vendor-specific		23 - 16 Vendor-specific
	Enabled: This bit specifies the validity of the		Enabled: This bit specifies the validity of the
	remaining iSNS Function fields. If set to		remaining iSNS Function fields. If set to
	one, then the contents of all other iSNS		one, then the contents of all other iSNS
	Function fields are valid. If set to zero,		Function fields are valid. If set to zero,
	then the contents of all other iSNS		then the contents of all other iSNS
			DHCP Option Number for iSNS Revision 4 December 2002
	Function fields MUST be ignored.		Function fields MUST be ignored.
	DD-based Indicates whether or not devices in a		DD-based Indicates whether or not devices in a
	Authorization: common Discovery Domain (DD) are implicitly		Authorization: common Discovery Domain (DD) are implicitly
	authorized to access one another. Although		authorized to access one another. Although
	Discovery Domains control the scope of		Discovery Domains control the scope of
	device discovery, they do not necessarily		device discovery, they do not necessarily
	indicate whether or not a domain member is		indicate whether or not a domain member is
	authorized to access discovered devices.		authorized to access discovered devices.
	If this bit is set to one, then devices in		If this bit is set to one, then devices in
	skipping to change at page 6, line 55		skipping to change at page 6, line 42
	If set to zero, then the iSNS client must		If set to zero, then the iSNS client must
	obtain its security policy configuration by		obtain its security policy configuration by
	other means.		other means.
	Vendor- These bits are used to indicate the vendor-		Vendor- These bits are used to indicate the vendor-
	Specific: specific capabilities supported by the		Specific: specific capabilities supported by the
	indicated iSNS server.		indicated iSNS server.
	2.2 Discovery Domain Access Field		2.2 Discovery Domain Access Field
	The format of the DD Access bit field is shown in Figure 3:		The format of the DD Access bit field is shown in
			Figure 3:
	DHCP Option Number for iSNS Revision 3 September 2002
	0 1 2 3 4 5 6 7		0 1 2 3 4 5 6 ... 15
	+---+---+---+---+---+---+---+---+		+---+---+---+---+---+---+---+---+---+
	| R | R | if| tf| is| ts| C | E |		| if| tf| is| ts| C | E | Reserved |
	+---+---+---+---+---+---+---+---+		+---+---+---+---+---+---+---+---+---+
	Figure 3 -- Discovery Domain Access		Figure 3 -- Discovery Domain Access
			DHCP Option Number for iSNS Revision 4 December 2002
	Bit field Significance		Bit field Significance
	--------- ------------		--------- ------------
	7 Enabled		0 iFCP Initiator Port
	6 Control Node		1 iFCP Target Port
	5 iSCSI Target		2 iSCSI Initiator
	4 iSCSI Initiator		3 iSCSI Target
	3 iFCP Target Port		4 Control Node
	2 iFCP Initiator Port		5 Enabled
	1 RESERVED		6 ... 15 Reserved
	0 RESERVED
	Enabled: This bit specifies the validity of the		Enabled: This bit specifies the validity of the
	remaining DD Access bit fields. If this		remaining DD Access bit fields. If this
	bit is set to one, then the contents of		bit is set to one, then the contents of
	the remainder of the DD Access field are		the remainder of the DD Access field are
	valid. If this bit is set to zero, then		valid. If this bit is set to zero, then
	the contents of the remainder of this		the contents of the remainder of this
	field MUST be ignored.		field MUST be ignored.
	Control Node: Specifies whether the iSNS server allows		Control Node: Specifies whether the iSNS server allows
	skipping to change at page 7, line 56		skipping to change at page 7, line 48
	one, then modification by the specified		one, then modification by the specified
	client type is allowed. If set to zero,		client type is allowed. If set to zero,
	then modification by the specified		then modification by the specified
	client type is not allowed.		client type is not allowed.
	(A node may implement multiple node		(A node may implement multiple node
	types.)		types.)
	2.3 Administrative Flags Field		2.3 Administrative Flags Field
	The format of the Administrative Flags bit field is shown in Figure		The format of the Administrative Flags bit field is shown in
	4:		Figure 4:
	DHCP Option Number for iSNS Revision 3 September 2002		DHCP Option Number for iSNS Revision 4 December 2002
	1 2 3		1 2 3
	8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1		6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
	+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	| RESERVED |D|M|H|E|		| RESERVED |D|M|H|E|
	+---+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+		+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
	Figure 4 -- Administrative Flags		Figure 4 -- Administrative Flags
	Bit Field Significance		Bit Field Significance
	--------- ------------		--------- ------------
	31 Enabled		31 Enabled
	30 Heartbeat		30 Heartbeat
	29 Management SCNs		29 Management SCNs
	28 Default Discovrery Domain		28 Default Discovery Domain
	27 - 8 RESERVED		27 - 16 RESERVED
	Enabled: Specifies the validity of the remainder		Enabled: Specifies the validity of the remainder
	of the Administrative Flags field. If		of the Administrative Flags field. If
	set to one, then the contents of the		set to one, then the contents of the
	remaining Administrative Flags are		remaining Administrative Flags are
	valid. If set to zero, then the		valid. If set to zero, then the
	remaining contents MUST be ignored,		remaining contents MUST be ignored,
	indicating that iSNS administrative		indicating that iSNS administrative
	settings are obtained through means		settings are obtained through means
	other than DHCP.		other than DHCP.
	Heartbeat: Indicates whether the first IP address		Heartbeat: Indicates whether the first IP address
	is the multicast address from which the		is the multicast address to which the
	iSNS heartbeat message originates. If		iSNS heartbeat message is sent. If set
	set to one, then a1-a4 contains the		to one, then a1-a4 contains the
	heartbeat multicast address and b1-b4		heartbeat multicast address and b1-b4
	contains the IP address of the primary		contains the IP address of the primary
	iSNS server, followed by the IP		iSNS server, followed by the IP
	address(es) of any backup servers. If		address(es) of any backup servers. If
	set to zero, then a1-a4 contains the IP		set to zero, then a1-a4 contains the IP
	address of the primary iSNS server,		address of the primary iSNS server,
	followed by the IP address(es) of any		followed by the IP address(es) of any
	backup servers.		backup servers.
	Management SCNs: Indicates whether control nodes are		Management SCNs: Indicates whether control nodes are
	skipping to change at page 9, line 4		skipping to change at page 9, line 4
	scope is the entire iSNS database. If		scope is the entire iSNS database. If
	set to one, then control nodes are		set to one, then control nodes are
	authorized to register to receive		authorized to register to receive
	Management SCN's. If set to zero, then		Management SCN's. If set to zero, then
	control nodes are not authorized to		control nodes are not authorized to
	receive Management SCN's (although they		receive Management SCN's (although they
	may receive normal SCN's).		may receive normal SCN's).
	Default Discovery Indicates whether a newly registered		Default Discovery Indicates whether a newly registered
	device that is not explicitly placed		device that is not explicitly placed
	DHCP Option Number for iSNS Revision 3 September 2002		DHCP Option Number for iSNS Revision 4 December 2002
	Domain: into a Discovery Domain (DD) and		Domain: into a Discovery Domain (DD) and
	Discovery Domain Set (DDS) should be		Discovery Domain Set (DDS) should be
	automatically placed into a default DD		automatically placed into a default DD
	and DDS. If set to one, then a default		and DDS. If set to one, then a default
	DD shall contain all devices in the iSNS		DD shall contain all devices in the iSNS
	database that have not been explicitly		database that have not been explicitly
	placed into a DD by an iSNS client. If		placed into a DD by an iSNS client. If
	set to zero, then devices not explicitly		set to zero, then devices not explicitly
	placed into a DD are not members of any		placed into a DD are not members of any
	skipping to change at page 10, line 4		skipping to change at page 10, line 4
	Bit Field Significance		Bit Field Significance
	--------- ----------------		--------- ----------------
	31 Enabled		31 Enabled
	30 IKE/IPSec		30 IKE/IPSec
	29 Main Mode		29 Main Mode
	28 Aggressive Mode		28 Aggressive Mode
	27 PFS		27 PFS
	26 Transport Mode		26 Transport Mode
	25 Tunnel Mode		25 Tunnel Mode
	24 -- 0 Reserved		24 -- 0 Reserved
	DHCP Option Number for iSNS Revision 3 September 2002		DHCP Option Number for iSNS Revision 4 December 2002
	Enabled This bit specifies the validity of the		Enabled This bit specifies the validity of the
	remainder of the iSNS server security		remainder of the iSNS server security
	bitmap. If set to one, then the contents		bitmap. If set to one, then the contents
	of the remainder of the field are valid.		of the remainder of the field are valid.
	If set to zero, then the contents of the		If set to zero, then the contents of the
	rest of the field are undefined and MUST		rest of the field are undefined and MUST
	be ignored.		be ignored.
	IKE/IPSec 1 = IKE/IPSec enabled; 0 = IKE/IPSec		IKE/IPSec 1 = IKE/IPSec enabled; 0 = IKE/IPSec
	skipping to change at page 10, line 38		skipping to change at page 10, line 38
	Tunnel Mode 1 = Tunnel mode preferred; 0 = No		Tunnel Mode 1 = Tunnel mode preferred; 0 = No
	preference.		preference.
	3. Security Considerations		3. Security Considerations
	DHCP currently provides no authentication or security mechanisms.		DHCP currently provides no authentication or security mechanisms.
	Potential exposures to attack are discussed in section 7 of the DHCP		Potential exposures to attack are discussed in section 7 of the DHCP
	protocol specification [DHCP].		protocol specification [DHCP].
	iSNS security considerations are discussed in [iSNS] and [SEC-IPS].		iSNS security considerations are discussed in [iSNS] and [SEC-IPS].
			With regard to security considerations specific to the use of this
			DHCP option to discover the location of the iSNS server, exposure to
			a "man-in-the-middle" attack by an hostile entity modifying or
			replacing the original iSNS option message should be considered a
			potential security exposure. To prevent an attacker from weakening
			the required security and potentially tricking the iSNS client into
			connecting into rogue iSNS servers, reliance on local security
			policy configuration is an appropriate countermeasure.
	4. Normative References		4. Normative References
	[DHCP] Droms, R., "Dynamic Host Configuration Protocol", RFC		[DHCP] Droms, R., "Dynamic Host Configuration Protocol", RFC
	2131, Bucknell University, March 1997.		2131, Bucknell University, March 1997.
	[RFC2026] Bradner, S., "The Internet Standards Process --		[RFC2026] Bradner, S., "The Internet Standards Process --
	Revision 3", BCP 9, RFC 2026, October 1996		Revision 3", BCP 9, RFC 2026, October 1996
	[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate		[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
	Requirement Levels", BCP 14, RFC 2119, March 1997		Requirement Levels", BCP 14, RFC 2119, March 1997
			DHCP Option Number for iSNS Revision 4 December 2002
	5. Non-Normative References		5. Non-Normative References
	[iFCP] Monia, C., et al., "iFCP - A Protocol for Internet Fibre		[iFCP] Monia, C., et al., "iFCP - A Protocol for Internet Fibre
	Channel Storage Networking", Internet draft (work in		Channel Storage Networking", Internet draft (work in
	progress), draft-ietf-ips-ifcp-13.txt, May 2002		progress), draft-ietf-ips-ifcp-13.txt, May 2002
	DHCP Option Number for iSNS Revision 3 September 2002
	[iSCSI] Satran, J., et al., "iSCSI", Internet draft (work in		[iSCSI] Satran, J., et al., "iSCSI", Internet draft (work in
	progress), draft-ietf-ips-iSCSI-15.txt, August 2002		progress), draft-ietf-ips-iSCSI-15.txt, August 2002
	[iSNS] Tseng, J. et al., "iSNS - Internet Storage Name		[iSNS] Tseng, J. et al., "iSNS - Internet Storage Name
	Service", Internet draft (work in progress), draft-ietf-		Service", Internet draft (work in progress), draft-ietf-
	ips-isns-12.txt, August 2002		ips-isns-12.txt, August 2002
	[SEC-IPS] Aboba, B., et al., "Securing IP Block Storage		[SEC-IPS] Aboba, B., et al., "Securing IP Block Storage
	Protocols", draft-ietf-ips-security-14.txt, June 2002		Protocols", draft-ietf-ips-security-14.txt, June 2002
	skipping to change at page 12, line 6		skipping to change at page 12, line 6
	Nishan Systems		Nishan Systems
	3850 North First Street		3850 North First Street
	San Jose, CA 95134-1702		San Jose, CA 95134-1702
	Phone: (408) 519-3700		Phone: (408) 519-3700
	Email: cmonia@nishansystems.com		Email: cmonia@nishansystems.com
	jtseng@nishansystems.com		jtseng@nishansystems.com
	kgibbons@nishansystems.com		kgibbons@nishansystems.com
	Full Copyright Statement		Full Copyright Statement
	"Copyright (C) The Internet Society September 2002. All Rights		"Copyright (C) The Internet Society December 2002. All Rights
	Reserved. This document and translations of it may be copied and		Reserved. This document and translations of it may be copied and
	furnished to others, and derivative works that comment on or		furnished to others, and derivative works that comment on or
	otherwise explain it or assist in its implementation may be		otherwise explain it or assist in its implementation may be
	prepared, copied, published and distributed, in whole or in part,		prepared, copied, published and distributed, in whole or in part,
	without restriction of any kind, provided that the above copyright		without restriction of any kind, provided that the above copyright
	notice and this paragraph are included on all such copies and		notice and this paragraph are included on all such copies and
	derivative works. However, this document itself may not be modified		derivative works. However, this document itself may not be modified
	in any way, such as by removing the copyright notice or references		in any way, such as by removing the copyright notice or references
	to the Internet Society or other Internet organizations, except as		to the Internet Society or other Internet organizations, except as
	needed for the purpose of developing Internet standards in which		needed for the purpose of developing Internet standards in which
End of changes.
This html diff was produced by rfcdiff 1.23, available from http://www.levkowetz.com/ietf/tools/rfcdiff/