1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
|
<pre>Network Working Group D. Wysochanski
Request for Comments: 4850 Network Appliance, Inc.
Updates: <a href="./rfc3720">3720</a> April 2007
Category: Standards Track
<span class="h1">Declarative Public Extension Key for</span>
<span class="h1">Internet Small Computer Systems Interface (iSCSI) Node Architecture</span>
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The IETF Trust (2007).
Abstract
The Internet Small Computer Systems Interface (iSCSI) protocol,
described in <a href="./rfc3720">RFC 3720</a>, allows for extension items to the protocol in
the form of Private or Public Extension Keys. This document
describes a Public Extension Key for the purpose of enhancing iSCSI
supportability. The key accomplishes this objective by allowing
iSCSI nodes to communicate architecture details during the iSCSI
login sequence. The receiving node can then use this information for
enhanced logging and support. This document updates <a href="./rfc3720">RFC 3720</a> to
allow iSCSI extension items to be defined by standards track RFCs and
experimental RFCs in addition to informational RFCs.
<span class="grey">Wysochanski Standards Track [Page 1]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-2" ></span>
<span class="grey"><a href="./rfc4850">RFC 4850</a> iSCSI Node Architecture April 2007</span>
<span class="h2"><a class="selflink" id="section-1" href="#section-1">1</a>. Introduction</span>
<span class="h3"><a class="selflink" id="section-1.1" href="#section-1.1">1.1</a>. Overview</span>
This document describes a declarative Public Extension Key, as
defined by <a href="./rfc3720#section-12.22">Section 12.22 of RFC 3720</a> [<a href="#ref-2" title=""Internet Small Computer Systems Interface (iSCSI)"">2</a>], that may be used to
communicate additional iSCSI node information to the peer node in a
session. The information carried in the described key has been found
to be valuable in real iSCSI customer environments as initiator and
target vendors collaborate to resolve technical issues and better
understand the interaction of iSCSI implementations.
The key has been modeled after the HTTP "Server" and "User-Agent"
header fields as specified in Sections <a href="#section-14.38">14.38</a> and <a href="#section-14.43">14.43</a> of <a href="./rfc2616">RFC 2616</a>
[<a href="#ref-3" title=""Hypertext Transfer Protocol -- HTTP/1.1"">3</a>], with the text-value(s) of the key roughly equivalent to Product
Tokens in <a href="./rfc2616#section-3.8">Section 3.8 of RFC 2616</a> [<a href="#ref-3" title=""Hypertext Transfer Protocol -- HTTP/1.1"">3</a>]. Note, however, that the text-
value(s) in the key's list-of-values MUST conform to the Text Format
as specified in <a href="./rfc3720#section-5.1">Section 5.1 of RFC 3720</a> [<a href="#ref-2" title=""Internet Small Computer Systems Interface (iSCSI)"">2</a>].
The key is sent during operational parameter negotiation of an iSCSI
session's login phase. The intended use of this key is to provide
enhanced logging and support capabilities, and to enable collection
of iSCSI implementation and usage information.
<span class="h3"><a class="selflink" id="section-1.2" href="#section-1.2">1.2</a>. Terminology</span>
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in <a href="./rfc2119">RFC 2119</a> [<a href="#ref-1" title=""Key words for use in RFCs to Indicate Requirement Levels"">1</a>].
<span class="h2"><a class="selflink" id="section-2" href="#section-2">2</a>. Definition</span>
The definition of the key is as follows, conforming to Sections <a href="#section-11">11</a>
and 12 of <a href="./rfc3720">RFC 3720</a> [<a href="#ref-2" title=""Internet Small Computer Systems Interface (iSCSI)"">2</a>], with example list-of-values conforming to
<a href="./rfc3720#section-5.1">Section 5.1 of RFC 3720</a> [<a href="#ref-2" title=""Internet Small Computer Systems Interface (iSCSI)"">2</a>].
The key is defined with a use of "LO", making it a Leading Only key,
and does not modify Sections <a href="#section-11">11</a> or <a href="#section-12">12</a> of <a href="./rfc3720">RFC 3720</a> [<a href="#ref-2" title=""Internet Small Computer Systems Interface (iSCSI)"">2</a>]. Thus, the key
MUST only be sent on the leading connection, MUST NOT be changed
after the leading connection login, and MUST only be sent after the
security negotiation login stage has completed (during operational
negotiation login stage). The key may be sent during normal or
discovery sessions.
<span class="grey">Wysochanski Standards Track [Page 2]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-3" ></span>
<span class="grey"><a href="./rfc4850">RFC 4850</a> iSCSI Node Architecture April 2007</span>
<span class="h3"><a class="selflink" id="section-2.1" href="#section-2.1">2.1</a>. X#NodeArchitecture</span>
Use: LO, Declarative
Senders: Initiator and Target
Scope: SW
X#NodeArchitecture=<list-of-values>
Examples:
X#NodeArchitecture=ExampleOS/v1234,ExampleInc_SW_Initiator/1.05a
X#NodeArchitecture=ExampleInc_HW_Initiator/4010,Firmware/2.0.0.5
X#NodeArchitecture=ExampleInc_SW_Initiator/2.1,CPU_Arch/i686
The initiator or target declares the details of its iSCSI node
architecture to the remote endpoint. These details may include, but
are not limited to, iSCSI vendor software, firmware, or hardware
versions, the OS version, or hardware architecture.
The length of the key value (total length of the list-of-values) MUST
NOT be greater than 255 bytes.
X#NodeArchitecture MUST NOT be redeclared.
<span class="h2"><a class="selflink" id="section-3" href="#section-3">3</a>. Implementation</span>
Functional behavior of the iSCSI node (this includes the iSCSI
protocol logic -- the SCSI, iSCSI, and TCP/IP protocols) MUST NOT
depend on the presence, absence, or content of the key. The key MUST
NOT be used by iSCSI nodes for interoperability, or exclusion of
other nodes. To ensure proper use, key values SHOULD be set by the
node itself, and there SHOULD NOT be provisions for the key values to
contain user-defined text.
Nodes implementing this key MUST choose one of the following
implementation options:
o only transmit the key,
o only log the key values received from other nodes, or
o both transmit and log the key values.
Each node choosing to implement transmission of the key values MUST
be prepared to handle the response of <a href="./rfc3720">RFC 3720</a> [<a href="#ref-2" title=""Internet Small Computer Systems Interface (iSCSI)"">2</a>] compliant nodes
that do not understand the key (<a href="./rfc3720">RFC 3720</a> [<a href="#ref-2" title=""Internet Small Computer Systems Interface (iSCSI)"">2</a>] states that compliant
nodes MUST respond with X#NodeArchitecture=NotUnderstood).
Nodes that implement transmission and/or logging of the key values
may also implement administrative mechanisms that disable and/or
<span class="grey">Wysochanski Standards Track [Page 3]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-4" ></span>
<span class="grey"><a href="./rfc4850">RFC 4850</a> iSCSI Node Architecture April 2007</span>
change the logging and key transmission detail (see Security
Considerations). Thus, a valid behavior for this key may be that a
node is completely silent (the node does not transmit any key value,
and simply discards any key values it receives without issuing a
NotUnderstood response).
<span class="h2"><a class="selflink" id="section-4" href="#section-4">4</a>. Security Considerations</span>
This extension key transmits specific implementation details about
the node that sends it; such details may be considered sensitive in
some environments. For example, if a certain software or firmware
version is known to contain security weaknesses, announcing the
presence of that version via this key may not be desirable. The
countermeasures for this security concern are:
o sending less detailed information in the key values,
o not sending the extension key, or
o using IPsec to provide confidentiality for the iSCSI connection on
which the key is sent (see <a href="./rfc3720">RFC 3720</a> [<a href="#ref-2" title=""Internet Small Computer Systems Interface (iSCSI)"">2</a>] and <a href="./rfc3723">RFC 3723</a> [<a href="#ref-4" title=""Securing Block Storage Protocols over IP"">4</a>]).
To support the first and second countermeasures, all implementations
of this extension key MUST provide an administrative mechanism to
disable sending the key. In addition, all implementations SHOULD
provide an administrative mechanism to configure a verbosity level of
the key value, thereby controlling the amount of information sent.
For example, a lower verbosity might enable transmission of node
architecture component names only, but no version numbers.
The choice of which countermeasure is most appropriate depends on the
environment. However, sending less detailed information in the key
values may be an acceptable countermeasure in many environments,
since it provides a compromise between sending too much information
and the other more complete countermeasures of not sending the key at
all or using IPsec.
In addition to security considerations involving transmission of the
key contents, any logging method(s) used for the key values MUST keep
the information secure from intruders. For all implementations, the
requirements to address this security concern are:
o Display of the log MUST only be possible with administrative
rights to the node.
o Options to disable logging to disk and to keep logs for a fixed
duration SHOULD be provided.
<span class="grey">Wysochanski Standards Track [Page 4]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-5" ></span>
<span class="grey"><a href="./rfc4850">RFC 4850</a> iSCSI Node Architecture April 2007</span>
Finally, it is important to note that different nodes may have
different levels of risk, and these differences may affect the
implementation. The components of risk include assets, threats, and
vulnerabilities. Consider the following example iSCSI nodes, which
demonstrate differences in assets and vulnerabilities of the nodes,
and as a result, differences in implementation:
o One iSCSI target based on a special-purpose operating system.
Since the iSCSI target controls access to the data storage
containing company assets, the asset level is seen as very high.
Also, because of the special-purpose operating system, in which
vulnerabilities are less well-known, the vulnerability level is
viewed as low.
o Multiple iSCSI initiators in a blade farm, each running a general-
purpose operating system. The asset level of each node is viewed
as low, since blades are replaceable and low cost. However, the
vulnerability level is viewed as high, since there are many well-
known vulnerabilities to the general-purpose operating system.
For the above target, an appropriate implementation might be logging
of received key values, but no transmission of the key. For the
initiators, an appropriate implementation might be transmission of
the key, but no logging of received key values.
<span class="h2"><a class="selflink" id="section-5" href="#section-5">5</a>. IANA Considerations</span>
The standards action of this document updates <a href="./rfc3720">RFC 3720</a> to allow any
iSCSI extension item, specifically X# extension text keys, Y# digest
algorithms, and Z# authentication methods, to be defined by a
standards track, experimental, or informational RFC. This document
is a standards track RFC that defines an X# extension text key.
IANA registered this key as follows:
o Key Name: X#NodeArchitecture
o Description: Node architecture details
o Reference: [<a href="./rfc4850">RFC4850</a>]
The update to <a href="./rfc3720">RFC 3720</a> to allow additional types of RFCs for iSCSI
Extension items has the same effect as if the following changes were
made to the text of <a href="./rfc3720">RFC 3720</a> (RFC text cannot be changed after
publication):
<span class="grey">Wysochanski Standards Track [Page 5]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-6" ></span>
<span class="grey"><a href="./rfc4850">RFC 4850</a> iSCSI Node Architecture April 2007</span>
1) In <a href="#section-11.1">Section 11.1</a>, the requirement that Z# Authentication methods
"MUST be described by an informational RFC." is changed to "MUST
be described by a standards track RFC, an experimental RFC, or an
informational RFC."
2) In <a href="#section-12.1">Section 12.1</a>, the requirement that Y# Digest algorithms "MUST
be described by an informational RFC." is changed to "MUST be
described by a standards track RFC, an experimental RFC, or an
informational RFC."
3) In <a href="#section-12.22">Section 12.22</a>, the requirement that X# text keys "MUST be
described by an informational RFC." is changed to "MUST be
described by a standards track RFC, an experimental RFC, or an
informational RFC."
4) In <a href="#section-13.3">Section 13.3</a>, the description of allowed RFC types for
extension items is changed from "The RFC may be informational
rather than Standards-Track," to "The RFC MUST be standards track,
experimental, or informational,"
5) In <a href="#section-13.5.2">Section 13.5.2</a>, the phrase "standards track" is changed to
"standards track or experimental" in the last sentence of the
first paragraph, so that the sentence reads: "If the specification
is a standards track or experimental document, the usual IETF
procedures for such documents are followed."
The registries for iSCSI extension items should be managed as if
these changes had been made to the text of <a href="./rfc3720">RFC 3720</a>.
<span class="h2"><a class="selflink" id="section-6" href="#section-6">6</a>. References</span>
<span class="h3"><a class="selflink" id="section-6.1" href="#section-6.1">6.1</a>. Normative References</span>
[<a id="ref-1">1</a>] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", <a href="https://www.rfc-editor.org/bcp/bcp14">BCP 14</a>, <a href="./rfc2119">RFC 2119</a>, March 1997.
[<a id="ref-2">2</a>] Satran, J., Meth, K., Sapuntzakis, C., Chadalapaka, M., and E.
Zeidner, "Internet Small Computer Systems Interface (iSCSI)",
<a href="./rfc3720">RFC 3720</a>, April 2004.
<span class="grey">Wysochanski Standards Track [Page 6]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-7" ></span>
<span class="grey"><a href="./rfc4850">RFC 4850</a> iSCSI Node Architecture April 2007</span>
<span class="h3"><a class="selflink" id="section-6.2" href="#section-6.2">6.2</a>. Informative References</span>
[<a id="ref-3">3</a>] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L.,
Leach, P., and T. Berners-Lee, "Hypertext Transfer Protocol --
HTTP/1.1", <a href="./rfc2616">RFC 2616</a>, June 1999.
[<a id="ref-4">4</a>] Aboba, B., Tseng, J., Walker, J., Rangan, V., and F. Travostino,
"Securing Block Storage Protocols over IP", <a href="./rfc3723">RFC 3723</a>, April
2004.
<span class="grey">Wysochanski Standards Track [Page 7]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-8" ></span>
<span class="grey"><a href="./rfc4850">RFC 4850</a> iSCSI Node Architecture April 2007</span>
<span class="h2"><a class="selflink" id="appendix-A" href="#appendix-A">Appendix A</a>. Acknowledgments</span>
The IP Storage (ips) Working Group in the Transport Area of IETF has
been responsible for defining the iSCSI protocol (apart from a host
of other relevant IP Storage protocols). The author acknowledges the
contributions of the entire working group.
The following individuals directly contributed to identifying issues
and/or suggesting resolutions to the issues found in this document:
David Black, Mallikarjun Chadalapaka, Paul Koning, Julian Satran,
John Hufferd, Claire Kraft, Ranga Sankar, Joseph Pittman, Greg Berg,
John Forte, Jim Yuill, William Studenmund, and Ken Sandars. This
document benefited from all these contributions.
Finally, the author recognizes Network Appliance, Inc. for
sponsorship and support during the development of this work.
Author's Address
Dave Wysochanski
8311 Brier Creek Parkway
Suite 105-296
Raleigh, NC 27617
US
Phone: +1 919 696 8130
EMail: wysochanski@pobox.com
<span class="grey">Wysochanski Standards Track [Page 8]</span></pre>
<hr class='noprint'/><!--NewPage--><pre class='newpage'><span id="page-9" ></span>
<span class="grey"><a href="./rfc4850">RFC 4850</a> iSCSI Node Architecture April 2007</span>
Full Copyright Statement
Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions
contained in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a>, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND
THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF
THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in <a href="https://www.rfc-editor.org/bcp/bcp78">BCP 78</a> and <a href="https://www.rfc-editor.org/bcp/bcp79">BCP 79</a>.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
<a href="http://www.ietf.org/ipr">http://www.ietf.org/ipr</a>.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is currently provided by the
Internet Society.
Wysochanski Standards Track [Page 9]
</pre>
|
