Dynamic Host Configuration Protocol (DHCP) Option for CableLabs Client Configuration
Extracted elements (28)
Only two provisioning server address type codes are defined (0=FQDN, 1=IPv4), and no additional types are anticipated; therefore IANA is not required to maintain a registry of type codes for this sub-option.
RFC 1510 does not define a backoff/retry mechanism for AS-REQ/AS-REP or AP-REQ/AP-REP exchanges. Sub-options 4 and 5 fill this gap by providing configurable nominal timeout, maximum timeout, and maximum retry parameters to support the PacketCable-defined backoff/retry mechanism.
The CCC option previously used the site-specific option value 177 (0xB1). This legacy value is now deprecated following IANA assignment of option code 122. Implementations migrating from legacy deployments should transition to option code 122.
FQDNs within CCC sub-options MUST be encoded per RFC 1035 section 3.1, including a terminating zero octet. DNS name compression as described in RFC 1035 section 4.1.4 MUST NOT be applied.
IPv4 addresses within CCC sub-options MUST be encoded as 4 binary octets in network byte order (high order byte first). All multi-octet quantities MUST be encoded in network byte order.
Sub-option 3's type octet MUST be set to 1 to indicate an IPv4 address and MUST be set to 0 to indicate an FQDN. The length MUST be 5 for IPv4 addresses.
Sub-option 7 length MUST be 1, and the value byte MUST be either 0 or 1; a value of 1 MUST be interpreted as true and 0 MUST be interpreted as false.
Sub-option 8 (Provisioning Timer) length MUST be 1. A value of 0 means the timer MUST be disabled. If the timer expires before provisioning completes, the MTA should reset and restart provisioning.
The Kerberos Realm name in sub-option 6 MUST be encoded per the domain-style realm name described in RFC 1510, MUST be all capital letters, and MUST conform to the syntax in RFC 1035 section 3.1.
The length octet of sub-option 4 (AS-REQ/AS-REP Backoff and Retry) MUST contain the value 12.
The length octet of sub-option 5 (AP-REQ/AP-REP Backoff and Retry) MUST contain the value 12.
When the total length of a CCC option exceeds 255 octets, the procedure in RFC 3396 MUST be employed to split the option into multiple smaller options.
Client devices (CM and MTA) request the CCC option via DHCP option 55 (Parameter Request List) and identify their device type via option 60 (Vendor Class Identifier). Client devices never populate the CCC option in their own DHCP requests.
Sub-options 1 and 2 are sent only to the CM (Cable Modem) and identify TSP DHCP servers from which an MTA is permitted to accept a DHCP OFFER. Sub-options 3–8 are sent only to the MTA and configure its provisioning and Kerberos authentication parameters.
The CableLabs Client Configuration (CCC) option is DHCP option code 122. It uses a tag-length-value format where the tag is code 122, followed by a length octet (not counting itself or the tag), followed by sub-option content. Both CM and MTA DHCP clients request this option.
IANA has assigned DHCP option code 122 for the CableLabs Client Configuration option. The legacy site-specific option value of 177 (0xB1) is deprecated in favor of the official IANA-assigned code.
IANA is requested to maintain a 'CableLabs Client Configuration Sub-options' number space within the BOOTP-DHCP Parameters Registry. Future sub-option codes (9–255, currently reserved) are to be registered via IETF Consensus per RFC 2434.
Even if server addresses and Kerberos realm name are successfully spoofed, a malicious client device must still present valid certificates to the KDC before being service-enabled. However, the computational overhead of certificate validation could itself present a Denial of Service opportunity.
The CCC option can be used to misdirect network traffic by providing incorrect DHCP server addresses, provisioning server addresses, or Kerberos realm names. This enables Denial of Service attacks via invalid addresses, man-in-the-middle attacks via snooper addresses, and customer theft by a malicious TSP altering the Kerberos realm designation.
Within the PacketCable cable delivery architecture, the CMTS is explicitly configured with permitted DHCP servers and only allows downstream traffic from specific IP addresses/ranges, partially mitigating spoofing of CCC option content.
Sub-option 3 (TSP's Provisioning Server Address) supports two formats indicated by a type byte: type 0 for FQDN (length = n+1, followed by encoded FQDN) and type 1 for IPv4 (length = 5, followed by 4-octet address).
Sub-option 4 (AS-REQ/AS-REP Backoff and Retry) has a fixed length of 12 octets: 4 octets nominal timeout (milliseconds, uint32), 4 octets maximum timeout (seconds, uint32), 4 octets maximum retry count (uint32).
Sub-option 5 (AP-REQ/AP-REP Backoff and Retry) has a fixed length of 12 octets: 4 octets nominal timeout (seconds, uint32), 4 octets maximum timeout (seconds, uint32), 4 octets maximum retry count (uint32). Note the nominal timeout unit is seconds, unlike sub-option 4's milliseconds.
Sub-option 6 (Kerberos Realm Name) encodes a variable-length Kerberos realm name: 1-octet code (6), 1-octet length (n), n octets of encoded realm name.
Sub-option 7 (TGT Utilization) is a 1-octet boolean: code 7, length 1, value 1 (true = use TGT) or 0 (false = do not use TGT) when obtaining a service ticket for PacketCable application servers.
Sub-option 8 (Provisioning Timer) has length 1: code 8, length 1, value 0–255 (minutes). A value of 0 disables the timer.
Sub-options 1 and 2 (TSP's Primary and Secondary DHCP Server Address) encode a single IPv4 address. Length MUST be 4. Format: 1-octet code (1 or 2), 1-octet length (4), 4 octets IPv4 address.
The CCC option wire format is: 1-octet code (122), 1-octet length, followed by N octets of sub-option content. Sub-options are themselves TLV-encoded: 1-octet sub-option code, 1-octet length, followed by sub-option data.