From: Michael Richardson <mcr+ietf@sandelman.ca>
To: captive-portals@ietf.org, dhcwg@ietf.org
In-Reply-To: <20250706200653.6C6713898D@tuna.sandelman.ca>
References: <20250706200653.6C6713898D@tuna.sandelman.ca>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
	micalg=pgp-sha512; protocol="application/pgp-signature"
Date: Sun, 06 Jul 2025 16:31:12 -0400
Message-ID: <18123.1751833872@obiwan.sandelman.ca>
Message-ID-Hash: 6DSZBH52IX4DNSFR3Q4TX3NHO35BBCSQ
Precedence: list
Subject: =?utf-8?q?=5BCaptive-portals=5D_HTTP_Proxy_option?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/captive-portals/Oe2inhQ43Hgu-eKeBTM9g3rurTE>

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


{resending without typo on captive-portals@ietf.org.  See I looked up the ML
name to be sure, but then fat-fingered it...}

https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameter=
s.xhtml#options
lists option 135, "HTTP Proxy for phone-specific applications"
but with no reference!

What does this option do, and who uses it?

I was looking if there was a way to set an HTTP Proxy, specifically in the
context of a captive-portal network that wanted to quarantine untrustworthy
hosts, but also wanted to allow them to reach out to a firmware update serv=
er
in order to get patched back to trustworthiness.

Going through an HTTP proxy allows the captive-portal/quarantine system to
see what end-system is being asked for.  In the case of HTTP, the content
might even be cached, which is useful in avoiding a (bandwidth) DoS.
While most updates would be HTTPS now, using CONNECT still shows the URL.

{The infrastructure, once it figured out that the host was trustworthy, wou=
ld
disconnect the client device, and when it reconnected, it would be put on a
real network.  Or, the user might ask for an exception via the portal inter=
face}

My conclusion is that no such DHCP option was ever practical/common.

The Proxy auto-config (PAC) is javascript, which is not so widely useful, a=
nd
not very secure.   There is the Web Proxy Auto-Discovery Protocol (WPAD),
which claims to be available via DHCP option, but I don't think any DHCP
option was ever recorded by IANA... it seems it's "site-local" option 252
according to: https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protoc=
ol

=2D-
Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 I=C3=B8T consulti=
ng )
           Sandelman Software Works Inc, Ottawa and Worldwide





--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQFKBAEBCgA0FiEEbsyLEzg/qUTA43uogItw+93Q3WUFAmhq3RAWHG1jcitpZXRm
QHNhbmRlbG1hbi5jYQAKCRCAi3D73dDdZQQkB/0eZb+KDVR9Z+6FChEcYU1W/gju
sHp7g3DfEhHgcQHCKPGqzBjxCt+2vZWM0UNbjZ8h4+wWy7Cn66YA1ecWMYPwDcD+
/Wp36ih+95b2KSxjri/G4LZD3U95m1L3QO9y+ngflPzNl2W73+BugEqB0SLGpvDe
zL1wgD+sHCMZgJbOl0tOr/z+WOWc2zGNM/myMeut3yHA2Fm+n/n3dbjELhCL5CIm
rqSSeWTTKvKx4ANEdbUDcaq8eyWyX98uvfoqBx6WQAcvZ4sA2zyGsAA5kAqh97hQ
w1yjbCMvZqMdVJp18gBceItrc6ZpWd37nA5LfY9IxEiWEJmnl6rtVe5SuTxW
=UiRr
-----END PGP SIGNATURE-----
--=-=-=--