[Captive-portals] Re: [dhcwg] HTTP Proxy option

[Bernie Volz <[e-mail]>]

Michael:

Regarding option 135 …

See https://www.ietf.org/archive/id/draft-blatherwick-dhc-mitel-site-options-usage-00.txt as that’s where this reported usage of the option was “documented”, but sadly there’s not really any useful information.

This likely was reported when we were trying to expand the dhcpv4 option space by reclaiming much of the “custom” space (it used to be 128 and up). We wanted to know what was in use so we could have IANA avoid assigning from those in use options unless absolutely necessary.

And, so that option 135 usage is vendor specific.

- Bernie

> On Jul 6, 2025, at 4:31 PM, Michael Richardson <[e-mail]> wrote:
> 
> 
> {resending without typo on [e-mail].  See I looked up the ML
> name to be sure, but then fat-fingered it...}
> 
> https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml#options
> lists option 135, "HTTP Proxy for phone-specific applications"
> but with no reference!
> 
> What does this option do, and who uses it?
> 
> I was looking if there was a way to set an HTTP Proxy, specifically in the
> context of a captive-portal network that wanted to quarantine untrustworthy
> hosts, but also wanted to allow them to reach out to a firmware update server
> in order to get patched back to trustworthiness.
> 
> Going through an HTTP proxy allows the captive-portal/quarantine system to
> see what end-system is being asked for.  In the case of HTTP, the content
> might even be cached, which is useful in avoiding a (bandwidth) DoS.
> While most updates would be HTTPS now, using CONNECT still shows the URL.
> 
> {The infrastructure, once it figured out that the host was trustworthy, would
> disconnect the client device, and when it reconnected, it would be put on a
> real network.  Or, the user might ask for an exception via the portal interface}
> 
> My conclusion is that no such DHCP option was ever practical/common.
> 
> The Proxy auto-config (PAC) is javascript, which is not so widely useful, and
> not very secure.   There is the Web Proxy Auto-Discovery Protocol (WPAD),
> which claims to be available via DHCP option, but I don't think any DHCP
> option was ever recorded by IANA... it seems it's "site-local" option 252
> according to: https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol
> 
> --
> Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
>           Sandelman Software Works Inc, Ottawa and Worldwide
> 
> 
> 
> 
> _______________________________________________
> dhcwg mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> <signature.asc>