Content-Type: multipart/alternative;
 boundary=Apple-Mail-548D8907-D65C-4972-9891-8B2738AEB748
Content-Transfer-Encoding: 7bit
From: Bernie Volz <bevolz@gmail.com>
Mime-Version: 1.0 (1.0)
Date: Sun, 6 Jul 2025 18:01:09 -0400
Message-Id: <1125DC3F-16D9-4B5F-91CD-5E1004A44DC8@gmail.com>
References: <18123.1751833872@obiwan.sandelman.ca>
In-Reply-To: <18123.1751833872@obiwan.sandelman.ca>
To: Michael Richardson <mcr+ietf@sandelman.ca>
Message-ID-Hash: 65VYKM46JBJMIZLHKKEYUEWJB4UB6PKJ
CC: captive-portals@ietf.org, dhcwg@ietf.org
Precedence: list
Subject: =?utf-8?q?=5BCaptive-portals=5D_Re=3A_=5Bdhcwg=5D_HTTP_Proxy_option?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/captive-portals/oftDR6mRay4AM4qcUb32icR7OFw>


--Apple-Mail-548D8907-D65C-4972-9891-8B2738AEB748
Content-Type: text/plain;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

Michael:

Regarding option 135 =E2=80=A6

See https://www.ietf.org/archive/id/draft-blatherwick-dhc-mitel-site-options=
-usage-00.txt as that=E2=80=99s where this reported usage of the option was =E2=
=80=9Cdocumented=E2=80=9D, but sadly there=E2=80=99s not really any useful i=
nformation.

This likely was reported when we were trying to expand the dhcpv4 option spa=
ce by reclaiming much of the =E2=80=9Ccustom=E2=80=9D space (it used to be 1=
28 and up). We wanted to know what was in use so we could have IANA avoid as=
signing from those in use options unless absolutely necessary.

And, so that option 135 usage is vendor specific.

- Bernie

> On Jul 6, 2025, at 4:31=E2=80=AFPM, Michael Richardson <mcr+ietf@sandelman=
.ca> wrote:
>=20
> =EF=BB=BF
> {resending without typo on captive-portals@ietf.org.  See I looked up the M=
L
> name to be sure, but then fat-fingered it...}
>=20
> https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-paramete=
rs.xhtml#options
> lists option 135, "HTTP Proxy for phone-specific applications"
> but with no reference!
>=20
> What does this option do, and who uses it?
>=20
> I was looking if there was a way to set an HTTP Proxy, specifically in the=

> context of a captive-portal network that wanted to quarantine untrustworth=
y
> hosts, but also wanted to allow them to reach out to a firmware update ser=
ver
> in order to get patched back to trustworthiness.
>=20
> Going through an HTTP proxy allows the captive-portal/quarantine system to=

> see what end-system is being asked for.  In the case of HTTP, the content
> might even be cached, which is useful in avoiding a (bandwidth) DoS.
> While most updates would be HTTPS now, using CONNECT still shows the URL.
>=20
> {The infrastructure, once it figured out that the host was trustworthy, wo=
uld
> disconnect the client device, and when it reconnected, it would be put on a=

> real network.  Or, the user might ask for an exception via the portal inte=
rface}
>=20
> My conclusion is that no such DHCP option was ever practical/common.
>=20
> The Proxy auto-config (PAC) is javascript, which is not so widely useful, a=
nd
> not very secure.   There is the Web Proxy Auto-Discovery Protocol (WPAD),
> which claims to be available via DHCP option, but I don't think any DHCP
> option was ever recorded by IANA... it seems it's "site-local" option 252
> according to: https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Proto=
col
>=20
> --
> Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 I=C3=B8T consult=
ing )
>           Sandelman Software Works Inc, Ottawa and Worldwide
>=20
>=20
>=20
>=20
> _______________________________________________
> dhcwg mailing list -- dhcwg@ietf.org
> To unsubscribe send an email to dhcwg-leave@ietf.org
> <signature.asc>

--Apple-Mail-548D8907-D65C-4972-9891-8B2738AEB748
Content-Type: text/html;
	charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D=
utf-8"></head><body dir=3D"auto">Michael:<div><br></div><div>Regarding optio=
n 135 =E2=80=A6<br><div><br></div><div>See&nbsp;<a href=3D"https://www.ietf.=
org/archive/id/draft-blatherwick-dhc-mitel-site-options-usage-00.txt">https:=
//www.ietf.org/archive/id/draft-blatherwick-dhc-mitel-site-options-usage-00.=
txt</a>&nbsp;as that=E2=80=99s where this reported usage of the option was =E2=
=80=9Cdocumented=E2=80=9D, but sadly there=E2=80=99s not really any useful i=
nformation.</div><div><br></div><div>This likely was reported when we were t=
rying to expand the dhcpv4 option space by reclaiming much of the =E2=80=9Cc=
ustom=E2=80=9D space (it used to be 128 and up). We wanted to know what was i=
n use so we could have IANA avoid assigning from those in use options unless=
 absolutely necessary.</div><div><br></div><div>And, so that option 135 usag=
e is vendor specific.</div><div><br></div><div><div><div dir=3D"ltr">- Berni=
e</div><div dir=3D"ltr"><br><blockquote type=3D"cite">On Jul 6, 2025, at 4:3=
1=E2=80=AFPM, Michael Richardson &lt;mcr+ietf@sandelman.ca&gt; wrote:<br><br=
></blockquote></div><blockquote type=3D"cite"><div dir=3D"ltr">=EF=BB=BF<spa=
n></span><br><span>{resending without typo on captive-portals@ietf.org. &nbs=
p;See I looked up the ML</span><br><span>name to be sure, but then fat-finge=
red it...}</span><br><span></span><br><span>https://www.iana.org/assignments=
/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml#options</span><br><span>l=
ists option 135, "HTTP Proxy for phone-specific applications"</span><br><spa=
n>but with no reference!</span><br><span></span><br><span>What does this opt=
ion do, and who uses it?</span><br><span></span><br><span>I was looking if t=
here was a way to set an HTTP Proxy, specifically in the</span><br><span>con=
text of a captive-portal network that wanted to quarantine untrustworthy</sp=
an><br><span>hosts, but also wanted to allow them to reach out to a firmware=
 update server</span><br><span>in order to get patched back to trustworthine=
ss.</span><br><span></span><br><span>Going through an HTTP proxy allows the c=
aptive-portal/quarantine system to</span><br><span>see what end-system is be=
ing asked for. &nbsp;In the case of HTTP, the content</span><br><span>might e=
ven be cached, which is useful in avoiding a (bandwidth) DoS.</span><br><spa=
n>While most updates would be HTTPS now, using CONNECT still shows the URL.<=
/span><br><span></span><br><span>{The infrastructure, once it figured out th=
at the host was trustworthy, would</span><br><span>disconnect the client dev=
ice, and when it reconnected, it would be put on a</span><br><span>real netw=
ork. &nbsp;Or, the user might ask for an exception via the portal interface}=
</span><br><span></span><br><span>My conclusion is that no such DHCP option w=
as ever practical/common.</span><br><span></span><br><span>The Proxy auto-co=
nfig (PAC) is javascript, which is not so widely useful, and</span><br><span=
>not very secure. &nbsp;&nbsp;There is the Web Proxy Auto-Discovery Protocol=
 (WPAD),</span><br><span>which claims to be available via DHCP option, but I=
 don't think any DHCP</span><br><span>option was ever recorded by IANA... it=
 seems it's "site-local" option 252</span><br><span>according to: https://en=
.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol</span><br><span></span=
><br><span>--</span><br><span>Michael Richardson &lt;mcr+IETF@sandelman.ca&g=
t; &nbsp;&nbsp;. o O ( IPv6 I=C3=B8T consulting )</span><br><span> &nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Sandelman Software Works I=
nc, Ottawa and Worldwide</span><br><span></span><br><span></span><br><span><=
/span><br><span></span><br><span>___________________________________________=
____</span><br><span>dhcwg mailing list -- dhcwg@ietf.org</span><br><span>To=
 unsubscribe send an email to dhcwg-leave@ietf.org</span><br><div>&lt;signat=
ure.asc&gt;</div></div></blockquote></div></div></div></body></html>=

--Apple-Mail-548D8907-D65C-4972-9891-8B2738AEB748--