Subject: [dhcwg] configuring SOCKS(v5) via DHCP

From: Michael Richardson <[email-masked]>
Date: Sat, 26 Mar 2022 18:03:12 +0100

As far as I can tell from
  https://www.iana.org/assignments/bootp-dhcp-parameters/bootp-dhcp-parameters.xhtml#options

we never allocated a DHCPv4 option for configuring the location of a SOCKSv5
proxy.  But a few names allocated are sufficiently unclear to me that maybe
they were doing something else.

Or maybe some options point to some other configuration mechanism that can
include a SOCKSv5 server address.

Or maybe it's buried in a vendor option?  If so, which one?

SOCKS is surprisingly still out there in many forms, including that many SSH
implementations provide for forwarding arbitrary connections via a SOCKS
server on a local port.
I'm aware of at least two gc.ca departments whose entire firewall mechanism
is (STILL) based upon it.

RFC1928 did not include a discovery mechanism.

SOCKSv5 is being proposed as a solution to certain IoT challenges, where we'd
like to declare the ACL in terms of DNS names, but the policy enforcement
point, of course, only sees IP addresses, not names.

If there was a way to learn if SOCKS was in use on a particular network, such
as via a DHCPv4 option, then devices could use it on networks where it
existed.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: <[email-masked]>
Date: Mon, 28 Mar 2022 07:06:09 +0000

Hi Michael, 

There is no such an option as far as I know.

We published this spec: https://datatracker.ietf.org/doc/html/draft-boucadair-tcpm-dhc-converter-03 to cover the discovery of a "converter". 

A converter is defined as a function that behaves as follows:  

==
      *  Listen for client sessions;
      *  Receive from a client the address of the final target server;
      *  Setup a session to the final server;
      *  Relay control messages and data between the client and the
         server;
      *  Perform access controls according to local policies.
==

SOCKS falls in that category. See rfc8803#section-3 for some more details. 

If SRVs are supported in your case, name discovery may be checked based on the already registered name. 

Cheers,
Med

> -----Message d'origine-----
> De : dhcwg <[email-masked]> De la part de Michael Richardson
> Envoyé : samedi 26 mars 2022 18:03
> À : [email-masked]
> Objet : [dhcwg] configuring SOCKS(v5) via DHCP
> 
> 
> we never allocated a DHCPv4 option for configuring the location of a
> SOCKSv5 proxy.  But a few names allocated are sufficiently unclear to me
> that maybe they were doing something else.
> 
> Or maybe some options point to some other configuration mechanism that
> can include a SOCKSv5 server address.
> 
> SOCKS is surprisingly still out there in many forms, including that many
> SSH implementations provide for forwarding arbitrary connections via a
> SOCKS server on a local port.
> I'm aware of at least two gc.ca departments whose entire firewall
> mechanism is (STILL) based upon it.
> 
> SOCKSv5 is being proposed as a solution to certain IoT challenges, where
> we'd like to declare the ACL in terms of DNS names, but the policy
> enforcement point, of course, only sees IP addresses, not names.
> 
> If there was a way to learn if SOCKS was in use on a particular network,
> such as via a DHCPv4 option, then devices could use it on networks where
> it existed.
> 
> --
> Michael Richardson <[email-masked]>, Sandelman Software Works  -=
> IPv6 IoT consulting =-
> 
> 

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Michael Richardson <[email-masked]>
Date: Mon, 28 Mar 2022 15:15:31 +0200

> We published this spec:
    > https://datatracker.ietf.org/doc/html/draft-boucadair-tcpm-dhc-converter-03
    > to cover the discovery of a "converter".

Thank you for confirming my investigation.

-- 
]               Never tell me the odds!                 | ipv6 mesh networks [ 
]   Michael Richardson, Sandelman Software Works        | network architect  [ 
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [

---

From: "Ms. Li HUANG" <[email-masked]>
Date: Tue, 29 Mar 2022 07:53:22 +0800

Mar 29 2022 07:40.hk S8

Good Day,

"If there was a way to learn if SOCKS was in use on a particular network,
such as via a DHCPv4 option, then devices could use it on networks where it
existed."

when the switch told from supplier that,  at dual stack, if isp not
allowing an  home.User to enough setting info such how many ip permitted,
public host etc., the home.user even could not do the configuration with
''permission'?!

Meanwhile the set up ipv6 prefix(s) ISP ever but not current using told was
not routing, then if, how the network before's events to be consistently
tracking , who caring them...?

WAN mostly related to sock layer,

since stranger switch appeared at between PCs ---(switch)---gateway---ISP
in 2013 to owning a switch in later 2019 as  PCs -----Switch
-----Gateway-----ISP
              |                       |
              -----(Switch)----

two of mach each, who knowing the events on them....? Ehat sock version
being used at dhcpv4 by when, and dhcpv6 since isp offering enterprise sort
of v6 in  Apt 2014 where ofca.gov.hk never clearly responded on these yet.

Regards
Li HUANG

On Tue, Mar 29, 2022, 05:43 Michael Richardson <[email-masked]>
wrote:

> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dhcwg
>

---

From: "Ms. Li HUANG" <[email-masked]>
Date: Fri, 1 Apr 2022 13:28:13 +0800

Apr. 1st 2022 13:24.hk w10pro.GLF7(7) r.s.m

Good Day,

such

Just tried once only and uninstalled all of the for sock.proxy pay one,
(email enquiry yet back ) not not the Github free one,
maybe detected by the server wherever, such app anit. could not be able to
reach its server to properly complete the installation during the week?!

Regards
[email-masked]

On Tue, Mar 29, 2022 at 7:53 AM Ms. Li HUANG <[email-masked]> wrote:

> it existed."
> Meanwhile the set up ipv6 prefix(s) ISP ever but not current using told
> was not routing, then if, how the network before's events to be
> consistently tracking , who caring them...?
>