Subject: [dhcwg] ID on Proxy Server Configuration using DHCP

From: SENTHIL KUMAR BALASUBRAMANIAN <[email-masked]>
Date: Wed, 5 Nov 2003 01:59:17 +0530 (IST)

Herewith, I have attached a new draft on proxy server configuration option for
DHCP. Following is the abstract of this draft

Abstract

   This document defines a new Dynamic Host Configuration Protocol
   (DHCP) option, which can be used to configure the TCP/IP host's
   Proxy Server configuration for standard protocols like HTTP, FTP,
   NNTP, SOCKS, Gopher, SLL and etc. Proxy Server provides controlled
   and efficient access to the Internet by access control mechanism
   for different types of user requests and caching frequently accessed
   information (Web pages and possibly files that might have been
   downloaded using FTP and other protocols).

Please go through the same and give me your comments.
I will submit this draft to the IETF once the queue is opened.

---

From: Robert Elz <[email-masked]>
Date: Wed, 05 Nov 2003 16:47:09 +0700

This is the kind of option that has been needed for ages.

I'd be interested in knowing if it is likely that any clients
(browsers in particular) are likely to support it, or what would
be needed for them to support it - the option will be useless if
it isn't used.

I'll leave the DHCP details for someone more expert in DHCP than I
to comment on - though my impression is that most proxy
configuration is done using a URL format, and I'd wonder if perhaps
the config that is wanted for a proxy shouldn't be a URL, rather
than a binary address & port number.

kre

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: "Barr Hibbs" <[email-masked]>
Date: Wed, 5 Nov 2003 11:31:03 -0800

I think this proposed option and set of sub-options is both unnecessary and
unlikely to be used.  I base my opinion on the existence of three current
DHCP options that are not, to my knowledge, used at all:

	option 72 -- Default World Wide Web (WWW) Server
	option 73 -- Default Finger Server
	option 74 -- Default Internet Relay Chat (IRC) Server

To be sure of my position, I configured two of the most widely used DHCP
servers with option 72 data, then released existing DHCP leases and rebooted
hosts using two different DHCP clients and two different web browsers,
monitoring the data exchange with Ethereal.  Neither client requested option
72 from the server and neither server sent the option without being
requested.  When the web browsers were started, neither one issued a
DHCPINFORM message requesting option 72.

Perhaps someone could come forward with a justification for these three
options?

Of course the DHC Working Group could define a means for configuring a
client with proxy server information, but I fear it would be like options
72, 73, and 74 -- unused.

The key to success is to have DHCP client vendors as well as applications
vendors committed to using the option and sub-options if the DHC Working
Group were to define them.

I also object to this wording, found in section 4 of the draft:

   "More than one Sub Option MAY be specified for the same protocol.
   In that case, the precedence MUST be given in the order in which
   these options were received by the client. The first one received
   shall be given higher priority and so on."

I know of no other DHCP option in which the order of receipt mandates the
priority for use by the client, and I don't think this is a good precedent
to establish without a compelling reason to do so.  Consider the routers
(03) option:

   "The router option specifies a list of IP addresses for routers on the
   client's subnet.  Routers SHOULD be listed in order of preference."

There is only a recommendation ("SHOULD") that a client receiving this
option choose which router to use for subsequent IP messages according to
the order of appearance in the router option.  A client is free to choose
whichever router it wishes for future messages, possibly applying some other
information in making the choice.  I believe this is a very good model to
follow.

"Security Considerations," section 8, contains this statement:

    "The DHCP Options defined here allow an unauthorized DHCP server to
    misdirect a client to access nonexistent/erring Proxy Server due to
    which the connection to the Internet might be denied."

Yes, but every other option presents an opportunity to misconfigure a
client, either unintentionally or maliciously.  The word "unauthorized"
implies that there is such a thing as an "authorized" DHCP server, which is
both incorrect and misleading.

---

From: Senthil Kumar B <[email-masked]>
Date: Tue, 11 Nov 2003 02:35:21 +0530

Robert,

Thanks for your comments. I am not very sure of any clients 
implementing/implemented these options.
This is not just for the browsers. This would be needed for any clients, 
which MUST go through a
proxy for any type of activity. For example, within an  enterprise 
network, if a client lies behind a firewall
and wants to access some resource for which a firewall/proxy access is 
required.

Also, I have seen some application which installs over the net and 
require proxy configuration for proper
access to the external network This is either to provide controlled 
access (in most of the cases, using firewall)
and/or for efficient access using caching and other mechanism.

The client might require a system parameter, which can be used till the 
machine reboots.
Also, the preferred things is to have a modifiable parameter so that any 
change would be in effect immediately.

Is it that Proxy config using an URL format is of the form 
http:/proxy.xxx.yy.com:8080 ?
or any another format. As long as the the server provides a method to 
have a proxy configuration
and it is of easy for the client to configure,  any type of 
configuration is fine.
Please give your comments on this if you have any.

Thanks,
Senthil

---

From: Senthil Kumar B <[email-masked]>
Date: Tue, 11 Nov 2003 02:39:04 +0530

Barr,

Thanks for your comments. Please see my reply inline.

>72, 73, and 74 -- unused.
I have explained the situation (in my earlier reply to  Robert Elz) 
where this proxy config option could be useful.
I do support that there are so many options like (72 to 74) which are 
not actively being used.

>information in making the choice.  I believe this is a very good model to
I agree that it shouldn't be MUST. Should be SHOULD. I didn't intend to 
write MUST here. It was my mistake
and my apologies for the confusion. Thanks a lot for the determinations.

>both incorrect and misleading.
I will update the doc with "interloper" DHCP server instead of  
"unauthorized" DHCP server in section 8.

>____________________________________________
>dhcwg mailing list
>[email-masked]