HOWTO: WPAD

Have Clue - Will Travel

Upcoming Events

Feeds

RSS 2.0 feed

ATOM 1.0 feed

RSS 2.0 Comments

Powered by

Serendipity PHP Weblog

Wednesday, April 9. 2008

Posted by David W. Hankins in Work

Comments (6)
Trackback (1)

WPAD, or Web Proxy AutoDetection, is a protocol that was designed to convey Netscape's PAC format (Proxy Auto Config file) to web browsers automatically - without the user ever having to type a button. It never became an RFC proposed standard, but rather died as an Internet-Draft. I can only wonder what politics led to its demise...but it's full of wonderful hints of terrible flamewars, including the admission that the option code, 252, was 'assigned by the DHC WG chair.' Maybe I need to point out: option codes are never assigned by WG chairs...they are assigned only by IANA after standards action. Meanwhile, 252 is in the "site-local" space - it is not available for allocation! Not by a WG chair, not even by IANA. The site-local options were intended for site administrators (your network's sysadmin) to allocate - not manufacturers.

But its failure to reach RFC did not stop it from becoming the Internet's de facto standard in configuring web proxies. Consequently, whenever your Windows box boots, it tries WPAD to find proxies in order to get Windows Updates...Automatic Updates does this a few minutes after a box reboots. The first thing to do in WPAD is to try DHCP, so you might see Windows boxes try DHCPINFORMs first requesting option 252. They'll try several times until they get 252, and if they never get it, they move on to DNS. They'll query 'wpad.foo.example.com' if foo.example.com were the configured domain name, then 'wpad.example.com', then they give up. They're looking for A records, although the WPAD standard also describes TXT and SRV records (it never tries these). WPAD also describes using SLP after DNS, but I sincerely doubt anyone bothers.

The DNS method is essentially garbage being flooded out on the global Internet. Some older implementations seem to seek right down to 'wpad.'. It seems this is tried in others if no domain name were specified. Your ISP has to deal with wpad.ispname.com being queried all the time, and the rest of the Internet has to cope if the system has some garbled domain name...the query gets passed all the way down to the roots and up.

Edit 2008-08-13: It's also a security problem! Dan Kaminsky has reminded us that it is still, even with all our protections (short of DNSSEC), quite possible to manipulate DNS data. A ne'er do well that creates a cache entry for 'wpad.etc' in front of a horde of WPAD-capable clients can become the man in the middle for all their web content. You can filter for WPAD DNS queries, but it's easier to just make them stop querying for it.

The way to stop all of these clients that implement WPAD from querying DNS at all is to give them a poison pill at DHCP time; or heck configure WPAD at DHCP time and start providing a caching proxy service. I'll show you how to do both below the cut.

In ISC DHCP's dhcpd.conf, enter:

# WPAD definition

option wpad code 252 = text;



# Suppress WPAD activity - no cache, no DNS.

option wpad "\n\000";



# Configure a valid WPAD cache.  The \n is required for Windows.

# All config below this line is optional.

#option wpad "http://www.example.com/wpad.pac\n";



# Special config for Windows ("MSFT 5.0") systems.

# Note this does not catch Windows CE.

class "MSFT" {

        match if substring(option vendor-class-identifier, 0, 4) = "MSFT";



        # They put 252 on the DHCPINFORM's, but not on the DHCPREQUEST's

        # PRL.  So we over-ride the PRL to include 252 = 0xFC, which will also

        # suppress the DHCPINFORMS!

        option dhcp-parameter-request-list =

                                concat(option dhcp-parameter-request-list, fc);

}

Now if you want to use a real cache instead of just poisoning WPAD to keep it from trying DNS, use something like the 'real cache' example in the above config snippet (commented out). Replace www.example.com with your handy web server. You have to configure the server to serve the wpad.pac file, and to set the right MIME type for it.

So on your webserver, first in apache's httpd.conf, enter in a MIME type pairing:

AddType application/x-ns-proxy-autoconfig .pac

Note that it appears x-ns-proxy-autoconfig is a deprecated MIME type for PAC files, but Windows (as of XP) will not digest a PAC file of the 'standard' MIME type.

Then, create a wpad.pac file. I recommend you start simple, see that it works, and then move onwards;

function FindProxyForURL(url, host)

{

  return "PROXY 192.168.0.1:3128 ; DIRECT";

}

Note that this is javascript. You can use any javascript function to do arbitrary things; you can return multiple PROXY lines, or return different PROXY lines for different conditions (a classic example is to distribute queries to an array of caches based on some consistent policy; to improve cache coherence on each cache...all a* names to cache 1, all b* names to cache 2, ...).

Finally, I've found that although 'Microsoft Industry Updater' (automatic updates) will use the above by default, IE out-of-the-box on Windows XP needs to be told to find caches automatically. I don't know if there's another way to coax it into this state of affairs (some vendor-encapsulated option?). It rather defeats the purpose of automatic discovery if it takes manual intervention to enable it tho. If you know of a solution here, please leave a comment.

Edit: It seems something called GPO can be used to push a group policy that sets the 'Detect proxy Automatically' setting in IE.

Trackbacks

Trackback specific URI for this entry

WPAD HowTo update.
It ocurred to me that my WPAD HowTo needs to be updated considering the recent Dan Kaminsky DNS vulnerability. This is one more reason to put out a WPAD poison pill, if you're not using it, in your users best interests.

Weblog: Have Clue - Will Travel
Tracked: Aug 13, 14:52

Comments

Display comments as (Linear | Threaded)

Will this same "\n\000" poisoning trick work in Windows DHCP?

#1 Murray Crane on 2008-08-15 03:24 (Reply)

I don't know how to configure Windows DHCP, but presumably if you can get it to output the same value, it should have the same result.

Of course you could also switch to ISC DHCP and use the contrib/ perl script to create a config file from the Windows' config.

#1.1 David W. Hankins (Homepage) on 2008-08-15 07:43 (Reply)

Hi
I'm novice about WPAD
what I would like to know if there is a function that can tell me if the proxy service is active or not, in practice whether the proxy service is running I will use "PROXY host: port", if not running I will use "DIRECT"
tanks
Luigi

#1.1.1 Luigi Augello on 2011-11-25 09:40 (Reply)

Hm, that would be a bit complicated, but I suppose you could make the WPAD file sent to the user first probe the proxy service. This isn't ideal however, since every web hit becomes two queries, longer delays.

Maybe you could try using lower lease times in DHCP, and have an automated process that delivers a different WPAD configuration depending on the state of the proxy?

#1.1.1.1 David W. Hankins (Homepage) on 2012-01-01 11:01 (Reply)

If I have 2 proxy server on same network how I create WPAD file for user

#2 Chifer on 2008-10-02 03:24 (Reply)

It's really no different from having one proxy on the network. There are two places you can make the decision of which client to send to which proxy. The most straightforward is to make the decision in the WPAD file directly; based on some part of the URL contents, direct half the population to each proxy.

This has the desirable side-effect that the proxies will be "striped" by content - since the proxies will consistently get queries for the same subset of the Internet content you configure them to get, their caches will be coherent within that subset. It helps you double your cache space size rather than copying content between the two caches.

You could also make the same determination at DHCP time by keeping two WPAD files and distributing them to different populations. As a hint, you can make an integer out of the leased-ip-address, and then take the integer modulus of 2 of that integer. Evens go one proxy, odds to the other.

#2.1 David W. Hankins (Homepage) on 2012-01-01 11:07 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Enclosing asterisks marks text as bold (word), underscore are made via _word_. E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above:
	Remember Information? Subscribe to this entry