Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently participated in a discussion regarding what happens when a client requests a page from a proxy server. I just wanted to make sure that my understanding of this sequence of events was correct in the general case:

  1. User requests site
  2. A DNS request is sent by the client, to its configured DNS server to resolve the destination IP address (this is done first in order to accommodate HTTP requests that are configured to bypass the proxy)
  3. Once the destination IP is received from DNS, and just before the HTTP request is sent, the request is checked against the exception list
  4. If the destination server is not on the exception list, the request is forwarded to the proxy server.
  5. If the destination server is on the exception list, the request is forwarded according to the client machine's routing table.

Any feedback would be most appreciated.

share|improve this question

4 Answers 4

I'm not sure that your DNS part is right. I have seen a machine with no valid DNS servers fetch pages in IE fine using a proxy.

share|improve this answer
    
I know that an ISA Server Web Proxy Client uses the ISA server's DNS to resolve destination addresses, but I'm pretty sure a basic HTTP proxy set in an XP/Win7 machine's Internet Options resolves as stated above... –  orange_aurelius Aug 12 '10 at 15:41
    
...and oops. I just did a test that proved myself wrong, at least in IE. So, I guess my next question would be, how is DNS resolved then for addresses that are in the proxy exception list? Maybe it's time to get out the sniffer. –  orange_aurelius Aug 12 '10 at 15:48

I try in ubuntu 10.04, wine, IE 6.0 and squid 2.7(system have one dns and squid have other dns server)

  1. User send requests to proxy
  2. Squid send DNS request to DNS server
  3. Squid receive DNS answer. If nxdomain or other error, send error page to IE. If name resolve, fetch the page and give it to IE.

IE 6.0 doesn't resolve DNS name.

share|improve this answer

I don't think it is - if you type in the IP and the domain's in the exception list, or the domain, and the IP is in the exception list, it will probably still go via the proxy.

It is possible that a proxy.pac/wpad.dat would enable you to force your way out of this behaviour.

share|improve this answer

Not exactly: it depends on how the client is configured. Let's use IE as the basic example.

If you configure IE with an explicit proxy:

  1. User types an address

  2. The address is checked for string matches against the IE proxy exceptions list

    a. If matching a bypassed entry, DNS is used to resolve the name, and the client connects directly to the target IP address on port 80 (assumed), then sends a request like:

    GET /something.htm HTTP/1.1
    Host: fulldomainame.example.com

    b. If non matching, continue

  3. The client connects to its configured proxy and sends a request of the form:

    GET http://fulldomainname.example.com/something.htm HTTP/1.1

    (this use of the FQDN in the URL is one way you can tell that a client thinks it's talking to a proxy instead of a real web server)

  4. The proxy resolves the name, connects to the target site, etc, etc

In the case of using a WPAD or Autoconfiguration script (such as provided by ISA/TMG when autoconfiguration is enabled), it's different:

When using WPAD/PAC:

  1. User types an address

  2. Client downloads the current copy of the wpad.dat/autoproxy.js file from its configured location

  3. Client looks for the entry point "FindProxyForUrl" in the js file, and executes it

  4. The Autoproxy file processes the hostname and URL. This is a limited function javascript file:

    a. this may include name resolution (IsInNet, DnsResolve)

    b. this may include string matching (ShExpMatch)

    c. this may include counting to a million (i++)

    d. this may include narky alert popup messages if the admin's a jerk (or just funny (or debugging))

  5. The FindProxyForUrl function returns at least one string, or an ordered list of the best proxies to use:

    a. either "DIRECT", in which case the client then needs to resolve the name itself, as per the bypass case above

    b. or "PROXY proxyname:8080" or similar, in which case the client connects to that port on the proxy, tells it to GET the full URL, and the proxy performs name resolution.

There are occasionally glitches, subtleties and unexplained behaviours, but for the most part when things aren't broken in weird and interesting ways, the above is how I've seen it work. If you're interested in the Winsock Proxy Client, that's a different story.

One final note: Once the client has decided to talk to a proxy, there's no way for the proxy to tell it "I don't serve that, you should just go directly to it instead." Once the client decides a particular URL is proxy-served, proxy-death-grip ensues.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.