Sign in Subscribe
By Ryan Ulrick in javascript —

Understanding PAC Files: An Introduction to Dynamic Proxy Configuration - Part 1 of 4

Welcome to this comprehensive multi-part blog series on Proxy Auto-Configuration (PAC) files! In this series, we will delve into the world of PAC files and explore their role in shaping web browsing experiences. Whether you're a curious learner or an aspiring network administrator, this series aims to equip you with the knowledge and understanding necessary to harness the power of PAC files effectively. In this inaugural post, we will lay the foundation by introducing PAC files and their significance in configuring proxy settings for web browsers. We'll explore the basic syntax, structure, and purpose of PAC files, paving the way for deeper exploration in the upcoming posts.

PAC files, although considered an older technology, remain widely used in the majority of organizations today. Introduced in the mid-1990s, PAC files (Proxy Auto-Configuration) are a mechanism for automatically configuring proxy settings in web browsers. Typically, a PAC file is hosted on a web server, and organizations configure their users' browsers to analyze this file by specifying its URL. The browser then uses the instructions within the PAC file to make dynamic traffic forwarding decisions based on various factors.

Now, let’s dive a little deeper. The primary purpose of PAC files is to provide a flexible and dynamic means of configuring proxy settings for web browsers based on specific conditions. For instance, let's consider a scenario where an organization has multiple proxy servers catering to different network segments or geographical locations. In this case, an administrator may host different PAC files at different locations across their enterprise to ensure that a user’s browser is adopting the proxy settings appropriate for that location.

📘
For more information on what a Proxy Server is and how it is used within an Enterprise, check out this post: Demystifying Proxy Servers: How They Direct and Secure Your Web Traffic

For example, let’s assume an organization has two supernets assigned across their network architecture; 10.0.0.0/16 for users within the United States and 10.1.0.0/16 for users in Europe. In an instance such as this an administrator may host their US based PAC file at http://synically-ackward.com/proxy/united-states.pac and their European PAC file at http://synically-ackward.com/proxy/europe.pac. For the purposes of this example I’ve included the content of each file below:

function FindProxyForURL(url, host) {
  // Proxy configuration for Location A
  if (isInNet(myIpAddress(), "10.0.0.0", "255.255.0.0")) {
    return "PROXY proxy-server-location-a:8080";
  }

  // Fallback option for other locations
  return "DIRECT";
}


function FindProxyForURL(url, host) {
  // Proxy configuration for Location B
  if (isInNet(myIpAddress(), "10.1.0.0", "255.255.0.0")) {
    return "PROXY proxy-server-location-b:8080";
  }

  // Fallback option for other locations
  return "DIRECT";
}

In these example PAC files, when a user based in the United States accesses a website while connected to the corporate network, their browser evaluates the isInNet() function. If the function returns true, indicating that the user is connected to a network within the IP address range of 10.0.0.0/16, the browser forwards the web traffic to the proxy server specified in the return clause of the PAC file. However, if the isInNet() function returns false, meaning the user's IP address is not within the specified range, the browser will directly route the traffic through the local connection without involving a proxy server.

Now that we have gained a comprehensive understanding of PAC files and their purpose, let's dive deeper into the Proxy Auto-Configuration (PAC) protocol itself, exploring how it facilitates dynamic web proxy configuration in web browsers.

The PAC protocol serves as an engine that enables web browsers to dynamically configure proxy settings based on specific conditions. The protocol engine acts as a powerful interpreter for PAC files, which are written in JavaScript. The protocol allows web browsers to evaluate the conditions and rules defined in PAC files to determine the appropriate proxy configuration for each network request. By leveraging the PAC protocol, organizations can achieve granular control over web proxy configurations, ensuring optimal performance, enhanced security, and efficient network utilization.

📘
It is worth noting that it is not a requirement for a web browser to support the PAC protocol. While most mainstream browsers such as Mozilla Firefox, Google Chrome, Microsoft Edge & Internet Explorer and Apple’s Safari support the protocol, there may be specialized browsers or applications that do not fully support the protocol.

The PAC protocol is not standardized or governed by a specific development convention; instead, it has evolved as a societally agreed-upon convention for auto proxy configuration since its inception. Despite the lack of standardization, organizations continue to leverage PAC files due to the five primary advantages they offer:

  • Centralized Management: Administrators can host and manage a single PAC file on their organization's web server or use a small set of PAC files to serve multiple geographic locations. This streamlined approach simplifies management as changes to a limited number of files can impact a large number of users.
  • Granular Control: PAC files provide administrators with the ability to define specific rules and conditions, enabling fine-tuning of proxy behavior. This granular control allows organizations to customize proxy configurations based on their unique requirements.
  • Load Balancing: Unlike system proxy settings, PAC files support load balancing by distributing traffic across multiple proxy servers. This feature optimizes resource utilization and ensures efficient handling of web traffic.
  • Scalability: PAC files can seamlessly scale in larger network environments, accommodating complex network architectures, multiple locations, and diverse proxy requirements without significant performance impact.
  • Flexible Policy Enforcement: PAC files empower organizations to enforce web access policies effectively. By directing traffic through appropriate proxies, administrators can implement content filtering, data loss prevention measures, and compliance policies transparently for their users.

By capitalizing on these advantages, organizations can achieve efficient, flexible, and secure web proxy configurations using PAC files.

When it comes to utilizing PAC files, the web browser plays a crucial role in fetching and interpreting the file to determine the appropriate proxy configuration. Upon startup or when network settings change, the browser retrieves the PAC file from the specified URL, fetching the latest version. The browser's built-in engine then parses the content of the PAC file, meticulously evaluating its syntax, conditions, and rules. This programmatic interpretation enables the browser to dynamically configure proxy settings based on specific conditions. Now, let's delve into the structure and syntax of PAC files, unraveling the elements that empower browsers to make intelligent proxy configuration decisions.

📘
As mentioned earlier, PAC files are written in JavaScript, a top-down oriented programming language. As a result, the policies defined in a PAC file are evaluated in the order they appear, following the sequence in which they are written.

In order to start looking at the various components of a PAC file, we’ll be using a new iteration from the files displayed earlier in this post. This will allow us to discuss some of the more dynamic capabilities of PAC files while still evaluating the overall structure. The new PAC file is shown below:

function FindProxyForURL(url, host) {
  // Time-based proxy configuration
  var currentHour = new Date().getHours();
  if (currentHour >= 9 && currentHour < 17) {
    return "PROXY proxy1.example.com:8080";
  } else {
    return "DIRECT";
  }

  // Domain-based proxy configuration
  var blockedDomains = ["blocked-site1.com", "blocked-site2.com"];
  for (var i = 0; i < blockedDomains.length; i++) {
    if (dnsDomainIs(host, blockedDomains[i])) {
      return "PROXY proxy2.example.com:8080";
    }
  }

  // Default proxy configuration
  return "PROXY proxy3.example.com:8080";
}

At its most basic a PAC file must be composed of the primary function FindProxyForURL(url, host) which serves as the programmatic entry point for the proxy configuration logic. A blank canvas for a PAC file would be comprised simply of the function shown below:

function FindProxyForURL(url, host) {
  // Proxy configuration logic goes here
}

The function keyword is used to define the FindProxyForURL() function, and the brackets indicate the boundaries of the function. Within this function, as shown in the snippet above, the logic has access to the variables url and host, which are provided by the web browser when invoking the function. It is conventional for the FindProxyForURL() function to be defined at the end of a PAC file, especially when additional helper functions are present.

As the dynamic nature and complexity of a PAC file evolves, you can introduce helper functions that can be referenced within the primary function. In the example code below, the isBlockedDomain() function serves as a helper function referenced within the FindProxyForURL() function. This separation of functionality allows for better organization and modularization of code, enabling reusable logic and improved maintainability.

The isBlockedDomain() helper function, in this case, checks if the host parameter matches any of the blocked domains listed in the blockedDomains array. It returns a boolean value indicating whether the host is blocked. The FindProxyForURL() function then utilizes the result of isBlockedDomain() to make a proxy configuration decision. If the host is blocked, it returns the proxy server proxy.example.com:8080; otherwise, it returns the directive DIRECT, indicating a direct connection.

By employing helper functions, PAC files can leverage modular and reusable code to handle complex logic and achieve more granular control over proxy configuration based on specific conditions.

// Helper function
function isBlockedDomain(host) {
  var blockedDomains = ["blocked-site1.com", "blocked-site2.com"];
  return blockedDomains.includes(host);
}

// Main function
function FindProxyForURL(url, host) {
  // Proxy configuration logic
  if (isBlockedDomain(host)) {
    return "PROXY proxy.example.com:8080";
  } else {
    return "DIRECT";
  }
}

Beyond the basic FindProxyForURL() function, one of the most critical aspects of any well-defined PAC file is the usage of conditional statements. Referring back to our PAC file example, we can observe that the primary function begins with an if statement. In the given PAC file snippet below, we have three conditional clauses. The first, as indicated by the accompanying comment, represents a time-based proxy configuration.

Within this conditional statement, the PAC file evaluates a variable called currentHour to determine the current hour of the day. If the time falls between 9:00 AM and 5:00 PM (17:00 in 24-hour time), the traffic is directed through the specified proxy server. On the other hand, if the time of day is outside of this window, the traffic bypasses the proxy server and is sent directly.

Here is the example PAC file code for reference:

function FindProxyForURL(url, host) {
  // Time-based proxy configuration
  var currentHour = new Date().getHours();
  if (currentHour >= 9 && currentHour < 17) {
    return "PROXY proxy1.example.com:8080";
  } else {
    return "DIRECT";
  }

  // Domain-based proxy configuration
  var blockedDomains = ["blocked-site1.com", "blocked-site2.com"];
  for (var i = 0; i < blockedDomains.length; i++) {
    if (dnsDomainIs(host, blockedDomains[i])) {
      return "PROXY proxy2.example.com:8080";
    }
  }

  // Default proxy configuration
  return "PROXY proxy3.example.com:8080";
}

By incorporating time-based conditions, PAC files offer the flexibility to route web traffic through proxies during specific time periods, enabling organizations to implement customized proxy configurations based on time-of-day requirements.

The second conditional block in our PAC file involves the evaluation of the blockedDomains variable. This condition iterates through a provided list of domain names and compares them against the host variable, which is supplied by the web browser. If the host variable matches any domain name within the blockedDomains list, the traffic is directed to a different proxy server (in this case, proxy2.example.com:8080) compared to when there is no match. This allows for the implementation of specific proxy configurations based on the presence of blocked domains.

The final conditional block, although not explicitly defined with an if statement like the previous conditions, can be thought of as being preceded by an implied else statement. In other words, if all the preceding conditions are evaluated as false, this condition is executed. In the example PAC file, this results in the traffic being routed to a third distinct proxy server. This allows for a default proxy configuration to be established, ensuring that even when none of the preceding conditions are met, the traffic is still directed through an appropriate proxy server.

In this introductory post, we delved into the world of PAC files, exploring their purpose and the fundamental elements that define their structure. We began by providing an overview of PAC files and their significance in automatically configuring proxy settings for web browsers. We then introduced the PAC protocol, highlighting its role in web proxy configuration and the support it receives from mainstream browsers. Moving on, we examined the basic syntax and structure of a PAC file, discussing the FindProxyForURL()
function, conditional statements, and helper functions. We explored how PAC files utilize conditional logic to make dynamic decisions based on factors like time and domain names. With a focus on the syntax, we emphasized the evaluative nature of the PAC protocol and the sequential processing of functions and conditions. By understanding these key concepts, readers are now equipped with a solid foundation to explore more advanced aspects of PAC files and their usage in subsequent posts.

Ryan works across networking and Zero Trust environments, with a focus on making complex systems easier to reason about in practice.

Subscribe to The Network Guy

Don’t miss out on the latest posts. Sign up now to get access to the library of members-only posts.
[email protected]
Subscribe