search

versat / cntlm

Cntlm is an NTLM / NTLM Session Response / NTLMv2 authenticating HTTP proxy intended to help you break free from the chains of Microsoft proprietary world. More info on http://cntlm.sourceforge.net/ website. This version also supports: SSPI (on Windows, NTLM authentication only), Kerberos authentication, IPv6, proxy PAC files.
GNU General Public License v2.0
118 stars 41 forks source link

Fallback to ntlmv2 when kerberos authentication fails #70

Closed fralken closed 2 years ago

fralken commented 2 years ago

Current Kerberos implementation falls back to NTLMv2 authentication but, since NTLMv2 is disabled when Kerberos is chosen, it always fails even if credentials are provided in the configuration file. This PR keeps NTLMv2 enabled (as default) when Kerberos is chosen. I have a scenario when some proxies accept kerberos but one accepts only ntlm.

jschwartzenberg commented 2 years ago

I would suggest creating different PRs for the different features. That way they can be merged one by one and regressions are easier to spot/bisect. Maybe you meant to only have the first commit for this PR?

The pac library replacement is very interesting. I imagine this will let it work on Windows too. (It's not trivial to compile pacparser on Windows.) Also you managed to let pac fully work when cntlm is access through socks? :)

sonarcloud[bot] commented 2 years ago

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot E 1 Security Hotspot
Code Smell A 1 Code Smell

No Coverage information No Coverage information
No Duplication information No Duplication information

fralken commented 2 years ago

Sorry, my mistake I pushed commits in the wrong branch. Now I fixed it. And yes, I completely reimplemented the pac logic, so that it works also for socks and tunnel connections, and not only for http proxy as it was before. Also, I removed the dependency with pacparser by using an embedded javascript engine (duktape). You can have a look in my fork.

jschwartzenberg commented 2 years ago

I completely reimplemented the pac logic, so that it works also for socks and tunnel connections, and not only for http proxy as it was before. Also, I removed the dependency with pacparser by using an embedded javascript engine (duktape).

Amazing work!! That will help a lot of users! Will you open a PR soon? Let me know if you'd like me to test this already.