Linux support for proxy PAC files

Question

My corporate environment is setup with a proxy blocking external internet access and requiring NTLM authentication. Internal addresses will not be routed be the proxy and must be accessed directly.

I am trying to setup a Linux machine in this environment (which is normally exclusively Windows) and have command-line tools that need external internet access. I have found NTLMaps which has worked great for authenticating to the proxy - however the problem now is when I set Linux's HTTP_PROXY environment variable, which many program use to determine the proxy, they always use the proxy server. Instead, I need them to use proxy/DIRECT connections based on the PAC file.

The very, very manual solution is to clear out the HTTP_PROXY environment variable when I want to access the intranet, and fill it in when I want to access the internet - but that's a pain.

Anyone know a way to do this? (Linux global .pac setting, etc...)

Answer 1

Support for proxy autoconfiguration on Windows seems so "seamless" because it's implemented by the WinHTTP client, which is stored in a DLL accessible to all applications with a public API. Many applications use WinHTTP and get proxy-autoconfiguration "for free".

In the Linux world, each application is typically making its own socket calls and using its own implementation of the HTTP protocol. There are HTTP libraries out there, but it's much more likely, as compared to Windows, that applications are going to handle doing HTTP on their own and probably won't have a Javascript interpreter necessary to process a proxy autoconfiguration file.

You might consider running a local proxy server on the Linux machine, specifying itself as the HTTP_PROXY system-wide, and then configuring that local proxy server with the necessary rules to access some sites directly versus using the corporate proxy as a parent.

Squid could do what you want, but it's fairly heavyweight. I just found this interesting tinyproxy project, and it certainly looks promising (allows for selective use of an upstream proxy by domain, very lightweight, etc), but I've never used it personally and know nothing about it. (In theory, one could modify tinyproxy to actually parse the proxy autoconfiguration file. That'd be a really neat trick, though not something I have time to work on...)