@@ -19,9 +19,6 @@ which mode OpenVPN is configured as.

   When using ``--auth-nocache`` in combination with a user/password file

   and ``--chroot`` or ``--daemon``, make sure to use an absolute path.

-  This directive does not affect the ``--http-proxy`` username/password.

-  It is always cached.

-

 --cd dir

   Change directory to ``dir`` prior to reading any files such as

   configuration files, key files, scripts, etc. ``dir`` should be an

@@ -691,6 +691,8 @@ init_proxy_dowork(struct context *c)

     if (c->options.ce.http_proxy_options)

     {

+        c->options.ce.http_proxy_options->first_time = c->first_time;

+

         /* Possible HTTP proxy user/pass input */

         c->c1.http_proxy = http_proxy_new(c->options.ce.http_proxy_options);

         if (c->c1.http_proxy)

@@ -1653,6 +1653,7 @@ show_http_proxy_options(const struct http_proxy_options *o)

     SHOW_STR(auth_file);

     SHOW_STR(auth_file_up);

     SHOW_BOOL(inline_creds);

+    SHOW_BOOL(nocache);

     SHOW_STR(http_version);

     SHOW_STR(user_agent);

     for  (i = 0; i < MAX_CUSTOM_HTTP_HEADER && o->custom_headers[i].name; i++)

@@ -3156,6 +3157,11 @@ options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce)

         ce->flags |= CE_DISABLED;

     }

+    if (ce->http_proxy_options)

+    {

+        ce->http_proxy_options->nocache = ssl_get_auth_nocache();

+    }

+

     /* our socks code is not fully IPv6 enabled yet (TCP works, UDP not)

      * so fall back to IPv4-only (trac #1221)

      */

@@ -276,7 +276,7 @@ get_user_pass_http(struct http_proxy_info *p, const bool force)

         {

             auth_file = p->options.auth_file_up;

         }

-        if (p->queried_creds)

+        if (p->queried_creds && !static_proxy_user_pass.nocache)

         {

             flags |= GET_USER_PASS_PREVIOUS_CREDS_FAILED;

         }

@@ -288,9 +288,14 @@ get_user_pass_http(struct http_proxy_info *p, const bool force)

                       auth_file,

                       UP_TYPE_PROXY,

                       flags);

-        p->queried_creds = true;

-        p->up = static_proxy_user_pass;

+        static_proxy_user_pass.nocache = p->options.nocache;

     }

+

+    /*

+     * Using cached credentials

+     */

+    p->queried_creds = true;

+    p->up = static_proxy_user_pass;

 }

 #if 0

@@ -541,7 +546,7 @@ http_proxy_new(const struct http_proxy_options *o)

     /* only basic and NTLM/NTLMv2 authentication supported so far */

     if (p->auth_method == HTTP_AUTH_BASIC || p->auth_method == HTTP_AUTH_NTLM || p->auth_method == HTTP_AUTH_NTLM2)

     {

-        get_user_pass_http(p, true);

+        get_user_pass_http(p, p->options.first_time);

     }

 #if !NTLM

@@ -656,6 +661,11 @@ establish_http_proxy_passthru(struct http_proxy_info *p,

         || p->auth_method == HTTP_AUTH_NTLM)

     {

         get_user_pass_http(p, false);

+

+        if (p->up.nocache)

+        {

+            clear_user_pass_http();

+        }

     }

     /* are we being called again after getting the digest server nonce in the previous transaction? */

@@ -1031,13 +1041,6 @@ establish_http_proxy_passthru(struct http_proxy_info *p,

             }

             goto error;

         }

-

-        /* clear state */

-        if (p->options.auth_retry)

-        {

-            clear_user_pass_http();

-        }

-        store_proxy_authenticate(p, NULL);

     }

     /* check return code, success = 200 */

@@ -57,6 +57,8 @@ struct http_proxy_options {

     const char *user_agent;

     struct http_custom_header custom_headers[MAX_CUSTOM_HTTP_HEADER];

     bool inline_creds; /* auth_file_up is inline credentials */

+    bool first_time; /* indicates if we need to wipe user creds at the first iteration of the main loop */

+    bool nocache;

 };

 struct http_proxy_options_simple {

@@ -499,6 +499,15 @@ ssl_set_auth_nocache(void)

 }

 /*

+ * Get the password caching

+ */

+bool

+ssl_get_auth_nocache(void)

+{

+    return passbuf.nocache;

+}

+

+/*

  * Set an authentication token

  */

 void

@@ -397,6 +397,11 @@ void auth_user_pass_setup(const char *auth_file, bool is_inline,

 void ssl_set_auth_nocache(void);

 /*

+ * Getter method for retrieving the auth-nocache option.

+ */

+bool ssl_get_auth_nocache(void);

+

+/*

  * Purge any stored authentication information, both for key files and tunnel

  * authentication. If PCKS #11 is enabled, purge authentication for that too.

  * Note that auth_token is not cleared.