syshttp 0.1.0__tar.gz → 0.1.1__tar.gz

{syshttp-0.1.0 → syshttp-0.1.1}/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-11-07
+
+### Added
+
+- `syshttp.negotiate`: Negotiate (SPNEGO) and NTLM authentication for the
+  default transport, so `HTTPClient`, `fetch()` and `HTTPTransport` answer a
+  `401` with `WWW-Authenticate: Negotiate` or `NTLM` and a `407` with
+  `Proxy-Authenticate` (a `CONNECT` the proxy challenges included), leg after
+  leg on the connection the challenge came on, with `Connection: keep-alive`.
+  It is off until `SYSHTTP_NEGOTIATE` (servers) or `SYSHTTP_PROXY_NEGOTIATE`
+  (proxies) names a host (`*.suffix` and `*` allowed), or `Negotiate(hosts,
+  proxies, *, username, password, plain_http, max_legs, max_token, env)` is
+  passed as `negotiate=` to `HTTPClient` or `HTTPTransport`. The identity is the
+  Windows logon session (SSPI) or the Kerberos credential cache, or
+  `SYSHTTP_NEGOTIATE_USER` and `SYSHTTP_NEGOTIATE_PASSWORD`; a password is in no
+  `repr()`, log line or message. A token is not sent over plain http to a host
+  that is not loopback unless `SYSHTTP_NEGOTIATE_PLAIN_HTTP` allows it, which
+  is logged as a weakening; `SYSHTTP_NEGOTIATE_MAX_LEGS` (default 5) and
+  `SYSHTTP_NEGOTIATE_MAX_TOKEN` (default 65536) bound a handshake. A server's
+  closing token is checked where the mechanism has mutual authentication. Skipped
+  for a request that names its own `Authorization`, a proxy with a credential of
+  its own, a body that cannot be sent twice and a gateway.
+- The extras `negotiate` (pyspnego: SSPI on Windows, NTLM in Python) and
+  `kerberos` (pyspnego with `gssapi`, for the credential cache on Linux and
+  macOS). `import syshttp` and a default install load and need neither.
+- `NegotiationError` (a handshake that failed: credentials refused, a token that
+  is not valid or too large, a connection closed or more legs than allowed, a
+  handshake that would cross plain http) and `NegotiateUnavailableError` (also an
+  `ImportError`: the extra is missing or does not import), both under
+  `SysHTTPError` and exported from the root; `has_negotiate()` says whether the
+  library imports.
+
 ## [0.1.0] - 2026-10-20
 
 ### Added
@@ -339,5 +371,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   longer with the userinfo, query and fragment (`user:pass@`,
   `?access_token=`).
 
-[Unreleased]: https://github.com/jose-pr/syshttp/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/jose-pr/syshttp/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/jose-pr/syshttp/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/jose-pr/syshttp/releases/tag/v0.1.0

{syshttp-0.1.0 → syshttp-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: syshttp
-Version: 0.1.0
+Version: 0.1.1
 Summary: HTTP plumbing that follows the system: the system proxy (PAC, WPAD) and the OS certificate verifier by default, proxy credentials and prefix gateways, Netscape cookie jars, OS trust-store TLS, URL hooks, and an HTTP client on the standard library
 Project-URL: Homepage, https://github.com/jose-pr/syshttp
 Project-URL: Documentation, https://jose-pr.github.io/syshttp/
@@ -29,6 +29,7 @@ Requires-Dist: black; extra == 'dev'
 Requires-Dist: build; extra == 'dev'
 Requires-Dist: httpx; extra == 'dev'
 Requires-Dist: mypy<2; extra == 'dev'
+Requires-Dist: pyspnego<0.13,>=0.12.0; extra == 'dev'
 Requires-Dist: pytest; extra == 'dev'
 Requires-Dist: requests; extra == 'dev'
 Requires-Dist: types-requests; extra == 'dev'
@@ -36,6 +37,10 @@ Provides-Extra: docs
 Requires-Dist: mkdocs; extra == 'docs'
 Requires-Dist: mkdocs-material; extra == 'docs'
 Requires-Dist: mkdocstrings[python]; extra == 'docs'
+Provides-Extra: kerberos
+Requires-Dist: pyspnego[kerberos]<0.13,>=0.12.0; extra == 'kerberos'
+Provides-Extra: negotiate
+Requires-Dist: pyspnego<0.13,>=0.12.0; extra == 'negotiate'
 Provides-Extra: pac
 Requires-Dist: proxylib[pac]<3,>=2.0.2; extra == 'pac'
 Description-Content-Type: text/markdown
@@ -101,6 +106,14 @@ it. Documentation: <https://jose-pr.github.io/syshttp/>.
   all of the above, on `http.client` and `ssl` alone. Its transport is
   replaceable: any object with `send()` (a `requests` or `httpx` one, a fake
   in a test), chosen per client or by `SYSHTTP_DEFAULT_TRANSPORT`.
+- **Negotiate and NTLM, for the servers and proxies you name** — a `401` with
+  `WWW-Authenticate: Negotiate` or `NTLM`, and a `407` with `Proxy-Authenticate`
+  (a `CONNECT` included), is answered leg after leg on the connection it came
+  on: SSPI with the current Windows logon, Kerberos from the credential cache
+  where `gssapi` is installed, NTLM with a credential you give. Off until
+  `SYSHTTP_NEGOTIATE` or `SYSHTTP_PROXY_NEGOTIATE` names a host, and never over
+  plain http to a host that is not loopback unless a setting says so
+  (`pip install "syshttp[negotiate]"`).
 - **Other programs' clients, patched on import** — `SYSHTTP_IMPORTPATCH=1`
   (or `requests:urllib:httpx:aiohttp:pip`) makes those libraries route and
   verify the same way in any program of the environment, through
@@ -116,6 +129,8 @@ pip install syshttp
 | Extra | Adds | Needed for |
 | --- | --- | --- |
 | `pac` | a JavaScript engine for proxylib | PAC scripts proxylib evaluates itself (Linux without libproxy) |
+| `negotiate` | pyspnego | Negotiate and NTLM for a server or proxy that challenges: SSPI on Windows, NTLM in Python elsewhere |
+| `kerberos` | pyspnego with `gssapi` | Kerberos from the credential cache on Linux and macOS (builds against the system's Kerberos headers when no wheel exists) |
 
 syshttp depends on proxylib (the system proxy), sslcontext (the system's
 TLS client: the OS verifier through truststore on Python 3.10+, OpenSSL over
@@ -152,6 +167,21 @@ with HTTPClient(cookies=True, tokens=True) as client:
     response = client.request("GET", "https://api.example.com/thing")
 ```
 
+A server or proxy behind Windows-integrated authentication, answered with the
+logon session (nothing is sent unless the host is named; needs
+`pip install "syshttp[negotiate]"`):
+
+```python
+from syshttp.client import HTTPClient
+from syshttp.negotiate import Negotiate
+
+with HTTPClient(negotiate=Negotiate("wiki.corp.example", proxies="proxy.corp.example")) as client:
+    response = client.request("GET", "https://wiki.corp.example/api/page")
+```
+
+The same from the environment, with no code change:
+`SYSHTTP_NEGOTIATE=wiki.corp.example SYSHTTP_PROXY_NEGOTIATE=proxy.corp.example`.
+
 A separate configuration, isolated from the process environment:
 
 ```python
@@ -168,6 +198,7 @@ response = fetch("https://api.example.com/thing", env=env)
 | `syshttp.env` | `HTTPEnv`: the prefixes and mapping every setting is read from |
 | `syshttp.proxy` | `proxy_map()`: the settings as one proxylib proxy map |
 | `syshttp.client` | `HTTPClient` and `fetch()`: the HTTP client, its transport protocol and response |
+| `syshttp.negotiate` | `Negotiate`: which servers and proxies get Negotiate and NTLM, and with whose credentials |
 | `syshttp.jar` | file and memory cookie/token jars |
 | `syshttp.cookies` | Netscape cookie files and curl's cookie rules |
 | `syshttp.hooks` | URL hooks declared in the environment |
@@ -190,6 +221,11 @@ full list is on the docs site:
 | `SYSHTTP_PROXY_AUTH` | the proxy credential, sent verbatim; else `HTTP_PROXY_AUTH` |
 | `SYSHTTP_PROXY_AUTH_HEADER` | the header it is sent in (default `Proxy-Authorization`) |
 | `SYSHTTP_PROXY_TYPE` | `connect` (default) or `prefix[:/endpoint]` |
+| `SYSHTTP_NEGOTIATE` | the servers whose Negotiate or NTLM challenge is answered: host names, `*.suffix`, `*` (default: none) |
+| `SYSHTTP_PROXY_NEGOTIATE` | the same for proxies, by the proxy's host |
+| `SYSHTTP_NEGOTIATE_USER`, `SYSHTTP_NEGOTIATE_PASSWORD` | an explicit identity (a secret) instead of the logon session or credential cache |
+| `SYSHTTP_NEGOTIATE_PLAIN_HTTP` | also authenticate over plain http to a host that is not loopback (off; logged as a weakening) |
+| `SYSHTTP_NEGOTIATE_MAX_LEGS`, `SYSHTTP_NEGOTIATE_MAX_TOKEN` | the limits of one handshake (5 requests, 65536 bytes a token) |
 | `SYSHTTP_HOME` | the jar directory (default: the per-user state directory) |
 | `SYSHTTP_IMPORTPATCH` | `1`, or `:`-separated names: the client libraries patched on import |
 | `SYSHTTP_HOOKS_<KEY>` | a URL hook's pattern, with `_PY` / `_CURL` targets |

{syshttp-0.1.0 → syshttp-0.1.1}/README.md

@@ -59,6 +59,14 @@ it. Documentation: <https://jose-pr.github.io/syshttp/>.
   all of the above, on `http.client` and `ssl` alone. Its transport is
   replaceable: any object with `send()` (a `requests` or `httpx` one, a fake
   in a test), chosen per client or by `SYSHTTP_DEFAULT_TRANSPORT`.
+- **Negotiate and NTLM, for the servers and proxies you name** — a `401` with
+  `WWW-Authenticate: Negotiate` or `NTLM`, and a `407` with `Proxy-Authenticate`
+  (a `CONNECT` included), is answered leg after leg on the connection it came
+  on: SSPI with the current Windows logon, Kerberos from the credential cache
+  where `gssapi` is installed, NTLM with a credential you give. Off until
+  `SYSHTTP_NEGOTIATE` or `SYSHTTP_PROXY_NEGOTIATE` names a host, and never over
+  plain http to a host that is not loopback unless a setting says so
+  (`pip install "syshttp[negotiate]"`).
 - **Other programs' clients, patched on import** — `SYSHTTP_IMPORTPATCH=1`
   (or `requests:urllib:httpx:aiohttp:pip`) makes those libraries route and
   verify the same way in any program of the environment, through
@@ -74,6 +82,8 @@ pip install syshttp
 | Extra | Adds | Needed for |
 | --- | --- | --- |
 | `pac` | a JavaScript engine for proxylib | PAC scripts proxylib evaluates itself (Linux without libproxy) |
+| `negotiate` | pyspnego | Negotiate and NTLM for a server or proxy that challenges: SSPI on Windows, NTLM in Python elsewhere |
+| `kerberos` | pyspnego with `gssapi` | Kerberos from the credential cache on Linux and macOS (builds against the system's Kerberos headers when no wheel exists) |
 
 syshttp depends on proxylib (the system proxy), sslcontext (the system's
 TLS client: the OS verifier through truststore on Python 3.10+, OpenSSL over
@@ -110,6 +120,21 @@ with HTTPClient(cookies=True, tokens=True) as client:
     response = client.request("GET", "https://api.example.com/thing")
 ```
 
+A server or proxy behind Windows-integrated authentication, answered with the
+logon session (nothing is sent unless the host is named; needs
+`pip install "syshttp[negotiate]"`):
+
+```python
+from syshttp.client import HTTPClient
+from syshttp.negotiate import Negotiate
+
+with HTTPClient(negotiate=Negotiate("wiki.corp.example", proxies="proxy.corp.example")) as client:
+    response = client.request("GET", "https://wiki.corp.example/api/page")
+```
+
+The same from the environment, with no code change:
+`SYSHTTP_NEGOTIATE=wiki.corp.example SYSHTTP_PROXY_NEGOTIATE=proxy.corp.example`.
+
 A separate configuration, isolated from the process environment:
 
 ```python
@@ -126,6 +151,7 @@ response = fetch("https://api.example.com/thing", env=env)
 | `syshttp.env` | `HTTPEnv`: the prefixes and mapping every setting is read from |
 | `syshttp.proxy` | `proxy_map()`: the settings as one proxylib proxy map |
 | `syshttp.client` | `HTTPClient` and `fetch()`: the HTTP client, its transport protocol and response |
+| `syshttp.negotiate` | `Negotiate`: which servers and proxies get Negotiate and NTLM, and with whose credentials |
 | `syshttp.jar` | file and memory cookie/token jars |
 | `syshttp.cookies` | Netscape cookie files and curl's cookie rules |
 | `syshttp.hooks` | URL hooks declared in the environment |
@@ -148,6 +174,11 @@ full list is on the docs site:
 | `SYSHTTP_PROXY_AUTH` | the proxy credential, sent verbatim; else `HTTP_PROXY_AUTH` |
 | `SYSHTTP_PROXY_AUTH_HEADER` | the header it is sent in (default `Proxy-Authorization`) |
 | `SYSHTTP_PROXY_TYPE` | `connect` (default) or `prefix[:/endpoint]` |
+| `SYSHTTP_NEGOTIATE` | the servers whose Negotiate or NTLM challenge is answered: host names, `*.suffix`, `*` (default: none) |
+| `SYSHTTP_PROXY_NEGOTIATE` | the same for proxies, by the proxy's host |
+| `SYSHTTP_NEGOTIATE_USER`, `SYSHTTP_NEGOTIATE_PASSWORD` | an explicit identity (a secret) instead of the logon session or credential cache |
+| `SYSHTTP_NEGOTIATE_PLAIN_HTTP` | also authenticate over plain http to a host that is not loopback (off; logged as a weakening) |
+| `SYSHTTP_NEGOTIATE_MAX_LEGS`, `SYSHTTP_NEGOTIATE_MAX_TOKEN` | the limits of one handshake (5 requests, 65536 bytes a token) |
 | `SYSHTTP_HOME` | the jar directory (default: the per-user state directory) |
 | `SYSHTTP_IMPORTPATCH` | `1`, or `:`-separated names: the client libraries patched on import |
 | `SYSHTTP_HOOKS_<KEY>` | a URL hook's pattern, with `_PY` / `_CURL` targets |

syshttp-0.1.1/docs/api/negotiate.md

@@ -0,0 +1,3 @@
+# `syshttp.negotiate`
+
+::: syshttp.negotiate

{syshttp-0.1.0 → syshttp-0.1.1}/docs/index.md

@@ -15,7 +15,7 @@ response = fetch("https://example.com/", cookies=True, tokens=True)
 print(response.status, response.headers["Content-Type"])
 ```
 
-- [Settings](settings.md): the variables, their prefix, and `HTTPEnv`.
+- [Settings](settings.md): the variables, their prefix, `HTTPEnv`, and Negotiate and NTLM.
 - API reference: one page per module, in the navigation.
 - [Changelog](changelog.md).
 

{syshttp-0.1.0 → syshttp-0.1.1}/docs/settings.md

@@ -17,6 +17,12 @@ read when they are needed, never at import.
 | `SYSHTTP_PROXY_AUTH` | `SYSHTTP_PROXY`'s credential, a header value sent verbatim to it only (a secret) | the URL's userinfo as Basic |
 | `SYSHTTP_PROXY_AUTH_HEADER` | the header `SYSHTTP_PROXY_AUTH` rides in | `Proxy-Authorization` |
 | `SYSHTTP_PROXY_TYPE` | `connect`, or `prefix[:/endpoint]` for a URL-prefix gateway | `connect` |
+| `SYSHTTP_NEGOTIATE` | the servers whose `Negotiate` or `NTLM` challenge is answered: a comma list of host names, `*.suffix` for a domain, `*` for all; needs the `negotiate` extra | none |
+| `SYSHTTP_PROXY_NEGOTIATE` | the same for proxies, by the proxy's host | none |
+| `SYSHTTP_NEGOTIATE_USER`, `SYSHTTP_NEGOTIATE_PASSWORD` | an explicit identity (`DOMAIN\user` or `user@REALM`) for every allowed host; both or neither; the password is a secret | the logon session (SSPI) or the Kerberos credential cache |
+| `SYSHTTP_NEGOTIATE_PLAIN_HTTP` | whether to authenticate over plain http to a host that is not loopback (boolean); each such host is logged as a weakening | off |
+| `SYSHTTP_NEGOTIATE_MAX_LEGS` | most authenticated requests of one handshake | 5 |
+| `SYSHTTP_NEGOTIATE_MAX_TOKEN` | most bytes of one token, sent or received | 65536 |
 | `SYSHTTP_HOME` | the directory of the cookie and token jars | the per-user state directory |
 | `SYSHTTP_COOKIE_HOSTS` | groups of hosts that share cookies: hosts split by `,`, groups by `;` | none |
 | `SYSHTTP_IMPORTPATCH` | client libraries patched as they are imported to use the system proxy and TLS: `1` for all, or `:`-separated names from `requests`, `urllib`, `httpx`, `aiohttp`, `pip` | none |
@@ -96,6 +102,54 @@ does not send an `https:` origin through a plain `prefix+http` gateway, whose
 hop would carry that origin's tokens and Secure cookies in clear text: use an
 `https` gateway.
 
+## Negotiate and NTLM
+
+A server that answers `401` with `WWW-Authenticate: Negotiate` or `NTLM`, and a
+proxy that answers `407` with `Proxy-Authenticate` (to a `CONNECT` as well), is
+answered by `syshttp.client` only for the hosts the settings name, and only
+with the `negotiate` extra installed:
+
+```sh
+pip install "syshttp[negotiate]"
+SYSHTTP_NEGOTIATE="wiki.corp.example,*.apps.corp.example"
+SYSHTTP_PROXY_NEGOTIATE="proxy.corp.example"
+```
+
+A pattern is a host name, `*.suffix` for every host below a domain (not the
+domain itself), or `*`. With neither variable set the library never sends a
+token and a `401` or `407` is the reply, as for any other client.
+
+- **Whose identity.** With no `SYSHTTP_NEGOTIATE_USER` and
+  `SYSHTTP_NEGOTIATE_PASSWORD`, the logon session on Windows (SSPI) and the
+  Kerberos credential cache on Linux and macOS (the `kerberos` extra adds
+  `gssapi`; without it pyspnego's own NTLM needs the explicit identity). With
+  them, that one identity for every host the lists name. A password is a secret:
+  it appears in no `repr()`, log line or message, and belongs in the
+  environment or a secret store, never on a command line.
+- **The exchange.** Each leg is the same request again with a token, on the
+  connection the challenge came on and with `Connection: keep-alive`, since
+  NTLM binds the identity to the connection. The request is not answered when
+  it names an `Authorization` (a `Proxy-Authorization` for a proxy), when the
+  proxy has a credential of its own, when its body cannot be sent twice, and for
+  a prefix gateway. The server's closing token is checked where the mechanism
+  has one (Kerberos); NTLM has none.
+- **Plain http.** A token crossing plain http is not tried for a host that is
+  not loopback, and the request fails with `NegotiationError` naming
+  `SYSHTTP_NEGOTIATE_PLAIN_HTTP`. Setting it to `1` allows it, and each such
+  host is logged once as `weakened` under the `syshttp.client` logger. An
+  `https:` server is judged by its own scheme; a proxy by the proxy URL's.
+- **Limits and failures.** `SYSHTTP_NEGOTIATE_MAX_LEGS` bounds the
+  authenticated requests of one handshake (NTLM takes two) and
+  `SYSHTTP_NEGOTIATE_MAX_TOKEN` a token in either direction. Refused
+  credentials, a token that is not valid, a closed connection, a limit and a
+  failure of the library raise `NegotiationError`, once: nothing is sent again.
+  The extra missing raises `NegotiateUnavailableError`, which is also an
+  `ImportError`, only for a host the settings name.
+
+In code, `HTTPClient(negotiate=Negotiate(...))` (or `HTTPTransport(negotiate=...)`)
+takes the same settings as arguments, which win over the variables; the
+[`syshttp.negotiate` reference](api/negotiate.md) lists them.
+
 ## The default transport
 
 An `HTTPClient` (and so `fetch()`) built without a `transport=` sends through

{syshttp-0.1.0 → syshttp-0.1.1}/mkdocs.yml

@@ -33,6 +33,7 @@ nav:
       - env: api/env.md
       - proxy: api/proxy.md
       - client: api/client.md
+      - negotiate: api/negotiate.md
       - jar: api/jar.md
       - cookies: api/cookies.md
       - hooks: api/hooks.md

{syshttp-0.1.0 → syshttp-0.1.1}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "syshttp"
-version = "0.1.0"
+version = "0.1.1"
 authors = [{ name = "jose-pr", email = "jose-pr@coqui.dev" }]
 description = "HTTP plumbing that follows the system: the system proxy (PAC, WPAD) and the OS certificate verifier by default, proxy credentials and prefix gateways, Netscape cookie jars, OS trust-store TLS, URL hooks, and an HTTP client on the standard library"
 readme = "README.md"
@@ -51,9 +51,17 @@ aiohttp = "syshttp.autopatch"
 # A JavaScript engine for PAC scripts proxylib evaluates itself (Linux without
 # libproxy); Windows and macOS evaluate PAC in the OS.
 pac = ["proxylib[pac]>=2.0.2,<3"]
+# Negotiate and NTLM authentication (syshttp.negotiate): SSPI on Windows with the
+# logon session, GSSAPI where `gssapi` is installed (the `kerberos` extra), and
+# NTLM in Python elsewhere.
+negotiate = ["pyspnego>=0.12.0,<0.13"]
+# Kerberos from the credential cache on Linux and macOS: pyspnego's GSSAPI
+# support, which builds against the system's Kerberos headers (krb5-devel,
+# libkrb5-dev) when no wheel exists.
+kerberos = ["pyspnego[kerberos]>=0.12.0,<0.13"]
 # requests, httpx and aiohttp are what syshttp.autopatch patches: the tests
 # use them. syshttp's own client needs none of them.
-dev = ["requests", "httpx", "aiohttp", "build", "pytest", "black", "mypy<2", "types-requests"]
+dev = ["requests", "httpx", "aiohttp", "build", "pytest", "black", "mypy<2", "types-requests", "syshttp[negotiate]"]
 docs = ["mkdocs", "mkdocs-material", "mkdocstrings[python]"]
 
 [project.urls]
@@ -80,6 +88,12 @@ line-length = 120
 [tool.pytest.ini_options]
 pythonpath = ["src"]
 testpaths = ["tests"]
-# Warnings are errors. An exception would be listed here as narrowly as the
-# warning's own text, with the reason it is tolerated; there are none.
-filterwarnings = ["error"]
+# Warnings are errors. An exception is listed here as narrowly as the warning's
+# own text, with the reason it is tolerated.
+filterwarnings = [
+    "error",
+    # cryptography, the cipher library of pyspnego, says so at import when its
+    # OpenSSL has no legacy provider (a Windows ARM64 Python ships none). NTLM
+    # needs RC4, which lives there: the tests that need it probe for it and skip.
+    "ignore:OpenSSL 3's legacy provider failed to load:Warning",
+]

{syshttp-0.1.0 → syshttp-0.1.1}/src/syshttp/AGENTS.md

@@ -7,7 +7,7 @@ self-contained. Development documentation lives with the source at
 <https://github.com/jose-pr/syshttp>.
 
 Import names from their modules: `syshttp.env`, `syshttp.proxy`,
-`syshttp.client`, `syshttp.jar`, `syshttp.cookies`, `syshttp.hooks`,
+`syshttp.client`, `syshttp.negotiate`, `syshttp.jar`, `syshttp.cookies`, `syshttp.hooks`,
 `syshttp.tls`, `syshttp.retry`, `syshttp.auth`, `syshttp.exceptions`,
 `syshttp.autopatch`. Each declares `__all__`: a name outside it is not API,
 and a module whose name starts with `_` is private. The root re-exports
@@ -19,9 +19,11 @@ module.
 `pip install syshttp` brings proxylib 2.0.2+ (proxy routing and the system's proxy configuration),
 sslcontext (the system's TLS client; truststore on Python 3.10+) and
 importpatch (import-time patching of other HTTP clients, off unless
-`SYSHTTP_IMPORTPATCH` asks for it). The extra `pac`
+`SYSHTTP_IMPORTPATCH` asks for it). The extras: `pac`
 adds a JavaScript engine for PAC scripts proxylib evaluates itself (Linux
-without libproxy). The client needs nothing else: `requests` is no dependency
+without libproxy); `negotiate` adds pyspnego for Negotiate and NTLM
+(`syshttp.negotiate`); `kerberos` adds `gssapi` to it for the Kerberos
+credential cache on Linux and macOS. The client needs nothing else: `requests` is no dependency
 of any feature; only `syshttp.autopatch` touches it, in a program that imports
 it, when `SYSHTTP_IMPORTPATCH` asks for it.
 
@@ -175,7 +177,8 @@ class HTTPClient:
                  cookies: bool | str | CookieJar | None = False, tokens: bool | str | TokenJar | None = False,
                  auth_provider: AuthProvider | None = None, retries: int = 3, backoff: float = 1,
                  status_forcelist: Iterable[int] = TRANSIENT_STATUSES,
-                 cookie_hosts: Iterable[Iterable[str]] | None = None)
+                 cookie_hosts: Iterable[Iterable[str]] | None = None,
+                 negotiate: Negotiate | None = None)
     transport                                   # the transport in use
     def request(self, method, url, *, data=None, headers=None, stream=False, allow_redirects=None,
                 timeout=..., deadline=..., auth=None) -> HTTPResponse
@@ -319,6 +322,11 @@ DEFAULT_TRANSPORT = "SYSHTTP_DEFAULT_TRANSPORT"      # setting names
   is used instead of sending. A request a provider or a hook makes through the
   client runs neither again; the guard is per thread, so another thread's
   requests still run them.
+- **Negotiate and NTLM.** `negotiate=` (a `syshttp.negotiate.Negotiate`, see
+  its section) configures the default transport as `proxymap` does: a transport
+  of your own, or `SYSHTTP_DEFAULT_TRANSPORT`, beside it is refused. Without
+  it the transport reads `SYSHTTP_NEGOTIATE` and its kin, which name no host by
+  default.
 - **Retries.** A status in `status_forcelist` (default `TRANSIENT_STATUSES`),
   or a failed connection (`ConnectionError`, not a timeout, not
   `NoReachableProxyError`), is sent again up to `retries` times (default 3) for
@@ -433,7 +441,8 @@ class PreparedRequest(NamedTuple):
 def prepare_request(method, url, *, headers, body=None, timeout) -> PreparedRequest
 
 class HTTPTransport:
-    def __init__(self, *, proxymap=None, env=None, ssl_context=None, proxy_ssl_context=None, verify=True)
+    def __init__(self, *, proxymap=None, env=None, ssl_context=None, proxy_ssl_context=None, verify=True,
+                 negotiate: Negotiate | None = None)
     def send(self, method, url, *, headers, body=None, timeout, stream=False) -> HTTPResponse
     def close(self) -> None
 ```
@@ -504,7 +513,102 @@ process using syshttp.
   unless it implements them; it can still be used by `fetch(transport=...)`.
   `HTTPTransport` adds to the contract's exceptions
   `proxylib.NoReachableProxyError`, `proxylib.UnsupportedProxyError` and
-  `ConfigurationError`.
+  `ConfigurationError`, and `NegotiationError` or `NegotiateUnavailableError`
+  for a server or proxy the `negotiate` policy names.
+
+## Negotiate and NTLM (`syshttp.negotiate`)
+
+```python
+class Negotiate:
+    def __init__(self, hosts: str | Iterable[str] | None = None, proxies: str | Iterable[str] | None = None, *,
+                 username: str | None = None, password: str | None = None, plain_http: bool | None = None,
+                 max_legs: int | None = None, max_token: int | None = None, env: HTTPEnv | None = None) -> None
+    def settings(self) -> NegotiateSettings
+    def wants(self, host: str, *, proxy: bool = False) -> bool
+
+@dataclass(frozen=True)
+class NegotiateSettings: hosts: tuple[str, ...]; proxies: tuple[str, ...]; plain_http: bool; max_legs: int; max_token: int; explicit_credentials: bool
+
+def has_negotiate() -> bool
+DEFAULT_MAX_LEGS = 5; DEFAULT_MAX_TOKEN = 65536
+NEGOTIATE = "SYSHTTP_NEGOTIATE"; PROXY_NEGOTIATE = "SYSHTTP_PROXY_NEGOTIATE"
+NEGOTIATE_USER = "SYSHTTP_NEGOTIATE_USER"; NEGOTIATE_PASSWORD = "SYSHTTP_NEGOTIATE_PASSWORD"
+NEGOTIATE_PLAIN_HTTP = "SYSHTTP_NEGOTIATE_PLAIN_HTTP"
+NEGOTIATE_MAX_LEGS = "SYSHTTP_NEGOTIATE_MAX_LEGS"; NEGOTIATE_MAX_TOKEN = "SYSHTTP_NEGOTIATE_MAX_TOKEN"   # setting names
+```
+
+`pip install "syshttp[negotiate]"` (pyspnego) is the one dependency; `kerberos`
+adds `gssapi` for the credential cache on Linux and macOS. `import syshttp`,
+`syshttp.negotiate` and `syshttp.client` import neither; pyspnego is imported
+at the first handshake.
+
+- **Off by default.** `HTTPTransport(negotiate=...)` and
+  `HTTPClient(negotiate=...)` take a `Negotiate`; with none given the transport
+  uses `Negotiate(env=env)`. A `401` with `WWW-Authenticate: Negotiate` or `NTLM`
+  and a `407` with `Proxy-Authenticate` are answered only for a host the policy
+  names; any other is the reply, as for any client. `hosts` (else
+  `SYSHTTP_NEGOTIATE`) names servers and `proxies` (else `SYSHTTP_PROXY_NEGOTIATE`)
+  proxies, by the host of the proxy: a comma list or an iterable of host names,
+  `*.suffix` for every host below a domain (not the domain), `*` for all; an
+  empty list is none and beats the variable. A host name is compared without
+  case, brackets or a trailing dot.
+- **The exchange.** The transport sends the same request again with `Authorization:
+  <Negotiate|NTLM> <base64 token>` (`Proxy-Authorization` for a proxy) on the
+  connection the challenge came on, with `Connection: keep-alive`, until the reply
+  is not the challenge again; `Negotiate` is preferred when a reply offers
+  both. A `CONNECT` the proxy answers `407` is answered the same way, on the
+  proxy connection, before the tunnel is made; a proxy's challenge is
+  answered before a server's, each once. The body of a challenge is read (up to
+  64 KiB) and dropped; the reply that follows is what `send()` returns, and
+  the connection, now authenticated, goes back to the pool. The server's
+  closing token is taken from that reply when the mechanism proves the server
+  (Kerberos): a reply of 400 or more is returned unchecked; an incomplete
+  exchange with no closing token, or one the token does not complete, is
+  `NegotiationError`; NTLM has none.
+- **Not answered** (the reply is returned): the request names an `Authorization`
+  (a `Proxy-Authorization` for a proxy challenge), the proxy has a credential of
+  its own (userinfo, headers), the body cannot be sent twice (a file, an
+  iterable), the route is a prefix gateway, or the reply offers neither scheme. A
+  plain-http server behind a proxy that also challenges is answered after the
+  proxy, but the proxy's token is not repeated on the server's legs: a
+  Kerberos proxy asks again and its `407` is returned. A transport of your own
+  does its own authentication.
+- **Identity.** `username` and `password` (else `SYSHTTP_NEGOTIATE_USER` and
+  `SYSHTTP_NEGOTIATE_PASSWORD`, both or `ConfigurationError`) are one identity
+  for every host the policy names, as `DOMAIN\user` or `user@REALM`; with none,
+  the Windows logon session (SSPI) or the Kerberos credential cache. The
+  password is a secret held by the object and in no `repr()`, message, log
+  line or exception attribute; `repr(Negotiate)` says `credentials=explicit`
+  or `logon`, `NegotiateSettings` holds `explicit_credentials`, never the
+  identity. A caller's bad argument is `ValueError` or `TypeError` (a half
+  identity, a line break in either part, `max_legs` below 1, a host that is not a
+  name or pattern); a variable that cannot be used is `ConfigurationError`
+  naming it, refused when the transport is made.
+- **Plain http.** A handshake over `http:` (the server's scheme; for a proxy
+  challenge the proxy URL's) to a host that is not `localhost`, `127.0.0.0/8` or
+  `::1` is `NegotiationError` naming `SYSHTTP_NEGOTIATE_PLAIN_HTTP`, before any
+  token is made. `plain_http=True` (else the variable, a boolean) allows it;
+  each such server or proxy is then logged once per transport at WARNING, under
+  `syshttp.client`, as `weakened`. An `https:` server through a proxy is judged
+  by its own scheme.
+- **Limits.** `max_legs` (default 5, `SYSHTTP_NEGOTIATE_MAX_LEGS`) is the most
+  authenticated requests of one handshake: NTLM takes two, Kerberos one or two.
+  `max_token` (default 65536, `SYSHTTP_NEGOTIATE_MAX_TOKEN`) is the most
+  bytes of a token, sent or received. Past either: `NegotiationError`, and
+  nothing more is sent.
+- **Failures.** `NegotiationError` (message: the host and port, the
+  mechanism, never a token or a credential): the credentials refused (the
+  challenge again), a challenge answered with a token that is not valid
+  base64, a server that closes the connection or sends more than 64 KiB between
+  legs, a limit, the library's own failure (`__cause__`), a refusal over plain
+  http. `NegotiateUnavailableError` (also `ImportError`): pyspnego is
+  missing or does not import, naming `pip install "syshttp[negotiate]"`; raised
+  only for a host the policy names. A handshake is never sent again by
+  syshttp: `NegotiationError` is not a `ConnectionError`, so the client's retries
+  do not repeat it.
+- **Channel binding** (Extended Protection for Authentication) is not sent: a
+  server that requires it refuses the exchange. `has_negotiate()` is whether
+  pyspnego imports.
 
 ## Exceptions (`syshttp.exceptions`)
 
@@ -513,6 +617,8 @@ class SysHTTPError(Exception)
 class ConfigurationError(SysHTTPError, ValueError)
 class HookError(SysHTTPError, RuntimeError)
 class ResponseError(SysHTTPError, ValueError)
+class NegotiationError(SysHTTPError)
+class NegotiateUnavailableError(NegotiationError, ImportError)
 ```
 
 - `SysHTTPError` is the base of what goes wrong at run time. proxylib's own
@@ -524,6 +630,10 @@ class ResponseError(SysHTTPError, ValueError)
   `SYSHTTP_PREFIX`). The message names the variable or key, never a secret.
 - `HookError`: a `_PY` hook failed; the hook's own exception is `__cause__`.
 - `ResponseError`: a body that is not the JSON `HTTPResponse.json()` was asked for.
+- `NegotiationError`: a Negotiate or NTLM handshake that did not authenticate
+  (see "Negotiate and NTLM"); `NegotiateUnavailableError` is the one raised when
+  pyspnego is missing or does not import, naming the `negotiate` extra. The
+  message names the host, never a token or a credential.
 - A caller's own mistake is a plain `ValueError` or `TypeError`, not one of
   these: a malformed `prefixes=` argument, `verify=False` beside `ssl_context`,
   a `client` beside `client_options` in `fetch()`, an unknown patch target.
@@ -776,6 +886,13 @@ def patched() -> tuple[str, ...]
 | `HTTP_PROXY_AUTH` | **secret**: the machine's proxy's credential (a `*_PROXY` variable's or the system's), as `Proxy-Authorization` | the URL's userinfo as Basic |
 | `SYSHTTP_PROXY_AUTH_HEADER` | the header name `SYSHTTP_PROXY_AUTH` rides in | `Proxy-Authorization` |
 | `SYSHTTP_PROXY_TYPE` | `connect` or `prefix[:/endpoint]` | `connect` |
+| `SYSHTTP_NEGOTIATE` | the servers whose Negotiate or NTLM challenge is answered: comma list of host names, `*.suffix`, `*` | none |
+| `SYSHTTP_PROXY_NEGOTIATE` | the same for proxies, by the proxy's host | none |
+| `SYSHTTP_NEGOTIATE_USER` | the explicit identity's name, `DOMAIN\user` or `user@REALM` (with `_PASSWORD`) | the logon session or credential cache |
+| `SYSHTTP_NEGOTIATE_PASSWORD` | **secret**: the explicit identity's password | none |
+| `SYSHTTP_NEGOTIATE_PLAIN_HTTP` | boolean: authenticate over plain http to a host that is not loopback (logged as a weakening) | off |
+| `SYSHTTP_NEGOTIATE_MAX_LEGS` | most authenticated requests of one handshake | 5 |
+| `SYSHTTP_NEGOTIATE_MAX_TOKEN` | most bytes of one token, sent or received | 65536 |
 | `SYSHTTP_HOME` | the jar root | the per-user state directory |
 | `SYSHTTP_COOKIE_HOSTS` | groups of hosts that share cookies: hosts split by `,`, groups by `;` (`HTTPClient`) | none |
 | `SYSHTTP_DEFAULT_TRANSPORT` | the transport of an `HTTPClient` (and `fetch()`) given none: `module:attr` or `<file>.py:attr`, an object with `send()` or something that makes one. It names code to import | syshttp's `HTTPTransport` |
@@ -815,3 +932,15 @@ proxylib's own `PROXYLIB_IMPORTPATCH` and `PROXYLIB_AUTOPROXY`.
   an untrusted party set the environment of a process using syshttp.
 - A client keeps the cookies its responses set for its whole life, as a
   session does: build one per identity, or pass `cookies=` a jar of its own.
+- Negotiate and NTLM send nothing until `SYSHTTP_NEGOTIATE` or
+  `SYSHTTP_PROXY_NEGOTIATE` (or a `Negotiate(hosts=...)`) names the host: the
+  logon identity is released only to hosts you list, never to whatever
+  challenges. Over plain http, to anything but loopback, it needs
+  `SYSHTTP_NEGOTIATE_PLAIN_HTTP` as well.
+- In a venv of the Windows ARM64 CPython 3.9 and 3.14 tested (cryptography
+  50.0.2, pyspnego 0.12.4), `import spnego` fails with "DLL load failed" until
+  the interpreter's `DLLs` directory is on the DLL search path
+  (`os.add_dll_directory`), and then warns that OpenSSL's legacy provider did
+  not load, which leaves pyspnego's own NTLM without RC4; SSPI, once the import
+  works, does not need it. `has_negotiate()` is the probe, and a handshake that
+  needs what is missing is `NegotiationError` or `NegotiateUnavailableError`.

{syshttp-0.1.0 → syshttp-0.1.1}/src/syshttp/__init__.py

@@ -10,6 +10,8 @@ Public surface (the package's AGENTS.md documents each name):
                                          --noproxy overrides included)
   proxy.configured_proxy / proxy_type  — SYSHTTP_PROXY as a proxylib Proxy; SYSHTTP_PROXY_TYPE
                                          (connect | prefix[:/endpoint])
+  negotiate.Negotiate                  — Negotiate and NTLM for the servers and proxies SYSHTTP_NEGOTIATE /
+                                         SYSHTTP_PROXY_NEGOTIATE name (the `negotiate` extra)
   client.HTTPClient / fetch            — the client: proxy map, system TLS, cookies, tokens,
                                          hooks, retries; replaceable transport. ``fetch`` is
                                          also ``syshttp.fetch``
@@ -32,12 +34,21 @@ from importlib.metadata import PackageNotFoundError, version
 from typing import Any
 
 from .env import HTTPEnv
-from .exceptions import ConfigurationError, HookError, ResponseError, SysHTTPError
+from .exceptions import (
+    ConfigurationError,
+    HookError,
+    NegotiateUnavailableError,
+    NegotiationError,
+    ResponseError,
+    SysHTTPError,
+)
 
 __all__ = [
     "ConfigurationError",
     "HTTPEnv",
     "HookError",
+    "NegotiateUnavailableError",
+    "NegotiationError",
     "NoReachableProxyError",
     "ResponseError",
     "SysHTTPError",

{syshttp-0.1.0 → syshttp-0.1.1}/src/syshttp/client/_client.py

@@ -14,6 +14,7 @@ from .. import __version__
 from .. import hooks as _hooks
 from ..env import HTTPEnv
 from ..jar import CookieJar, TokenJar
+from ..negotiate import Negotiate
 from ..retry import TRANSIENT_STATUSES, retry_after
 from . import _follow, _settings
 from ._deadline import Deadline, check_deadline
@@ -123,6 +124,7 @@ class HTTPClient:
         backoff: float = 1,
         status_forcelist: "_ty.Iterable[int]" = TRANSIENT_STATUSES,
         cookie_hosts: "_ty.Iterable[_ty.Iterable[str]] | None" = None,
+        negotiate: "Negotiate | None" = None,
     ):
         if transport is not None and not callable(getattr(transport, "send", None)):
             raise TypeError("a transport is an object with a send() method")
@@ -136,6 +138,7 @@ class HTTPClient:
             "ssl_context": ssl_context,
             "proxy_ssl_context": proxy_ssl_context,
             "verify": verify,
+            "negotiate": negotiate,
         }
         self._transport = transport
         self._built = None
@@ -143,7 +146,7 @@ class HTTPClient:
         if transport is not None:
             if any(value is not (True if name == "verify" else None) for name, value in options.items()):
                 raise ValueError(
-                    "proxymap, ssl_context, proxy_ssl_context and verify configure the default transport: "
+                    "proxymap, ssl_context, proxy_ssl_context, verify and negotiate configure the default transport: "
                     "a client given a transport leaves them to it"
                 )
         else: