Kerberos SPN generation for Negotiate challenges

net/http/http_network_transaction.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_network_transaction.h"
 
 #include "base/compiler_specific.h"
 #include "base/field_trial.h"
 #include "base/format_macros.h"
 #include "base/histogram.h"
@@ skipping 556 matching lines @@
         DCHECK_EQ(OK, rv);
         TRACE_EVENT_BEGIN("http.read_headers", request_, request_->url.spec());
         net_log_.BeginEvent(NetLog::TYPE_HTTP_TRANSACTION_READ_HEADERS);
         rv = DoReadHeaders();
         break;
       case STATE_READ_HEADERS_COMPLETE:
         rv = DoReadHeadersComplete(rv);
         TRACE_EVENT_END("http.read_headers", request_, request_->url.spec());
         net_log_.EndEvent(NetLog::TYPE_HTTP_TRANSACTION_READ_HEADERS);
         break;
+      case STATE_RESOLVE_CANONICAL_NAME:
+        rv = DoResolveCanonicalName();
+        break;
+      case STATE_RESOLVE_CANONICAL_NAME_COMPLETE:
+        rv = DoResolveCanonicalNameComplete(rv);
+        break;
       case STATE_READ_BODY:
         DCHECK_EQ(OK, rv);
         TRACE_EVENT_BEGIN("http.read_body", request_, request_->url.spec());
         net_log_.BeginEvent(NetLog::TYPE_HTTP_TRANSACTION_READ_BODY);
         rv = DoReadBody();
         break;
       case STATE_READ_BODY_COMPLETE:
         rv = DoReadBodyComplete(rv);
         TRACE_EVENT_END("http.read_body", request_, request_->url.spec());
         net_log_.EndEvent(NetLog::TYPE_HTTP_TRANSACTION_READ_BODY);
@@ skipping 522 matching lines @@
   if (using_ssl_ && !establishing_tunnel_) {
     SSLClientSocket* ssl_socket =
         reinterpret_cast<SSLClientSocket*>(connection_->socket());
     ssl_socket->GetSSLInfo(&response_.ssl_info);
   }
 
   headers_valid_ = true;
   return OK;
 }
 
+int HttpNetworkTransaction::DoResolveCanonicalName() {
+  HttpAuthHandler* auth_handler = auth_handler_[pending_auth_target_];
+  DCHECK(auth_handler);
+  next_state_ = STATE_RESOLVE_CANONICAL_NAME_COMPLETE;
+  return auth_handler->ResolveCanonicalName(session_->host_resolver(),
+                                            &io_callback_, net_log_);
+}
+
+int HttpNetworkTransaction::DoResolveCanonicalNameComplete(int result) {
+  // The STATE_RESOLVE_CANONICAL_NAME state ends the Start sequence when the
+  // canonical name of the server needs to be determined. Normally
+  // DoReadHeadersComplete completes the sequence. The next state is
+  // intentionally not set as it should be STATE_NONE;
+  DCHECK_EQ(STATE_NONE, next_state_);
+  return result;
+}
+
 int HttpNetworkTransaction::DoReadBody() {
   DCHECK(read_buf_);
   DCHECK_GT(read_buf_len_, 0);
   DCHECK(connection_->is_initialized());
 
   next_state_ = STATE_READ_BODY_COMPLETE;
   return http_stream_->ReadResponseBody(read_buf_, read_buf_len_,
                                         &io_callback_);
 }
 
@@ skipping 781 matching lines @@
 
   // Make a note that we are waiting for auth. This variable is inspected
   // when the client calls RestartWithAuth() to pick up where we left off.
   pending_auth_target_ = target;
 
   if (auth_identity_[target].invalid) {
     // We have exhausted all identity possibilities, all we can do now is
     // pass the challenge information back to the client.
     PopulateAuthChallenge(target, auth_origin);
   }
+
+  // SPN determination (for Negotiate) requires a DNS lookup to find the
+  // canonical name. This needs to be done asynchronously to prevent blocking
+  // the IO thread.
+  if (auth_handler_[target]->NeedsCanonicalName())
+    next_state_ = STATE_RESOLVE_CANONICAL_NAME;
+
   return OK;
 }
 
 void HttpNetworkTransaction::PopulateAuthChallenge(HttpAuth::Target target,
                                                    const GURL& auth_origin) {
   // Populates response_.auth_challenge with the authentication challenge info.
   // This info is consumed by URLRequestHttpJob::GetAuthChallengeInfo().
 
   AuthChallengeInfo* auth_info = new AuthChallengeInfo;
   auth_info->is_proxy = target == HttpAuth::AUTH_PROXY;
@@ skipping 13 matching lines @@
       http_host_port_pair);
 
   alternate_protocol_mode_ = kDoNotUseAlternateProtocol;
   if (connection_->socket())
     connection_->socket()->Disconnect();
   connection_->Reset();
   next_state_ = STATE_INIT_CONNECTION;
 }
 
 }  // namespace net