Kerberos authentication backoff cleanup.

net/http/http_auth_handler_negotiate_unittest.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_negotiate.h"
 
 #include "net/base/mock_host_resolver.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/http/http_request_info.h"
 #if defined(OS_WIN)
 #include "net/http/mock_sspi_library_win.h"
 #elif defined(OS_POSIX)
 #include "net/http/mock_gssapi_library_posix.h"
+#include "net/third_party/gssapi/gssapi.h"
 #endif
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
 
 #if defined(OS_WIN)
 typedef net::MockSSPILibrary MockAuthLibrary;
 #elif defined(OS_POSIX)
 typedef net::test::MockGSSAPILibrary MockAuthLibrary;
 #endif
 
 
 namespace net {
 
 class HttpAuthHandlerNegotiateTest : public PlatformTest {
  public:
   virtual void SetUp() {
     auth_library_.reset(new MockAuthLibrary());
-    SetupMocks(auth_library_.get());
     resolver_ = new MockHostResolver();
     resolver_->rules()->AddIPLiteralRule("alias", "10.0.0.2",
                                            "canonical.example.com");
 
     url_security_manager_.reset(new URLSecurityManagerAllow());
     factory_.reset(new HttpAuthHandlerNegotiate::Factory());
     factory_->set_url_security_manager(url_security_manager_.get());
     factory_->set_library(auth_library_.get());
     factory_->set_host_resolver(resolver_);
   }
@@ skipping 82 matching lines @@
         GSS_S_COMPLETE,                 // Major response code
         0,                              // Minor response code
         context2,                       // Context
         { arraysize(kAuthResponse),
           const_cast<char*>(kAuthResponse) },  // Expected input token
         { arraysize(kAuthResponse),
           const_cast<char*>(kAuthResponse) }   // Output token
       },
     };
 
-    size_t i;
-    for (i = 0; i < arraysize(queries); ++i) {
+    for (size_t i = 0; i < arraysize(queries); ++i) {
       mock_library->ExpectSecurityContext(queries[i].expected_package,
                                           queries[i].response_code,
                                           queries[i].minor_response_code,
                                           queries[i].context_info,
                                           queries[i].expected_input_token,
                                           queries[i].output_token);
     }
 #endif  // defined(OS_POSIX)
   }
 
+#if defined(OS_POSIX)
+  void SetupErrorMocks(MockAuthLibrary* mock_library,
+                       int major_status,
+                       int minor_status) {
+    const gss_OID_desc kDefaultMech = { 0, NULL };
+    test::GssContextMockImpl context(
+        "localhost",                    // Source name
+        "example.com",                  // Target name
+        0,                              // Lifetime
+        kDefaultMech,                   // Mechanism
+        0,                              // Context flags
+        1,                              // Locally initiated
+        0);                             // Open
+    test::MockGSSAPILibrary::SecurityContextQuery query = {
+      "Negotiate",                    // Package name
+      major_status,                   // Major response code
+      minor_status,                   // Minor response code
+      context,                        // Context
+      { 0, NULL },                    // Expected input token
+      { 0, NULL }                     // Output token
+    };
+
+    mock_library->ExpectSecurityContext(query.expected_package,
+                                        query.response_code,
+                                        query.minor_response_code,
+                                        query.context_info,
+                                        query.expected_input_token,
+                                        query.output_token);
+  }
+
+#endif  // defined(OS_POSIX)
+
   int CreateHandler(bool disable_cname_lookup, bool use_port,
                      bool synchronous_resolve_mode,
                      const std::string& url_string,
                      scoped_ptr<HttpAuthHandlerNegotiate>* handler) {
     factory_->set_disable_cname_lookup(disable_cname_lookup);
     factory_->set_use_port(use_port);
     resolver_->set_synchronous_mode(synchronous_resolve_mode);
     GURL gurl(url_string);
 
     // Note: This is a little tricky because CreateAuthHandlerFromString
     // expects a scoped_ptr<HttpAuthHandler>* rather than a
     // scoped_ptr<HttpAuthHandlerNegotiate>*. This needs to do the cast
     // after creating the handler, and make sure that generic_handler
     // no longer holds on to the HttpAuthHandlerNegotiate object.
     scoped_ptr<HttpAuthHandler> generic_handler;
     int rv = factory_->CreateAuthHandlerFromString("Negotiate",
                                                    HttpAuth::AUTH_SERVER,
                                                    gurl,
                                                    BoundNetLog(),
                                                    &generic_handler);
     if (rv != OK)
       return rv;
     HttpAuthHandlerNegotiate* negotiate_handler =
         static_cast<HttpAuthHandlerNegotiate*>(generic_handler.release());
     handler->reset(negotiate_handler);
     return rv;
   }
 
+  MockAuthLibrary* AuthLibrary() { return auth_library_.get(); }
+
  private:
 #if defined(OS_WIN)
   scoped_ptr<SecPkgInfoW> security_package_;
 #endif
   scoped_ptr<MockAuthLibrary> auth_library_;
   scoped_refptr<MockHostResolver> resolver_;
   scoped_ptr<URLSecurityManager> url_security_manager_;
   scoped_ptr<HttpAuthHandlerNegotiate::Factory> factory_;
 };
 
 TEST_F(HttpAuthHandlerNegotiateTest, DisableCname) {
+  SetupMocks(AuthLibrary());
   scoped_ptr<HttpAuthHandlerNegotiate> auth_handler;
   EXPECT_EQ(OK, CreateHandler(
       true, false, true, "http://alias:500", &auth_handler));
 
   ASSERT_TRUE(auth_handler.get() != NULL);
   TestCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
   std::wstring username = L"foo";
   std::wstring password = L"bar";
   EXPECT_EQ(OK, auth_handler->GenerateAuthToken(&username, &password,
                                                 &request_info,
                                                 &callback, &token));
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/alias", auth_handler->spn());
 #elif defined(OS_POSIX)
   EXPECT_EQ(L"HTTP@alias", auth_handler->spn());
 #endif
 }
 
 TEST_F(HttpAuthHandlerNegotiateTest, DisableCnameStandardPort) {
+  SetupMocks(AuthLibrary());
   scoped_ptr<HttpAuthHandlerNegotiate> auth_handler;
   EXPECT_EQ(OK, CreateHandler(
       true, true, true, "http://alias:80", &auth_handler));
   ASSERT_TRUE(auth_handler.get() != NULL);
   TestCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
   std::wstring username = L"foo";
   std::wstring password = L"bar";
   EXPECT_EQ(OK, auth_handler->GenerateAuthToken(&username, &password,
                                                 &request_info,
                                                 &callback, &token));
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/alias", auth_handler->spn());
 #elif defined(OS_POSIX)
   EXPECT_EQ(L"HTTP@alias", auth_handler->spn());
 #endif
 }
 
 TEST_F(HttpAuthHandlerNegotiateTest, DisableCnameNonstandardPort) {
+  SetupMocks(AuthLibrary());
   scoped_ptr<HttpAuthHandlerNegotiate> auth_handler;
   EXPECT_EQ(OK, CreateHandler(
       true, true, true, "http://alias:500", &auth_handler));
   ASSERT_TRUE(auth_handler.get() != NULL);
   TestCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
   std::wstring username = L"foo";
   std::wstring password = L"bar";
   EXPECT_EQ(OK, auth_handler->GenerateAuthToken(&username, &password,
                                                 &request_info,
                                                 &callback, &token));
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/alias:500", auth_handler->spn());
 #elif defined(OS_POSIX)
   EXPECT_EQ(L"HTTP@alias:500", auth_handler->spn());
 #endif
 }
 
 TEST_F(HttpAuthHandlerNegotiateTest, CnameSync) {
+  SetupMocks(AuthLibrary());
   scoped_ptr<HttpAuthHandlerNegotiate> auth_handler;
   EXPECT_EQ(OK, CreateHandler(
       false, false, true, "http://alias:500", &auth_handler));
   ASSERT_TRUE(auth_handler.get() != NULL);
   TestCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
   std::wstring username = L"foo";
   std::wstring password = L"bar";
   EXPECT_EQ(OK, auth_handler->GenerateAuthToken(&username, &password,
                                                 &request_info,
                                                 &callback, &token));
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/canonical.example.com", auth_handler->spn());
 #elif defined(OS_POSIX)
   EXPECT_EQ(L"HTTP@canonical.example.com", auth_handler->spn());
 #endif
 }
 
 TEST_F(HttpAuthHandlerNegotiateTest, CnameAsync) {
+  SetupMocks(AuthLibrary());
   scoped_ptr<HttpAuthHandlerNegotiate> auth_handler;
   EXPECT_EQ(OK, CreateHandler(
       false, false, false, "http://alias:500", &auth_handler));
   ASSERT_TRUE(auth_handler.get() != NULL);
   TestCompletionCallback callback;
   HttpRequestInfo request_info;
   std::string token;
   std::wstring username = L"foo";
   std::wstring password = L"bar";
   EXPECT_EQ(ERR_IO_PENDING, auth_handler->GenerateAuthToken(
       &username, &password, &request_info, &callback, &token));
   EXPECT_EQ(OK, callback.WaitForResult());
 #if defined(OS_WIN)
   EXPECT_EQ(L"HTTP/canonical.example.com", auth_handler->spn());
 #elif defined(OS_POSIX)
   EXPECT_EQ(L"HTTP@canonical.example.com", auth_handler->spn());
 #endif
 }
 
+#if defined(OS_POSIX)
+
+// These tests are only for GSSAPI, as we can't use explicit credentials with
+// that library.
+
+TEST_F(HttpAuthHandlerNegotiateTest, ServerNotInKerberosDatabase) {
+  SetupErrorMocks(AuthLibrary(), GSS_S_FAILURE, 0x96C73A07);  // No server
+  scoped_ptr<HttpAuthHandlerNegotiate> auth_handler;
+  EXPECT_EQ(OK, CreateHandler(
+      false, false, false, "http://alias:500", &auth_handler));
+  ASSERT_TRUE(auth_handler.get() != NULL);
+  TestCompletionCallback callback;
+  HttpRequestInfo request_info;
+  std::string token;
+  EXPECT_EQ(ERR_IO_PENDING, auth_handler->GenerateAuthToken(
+      NULL, NULL, &request_info, &callback, &token));
+  EXPECT_EQ(ERR_MISSING_AUTH_CREDENTIALS, callback.WaitForResult());
+}
+
+TEST_F(HttpAuthHandlerNegotiateTest, NoKerberosCredentials) {
+  SetupErrorMocks(AuthLibrary(), GSS_S_FAILURE, 0x96C73AC3);  // No credentials
+  scoped_ptr<HttpAuthHandlerNegotiate> auth_handler;
+  EXPECT_EQ(OK, CreateHandler(
+      false, false, false, "http://alias:500", &auth_handler));
+  ASSERT_TRUE(auth_handler.get() != NULL);
+  TestCompletionCallback callback;
+  HttpRequestInfo request_info;
+  std::string token;
+  EXPECT_EQ(ERR_IO_PENDING, auth_handler->GenerateAuthToken(
+      NULL, NULL, &request_info, &callback, &token));
+  EXPECT_EQ(ERR_MISSING_AUTH_CREDENTIALS, callback.WaitForResult());
+}
+
+#endif  // defined(OS_POSIX)
+
 }  // namespace net