Fix multi-round authentication....

net/http/http_auth_gssapi_posix.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_gssapi_posix.h"
 
 #include <limits>
 #include <string>
 
 #include "base/base64.h"
@@ skipping 96 matching lines @@
   // msg_ctx needs to be outside the loop because it is invoked multiple times.
   OM_uint32 msg_ctx = 0;
   std::string rv = StringPrintf("(0x%08X)", status);
 
   // This loop should continue iterating until msg_ctx is 0 after the first
   // iteration. To be cautious and prevent an infinite loop, it stops after
   // a finite number of iterations as well. As an added sanity check, no
   // individual message may exceed |kMaxMsgLength|, and the final result
   // will not exceed |kMaxMsgLength|*2-1.
   for (int i = 0; i < kMaxDisplayIterations && rv.size() < kMaxMsgLength;
-      ++i) {
+       ++i) {
     OM_uint32 min_stat;
     gss_buffer_desc_struct msg = GSS_C_EMPTY_BUFFER;
     OM_uint32 maj_stat =
         gssapi_lib->display_status(&min_stat, status, status_code_type,
                                    GSS_C_NULL_OID, &msg_ctx, &msg);
     if (maj_stat == GSS_S_COMPLETE) {
       int msg_len = (msg.length > kMaxMsgLength) ?
           static_cast<int>(kMaxMsgLength) :
           static_cast<int>(msg.length);
       if (msg_len > 0 && msg.value != NULL) {
@@ skipping 347 matching lines @@
       // Only return this library if we can bind the functions we need.
       if (BindMethods(lib))
         return lib;
       base::UnloadNativeLibrary(lib);
     }
   }
   LOG(WARNING) << "Unable to find a compatible GSSAPI library";
   return NULL;
 }
 
-#define BIND(lib, x) \
-  gss_##x##_type x = reinterpret_cast<gss_##x##_type>( \
-      base::GetFunctionPointerFromNativeLibrary(lib, "gss_" #x)); \
-  if (x == NULL) { \
-    LOG(WARNING) << "Unable to bind function \"" << "gss_" #x << "\""; \
-    return false; \
+#define BIND(lib, x)                                                    \
+  gss_##x##_type x = reinterpret_cast<gss_##x##_type>(                  \
+      base::GetFunctionPointerFromNativeLibrary(lib, "gss_" #x));       \
+  if (x == NULL) {                                                      \
+    LOG(WARNING) << "Unable to bind function \"" << "gss_" #x << "\"";  \
+    return false;                                                       \
   }
 
 bool GSSAPISharedLibrary::BindMethods(base::NativeLibrary lib) {
   DCHECK(lib != NULL);
 
-  BIND(lib, import_name)
-  BIND(lib, release_name)
-  BIND(lib, release_buffer)
-  BIND(lib, display_name)
-  BIND(lib, display_status)
-  BIND(lib, init_sec_context)
-  BIND(lib, wrap_size_limit)
-  BIND(lib, delete_sec_context)
-  BIND(lib, inquire_context)
+  BIND(lib, import_name);
+  BIND(lib, release_name);
+  BIND(lib, release_buffer);
+  BIND(lib, display_name);
+  BIND(lib, display_status);
+  BIND(lib, init_sec_context);
+  BIND(lib, wrap_size_limit);
+  BIND(lib, delete_sec_context);
+  BIND(lib, inquire_context);
 
   import_name_ = import_name;
   release_name_ = release_name;
   release_buffer_ = release_buffer;
   display_name_ = display_name;
   display_status_ = display_status;
   init_sec_context_ = init_sec_context;
   wrap_size_limit_ = wrap_size_limit;
   delete_sec_context_ = delete_sec_context;
   inquire_context_ = inquire_context;
@@ skipping 116 matching lines @@
     const gss_ctx_id_t context_handle,
     gss_name_t* src_name,
     gss_name_t* targ_name,
     OM_uint32* lifetime_rec,
     gss_OID* mech_type,
     OM_uint32* ctx_flags,
     int* locally_initiated,
     int* open) {
   DCHECK(initialized_);
   return inquire_context_(minor_status,
-                         context_handle,
-                         src_name,
-                         targ_name,
-                         lifetime_rec,
-                         mech_type,
-                         ctx_flags,
-                         locally_initiated,
-                         open);
+                          context_handle,
+                          src_name,
+                          targ_name,
+                          lifetime_rec,
+                          mech_type,
+                          ctx_flags,
+                          locally_initiated,
+                          open);
 }
 GSSAPILibrary* GSSAPILibrary::GetDefault() {
   return Singleton<GSSAPISharedLibrary>::get();
 }
 
 ScopedSecurityContext::ScopedSecurityContext(GSSAPILibrary* gssapi_lib)
     : security_context_(GSS_C_NO_CONTEXT),
       gssapi_lib_(gssapi_lib) {
   DCHECK(gssapi_lib_);
 }
@@ skipping 29 matching lines @@
 bool HttpAuthGSSAPI::Init() {
   if (!library_)
     return false;
   return library_->Init();
 }
 
 bool HttpAuthGSSAPI::NeedsIdentity() const {
   return decoded_server_auth_token_.empty();
 }
 
-bool HttpAuthGSSAPI::IsFinalRound() const {
-  return !NeedsIdentity();
-}
-
 void HttpAuthGSSAPI::Delegate() {
   can_delegate_ = true;
 }
 
-bool HttpAuthGSSAPI::ParseChallenge(HttpAuth::ChallengeTokenizer* tok) {
+HttpAuth::AuthorizationResult HttpAuthGSSAPI::ParseChallenge(
+    HttpAuth::ChallengeTokenizer* tok) {
   // Verify the challenge's auth-scheme.
   if (!tok->valid() ||
       !LowerCaseEqualsASCII(tok->scheme(), StringToLowerASCII(scheme_).c_str()))
-    return false;
+    return HttpAuth::AUTHORIZATION_RESULT_INVALID;
 
   tok->set_expect_base64_token(true);
   if (!tok->GetNext()) {
-    decoded_server_auth_token_.clear();
-    return true;
+    // If a context has already been established, an empty Negotiate challenge
+    // should be treated as a rejection of the current attempt.
+    if (scoped_sec_context_.get() != GSS_C_NO_CONTEXT)
+      return HttpAuth::AUTHORIZATION_RESULT_REJECT;
+    DCHECK(decoded_server_auth_token_.empty());
+    return HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
+  } else {
+    // If a context has not already been established, additional tokens should
+    // not be present in the auth challenge.
+    if (scoped_sec_context_.get() == GSS_C_NO_CONTEXT)
+      return HttpAuth::AUTHORIZATION_RESULT_INVALID;
   }
 
+  // Make sure the additional token is base64 encoded.
   std::string encoded_auth_token = tok->value();
   std::string decoded_auth_token;
   bool base64_rv = base::Base64Decode(encoded_auth_token, &decoded_auth_token);
-  if (!base64_rv) {
-    LOG(ERROR) << "Base64 decoding of auth token failed.";
-    return false;
-  }
+  if (!base64_rv)
+    return HttpAuth::AUTHORIZATION_RESULT_INVALID;
   decoded_server_auth_token_ = decoded_auth_token;
-  return true;
+  return HttpAuth::AUTHORIZATION_RESULT_ACCEPT;
 }
 
 int HttpAuthGSSAPI::GenerateAuthToken(const string16* username,
                                       const string16* password,
                                       const std::wstring& spn,
                                       std::string* auth_token) {
   DCHECK(auth_token);
   DCHECK(username == NULL && password == NULL);
 
   gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
   input_token.length = decoded_server_auth_token_.length();
-  input_token.value =
-      (input_token.length > 0) ?
-          const_cast<char*>(decoded_server_auth_token_.data()) :
-          NULL;
+  input_token.value = (input_token.length > 0) ?
+      const_cast<char*>(decoded_server_auth_token_.data()) :
+      NULL;
   gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
   ScopedBuffer scoped_output_token(&output_token, library_);
   int rv = GetNextSecurityToken(spn, &input_token, &output_token);
   if (rv != OK)
     return rv;
 
   // Base64 encode data in output buffer and prepend the scheme.
   std::string encode_input(static_cast<char*>(output_token.value),
                            output_token.length);
   std::string encode_output;
@@ skipping 155 matching lines @@
                                         minor_status)
                << std::endl
                << DescribeContext(library_, scoped_sec_context_.get());
     return rv;
   }
 
   return OK;
 }
 
 }  // namespace net