Fix multi-round authentication....

net/http/http_auth_handler_digest.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_digest.h"
 
 #include <string>
 
 #include "base/logging.h"
 #include "base/md5.h"
@@ skipping 155 matching lines @@
     const std::string& method,
     const std::string& path,
     const string16& username,
     const string16& password,
     const std::string& cnonce,
     int nonce_count) const {
   // the nonce-count is an 8 digit hex string.
   std::string nc = StringPrintf("%08x", nonce_count);
 
   // TODO(eroman): is this the right encoding?
-  std::string authorization = std::string("Digest username=") +
-                              HttpUtil::Quote(UTF16ToUTF8(username));
+  std::string authorization = (std::string("Digest username=") +
+                               HttpUtil::Quote(UTF16ToUTF8(username)));
   authorization += ", realm=" + HttpUtil::Quote(realm_);
   authorization += ", nonce=" + HttpUtil::Quote(nonce_);
   authorization += ", uri=" + HttpUtil::Quote(path);
 
   if (algorithm_ != ALGORITHM_UNSPECIFIED) {
     authorization += ", algorithm=" + AlgorithmToString(algorithm_);
   }
   std::string response = AssembleResponseDigest(method, path, username,
                                                 password, cnonce, nc);
   // No need to call HttpUtil::Quote() as the response digest cannot contain
   // any characters needing to be escaped.
   authorization += ", response=\"" + response + "\"";
 
   if (!opaque_.empty()) {
     authorization += ", opaque=" + HttpUtil::Quote(opaque_);
   }
   if (qop_ != QOP_UNSPECIFIED) {
     // TODO(eroman): Supposedly IIS server requires quotes surrounding qop.
     authorization += ", qop=" + QopToString(qop_);
     authorization += ", nc=" + nc;
     authorization += ", cnonce=" + HttpUtil::Quote(cnonce);
   }
 
   return authorization;
 }
 
+bool HttpAuthHandlerDigest::Init(HttpAuth::ChallengeTokenizer* challenge) {
+  return ParseChallenge(challenge);
+}
+
+HttpAuth::AuthorizationResult HttpAuthHandlerDigest::HandleAnotherChallenge(
+    HttpAuth::ChallengeTokenizer* challenge) {
+  // Even though Digest is not connection based, a "second round" is parsed
+  // to differentiate between stale and rejected responses.
+  // Note that the state of the current handler is not mutated - this way if
+  // there is a rejection the realm hasn't changed.
+  if (!challenge->valid() ||
+      !LowerCaseEqualsASCII(challenge->scheme(), "digest"))
+    return HttpAuth::AUTHORIZATION_RESULT_INVALID;
+
+  // Try to find the "stale" value.
+  while (challenge->GetNext()) {
+    if (!LowerCaseEqualsASCII(challenge->name(), "stale"))
+      continue;
+    if (LowerCaseEqualsASCII(challenge->unquoted_value(), "true"))
+      return HttpAuth::AUTHORIZATION_RESULT_STALE;
+  }
+
+  return HttpAuth::AUTHORIZATION_RESULT_REJECT;
+}
+
 // The digest challenge header looks like:
 //   WWW-Authenticate: Digest
 //     [realm="<realm-value>"]
 //     nonce="<nonce-value>"
 //     [domain="<list-of-URIs>"]
 //     [opaque="<opaque-token-value>"]
 //     [stale="<true-or-false>"]
 //     [algorithm="<digest-algorithm>"]
 //     [qop="<list-of-qop-values>"]
 //     [<extension-directive>]
@@ skipping 10 matching lines @@
   scheme_ = "digest";
   score_ = 2;
   properties_ = ENCRYPTS_IDENTITY;
 
   // Initialize to defaults.
   stale_ = false;
   algorithm_ = ALGORITHM_UNSPECIFIED;
   qop_ = QOP_UNSPECIFIED;
   realm_ = nonce_ = domain_ = opaque_ = std::string();
 
+  // FAIL -- Couldn't match auth-scheme.
   if (!challenge->valid() ||
       !LowerCaseEqualsASCII(challenge->scheme(), "digest"))
-    return false;  // FAIL -- Couldn't match auth-scheme.
+    return false;
 
   // Loop through all the properties.
   while (challenge->GetNext()) {
     if (challenge->value().empty()) {
       DLOG(INFO) << "Invalid digest property";
       return false;
     }
 
+    // FAIL -- couldn't parse a property.
     if (!ParseChallengeProperty(challenge->name(), challenge->unquoted_value()))
-      return false;  // FAIL -- couldn't parse a property.
+      return false;
   }
 
   // Check if tokenizer failed.
   if (!challenge->valid())
-    return false;  // FAIL
+    return false;
 
   // Check that a minimum set of properties were provided.
   if (nonce_.empty())
-    return false;  // FAIL
+    return false;
 
   return true;
 }
 
 bool HttpAuthHandlerDigest::ParseChallengeProperty(const std::string& name,
                                                    const std::string& value) {
   if (LowerCaseEqualsASCII(name, "realm")) {
     realm_ = value;
   } else if (LowerCaseEqualsASCII(name, "nonce")) {
     nonce_ = value;
@@ skipping 49 matching lines @@
   //                 method and only constructing when valid.
   scoped_ptr<HttpAuthHandler> tmp_handler(
       new HttpAuthHandlerDigest(digest_nonce_count));
   if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log))
     return ERR_INVALID_RESPONSE;
   handler->swap(tmp_handler);
   return OK;
 }
 
 }  // namespace net