Allow chrome to handle 407 auth challenges to CONNECT requests

net/http/http_proxy_client_socket_pool.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_proxy_client_socket_pool.h"
 
 #include <algorithm>
 
 #include "base/time.h"
 #include "base/values.h"
@@ skipping 10 matching lines @@
 #include "net/socket/ssl_client_socket_pool.h"
 #include "net/socket/transport_client_socket_pool.h"
 #include "net/spdy/spdy_proxy_client_socket.h"
 #include "net/spdy/spdy_session.h"
 #include "net/spdy/spdy_session_pool.h"
 #include "net/spdy/spdy_settings_storage.h"
 #include "net/spdy/spdy_stream.h"
 
 namespace net {
 
+namespace {
+
+std::string GetProxyUrl(const scoped_refptr<HttpProxySocketParams>& params) {
+  return (params->ssl_params() != NULL ? "https://" : "http://")
+      + params->destination().host_port_pair().ToString();
+}
+
+}  // namespace
+
 HttpProxySocketParams::HttpProxySocketParams(
     const scoped_refptr<TransportSocketParams>& transport_params,
     const scoped_refptr<SSLSocketParams>& ssl_params,
     const GURL& request_url,
     const std::string& user_agent,
     HostPortPair endpoint,
     HttpAuthCache* http_auth_cache,
     HttpAuthHandlerFactory* http_auth_handler_factory,
     SpdySessionPool* spdy_session_pool,
-    bool tunnel)
+    bool tunnel,
+    TunnelAuthNeededCB auth_needed_callback)
     : transport_params_(transport_params),
       ssl_params_(ssl_params),
       spdy_session_pool_(spdy_session_pool),
       request_url_(request_url),
       user_agent_(user_agent),
       endpoint_(endpoint),
       http_auth_cache_(tunnel ? http_auth_cache : NULL),
       http_auth_handler_factory_(tunnel ? http_auth_handler_factory : NULL),
-      tunnel_(tunnel) {
+      tunnel_(tunnel),
+      auth_needed_callback_(auth_needed_callback) {
   DCHECK((transport_params == NULL && ssl_params != NULL) ||
          (transport_params != NULL && ssl_params == NULL));
   if (transport_params_)
     ignore_limits_ = transport_params->ignore_limits();
   else
     ignore_limits_ = ssl_params->ignore_limits();
 }
 
 const HostResolver::RequestInfo& HttpProxySocketParams::destination() const {
   if (transport_params_ == NULL)
@@ skipping 20 matching lines @@
     : ConnectJob(group_name, timeout_duration, delegate,
                  BoundNetLog::Make(net_log, NetLog::SOURCE_CONNECT_JOB)),
       params_(params),
       transport_pool_(transport_pool),
       ssl_pool_(ssl_pool),
       resolver_(host_resolver),
       ALLOW_THIS_IN_INITIALIZER_LIST(
           callback_(base::Bind(&HttpProxyConnectJob::OnIOComplete,
                                base::Unretained(this)))),
       using_spdy_(false),
-      protocol_negotiated_(SSLClientSocket::kProtoUnknown) {

[vandebo (ex-Chrome), 2012/01/19 20:12:49]

Why are you removing the initialization of this variable?

[Ryan Hamilton, 2012/01/19 23:11:19]

OUCH!  Thanks for catching this mistake

+      auth_(params->tunnel() ?
+            new HttpAuthController(HttpAuth::AUTH_PROXY,
+                                   GURL(GetProxyUrl(params_)),
+                                   params->http_auth_cache(),
+                                   params->http_auth_handler_factory())
+            : NULL),
+      ALLOW_THIS_IN_INITIALIZER_LIST(ptr_factory_(this)) {
 }
 
 HttpProxyConnectJob::~HttpProxyConnectJob() {}
 
 LoadState HttpProxyConnectJob::GetLoadState() const {
   switch (next_state_) {
     case STATE_TCP_CONNECT:
     case STATE_TCP_CONNECT_COMPLETE:
     case STATE_SSL_CONNECT:
     case STATE_SSL_CONNECT_COMPLETE:
       return transport_socket_handle_->GetLoadState();
     case STATE_HTTP_PROXY_CONNECT:
     case STATE_HTTP_PROXY_CONNECT_COMPLETE:
     case STATE_SPDY_PROXY_CREATE_STREAM:
     case STATE_SPDY_PROXY_CREATE_STREAM_COMPLETE:
+    case STATE_RESTART_WITH_AUTH:
+    case STATE_RESTART_WITH_AUTH_COMPLETE:
       return LOAD_STATE_ESTABLISHING_PROXY_TUNNEL;
     default:
       NOTREACHED();
       return LOAD_STATE_IDLE;
   }
 }
 
 void HttpProxyConnectJob::GetAdditionalErrorState(ClientSocketHandle * handle) {
   if (error_response_info_.cert_request_info) {
     handle->set_ssl_error_response_info(error_response_info_);
@@ skipping 36 matching lines @@
       case STATE_HTTP_PROXY_CONNECT_COMPLETE:
         rv = DoHttpProxyConnectComplete(rv);
         break;
       case STATE_SPDY_PROXY_CREATE_STREAM:
         DCHECK_EQ(OK, rv);
         rv = DoSpdyProxyCreateStream();
         break;
       case STATE_SPDY_PROXY_CREATE_STREAM_COMPLETE:
         rv = DoSpdyProxyCreateStreamComplete(rv);
         break;
+      case STATE_RESTART_WITH_AUTH:
+        DCHECK_EQ(OK, rv);
+        rv = DoRestartWithAuth();
+        break;
+      case STATE_RESTART_WITH_AUTH_COMPLETE:
+        rv = DoRestartWithAuthComplete(rv);
+        break;
       default:
         NOTREACHED() << "bad state";
         rv = ERR_FAILED;
         break;
     }
   } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
 
   return rv;
 }
 
@@ skipping 87 matching lines @@
   const HostResolver::RequestInfo& tcp_destination = params_->destination();
   const HostPortPair& proxy_server = tcp_destination.host_port_pair();
 
   // Add a HttpProxy connection on top of the tcp socket.
   transport_socket_.reset(
       new HttpProxyClientSocket(transport_socket_handle_.release(),
                                 params_->request_url(),
                                 params_->user_agent(),
                                 params_->endpoint(),
                                 proxy_server,
-                                params_->http_auth_cache(),
-                                params_->http_auth_handler_factory(),
+                                auth_,
                                 params_->tunnel(),
                                 using_spdy_,
                                 protocol_negotiated_,
                                 params_->ssl_params() != NULL));
   return transport_socket_->Connect(callback_);
 }
 
+void HttpProxyConnectJob::HandleProxyAuthChallenge() {

[vandebo (ex-Chrome), 2012/01/19 20:12:49]

I think you were asking if you could get rid of this method.  My sources think
it's possible, ping ajwong for the exact syntax.  (At your discretion.)

[Ryan Hamilton, 2012/01/19 23:11:19]

Will follow up with ajwong offline and possibly implement in a subsequent CL.

+  next_state_ = STATE_RESTART_WITH_AUTH;
+  params_->auth_needed_callback().Run(
+    *transport_socket_->GetConnectResponseInfo(),
+    transport_socket_->auth_controller(),
+    callback_);
+}
+
+int HttpProxyConnectJob::DoRestartWithAuth() {
+  // If no auth was added to the controller, then we should abort.
+  next_state_ = STATE_RESTART_WITH_AUTH_COMPLETE;
+  if (!transport_socket_->auth_controller()->HaveAuth()) {
+    return ERR_PROXY_AUTH_REQUESTED;

[vandebo (ex-Chrome), 2012/01/19 20:12:49]

Should we set the socket to the transport socket here?  I'm not sure.  I guess
the reason to do it would be so that the user sees the 407 error page, is that
what we want?

[Ryan Hamilton, 2012/01/19 23:11:19]

No, we don't need to do it here, because we do it in
DoRestartWithAuthComplete().  (In the case where DoRestartWithAuth returns
ERR_PROXY_AUTH_REQUESTED, we run DoRestartWithAuthComplete which sets the socket
for us.)

+  }
+
+  return transport_socket_->RestartWithAuth(callback_);
+}
+
+int HttpProxyConnectJob::DoRestartWithAuthComplete(int result) {
+  if (result != OK) {
+    if (result == ERR_PROXY_AUTH_REQUESTED ||
+        result == ERR_HTTPS_PROXY_TUNNEL_RESPONSE) {
+      set_socket(transport_socket_.release());

[vandebo (ex-Chrome), 2012/01/19 20:12:49]

I guess maybe we do want to set the socket above, since we do here.

[Ryan Hamilton, 2012/01/19 23:11:19]

(To amplify the previous comment, this code here handles the earlier case so
we're just fine.  In fact, adding a set_socket() above means that when this code
executes we end up set_socket() with null since transport_socket has already
been released.

+    }
+    return result;
+  }
+
+  if (!transport_socket_->IsConnectedAndIdle()) {
+    return ConnectInternal();

[vandebo (ex-Chrome), 2012/01/19 20:12:49]

I think you're already inside a DoLoop here (You got here from callback_ called
from params_->auth_needed_callback(), which did DoRestartWithAuth, and then this
method.  I think you just want to set the state you want and return.

[Ryan Hamilton, 2012/01/19 23:11:19]

Done.

+  }
+
+  next_state_ = STATE_HTTP_PROXY_CONNECT_COMPLETE;
+  return OK;
+}
+
 int HttpProxyConnectJob::DoHttpProxyConnectComplete(int result) {
-  if (result == OK || result == ERR_PROXY_AUTH_REQUESTED ||
+  // Handle a proxy auth challenge by asynchronously invoking the callback.

[vandebo (ex-Chrome), 2012/01/19 20:12:49]

Wouldn't hurt to explain why it's being done asynchronously.

[Ryan Hamilton, 2012/01/19 23:11:19]

Done.

+  if (result == ERR_PROXY_AUTH_REQUESTED) {
+    MessageLoop::current()->PostTask(
+        FROM_HERE,
+        base::Bind(&HttpProxyConnectJob::HandleProxyAuthChallenge,
+                   ptr_factory_.GetWeakPtr()));
+    return ERR_IO_PENDING;
+  }
+  if (result == OK ||
       result == ERR_HTTPS_PROXY_TUNNEL_RESPONSE) {
       set_socket(transport_socket_.release());
   }
 
   return result;
 }
 
 int HttpProxyConnectJob::DoSpdyProxyCreateStream() {
   DCHECK(using_spdy_);
   DCHECK(params_->tunnel());
@@ skipping 29 matching lines @@
   if (result < 0)
     return result;
 
   next_state_ = STATE_HTTP_PROXY_CONNECT_COMPLETE;
   transport_socket_.reset(
       new SpdyProxyClientSocket(spdy_stream_,
                                 params_->user_agent(),
                                 params_->endpoint(),
                                 params_->request_url(),
                                 params_->destination().host_port_pair(),
-                                params_->http_auth_cache(),
-                                params_->http_auth_handler_factory()));
+                                auth_));
   return transport_socket_->Connect(callback_);
 }
 
 int HttpProxyConnectJob::ConnectInternal() {
   if (params_->transport_params())
     next_state_ = STATE_TCP_CONNECT;
   else
     next_state_ = STATE_SSL_CONNECT;
   return DoLoop(OK);
 }
@@ skipping 165 matching lines @@
   return base_.histograms();
 }
 
 bool HttpProxyClientSocketPool::CloseOneIdleConnection() {
   if (base_.CloseOneIdleSocket())
     return true;
   return base_.CloseOneIdleConnectionInLayeredPool();
 }
 
 }  // namespace net