Allow dynamic updating of authentication policies

net/http/http_auth_handler_negotiate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_negotiate.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
 #include "net/base/address_family.h"
 #include "net/base/net_errors.h"
 #include "net/dns/host_resolver.h"
 #include "net/dns/single_request_host_resolver.h"
 #include "net/http/http_auth_filter.h"
-#include "net/http/url_security_manager.h"
+#include "net/http/http_auth_preferences.h"
 
 namespace net {
 
 HttpAuthHandlerNegotiate::Factory::Factory()
-    : disable_cname_lookup_(false),
-      use_port_(false),
-      resolver_(NULL),
+    : resolver_(NULL),
 #if defined(OS_WIN)
       max_token_length_(0),
 #endif
       is_unsupported_(false) {
 }
 
 HttpAuthHandlerNegotiate::Factory::~Factory() {
 }
 
 void HttpAuthHandlerNegotiate::Factory::set_host_resolver(
@@ skipping 17 matching lines @@
                                      &max_token_length_);
     if (rv == ERR_UNSUPPORTED_AUTH_SCHEME)
       is_unsupported_ = true;
     if (rv != OK)
       return rv;
   }
   // TODO(cbentzel): Move towards model of parsing in the factory
   //                 method and only constructing when valid.
   scoped_ptr<HttpAuthHandler> tmp_handler(
       new HttpAuthHandlerNegotiate(auth_library_.get(), max_token_length_,
-                                   url_security_manager(), resolver_,
-                                   disable_cname_lookup_, use_port_));
+                                   http_auth_preferences(), resolver_));
 #elif defined(OS_ANDROID)
-  if (is_unsupported_ || auth_library_->empty() || reason == CREATE_PREEMPTIVE)
+  if (is_unsupported_ || !http_auth_preferences() ||
+      http_auth_preferences()->AuthAndroidNegotiateAccountType().empty() ||
+      reason == CREATE_PREEMPTIVE)
     return ERR_UNSUPPORTED_AUTH_SCHEME;
   // TODO(cbentzel): Move towards model of parsing in the factory
   //                 method and only constructing when valid.
-  scoped_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNegotiate(
-      auth_library_.get(), url_security_manager(), resolver_,
-      disable_cname_lookup_, use_port_));
+  scoped_ptr<HttpAuthHandler> tmp_handler(
+      new HttpAuthHandlerNegotiate(http_auth_preferences(), resolver_));
 #elif defined(OS_POSIX)
   if (is_unsupported_)
     return ERR_UNSUPPORTED_AUTH_SCHEME;
   if (!auth_library_->Init()) {
     is_unsupported_ = true;
     return ERR_UNSUPPORTED_AUTH_SCHEME;
   }
   // TODO(ahendrickson): Move towards model of parsing in the factory
   //                     method and only constructing when valid.
-  scoped_ptr<HttpAuthHandler> tmp_handler(
-      new HttpAuthHandlerNegotiate(auth_library_.get(), url_security_manager(),
-                                   resolver_, disable_cname_lookup_,
-                                   use_port_));
+  scoped_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNegotiate(
+      auth_library_.get(), http_auth_preferences(), resolver_));
 #endif
   if (!tmp_handler->InitFromChallenge(challenge, target, origin, net_log))
     return ERR_INVALID_RESPONSE;
   handler->swap(tmp_handler);
   return OK;
 }
 
 HttpAuthHandlerNegotiate::HttpAuthHandlerNegotiate(
+#if !defined(OS_ANDROID)
     AuthLibrary* auth_library,
+#endif
 #if defined(OS_WIN)
     ULONG max_token_length,
 #endif
-    URLSecurityManager* url_security_manager,
-    HostResolver* resolver,
-    bool disable_cname_lookup,
-    bool use_port)
+    const HttpAuthPreferences* prefs,
+    HostResolver* resolver)
 #if defined(OS_ANDROID)
-    : auth_system_(*auth_library),
+    : auth_system_(prefs),
 #elif defined(OS_WIN)
     : auth_system_(auth_library, "Negotiate", NEGOSSP_NAME, max_token_length),
 #elif defined(OS_POSIX)
     : auth_system_(auth_library, "Negotiate", CHROME_GSS_SPNEGO_MECH_OID_DESC),
 #endif
-      disable_cname_lookup_(disable_cname_lookup),
-      use_port_(use_port),
       resolver_(resolver),
       already_called_(false),
       has_credentials_(false),
       auth_token_(NULL),
       next_state_(STATE_NONE),
-      url_security_manager_(url_security_manager) {
+      http_auth_preferences_(prefs) {
 }
 
 HttpAuthHandlerNegotiate::~HttpAuthHandlerNegotiate() {
 }
 
-std::string HttpAuthHandlerNegotiate::CreateSPN(
-    const AddressList& address_list, const GURL& origin) {
+std::string HttpAuthHandlerNegotiate::CreateSPN(const AddressList& address_list,
+                                                const GURL& origin) {
   // Kerberos Web Server SPNs are in the form HTTP/<host>:<port> through SSPI,
   // and in the form HTTP@<host>:<port> through GSSAPI
   //   http://msdn.microsoft.com/en-us/library/ms677601%28VS.85%29.aspx
   //
   // However, reality differs from the specification. A good description of
   // the problems can be found here:
   //   http://blog.michelbarneveld.nl/michel/archive/2009/11/14/the-reason-why-kb911149-and-kb908209-are-not-the-soluton.aspx
   //
   // Typically the <host> portion should be the canonical FQDN for the service.
   // If this could not be resolved, the original hostname in the URL will be
@@ skipping 18 matching lines @@
   // non-standard ports are included.
   int port = origin.EffectiveIntPort();
   std::string server = address_list.canonical_name();
   if (server.empty())
     server = origin.host();
 #if defined(OS_WIN)
   static const char kSpnSeparator = '/';
 #elif defined(OS_POSIX)
   static const char kSpnSeparator = '@';
 #endif
-  if (port != 80 && port != 443 && use_port_) {
+  if (port != 80 && port != 443 &&
+      (!http_auth_preferences_ ||

[asanka, 2015/12/01 05:30:03]

use_port_ was defaulting to false everywhere. Why default to true here?

[aberent, 2015/12/01 14:33:25]

Done.

+       http_auth_preferences_->NegotiateEnablePort())) {
     return base::StringPrintf("HTTP%c%s:%d", kSpnSeparator, server.c_str(),
                               port);
   } else {
     return base::StringPrintf("HTTP%c%s", kSpnSeparator, server.c_str());
   }
 }
 
 HttpAuth::AuthorizationResult HttpAuthHandlerNegotiate::HandleAnotherChallenge(
     HttpAuthChallengeTokenizer* challenge) {
   return auth_system_.ParseChallenge(challenge);
 }
 
 // Require identity on first pass instead of second.
 bool HttpAuthHandlerNegotiate::NeedsIdentity() {
   return auth_system_.NeedsIdentity();
 }
 
 bool HttpAuthHandlerNegotiate::AllowsDefaultCredentials() {
   if (target_ == HttpAuth::AUTH_PROXY)
     return true;
-  if (!url_security_manager_)
+  if (!http_auth_preferences_)
     return false;
-  return url_security_manager_->CanUseDefaultCredentials(origin_);
+  return http_auth_preferences_->CanUseDefaultCredentials(origin_);
 }
 
 bool HttpAuthHandlerNegotiate::AllowsExplicitCredentials() {
   return auth_system_.AllowsExplicitCredentials();
 }
 
 // The Negotiate challenge header looks like:
 //   WWW-Authenticate: NEGOTIATE auth-data
 bool HttpAuthHandlerNegotiate::Init(HttpAuthChallengeTokenizer* challenge) {
 #if defined(OS_POSIX)
@@ skipping 83 matching lines @@
         rv = ERR_FAILED;
         break;
     }
   } while (rv != ERR_IO_PENDING && next_state_ != STATE_NONE);
 
   return rv;
 }
 
 int HttpAuthHandlerNegotiate::DoResolveCanonicalName() {
   next_state_ = STATE_RESOLVE_CANONICAL_NAME_COMPLETE;
-  if (disable_cname_lookup_ || !resolver_)
+  if ((http_auth_preferences_ &&
+       http_auth_preferences_->NegotiateDisableCnameLookup()) ||
+      !resolver_)
     return OK;
 
   // TODO(cbentzel): Add reverse DNS lookup for numeric addresses.
   DCHECK(!single_resolve_.get());
   HostResolver::RequestInfo info(HostPortPair(origin_.host(), 0));
   info.set_host_resolver_flags(HOST_RESOLVER_CANONNAME);
   single_resolve_.reset(new SingleRequestHostResolver(resolver_));
   return single_resolve_->Resolve(
       info,
       DEFAULT_PRIORITY,
@@ skipping 31 matching lines @@
 int HttpAuthHandlerNegotiate::DoGenerateAuthTokenComplete(int rv) {
   DCHECK_NE(ERR_IO_PENDING, rv);
   auth_token_ = NULL;
   return rv;
 }
 
 bool HttpAuthHandlerNegotiate::CanDelegate() const {
   // TODO(cbentzel): Should delegation be allowed on proxies?
   if (target_ == HttpAuth::AUTH_PROXY)
     return false;
-  if (!url_security_manager_)
+  if (!http_auth_preferences_)
     return false;
-  return url_security_manager_->CanDelegate(origin_);
+  return http_auth_preferences_->CanDelegate(origin_);
 }
 
 }  // namespace net