Add support for digest authentication of HTTP proxies

sdk/lib/io/http_impl.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.io;
 
 class _HttpIncoming extends Stream<List<int>> {
   final int _transferLength;
   final Completer _dataCompleter = new Completer();
   Stream<List<int>> _stream;
@@ skipping 363 matching lines @@
         _HeaderValue.parse(challenge[0], parameterSeparator: ",");
     _AuthenticationScheme scheme =
         new _AuthenticationScheme.fromString(header.value);
     String realm = header.parameters["realm"];
 
     // See if any credentials are available.
     var proxy = _httpRequest._proxy;
 
     var cr =  _httpClient._findProxyCredentials(proxy);
     if (cr != null) {
-      return retryWithProxyCredentials(cr);
+      if (cr.scheme == _AuthenticationScheme.BASIC) {
+        return retryWithProxyCredentials(cr);
+      }
+
+      // Digest authentication only supports the MD5 algorithm.
+      if (cr.scheme == _AuthenticationScheme.DIGEST &&
+          (header.parameters["algorithm"] == null ||
+           header.parameters["algorithm"].toLowerCase() == "md5")) {
+        if (cr.nonce == null || cr.nonce == header.parameters["nonce"]) {
+          // If the nonce is not set then this is the first authenticate
+          // response for these credentials. Set up authentication state.
+          if (cr.nonce == null) {
+            cr.nonce = header.parameters["nonce"];
+            cr.algorithm = "MD5";
+            cr.qop = header.parameters["qop"];
+            cr.nonceCount = 0;
+          }
+          // Credentials where found, prepare for retrying the request.
+          return retryWithProxyCredentials(cr);
+        } else if (header.parameters["stale"] != null &&
+                   header.parameters["stale"].toLowerCase() == "true") {
+          // If stale is true retry with new nonce.
+          cr.nonce = header.parameters["nonce"];
+          // Credentials where found, prepare for retrying the request.
+          return retryWithProxyCredentials(cr);
+        }
+      }
     }
 
     // Ask for more credentials if none found.
     if (_httpClient._authenticateProxy != null) {
       Future authComplete = _httpClient._authenticateProxy(proxy.host,
                                                            proxy.port,
                                                            "basic",
                                                            realm);
       return authComplete.then((credsAvailable) {
         if (credsAvailable) {
@@ skipping 723 matching lines @@
           }
         },
         onDone: () {
           close();
         });
   }
 
   _HttpClientRequest send(Uri uri, int port, String method, _Proxy proxy) {
     // Start with pausing the parser.
     _subscription.pause();
-    _Credentials cr;  // Credentials used to authorize this request.
+    _ProxyCredentials proxyCreds;  // Credentials used to authorize proxy.
+    _SiteCredentials creds;  // Credentials used to authorize this request.
     var outgoing = new _HttpOutgoing(_socket);
     // Create new request object, wrapping the outgoing connection.
     var request = new _HttpClientRequest(outgoing,
                                          uri,
                                          method,
                                          proxy,
                                          _httpClient,
                                          this);
     request.headers.host = uri.domain;
     request.headers.port = port;
     request.headers.set(HttpHeaders.ACCEPT_ENCODING, "gzip");
     if (proxy.isAuthenticated) {
       // If the proxy configuration contains user information use that
       // for proxy basic authorization.
       String auth = CryptoUtils.bytesToBase64(
           _encodeString("${proxy.username}:${proxy.password}"));
       request.headers.set(HttpHeaders.PROXY_AUTHORIZATION, "Basic $auth");
     } else if (!proxy.isDirect && _httpClient._proxyCredentials.length > 0) {
-      var cr =  _httpClient._findProxyCredentials(proxy);
-      if (cr != null) {
-        cr.authorize(request);
+      proxyCreds = _httpClient._findProxyCredentials(proxy);
+      if (proxyCreds != null) {
+        proxyCreds.authorize(request);
       }
     }
     if (uri.userInfo != null && !uri.userInfo.isEmpty) {
       // If the URL contains user information use that for basic
       // authorization.
       String auth =
           CryptoUtils.bytesToBase64(_encodeString(uri.userInfo));
       request.headers.set(HttpHeaders.AUTHORIZATION, "Basic $auth");
     } else {
       // Look for credentials.
-      cr = _httpClient._findCredentials(uri);
-      if (cr != null) {
-        cr.authorize(request);
+      creds = _httpClient._findCredentials(uri);
+      if (creds != null) {
+        creds.authorize(request);
       }
     }
     // Start sending the request (lazy, delayed until the user provides
     // data).
     _httpParser.responseToMethod = method;
     _streamFuture = outgoing.done
         .then((s) {
           // Request sent, set up response completer.
           _nextResponseCompleter = new Completer();
 
           // Listen for response.
           _nextResponseCompleter.future
               .then((incoming) {
                 incoming.dataDone.then((_) {
                   if (!_dispose &&
                       incoming.headers.persistentConnection &&
                       request.persistentConnection) {
                     // Return connection, now we are done.
                     _httpClient._returnConnection(this);
                     _subscription.resume();
                   } else {
                     destroy();
                   }
                 });
-                // For digest authentication check if the server
-                // requests the client to start using a new nonce.
-                if (cr != null && cr.scheme == _AuthenticationScheme.DIGEST) {
+                // For digest authentication if proxy check if the proxy
+                // requests the client to start using a new nonce for proxy
+                // authentication.
+                if (proxyCreds != null &&
+                    proxyCreds.scheme == _AuthenticationScheme.DIGEST) {
+                  var authInfo = incoming.headers["proxy-authentication-info"];
+                  if (authInfo != null && authInfo.length == 1) {
+                    var header =
+                        _HeaderValue.parse(
+                            authInfo[0], parameterSeparator: ',');
+                    var nextnonce = header.parameters["nextnonce"];
+                    if (nextnonce != null) proxyCreds.nonce = nextnonce;
+                  }
+                }
+                // For digest authentication check if the server requests the
+                // client to start using a new nonce.
+                if (creds != null &&
+                    creds.scheme == _AuthenticationScheme.DIGEST) {
                   var authInfo = incoming.headers["authentication-info"];
                   if (authInfo != null && authInfo.length == 1) {
                     var header =
                         _HeaderValue.parse(
                             authInfo[0], parameterSeparator: ',');
                     var nextnonce = header.parameters["nextnonce"];
-                    if (nextnonce != null) cr.nonce = nextnonce;
+                    if (nextnonce != null) creds.nonce = nextnonce;
                   }
                 }
                 request._onIncoming(incoming);
               })
               // If we see a state error, we failed to get the 'first'
               // element.
               // Transform the error to a HttpParserException, for
               // consistency.
               .catchError((error) {
                 throw new HttpParserException(
@@ skipping 811 matching lines @@
   String realm;
   bool used = false;
 
   // Digest specific fields.
   String ha1;
   String nonce;
   String algorithm;
   String qop;
   int nonceCount;
 
-  _Credentials(this.realm, this.credentials) {
+  _Credentials(this.credentials, this.realm) {
     if (credentials.scheme == _AuthenticationScheme.DIGEST) {
       // Calculate the H(A1) value once. There is no mentioning of
       // username/password encoding in RFC 2617. However there is an
       // open draft for adding an additional accept-charset parameter to
       // the WWW-Authenticate and Proxy-Authenticate headers, see
       // http://tools.ietf.org/html/draft-reschke-basicauth-enc-06. For
       // now always use UTF-8 encoding.
       _HttpClientDigestCredentials creds = credentials;
       var hasher = new MD5();
       hasher.add(_encodeString(creds.username));
       hasher.add([_CharCode.COLON]);
       hasher.add(realm.codeUnits);
       hasher.add([_CharCode.COLON]);
       hasher.add(_encodeString(creds.password));
       ha1 = CryptoUtils.bytesToHex(hasher.close());
     }
   }
 
   _AuthenticationScheme get scheme => credentials.scheme;
 
   void authorize(HttpClientRequest request);
 }
 
 class _SiteCredentials extends _Credentials {
   Uri uri;
 
   _SiteCredentials(this.uri, realm, _HttpClientCredentials creds)
-  : super(realm, creds);
+  : super(creds, realm);
 
   bool applies(Uri uri, _AuthenticationScheme scheme) {
     if (scheme != null && credentials.scheme != scheme) return false;
     if (uri.domain != this.uri.domain) return false;
     int thisPort =
         this.uri.port == 0 ? HttpClient.DEFAULT_HTTP_PORT : this.uri.port;
     int otherPort = uri.port == 0 ? HttpClient.DEFAULT_HTTP_PORT : uri.port;
     if (otherPort != thisPort) return false;
     return uri.path.startsWith(this.uri.path);
   }
@@ skipping 12 matching lines @@
 
 
 class _ProxyCredentials extends _Credentials {
   String host;
   int port;
 
   _ProxyCredentials(this.host,
                     this.port,
                     realm,
                     _HttpClientCredentials creds)
-  : super(realm, creds);
-
+  : super(creds, realm);
 
   bool applies(_Proxy proxy, _AuthenticationScheme scheme) {
     return proxy.host == host && proxy.port == port;
   }
 
   void authorize(HttpClientRequest request) {
     // Digest credentials cannot be used without a nonce from the
     // server.
     if (credentials.scheme == _AuthenticationScheme.DIGEST &&
         nonce == null) {
@@ skipping 105 matching lines @@
     return buffer.toString();
   }
 
   void authorize(_Credentials credentials, HttpClientRequest request) {
     request.headers.set(HttpHeaders.AUTHORIZATION,
                         authorization(credentials, request));
   }
 
   void authorizeProxy(_ProxyCredentials credentials,
                       HttpClientRequest request) {
-    // TODO(sgjesse): Implement!!!
-    throw new UnsupportedError("Digest authentication not yet supported");
+    request.headers.set(HttpHeaders.PROXY_AUTHORIZATION,
+                        authorization(credentials, request));
   }
 
   String username;
   String password;
 }
 
 
 class _RedirectInfo implements RedirectInfo {
   const _RedirectInfo(int this.statusCode,
                       String this.method,
                       Uri this.location);
   final int statusCode;
   final String method;
   final Uri location;
 }