| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "net/http/http_auth_controller.h" | 5 #include "net/http/http_auth_controller.h" |
| 6 | 6 |
| 7 #include "base/bind.h" | 7 #include "base/bind.h" |
| 8 #include "base/bind_helpers.h" | 8 #include "base/bind_helpers.h" |
| 9 #include "base/metrics/histogram_macros.h" | 9 #include "base/metrics/histogram_macros.h" |
| 10 #include "base/strings/string_util.h" | 10 #include "base/strings/string_util.h" |
| (...skipping 120 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 131 auth_url_(auth_url), | 131 auth_url_(auth_url), |
| 132 auth_origin_(auth_url.GetOrigin()), | 132 auth_origin_(auth_url.GetOrigin()), |
| 133 auth_path_(HttpAuth::AUTH_PROXY ? std::string() : auth_url.path()), | 133 auth_path_(HttpAuth::AUTH_PROXY ? std::string() : auth_url.path()), |
| 134 embedded_identity_used_(false), | 134 embedded_identity_used_(false), |
| 135 default_credentials_used_(false), | 135 default_credentials_used_(false), |
| 136 http_auth_cache_(http_auth_cache), | 136 http_auth_cache_(http_auth_cache), |
| 137 http_auth_handler_factory_(http_auth_handler_factory) { | 137 http_auth_handler_factory_(http_auth_handler_factory) { |
| 138 } | 138 } |
| 139 | 139 |
| 140 HttpAuthController::~HttpAuthController() { | 140 HttpAuthController::~HttpAuthController() { |
| 141 DCHECK(CalledOnValidThread()); | 141 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 142 } | 142 } |
| 143 | 143 |
| 144 int HttpAuthController::MaybeGenerateAuthToken( | 144 int HttpAuthController::MaybeGenerateAuthToken( |
| 145 const HttpRequestInfo* request, | 145 const HttpRequestInfo* request, |
| 146 const CompletionCallback& callback, | 146 const CompletionCallback& callback, |
| 147 const NetLogWithSource& net_log) { | 147 const NetLogWithSource& net_log) { |
| 148 DCHECK(CalledOnValidThread()); | 148 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 149 DCHECK(!auth_info_); | 149 DCHECK(!auth_info_); |
| 150 bool needs_auth = HaveAuth() || SelectPreemptiveAuth(net_log); | 150 bool needs_auth = HaveAuth() || SelectPreemptiveAuth(net_log); |
| 151 if (!needs_auth) | 151 if (!needs_auth) |
| 152 return OK; | 152 return OK; |
| 153 const AuthCredentials* credentials = NULL; | 153 const AuthCredentials* credentials = NULL; |
| 154 if (identity_.source != HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS) | 154 if (identity_.source != HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS) |
| 155 credentials = &identity_.credentials; | 155 credentials = &identity_.credentials; |
| 156 DCHECK(auth_token_.empty()); | 156 DCHECK(auth_token_.empty()); |
| 157 DCHECK(callback_.is_null()); | 157 DCHECK(callback_.is_null()); |
| 158 int rv = handler_->GenerateAuthToken( | 158 int rv = handler_->GenerateAuthToken( |
| 159 credentials, request, | 159 credentials, request, |
| 160 base::Bind(&HttpAuthController::OnGenerateAuthTokenDone, | 160 base::Bind(&HttpAuthController::OnGenerateAuthTokenDone, |
| 161 base::Unretained(this)), | 161 base::Unretained(this)), |
| 162 &auth_token_); | 162 &auth_token_); |
| 163 | 163 |
| 164 if (rv == ERR_IO_PENDING) { | 164 if (rv == ERR_IO_PENDING) { |
| 165 callback_ = callback; | 165 callback_ = callback; |
| 166 return rv; | 166 return rv; |
| 167 } | 167 } |
| 168 | 168 |
| 169 return HandleGenerateTokenResult(rv); | 169 return HandleGenerateTokenResult(rv); |
| 170 } | 170 } |
| 171 | 171 |
| 172 bool HttpAuthController::SelectPreemptiveAuth(const NetLogWithSource& net_log) { | 172 bool HttpAuthController::SelectPreemptiveAuth(const NetLogWithSource& net_log) { |
| 173 DCHECK(CalledOnValidThread()); | 173 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 174 DCHECK(!HaveAuth()); | 174 DCHECK(!HaveAuth()); |
| 175 DCHECK(identity_.invalid); | 175 DCHECK(identity_.invalid); |
| 176 | 176 |
| 177 // Don't do preemptive authorization if the URL contains a username:password, | 177 // Don't do preemptive authorization if the URL contains a username:password, |
| 178 // since we must first be challenged in order to use the URL's identity. | 178 // since we must first be challenged in order to use the URL's identity. |
| 179 if (auth_url_.has_username()) | 179 if (auth_url_.has_username()) |
| 180 return false; | 180 return false; |
| 181 | 181 |
| 182 // SelectPreemptiveAuth() is on the critical path for each request, so it | 182 // SelectPreemptiveAuth() is on the critical path for each request, so it |
| 183 // is expected to be fast. LookupByPath() is fast in the common case, since | 183 // is expected to be fast. LookupByPath() is fast in the common case, since |
| (...skipping 17 matching lines...) Expand all Loading... |
| 201 // Set the state | 201 // Set the state |
| 202 identity_.source = HttpAuth::IDENT_SRC_PATH_LOOKUP; | 202 identity_.source = HttpAuth::IDENT_SRC_PATH_LOOKUP; |
| 203 identity_.invalid = false; | 203 identity_.invalid = false; |
| 204 identity_.credentials = entry->credentials(); | 204 identity_.credentials = entry->credentials(); |
| 205 handler_.swap(handler_preemptive); | 205 handler_.swap(handler_preemptive); |
| 206 return true; | 206 return true; |
| 207 } | 207 } |
| 208 | 208 |
| 209 void HttpAuthController::AddAuthorizationHeader( | 209 void HttpAuthController::AddAuthorizationHeader( |
| 210 HttpRequestHeaders* authorization_headers) { | 210 HttpRequestHeaders* authorization_headers) { |
| 211 DCHECK(CalledOnValidThread()); | 211 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 212 DCHECK(HaveAuth()); | 212 DCHECK(HaveAuth()); |
| 213 // auth_token_ can be empty if we encountered a permanent error with | 213 // auth_token_ can be empty if we encountered a permanent error with |
| 214 // the auth scheme and want to retry. | 214 // the auth scheme and want to retry. |
| 215 if (!auth_token_.empty()) { | 215 if (!auth_token_.empty()) { |
| 216 authorization_headers->SetHeader( | 216 authorization_headers->SetHeader( |
| 217 HttpAuth::GetAuthorizationHeaderName(target_), auth_token_); | 217 HttpAuth::GetAuthorizationHeaderName(target_), auth_token_); |
| 218 auth_token_.clear(); | 218 auth_token_.clear(); |
| 219 } | 219 } |
| 220 } | 220 } |
| 221 | 221 |
| 222 int HttpAuthController::HandleAuthChallenge( | 222 int HttpAuthController::HandleAuthChallenge( |
| 223 scoped_refptr<HttpResponseHeaders> headers, | 223 scoped_refptr<HttpResponseHeaders> headers, |
| 224 const SSLInfo& ssl_info, | 224 const SSLInfo& ssl_info, |
| 225 bool do_not_send_server_auth, | 225 bool do_not_send_server_auth, |
| 226 bool establishing_tunnel, | 226 bool establishing_tunnel, |
| 227 const NetLogWithSource& net_log) { | 227 const NetLogWithSource& net_log) { |
| 228 DCHECK(CalledOnValidThread()); | 228 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 229 DCHECK(headers.get()); | 229 DCHECK(headers.get()); |
| 230 DCHECK(auth_origin_.is_valid()); | 230 DCHECK(auth_origin_.is_valid()); |
| 231 DCHECK(!auth_info_); | 231 DCHECK(!auth_info_); |
| 232 | 232 |
| 233 // Give the existing auth handler first try at the authentication headers. | 233 // Give the existing auth handler first try at the authentication headers. |
| 234 // This will also evict the entry in the HttpAuthCache if the previous | 234 // This will also evict the entry in the HttpAuthCache if the previous |
| 235 // challenge appeared to be rejected, or is using a stale nonce in the Digest | 235 // challenge appeared to be rejected, or is using a stale nonce in the Digest |
| 236 // case. | 236 // case. |
| 237 if (HaveAuth()) { | 237 if (HaveAuth()) { |
| 238 std::string challenge_used; | 238 std::string challenge_used; |
| (...skipping 93 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 332 // If we get here and we don't have a handler_, that's because we | 332 // If we get here and we don't have a handler_, that's because we |
| 333 // invalidated it due to not having any viable identities to use with it. Go | 333 // invalidated it due to not having any viable identities to use with it. Go |
| 334 // back and try again. | 334 // back and try again. |
| 335 // TODO(asanka): Instead we should create a priority list of | 335 // TODO(asanka): Instead we should create a priority list of |
| 336 // <handler,identity> and iterate through that. | 336 // <handler,identity> and iterate through that. |
| 337 } while(!handler_.get()); | 337 } while(!handler_.get()); |
| 338 return OK; | 338 return OK; |
| 339 } | 339 } |
| 340 | 340 |
| 341 void HttpAuthController::ResetAuth(const AuthCredentials& credentials) { | 341 void HttpAuthController::ResetAuth(const AuthCredentials& credentials) { |
| 342 DCHECK(CalledOnValidThread()); | 342 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 343 DCHECK(identity_.invalid || credentials.Empty()); | 343 DCHECK(identity_.invalid || credentials.Empty()); |
| 344 | 344 |
| 345 if (identity_.invalid) { | 345 if (identity_.invalid) { |
| 346 // Update the credentials. | 346 // Update the credentials. |
| 347 identity_.source = HttpAuth::IDENT_SRC_EXTERNAL; | 347 identity_.source = HttpAuth::IDENT_SRC_EXTERNAL; |
| 348 identity_.invalid = false; | 348 identity_.invalid = false; |
| 349 identity_.credentials = credentials; | 349 identity_.credentials = credentials; |
| 350 | 350 |
| 351 // auth_info_ is no longer necessary. | 351 // auth_info_ is no longer necessary. |
| 352 auth_info_ = nullptr; | 352 auth_info_ = nullptr; |
| (...skipping 30 matching lines...) Expand all Loading... |
| 383 bool HttpAuthController::HaveAuthHandler() const { | 383 bool HttpAuthController::HaveAuthHandler() const { |
| 384 return handler_.get() != NULL; | 384 return handler_.get() != NULL; |
| 385 } | 385 } |
| 386 | 386 |
| 387 bool HttpAuthController::HaveAuth() const { | 387 bool HttpAuthController::HaveAuth() const { |
| 388 return handler_.get() && !identity_.invalid; | 388 return handler_.get() && !identity_.invalid; |
| 389 } | 389 } |
| 390 | 390 |
| 391 void HttpAuthController::InvalidateCurrentHandler( | 391 void HttpAuthController::InvalidateCurrentHandler( |
| 392 InvalidateHandlerAction action) { | 392 InvalidateHandlerAction action) { |
| 393 DCHECK(CalledOnValidThread()); | 393 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 394 DCHECK(handler_.get()); | 394 DCHECK(handler_.get()); |
| 395 | 395 |
| 396 if (action == INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS) | 396 if (action == INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS) |
| 397 InvalidateRejectedAuthFromCache(); | 397 InvalidateRejectedAuthFromCache(); |
| 398 if (action == INVALIDATE_HANDLER_AND_DISABLE_SCHEME) | 398 if (action == INVALIDATE_HANDLER_AND_DISABLE_SCHEME) |
| 399 DisableAuthScheme(handler_->auth_scheme()); | 399 DisableAuthScheme(handler_->auth_scheme()); |
| 400 handler_.reset(); | 400 handler_.reset(); |
| 401 identity_ = HttpAuth::Identity(); | 401 identity_ = HttpAuth::Identity(); |
| 402 } | 402 } |
| 403 | 403 |
| 404 void HttpAuthController::InvalidateRejectedAuthFromCache() { | 404 void HttpAuthController::InvalidateRejectedAuthFromCache() { |
| 405 DCHECK(CalledOnValidThread()); | 405 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 406 DCHECK(HaveAuth()); | 406 DCHECK(HaveAuth()); |
| 407 | 407 |
| 408 // Clear the cache entry for the identity we just failed on. | 408 // Clear the cache entry for the identity we just failed on. |
| 409 // Note: we require the credentials to match before invalidating | 409 // Note: we require the credentials to match before invalidating |
| 410 // since the entry in the cache may be newer than what we used last time. | 410 // since the entry in the cache may be newer than what we used last time. |
| 411 http_auth_cache_->Remove(auth_origin_, handler_->realm(), | 411 http_auth_cache_->Remove(auth_origin_, handler_->realm(), |
| 412 handler_->auth_scheme(), identity_.credentials); | 412 handler_->auth_scheme(), identity_.credentials); |
| 413 } | 413 } |
| 414 | 414 |
| 415 bool HttpAuthController::SelectNextAuthIdentityToTry() { | 415 bool HttpAuthController::SelectNextAuthIdentityToTry() { |
| 416 DCHECK(CalledOnValidThread()); | 416 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 417 DCHECK(handler_.get()); | 417 DCHECK(handler_.get()); |
| 418 DCHECK(identity_.invalid); | 418 DCHECK(identity_.invalid); |
| 419 | 419 |
| 420 // Try to use the username:password encoded into the URL first. | 420 // Try to use the username:password encoded into the URL first. |
| 421 if (target_ == HttpAuth::AUTH_SERVER && auth_url_.has_username() && | 421 if (target_ == HttpAuth::AUTH_SERVER && auth_url_.has_username() && |
| 422 !embedded_identity_used_) { | 422 !embedded_identity_used_) { |
| 423 identity_.source = HttpAuth::IDENT_SRC_URL; | 423 identity_.source = HttpAuth::IDENT_SRC_URL; |
| 424 identity_.invalid = false; | 424 identity_.invalid = false; |
| 425 // Extract the username:password from the URL. | 425 // Extract the username:password from the URL. |
| 426 base::string16 username; | 426 base::string16 username; |
| (...skipping 28 matching lines...) Expand all Loading... |
| 455 identity_.source = HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS; | 455 identity_.source = HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS; |
| 456 identity_.invalid = false; | 456 identity_.invalid = false; |
| 457 default_credentials_used_ = true; | 457 default_credentials_used_ = true; |
| 458 return true; | 458 return true; |
| 459 } | 459 } |
| 460 | 460 |
| 461 return false; | 461 return false; |
| 462 } | 462 } |
| 463 | 463 |
| 464 void HttpAuthController::PopulateAuthChallenge() { | 464 void HttpAuthController::PopulateAuthChallenge() { |
| 465 DCHECK(CalledOnValidThread()); | 465 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 466 | 466 |
| 467 // Populates response_.auth_challenge with the authentication challenge info. | 467 // Populates response_.auth_challenge with the authentication challenge info. |
| 468 // This info is consumed by URLRequestHttpJob::GetAuthChallengeInfo(). | 468 // This info is consumed by URLRequestHttpJob::GetAuthChallengeInfo(). |
| 469 | 469 |
| 470 auth_info_ = new AuthChallengeInfo; | 470 auth_info_ = new AuthChallengeInfo; |
| 471 auth_info_->is_proxy = (target_ == HttpAuth::AUTH_PROXY); | 471 auth_info_->is_proxy = (target_ == HttpAuth::AUTH_PROXY); |
| 472 auth_info_->challenger = url::Origin(auth_origin_); | 472 auth_info_->challenger = url::Origin(auth_origin_); |
| 473 auth_info_->scheme = HttpAuth::SchemeToString(handler_->auth_scheme()); | 473 auth_info_->scheme = HttpAuth::SchemeToString(handler_->auth_scheme()); |
| 474 auth_info_->realm = handler_->realm(); | 474 auth_info_->realm = handler_->realm(); |
| 475 } | 475 } |
| 476 | 476 |
| 477 int HttpAuthController::HandleGenerateTokenResult(int result) { | 477 int HttpAuthController::HandleGenerateTokenResult(int result) { |
| 478 DCHECK(CalledOnValidThread()); | 478 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 479 switch (result) { | 479 switch (result) { |
| 480 // Occurs if the credential handle is found to be invalid at the point it is | 480 // Occurs if the credential handle is found to be invalid at the point it is |
| 481 // exercised (i.e. GenerateAuthToken stage). We are going to consider this | 481 // exercised (i.e. GenerateAuthToken stage). We are going to consider this |
| 482 // to be an error that invalidates the identity but not necessarily the | 482 // to be an error that invalidates the identity but not necessarily the |
| 483 // scheme. Doing so allows a different identity to be used with the same | 483 // scheme. Doing so allows a different identity to be used with the same |
| 484 // scheme. See https://crbug.com/648366. | 484 // scheme. See https://crbug.com/648366. |
| 485 case ERR_INVALID_HANDLE: | 485 case ERR_INVALID_HANDLE: |
| 486 | 486 |
| 487 // If the GenerateAuthToken call fails with this error, this means that the | 487 // If the GenerateAuthToken call fails with this error, this means that the |
| 488 // handler can no longer be used. However, the authentication scheme is | 488 // handler can no longer be used. However, the authentication scheme is |
| (...skipping 28 matching lines...) Expand all Loading... |
| 517 InvalidateCurrentHandler(INVALIDATE_HANDLER_AND_DISABLE_SCHEME); | 517 InvalidateCurrentHandler(INVALIDATE_HANDLER_AND_DISABLE_SCHEME); |
| 518 auth_token_.clear(); | 518 auth_token_.clear(); |
| 519 return OK; | 519 return OK; |
| 520 | 520 |
| 521 default: | 521 default: |
| 522 return result; | 522 return result; |
| 523 } | 523 } |
| 524 } | 524 } |
| 525 | 525 |
| 526 void HttpAuthController::OnGenerateAuthTokenDone(int result) { | 526 void HttpAuthController::OnGenerateAuthTokenDone(int result) { |
| 527 DCHECK(CalledOnValidThread()); | 527 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 528 result = HandleGenerateTokenResult(result); | 528 result = HandleGenerateTokenResult(result); |
| 529 if (!callback_.is_null()) { | 529 if (!callback_.is_null()) { |
| 530 CompletionCallback c = callback_; | 530 CompletionCallback c = callback_; |
| 531 callback_.Reset(); | 531 callback_.Reset(); |
| 532 c.Run(result); | 532 c.Run(result); |
| 533 } | 533 } |
| 534 } | 534 } |
| 535 | 535 |
| 536 scoped_refptr<AuthChallengeInfo> HttpAuthController::auth_info() { | 536 scoped_refptr<AuthChallengeInfo> HttpAuthController::auth_info() { |
| 537 DCHECK(CalledOnValidThread()); | 537 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 538 return auth_info_; | 538 return auth_info_; |
| 539 } | 539 } |
| 540 | 540 |
| 541 bool HttpAuthController::IsAuthSchemeDisabled(HttpAuth::Scheme scheme) const { | 541 bool HttpAuthController::IsAuthSchemeDisabled(HttpAuth::Scheme scheme) const { |
| 542 DCHECK(CalledOnValidThread()); | 542 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 543 return disabled_schemes_.find(scheme) != disabled_schemes_.end(); | 543 return disabled_schemes_.find(scheme) != disabled_schemes_.end(); |
| 544 } | 544 } |
| 545 | 545 |
| 546 void HttpAuthController::DisableAuthScheme(HttpAuth::Scheme scheme) { | 546 void HttpAuthController::DisableAuthScheme(HttpAuth::Scheme scheme) { |
| 547 DCHECK(CalledOnValidThread()); | 547 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 548 disabled_schemes_.insert(scheme); | 548 disabled_schemes_.insert(scheme); |
| 549 } | 549 } |
| 550 | 550 |
| 551 void HttpAuthController::DisableEmbeddedIdentity() { | 551 void HttpAuthController::DisableEmbeddedIdentity() { |
| 552 DCHECK(CalledOnValidThread()); | 552 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 553 embedded_identity_used_ = true; | 553 embedded_identity_used_ = true; |
| 554 } | 554 } |
| 555 | 555 |
| 556 void HttpAuthController::OnConnectionClosed() { | 556 void HttpAuthController::OnConnectionClosed() { |
| 557 DCHECK(CalledOnValidThread()); | 557 DCHECK_CALLED_ON_VALID_THREAD(thread_checker_); |
| 558 InvalidateCurrentHandler(INVALIDATE_HANDLER); | 558 InvalidateCurrentHandler(INVALIDATE_HANDLER); |
| 559 } | 559 } |
| 560 | 560 |
| 561 } // namespace net | 561 } // namespace net |
| OLD | NEW |