Map WebSocket URL schemes to HTTP URL schemes for auth purposes.

net/websockets/websocket_stream_test.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/websockets/websocket_stream.h"
 
 #include <algorithm>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 38 matching lines @@
 
 std::vector<HeaderKeyValuePair> ToVector(const HttpResponseHeaders& headers) {
   void* iter = NULL;
   std::string name, value;
   std::vector<HeaderKeyValuePair> result;
   while (headers.EnumerateHeaderLines(&iter, &name, &value))
     result.push_back(HeaderKeyValuePair(name, value));
   return result;
 }
 
+// Simple builder for a DeterministicSocketData object to save repetitive code.
+// It always sets the connect data to MockConnect(SYNCHRONOUS, OK), so it cannot
+// be used in tests where the connect fails. In practice, those tests never have
+// any read/write data and so can't benefit from it anyway.  The arrays are not
+// copied. It is up to the caller to ensure they stay in scope until the test
+// ends.
+template <size_t reads_count, size_t writes_count>
+scoped_ptr<DeterministicSocketData> BuildSocketData(
+    MockRead (&reads)[reads_count],
+    MockWrite (&writes)[writes_count]) {
+  scoped_ptr<DeterministicSocketData> socket_data(
+      new DeterministicSocketData(reads, reads_count, writes, writes_count));
+  socket_data->set_connect_data(MockConnect(SYNCHRONOUS, OK));
+  socket_data->SetStop(reads_count + writes_count);
+  return socket_data.Pass();
+}
+
+// Builder for a DeterministicSocketData that expects nothing. This does not
+// set the connect data, so the calling code must do that explicitly.
+scoped_ptr<DeterministicSocketData> BuildNullSocketData() {
+  return make_scoped_ptr(new DeterministicSocketData(NULL, 0, NULL, 0));
+}
+
 // A sub-class of WebSocketHandshakeStreamCreateHelper which always sets a
 // deterministic key to use in the WebSocket handshake.
 class DeterministicKeyWebSocketHandshakeStreamCreateHelper
     : public WebSocketHandshakeStreamCreateHelper {
  public:
   DeterministicKeyWebSocketHandshakeStreamCreateHelper(
       WebSocketStream::ConnectDelegate* connect_delegate,
       const std::vector<std::string>& requested_subprotocols)
       : WebSocketHandshakeStreamCreateHelper(connect_delegate,
                                              requested_subprotocols) {}
@@ skipping 35 matching lines @@
         origin,
         extra_request_headers,
         WebSocketStandardResponse(extra_response_headers));
   }
 
   void CreateAndConnectRawExpectations(
       const std::string& socket_url,
       const std::vector<std::string>& sub_protocols,
       const std::string& origin,
       scoped_ptr<DeterministicSocketData> socket_data) {
+    AddRawExpectations(socket_data.Pass());
+    CreateAndConnectStream(socket_url, sub_protocols, origin);
+  }
+
+  // Add additional raw expectations for sockets created before the final one.
+  void AddRawExpectations(scoped_ptr<DeterministicSocketData> socket_data) {
     url_request_context_host_.AddRawExpectations(socket_data.Pass());
-    CreateAndConnectStream(socket_url, sub_protocols, origin);
   }
 
   // A wrapper for CreateAndConnectStreamForTesting that knows about our default
   // parameters.
   void CreateAndConnectStream(const std::string& socket_url,
                               const std::vector<std::string>& sub_protocols,
                               const std::string& origin) {
     for (size_t i = 0; i < ssl_data_.size(); ++i) {
       scoped_ptr<SSLSocketDataProvider> ssl_data(ssl_data_[i]);
       ssl_data_[i] = NULL;
@@ skipping 34 matching lines @@
       stream.swap(owner_->stream_);
     }
 
     virtual void OnFailure(const std::string& message) OVERRIDE {
       owner_->has_failed_ = true;
       owner_->failure_message_ = message;
     }
 
     virtual void OnStartOpeningHandshake(
         scoped_ptr<WebSocketHandshakeRequestInfo> request) OVERRIDE {
-      if (owner_->request_info_)
-        ADD_FAILURE();
+      // Can be called multiple times (in the case of HTTP auth). Last call
+      // wins.
       owner_->request_info_ = request.Pass();
     }
     virtual void OnFinishOpeningHandshake(
         scoped_ptr<WebSocketHandshakeResponseInfo> response) OVERRIDE {
       if (owner_->response_info_)
         ADD_FAILURE();
       owner_->response_info_ = response.Pass();
     }
     virtual void OnSSLCertificateError(
         scoped_ptr<WebSocketEventInterface::SSLErrorCallbacks>
@@ skipping 37 matching lines @@
         "ws://localhost/testing_path",
         "/testing_path",
         NoSubProtocols(),
         "http://localhost",
         "",
         "Sec-WebSocket-Extensions: " + extensions_header_value + "\r\n");
     RunUntilIdle();
   }
 };
 
+// Common code to construct expectations for authentication tests that receive
+// the auth challenge on one connection and then create a second connection to
+// send the authenticated request on.
+class CommonAuthTestHelper {
+ public:
+  CommonAuthTestHelper() : reads1_(), writes1_(), reads2_(), writes2_() {}
+
+  scoped_ptr<DeterministicSocketData> BuildSocketData1(
+      const std::string& response) {
+    request1_ = WebSocketStandardRequest("/", "http://localhost", "");
+    writes1_[0] = MockWrite(SYNCHRONOUS, 0, request1_.c_str());
+    response1_ = response;
+    reads1_[0] = MockRead(SYNCHRONOUS, 1, response1_.c_str());
+    reads1_[1] = MockRead(SYNCHRONOUS, OK, 2);  // Close connection
+
+    return BuildSocketData(reads1_, writes1_);
+  }
+
+  scoped_ptr<DeterministicSocketData> BuildSocketData2(
+      const std::string& request,
+      const std::string& response) {
+    request2_ = request;
+    response2_ = response;
+    writes2_[0] = MockWrite(SYNCHRONOUS, 0, request2_.c_str());
+    reads2_[0] = MockRead(SYNCHRONOUS, 1, response2_.c_str());
+    return BuildSocketData(reads2_, writes2_);
+  }
+
+ private:
+  // These need to be object-scoped since they have to remain valid until all
+  // socket operations in the test are complete.
+  std::string request1_;
+  std::string request2_;
+  std::string response1_;
+  std::string response2_;
+  MockRead reads1_[2];
+  MockWrite writes1_[1];
+  MockRead reads2_[1];
+  MockWrite writes2_[1];
+
+  DISALLOW_COPY_AND_ASSIGN(CommonAuthTestHelper);
+};
+
+// Data and methods for BasicAuth tests.
+class WebSocketStreamCreateBasicAuthTest : public WebSocketStreamCreateTest {
+ protected:
+  void CreateAndConnectAuthHandshake(const std::string& url,
+                                     const std::string& base64_user_pass,
+                                     const std::string& response2) {
+    AddRawExpectations(helper_.BuildSocketData1(kUnauthorizedResponse));
+
+    static const char request2format[] =
+        "GET / HTTP/1.1\r\n"
+        "Host: localhost\r\n"
+        "Connection: Upgrade\r\n"
+        "Pragma: no-cache\r\n"
+        "Cache-Control: no-cache\r\n"
+        "Authorization: Basic %s\r\n"
+        "Upgrade: websocket\r\n"
+        "Origin: http://localhost\r\n"
+        "Sec-WebSocket-Version: 13\r\n"
+        "User-Agent:\r\n"
+        "Accept-Encoding: gzip,deflate\r\n"
+        "Accept-Language: en-us,fr\r\n"
+        "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n"
+        "Sec-WebSocket-Extensions: permessage-deflate; "
+        "client_max_window_bits\r\n"
+        "\r\n";
+    const std::string request =
+        base::StringPrintf(request2format, base64_user_pass.c_str());
+    CreateAndConnectRawExpectations(
+        url,
+        NoSubProtocols(),
+        "http://localhost",
+        helper_.BuildSocketData2(request, response2));
+  }
+
+  static const char kUnauthorizedResponse[];
+
+  CommonAuthTestHelper helper_;
+};
+
+class WebSocketStreamCreateDigestAuthTest : public WebSocketStreamCreateTest {
+ protected:
+  static const char kUnauthorizedResponse[];
+  static const char kAuthorizedRequest[];
+
+  CommonAuthTestHelper helper_;
+};
+
+const char WebSocketStreamCreateBasicAuthTest::kUnauthorizedResponse[] =
+    "HTTP/1.1 401 Unauthorized\r\n"
+    "Content-Length: 0\r\n"
+    "WWW-Authenticate: Basic realm=\"camelot\"\r\n"
+    "\r\n";
+
+// These negotiation values are borrowed from
+// http_auth_handler_digest_unittest.cc. Feel free to come up with new ones if
+// you are bored. Only the weakest (no qop) variants of Digest authentication
+// can be tested by this method, because the others involve random input.
+const char WebSocketStreamCreateDigestAuthTest::kUnauthorizedResponse[] =
+    "HTTP/1.1 401 Unauthorized\r\n"
+    "Content-Length: 0\r\n"
+    "WWW-Authenticate: Digest realm=\"Oblivion\", nonce=\"nonce-value\"\r\n"
+    "\r\n";
+
+const char WebSocketStreamCreateDigestAuthTest::kAuthorizedRequest[] =
+    "GET / HTTP/1.1\r\n"
+    "Host: localhost\r\n"
+    "Connection: Upgrade\r\n"
+    "Pragma: no-cache\r\n"
+    "Cache-Control: no-cache\r\n"
+    "Authorization: Digest username=\"FooBar\", realm=\"Oblivion\", "
+    "nonce=\"nonce-value\", uri=\"/\", "
+    "response=\"f72ff54ebde2f928860f806ec04acd1b\"\r\n"
+    "Upgrade: websocket\r\n"
+    "Origin: http://localhost\r\n"
+    "Sec-WebSocket-Version: 13\r\n"
+    "User-Agent:\r\n"
+    "Accept-Encoding: gzip,deflate\r\n"
+    "Accept-Language: en-us,fr\r\n"
+    "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n"
+    "Sec-WebSocket-Extensions: permessage-deflate; "
+    "client_max_window_bits\r\n"
+    "\r\n";
+
 class WebSocketStreamCreateUMATest : public ::testing::Test {
  public:
   // This enum should match with the enum in Delegate in websocket_stream.cc.
   enum HandshakeResult {
     INCOMPLETE,
     CONNECTED,
     FAILED,
     NUM_HANDSHAKE_RESULT_TYPES,
   };
 
@@ skipping 672 matching lines @@
   stream_request_.reset();
   RunUntilIdle();
   EXPECT_FALSE(has_failed());
   EXPECT_FALSE(stream_);
   EXPECT_FALSE(request_info_);
   EXPECT_FALSE(response_info_);
 }
 
 // Connect failure must look just like negotiation failure.
 TEST_F(WebSocketStreamCreateTest, ConnectionFailure) {
-  scoped_ptr<DeterministicSocketData> socket_data(
-      new DeterministicSocketData(NULL, 0, NULL, 0));
+  scoped_ptr<DeterministicSocketData> socket_data(BuildNullSocketData());
   socket_data->set_connect_data(
       MockConnect(SYNCHRONOUS, ERR_CONNECTION_REFUSED));
   CreateAndConnectRawExpectations("ws://localhost/", NoSubProtocols(),
                                   "http://localhost", socket_data.Pass());
   RunUntilIdle();
   EXPECT_TRUE(has_failed());
   EXPECT_EQ("Error in connection establishment: net::ERR_CONNECTION_REFUSED",
             failure_message());
   EXPECT_FALSE(request_info_);
   EXPECT_FALSE(response_info_);
 }
 
 // Connect timeout must look just like any other failure.
 TEST_F(WebSocketStreamCreateTest, ConnectionTimeout) {
-  scoped_ptr<DeterministicSocketData> socket_data(
-      new DeterministicSocketData(NULL, 0, NULL, 0));
+  scoped_ptr<DeterministicSocketData> socket_data(BuildNullSocketData());
   socket_data->set_connect_data(
       MockConnect(ASYNC, ERR_CONNECTION_TIMED_OUT));
   CreateAndConnectRawExpectations("ws://localhost/", NoSubProtocols(),
                                   "http://localhost", socket_data.Pass());
   RunUntilIdle();
   EXPECT_TRUE(has_failed());
   EXPECT_EQ("Error in connection establishment: net::ERR_CONNECTION_TIMED_OUT",
             failure_message());
 }
 
 // Cancellation during connect works.
 TEST_F(WebSocketStreamCreateTest, CancellationDuringConnect) {
-  scoped_ptr<DeterministicSocketData> socket_data(
-      new DeterministicSocketData(NULL, 0, NULL, 0));
+  scoped_ptr<DeterministicSocketData> socket_data(BuildNullSocketData());
   socket_data->set_connect_data(MockConnect(SYNCHRONOUS, ERR_IO_PENDING));
   CreateAndConnectRawExpectations("ws://localhost/",
                                   NoSubProtocols(),
                                   "http://localhost",
                                   socket_data.Pass());
   stream_request_.reset();
   RunUntilIdle();
   EXPECT_FALSE(has_failed());
   EXPECT_FALSE(stream_);
 }
@@ skipping 21 matching lines @@
   EXPECT_FALSE(response_info_);
 }
 
 // Cancellation during read of the response headers works.
 TEST_F(WebSocketStreamCreateTest, CancellationDuringRead) {
   std::string request = WebSocketStandardRequest("/", "http://localhost", "");
   MockWrite writes[] = {MockWrite(ASYNC, 0, request.c_str())};
   MockRead reads[] = {
     MockRead(ASYNC, 1, "HTTP/1.1 101 Switching Protocols\r\nUpgr"),
   };
-  DeterministicSocketData* socket_data(new DeterministicSocketData(
-      reads, arraysize(reads), writes, arraysize(writes)));
-  socket_data->set_connect_data(MockConnect(SYNCHRONOUS, OK));
+  scoped_ptr<DeterministicSocketData> socket_data(
+      BuildSocketData(reads, writes));
   socket_data->SetStop(1);
+  DeterministicSocketData* socket_data_raw_ptr = socket_data.get();
   CreateAndConnectRawExpectations("ws://localhost/",
                                   NoSubProtocols(),
                                   "http://localhost",
-                                  make_scoped_ptr(socket_data));
-  socket_data->Run();
+                                  socket_data.Pass());
+  socket_data_raw_ptr->Run();
   stream_request_.reset();
   RunUntilIdle();
   EXPECT_FALSE(has_failed());
   EXPECT_FALSE(stream_);
   EXPECT_TRUE(request_info_);
   EXPECT_FALSE(response_info_);
 }
 
 // Over-size response headers (> 256KB) should not cause a crash.  This is a
 // regression test for crbug.com/339456. It is based on the layout test
@@ skipping 12 matching lines @@
   EXPECT_FALSE(response_info_);
 }
 
 // If the remote host closes the connection without sending headers, we should
 // log the console message "Connection closed before receiving a handshake
 // response".
 TEST_F(WebSocketStreamCreateTest, NoResponse) {
   std::string request = WebSocketStandardRequest("/", "http://localhost", "");
   MockWrite writes[] = {MockWrite(ASYNC, request.data(), request.size(), 0)};
   MockRead reads[] = {MockRead(ASYNC, 0, 1)};
-  DeterministicSocketData* socket_data(new DeterministicSocketData(
-      reads, arraysize(reads), writes, arraysize(writes)));
-  socket_data->set_connect_data(MockConnect(SYNCHRONOUS, OK));
+  scoped_ptr<DeterministicSocketData> socket_data(
+      BuildSocketData(reads, writes));
+  DeterministicSocketData* socket_data_raw_ptr = socket_data.get();
   CreateAndConnectRawExpectations("ws://localhost/",
                                   NoSubProtocols(),
                                   "http://localhost",
-                                  make_scoped_ptr(socket_data));
-  socket_data->RunFor(2);
+                                  socket_data.Pass());
+  socket_data_raw_ptr->RunFor(2);
   EXPECT_TRUE(has_failed());
   EXPECT_FALSE(stream_);
   EXPECT_FALSE(response_info_);
   EXPECT_EQ("Connection closed before receiving a handshake response",
             failure_message());
 }
 
 TEST_F(WebSocketStreamCreateTest, SelfSignedCertificateFailure) {
   ssl_data_.push_back(
       new SSLSocketDataProvider(ASYNC, ERR_CERT_AUTHORITY_INVALID));
   ssl_data_[0]->cert =
       ImportCertFromFile(GetTestCertsDirectory(), "unittest.selfsigned.der");
   ASSERT_TRUE(ssl_data_[0]->cert);
-  scoped_ptr<DeterministicSocketData> raw_socket_data(
-      new DeterministicSocketData(NULL, 0, NULL, 0));
+  scoped_ptr<DeterministicSocketData> raw_socket_data(BuildNullSocketData());
   CreateAndConnectRawExpectations("wss://localhost/",
                                   NoSubProtocols(),
                                   "http://localhost",
                                   raw_socket_data.Pass());
   RunUntilIdle();
   EXPECT_FALSE(has_failed());
   ASSERT_TRUE(ssl_error_callbacks_);
   ssl_error_callbacks_->CancelSSLRequest(ERR_CERT_AUTHORITY_INVALID,
                                          &ssl_info_);
   RunUntilIdle();
   EXPECT_TRUE(has_failed());
 }
 
 TEST_F(WebSocketStreamCreateTest, SelfSignedCertificateSuccess) {
   scoped_ptr<SSLSocketDataProvider> ssl_data(
       new SSLSocketDataProvider(ASYNC, ERR_CERT_AUTHORITY_INVALID));
   ssl_data->cert =
       ImportCertFromFile(GetTestCertsDirectory(), "unittest.selfsigned.der");
   ASSERT_TRUE(ssl_data->cert);
   ssl_data_.push_back(ssl_data.release());
   ssl_data.reset(new SSLSocketDataProvider(ASYNC, OK));
   ssl_data_.push_back(ssl_data.release());
-  url_request_context_host_.AddRawExpectations(
-      make_scoped_ptr(new DeterministicSocketData(NULL, 0, NULL, 0)));
+  url_request_context_host_.AddRawExpectations(BuildNullSocketData());
   CreateAndConnectStandard(
       "wss://localhost/", "/", NoSubProtocols(), "http://localhost", "", "");
   RunUntilIdle();
   ASSERT_TRUE(ssl_error_callbacks_);
   ssl_error_callbacks_->ContinueSSLRequest();
   RunUntilIdle();
   EXPECT_FALSE(has_failed());
   EXPECT_TRUE(stream_);
 }
 
+// If the server requests authorisation, but we have no credentials, the
+// connection should fail cleanly.
+TEST_F(WebSocketStreamCreateBasicAuthTest, FailureNoCredentials) {
+  CreateAndConnectCustomResponse("ws://localhost/",
+                                 "/",
+                                 NoSubProtocols(),
+                                 "http://localhost",
+                                 "",
+                                 kUnauthorizedResponse);
+  RunUntilIdle();
+  EXPECT_TRUE(has_failed());
+  EXPECT_EQ("HTTP Authentication failed; no valid credentials available",
+            failure_message());
+  EXPECT_TRUE(response_info_);
+}
+
+TEST_F(WebSocketStreamCreateBasicAuthTest, SuccessPasswordInUrl) {
+  CreateAndConnectAuthHandshake("ws://foo:bar@localhost/",
+                                "Zm9vOmJhcg==",
+                                WebSocketStandardResponse(std::string()));
+  RunUntilIdle();
+  EXPECT_FALSE(has_failed());
+  EXPECT_TRUE(stream_);
+  ASSERT_TRUE(response_info_);
+  EXPECT_EQ(101, response_info_->status_code);
+}
+
+TEST_F(WebSocketStreamCreateBasicAuthTest, FailureIncorrectPasswordInUrl) {
+  CreateAndConnectAuthHandshake(
+      "ws://foo:baz@localhost/", "Zm9vOmJheg==", kUnauthorizedResponse);
+  RunUntilIdle();
+  EXPECT_TRUE(has_failed());
+  EXPECT_TRUE(response_info_);
+}
+
+// Digest auth has the same connection semantics as Basic auth, so we can
+// generally assume that whatever works for Basic auth will also work for
+// Digest. There's just one test here, to confirm that it works at all.
+TEST_F(WebSocketStreamCreateDigestAuthTest, DigestPasswordInUrl) {
+  AddRawExpectations(helper_.BuildSocketData1(kUnauthorizedResponse));
+
+  CreateAndConnectRawExpectations(
+      "ws://FooBar:pass@localhost/",
+      NoSubProtocols(),
+      "http://localhost",
+      helper_.BuildSocketData2(kAuthorizedRequest,
+                               WebSocketStandardResponse(std::string())));
+  RunUntilIdle();
+  EXPECT_FALSE(has_failed());
+  EXPECT_TRUE(stream_);
+  ASSERT_TRUE(response_info_);
+  EXPECT_EQ(101, response_info_->status_code);
+}
+
 TEST_F(WebSocketStreamCreateUMATest, Incomplete) {
   const std::string name("Net.WebSocket.HandshakeResult");
   scoped_ptr<base::HistogramSamples> original(GetSamples(name));
 
   {
     StreamCreation creation;
     creation.CreateAndConnectStandard("ws://localhost/",
                                       "/",
                                       creation.NoSubProtocols(),
                                       "http://localhost",
@@ skipping 62 matching lines @@
   if (original) {
     samples->Subtract(*original);  // Cancel the original values.
   }
   EXPECT_EQ(1, samples->GetCount(INCOMPLETE));
   EXPECT_EQ(0, samples->GetCount(CONNECTED));
   EXPECT_EQ(0, samples->GetCount(FAILED));
 }
 
 }  // namespace
 }  // namespace net