| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "net/http/http_auth_controller.h" | |
| 6 | |
| 7 #include "base/bind.h" | |
| 8 #include "base/bind_helpers.h" | |
| 9 #include "base/metrics/histogram.h" | |
| 10 #include "base/strings/string_util.h" | |
| 11 #include "base/strings/utf_string_conversions.h" | |
| 12 #include "base/threading/platform_thread.h" | |
| 13 #include "net/base/auth.h" | |
| 14 #include "net/base/net_util.h" | |
| 15 #include "net/dns/host_resolver.h" | |
| 16 #include "net/http/http_auth_handler.h" | |
| 17 #include "net/http/http_auth_handler_factory.h" | |
| 18 #include "net/http/http_network_session.h" | |
| 19 #include "net/http/http_request_headers.h" | |
| 20 #include "net/http/http_request_info.h" | |
| 21 #include "net/http/http_response_headers.h" | |
| 22 | |
| 23 namespace net { | |
| 24 | |
| 25 namespace { | |
| 26 | |
| 27 // Returns a log message for all the response headers related to the auth | |
| 28 // challenge. | |
| 29 std::string AuthChallengeLogMessage(HttpResponseHeaders* headers) { | |
| 30 std::string msg; | |
| 31 std::string header_val; | |
| 32 void* iter = NULL; | |
| 33 while (headers->EnumerateHeader(&iter, "proxy-authenticate", &header_val)) { | |
| 34 msg.append("\n Has header Proxy-Authenticate: "); | |
| 35 msg.append(header_val); | |
| 36 } | |
| 37 | |
| 38 iter = NULL; | |
| 39 while (headers->EnumerateHeader(&iter, "www-authenticate", &header_val)) { | |
| 40 msg.append("\n Has header WWW-Authenticate: "); | |
| 41 msg.append(header_val); | |
| 42 } | |
| 43 | |
| 44 // RFC 4559 requires that a proxy indicate its support of NTLM/Negotiate | |
| 45 // authentication with a "Proxy-Support: Session-Based-Authentication" | |
| 46 // response header. | |
| 47 iter = NULL; | |
| 48 while (headers->EnumerateHeader(&iter, "proxy-support", &header_val)) { | |
| 49 msg.append("\n Has header Proxy-Support: "); | |
| 50 msg.append(header_val); | |
| 51 } | |
| 52 | |
| 53 return msg; | |
| 54 } | |
| 55 | |
| 56 enum AuthEvent { | |
| 57 AUTH_EVENT_START = 0, | |
| 58 AUTH_EVENT_REJECT, | |
| 59 AUTH_EVENT_MAX, | |
| 60 }; | |
| 61 | |
| 62 enum AuthTarget { | |
| 63 AUTH_TARGET_PROXY = 0, | |
| 64 AUTH_TARGET_SECURE_PROXY, | |
| 65 AUTH_TARGET_SERVER, | |
| 66 AUTH_TARGET_SECURE_SERVER, | |
| 67 AUTH_TARGET_MAX, | |
| 68 }; | |
| 69 | |
| 70 AuthTarget DetermineAuthTarget(const HttpAuthHandler* handler) { | |
| 71 switch (handler->target()) { | |
| 72 case HttpAuth::AUTH_PROXY: | |
| 73 if (handler->origin().SchemeIsSecure()) | |
| 74 return AUTH_TARGET_SECURE_PROXY; | |
| 75 else | |
| 76 return AUTH_TARGET_PROXY; | |
| 77 case HttpAuth::AUTH_SERVER: | |
| 78 if (handler->origin().SchemeIsSecure()) | |
| 79 return AUTH_TARGET_SECURE_SERVER; | |
| 80 else | |
| 81 return AUTH_TARGET_SERVER; | |
| 82 default: | |
| 83 NOTREACHED(); | |
| 84 return AUTH_TARGET_MAX; | |
| 85 } | |
| 86 } | |
| 87 | |
| 88 // Records the number of authentication events per authentication scheme. | |
| 89 void HistogramAuthEvent(HttpAuthHandler* handler, AuthEvent auth_event) { | |
| 90 #if !defined(NDEBUG) | |
| 91 // Note: The on-same-thread check is intentionally not using a lock | |
| 92 // to protect access to first_thread. This method is meant to be only | |
| 93 // used on the same thread, in which case there are no race conditions. If | |
| 94 // there are race conditions (say, a read completes during a partial write), | |
| 95 // the DCHECK will correctly fail. | |
| 96 static base::PlatformThreadId first_thread = | |
| 97 base::PlatformThread::CurrentId(); | |
| 98 DCHECK_EQ(first_thread, base::PlatformThread::CurrentId()); | |
| 99 #endif | |
| 100 | |
| 101 HttpAuth::Scheme auth_scheme = handler->auth_scheme(); | |
| 102 DCHECK(auth_scheme >= 0 && auth_scheme < HttpAuth::AUTH_SCHEME_MAX); | |
| 103 | |
| 104 // Record start and rejection events for authentication. | |
| 105 // | |
| 106 // The results map to: | |
| 107 // Basic Start: 0 | |
| 108 // Basic Reject: 1 | |
| 109 // Digest Start: 2 | |
| 110 // Digest Reject: 3 | |
| 111 // NTLM Start: 4 | |
| 112 // NTLM Reject: 5 | |
| 113 // Negotiate Start: 6 | |
| 114 // Negotiate Reject: 7 | |
| 115 static const int kEventBucketsEnd = | |
| 116 HttpAuth::AUTH_SCHEME_MAX * AUTH_EVENT_MAX; | |
| 117 int event_bucket = auth_scheme * AUTH_EVENT_MAX + auth_event; | |
| 118 DCHECK(event_bucket >= 0 && event_bucket < kEventBucketsEnd); | |
| 119 UMA_HISTOGRAM_ENUMERATION("Net.HttpAuthCount", event_bucket, | |
| 120 kEventBucketsEnd); | |
| 121 | |
| 122 // Record the target of the authentication. | |
| 123 // | |
| 124 // The results map to: | |
| 125 // Basic Proxy: 0 | |
| 126 // Basic Secure Proxy: 1 | |
| 127 // Basic Server: 2 | |
| 128 // Basic Secure Server: 3 | |
| 129 // Digest Proxy: 4 | |
| 130 // Digest Secure Proxy: 5 | |
| 131 // Digest Server: 6 | |
| 132 // Digest Secure Server: 7 | |
| 133 // NTLM Proxy: 8 | |
| 134 // NTLM Secure Proxy: 9 | |
| 135 // NTLM Server: 10 | |
| 136 // NTLM Secure Server: 11 | |
| 137 // Negotiate Proxy: 12 | |
| 138 // Negotiate Secure Proxy: 13 | |
| 139 // Negotiate Server: 14 | |
| 140 // Negotiate Secure Server: 15 | |
| 141 if (auth_event != AUTH_EVENT_START) | |
| 142 return; | |
| 143 static const int kTargetBucketsEnd = | |
| 144 HttpAuth::AUTH_SCHEME_MAX * AUTH_TARGET_MAX; | |
| 145 AuthTarget auth_target = DetermineAuthTarget(handler); | |
| 146 int target_bucket = auth_scheme * AUTH_TARGET_MAX + auth_target; | |
| 147 DCHECK(target_bucket >= 0 && target_bucket < kTargetBucketsEnd); | |
| 148 UMA_HISTOGRAM_ENUMERATION("Net.HttpAuthTarget", target_bucket, | |
| 149 kTargetBucketsEnd); | |
| 150 } | |
| 151 | |
| 152 } // namespace | |
| 153 | |
| 154 HttpAuthController::HttpAuthController( | |
| 155 HttpAuth::Target target, | |
| 156 const GURL& auth_url, | |
| 157 HttpAuthCache* http_auth_cache, | |
| 158 HttpAuthHandlerFactory* http_auth_handler_factory) | |
| 159 : target_(target), | |
| 160 auth_url_(auth_url), | |
| 161 auth_origin_(auth_url.GetOrigin()), | |
| 162 auth_path_(HttpAuth::AUTH_PROXY ? std::string() : auth_url.path()), | |
| 163 embedded_identity_used_(false), | |
| 164 default_credentials_used_(false), | |
| 165 http_auth_cache_(http_auth_cache), | |
| 166 http_auth_handler_factory_(http_auth_handler_factory) { | |
| 167 } | |
| 168 | |
| 169 HttpAuthController::~HttpAuthController() { | |
| 170 DCHECK(CalledOnValidThread()); | |
| 171 } | |
| 172 | |
| 173 int HttpAuthController::MaybeGenerateAuthToken( | |
| 174 const HttpRequestInfo* request, const CompletionCallback& callback, | |
| 175 const BoundNetLog& net_log) { | |
| 176 DCHECK(CalledOnValidThread()); | |
| 177 bool needs_auth = HaveAuth() || SelectPreemptiveAuth(net_log); | |
| 178 if (!needs_auth) | |
| 179 return OK; | |
| 180 const AuthCredentials* credentials = NULL; | |
| 181 if (identity_.source != HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS) | |
| 182 credentials = &identity_.credentials; | |
| 183 DCHECK(auth_token_.empty()); | |
| 184 DCHECK(callback_.is_null()); | |
| 185 int rv = handler_->GenerateAuthToken( | |
| 186 credentials, request, | |
| 187 base::Bind(&HttpAuthController::OnIOComplete, base::Unretained(this)), | |
| 188 &auth_token_); | |
| 189 if (DisableOnAuthHandlerResult(rv)) | |
| 190 rv = OK; | |
| 191 if (rv == ERR_IO_PENDING) | |
| 192 callback_ = callback; | |
| 193 else | |
| 194 OnIOComplete(rv); | |
| 195 return rv; | |
| 196 } | |
| 197 | |
| 198 bool HttpAuthController::SelectPreemptiveAuth(const BoundNetLog& net_log) { | |
| 199 DCHECK(CalledOnValidThread()); | |
| 200 DCHECK(!HaveAuth()); | |
| 201 DCHECK(identity_.invalid); | |
| 202 | |
| 203 // Don't do preemptive authorization if the URL contains a username:password, | |
| 204 // since we must first be challenged in order to use the URL's identity. | |
| 205 if (auth_url_.has_username()) | |
| 206 return false; | |
| 207 | |
| 208 // SelectPreemptiveAuth() is on the critical path for each request, so it | |
| 209 // is expected to be fast. LookupByPath() is fast in the common case, since | |
| 210 // the number of http auth cache entries is expected to be very small. | |
| 211 // (For most users in fact, it will be 0.) | |
| 212 HttpAuthCache::Entry* entry = http_auth_cache_->LookupByPath( | |
| 213 auth_origin_, auth_path_); | |
| 214 if (!entry) | |
| 215 return false; | |
| 216 | |
| 217 // Try to create a handler using the previous auth challenge. | |
| 218 scoped_ptr<HttpAuthHandler> handler_preemptive; | |
| 219 int rv_create = http_auth_handler_factory_-> | |
| 220 CreatePreemptiveAuthHandlerFromString(entry->auth_challenge(), target_, | |
| 221 auth_origin_, | |
| 222 entry->IncrementNonceCount(), | |
| 223 net_log, &handler_preemptive); | |
| 224 if (rv_create != OK) | |
| 225 return false; | |
| 226 | |
| 227 // Set the state | |
| 228 identity_.source = HttpAuth::IDENT_SRC_PATH_LOOKUP; | |
| 229 identity_.invalid = false; | |
| 230 identity_.credentials = entry->credentials(); | |
| 231 handler_.swap(handler_preemptive); | |
| 232 return true; | |
| 233 } | |
| 234 | |
| 235 void HttpAuthController::AddAuthorizationHeader( | |
| 236 HttpRequestHeaders* authorization_headers) { | |
| 237 DCHECK(CalledOnValidThread()); | |
| 238 DCHECK(HaveAuth()); | |
| 239 // auth_token_ can be empty if we encountered a permanent error with | |
| 240 // the auth scheme and want to retry. | |
| 241 if (!auth_token_.empty()) { | |
| 242 authorization_headers->SetHeader( | |
| 243 HttpAuth::GetAuthorizationHeaderName(target_), auth_token_); | |
| 244 auth_token_.clear(); | |
| 245 } | |
| 246 } | |
| 247 | |
| 248 int HttpAuthController::HandleAuthChallenge( | |
| 249 scoped_refptr<HttpResponseHeaders> headers, | |
| 250 bool do_not_send_server_auth, | |
| 251 bool establishing_tunnel, | |
| 252 const BoundNetLog& net_log) { | |
| 253 DCHECK(CalledOnValidThread()); | |
| 254 DCHECK(headers.get()); | |
| 255 DCHECK(auth_origin_.is_valid()); | |
| 256 VLOG(1) << "The " << HttpAuth::GetAuthTargetString(target_) << " " | |
| 257 << auth_origin_ << " requested auth " | |
| 258 << AuthChallengeLogMessage(headers.get()); | |
| 259 | |
| 260 // Give the existing auth handler first try at the authentication headers. | |
| 261 // This will also evict the entry in the HttpAuthCache if the previous | |
| 262 // challenge appeared to be rejected, or is using a stale nonce in the Digest | |
| 263 // case. | |
| 264 if (HaveAuth()) { | |
| 265 std::string challenge_used; | |
| 266 HttpAuth::AuthorizationResult result = | |
| 267 HttpAuth::HandleChallengeResponse(handler_.get(), | |
| 268 headers.get(), | |
| 269 target_, | |
| 270 disabled_schemes_, | |
| 271 &challenge_used); | |
| 272 switch (result) { | |
| 273 case HttpAuth::AUTHORIZATION_RESULT_ACCEPT: | |
| 274 break; | |
| 275 case HttpAuth::AUTHORIZATION_RESULT_INVALID: | |
| 276 InvalidateCurrentHandler(INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS); | |
| 277 break; | |
| 278 case HttpAuth::AUTHORIZATION_RESULT_REJECT: | |
| 279 HistogramAuthEvent(handler_.get(), AUTH_EVENT_REJECT); | |
| 280 InvalidateCurrentHandler(INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS); | |
| 281 break; | |
| 282 case HttpAuth::AUTHORIZATION_RESULT_STALE: | |
| 283 if (http_auth_cache_->UpdateStaleChallenge(auth_origin_, | |
| 284 handler_->realm(), | |
| 285 handler_->auth_scheme(), | |
| 286 challenge_used)) { | |
| 287 InvalidateCurrentHandler(INVALIDATE_HANDLER); | |
| 288 } else { | |
| 289 // It's possible that a server could incorrectly issue a stale | |
| 290 // response when the entry is not in the cache. Just evict the | |
| 291 // current value from the cache. | |
| 292 InvalidateCurrentHandler(INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS); | |
| 293 } | |
| 294 break; | |
| 295 case HttpAuth::AUTHORIZATION_RESULT_DIFFERENT_REALM: | |
| 296 // If the server changes the authentication realm in a | |
| 297 // subsequent challenge, invalidate cached credentials for the | |
| 298 // previous realm. If the server rejects a preemptive | |
| 299 // authorization and requests credentials for a different | |
| 300 // realm, we keep the cached credentials. | |
| 301 InvalidateCurrentHandler( | |
| 302 (identity_.source == HttpAuth::IDENT_SRC_PATH_LOOKUP) ? | |
| 303 INVALIDATE_HANDLER : | |
| 304 INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS); | |
| 305 break; | |
| 306 default: | |
| 307 NOTREACHED(); | |
| 308 break; | |
| 309 } | |
| 310 } | |
| 311 | |
| 312 identity_.invalid = true; | |
| 313 | |
| 314 bool can_send_auth = (target_ != HttpAuth::AUTH_SERVER || | |
| 315 !do_not_send_server_auth); | |
| 316 | |
| 317 do { | |
| 318 if (!handler_.get() && can_send_auth) { | |
| 319 // Find the best authentication challenge that we support. | |
| 320 HttpAuth::ChooseBestChallenge(http_auth_handler_factory_, | |
| 321 headers.get(), | |
| 322 target_, | |
| 323 auth_origin_, | |
| 324 disabled_schemes_, | |
| 325 net_log, | |
| 326 &handler_); | |
| 327 if (handler_.get()) | |
| 328 HistogramAuthEvent(handler_.get(), AUTH_EVENT_START); | |
| 329 } | |
| 330 | |
| 331 if (!handler_.get()) { | |
| 332 if (establishing_tunnel) { | |
| 333 LOG(ERROR) << "Can't perform auth to the " | |
| 334 << HttpAuth::GetAuthTargetString(target_) << " " | |
| 335 << auth_origin_ << " when establishing a tunnel" | |
| 336 << AuthChallengeLogMessage(headers.get()); | |
| 337 | |
| 338 // We are establishing a tunnel, we can't show the error page because an | |
| 339 // active network attacker could control its contents. Instead, we just | |
| 340 // fail to establish the tunnel. | |
| 341 DCHECK(target_ == HttpAuth::AUTH_PROXY); | |
| 342 return ERR_PROXY_AUTH_UNSUPPORTED; | |
| 343 } | |
| 344 // We found no supported challenge -- let the transaction continue so we | |
| 345 // end up displaying the error page. | |
| 346 return OK; | |
| 347 } | |
| 348 | |
| 349 if (handler_->NeedsIdentity()) { | |
| 350 // Pick a new auth identity to try, by looking to the URL and auth cache. | |
| 351 // If an identity to try is found, it is saved to identity_. | |
| 352 SelectNextAuthIdentityToTry(); | |
| 353 } else { | |
| 354 // Proceed with the existing identity or a null identity. | |
| 355 identity_.invalid = false; | |
| 356 } | |
| 357 | |
| 358 // From this point on, we are restartable. | |
| 359 | |
| 360 if (identity_.invalid) { | |
| 361 // We have exhausted all identity possibilities. | |
| 362 if (!handler_->AllowsExplicitCredentials()) { | |
| 363 // If the handler doesn't accept explicit credentials, then we need to | |
| 364 // choose a different auth scheme. | |
| 365 HistogramAuthEvent(handler_.get(), AUTH_EVENT_REJECT); | |
| 366 InvalidateCurrentHandler(INVALIDATE_HANDLER_AND_DISABLE_SCHEME); | |
| 367 } else { | |
| 368 // Pass the challenge information back to the client. | |
| 369 PopulateAuthChallenge(); | |
| 370 } | |
| 371 } else { | |
| 372 auth_info_ = NULL; | |
| 373 } | |
| 374 | |
| 375 // If we get here and we don't have a handler_, that's because we | |
| 376 // invalidated it due to not having any viable identities to use with it. Go | |
| 377 // back and try again. | |
| 378 // TODO(asanka): Instead we should create a priority list of | |
| 379 // <handler,identity> and iterate through that. | |
| 380 } while(!handler_.get()); | |
| 381 return OK; | |
| 382 } | |
| 383 | |
| 384 void HttpAuthController::ResetAuth(const AuthCredentials& credentials) { | |
| 385 DCHECK(CalledOnValidThread()); | |
| 386 DCHECK(identity_.invalid || credentials.Empty()); | |
| 387 | |
| 388 if (identity_.invalid) { | |
| 389 // Update the credentials. | |
| 390 identity_.source = HttpAuth::IDENT_SRC_EXTERNAL; | |
| 391 identity_.invalid = false; | |
| 392 identity_.credentials = credentials; | |
| 393 } | |
| 394 | |
| 395 DCHECK(identity_.source != HttpAuth::IDENT_SRC_PATH_LOOKUP); | |
| 396 | |
| 397 // Add the auth entry to the cache before restarting. We don't know whether | |
| 398 // the identity is valid yet, but if it is valid we want other transactions | |
| 399 // to know about it. If an entry for (origin, handler->realm()) already | |
| 400 // exists, we update it. | |
| 401 // | |
| 402 // If identity_.source is HttpAuth::IDENT_SRC_NONE or | |
| 403 // HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS, identity_ contains no | |
| 404 // identity because identity is not required yet or we're using default | |
| 405 // credentials. | |
| 406 // | |
| 407 // TODO(wtc): For NTLM_SSPI, we add the same auth entry to the cache in | |
| 408 // round 1 and round 2, which is redundant but correct. It would be nice | |
| 409 // to add an auth entry to the cache only once, preferrably in round 1. | |
| 410 // See http://crbug.com/21015. | |
| 411 switch (identity_.source) { | |
| 412 case HttpAuth::IDENT_SRC_NONE: | |
| 413 case HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS: | |
| 414 break; | |
| 415 default: | |
| 416 http_auth_cache_->Add(auth_origin_, handler_->realm(), | |
| 417 handler_->auth_scheme(), handler_->challenge(), | |
| 418 identity_.credentials, auth_path_); | |
| 419 break; | |
| 420 } | |
| 421 } | |
| 422 | |
| 423 bool HttpAuthController::HaveAuthHandler() const { | |
| 424 return handler_.get() != NULL; | |
| 425 } | |
| 426 | |
| 427 bool HttpAuthController::HaveAuth() const { | |
| 428 return handler_.get() && !identity_.invalid; | |
| 429 } | |
| 430 | |
| 431 void HttpAuthController::InvalidateCurrentHandler( | |
| 432 InvalidateHandlerAction action) { | |
| 433 DCHECK(CalledOnValidThread()); | |
| 434 DCHECK(handler_.get()); | |
| 435 | |
| 436 if (action == INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS) | |
| 437 InvalidateRejectedAuthFromCache(); | |
| 438 if (action == INVALIDATE_HANDLER_AND_DISABLE_SCHEME) | |
| 439 DisableAuthScheme(handler_->auth_scheme()); | |
| 440 handler_.reset(); | |
| 441 identity_ = HttpAuth::Identity(); | |
| 442 } | |
| 443 | |
| 444 void HttpAuthController::InvalidateRejectedAuthFromCache() { | |
| 445 DCHECK(CalledOnValidThread()); | |
| 446 DCHECK(HaveAuth()); | |
| 447 | |
| 448 // Clear the cache entry for the identity we just failed on. | |
| 449 // Note: we require the credentials to match before invalidating | |
| 450 // since the entry in the cache may be newer than what we used last time. | |
| 451 http_auth_cache_->Remove(auth_origin_, handler_->realm(), | |
| 452 handler_->auth_scheme(), identity_.credentials); | |
| 453 } | |
| 454 | |
| 455 bool HttpAuthController::SelectNextAuthIdentityToTry() { | |
| 456 DCHECK(CalledOnValidThread()); | |
| 457 DCHECK(handler_.get()); | |
| 458 DCHECK(identity_.invalid); | |
| 459 | |
| 460 // Try to use the username:password encoded into the URL first. | |
| 461 if (target_ == HttpAuth::AUTH_SERVER && auth_url_.has_username() && | |
| 462 !embedded_identity_used_) { | |
| 463 identity_.source = HttpAuth::IDENT_SRC_URL; | |
| 464 identity_.invalid = false; | |
| 465 // Extract the username:password from the URL. | |
| 466 base::string16 username; | |
| 467 base::string16 password; | |
| 468 GetIdentityFromURL(auth_url_, &username, &password); | |
| 469 identity_.credentials.Set(username, password); | |
| 470 embedded_identity_used_ = true; | |
| 471 // TODO(eroman): If the password is blank, should we also try combining | |
| 472 // with a password from the cache? | |
| 473 UMA_HISTOGRAM_BOOLEAN("net.HttpIdentSrcURL", true); | |
| 474 return true; | |
| 475 } | |
| 476 | |
| 477 // Check the auth cache for a realm entry. | |
| 478 HttpAuthCache::Entry* entry = | |
| 479 http_auth_cache_->Lookup(auth_origin_, handler_->realm(), | |
| 480 handler_->auth_scheme()); | |
| 481 | |
| 482 if (entry) { | |
| 483 identity_.source = HttpAuth::IDENT_SRC_REALM_LOOKUP; | |
| 484 identity_.invalid = false; | |
| 485 identity_.credentials = entry->credentials(); | |
| 486 return true; | |
| 487 } | |
| 488 | |
| 489 // Use default credentials (single sign on) if this is the first attempt | |
| 490 // at identity. Do not allow multiple times as it will infinite loop. | |
| 491 // We use default credentials after checking the auth cache so that if | |
| 492 // single sign-on doesn't work, we won't try default credentials for future | |
| 493 // transactions. | |
| 494 if (!default_credentials_used_ && handler_->AllowsDefaultCredentials()) { | |
| 495 identity_.source = HttpAuth::IDENT_SRC_DEFAULT_CREDENTIALS; | |
| 496 identity_.invalid = false; | |
| 497 default_credentials_used_ = true; | |
| 498 return true; | |
| 499 } | |
| 500 | |
| 501 return false; | |
| 502 } | |
| 503 | |
| 504 void HttpAuthController::PopulateAuthChallenge() { | |
| 505 DCHECK(CalledOnValidThread()); | |
| 506 | |
| 507 // Populates response_.auth_challenge with the authentication challenge info. | |
| 508 // This info is consumed by URLRequestHttpJob::GetAuthChallengeInfo(). | |
| 509 | |
| 510 auth_info_ = new AuthChallengeInfo; | |
| 511 auth_info_->is_proxy = (target_ == HttpAuth::AUTH_PROXY); | |
| 512 auth_info_->challenger = HostPortPair::FromURL(auth_origin_); | |
| 513 auth_info_->scheme = HttpAuth::SchemeToString(handler_->auth_scheme()); | |
| 514 auth_info_->realm = handler_->realm(); | |
| 515 } | |
| 516 | |
| 517 bool HttpAuthController::DisableOnAuthHandlerResult(int result) { | |
| 518 DCHECK(CalledOnValidThread()); | |
| 519 | |
| 520 switch (result) { | |
| 521 // Occurs with GSSAPI, if the user has not already logged in. | |
| 522 case ERR_MISSING_AUTH_CREDENTIALS: | |
| 523 | |
| 524 // Can occur with GSSAPI or SSPI if the underlying library reports | |
| 525 // a permanent error. | |
| 526 case ERR_UNSUPPORTED_AUTH_SCHEME: | |
| 527 | |
| 528 // These two error codes represent failures we aren't handling. | |
| 529 case ERR_UNEXPECTED_SECURITY_LIBRARY_STATUS: | |
| 530 case ERR_UNDOCUMENTED_SECURITY_LIBRARY_STATUS: | |
| 531 | |
| 532 // Can be returned by SSPI if the authenticating authority or | |
| 533 // target is not known. | |
| 534 case ERR_MISCONFIGURED_AUTH_ENVIRONMENT: | |
| 535 | |
| 536 // In these cases, disable the current scheme as it cannot | |
| 537 // succeed. | |
| 538 DisableAuthScheme(handler_->auth_scheme()); | |
| 539 auth_token_.clear(); | |
| 540 return true; | |
| 541 | |
| 542 default: | |
| 543 return false; | |
| 544 } | |
| 545 } | |
| 546 | |
| 547 void HttpAuthController::OnIOComplete(int result) { | |
| 548 DCHECK(CalledOnValidThread()); | |
| 549 if (DisableOnAuthHandlerResult(result)) | |
| 550 result = OK; | |
| 551 if (!callback_.is_null()) { | |
| 552 CompletionCallback c = callback_; | |
| 553 callback_.Reset(); | |
| 554 c.Run(result); | |
| 555 } | |
| 556 } | |
| 557 | |
| 558 scoped_refptr<AuthChallengeInfo> HttpAuthController::auth_info() { | |
| 559 DCHECK(CalledOnValidThread()); | |
| 560 return auth_info_; | |
| 561 } | |
| 562 | |
| 563 bool HttpAuthController::IsAuthSchemeDisabled(HttpAuth::Scheme scheme) const { | |
| 564 DCHECK(CalledOnValidThread()); | |
| 565 return disabled_schemes_.find(scheme) != disabled_schemes_.end(); | |
| 566 } | |
| 567 | |
| 568 void HttpAuthController::DisableAuthScheme(HttpAuth::Scheme scheme) { | |
| 569 DCHECK(CalledOnValidThread()); | |
| 570 disabled_schemes_.insert(scheme); | |
| 571 } | |
| 572 | |
| 573 void HttpAuthController::DisableEmbeddedIdentity() { | |
| 574 DCHECK(CalledOnValidThread()); | |
| 575 embedded_identity_used_ = true; | |
| 576 } | |
| 577 | |
| 578 } // namespace net | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 992733002:
Remove //net (except for Android test stuff) and sdch (Closed)
Base URL: git@github.com:domokit/mojo.git@master