1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
|
// Copyright 2011 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "net/http/http_auth.h"
#include <algorithm>
#include <array>
#include <optional>
#include <string_view>
#include "base/strings/string_tokenizer.h"
#include "base/strings/string_util.h"
#include "base/values.h"
#include "net/base/net_errors.h"
#include "net/dns/host_resolver.h"
#include "net/http/http_auth_challenge_tokenizer.h"
#include "net/http/http_auth_handler.h"
#include "net/http/http_auth_handler_factory.h"
#include "net/http/http_auth_scheme.h"
#include "net/http/http_request_headers.h"
#include "net/http/http_response_headers.h"
#include "net/http/http_util.h"
#include "net/log/net_log.h"
#include "net/log/net_log_values.h"
namespace net {
namespace {
constexpr auto kSchemeNames = std::to_array<const char*>({
kBasicAuthScheme,
kDigestAuthScheme,
kNtlmAuthScheme,
kNegotiateAuthScheme,
kSpdyProxyAuthScheme,
kMockAuthScheme,
});
} // namespace
HttpAuth::Identity::Identity() = default;
// static
void HttpAuth::ChooseBestChallenge(
HttpAuthHandlerFactory* http_auth_handler_factory,
const HttpResponseHeaders& response_headers,
const SSLInfo& ssl_info,
const NetworkAnonymizationKey& network_anonymization_key,
Target target,
const url::SchemeHostPort& scheme_host_port,
const std::set<Scheme>& disabled_schemes,
const NetLogWithSource& net_log,
HostResolver* host_resolver,
std::unique_ptr<HttpAuthHandler>* handler) {
DCHECK(http_auth_handler_factory);
DCHECK(handler->get() == nullptr);
// Choose the challenge whose authentication handler gives the maximum score.
std::unique_ptr<HttpAuthHandler> best;
const std::string header_name = GetChallengeHeaderName(target);
std::optional<std::string_view> cur_challenge;
size_t iter = 0;
while (
(cur_challenge = response_headers.EnumerateHeader(&iter, header_name))) {
std::unique_ptr<HttpAuthHandler> cur;
int rv = http_auth_handler_factory->CreateAuthHandlerFromString(
*cur_challenge, target, ssl_info, network_anonymization_key,
scheme_host_port, net_log, host_resolver, &cur);
if (rv != OK) {
VLOG(1) << "Unable to create AuthHandler. Status: " << ErrorToString(rv)
<< " Challenge: " << *cur_challenge;
continue;
}
if (cur.get() && (!best.get() || best->score() < cur->score()) &&
(disabled_schemes.find(cur->auth_scheme()) == disabled_schemes.end()))
best.swap(cur);
}
handler->swap(best);
}
// static
HttpAuth::AuthorizationResult HttpAuth::HandleChallengeResponse(
HttpAuthHandler* handler,
const HttpResponseHeaders& response_headers,
Target target,
const std::set<Scheme>& disabled_schemes,
std::string* challenge_used) {
DCHECK(handler);
DCHECK(challenge_used);
challenge_used->clear();
HttpAuth::Scheme current_scheme = handler->auth_scheme();
if (disabled_schemes.find(current_scheme) != disabled_schemes.end())
return HttpAuth::AUTHORIZATION_RESULT_REJECT;
const char* current_scheme_name = SchemeToString(current_scheme);
const std::string header_name = GetChallengeHeaderName(target);
size_t iter = 0;
std::optional<std::string_view> challenge;
HttpAuth::AuthorizationResult authorization_result =
HttpAuth::AUTHORIZATION_RESULT_INVALID;
while ((challenge = response_headers.EnumerateHeader(&iter, header_name))) {
HttpAuthChallengeTokenizer challenge_tokens(*challenge);
if (challenge_tokens.auth_scheme() != current_scheme_name)
continue;
authorization_result = handler->HandleAnotherChallenge(&challenge_tokens);
if (authorization_result != HttpAuth::AUTHORIZATION_RESULT_INVALID) {
*challenge_used = *challenge;
return authorization_result;
}
}
// Finding no matches is equivalent to rejection.
return HttpAuth::AUTHORIZATION_RESULT_REJECT;
}
// static
std::string HttpAuth::GetChallengeHeaderName(Target target) {
switch (target) {
case AUTH_PROXY:
return "Proxy-Authenticate";
case AUTH_SERVER:
return "WWW-Authenticate";
default:
NOTREACHED();
}
}
// static
std::string HttpAuth::GetAuthorizationHeaderName(Target target) {
switch (target) {
case AUTH_PROXY:
return HttpRequestHeaders::kProxyAuthorization;
case AUTH_SERVER:
return HttpRequestHeaders::kAuthorization;
default:
NOTREACHED();
}
}
// static
std::string HttpAuth::GetAuthTargetString(Target target) {
switch (target) {
case AUTH_PROXY:
return "proxy";
case AUTH_SERVER:
return "server";
default:
NOTREACHED();
}
}
// static
const char* HttpAuth::SchemeToString(Scheme scheme) {
static_assert(std::size(kSchemeNames) == AUTH_SCHEME_MAX,
"http auth scheme names incorrect size");
if (scheme < AUTH_SCHEME_BASIC || scheme >= AUTH_SCHEME_MAX) {
NOTREACHED();
}
return kSchemeNames[scheme];
}
// static
HttpAuth::Scheme HttpAuth::StringToScheme(const std::string& str) {
for (uint8_t i = 0; i < std::size(kSchemeNames); i++) {
if (str == kSchemeNames[i])
return static_cast<Scheme>(i);
}
NOTREACHED();
}
// static
const char* HttpAuth::AuthorizationResultToString(
AuthorizationResult authorization_result) {
switch (authorization_result) {
case AUTHORIZATION_RESULT_ACCEPT:
return "accept";
case AUTHORIZATION_RESULT_REJECT:
return "reject";
case AUTHORIZATION_RESULT_STALE:
return "stale";
case AUTHORIZATION_RESULT_INVALID:
return "invalid";
case AUTHORIZATION_RESULT_DIFFERENT_REALM:
return "different_realm";
}
NOTREACHED();
}
// static
base::Value::Dict HttpAuth::NetLogAuthorizationResultParams(
const char* name,
AuthorizationResult authorization_result) {
return NetLogParamsWithString(
name, AuthorizationResultToString(authorization_result));
}
} // namespace net
|
