Use SPNEGO mechanism with GSSAPI on Posix

net/http/http_auth_gssapi_posix_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_gssapi_posix.h"
 
 #include "base/basictypes.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/native_library.h"
@@ skipping 36 matching lines @@
   SetBuffer(dest, src->value, src->length);
 }
 
 const char kInitialAuthResponse[] = "Mary had a little lamb";
 
 void EstablishInitialContext(test::MockGSSAPILibrary* library) {
   test::GssContextMockImpl context_info(
       "localhost",                         // Source name
       "example.com",                       // Target name
       23,                                  // Lifetime
-      *CHROME_GSS_C_NT_HOSTBASED_SERVICE,  // Mechanism
+      *CHROME_GSS_SPNEGO_MECH_OID_DESC,    // Mechanism
       0,                                   // Context flags
       1,                                   // Locally initiated
       0);                                  // Open
   gss_buffer_desc in_buffer = {0, NULL};
   gss_buffer_desc out_buffer = {arraysize(kInitialAuthResponse),
                                 const_cast<char*>(kInitialAuthResponse)};
   library->ExpectSecurityContext(
       "Negotiate",
       GSS_S_CONTINUE_NEEDED,
       0,
@@ skipping 23 matching lines @@
 
 TEST(HttpAuthGSSAPIPOSIXTest, GSSAPICycle) {
   scoped_ptr<test::MockGSSAPILibrary> mock_library(new test::MockGSSAPILibrary);
   DCHECK(mock_library.get());
   mock_library->Init();
   const char kAuthResponse[] = "Mary had a little lamb";
   test::GssContextMockImpl context1(
       "localhost",                         // Source name
       "example.com",                       // Target name
       23,                                  // Lifetime
-      *CHROME_GSS_C_NT_HOSTBASED_SERVICE,  // Mechanism
+      *CHROME_GSS_SPNEGO_MECH_OID_DESC,    // Mechanism
       0,                                   // Context flags
       1,                                   // Locally initiated
       0);                                  // Open
   test::GssContextMockImpl context2(
       "localhost",                         // Source name
       "example.com",                       // Target name
       23,                                  // Lifetime
-      *CHROME_GSS_C_NT_HOSTBASED_SERVICE,  // Mechanism
+      *CHROME_GSS_SPNEGO_MECH_OID_DESC,    // Mechanism
       0,                                   // Context flags
       1,                                   // Locally initiated
       1);                                  // Open
   test::MockGSSAPILibrary::SecurityContextQuery queries[] = {
     test::MockGSSAPILibrary::SecurityContextQuery(
         "Negotiate",            // Package name
         GSS_S_CONTINUE_NEEDED,  // Major response code
         0,                      // Minor response code
         context1,               // Context
         NULL,                   // Expected input token
@@ skipping 52 matching lines @@
   major_status = mock_library->delete_sec_context(&minor_status,
                                                   &context_handle,
                                                   GSS_C_NO_BUFFER);
   EXPECT_EQ(static_cast<OM_uint32>(GSS_S_COMPLETE), major_status);
 }
 
 TEST(HttpAuthGSSAPITest, ParseChallenge_FirstRound) {
   // The first round should just consist of an unadorned "Negotiate" header.
   test::MockGSSAPILibrary mock_library;
   HttpAuthGSSAPI auth_gssapi(&mock_library, "Negotiate",
-                             CHROME_GSS_KRB5_MECH_OID_DESC);
+                             CHROME_GSS_SPNEGO_MECH_OID_DESC);
   std::string challenge_text = "Negotiate";
   HttpAuth::ChallengeTokenizer challenge(challenge_text.begin(),
                                          challenge_text.end());
   EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
             auth_gssapi.ParseChallenge(&challenge));
 }
 
 TEST(HttpAuthGSSAPITest, ParseChallenge_TwoRounds) {
   // The first round should just have "Negotiate", and the second round should
   // have a valid base64 token associated with it.
   test::MockGSSAPILibrary mock_library;
   HttpAuthGSSAPI auth_gssapi(&mock_library, "Negotiate",
-                             CHROME_GSS_KRB5_MECH_OID_DESC);
+                             CHROME_GSS_SPNEGO_MECH_OID_DESC);
   std::string first_challenge_text = "Negotiate";
   HttpAuth::ChallengeTokenizer first_challenge(first_challenge_text.begin(),
                                                first_challenge_text.end());
   EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
             auth_gssapi.ParseChallenge(&first_challenge));
 
   // Generate an auth token and create another thing.
   EstablishInitialContext(&mock_library);
   std::string auth_token;
   EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                               &auth_token));
 
   std::string second_challenge_text = "Negotiate Zm9vYmFy";
   HttpAuth::ChallengeTokenizer second_challenge(second_challenge_text.begin(),
                                                 second_challenge_text.end());
   EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
             auth_gssapi.ParseChallenge(&second_challenge));
 }
 
 TEST(HttpAuthGSSAPITest, ParseChallenge_UnexpectedTokenFirstRound) {
   // If the first round challenge has an additional authentication token, it
   // should be treated as an invalid challenge from the server.
   test::MockGSSAPILibrary mock_library;
   HttpAuthGSSAPI auth_gssapi(&mock_library, "Negotiate",
-                             CHROME_GSS_KRB5_MECH_OID_DESC);
+                             CHROME_GSS_SPNEGO_MECH_OID_DESC);
   std::string challenge_text = "Negotiate Zm9vYmFy";
   HttpAuth::ChallengeTokenizer challenge(challenge_text.begin(),
                                          challenge_text.end());
   EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_INVALID,
             auth_gssapi.ParseChallenge(&challenge));
 }
 
 TEST(HttpAuthGSSAPITest, ParseChallenge_MissingTokenSecondRound) {
   // If a later-round challenge is simply "Negotiate", it should be treated as
   // an authentication challenge rejection from the server or proxy.
   test::MockGSSAPILibrary mock_library;
   HttpAuthGSSAPI auth_gssapi(&mock_library, "Negotiate",
-                             CHROME_GSS_KRB5_MECH_OID_DESC);
+                             CHROME_GSS_SPNEGO_MECH_OID_DESC);
   std::string first_challenge_text = "Negotiate";
   HttpAuth::ChallengeTokenizer first_challenge(first_challenge_text.begin(),
                                                first_challenge_text.end());
   EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
             auth_gssapi.ParseChallenge(&first_challenge));
 
   EstablishInitialContext(&mock_library);
   std::string auth_token;
   EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                               &auth_token));
   std::string second_challenge_text = "Negotiate";
   HttpAuth::ChallengeTokenizer second_challenge(second_challenge_text.begin(),
                                                 second_challenge_text.end());
   EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_REJECT,
             auth_gssapi.ParseChallenge(&second_challenge));
 }
 
 TEST(HttpAuthGSSAPITest, ParseChallenge_NonBase64EncodedToken) {
   // If a later-round challenge has an invalid base64 encoded token, it should
   // be treated as an invalid challenge.
   test::MockGSSAPILibrary mock_library;
   HttpAuthGSSAPI auth_gssapi(&mock_library, "Negotiate",
-                             CHROME_GSS_KRB5_MECH_OID_DESC);
+                             CHROME_GSS_SPNEGO_MECH_OID_DESC);
   std::string first_challenge_text = "Negotiate";
   HttpAuth::ChallengeTokenizer first_challenge(first_challenge_text.begin(),
                                                first_challenge_text.end());
   EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_ACCEPT,
             auth_gssapi.ParseChallenge(&first_challenge));
 
   EstablishInitialContext(&mock_library);
   std::string auth_token;
   EXPECT_EQ(OK, auth_gssapi.GenerateAuthToken(NULL, L"HTTP/intranet.google.com",
                                               &auth_token));
   std::string second_challenge_text = "Negotiate =happyjoy=";
   HttpAuth::ChallengeTokenizer second_challenge(second_challenge_text.begin(),
                                                 second_challenge_text.end());
   EXPECT_EQ(HttpAuth::AUTHORIZATION_RESULT_INVALID,
             auth_gssapi.ParseChallenge(&second_challenge));
 }
 
 }  // namespace net