Merged from trunk

diff --cc src/HelperReply.cc
index 90721f99b7dcee9809b2d9e9e72c1daacc431975,bc33a84984ccdb814c07fbfed5f0f8ec1b68d985..2fa277ac8f11bd30559e3fa92a30fa355fab51c8
--- 1/src/HelperReply.cc
--- 2/src/HelperReply.cc
+++ b/src/HelperReply.cc
@@@ -33,29 -34,11 +39,29 @@@ HelperReply::HelperReply(const char *bu
          } else if (!strncmp(p,"TT ",3)) {
              // NTLM challenge token
              result = HelperReply::TT;
-             p+=2;
+             p+=3;
 +            // followed by an auth token
 +            char *token = strwordtok(NULL, &p);
 +            authToken.init();
 +            authToken.append(token, strlen(token));
          } else if (!strncmp(p,"AF ",3)) {
 -            // NTLM OK response
 -            result = HelperReply::AF;
 +            // NTLM/Negotate OK response
 +            result = HelperReply::OK;
              p+=3;
 +            // followed by:
 +            //  an auth token and user field
 +            // or, an optional username field
 +            char *blob = strwordtok(NULL, &p);
 +            char *arg = strwordtok(NULL, &p);
 +            if (arg != NULL) {
 +                authToken.init();
 +                authToken.append(blob, strlen(blob));
 +                user.init();
 +                user.append(arg,strlen(arg));
 +            } else if (blob != NULL) {
 +                user.init();
 +                user.append(blob, strlen(blob));
 +            }
          } else if (!strncmp(p,"NA ",3)) {
              // NTLM fail-closed ERR response
              result = HelperReply::NA;
@@@ -119,8 -60,7 +125,7 @@@ std::ostream 
  operator <<(std::ostream &os, const HelperReply &r)
  {
      os << "{result=";
-     switch(r.result)
-     {
 -    switch (r.result) {
++    switch(r.result) {
      case HelperReply::Okay:
          os << "OK";
          break;

diff --cc src/HelperReply.h
index 807ab77a9116c01527e2c4b04d7798569a86c0bf,ea1657d701e74f57377c718abcb9495b553a2239..8ebed059d7cf3fee272153ddccd6652b3cafa0cd
--- 1/src/HelperReply.h
--- 2/src/HelperReply.h
+++ b/src/HelperReply.h
@@@ -25,8 -24,7 +24,7 @@@ private
  
  public:
      // create/parse details from the msg buffer provided
 -    HelperReply(const char *buf, size_t len);
 +    HelperReply(const char *buf, size_t len, bool urlQuoting = false);
-     ~HelperReply() {}
  
      const MemBuf &other() const { return other_; }
  

diff --cc src/MemBuf.h
Simple merge

diff --cc src/auth/negotiate/UserRequest.cc
index 530fc908362d56f47f870506e65ec01a3a8a5420,77420cb616e3efb9e533f631e3ee73cbec94b65e..8749b723803a95086339260133a32f3bbf90fa27
--- 1/src/auth/negotiate/UserRequest.cc
--- 2/src/auth/negotiate/UserRequest.cc
+++ b/src/auth/negotiate/UserRequest.cc
@@@ -279,21 -278,21 +278,20 @@@ Auth::Negotiate::UserRequest::HandleRep
      case HelperReply::TT:
          /* we have been given a blob to send to the client */
          safe_free(lm_request->server_blob);
-         lm_request->request->flags.must_keepalive = 1;
-         if (lm_request->request->flags.proxy_keepalive) {
+         lm_request->request->flags.mustKeepalive = 1;
+         if (lm_request->request->flags.proxyKeepalive) {
 -            lm_request->server_blob = xstrdup(blob);
 +            lm_request->server_blob = xstrdup(reply.authToken.content());
              auth_user_request->user()->credentials(Auth::Handshake);
              auth_user_request->denyMessage("Authentication in progress");
 -            debugs(29, 4, HERE << "Need to challenge the client with a server blob '" << blob << "'");
 +            debugs(29, 4, HERE << "Need to challenge the client with a server token: '" << reply.authToken << "'");
          } else {
              auth_user_request->user()->credentials(Auth::Failed);
 -            auth_user_request->denyMessage("NTLM authentication requires a persistent connection");
 +            auth_user_request->denyMessage("Negotiate authentication requires a persistent connection");
          }
          break;
  
-     case HelperReply::Okay:
-     {
 -    case HelperReply::AF:
+     case HelperReply::Okay: {
 -        if (arg == NULL) {
 +        if (!reply.user.hasContent()) {
              // XXX: handle a success with no username better
              /* protocol error */
              fatalf("authenticateNegotiateHandleReply: *** Unsupported helper response ***, '%s'\n", reply.other().content());
@@@ -333,9 -332,9 +331,9 @@@
           * existing user or a new user */
          local_auth_user->expiretime = current_time.tv_sec;
          auth_user_request->user()->credentials(Auth::Ok);
 -        debugs(29, 4, HERE << "Successfully validated user via Negotiate. Username '" << arg << "'");
 +        debugs(29, 4, HERE << "Successfully validated user via Negotiate. Username '" << reply.user << "'");
      }
-         break;
+     break;
  
      case HelperReply::NA:
      case HelperReply::Error:

diff --cc src/auth/ntlm/UserRequest.cc
index 8e9384608242ff600a5b233c49891b4f20d8d81e,50d7e32fe71f4415357df13e952c5404b18a290e..4ded878fb7d752c1bec67af618c87cf8bf3a4328
--- 1/src/auth/ntlm/UserRequest.cc
--- 2/src/auth/ntlm/UserRequest.cc
+++ b/src/auth/ntlm/UserRequest.cc
@@@ -263,22 -262,22 +262,22 @@@ Auth::Ntlm::UserRequest::HandleReply(vo
      case HelperReply::TT:
          /* we have been given a blob to send to the client */
          safe_free(lm_request->server_blob);
-         lm_request->request->flags.must_keepalive = 1;
-         if (lm_request->request->flags.proxy_keepalive) {
+         lm_request->request->flags.mustKeepalive = 1;
+         if (lm_request->request->flags.proxyKeepalive) {
 -            lm_request->server_blob = xstrdup(blob);
 +            lm_request->server_blob = xstrdup(reply.authToken.content());
              auth_user_request->user()->credentials(Auth::Handshake);
              auth_user_request->denyMessage("Authentication in progress");
 -            debugs(29, 4, HERE << "Need to challenge the client with a server blob '" << blob << "'");
 +            debugs(29, 4, HERE << "Need to challenge the client with a server token: '" << reply.authToken << "'");
          } else {
              auth_user_request->user()->credentials(Auth::Failed);
              auth_user_request->denyMessage("NTLM authentication requires a persistent connection");
          }
          break;
  
-     case HelperReply::Okay:
-     {
+     case HelperReply::AF:
+     case HelperReply::Okay: {
          /* we're finished, release the helper */
 -        auth_user_request->user()->username(blob);
 +        auth_user_request->user()->username(reply.user.content());
          auth_user_request->denyMessage("Login successful");
          safe_free(lm_request->server_blob);
          lm_request->releaseAuthServer();
@@@ -310,9 -309,9 +309,9 @@@
           * existing user or a new user */
          local_auth_user->expiretime = current_time.tv_sec;
          auth_user_request->user()->credentials(Auth::Ok);
 -        debugs(29, 4, HERE << "Successfully validated user via NTLM. Username '" << blob << "'");
 +        debugs(29, 4, HERE << "Successfully validated user via NTLM. Username '" << reply.user << "'");
      }
-         break;
+     break;
  
      case HelperReply::NA:
      case HelperReply::Error:

diff --cc src/client_side.cc
Simple merge

diff --cc src/external_acl.cc
Simple merge

diff --cc src/helper.h
Simple merge

diff --cc src/ssl/helper.cc
index b5b64e850bc6049704ce16b6b43bbc4088296728,dd6b00b90f1bcb04d6f6d58b0fcdfc36cd1ad513..c6b109958907879fdcb626707fa0febdbd00c765
--- 1/src/ssl/helper.cc
--- 2/src/ssl/helper.cc
+++ b/src/ssl/helper.cc
@@@ -96,8 -93,9 +93,9 @@@ void Ssl::Helper::sslSubmit(CrtdMessag
          if (squid_curtime - first_warn > 3 * 60)
              fatal("SSL servers not responding for 3 minutes");
          debugs(34, DBG_IMPORTANT, HERE << "Queue overload, rejecting");
 -        const char *errMsg = "BH error 45 Temporary network problem, please retry later"; // XXX: upgrade to message=""
 +        const char *errMsg = "BH message=\"error 45 Temporary network problem, please retry later\"";
-         callback(data, HelperReply(errMsg,strlen(errMsg)));
+         HelperReply failReply(errMsg,strlen(errMsg));
+         callback(data, failReply);
          return;
      }