tests/httpProxy.test - add new tests for cleanup (mainly after 407 request) by checking that a second request is handled correctly.

1 files changed, 638 insertions, 0 deletions

diff --git a/tests/httpProxy.test b/tests/httpProxy.test
index d9e865a..d8bd6b7 100644
--- a/tests/httpProxy.test
+++ b/tests/httpProxy.test
@@ -26,6 +26,10 @@ proc bgerror {args} {
     puts stderr $errorInfo
 }
 
+proc stopMe {token} {
+    set ${token}(z) done
+}
+
 if {![info exists ThreadLevel]} {
     if {[catch {package require Thread}] == 0} {
         set ValueRange {0 1 2}
@@ -303,6 +307,294 @@ test httpProxy-3.6.$ThreadLevel {https with-proxy ipv6 with-auth valid-creds-pro
     http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
 }
 
+test httpProxy-3.7.$ThreadLevel {http with-proxy ipv4 with-auth valid-creds-provided; check that 2nd valid request with creds is possible, and keep-alive works} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth $aliceCreds
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- HttpProxy 1 1 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.7x.$ThreadLevel {http with-proxy ipv4 with-auth 1st request no-creds-provided; check that 2nd request with creds is possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth {}
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000]
+
+    http::config -proxyauth $aliceCreds
+} -body {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- HttpProxy 1 1 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.8.$ThreadLevel {https with-proxy ipv4 with-auth valid-creds-provided; check that 2nd valid request with creds is possible, and keep-alive works} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth $aliceCreds
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- SecureProxy 0 0 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.8x.$ThreadLevel {https with-proxy ipv4 with-auth 1st request no-creds-provided; check that 2nd request with creds is possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth {}
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000]
+
+    http::config -proxyauth $aliceCreds
+} -body {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- SecureProxy 0 0 -- -1 done 0} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.9.$ThreadLevel {http with-proxy ipv6 with-auth valid-creds-provided; check that 2nd valid request with creds is possible, and keep-alive works} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth $aliceCreds
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- HttpProxy 1 1 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.9p.$ThreadLevel {http with-proxy ipv6 with-auth valid-creds-provided; check that 2nd valid request with creds is possible, and keep-alive works, pipelining requested and possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth $aliceCreds
+} -body {
+    set can0 [after 6000 {http::reset $token0; set ${token0}(z) timeout}]
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+after idle {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+}
+    vwait ${token0}(z)
+    after cancel $can0
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- HttpProxy 1 1 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can0 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.9x.$ThreadLevel {http with-proxy ipv6 with-auth 1st request no-creds-provided; check that 2nd request with creds is possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth {}
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000]
+
+    http::config -proxyauth $aliceCreds
+} -body {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- HttpProxy 1 1 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.10.$ThreadLevel {https with-proxy ipv6 with-auth valid-creds-provided; check that 2nd valid request with creds is possible, and keep-alive works} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth $aliceCreds
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- SecureProxy 0 0 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.10p.$ThreadLevel {https with-proxy ipv6 with-auth valid-creds-provided; check that 2nd valid request with creds is possible, and keep-alive works, pipelining requested and possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth $aliceCreds
+} -body {
+    set can0 [after 6000 {http::reset $token0; set ${token0}(z) timeout}]
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+after idle {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token0; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+}
+    vwait ${token0}(z)
+    after cancel $can0
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- SecureProxy 0 0 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can0 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-3.10x.$ThreadLevel {https with-proxy ipv6 with-auth 1st request no-creds-provided; check that 2nd request with creds is possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth {}
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000]
+
+    http::config -proxyauth $aliceCreds
+} -body {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 200 -- SecureProxy 0 0 -- -1 done 0} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
 test httpProxy-4.1.$ThreadLevel {http no-proxy with-auth no-creds-provided} -constraints {needsSquid} -setup {
    http::config -proxyhost {} -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth {}
 } -body {
@@ -399,6 +691,179 @@ test httpProxy-4.6.$ThreadLevel {https with-proxy ipv6 with-auth no-creds-provid
     http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
 }
 
+test httpProxy-4.7.$ThreadLevel {http with-proxy ipv4 with-auth no-creds-provided; check that 2nd request is possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth {}
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- HttpProxy 0 0 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-4.8.$ThreadLevel {https with-proxy ipv4 with-auth no-creds-provided; check that 2nd request is possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth {}
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- SecureProxyFailed 0 0 -- -1 done 0} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-4.9.$ThreadLevel {http with-proxy ipv6 with-auth no-creds-provided; check that 2nd request is possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth {}
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- HttpProxy 0 0 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-4.9p.$ThreadLevel {http with-proxy ipv6 with-auth no-creds-provided; check that 2nd request is possible, pipelining requested and possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth {}
+} -body {
+    set can0 [after 6000 {http::reset $token0; set ${token0}(z) timeout}]
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+after idle {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token0; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+}
+    vwait ${token0}(z)
+    after cancel $can0
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- HttpProxy 0 0 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can0 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-4.10.$ThreadLevel {https with-proxy ipv6 with-auth no-creds-provided; check that 2nd request is possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth {}
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- SecureProxyFailed 0 0 -- -1 done 0} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-4.10p.$ThreadLevel {https with-proxy ipv6 with-auth no-creds-provided; check that 2nd request is possible, pipelining requested but not possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth {}
+} -body {
+    set can0 [after 6000 {http::reset $token0; set ${token0}(z) timeout}]
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+
+after idle {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+}
+    vwait ${token0}(z)
+    after cancel $can0
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $aliceCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- SecureProxyFailed 0 0 -- -1 done 0} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can0 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
 test httpProxy-5.1.$ThreadLevel {http no-proxy with-auth bad-creds-provided} -constraints {needsSquid} -setup {
    http::config -proxyhost {} -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth $badCreds
 } -body {
@@ -495,10 +960,183 @@ test httpProxy-5.6.$ThreadLevel {https with-proxy ipv6 with-auth bad-creds-provi
     http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
 }
 
+test httpProxy-5.7.$ThreadLevel {http with-proxy ipv4 with-auth bad-creds-provided; check that 2nd request is possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth $badCreds
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $badCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- HttpProxy 1 1 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-5.7p.$ThreadLevel {http with-proxy ipv4 with-auth bad-creds-provided; check that 2nd request is possible, pipelining requested and possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth $badCreds
+} -body {
+    set can0 [after 6000 {http::reset $token0; set ${token0}(z) timeout}]
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    # Use the same caution as for the corresponding https test.
+after idle {
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+}
+    vwait ${token0}(z)
+    after cancel $can0
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $badCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- HttpProxy 1 1 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can0 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-5.8.$ThreadLevel {https with-proxy ipv4 with-auth bad-creds-provided; check that 2nd request is possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth $badCreds
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $badCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- SecureProxyFailed 1 1 -- -1 done 0} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-5.8p.$ThreadLevel {https with-proxy ipv4 with-auth bad-creds-provided; check that 2nd request is possible, pipelining requested but not possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a4host -proxyport $a4port -proxynot {127.0.0.1 localhost} -proxyauth $badCreds
+} -body {
+    set can0 [after 6000 {http::reset $token0; set ${token0}(z) timeout}]
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+after idle {
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+}
+    vwait ${token0}(z)
+    after cancel $can0
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $badCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- SecureProxyFailed 1 1 -- -1 done 0} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can0 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-5.9.$ThreadLevel {http with-proxy ipv6 with-auth bad-creds-provided; check that 2nd request is possible} -constraints {needsSquid} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth $badCreds
+    set token0 [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # Use the same caution as for the corresponding https test.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl http://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $badCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- HttpProxy 1 1 -- -1 done 1} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
+test httpProxy-5.10.$ThreadLevel {https with-proxy ipv6 with-auth bad-creds-provided; check that 2nd request is possible} -constraints {needsSquid needsTls} -setup {
+    array unset ::http::socketMapping
+    http::config -proxyhost $a6host -proxyport $a6port -proxynot {::1 localhost} -proxyauth $badCreds
+    set token0 [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000]
+} -body {
+    # If a bug passes the socket of a failed CONNECT to the main request, an infinite
+    # wait can occur despite -timeout.  Fix this with http::reset; to do this the call
+    # to http::geturl must be async so we have $token for use as argument of reset.
+    set can [after 6000 {http::reset $token; set ${token}(z) timeout}]
+    set token [http::geturl https://www.google.com/ -keepalive 1 -timeout 5000 -command stopMe]
+    vwait ${token}(z)
+    after cancel $can
+
+    set ri [http::responseInfo $token]
+    set pos1 [lsearch -exact [string tolower [set ${token}(requestHeaders)]] proxy-authorization]
+    set pos2 [lsearch -exact [set ${token}(requestHeaders)] $badCreds]
+    set same [string equal [set ${token0}(sock)] [set ${token}(sock)]]
+    set res "[dict get $ri stage] [dict get $ri status] [dict get $ri responseCode] --\
+             [dict get $ri proxyUsed] [expr {$pos1 > -1}] [expr {$pos2 > -1}] --\
+             [lsearch -glob [array get ::http::socketMapping] HTTP_PLACEHOLDER_*] [set ${token}(z)] $same"
+} -result {complete ok 407 -- SecureProxyFailed 1 1 -- -1 done 0} -cleanup {
+    http::cleanup $token0
+    http::cleanup $token
+    unset -nocomplain token0 token ri res pos1 pos2 can same
+    array unset ::http::socketMapping
+    http::config -proxyhost {} -proxyport {} -proxynot {} -proxyauth {}
+}
+
 # cleanup
 unset -nocomplain n4host n6host n4port n6port a4host a6host a4port a6port aliceCreds badCreds
 
 rename bgerror {}
+rename stopMe {}
 
 ::tcltest::cleanupTests