make EstablishProxyTunnelAsync throw on failure status code from proxy (#50763)

* make EstablishProxyTunnelAsync throw on failure status code from proxy and fix relevant test

* ensure tunnelResponse is disposed on exception

* Update src/libraries/System.Net.Http/src/Resources/Strings.resx

Co-authored-by: Stephen Toub <[email protected]>

Co-authored-by: Geoffrey Kizer <[email protected]>
Co-authored-by: Stephen Toub <[email protected]>

Author: 3 people

src/libraries/Common/tests/System/Net/Http/HttpClientHandlerTest.Proxy.cs

@@ -280,9 +280,8 @@ public async Task AuthenticatedProxiedRequest_GetAsyncWithNoCreds_ProxyAuthentic
             }
         }
 
-        [OuterLoop("Uses external server")]
         [Fact]
-        public async Task AuthenticatedProxyTunnelRequest_PostAsyncWithNoCreds_ProxyAuthenticationRequiredStatusCode()
+        public async Task AuthenticatedProxyTunnelRequest_PostAsyncWithNoCreds_Throws()
         {
             if (IsWinHttpHandler)
             {
@@ -300,14 +299,13 @@ public async Task AuthenticatedProxyTunnelRequest_PostAsyncWithNoCreds_ProxyAuth
                 handler.Proxy = new WebProxy(proxyServer.Uri);
                 handler.ServerCertificateCustomValidationCallback = TestHelper.AllowAllCertificates;
                 using (HttpClient client = CreateHttpClient(handler))
-                using (HttpResponseMessage response = await client.PostAsync(Configuration.Http.SecureRemoteEchoServer, new StringContent(content)))
                 {
-                    Assert.Equal(HttpStatusCode.ProxyAuthenticationRequired, response.StatusCode);
+                    HttpRequestException e = await Assert.ThrowsAnyAsync<HttpRequestException>(async () => await client.PostAsync("https://nosuchhost.invalid", new StringContent(content)));
+                    Assert.Contains("407", e.Message);
                 }
             }
         }
 
-
         [ConditionalFact(typeof(PlatformDetection), nameof(PlatformDetection.IsNotWindowsSubsystemForLinux))] // [ActiveIssue("https://github.com/dotnet/runtime/issues/18258")]
         public async Task Proxy_SslProxyUnsupported_Throws()
         {

src/libraries/System.Net.Http/src/Resources/Strings.resx

@@ -606,4 +606,7 @@
   <data name="net_http_synchronous_reads_not_supported" xml:space="preserve">
     <value>Synchronous reads are not supported, use ReadAsync instead.</value>
   </data>
+  <data name="net_http_proxy_tunnel_returned_failure_status_code" xml:space="preserve">
+    <value>The proxy tunnel request to proxy '{0}' failed with status code '{1}'."</value>
+  </data>
 </root>

src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/AuthenticationHelper.NtAuth.cs

@@ -63,15 +63,7 @@ private static async Task<HttpResponseMessage> SendWithNtAuthAsync(HttpRequestMe
                         if (response.Headers.ConnectionClose.GetValueOrDefault())
                         {
                             // Server is closing the connection and asking us to authenticate on a new connection.
-                            // expression returns null connection on error, was not able to use '!' for the expression
-#pragma warning disable CS8600
-                            (connection, response) = await connectionPool.CreateHttp11ConnectionAsync(request, async, cancellationToken).ConfigureAwait(false);
-#pragma warning restore CS8600
-                            if (response != null)
-                            {
-                                return response;
-                            }
-
+                            connection = await connectionPool.CreateHttp11ConnectionAsync(request, async, cancellationToken).ConfigureAwait(false);
                             connectionPool.IncrementConnectionCount();
                             connection!.Acquire();
                             isNewConnection = true;