maindavfs2 - Support: sr #107060, Support NTLM for davfs2

 
 

sr #107060: Support NTLM for davfs2

Submitter:  Ruediger Pluem <ruediger_pluem>
Submitted:  Wed 14 Oct 2009 10:49:54 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  _71007
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 02 Dec 2009 09:43:23 PM UTC, comment #15: 

There is a bug report on the neon mailing list about a buffer overflow in ne_ntlm.c. It might be the cause of the trouble.
Please have a look at http://lists.manyfish.co.uk/pipermail/neon/2009-November/001103.html. There is a patch included and as I understand there will also be a bugfix release soon.

Cheers
Werner

- <_71007>
Tue 24 Nov 2009 08:40:34 PM UTC, comment #14: 

I am not very familiar with interpreting backtraces. But the bufferoverflows happens within neon. Beginning from ne_end_request there are another four function calls before it crashes.
You might report this to the neon maintainers. But before doing so you should check what might have gone wrong with your libneon installation. Did you run ldconfig?

debug log
---------
There should be more than just messages in your /var/log directory. My Debian system for instance has a files /var/log/debug and /var/log/daemon.log and many others. Please search all log files. If you can't find debug messages from davfs2 your syslog is configured badly or seriously broken.
mount.davfs sends the log messages about username and password long before it crashes. The messages look like this:
Nov 24 21:32:23 ginster mount.davfs: Secrets:
Nov 24 21:32:23 ginster mount.davfs:   username: otto
Nov 24 21:32:23 ginster mount.davfs:   cl_username: (null)
Nov 24 21:32:23 ginster mount.davfs:   password: geheim
Nov 24 21:32:23 ginster mount.davfs:   p_user: (null)
Nov 24 21:32:23 ginster mount.davfs:   p_passwd: (null)
Nov 24 21:32:23 ginster mount.davfs:   clicert_pw: (null)

It could be useful to set option 'debug most' as well. It might show information at what point neon crashes. Neon creates a lot of debug output too, which is send by mount.davfs to the syslog daemon.

Cheers
Werner

- <_71007>
Tue 24 Nov 2009 07:03:26 AM UTC, comment #13: 

Yes, well with the non-openssl neon I get only this in the log:

[root@tlik ~]# grep davfs /var/log/messages
Nov 23 13:51:45 tlik mount.davfs: authentication failure:
Nov 23 13:51:45 tlik mount.davfs:   Digest
[root@tlik ~]#


WHwn I use the openssl enabled version I get nothing in the log-files. Only the Backtrace (anonymified):

[user@tlik ~]$ mount /home/user/doc
Please enter the username to authenticate with server
http://server/doc/ or hit enter for none.
  Username: DOMAIN\user
Please enter the password to authenticate user DOMAIN\user with server
http://server/doc/ or hit enter for none.
  Password: 
* buffer overflow detected *: /sbin/mount.davfs terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x48)[0x82d938]
/lib/libc.so.6[0x82ba30]
/usr/lib/libneon.so.27[0x90edf0]
/usr/lib/libneon.so.27[0x90f24c]
/usr/lib/libneon.so.27[0x90aff7]
/usr/lib/libneon.so.27[0x90abc5]
/usr/lib/libneon.so.27(ne_end_request+0x76)[0x8fe9d6]
/usr/lib/libneon.so.27(ne_request_dispatch+0x49)[0x9008b9]
/usr/lib/libneon.so.27(ne_options2+0x3b)[0x90280b]
/usr/lib/libneon.so.27(ne_options+0x4a)[0x90296a]
/sbin/mount.davfs[0x805e562]
/sbin/mount.davfs[0x805f8ad]
/sbin/mount.davfs[0x804de79]
/sbin/mount.davfs[0x804fbda]
/sbin/mount.davfs[0x805c433]
/lib/libc.so.6(__libc_start_main+0xe5)[0x7466e5]
/sbin/mount.davfs[0x804b0a1]
======= Memory map: ========
00114000-00115000 r-xp 00114000 00:00 0          [vdso]
00115000-00128000 r-xp 00000000 fd:00 111322     /lib/libz.so.1.2.3
00128000-00129000 rw-p 00012000 fd:00 111322     /lib/libz.so.1.2.3
00129000-00132000 r-xp 00000000 fd:00 111294     /lib/libnss_nis-2.9.so
00132000-00133000 r--p 00009000 fd:00 111294     /lib/libnss_nis-2.9.so
00133000-00134000 rw-p 0000a000 fd:00 111294     /lib/libnss_nis-2.9.so
0045d000-00466000 r-xp 00000000 fd:04 1250154    /usr/lib/libkrb5support.so.0.1
00466000-00467000 rw-p 00008000 fd:04 1250154    /usr/lib/libkrb5support.so.0.1
0049a000-004be000 r-xp 00000000 fd:04 1250155    /usr/lib/libk5crypto.so.3.1
004be000-004bf000 rw-p 00024000 fd:04 1250155    /usr/lib/libk5crypto.so.3.1
00529000-00557000 r-xp 00000000 fd:04 1250109    /usr/lib/libgssapi_krb5.so.2.2
00557000-00558000 rw-p 0002e000 fd:04 1250109    /usr/lib/libgssapi_krb5.so.2.2
0055a000-005a1000 r-xp 00000000 fd:00 111532     /lib/libssl.so.0.9.8g
005a1000-005a5000 rw-p 00046000 fd:00 111532     /lib/libssl.so.0.9.8g
00668000-0066d000 r-xp 00000000 fd:00 111288     /lib/libnss_dns-2.9.so
0066d000-0066e000 r--p 00004000 fd:00 111288     /lib/libnss_dns-2.9.so
0066e000-0066f000 rw-p 00005000 fd:00 111288     /lib/libnss_dns-2.9.so
006f6000-00703000 r-xp 00000000 fd:00 113267     /lib/libgcc_s-4.3.2-20081105.so.1
00703000-00704000 rw-p 0000c000 fd:00 113267     /lib/libgcc_s-4.3.2-20081105.so.1
00707000-00727000 r-xp 00000000 fd:00 112897     /lib/ld-2.9.so
00728000-00729000 r--p 00020000 fd:00 112897     /lib/ld-2.9.so
00729000-0072a000 rw-p 00021000 fd:00 112897     /lib/ld-2.9.so
00730000-0089e000 r-xp 00000000 fd:00 113249     /lib/libc-2.9.so
0089e000-008a0000 r--p 0016e000 fd:00 113249     /lib/libc-2.9.so
008a0000-008a1000 rw-p 00170000 fd:00 113249     /lib/libc-2.9.so
008a1000-008a4000 rw-p 008a1000 00:00 0
008d1000-008d4000 r-xp 00000000 fd:00 113255     /lib/libdl-2.9.so
008d4000-008d5000 r--p 00002000 fd:00 113255     /lib/libdl-2.9.so
008d5000-008d6000 rw-p 00003000 fd:00 113255     /lib/libdl-2.9.so
008d8000-008ee000 r-xp 00000000 fd:00 113259     /lib/libpthread-2.9.so
008ee000-008ef000 r--p 00015000 fd:00 113259     /lib/libpthread-2.9.so
008ef000-008f0000 rw-p 00016000 fd:00 113259     /lib/libpthread-2.9.so
008f0000-008f2000 rw-p 008f0000 00:00 0
008f6000-0091f000 r-xp 00000000 fd:04 1249719    /usr/lib/libneon.so.27.2.0
0091f000-00920000 rw-p 00028000 fd:04 1249719    /usr/lib/libneon.so.27.2.0
00a42000-00a48000 r-xp 00000000 fd:04 1251016    /usr/lib/libpakchois.so.0.1.0
00a48000-00a49000 rw-p 00005000 fd:04 1251016    /usr/lib/libpakchois.so.0.1.0
00a65000-00a70000 r-xp 00000000 fd:00 111290     /lib/libnss_files-2.9.so
00a70000-00a71000 r--p 0000a000 fd:00 111290     /lib/libnss_files-2.9.so
00a71000-00a72000 rw-p 0000b000 fd:00 111290     /lib/libnss_files-2.9.so
00beb000-00c06000 r-xp 00000000 fd:00 112231     /lib/libselinux.so.1
00c06000-00c07000 r--p 0001a000 fd:00 112231     /lib/libselinux.so.1
00c07000-00c08000 rw-p 0001b000 fd:00 112231     /lib/libselinux.so.1
00c38000-00c3a000 r-xp 00000000 fd:00 111528     /lib/libcom_err.so.2.1
00c3a000-00c3b000 rw-p 00001000 fd:00 111528     /lib/libcom_err.so.2.1
00c45000-00c6a000 r-xp 00000000 fd:00 111411     /lib/libexpat.so.1.5.2
00c6a000-00c6c000 rw-p 00024000 fd:00 111411     /lib/libexpat.so.1.5.2
0350b000-03642000 r-xp 00000000 fd:00 111186     /lib/libcrypto.so.0.9.8g
03642000-03656000 rw-p 00136000 fd:00 111186     /lib/libcrypto.so.0.9.8g
03656000-03659000 rw-p 03656000 00:00 0
041c7000-04263000 r-xp 00000000 fd:04 1250059    /usr/lib/libkrb5.so.3.3
04263000-04266000 rw-p 0009b000 fd:04 1250059    /usr/lib/libkrb5.so.3.3
04618000-0462e000 r-xp 00000000 fd:00 113254     /lib/libnsl-2.9.so
0462e000-0462f000 r--p 00016000 fd:00 113254     /lib/libnsl-2.9.so
0462f000-04630000 rw-p 00017000 fd:00 113254     /lib/libnsl-2.9.so
04630000-04632000 rw-p 04630000 00:00 0
04654000-04667000 r-xp 00000000 fd:00 113271     /lib/libresolv-2.9.so
04667000-04668000 r--p 00012000 fd:00 113271     /lib/libresolv-2.9.so
04668000-04669000 rw-p 00013000 fd:00 113271     /lib/libresolv-2.9.so
04669000-0466b000 rw-p 04669000 00:00 0
04aaa000-04aac000 r-xp 00000000 fd:00 113270     /lib/libkeyutils-1.2.so
04aac000-04aad000 rw-p 00001000 fd:00 113270     /lib/libkeyutils-1.2.so
08048000-08066000 r-xp 00000000 fd:04 620226     /usr/sbin/mount.davfs
08066000-08068000 rw-p 0001d000 fd:04 620226     /usr/sbin/mount.davfs
089b5000-089d6000 rw-p 089b5000 00:00 0          [heap]
b7682000-b7882000 r--p 00000000 fd:04 1248878    /usr/lib/locale/locale-archive
b7882000-b7887000 rw-p b7882000 00:00 0
b789b000-b78a2000 r--s 00000000 fd:04 1248743    /usr/lib/gconv/gconv-modules.cache
b78a2000-b78a3000 r--p 00000000 fd:04 343633     /usr/share/locale/en_GB/LC_MESSAGES/libc.mo
b78a3000-b78a5000 rw-p b78a3000 00:00 0
b78a5000-b78a6000 r--p 00baf000 fd:04 1248878    /usr/lib/locale/locale-archive
bfad8000-bfaed000 rw-p bffeb000 00:00 0          [stack]
[user@tlik ~]$


Tony Lindström <tonykl>
Mon 23 Nov 2009 06:46:07 PM UTC, comment #12: 

One more point:
Please search all your log files for "mount.davfs". If there really are no log entries from mount.davfs then your syslog seems to be configured in a very unusual way (after all, the log files are your best friends. No Unix-like operating system should prevent them from helping you.) The log entries from mount.davfs are the easiest way to track down many (not all) problems.

- <_71007>
Mon 23 Nov 2009 06:34:57 PM UTC, comment #11: 

You may attach the backtrace as a file (see bottons further down in this page), but for 70 lines you may as well paste them into the message text.

I got an answer from the Neon mailing list concerning GnuTLS:
"The platform-independent NTLM implementation (I do not mean the SSPI-based implementation, that is only avail on Window) does currently only work with OpenSSL, not GnuTLS. The respective code in ne_ntlm.c would need to be ported to the neon SSL API in order to get GnuTLS work as well. Thus, config is correct, unfortunately."

So NTLM only works with OpenSSL unless somewone does the work to port the code.

Cheers
Werner

- <_71007>
Mon 23 Nov 2009 11:42:26 AM UTC, comment #10: 

Ok. I compiled neon with open-ssl. And the recompiled davfs2-1-4.5. Something definiately changed, because now when I try to mount the sharepoint server or the plain IIS server, I get:
* buffer overflow detected *: /sbin/mount.davfs terminated
(And a backtrace, where can I send it?) Or is it ok to paste it  here? It is only about 70 lines....

I can't get anything to the syslog files even though I have enabled debug secrests, both in the global and the users davfs2-.conf files.
 


Tony Lindström <tonykl>
Sat 21 Nov 2009 04:23:55 PM UTC, comment #9: 

The problems in the two cases seem to be of different nature.

1. Sharepoint
-------------
/sbin/mount.davfs: Mounting failed.
Could not authenticate to server: rejected Digest challenge

The Sharepoint server asks for Digest-authentication (not NTLM). Neon tries to get username and password from davfs2 but does not get them.

Are you sure you supplied unsername and password to davfs2? To check:
Please add option 'debug secrets' to your davfs2.conf file and mount. One of your system's log files should show messages from mount.davfs displaying username and password as davfs2 has parsed them.

2. IIS
------
/sbin/mount.davfs: Mounting failed.
Could not authenticate to server: ignored NTLM challenge, GSSAPI authentication error: Unspecified GSS failure. Minor code may provide more information: No credentials cache found

Your neon library seems not to support NTLM authentication, while GSSAPI is not configured appropriately. But you want to use NTLM. It's a bit trcky:
Neon will only support NTLM when built with OpenSSL. It will not support NTLM without SSL-support and not with GnuTLS.
While I understand that using NTLM without SSL is a bad idea anyway, I am not clear why it is not supported when using GnuTLS. I asked at the Neon mailing list for this.

Please try this:
Check the file config.h in your Neon sources for "#define HAVE_NTLM". If it is not there or "/* #undef HAVE_NTLM */" instead, NTLM is not supported.
Configure your Neon library '--with-neon=openssl' and try again.

Cheers
Werner

- <_71007>
Fri 20 Nov 2009 12:46:47 PM UTC, comment #8: 

I can't get this to work. I have davfs2-1.4.5 and neon-0.29.0, (own made packages on Fedora 10) but when I try to connect to a sharepoint 2003 server I get:

/sbin/mount.davfs: Mounting failed.
Could not authenticate to server: rejected Digest challenge

If I try to mount from an basic IIS-server with NTLM-authentication I get:

/sbin/mount.davfs: Mounting failed.
Could not authenticate to server: ignored NTLM challenge, GSSAPI authentication error: Unspecified GSS failure.  Minor code may provide more information: No credentials cache found

Googling around tells me, that this is what I get if I don't have
 ntlm-support in neon. But the 0.29 should have it???


Tony Lindström <tonykl>
Fri 16 Oct 2009 05:58:58 AM UTC, comment #7: 


> The config.h (the davfs2 config.h, neon's config.h is only needed > for compiling neon not for programs that include neon) is created > by the ./configure script from config.h.in according to the
> results of its many tests. With davfs2 config.h is the first
> #include in every .c-file. This allows to make compilation depend
> on the results of ./configure. davfs2 uses this e.g. for some
> neon functions and for the inclusion/exclusion of gettext.


Thanks for clarification. I missed that these defines are part of davfs2's config.h and get set up accordingly by the configure script of davfs2.

Regards

Rüdiger

Ruediger Pluem <ruediger_pluem>
Fri 16 Oct 2009 05:54:06 AM UTC, comment #6: 

I did nothing special. After compiling the patched davfs2 against neon 0.29 it just worked.
But keep in mind the following two issues:

1. Put the domain name in front of the user name.
2. Give write permissions to the user in Sharepoint. Sharepoint only accepts PROPFIND requests if the user has write permissions.

Ruediger Pluem <ruediger_pluem>
Thu 15 Oct 2009 11:29:17 PM UTC, comment #5: 

Rüdiger,

This is interesting timing as I have bee trying to get Sharepoint NTLM authentication working all day (davfs2 v1.4.1 on CentOS 5 to MOSS 2007 on Server 2003). In the HTTP logs I ame seeing the initial connection, which is geting the 401.2 error, but davfs2 is not following up with the user credentials.

I'm thinking it must be a configuration issue, but the man pages are no help.

May I ask how you got it to work?

Eric Diamond <ediamond>
Thu 15 Oct 2009 05:11:57 PM UTC, comment #4: 

The config.h (the davfs2 config.h, neon's config.h is only needed for compiling neon not for programs that include neon) is created by the ./configure script from config.h.in according to the results of its many tests. With davfs2 config.h is the first #include in every .c-file. This allows to make compilation depend on the results of ./configure. davfs2 uses this e.g. for some neon functions and for the inclusion/exclusion of gettext.

Cheers
Werner

- <_71007>
Thu 15 Oct 2009 06:39:54 AM UTC, comment #3: 

Yes, I tested NTLM against a MS Sharepoint provided DAV that requires NTLM.
I haven't checked GSSAPI/SSPI and frankly I don't know how and I don't know if davfs2 has to do something special here.
But once it is enabled maybe someone else will test it for us :-).
Is the NE_VERSION_MINOR define really a public define in all versions?
I did a quick check for 0.26.0 and it seems to be only defined in config.h which doesn't get installed in the includes directory.


Regards

Rüdiger

Ruediger Pluem <ruediger_pluem>
Wed 14 Oct 2009 08:07:19 PM UTC, comment #2: 

Thanks for the patches.
I just uploaded the changes to CVS.
As the next release will be mainly a bug-fix release it will still support neon 0.25, doing some conditionals (#if NE_VERSION_MINOR), but with the next major changes I will drop support for neon 0.25.

Just to be sure and as I can't test NTLM authentication: you tested it?

By the way: Do you also know about GSSAPI/SSPI? Neon supports it but I know almost nothing about it. Has davfs2 to do something special or does it already work and I don't know?

Cheers
Werner

- <_71007>
Wed 14 Oct 2009 11:06:32 AM UTC, comment #1: 

Note: It is likely that it is no longer possible to compile against neon 0.25.x as the neon changelog says that ne_add_server_auth was added in 0.26.0. So the correct patch for configure.ac should be:

--- davfs2-1.4.1.orig/configure.ac 2009-06-12 21:16:11.000000000 +0200
+++ davfs2-1.4.1/configure.ac 2009-10-14 12:34:15.000000000 +0200
@@ -36,7 +36,7 @@
# Checks for libraries.
AM_GNU_GETTEXT_VERSION(0.14.4)
AM_GNU_GETTEXT([external])
-NE_REQUIRE_VERSIONS([0], [25 26 27 28])
+NE_REQUIRE_VERSIONS([0], [26 27 28 29])
DAV_CHECK_NEON

# Checks for header files.

(file #18877)

Ruediger Pluem <ruediger_pluem>
Wed 14 Oct 2009 10:49:54 AM UTC, original submission:  

The latest version of the neon library 0.29.0 supports NTLM. The following patch makes NTLM available to davfs2 when compiled against neon 0.29.0. Note that the neon home page states that neon 0.29.0 is API and ABI backwards-compatible with 0.28.x and 0.27.x.

--- davfs2-1.4.1.orig/configure.ac      2009-06-12 21:16:11.000000000 +0200
+++ davfs2-1.4.1/configure.ac   2009-10-14 12:34:15.000000000 +0200
@@ -36,7 +36,7 @@
 # Checks for libraries.
 AM_GNU_GETTEXT_VERSION(0.14.4)
 AM_GNU_GETTEXT([external])
-NE_REQUIRE_VERSIONS([0], [25 26 27 28])
+NE_REQUIRE_VERSIONS([0], [25 26 27 28 29])
 DAV_CHECK_NEON

 # Checks for header files.
diff -Nru davfs2-1.4.1.orig/src/webdav.c davfs2-1.4.1/src/webdav.c
--- davfs2-1.4.1.orig/src/webdav.c      2009-06-07 21:48:04.000000000 +0200
+++ davfs2-1.4.1/src/webdav.c   2009-10-14 12:36:30.000000000 +0200
@@ -370,7 +370,7 @@
         username = ne_strdup(args->username);
     if (args->password)
         password = ne_strdup(args->password);
-    ne_set_server_auth(session, auth, "server");
+    ne_add_server_auth(session, NE_AUTH_ALL, auth, "server");

     if (args->useproxy && args->p_host) {
         ne_session_proxy(session, args->p_host, args->p_port);
@@ -378,7 +378,7 @@
             p_username = ne_strdup(args->p_user);
         if (args->p_passwd)
             p_password = ne_strdup(args->p_passwd);
-        ne_set_proxy_auth(session, auth, "proxy");
+        ne_add_proxy_auth(session, NE_AUTH_ALL, auth, "proxy");
     }

     if (strcmp(args->scheme, "https") == 0) {

Ruediger Pluem <ruediger_pluem>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #18877:  davfs2_ntlm2.diff added by ruediger_pluem (1KiB - text/x-patch)
file #18876:  davfs2_ntlm.diff added by ruediger_pluem (1KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by tonykl (Posted a comment)
  • -email is unavailable- added by ediamond (Posted a comment)
  • -email is unavailable- added by _71007 (Posted a comment)
  • -email is unavailable- added by ruediger_pluem (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-07-19 _71007 Open/ClosedOpen Closed
    2010-01-11 _71007 StatusIn Progress Done
    2009-11-21 _71007 StatusDone In Progress
    2009-10-14 _71007 StatusNone Done
        Assigned toNone _71007
    2009-10-14 ruediger_pluem Attached File- Added davfs2_ntlm2.diff, #18877
    2009-10-14 ruediger_pluem Attached File- Added davfs2_ntlm.diff, #18876

    Back to the top

    Powered by Savane 3.13-caa5.
    Corresponding source code