I'm still a bit fuzzy on exactly what has blown up here since my 1.2
install (or maybe it was broken then and I never noticed), but it
looks like the way dovecot is calling out to ntlm_auth is violating
the --helper-protocol=squid-2.5-ntlmssp scheme.
The issue is how it handles simultaneous clients connecting - for
instance launching thunderbird with NTLM auth creates multiple imapds
that all have to be auth'd.
Since dovecot doesn't (and apparrently didn't in 1.2?) serialize this
it ends up sending a jumble to ntlm_auth. Strace sayth, as example:
read(0, "YR xxxxxxx=\n", 4096) = 48
read(0, "YR xxxxxxx=\n", 4096) = 48
read(0, "KK xxxxxxx=\n",4096) = 176
read(0, "KK xxxxxxx=\n",4096) = 176
That is two clients connecting at once, and the sequence has become
jumbled.
Fiddling around with ntlm_auth manually I can get it to give me this:
YR xxx # 1
TT xxx # 1
YR xxx # 2
TT xxx # 2
KK xxx # 2
AF jgg # 2
KK xxx # 1
Called NTLMSSP after state machine was 'done'
GENSEC login failed: NT_STATUS_INVALID_PARAMETER
NA NT_STATUS_INVALID_PARAMETER
Ie, reordering the sequence (# 1 and # 2) causes it to tell you that,
no, the sequence cannot be reordered.
To me this says the samba folks expect that the YY/TT/KK/AF sequence
is *NOT* reordered.
The implication is that the mech-winbind in dovecot must seralize
everything, and it doesn't!
So, this is fairly broken, I can hit these failure causes with a high
probability when using thunderbird.
Any thoughts on how to repair this?
The simplest answer would be to pool and assign a ntlm_auth process to
each incoming auth context, or to actually serialize auth. But it
can't treat ntlm_auth as a stateless helper.
Jason
