NET8 WcfClient (net-tcp binding) running on linux cannot be authenticated on WCF Server hosted on windows if UseManagedNtlm is set

[AlexanderUsmanov]

Description

Hello!
I found problem while trying to connect to WCF service hosted on Windows over net-tcp connection using WCF client on linux with windows local user credentials. Problem occurs just when switch System.Net.Security.UseManagedNtlm is set to true. Otherwise it working on ubuntu 20.04. On ubuntu 22.04 and higher there is known issue with OpenSSL 3+ (see #67353) and in this case it working just with workaround described here #67353 (comment).

I also tried to apply fix from #95725 but it doesn't work for me.
Is it any chance to get fix for this problem on net8?

Reproduction Steps

Here is repository with reproduction solution and steps: https://github.com/AlexanderUsmanov/WcfClientNet8-issue

Expected behavior

Managed NTLM working

Actual behavior

Managed NTLM failing

Regression?

No response

Known Workarounds

Use unmanaged implementation which working just in case of OpenSSL version < 3.0 (because in OpenSSL with version 3 and higher md4 was marked as deprecated).

Configuration

Client:

• .Net version: Net8
• OS: ubuntu 20.04
• Architecture: x64

Server:

• .Net version: Net Framework 4.7.2
• OS: Windows 10
• Architecture: x64

WCF binding: net-tcp

Other information

I have captures of traffic using both managed and unmanaged ntlm authentication over net-tcp
Captures.zip

Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

Hello!
I found problem while trying to connect to WCF service hosted on Windows over net-tcp connection using WCF client on linux with windows local user credentials. Problem occurs just when switch System.Net.Security.UseManagedNtlm is set to true. Otherwise it working on ubuntu 20.04. On ubuntu 22.04 and higher there is known issue with OpenSSL 3+ (see #67353) and in this case it working just with workaround described here #67353 (comment).

I also tried to apply fix from #95725 but it doesn't work for me.
Is it any chance to get fix for this problem on net8?

Reproduction Steps

Here is repository with reproduction solution and steps: https://github.com/AlexanderUsmanov/WcfClientNet8-issue

Expected behavior

Managed NTLM working

Actual behavior

Managed NTLM failing

Regression?

No response

Known Workarounds

Use unmanaged implementation which working just in case of OpenSSL version < 3.0 (because in OpenSSL with version 3 and higher md4 was marked as deprecated).

Configuration

Client:

• .Net version: Net8
• OS: ubuntu 20.04
• Architecture: x64

Server:

• .Net version: Net Framework 4.7.2
• OS: Windows 10
• Architecture: x64

WCF binding: net-tcp

Other information

I have captures of traffic using both managed and unmanaged ntlm authentication over net-tcp
Captures.zip

Author:	AlexanderUsmanov
Assignees:	-
Labels:	area-System.Net.Security, untriaged
Milestone:	-

[rzikm]

cc: @filipnavara

[filipnavara]

cc: @filipnavara

Thanks. I have the issue on my radar. I was just preoccupied with other stuff and didn't get to analyze the data yet.

[wfurt]

So .NET 9, does not work either @AlexanderUsmanov e.g. #95725 is not sufficient?

[wfurt]

Note that Ubuntu 23.10 should have updated gss-ntlmssp (1.2.0-1) e.g. the native layer should work again with OpenSLL 3.

[filipnavara]

I tested the sample with .NET 9 (P3 daily build) and it's not resolved.

[AlexanderUsmanov]

So .NET 9, does not work either @AlexanderUsmanov e.g. #95725 is not sufficient?

Unfortunately no. I tried to do following:

1. Apply fix from this issue 95725, rebuild System.Net.Securtity.dll with this fix
2. Built client as self-contained app
3. Replaced System.Net.Security.dll in output by result of p.1
4. Run client - it doesn't work.

[rzikm]

Triage: Tentatively set to 9.0 milestone.

[filipnavara]

I'll have a look... but it may have to wait few days.

[rzikm]

Thank you, I don't think this issue is immediately urgent. In the worst case I can dig in it once I run out of higher priority tasks.