Lighttpd

lighttpd -f /etc/lighttpd/lighttpd.conf -p and verify that you have isolated your webdav config, and that the webdav directives are not being modified by some other part of your config file.

Try webdav.log-xml = "enable" and review what cadaver is sending in PROPFIND requests, and how lighttpd is responding.

Have you tested a different DAV client for comparison?

An strace of lighttpd might also be useful to see the arguments and return value for fstatat().

Thank for your reply.

this is the output of lighttpd -f /etc/lighttpd/lighttpd.conf -p :

config {
var.CWD = "/usr/local/src/lighttpd-1.4.71"
var.PID = 10586
var.log_root = "/var/log/lighttpd"
var.server_root = "/var/www/html"
var.state_dir = "/run"
var.home_dir = "/var/lib/lighttpd"
var.conf_dir = "/etc/lighttpd"
var.vhosts_dir = "/var/www/html/vhosts"
var.cache_dir = "/var/cache/lighttpd"
var.socket_dir = "/var/lib/lighttpd/sockets"
server.port = 88
server.username = "lighttpd"
server.groupname = "lighttpd"
server.document-root = "/var/www/html/htdocs"
server.pid-file = "/run/lighttpd.pid"
server.errorlog = "/var/log/lighttpd/error.log"
server.follow-symlink = "disable"
accesslog.filename = "/var/log/lighttpd/access.log"
debug.log-request-handling = "enable"
debug.log-request-header = "enable"
debug.log-request-header-on-error = "enable"
debug.log-response-header = "enable"
debug.log-file-not-found = "enable"
debug.log-condition-handling = "enable"
server.max-fds = 16384
index-file.names = ("index.xhtml", "index.html", "index.htm", "default.htm", "index.php")
url.access-deny = ("~", ".inc")
static-file.exclude-extensions = (".php", ".pl", ".fcgi", ".scgi")
server.modules = (
"mod_accesslog",
"mod_rewrite",
"mod_access",
"mod_auth",
"mod_webdav",
"mod_authn_file",
"mod_alias",
)

$HTTP["host"] == "***" {
    # block 1
        var.server_name      = "***" 
        server.name          = "***" 
        server.document-root = "/var/www/html/htdocs" 
        alias.url            = (
            "/dav" => "/var/www/html/htdocs/dav",
        )

$HTTP["url"] =~ "^/dav($|/)" {
    # block 2
            dir-listing.activate  = "enable" 
            dir-listing.encoding  = "utf-8" 
            webdav.activate       = "enable" 
            webdav.opts           = (
                "unsafe-propfind-follow-symlink" => "enable",
                "propfind-depth-infinity"        => "enable",
            )
            webdav.is-readonly    = "enable" 
            webdav.log-xml        = "enable" 
            webdav.sqlite-db-name = "/var/lib/lighttpd/webdav.db"

} # end of $HTTP["url"] =~ "^/dav($|/)" 
    } # end of $HTTP["host"]  "***" 
}

And it seems ok.

But now in error.log I see these entries when I try a list of content (ls folder4):

2023-06-30 14:52:16: (h1.c.497) fd:12 rqst: PROPFIND /dav/folder4/ HTTP/1.1
2023-06-30 14:52:16: (h1.c.497) fd:12 rqst: User-Agent: cadaver/0.23.3 neon/0.30.0
2023-06-30 14:52:16: (h1.c.497) fd:12 rqst: Connection: TE
2023-06-30 14:52:16: (h1.c.497) fd:12 rqst: TE: trailers
2023-06-30 14:52:16: (h1.c.497) fd:12 rqst: Host: webonline.virgo-gw.eu:88
2023-06-30 14:52:16: (h1.c.497) fd:12 rqst: Depth: 1
2023-06-30 14:52:16: (h1.c.497) fd:12 rqst: Content-Length: 288
2023-06-30 14:52:16: (h1.c.497) fd:12 rqst: Content-Type: application/xml
2023-06-30 14:52:16: (h1.c.497) fd:12 rqst:
2023-06-30 14:52:16: (configfile-glue.c.600) = start of condition block ===
2023-06-30 14:52:16: (configfile-glue.c.531) $HTTP["host"] "***" compare to
2023-06-30 14:52:16: (configfile-glue.c.388) 1 (uncached) result: true (cond: global / $HTTP["host"] "")
2023-06-30 14:52:16: (response.c.260) -- parsed Request-URI
2023-06-30 14:52:16: (response.c.262) Request-URI : /dav/folder4/
2023-06-30 14:52:16: (response.c.264) URI-scheme : http
2023-06-30 14:52:16: (response.c.266) URI-authority :
2023-06-30 14:52:16: (response.c.268) URI-path (clean): /dav/folder4/
2023-06-30 14:52:16: (response.c.270) URI-query :
2023-06-30 14:52:16: (configfile-glue.c.600) === start of condition block ===
2023-06-30 14:52:16: (configfile-glue.c.422) go parent global / $HTTP["host"] ""
2023-06-30 14:52:16: (configfile-glue.c.388) 1 (cached) result: true (cond: global / $HTTP["host"] "***")
2023-06-30 14:52:16: (configfile-glue.c.531) $HTTP["url"] =~ "^/dav($|/)" compare to /dav/folder4/
2023-06-30 14:52:16: (configfile-glue.c.388) 2 (uncached) result: true (cond: global / $HTTP["host"] == "***" / $HTTP["url"] =~ "^/dav($|/)")
2023-06-30 14:52:16: (mod_webdav.c.3887) XML-request-body: \n<propfind xmlns="DAV:"><prop>\n<getcontentlength xmlns="DAV:"/>\n<getlastmodified xmlns="DAV:"/>\n<executable xmlns="http://apache.org/dav/props/&quot;/&gt;\n&lt;resourcetype xmlns="DAV:"/>\n<checked-in xmlns="DAV:"/>\n<checked-out xmlns="DAV:"/>\n</prop></propfind>\n
2023-06-30 14:52:16: (mod_webdav.c.795) XML-response-body: \n<D:multistatus xmlns:D="DAV:" xmlns:ns0="urn:uuid:c2f41010-65b3-11d1-a29f-00aa00c14882/">\n<D:response>\n<D:href>/dav/folder4/</D:href>\n<D:propstat>\n<D:status>HTTP/1.1 403 Forbidden</D:status>\n</D:propstat>\n</D:response>\n</D:multistatus>\n
2023-06-30 14:52:16: (h1.c.248) fd:12 resp: HTTP/1.1 207 Multi-status
2023-06-30 14:52:16: (h1.c.248) fd:12 resp: Content-Type: application/xml;charset=utf-8
2023-06-30 14:52:16: (h1.c.248) fd:12 resp: Content-Length: 275
2023-06-30 14:52:16: (h1.c.248) fd:12 resp: Date: Fri, 30 Jun 2023 12:52:16 GMT
2023-06-30 14:52:16: (h1.c.248) fd:12 resp: Server: lighttpd/1.4.71
2023-06-30 14:52:16: (h1.c.248) fd:12 resp:
2023-06-30 14:52:22: (h1.c.881) connection closed - keep-alive timeout: 12

Where I can see now:

2023-06-30 14:52:16: (mod_webdav.c.795) XML-response-body: \n<D:multistatus xmlns:D="DAV:" xmlns:ns0="urn:uuid:c2f41010-65b3-11d1-a29f-00aa00c14882/">\n<D:response>\n<D:href>/dav/folder4/</D:href>\n<D:propstat>\n<D:status>HTTP/1.1 403 Forbidden</D:status>\n</D:propstat>\n</D:response>\n</D:multistatus>\n

but I cannot understand what it means.

And yes I tried also with a simple mount davfs2 on a remote server: mount -t davfs http://***/dav /basemnt/lighttpd -o ro,_netdev,uid=apache,gid=apache

and when I ls folder4... it is empty.

Thanks for your help.

Your config contains:
server.follow-symlink = "disable"

Why would you do this?

Ok, you are right. It's only an attempt to see if something change... even if changing it to server.follow-symlink = "enable" the issue remain.

Very strange.

Thanks

I found a way to make it work.

In mod_webdav.c in the function webdav_propfind_dir() the line:

const int dfd = fdevent_open_dirname(dst->path.ptr, 0)

opens the directory with the second argument "symlink" set 0 which I understand tells to "NOT" follow the symbolic links even if the proper workaraund options are chosen in the configuration.

changing the line setting the flag to 1:

const int dfd = fdevent_open_dirname(dst->path.ptr, 1)

solves the problem and the directories are now populated in cadaver.

I don't know whether this could cause side effects in the general case, but it seems not for us since our use case requires to use webdav just in readonly.

Thanks for digging in.

When I saw server.follow-symlink = "disable" in the config, I knew that was probably at least one issue.

Now that it is removed, you identified in webdav_propfind_dir():
const int dfd = fdevent_open_dirname(dst->path.ptr, 0);

Perhaps in webdav_propfind_dir() that should be
const int dfd = fdevent_open_dirname(dst->path.ptr, (pb->atflags != AT_SYMLINK_NOFOLLOW));

I need to do some testing and to check the git source history to see if there was specific reason for that, but at first glance this patch looks ok to me.

reference: in mod_webdav_propfind

    pb.atflags =
      ((pconf->opts & MOD_WEBDAV_UNSAFE_PROPFIND_FOLLOW_SYMLINK)
       && pconf->is_readonly)
        ? 0 /* non-standard */
        : AT_SYMLINK_NOFOLLOW; /* WebDAV does not have symlink concept */

lighttpd 1.4.72 contains this extension.
https://redmine.lighttpd.net/projects/lighttpd/repository/14/revisions/9673dab01fa384e48dd1a25ab463c26cb2cf1ef1