/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */

/*

 * soup-auth-ntlm.c: HTTP NTLM Authentication helper

 *

 * Copyright (C) 2007 Red Hat, Inc.

 */

#ifdef HAVE_CONFIG_H

#include <config.h>

#endif

#include <errno.h>

#include <stdlib.h>

#include <string.h>

#include <glib.h>

#include "soup-auth-ntlm.h"

#include "soup.h"

#include "soup-message-private.h"

static void        soup_ntlm_lanmanager_hash   (const char  *password,

						guchar       hash[21]);

static void        soup_ntlm_nt_hash           (const char  *password,

						guchar       hash[21]);

static char       *soup_ntlm_request           (void);

static gboolean    soup_ntlm_parse_challenge   (const char  *challenge,

						char       **nonce,

						char       **default_domain,

						gboolean    *ntlmv2_session);

static char       *soup_ntlm_response          (const char  *nonce, 

						const char  *user,

						guchar       nt_hash[21],

						guchar       lm_hash[21],

						const char  *host, 

						const char  *domain,

						gboolean     ntlmv2_session);

typedef enum {

	SOUP_NTLM_NEW,

	SOUP_NTLM_SSO_FAILED,

	SOUP_NTLM_SENT_REQUEST,

	SOUP_NTLM_RECEIVED_CHALLENGE,

	SOUP_NTLM_SENT_RESPONSE,

	SOUP_NTLM_FAILED

} SoupNTLMState;

typedef struct {

	SoupNTLMState state;

	char *nonce;

	char *response_header;

	gboolean ntlmv2_session;

} SoupNTLMConnectionState;

typedef enum {

	SOUP_NTLM_PASSWORD_NONE,

	SOUP_NTLM_PASSWORD_PROVIDED,

	SOUP_NTLM_PASSWORD_ACCEPTED,

	SOUP_NTLM_PASSWORD_REJECTED

} SoupNTLMPasswordState;

typedef struct {

	char *username, *domain;

	guchar nt_hash[21], lm_hash[21];

	SoupNTLMPasswordState password_state;

#ifdef USE_NTLM_AUTH

	/* Use Samba's 'winbind' daemon to support NTLM single-sign-on,

	 * by delegating the NTLM challenge/response protocal to a helper

	 * in ntlm_auth.

	 * http://devel.squid-cache.org/ntlm/squid_helper_protocol.html

	 * http://www.samba.org/samba/docs/man/manpages-3/winbindd.8.html

	 * http://www.samba.org/samba/docs/man/manpages-3/ntlm_auth.1.html

	 */

	gboolean sso_available;

	int fd_in;

	int fd_out;

#endif

} SoupAuthNTLMPrivate;

#ifdef USE_NTLM_AUTH

static gboolean ntlm_auth_available, ntlm_auth_debug;

static void sso_ntlm_close (SoupAuthNTLMPrivate *priv);

#endif

/**

 * SOUP_TYPE_AUTH_NTLM:

 *

 * A #GType corresponding to HTTP-based NTLM authentication.

 * #SoupSessions do not support this type by default; if you want to

 * enable support for it, call soup_session_add_feature_by_type(),

 * passing %SOUP_TYPE_AUTH_NTLM.

 *

 * Since: 2.34

 */

G_DEFINE_TYPE_WITH_PRIVATE (SoupAuthNTLM, soup_auth_ntlm, SOUP_TYPE_CONNECTION_AUTH)

static void

soup_auth_ntlm_init (SoupAuthNTLM *ntlm)

{

#ifdef USE_NTLM_AUTH

	SoupAuthNTLMPrivate *priv = soup_auth_ntlm_get_instance_private (ntlm);

	const char *username = NULL, *slash;

	priv->sso_available = TRUE;

	priv->fd_in = -1;

	priv->fd_out = -1;

	username = getenv ("NTLMUSER");

	if (!username)

		username = g_get_user_name ();

	slash = strpbrk (username, "\\/");

	if (slash) {

		priv->username = g_strdup (slash + 1);

		priv->domain = g_strndup (username, slash - username);

	} else {

		priv->username = g_strdup (username);

		priv->domain = NULL;

	}

#endif

}

static void

soup_auth_ntlm_finalize (GObject *object)

{

	SoupAuthNTLMPrivate *priv = soup_auth_ntlm_get_instance_private (SOUP_AUTH_NTLM (object));

	g_free (priv->username);

	g_free (priv->domain);

	memset (priv->nt_hash, 0, sizeof (priv->nt_hash));

	memset (priv->lm_hash, 0, sizeof (priv->lm_hash));

#ifdef USE_NTLM_AUTH

	sso_ntlm_close (priv);

#endif

	G_OBJECT_CLASS (soup_auth_ntlm_parent_class)->finalize (object);

}

#ifdef USE_NTLM_AUTH

static void

sso_ntlm_close (SoupAuthNTLMPrivate *priv)

{

	if (priv->fd_in != -1) {

		close (priv->fd_in);

		priv->fd_in = -1;

	}

	if (priv->fd_out != -1) {

		close (priv->fd_out);

		priv->fd_out = -1;

	}

}

static gboolean

sso_ntlm_initiate (SoupAuthNTLMPrivate *priv)

{

	char *argv[9];

	gboolean ret;

	if (!priv->sso_available)

		return FALSE;

	if (!ntlm_auth_available && !ntlm_auth_debug) {

		priv->sso_available = FALSE;

		return FALSE;

	}

	/* Return if ntlm_auth execution process exist already */

	if (priv->fd_in != -1 && priv->fd_out != -1)

		return TRUE;

	else {

		/* Clean all sso data before re-initiate */

		sso_ntlm_close (priv);

	}

	if (ntlm_auth_debug) {

		argv[0] = (char *) g_getenv ("SOUP_NTLM_AUTH_DEBUG");

		if (!*argv[0]) {

			priv->sso_available = FALSE;

			return FALSE;

		}

	} else

		argv[0] = NTLM_AUTH;

	argv[1] = "--helper-protocol";

	argv[2] = "ntlmssp-client-1";

	argv[3] = "--use-cached-creds";

	argv[4] = "--username";

	argv[5] = priv->username;

	argv[6] = priv->domain ? "--domain" : NULL;

	argv[7] = priv->domain;

	argv[8] = NULL;

	ret = g_spawn_async_with_pipes (NULL, argv, NULL,

					G_SPAWN_STDERR_TO_DEV_NULL,

					NULL, NULL,

					NULL, &priv->fd_in, &priv->fd_out,

					NULL, NULL);

	if (!ret)

		priv->sso_available = FALSE;

	return ret;

}

static char *

sso_ntlm_response (SoupAuthNTLMPrivate *priv, const char *input, SoupNTLMState conn_state)

{

	ssize_t size;

	char buf[1024];

	char *tmpbuf = buf;

	size_t	len_in = strlen (input), len_out = sizeof (buf);

	while (len_in > 0) {

		int written = write (priv->fd_in, input, len_in);

		if (written == -1) {

			if (errno == EINTR)

				continue;

			/* write failed if other errors happen */

			return NULL;

		}

		input += written;

		len_in -= written;

	}

	/* Read one line */

	while (len_out > 0) {

		size = read (priv->fd_out, tmpbuf, len_out);

		if (size == -1) {

			if (errno == EINTR)

				continue;

			return NULL;

		} else if (size == 0)

			return NULL;

		else if (tmpbuf[size - 1] == '\n') {

			tmpbuf[size - 1] = '\0';

			goto wrfinish;

		}

		tmpbuf += size;

		len_out -= size;

	}

	return NULL;

wrfinish:

	if (g_ascii_strcasecmp (buf, "PW") == 0) {

		/* Samba/winbind installed but not configured */

		return g_strdup ("PW");

	}

	if (conn_state == SOUP_NTLM_NEW &&

	    g_ascii_strncasecmp (buf, "YR ", 3) != 0) {

		/* invalid response for type 1 message */

		return NULL;

	}

	if (conn_state == SOUP_NTLM_RECEIVED_CHALLENGE &&

	    g_ascii_strncasecmp (buf, "KK ", 3) != 0 &&

	    g_ascii_strncasecmp (buf, "AF ", 3) != 0) {

		/* invalid response for type 3 message */

		return NULL;

	}

	return g_strdup_printf ("NTLM %.*s", (int)(size - 4), buf + 3);

}

#endif /* USE_NTLM_AUTH */

static gpointer

soup_auth_ntlm_create_connection_state (SoupConnectionAuth *auth)

{

	SoupNTLMConnectionState *conn;

	conn = g_slice_new0 (SoupNTLMConnectionState);

	conn->state = SOUP_NTLM_NEW;

	return conn;

}

static void

soup_auth_ntlm_free_connection_state (SoupConnectionAuth *auth,

				      gpointer state)

{

	SoupNTLMConnectionState *conn = state;

	g_free (conn->nonce);

	g_free (conn->response_header);

	g_slice_free (SoupNTLMConnectionState, conn);

}

static gboolean

soup_auth_ntlm_update_connection (SoupConnectionAuth *auth, SoupMessage *msg,

				  const char *auth_header, gpointer state)

{

	SoupAuthNTLM *auth_ntlm = SOUP_AUTH_NTLM (auth);

	SoupAuthNTLMPrivate *priv = soup_auth_ntlm_get_instance_private (auth_ntlm);

	SoupNTLMConnectionState *conn = state;

	gboolean success = TRUE;

	/* Note that we only return FALSE if some sort of parsing error

	 * occurs. Otherwise, the SoupAuth is still reusable (though it may

	 * no longer be _ready or _authenticated).

	 */

	if (!g_str_has_prefix (auth_header, "NTLM"))

		return FALSE;

	if (conn->state > SOUP_NTLM_SENT_REQUEST) {

		if (priv->password_state == SOUP_NTLM_PASSWORD_ACCEPTED) {

			/* We know our password is correct, so a 401

			 * means "permission denied". The code can't deal

			 * with re-authenticating correctly, so make sure

			 * we don't try.

			 */

			conn->state = SOUP_NTLM_FAILED;

			if (soup_message_is_keepalive (msg)) {

				soup_message_headers_append (msg->response_headers,

							     "Connection", "close");

			}

			return TRUE;

		}

#ifdef USE_NTLM_AUTH

		if (priv->sso_available) {

			conn->state = SOUP_NTLM_SSO_FAILED;

			priv->password_state = SOUP_NTLM_PASSWORD_NONE;

		} else {

#endif

			conn->state = SOUP_NTLM_FAILED;

			priv->password_state = SOUP_NTLM_PASSWORD_REJECTED;

#ifdef USE_NTLM_AUTH

		}

#endif

		return TRUE;

	}

	if (conn->state == SOUP_NTLM_NEW && !auth_header[4])

		return TRUE;

	if (!auth_header[4] || !auth_header[5]) {

		conn->state = SOUP_NTLM_FAILED;

		return FALSE;

	}

	if (!soup_ntlm_parse_challenge (auth_header + 5, &conn->nonce,

					priv->domain ? NULL : &priv->domain,

					&conn->ntlmv2_session)) {

		conn->state = SOUP_NTLM_FAILED;

		return FALSE;

	}

#ifdef USE_NTLM_AUTH

	if (priv->sso_available && conn->state == SOUP_NTLM_SENT_REQUEST) {

		char *input, *response;

		/* Re-Initiate ntlm_auth process in case it was closed/killed abnormally */

		if (!sso_ntlm_initiate (priv)) {

			conn->state = SOUP_NTLM_SSO_FAILED;

			success = FALSE;

			goto out;

		}

		input = g_strdup_printf ("TT %s\n", auth_header + 5);

		response = sso_ntlm_response (priv, input, conn->state);

		sso_ntlm_close (priv);

		g_free (input);

		if (!response) {

			conn->state = SOUP_NTLM_SSO_FAILED;

			success = FALSE;

		} else if (!g_ascii_strcasecmp (response, "PW")) {

			conn->state = SOUP_NTLM_SSO_FAILED;

			priv->sso_available = FALSE;

			g_free (response);

		} else {

			conn->response_header = response;

			if (priv->password_state != SOUP_NTLM_PASSWORD_ACCEPTED)

				priv->password_state = SOUP_NTLM_PASSWORD_PROVIDED;

		}

	}

 out:

#endif

	if (conn->state == SOUP_NTLM_SENT_REQUEST)

		conn->state = SOUP_NTLM_RECEIVED_CHALLENGE;

	g_object_set (G_OBJECT (auth),

		      SOUP_AUTH_REALM, priv->domain,

		      SOUP_AUTH_HOST, soup_message_get_uri (msg)->host,

		      NULL);

	return success;

}

static GSList *

soup_auth_ntlm_get_protection_space (SoupAuth *auth, SoupURI *source_uri)

{

	char *space, *p;

	space = g_strdup (source_uri->path);

	/* Strip filename component */

	p = strrchr (space, '/');

	if (p && p != space && p[1])

		*p = '\0';

	return g_slist_prepend (NULL, space);

}

static void

soup_auth_ntlm_authenticate (SoupAuth *auth, const char *username,

			     const char *password)

{

	SoupAuthNTLM *auth_ntlm = SOUP_AUTH_NTLM (auth);

	SoupAuthNTLMPrivate *priv = soup_auth_ntlm_get_instance_private (auth_ntlm);

	const char *slash;

	g_return_if_fail (username != NULL);

	g_return_if_fail (password != NULL);

	if (priv->username)

		g_free (priv->username);

	if (priv->domain)

		g_free (priv->domain);

	slash = strpbrk (username, "\\/");

	if (slash) {

		priv->domain = g_strndup (username, slash - username);

		priv->username = g_strdup (slash + 1);

	} else {

		priv->domain = g_strdup ("");

		priv->username = g_strdup (username);

	}

	soup_ntlm_nt_hash (password, priv->nt_hash);

	soup_ntlm_lanmanager_hash (password, priv->lm_hash);

	priv->password_state = SOUP_NTLM_PASSWORD_PROVIDED;

}

static gboolean

soup_auth_ntlm_is_authenticated (SoupAuth *auth)

{

	SoupAuthNTLM *auth_ntlm = SOUP_AUTH_NTLM (auth);

	SoupAuthNTLMPrivate *priv = soup_auth_ntlm_get_instance_private (auth_ntlm);

	return (priv->password_state != SOUP_NTLM_PASSWORD_NONE &&

		priv->password_state != SOUP_NTLM_PASSWORD_REJECTED);

}

static gboolean

soup_auth_ntlm_is_connection_ready (SoupConnectionAuth *auth,

				    SoupMessage        *msg,

				    gpointer            state)

{

	SoupAuthNTLM *auth_ntlm = SOUP_AUTH_NTLM (auth);

	SoupAuthNTLMPrivate *priv = soup_auth_ntlm_get_instance_private (auth_ntlm);

	SoupNTLMConnectionState *conn = state;

	if (priv->password_state == SOUP_NTLM_PASSWORD_REJECTED)

		return FALSE;

	if (priv->password_state == SOUP_NTLM_PASSWORD_PROVIDED)

		return TRUE;

	return conn->state != SOUP_NTLM_FAILED;

}

static void

got_final_auth_result (SoupMessage *msg, gpointer data)

{

	SoupAuth *auth = data;

	SoupAuthNTLMPrivate *priv = soup_auth_ntlm_get_instance_private (SOUP_AUTH_NTLM (auth));

	g_signal_handlers_disconnect_by_func (msg, G_CALLBACK (got_final_auth_result), auth);

	if (auth != soup_message_get_auth (msg))

		return;

	if (msg->status_code != SOUP_STATUS_UNAUTHORIZED)

		priv->password_state = SOUP_NTLM_PASSWORD_ACCEPTED;

}

static char *

soup_auth_ntlm_get_connection_authorization (SoupConnectionAuth *auth,

					     SoupMessage        *msg,

					     gpointer            state)

{

	SoupAuthNTLM *auth_ntlm = SOUP_AUTH_NTLM (auth);

	SoupAuthNTLMPrivate *priv = soup_auth_ntlm_get_instance_private (auth_ntlm);

	SoupNTLMConnectionState *conn = state;

	char *header = NULL;

	switch (conn->state) {

	case SOUP_NTLM_NEW:

#ifdef USE_NTLM_AUTH

		if (sso_ntlm_initiate (priv)) {

			header = sso_ntlm_response (priv, "YR\n", conn->state);

			if (header) {

				if (g_ascii_strcasecmp (header, "PW") != 0) {

					conn->state = SOUP_NTLM_SENT_REQUEST;

					break;

				} else {

					g_free (header);

					header = NULL;

					priv->sso_available = FALSE;

				}

			} else {

				g_debug ("NTLM single-sign-on using %s failed", NTLM_AUTH);

			}

		}

		/* If NTLM single-sign-on fails, go back to original

		 * request handling process.

		 */

#endif

		header = soup_ntlm_request ();

		conn->state = SOUP_NTLM_SENT_REQUEST;

		break;

	case SOUP_NTLM_RECEIVED_CHALLENGE:

		if (conn->response_header) {

			header = conn->response_header;

			conn->response_header = NULL;

		} else {

			header = soup_ntlm_response (conn->nonce,

						     priv->username,

						     priv->nt_hash,

						     priv->lm_hash,

						     NULL,

						     priv->domain,

						     conn->ntlmv2_session);

		}

		g_clear_pointer (&conn->nonce, g_free);

		conn->state = SOUP_NTLM_SENT_RESPONSE;

		if (priv->password_state != SOUP_NTLM_PASSWORD_ACCEPTED) {

			/* We need to know if this worked */

			g_signal_connect (msg, "got-headers",

					  G_CALLBACK (got_final_auth_result),

					  auth);

		}

		break;

#ifdef USE_NTLM_AUTH

	case SOUP_NTLM_SSO_FAILED:

		/* Restart request without SSO */

		g_debug ("NTLM single-sign-on by using %s failed", NTLM_AUTH);

		priv->sso_available = FALSE;

		header = soup_ntlm_request ();

		conn->state = SOUP_NTLM_SENT_REQUEST;

		break;

#endif

	default:

		break;

	}

	return header;

}

static void

soup_auth_ntlm_class_init (SoupAuthNTLMClass *auth_ntlm_class)

{

	SoupAuthClass *auth_class = SOUP_AUTH_CLASS (auth_ntlm_class);

	SoupConnectionAuthClass *connauth_class = SOUP_CONNECTION_AUTH_CLASS (auth_ntlm_class);

	GObjectClass *object_class = G_OBJECT_CLASS (auth_ntlm_class);

	auth_class->scheme_name = "NTLM";

	auth_class->strength = 3;

	auth_class->get_protection_space = soup_auth_ntlm_get_protection_space;

	auth_class->authenticate = soup_auth_ntlm_authenticate;

	auth_class->is_authenticated = soup_auth_ntlm_is_authenticated;

	connauth_class->create_connection_state = soup_auth_ntlm_create_connection_state;

	connauth_class->free_connection_state = soup_auth_ntlm_free_connection_state;

	connauth_class->update_connection = soup_auth_ntlm_update_connection;

	connauth_class->get_connection_authorization = soup_auth_ntlm_get_connection_authorization;

	connauth_class->is_connection_ready = soup_auth_ntlm_is_connection_ready;

	object_class->finalize = soup_auth_ntlm_finalize;

#ifdef USE_NTLM_AUTH

	ntlm_auth_available = g_file_test (NTLM_AUTH, G_FILE_TEST_IS_EXECUTABLE);

	ntlm_auth_debug = (g_getenv ("SOUP_NTLM_AUTH_DEBUG") != NULL);

#endif

}

static void md4sum                (const unsigned char *in, 

				   int                  nbytes, 

				   unsigned char        digest[16]);

typedef guint32 DES_KS[16][2]; /* Single-key DES key schedule */

static void deskey                (DES_KS, unsigned char *, int);

static void des                   (DES_KS, unsigned char *);

static void setup_schedule        (const guchar *key_56, DES_KS ks);

static void calc_response         (const guchar        *key, 

				   const guchar        *plaintext,

				   guchar              *results);

#define LM_PASSWORD_MAGIC "\x4B\x47\x53\x21\x40\x23\x24\x25" \

                          "\x4B\x47\x53\x21\x40\x23\x24\x25" \

			  "\x00\x00\x00\x00\x00"

static void

soup_ntlm_lanmanager_hash (const char *password, guchar hash[21])

{

	guchar lm_password [15];

	DES_KS ks;

	int i;

	for (i = 0; i < 14 && password [i]; i++)

		lm_password [i] = g_ascii_toupper ((unsigned char) password [i]);

	for (; i < 15; i++)

		lm_password [i] = '\0';

	memcpy (hash, LM_PASSWORD_MAGIC, 21);

	setup_schedule (lm_password, ks);

	des (ks, hash);

	setup_schedule (lm_password + 7, ks);

	des (ks, hash + 8);

}

static void

soup_ntlm_nt_hash (const char *password, guchar hash[21])

{

	unsigned char *buf, *p;

	p = buf = g_malloc (strlen (password) * 2);

	while (*password) {

		*p++ = *password++;

		*p++ = '\0';

	}

	md4sum (buf, p - buf, hash);

	memset (hash + 16, 0, 5);

	g_free (buf);

}

typedef struct {

	guint16 length;

	guint16 length2;

	guint16 offset;

	guchar  zero_pad[2];

} NTLMString;

#define NTLM_CHALLENGE_NONCE_OFFSET         24

#define NTLM_CHALLENGE_NONCE_LENGTH          8

#define NTLM_CHALLENGE_DOMAIN_STRING_OFFSET 12

#define NTLM_CHALLENGE_FLAGS_OFFSET         20

#define NTLM_FLAGS_NEGOTIATE_NTLMV2 0x00080000

#define NTLM_RESPONSE_HEADER "NTLMSSP\x00\x03\x00\x00\x00"

#define NTLM_RESPONSE_FLAGS 0x8201

#define NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0x00080000

typedef struct {

        guchar     header[12];

	NTLMString lm_resp;

	NTLMString nt_resp;

	NTLMString domain;

	NTLMString user;

	NTLMString host;

	NTLMString session_key;

        guint32    flags;

} NTLMResponse;

static void

ntlm_set_string (NTLMString *string, int *offset, int len)

{

	string->offset = GUINT16_TO_LE (*offset);

	string->length = string->length2 = GUINT16_TO_LE (len);

	*offset += len;

}

static char *

soup_ntlm_request (void)

{

	return g_strdup ("NTLM TlRMTVNTUAABAAAABYIIAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAAAAAAAAAAwAAAA");

}

static gboolean

soup_ntlm_parse_challenge (const char *challenge,

			   char      **nonce,

			   char      **default_domain,

			   gboolean   *ntlmv2_session)

{

	gsize clen;

	NTLMString domain;

	guchar *chall;

	guint32 flags;

	chall = g_base64_decode (challenge, &clen);

	if (clen < NTLM_CHALLENGE_DOMAIN_STRING_OFFSET ||

	    clen < NTLM_CHALLENGE_NONCE_OFFSET + NTLM_CHALLENGE_NONCE_LENGTH) {

		g_free (chall);

		return FALSE;

	}

	memcpy (&flags, chall + NTLM_CHALLENGE_FLAGS_OFFSET, sizeof(flags));

	flags = GUINT_FROM_LE (flags);

	*ntlmv2_session = (flags & NTLM_FLAGS_NEGOTIATE_NTLMV2) ? TRUE : FALSE;

	if (default_domain) {

		memcpy (&domain, chall + NTLM_CHALLENGE_DOMAIN_STRING_OFFSET, sizeof (domain));

		domain.length = GUINT16_FROM_LE (domain.length);

		domain.offset = GUINT16_FROM_LE (domain.offset);

		if (clen < domain.length + domain.offset) {

			g_free (chall);

			return FALSE;

		}

		*default_domain = g_convert ((char *)chall + domain.offset,

					     domain.length, "UTF-8", "UCS-2LE",

					     NULL, NULL, NULL);

	}

	if (nonce) {

		*nonce = g_memdup (chall + NTLM_CHALLENGE_NONCE_OFFSET,

				   NTLM_CHALLENGE_NONCE_LENGTH);

	}

	g_free (chall);

	return TRUE;

}

static void

calc_ntlm2_session_response (const char *nonce,

			     guchar      nt_hash[21],

			     guchar      lm_hash[21],

			     guchar     *lm_resp,

			     gsize       lm_resp_sz,

			     guchar     *nt_resp)

{

	guint32 client_nonce[2];

	guchar ntlmv2_hash[16];

	GChecksum *ntlmv2_cksum;

	gsize ntlmv2_hash_sz = sizeof (ntlmv2_hash);

	/* FIXME: if GLib ever gets a more secure random number

	 * generator, use it here

	 */

	client_nonce[0] = g_random_int();

	client_nonce[1] = g_random_int();

	ntlmv2_cksum = g_checksum_new (G_CHECKSUM_MD5);

	g_checksum_update (ntlmv2_cksum, (const guchar *) nonce, 8);

	g_checksum_update (ntlmv2_cksum, (const guchar *) client_nonce, sizeof (client_nonce));

	g_checksum_get_digest (ntlmv2_cksum, ntlmv2_hash, &ntlmv2_hash_sz);

	g_checksum_free (ntlmv2_cksum);

	/* Send the padded client nonce as a fake lm_resp */

	memset (lm_resp, 0, lm_resp_sz);

	memcpy (lm_resp, client_nonce, sizeof (client_nonce));

	/* Compute nt_hash as usual but with a new nonce */

	calc_response (nt_hash, ntlmv2_hash, nt_resp);

}

static char *

soup_ntlm_response (const char *nonce, 

		    const char *user,

		    guchar      nt_hash[21],

		    guchar      lm_hash[21],

		    const char *host, 

		    const char *domain,

		    gboolean    ntlmv2_session)

{

	int offset;

	gsize hlen, dlen, ulen;

	guchar lm_resp[24], nt_resp[24];

	char *user_conv, *host_conv, *domain_conv;

	NTLMResponse resp;

	char *out, *p;

	int state, save;

	if (ntlmv2_session) {

		calc_ntlm2_session_response (nonce, nt_hash, lm_hash,

					     lm_resp, sizeof(lm_resp), nt_resp);

	} else {

		/* Compute a regular response */

		calc_response (nt_hash, (guchar *) nonce, nt_resp);

		calc_response (lm_hash, (guchar *) nonce, lm_resp);

	}

	memset (&resp, 0, sizeof (resp));

	memcpy (resp.header, NTLM_RESPONSE_HEADER, sizeof (resp.header));

	resp.flags = GUINT32_TO_LE (NTLM_RESPONSE_FLAGS);

	if (ntlmv2_session)

		resp.flags |= GUINT32_TO_LE (NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY);

	offset = sizeof (resp);

	if (!host)

		host = "UNKNOWN";

	domain_conv = g_convert (domain, -1, "UCS-2LE", "UTF-8", NULL, &dlen, NULL);

	user_conv = g_convert (user, -1, "UCS-2LE", "UTF-8", NULL, &ulen, NULL);

	host_conv = g_convert (host, -1, "UCS-2LE", "UTF-8", NULL, &hlen, NULL);

	ntlm_set_string (&resp.domain, &offset, dlen);

	ntlm_set_string (&resp.user, &offset, ulen);

	ntlm_set_string (&resp.host, &offset, hlen);

	ntlm_set_string (&resp.lm_resp, &offset, sizeof (lm_resp));

	ntlm_set_string (&resp.nt_resp, &offset, sizeof (nt_resp));

	out = g_malloc (((offset + 3) * 4) / 3 + 6);

	strncpy (out, "NTLM ", 5);

	p = out + 5;

	state = save = 0;

	p += g_base64_encode_step ((const guchar *) &resp, sizeof (resp), 

				   FALSE, p, &state, &save);

	p += g_base64_encode_step ((const guchar *) domain_conv, dlen, 

				   FALSE, p, &state, &save);

	p += g_base64_encode_step ((const guchar *) user_conv, ulen, 

				   FALSE, p, &state, &save);

	p += g_base64_encode_step ((const guchar *) host_conv, hlen, 

				   FALSE, p, &state, &save);

	p += g_base64_encode_step (lm_resp, sizeof (lm_resp), 

				   FALSE, p, &state, &save);

	p += g_base64_encode_step (nt_resp, sizeof (nt_resp), 

				   FALSE, p, &state, &save);

	p += g_base64_encode_close (FALSE, p, &state, &save);

	*p = '\0';

	g_free (domain_conv);

	g_free (user_conv);

	g_free (host_conv);

	return out;

}

/* DES utils */

/* Set up a key schedule based on a 56bit key */

static void

setup_schedule (const guchar *key_56, DES_KS ks)

{

	guchar key[8];

	int i, c, bit;

	key[0] = (key_56[0])                                 ;

	key[1] = (key_56[1] >> 1) | ((key_56[0] << 7) & 0xFF);

	key[2] = (key_56[2] >> 2) | ((key_56[1] << 6) & 0xFF);

	key[3] = (key_56[3] >> 3) | ((key_56[2] << 5) & 0xFF);

	key[4] = (key_56[4] >> 4) | ((key_56[3] << 4) & 0xFF);

	key[5] = (key_56[5] >> 5) | ((key_56[4] << 3) & 0xFF);

	key[6] = (key_56[6] >> 6) | ((key_56[5] << 2) & 0xFF);

	key[7] =                    ((key_56[6] << 1) & 0xFF);

	/* Fix parity */

	for (i = 0; i < 8; i++) {

		for (c = bit = 0; bit < 8; bit++)

			if (key[i] & (1 << bit))

				c++;

		if (!(c & 1))

			key[i] ^= 0x01;

	}

        deskey (ks, key, 0);

}

static void

calc_response (const guchar *key, const guchar *plaintext, guchar *results)

{

        DES_KS ks;

	memcpy (results, plaintext, 8);

	memcpy (results + 8, plaintext, 8);

	memcpy (results + 16, plaintext, 8);

        setup_schedule (key, ks);

	des (ks, results);