diff -up libsoup-2.62.3/libsoup/soup-auth-ntlm.c.4 libsoup-2.62.3/libsoup/soup-auth-ntlm.c

--- libsoup-2.62.3/libsoup/soup-auth-ntlm.c.4	2021-03-12 07:30:03.366088932 +0100

+++ libsoup-2.62.3/libsoup/soup-auth-ntlm.c	2021-03-12 07:30:25.296043405 +0100

@@ -12,6 +12,8 @@

 #include <errno.h>

 #include <stdlib.h>

 #include <string.h>

+#include <stdio.h>

+

 #include <glib.h>

 #include "soup-auth-ntlm.h"

@@ -26,14 +28,20 @@ static char       *soup_ntlm_request

 static gboolean    soup_ntlm_parse_challenge   (const char  *challenge,

 						char       **nonce,

 						char       **default_domain,

-						gboolean    *ntlmv2_session);

-static char       *soup_ntlm_response          (const char  *nonce, 

+						gboolean    *ntlmv2_session,

+						gboolean    *negotiate_target,

+						char		**target_info,

+						size_t		*target_info_sz);

+static char       *soup_ntlm_response          (const char  *nonce,

 						const char  *user,

 						guchar       nt_hash[21],

 						guchar       lm_hash[21],

 						const char  *host, 

 						const char  *domain,

-						gboolean     ntlmv2_session);

+						gboolean     ntlmv2_session,

+						gboolean     negotiate_target,

+						const char	*target_info,

+						size_t		target_info_sz);

 typedef enum {

 	SOUP_NTLM_NEW,

@@ -49,6 +57,9 @@ typedef struct {

 	char *nonce;

 	char *response_header;

 	gboolean ntlmv2_session;

+	gboolean negotiate_target;

+	char *target_info;

+	size_t target_info_sz;

 } SoupNTLMConnectionState;

 typedef enum {

@@ -280,6 +291,7 @@ soup_auth_ntlm_free_connection_state (So

 	g_free (conn->nonce);

 	g_free (conn->response_header);

+	g_free (conn->target_info);

 	g_slice_free (SoupNTLMConnectionState, conn);

 }

@@ -339,7 +351,8 @@ soup_auth_ntlm_update_connection (SoupCo

 	if (!soup_ntlm_parse_challenge (auth_header + 5, &conn->nonce,

 					priv->domain ? NULL : &priv->domain,

-					&conn->ntlmv2_session)) {

+					&conn->ntlmv2_session, &conn->negotiate_target,

+					&conn->target_info, &conn->target_info_sz)) {

 		conn->state = SOUP_NTLM_FAILED;

 		return FALSE;

 	}

@@ -521,7 +534,10 @@ soup_auth_ntlm_get_connection_authorizat

 						     priv->lm_hash,

 						     NULL,

 						     priv->domain,

-						     conn->ntlmv2_session);

+						     conn->ntlmv2_session,

+							 conn->negotiate_target,

+							 conn->target_info,

+							 conn->target_info_sz);

 		}

 		g_clear_pointer (&conn->nonce, g_free);

 		conn->state = SOUP_NTLM_SENT_RESPONSE;

@@ -647,14 +663,20 @@ typedef struct {

 #define NTLM_CHALLENGE_NONCE_OFFSET         24

 #define NTLM_CHALLENGE_NONCE_LENGTH          8

 #define NTLM_CHALLENGE_DOMAIN_STRING_OFFSET 12

+#define NTLM_CHALLENGE_TARGET_INFORMATION_OFFSET      40

 #define NTLM_CHALLENGE_FLAGS_OFFSET         20

 #define NTLM_FLAGS_NEGOTIATE_NTLMV2 0x00080000

+#define NTLM_FLAGS_NEGOTIATE_TARGET_INFORMATION 0x00800000

+#define NTLM_FLAGS_REQUEST_TARGET 0x00000004

 #define NTLM_RESPONSE_HEADER "NTLMSSP\x00\x03\x00\x00\x00"

 #define NTLM_RESPONSE_FLAGS 0x8201

+#define NTLM_RESPONSE_TARGET_INFORMATION_OFFSET 44

 #define NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY 0x00080000

+#define HMAC_MD5_LENGTH                     16

+

 typedef struct {

         guchar     header[12];

@@ -686,10 +708,14 @@ static gboolean

 soup_ntlm_parse_challenge (const char *challenge,

 			   char      **nonce,

 			   char      **default_domain,

-			   gboolean   *ntlmv2_session)

+			   gboolean   *ntlmv2_session,

+			   gboolean   *negotiate_target,

+			   char		**target_info,

+			   size_t	*target_info_sz)

 {

 	gsize clen;

 	NTLMString domain;

+	NTLMString target;

 	guchar *chall;

 	guint32 flags;

@@ -703,6 +729,14 @@ soup_ntlm_parse_challenge (const char *c

 	memcpy (&flags, chall + NTLM_CHALLENGE_FLAGS_OFFSET, sizeof(flags));

 	flags = GUINT_FROM_LE (flags);

 	*ntlmv2_session = (flags & NTLM_FLAGS_NEGOTIATE_NTLMV2) ? TRUE : FALSE;

+	/* To know if NTLMv2 responses should be calculated */

+	*negotiate_target = (flags & NTLM_FLAGS_NEGOTIATE_TARGET_INFORMATION ) ? TRUE : FALSE;

+        if (*negotiate_target) {

+            if (clen < NTLM_CHALLENGE_TARGET_INFORMATION_OFFSET + sizeof (target)) {

+                g_free (chall);

+                return FALSE;

+            }

+        }

 	if (default_domain) {

 		memcpy (&domain, chall + NTLM_CHALLENGE_DOMAIN_STRING_OFFSET, sizeof (domain));

@@ -723,6 +757,19 @@ soup_ntlm_parse_challenge (const char *c

 		*nonce = g_memdup (chall + NTLM_CHALLENGE_NONCE_OFFSET,

 				   NTLM_CHALLENGE_NONCE_LENGTH);

 	}

+	/* For NTLMv2 response */

+	if (*negotiate_target && target_info) {

+		memcpy (&target, chall + NTLM_CHALLENGE_TARGET_INFORMATION_OFFSET, sizeof (target));

+		target.length = GUINT16_FROM_LE (target.length);

+		target.offset = GUINT16_FROM_LE (target.offset);

+

+		if (clen < target.length + target.offset) {

+			g_free (chall);

+			return FALSE;

+		}

+		*target_info = g_memdup (chall + target.offset, target.length);

+		*target_info_sz = target.length;

+	}

 	g_free (chall);

 	return TRUE;

@@ -761,6 +808,115 @@ calc_ntlm2_session_response (const char

 	calc_response (nt_hash, ntlmv2_hash, nt_resp);

 }

+/* Compute HMAC-MD5 with Glib function*/

+static void

+calc_hmac_md5 (unsigned char *hmac, const guchar *key, gsize key_sz, const guchar *data, gsize data_sz)

+{

+	char *hmac_hex, *hex_pos;

+	size_t count;

+

+	hmac_hex = g_compute_hmac_for_data(G_CHECKSUM_MD5, key, key_sz, data, data_sz);

+	hex_pos = hmac_hex;

+	for (count = 0; count < HMAC_MD5_LENGTH; count++)

+	{

+		/* The 'hh' sscanf format modifier is C99, so we enable it on

+		 * non-Windows or if __USE_MINGW_ANSI_STDIO is enabled or`

+		 * if we are building on Visual Studio 2015 or later

+		 */

+#if !defined (G_OS_WIN32) || (__USE_MINGW_ANSI_STDIO == 1) || (_MSC_VER >= 1900)

+		sscanf(hex_pos, "%2hhx", &hmac[count]);

+#else

+		unsigned int tmp_hmac;

+		sscanf(hex_pos, "%2x", &tmp_hmac);

+		hmac[count] = (guint8)tmp_hmac;

+#endif

+

+		hex_pos += 2;

+	}

+	g_free(hmac_hex);

+}

+

+static void

+calc_ntlmv2_response (const char *user, const char *domain,

+						const guchar *nt_hash, const gsize nt_hash_sz,

+						const guchar *nonce,

+						const char *target_info, size_t target_info_sz,

+						guchar *lm_resp, size_t lm_resp_sz,

+						guchar *nt_resp, size_t nt_resp_sz)

+{

+	const unsigned char blob_signature[] = {0x01,0x01,0x00,0x00};

+	const unsigned char blob_reserved[] = {0x00,0x00,0x00,0x00};

+	gint64 blob_timestamp;

+	unsigned char client_nonce[8];

+	const unsigned char blob_unknown[] = {0x00,0x00,0x00,0x00};

+

+	unsigned char ntv2_hash[HMAC_MD5_LENGTH];

+	guchar *nonce_blob, *blob, *p_blob;

+	unsigned char nonce_blob_hash[HMAC_MD5_LENGTH];

+	unsigned char nonce_client_nonce[16], nonce_client_nonce_hash[HMAC_MD5_LENGTH];

+	gchar *user_uppercase, *user_domain, *user_domain_conv;

+	gsize user_domain_conv_sz;

+	size_t blob_sz;

+	int i;

+

+	/* create HMAC-MD5 hash of Unicode uppercase username and Unicode domain */

+	user_uppercase = g_utf8_strup (user, strlen (user));

+	user_domain = g_strconcat (user_uppercase, domain, NULL);

+	user_domain_conv = g_convert (user_domain, -1, "UCS-2LE", "UTF-8", NULL, &user_domain_conv_sz, NULL);

+	calc_hmac_md5 (ntv2_hash, nt_hash, nt_hash_sz, (const guchar *)user_domain_conv, user_domain_conv_sz);

+	g_free (user_uppercase);

+	g_free (user_domain);

+	g_free (user_domain_conv);

+

+	/* create random client nonce */

+	for (i = 0; i < sizeof (client_nonce); i++)

+	{

+		client_nonce[i] = g_random_int();

+	}

+

+	/* create timestamp for blob

+	 * LE, 64-bit signed value, number of tenths of a ms since January 1, 1601.*/

+	blob_timestamp = GINT64_TO_LE(((unsigned long)time(NULL) + 11644473600) * 10000000);

+

+	/* create blob */

+	blob_sz = sizeof (blob_signature) + sizeof (blob_reserved) +

+			sizeof (blob_timestamp) + sizeof (client_nonce) +

+			sizeof (blob_unknown) + target_info_sz;

+	p_blob = blob = g_malloc (blob_sz);

+	memset (blob, 0, blob_sz);

+	memcpy (p_blob, blob_signature, sizeof (blob_signature));

+	memcpy (p_blob += sizeof (blob_signature), blob_reserved, sizeof (blob_reserved));

+	memcpy (p_blob += sizeof (blob_reserved), &blob_timestamp, sizeof (blob_timestamp));

+	memcpy (p_blob += sizeof (blob_timestamp), client_nonce, sizeof (client_nonce));

+	memcpy (p_blob += sizeof (client_nonce), blob_unknown, sizeof (blob_unknown));

+	memcpy (p_blob += sizeof (blob_unknown), target_info, target_info_sz);

+

+	/* create HMAC-MD5 hash of concatenated nonce and blob */

+	nonce_blob = g_malloc (NTLM_CHALLENGE_NONCE_LENGTH + blob_sz);

+	memcpy (nonce_blob, nonce, NTLM_CHALLENGE_NONCE_LENGTH);

+	memcpy (nonce_blob + NTLM_CHALLENGE_NONCE_LENGTH, blob, blob_sz);

+	calc_hmac_md5 (nonce_blob_hash, (const guchar *)ntv2_hash, (gsize) sizeof (ntv2_hash), (const guchar *) nonce_blob, (gsize) NTLM_CHALLENGE_NONCE_LENGTH + blob_sz);

+	g_free (nonce_blob);

+

+	/* create NTv2 response */

+	memset (nt_resp, 0, nt_resp_sz);

+	memcpy (nt_resp, nonce_blob_hash, sizeof (nonce_blob_hash));

+	memcpy (nt_resp + sizeof (nonce_blob_hash), blob, blob_sz);

+

+	g_free (blob);

+

+	/* LMv2

+	 * create HMAC-MD5 hash of concatenated nonce and client nonce

+	 */

+	memcpy (nonce_client_nonce, nonce, NTLM_CHALLENGE_NONCE_LENGTH);

+	memcpy (nonce_client_nonce + NTLM_CHALLENGE_NONCE_LENGTH, client_nonce, sizeof (client_nonce));

+	calc_hmac_md5 (nonce_client_nonce_hash, (const guchar *) ntv2_hash, (gsize) sizeof (ntv2_hash), (const guchar *) nonce_client_nonce, (gsize) NTLM_CHALLENGE_NONCE_LENGTH + sizeof (client_nonce));

+

+	/* create LMv2 response */

+	memset (lm_resp, 0, lm_resp_sz);

+	memcpy (lm_resp, nonce_client_nonce_hash, sizeof (nonce_client_nonce_hash));

+	memcpy (lm_resp + sizeof (nonce_client_nonce_hash), client_nonce, sizeof (client_nonce));

+}

 static char *

 soup_ntlm_response (const char *nonce, 

@@ -769,23 +925,45 @@ soup_ntlm_response (const char *nonce,

 		    guchar      lm_hash[21],

 		    const char *host, 

 		    const char *domain,

-		    gboolean    ntlmv2_session)

+		    gboolean    ntlmv2_session,

+		    gboolean    negotiate_target,

+		    const char	*target_info,

+		    size_t	target_info_sz)

 {

+

 	int offset;

-	gsize hlen, dlen, ulen;

-	guchar lm_resp[24], nt_resp[24];

+	gsize hlen, dlen, ulen, nt_resp_sz;

+	guchar lm_resp[24], *nt_resp;

 	char *user_conv, *host_conv, *domain_conv;

 	NTLMResponse resp;

 	char *out, *p;

 	int state, save;

-	if (ntlmv2_session) {

+	if (negotiate_target)

+	{

+		/* nonce_blob_hash 16 + blob_signature 4 + blob_reserved 4 +

+		 * blob_timestamp 8 + client_nonce 8 + blob_unknown 4 +

+		 * target_info*/

+		nt_resp_sz = NTLM_RESPONSE_TARGET_INFORMATION_OFFSET + target_info_sz;

+	} else {

+		nt_resp_sz = 24;

+	}

+	nt_resp = g_malloc (nt_resp_sz);

+

+	if (ntlmv2_session && !negotiate_target) {

 		calc_ntlm2_session_response (nonce, nt_hash, lm_hash,

 					     lm_resp, sizeof(lm_resp), nt_resp);

-	} else {

-		/* Compute a regular response */

+	} else if (!negotiate_target){

+		/* Compute a regular NTLMv1 response */

 		calc_response (nt_hash, (guchar *) nonce, nt_resp);

 		calc_response (lm_hash, (guchar *) nonce, lm_resp);

+	} else {

+		calc_ntlmv2_response (user, domain,

+					nt_hash, 21,

+					(guchar *) nonce,

+					target_info, target_info_sz,

+					lm_resp, sizeof (lm_resp),

+					nt_resp, (size_t) nt_resp_sz);

 	}

 	memset (&resp, 0, sizeof (resp));

@@ -793,7 +971,8 @@ soup_ntlm_response (const char *nonce,

 	resp.flags = GUINT32_TO_LE (NTLM_RESPONSE_FLAGS);

 	if (ntlmv2_session)

 		resp.flags |= GUINT32_TO_LE (NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY);

-

+	if (negotiate_target)

+			resp.flags |= GUINT32_TO_LE (NTLM_FLAGS_REQUEST_TARGET);

 	offset = sizeof (resp);

 	if (!host)

@@ -807,10 +986,10 @@ soup_ntlm_response (const char *nonce,

 	ntlm_set_string (&resp.user, &offset, ulen);

 	ntlm_set_string (&resp.host, &offset, hlen);

 	ntlm_set_string (&resp.lm_resp, &offset, sizeof (lm_resp));

-	ntlm_set_string (&resp.nt_resp, &offset, sizeof (nt_resp));

+	ntlm_set_string (&resp.nt_resp, &offset, nt_resp_sz);

 	out = g_malloc (((offset + 3) * 4) / 3 + 6);

-	strncpy (out, "NTLM ", 5);

+	memcpy (out, "NTLM ", 5);

 	p = out + 5;

 	state = save = 0;

@@ -825,7 +1004,7 @@ soup_ntlm_response (const char *nonce,

 				   FALSE, p, &state, &save);

 	p += g_base64_encode_step (lm_resp, sizeof (lm_resp), 

 				   FALSE, p, &state, &save);

-	p += g_base64_encode_step (nt_resp, sizeof (nt_resp), 

+	p += g_base64_encode_step (nt_resp, nt_resp_sz,

 				   FALSE, p, &state, &save);

 	p += g_base64_encode_close (FALSE, p, &state, &save);

 	*p = '\0';

@@ -833,6 +1012,7 @@ soup_ntlm_response (const char *nonce,

 	g_free (domain_conv);

 	g_free (user_conv);

 	g_free (host_conv);

+	g_free (nt_resp);

 	return out;

 }