  #define ssize_t int
  #endif
  
+--- misc/neon-0.28.2/src/ne_locks.c	2007-02-05 11:09:27.000000000 +0100
++++ misc/build/neon-0.28.2/src/ne_locks.c	2009-11-12 12:57:15.000000000 +0100
+@@ -579,6 +579,23 @@
+         const char *token = ne_get_response_header(ctx->req, "Lock-Token");
+         /* at the root element; retrieve the Lock-Token header,
+          * and bail if it wasn't given. */
++#ifdef IIS_LOCK_BUG_WORKAROUND
++        /* MS IIS violates RFC 2518/4918. It does not send a Lock-Token response
++           header upon successful creation of a new lock. As a workaround, we
++           will try to pick the lock token from the response body (although
++           this is not 100% safe in case of multiple activelocks). */
++        if (token == NULL)
++	  NE_DEBUG(NE_DBG_LOCKS,
++		   "Ignoring missing LOCK response Lock-Token header\n");
++
++        if (token != NULL) {
++	  if (token[0] == '<') token++;
++	  ctx->token = ne_strdup(token);
++	  ne_shave(ctx->token, ">");
++	  NE_DEBUG(NE_DBG_LOCKS, "lk_startelm: Finding token %s\n",
++		   ctx->token);
++        }
++#else
+         if (token == NULL) {
+             ne_xml_set_error(ctx->parser, 
+                              _("LOCK response missing Lock-Token header"));
+@@ -590,12 +607,28 @@
+         ne_shave(ctx->token, ">");
+         NE_DEBUG(NE_DBG_LOCKS, "lk_startelm: Finding token %s\n",
+                  ctx->token);
++#endif
+     }
+ 
+     /* TODO: only accept 'prop' as root for LOCK response */
+     if (!can_accept(parent, id))
+         return NE_XML_DECLINE;
+ 
++#ifdef IIS_LOCK_BUG_WORKAROUND
++    if (id == ELM_activelock && ctx->found) {
++      /* Found another activelock... */
++      const char *token = ne_get_response_header(ctx->req, "Lock-Token");
++      if (token == NULL) {
++	/* Response contains more than one activelock and no Lock-Token
++	 * response header. We are doomed. No safe workaround for IIS
++	 * lock bug possible. */
++	ne_xml_set_error(ctx->parser,
++			 _("LOCK response missing Lock-Token header and more than one activelock"));
++	return NE_XML_ABORT;
++      }
++    }
++#endif
++
+     if (id == ELM_activelock && !ctx->found) {
+ 	/* a new activelock */
+ 	ne_lock_free(&ctx->active);
+@@ -621,7 +654,12 @@
+ 	return -1;
+ 
+     if (state == ELM_activelock) {
++#ifdef IIS_LOCK_BUG_WORKAROUND
++      if (ctx->active.token) {
++        ctx->token = ne_strdup(ctx->active.token);
++#else
+ 	if (ctx->active.token && strcmp(ctx->active.token, ctx->token) == 0) {
++#endif
+ 	    ctx->found = 1;
+ 	}
+     }
 --- misc/neon-0.28.2/src/ne_locks.h	2006-01-02 12:43:19.000000000 +0100
-+++ misc/build/neon-0.28.2/src/ne_locks.h	2009-08-11 09:48:54.000000000 +0200
++++ misc/build/neon-0.28.2/src/ne_locks.h	2009-11-12 11:39:52.000000000 +0100
 @@ -22,6 +22,10 @@
  #ifndef NE_LOCKS_H
  #define NE_LOCKS_H

 #endif /* NE_HAVE_* */
     default:
--- misc/neon-0.28.2/src/ne_utils.h	2007-07-16 08:54:57.000000000 +0200
+++ misc/build/neon-0.28.2/src/ne_utils.h	2009-08-24 15:47:03.000000000 +0200
@@ -54,6 +54,7 @@
 #define NE_FEATURE_SOCKS (5) /* SOCKSv5 support */
 #define NE_FEATURE_TS_SSL (6) /* Thread-safe SSL/TLS support */

     return ret;
 }
--- misc/neon-0.28.2/src/ne_auth.h	2007-12-05 17:39:58.000000000 +0100
+++ misc/build/neon-0.28.2/src/ne_auth.h	2009-11-12 11:39:52.000000000 +0100
@@ -47,8 +47,8 @@
  * Hint: if you just wish to attempt authentication just once (even if
  * the user gets the username/password wrong), have the callback
