source3/libsmb/clispnego.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5/SPNEGO routines
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   6    Copyright (C) Luke Howard     2003
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "smb_krb5.h"
  24
  25 /*
  26   generate a negTokenInit packet given a GUID, a list of supported
  27   OIDs (the mechanisms) and a principal name string
  28 */
  29 DATA_BLOB spnego_gen_negTokenInit(char guid[16],
  30                                   const char *OIDs[],
  31                                   const char *principal)
  32 {
  33         int i;
  34         ASN1_DATA *data;
  35         DATA_BLOB ret;
  36
  37         data = asn1_init(talloc_tos());
  38         if (data == NULL) {
  39                 return data_blob_null;
  40         }
  41
  42         asn1_write(data, guid, 16);
  43         asn1_push_tag(data,ASN1_APPLICATION(0));
  44         asn1_write_OID(data,OID_SPNEGO);
  45         asn1_push_tag(data,ASN1_CONTEXT(0));
  46         asn1_push_tag(data,ASN1_SEQUENCE(0));
  47
  48         asn1_push_tag(data,ASN1_CONTEXT(0));
  49         asn1_push_tag(data,ASN1_SEQUENCE(0));
  50         for (i=0; OIDs[i]; i++) {
  51                 asn1_write_OID(data,OIDs[i]);
  52         }
  53         asn1_pop_tag(data);
  54         asn1_pop_tag(data);
  55
  56         asn1_push_tag(data, ASN1_CONTEXT(3));
  57         asn1_push_tag(data, ASN1_SEQUENCE(0));
  58         asn1_push_tag(data, ASN1_CONTEXT(0));
  59         asn1_write_GeneralString(data,principal);
  60         asn1_pop_tag(data);
  61         asn1_pop_tag(data);
  62         asn1_pop_tag(data);
  63
  64         asn1_pop_tag(data);
  65         asn1_pop_tag(data);
  66
  67         asn1_pop_tag(data);
  68
  69         if (data->has_error) {
  70                 DEBUG(1,("Failed to build negTokenInit at offset %d\n", (int)data->ofs));
  71         }
  72
  73         ret = data_blob(data->data, data->length);
  74         asn1_free(data);
  75
  76         return ret;
  77 }
  78
  79 /*
  80   Generate a negTokenInit as used by the client side ... It has a mechType
  81   (OID), and a mechToken (a security blob) ...
  82
  83   Really, we need to break out the NTLMSSP stuff as well, because it could be
  84   raw in the packets!
  85 */
  86 DATA_BLOB gen_negTokenInit(const char *OID, DATA_BLOB blob)
  87 {
  88         ASN1_DATA *data;
  89         DATA_BLOB ret;
  90
  91         data = asn1_init(talloc_tos());
  92         if (data == NULL) {
  93                 return data_blob_null;
  94         }
  95
  96         asn1_push_tag(data, ASN1_APPLICATION(0));
  97         asn1_write_OID(data,OID_SPNEGO);
  98         asn1_push_tag(data, ASN1_CONTEXT(0));
  99         asn1_push_tag(data, ASN1_SEQUENCE(0));
 100
 101         asn1_push_tag(data, ASN1_CONTEXT(0));
 102         asn1_push_tag(data, ASN1_SEQUENCE(0));
 103         asn1_write_OID(data, OID);
 104         asn1_pop_tag(data);
 105         asn1_pop_tag(data);
 106
 107         asn1_push_tag(data, ASN1_CONTEXT(2));
 108         asn1_write_OctetString(data,blob.data,blob.length);
 109         asn1_pop_tag(data);
 110
 111         asn1_pop_tag(data);
 112         asn1_pop_tag(data);
 113
 114         asn1_pop_tag(data);
 115
 116         if (data->has_error) {
 117                 DEBUG(1,("Failed to build negTokenInit at offset %d\n", (int)data->ofs));
 118         }
 119
 120         ret = data_blob(data->data, data->length);
 121         asn1_free(data);
 122
 123         return ret;
 124 }
 125
 126 /*
 127   parse a negTokenInit packet giving a GUID, a list of supported
 128   OIDs (the mechanisms) and a principal name string
 129 */
 130 bool spnego_parse_negTokenInit(DATA_BLOB blob,
 131                                char *OIDs[ASN1_MAX_OIDS],
 132                                char **principal)
 133 {
 134         int i;
 135         bool ret;
 136         ASN1_DATA *data;
 137
 138         data = asn1_init(talloc_tos());
 139         if (data == NULL) {
 140                 return false;
 141         }
 142
 143         asn1_load(data, blob);
 144
 145         asn1_start_tag(data,ASN1_APPLICATION(0));
 146
 147         asn1_check_OID(data,OID_SPNEGO);
 148
 149         /* negTokenInit  [0]  NegTokenInit */
 150         asn1_start_tag(data,ASN1_CONTEXT(0));
 151         asn1_start_tag(data,ASN1_SEQUENCE(0));
 152
 153         /* mechTypes [0] MechTypeList  OPTIONAL */
 154
 155         /* Not really optional, we depend on this to decide
 156          * what mechanisms we have to work with. */
 157
 158         asn1_start_tag(data,ASN1_CONTEXT(0));
 159         asn1_start_tag(data,ASN1_SEQUENCE(0));
 160         for (i=0; asn1_tag_remaining(data) > 0 && i < ASN1_MAX_OIDS-1; i++) {
 161                 const char *oid_str = NULL;
 162                 asn1_read_OID(data,NULL,&oid_str);
 163                 OIDs[i] = CONST_DISCARD(char *, oid_str);
 164         }
 165         OIDs[i] = NULL;
 166         asn1_end_tag(data);
 167         asn1_end_tag(data);
 168
 169         *principal = NULL;
 170
 171
 172         /*
 173           Win7 + Live Sign-in Assistant attaches a mechToken
 174           ASN1_CONTEXT(2) to the negTokenInit packet
 175           which breaks our negotiation if we just assume
 176           the next tag is ASN1_CONTEXT(3).
 177         */
 178
 179         if (asn1_peek_tag(data, ASN1_CONTEXT(1))) {
 180                 uint8 flags;
 181
 182                 /* reqFlags [1] ContextFlags  OPTIONAL */
 183                 asn1_start_tag(data, ASN1_CONTEXT(1));
 184                 asn1_start_tag(data, ASN1_BITFIELD);
 185                 while (asn1_tag_remaining(data) > 0) {
 186                         asn1_read_uint8(data, &flags);
 187                 }
 188                 asn1_end_tag(data);
 189                 asn1_end_tag(data);
 190         }
 191
 192         if (asn1_peek_tag(data, ASN1_CONTEXT(2))) {
 193                 /* mechToken [2] OCTET STRING  OPTIONAL */
 194                 DATA_BLOB token;
 195                 asn1_start_tag(data, ASN1_CONTEXT(2));
 196                 asn1_read_OctetString(data, NULL, &token);
 197                 asn1_end_tag(data);
 198                 /* Throw away the token - not used. */
 199                 data_blob_free(&token);
 200         }
 201
 202         if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
 203                 /* mechListMIC [3] OCTET STRING  OPTIONAL */
 204                 asn1_start_tag(data, ASN1_CONTEXT(3));
 205                 asn1_start_tag(data, ASN1_SEQUENCE(0));
 206                 asn1_start_tag(data, ASN1_CONTEXT(0));
 207                 asn1_read_GeneralString(data,NULL,principal);
 208                 asn1_end_tag(data);
 209                 asn1_end_tag(data);
 210                 asn1_end_tag(data);
 211         }
 212
 213         asn1_end_tag(data);
 214         asn1_end_tag(data);
 215
 216         asn1_end_tag(data);
 217
 218         ret = !data->has_error;
 219         if (data->has_error) {
 220                 int j;
 221                 TALLOC_FREE(*principal);
 222                 for(j = 0; j < i && j < ASN1_MAX_OIDS-1; j++) {
 223                         TALLOC_FREE(OIDs[j]);
 224                 }
 225         }
 226
 227         asn1_free(data);
 228         return ret;
 229 }
 230
 231 /*
 232   generate a negTokenTarg packet given a list of OIDs and a security blob
 233 */
 234 DATA_BLOB gen_negTokenTarg(const char *OIDs[], DATA_BLOB blob)
 235 {
 236         int i;
 237         ASN1_DATA *data;
 238         DATA_BLOB ret;
 239
 240         data = asn1_init(talloc_tos());
 241         if (data == NULL) {
 242                 return data_blob_null;
 243         }
 244
 245         asn1_push_tag(data, ASN1_APPLICATION(0));
 246         asn1_write_OID(data,OID_SPNEGO);
 247         asn1_push_tag(data, ASN1_CONTEXT(0));
 248         asn1_push_tag(data, ASN1_SEQUENCE(0));
 249
 250         asn1_push_tag(data, ASN1_CONTEXT(0));
 251         asn1_push_tag(data, ASN1_SEQUENCE(0));
 252         for (i=0; OIDs[i]; i++) {
 253                 asn1_write_OID(data,OIDs[i]);
 254         }
 255         asn1_pop_tag(data);
 256         asn1_pop_tag(data);
 257
 258         asn1_push_tag(data, ASN1_CONTEXT(2));
 259         asn1_write_OctetString(data,blob.data,blob.length);
 260         asn1_pop_tag(data);
 261
 262         asn1_pop_tag(data);
 263         asn1_pop_tag(data);
 264
 265         asn1_pop_tag(data);
 266
 267         if (data->has_error) {
 268                 DEBUG(1,("Failed to build negTokenTarg at offset %d\n", (int)data->ofs));
 269         }
 270
 271         ret = data_blob(data->data, data->length);
 272         asn1_free(data);
 273
 274         return ret;
 275 }
 276
 277 /*
 278   parse a negTokenTarg packet giving a list of OIDs and a security blob
 279 */
 280 bool parse_negTokenTarg(DATA_BLOB blob, char *OIDs[ASN1_MAX_OIDS], DATA_BLOB *secblob)
 281 {
 282         int i;
 283         ASN1_DATA *data;
 284
 285         data = asn1_init(talloc_tos());
 286         if (data == NULL) {
 287                 return false;
 288         }
 289
 290         asn1_load(data, blob);
 291         asn1_start_tag(data, ASN1_APPLICATION(0));
 292         asn1_check_OID(data,OID_SPNEGO);
 293         asn1_start_tag(data, ASN1_CONTEXT(0));
 294         asn1_start_tag(data, ASN1_SEQUENCE(0));
 295
 296         asn1_start_tag(data, ASN1_CONTEXT(0));
 297         asn1_start_tag(data, ASN1_SEQUENCE(0));
 298         for (i=0; asn1_tag_remaining(data) > 0 && i < ASN1_MAX_OIDS-1; i++) {
 299                 const char *oid_str = NULL;
 300                 asn1_read_OID(data,NULL,&oid_str);
 301                 OIDs[i] = CONST_DISCARD(char *, oid_str);
 302         }
 303         OIDs[i] = NULL;
 304         asn1_end_tag(data);
 305         asn1_end_tag(data);
 306
 307         /* Skip any optional req_flags that are sent per RFC 4178 */
 308         if (asn1_peek_tag(data, ASN1_CONTEXT(1))) {
 309                 uint8 flags;
 310
 311                 asn1_start_tag(data, ASN1_CONTEXT(1));
 312                 asn1_start_tag(data, ASN1_BITFIELD);
 313                 while (asn1_tag_remaining(data) > 0)
 314                         asn1_read_uint8(data, &flags);
 315                 asn1_end_tag(data);
 316                 asn1_end_tag(data);
 317         }
 318
 319         asn1_start_tag(data, ASN1_CONTEXT(2));
 320         asn1_read_OctetString(data,NULL,secblob);
 321         asn1_end_tag(data);
 322
 323         asn1_end_tag(data);
 324         asn1_end_tag(data);
 325
 326         asn1_end_tag(data);
 327
 328         if (data->has_error) {
 329                 int j;
 330                 data_blob_free(secblob);
 331                 for(j = 0; j < i && j < ASN1_MAX_OIDS-1; j++) {
 332                         TALLOC_FREE(OIDs[j]);
 333                 }
 334                 DEBUG(1,("Failed to parse negTokenTarg at offset %d\n", (int)data->ofs));
 335                 asn1_free(data);
 336                 return False;
 337         }
 338
 339         asn1_free(data);
 340         return True;
 341 }
 342
 343 /*
 344   generate a krb5 GSS-API wrapper packet given a ticket
 345 */
 346 DATA_BLOB spnego_gen_krb5_wrap(const DATA_BLOB ticket, const uint8 tok_id[2])
 347 {
 348         ASN1_DATA *data;
 349         DATA_BLOB ret;
 350
 351         data = asn1_init(talloc_tos());
 352         if (data == NULL) {
 353                 return data_blob_null;
 354         }
 355
 356         asn1_push_tag(data, ASN1_APPLICATION(0));
 357         asn1_write_OID(data, OID_KERBEROS5);
 358
 359         asn1_write(data, tok_id, 2);
 360         asn1_write(data, ticket.data, ticket.length);
 361         asn1_pop_tag(data);
 362
 363         if (data->has_error) {
 364                 DEBUG(1,("Failed to build krb5 wrapper at offset %d\n", (int)data->ofs));
 365         }
 366
 367         ret = data_blob(data->data, data->length);
 368         asn1_free(data);
 369
 370         return ret;
 371 }
 372
 373 /*
 374   parse a krb5 GSS-API wrapper packet giving a ticket
 375 */
 376 bool spnego_parse_krb5_wrap(DATA_BLOB blob, DATA_BLOB *ticket, uint8 tok_id[2])
 377 {
 378         bool ret;
 379         ASN1_DATA *data;
 380         int data_remaining;
 381
 382         data = asn1_init(talloc_tos());
 383         if (data == NULL) {
 384                 return false;
 385         }
 386
 387         asn1_load(data, blob);
 388         asn1_start_tag(data, ASN1_APPLICATION(0));
 389         asn1_check_OID(data, OID_KERBEROS5);
 390
 391         data_remaining = asn1_tag_remaining(data);
 392
 393         if (data_remaining < 3) {
 394                 data->has_error = True;
 395         } else {
 396                 asn1_read(data, tok_id, 2);
 397                 data_remaining -= 2;
 398                 *ticket = data_blob(NULL, data_remaining);
 399                 asn1_read(data, ticket->data, ticket->length);
 400         }
 401
 402         asn1_end_tag(data);
 403
 404         ret = !data->has_error;
 405
 406         if (data->has_error) {
 407                 data_blob_free(ticket);
 408         }
 409
 410         asn1_free(data);
 411
 412         return ret;
 413 }
 414
 415
 416 /*
 417    generate a SPNEGO negTokenTarg packet, ready for a EXTENDED_SECURITY
 418    kerberos session setup
 419 */
 420 int spnego_gen_negTokenTarg(const char *principal, int time_offset,
 421                             DATA_BLOB *targ,
 422                             DATA_BLOB *session_key_krb5, uint32 extra_ap_opts,
 423                             time_t *expire_time)
 424 {
 425         int retval;
 426         DATA_BLOB tkt, tkt_wrapped;
 427         const char *krb_mechs[] = {OID_KERBEROS5_OLD, OID_KERBEROS5, OID_NTLMSSP, NULL};
 428
 429         /* get a kerberos ticket for the service and extract the session key */
 430         retval = cli_krb5_get_ticket(principal, time_offset,
 431                                         &tkt, session_key_krb5, extra_ap_opts, NULL,
 432                                         expire_time);
 433
 434         if (retval)
 435                 return retval;
 436
 437         /* wrap that up in a nice GSS-API wrapping */
 438         tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
 439
 440         /* and wrap that in a shiny SPNEGO wrapper */
 441         *targ = gen_negTokenTarg(krb_mechs, tkt_wrapped);
 442
 443         data_blob_free(&tkt_wrapped);
 444         data_blob_free(&tkt);
 445
 446         return retval;
 447 }
 448
 449
 450 /*
 451   parse a spnego NTLMSSP challenge packet giving two security blobs
 452 */
 453 bool spnego_parse_challenge(const DATA_BLOB blob,
 454                             DATA_BLOB *chal1, DATA_BLOB *chal2)
 455 {
 456         bool ret;
 457         ASN1_DATA *data;
 458
 459         ZERO_STRUCTP(chal1);
 460         ZERO_STRUCTP(chal2);
 461
 462         data = asn1_init(talloc_tos());
 463         if (data == NULL) {
 464                 return false;
 465         }
 466
 467         asn1_load(data, blob);
 468         asn1_start_tag(data,ASN1_CONTEXT(1));
 469         asn1_start_tag(data,ASN1_SEQUENCE(0));
 470
 471         asn1_start_tag(data,ASN1_CONTEXT(0));
 472         asn1_check_enumerated(data,1);
 473         asn1_end_tag(data);
 474
 475         asn1_start_tag(data,ASN1_CONTEXT(1));
 476         asn1_check_OID(data, OID_NTLMSSP);
 477         asn1_end_tag(data);
 478
 479         asn1_start_tag(data,ASN1_CONTEXT(2));
 480         asn1_read_OctetString(data, NULL, chal1);
 481         asn1_end_tag(data);
 482
 483         /* the second challenge is optional (XP doesn't send it) */
 484         if (asn1_tag_remaining(data)) {
 485                 asn1_start_tag(data,ASN1_CONTEXT(3));
 486                 asn1_read_OctetString(data, NULL, chal2);
 487                 asn1_end_tag(data);
 488         }
 489
 490         asn1_end_tag(data);
 491         asn1_end_tag(data);
 492
 493         ret = !data->has_error;
 494
 495         if (data->has_error) {
 496                 data_blob_free(chal1);
 497                 data_blob_free(chal2);
 498         }
 499
 500         asn1_free(data);
 501         return ret;
 502 }
 503
 504
 505 /*
 506  generate a SPNEGO auth packet. This will contain the encrypted passwords
 507 */
 508 DATA_BLOB spnego_gen_auth(DATA_BLOB blob)
 509 {
 510         ASN1_DATA *data;
 511         DATA_BLOB ret;
 512
 513         data = asn1_init(talloc_tos());
 514         if (data == NULL) {
 515                 return data_blob_null;
 516         }
 517
 518         asn1_push_tag(data, ASN1_CONTEXT(1));
 519         asn1_push_tag(data, ASN1_SEQUENCE(0));
 520         asn1_push_tag(data, ASN1_CONTEXT(2));
 521         asn1_write_OctetString(data,blob.data,blob.length);
 522         asn1_pop_tag(data);
 523         asn1_pop_tag(data);
 524         asn1_pop_tag(data);
 525
 526         ret = data_blob(data->data, data->length);
 527
 528         asn1_free(data);
 529
 530         return ret;
 531 }
 532
 533 /*
 534  parse a SPNEGO auth packet. This contains the encrypted passwords
 535 */
 536 bool spnego_parse_auth(DATA_BLOB blob, DATA_BLOB *auth)
 537 {
 538         SPNEGO_DATA token;
 539         ssize_t len;
 540
 541         len = read_spnego_data(talloc_tos(), blob, &token);
 542         if (len == -1) {
 543                 DEBUG(3,("spnego_parse_auth: read_spnego_data failed\n"));
 544                 return false;
 545         }
 546
 547         if (token.type != SPNEGO_NEG_TOKEN_TARG) {
 548                 DEBUG(3,("spnego_parse_auth: wrong token type: %d\n",
 549                         token.type));
 550                 free_spnego_data(&token);
 551                 return false;
 552         }
 553
 554         *auth = data_blob_talloc(talloc_tos(),
 555                                  token.negTokenTarg.responseToken.data,
 556                                  token.negTokenTarg.responseToken.length);
 557         free_spnego_data(&token);
 558
 559         return true;
 560 }
 561
 562 /*
 563   generate a minimal SPNEGO response packet.  Doesn't contain much.
 564 */
 565 DATA_BLOB spnego_gen_auth_response(DATA_BLOB *reply, NTSTATUS nt_status,
 566                                    const char *mechOID)
 567 {
 568         ASN1_DATA *data;
 569         DATA_BLOB ret;
 570         uint8 negResult;
 571
 572         if (NT_STATUS_IS_OK(nt_status)) {
 573                 negResult = SPNEGO_NEG_RESULT_ACCEPT;
 574         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 575                 negResult = SPNEGO_NEG_RESULT_INCOMPLETE;
 576         } else {
 577                 negResult = SPNEGO_NEG_RESULT_REJECT;
 578         }
 579
 580         data = asn1_init(talloc_tos());
 581         if (data == NULL) {
 582                 return data_blob_null;
 583         }
 584
 585         asn1_push_tag(data, ASN1_CONTEXT(1));
 586         asn1_push_tag(data, ASN1_SEQUENCE(0));
 587         asn1_push_tag(data, ASN1_CONTEXT(0));
 588         asn1_write_enumerated(data, negResult);
 589         asn1_pop_tag(data);
 590
 591         if (mechOID) {
 592                 asn1_push_tag(data,ASN1_CONTEXT(1));
 593                 asn1_write_OID(data, mechOID);
 594                 asn1_pop_tag(data);
 595         }
 596
 597         if (reply && reply->data != NULL) {
 598                 asn1_push_tag(data,ASN1_CONTEXT(2));
 599                 asn1_write_OctetString(data, reply->data, reply->length);
 600                 asn1_pop_tag(data);
 601         }
 602
 603         asn1_pop_tag(data);
 604         asn1_pop_tag(data);
 605
 606         ret = data_blob(data->data, data->length);
 607         asn1_free(data);
 608         return ret;
 609 }
 610
 611 /*
 612  parse a SPNEGO auth packet. This contains the encrypted passwords
 613 */
 614 bool spnego_parse_auth_response(DATA_BLOB blob, NTSTATUS nt_status,
 615                                 const char *mechOID,
 616                                 DATA_BLOB *auth)
 617 {
 618         ASN1_DATA *data;
 619         uint8 negResult;
 620
 621         if (NT_STATUS_IS_OK(nt_status)) {
 622                 negResult = SPNEGO_NEG_RESULT_ACCEPT;
 623         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 624                 negResult = SPNEGO_NEG_RESULT_INCOMPLETE;
 625         } else {
 626                 negResult = SPNEGO_NEG_RESULT_REJECT;
 627         }
 628
 629         data = asn1_init(talloc_tos());
 630         if (data == NULL) {
 631                 return false;
 632         }
 633
 634         asn1_load(data, blob);
 635         asn1_start_tag(data, ASN1_CONTEXT(1));
 636         asn1_start_tag(data, ASN1_SEQUENCE(0));
 637         asn1_start_tag(data, ASN1_CONTEXT(0));
 638         asn1_check_enumerated(data, negResult);
 639         asn1_end_tag(data);
 640
 641         *auth = data_blob_null;
 642
 643         if (asn1_tag_remaining(data)) {
 644                 asn1_start_tag(data,ASN1_CONTEXT(1));
 645                 asn1_check_OID(data, mechOID);
 646                 asn1_end_tag(data);
 647
 648                 if (asn1_tag_remaining(data)) {
 649                         asn1_start_tag(data,ASN1_CONTEXT(2));
 650                         asn1_read_OctetString(data, NULL, auth);
 651                         asn1_end_tag(data);
 652                 }
 653         } else if (negResult == SPNEGO_NEG_RESULT_INCOMPLETE) {
 654                 data->has_error = 1;
 655         }
 656
 657         /* Binding against Win2K DC returns a duplicate of the responseToken in
 658          * the optional mechListMIC field. This is a bug in Win2K. We ignore
 659          * this field if it exists. Win2K8 may return a proper mechListMIC at
 660          * which point we need to implement the integrity checking. */
 661         if (asn1_tag_remaining(data)) {
 662                 DATA_BLOB mechList = data_blob_null;
 663                 asn1_start_tag(data, ASN1_CONTEXT(3));
 664                 asn1_read_OctetString(data, NULL, &mechList);
 665                 asn1_end_tag(data);
 666                 data_blob_free(&mechList);
 667                 DEBUG(5,("spnego_parse_auth_response received mechListMIC, "
 668                     "ignoring.\n"));
 669         }
 670
 671         asn1_end_tag(data);
 672         asn1_end_tag(data);
 673
 674         if (data->has_error) {
 675                 DEBUG(3,("spnego_parse_auth_response failed at %d\n", (int)data->ofs));
 676                 asn1_free(data);
 677                 data_blob_free(auth);
 678                 return False;
 679         }
 680
 681         asn1_free(data);
 682         return True;
 683 }