CVE-2016-2110: auth/gensec: fix the client side of a spnego downgrade

New servers response with SPNEGO_REQUEST_MIC instead of
SPNEGO_ACCEPT_INCOMPLETE to a downgrade.

With just KRB5 and NTLMSSP this doesn't happen, but we
want to be prepared for the future.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11644

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

diff --git a/auth/gensec/spnego.c b/auth/gensec/spnego.c
index af5231ae1427d2fc2e29293e26ee376bd62a1fa1..3fcd057f4da0dd6fc9f7c1050305237fd216cd31 100644 (file)
--- a/auth/gensec/spnego.c
+++ b/auth/gensec/spnego.c
@@ -970,13 +970,15 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA
                }
 
                /* Server didn't like our choice of mech, and chose something else */
-               if ((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) &&
+               if (((spnego.negTokenTarg.negResult == SPNEGO_ACCEPT_INCOMPLETE) ||
+                    (spnego.negTokenTarg.negResult == SPNEGO_REQUEST_MIC)) &&
                    spnego.negTokenTarg.supportedMech &&
                    strcmp(spnego.negTokenTarg.supportedMech, spnego_state->neg_oid) != 0) {
                        DEBUG(3,("GENSEC SPNEGO: client preferred mech (%s) not accepted, server wants: %s\n",
-                                gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech), 
-                                gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid)));
+                                gensec_get_name_by_oid(gensec_security, spnego_state->neg_oid),
+                                gensec_get_name_by_oid(gensec_security, spnego.negTokenTarg.supportedMech)));
 
+                       spnego_state->no_response_expected = false;
                        talloc_free(spnego_state->sub_sec_security);
                        nt_status = gensec_subcontext_start(spnego_state,
                                                            gensec_security,