+ asn1_end_tag(data);
+ asn1_end_tag(data);
+
+ *principal = NULL;
+
+ /*
+ Win7 + Live Sign-in Assistant attaches a mechToken
+ ASN1_CONTEXT(2) to the negTokenInit packet
+ which breaks our negotiation if we just assume
+ the next tag is ASN1_CONTEXT(3).
+ */
+
+ if (asn1_peek_tag(data, ASN1_CONTEXT(1))) {
+ uint8 flags;
+
+ /* reqFlags [1] ContextFlags OPTIONAL */
+ asn1_start_tag(data, ASN1_CONTEXT(1));
+ asn1_start_tag(data, ASN1_BIT_STRING);
+ while (asn1_tag_remaining(data) > 0) {
+ asn1_read_uint8(data, &flags);
+ }
+ asn1_end_tag(data);
+ asn1_end_tag(data);
+ }
+
+ if (asn1_peek_tag(data, ASN1_CONTEXT(2))) {
+ /* mechToken [2] OCTET STRING OPTIONAL */
+ DATA_BLOB token;
+ asn1_start_tag(data, ASN1_CONTEXT(2));
+ asn1_read_OctetString(data, talloc_autofree_context(),
+ &token);
+ asn1_end_tag(data);
+ /* Throw away the token - not used. */
+ data_blob_free(&token);
+ }