r4692: Make the client SPNEGO code bail out in a couple more cases.

Andrew Bartlett
(This used to be commit a062ac122c402fb2cf31eb8e76f4077b1f33b8eb)

diff --git a/source4/libcli/auth/spnego.c b/source4/libcli/auth/spnego.c
index 84bd7ce42c092219f0b972ced005eb34c66b738a..f7221b7458a274fb876ca36b29a0aa25ceaa8e1c 100644 (file)
--- a/source4/libcli/auth/spnego.c
+++ b/source4/libcli/auth/spnego.c
@@ -686,7 +686,10 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA
 
                if (spnego_state->no_response_expected) {
                        if (spnego.negTokenTarg.negResult != SPNEGO_ACCEPT_COMPLETED) {
-                               DEBUG(1,("gensec_update ok but not accepted\n"));
+                               DEBUG(3,("GENSEC SPNEGO: client GENSEC accepted, but server rejected (bad password?)\n"));
+                               nt_status = NT_STATUS_INVALID_PARAMETER;
+                       } else if (spnego.negTokenTarg.responseToken.length) {
+                               DEBUG(2,("GENSEC SPNEGO: client GENSEC accepted, but server continued negotiation!\n"));
                                nt_status = NT_STATUS_INVALID_PARAMETER;
                        } else {
                                nt_status = NT_STATUS_OK;