[krbdev.mit.edu #6726] SPNEGO doesn't interoperate with Windows 2000

[Arlene Berry via RT]

The problem is Windows 2000 returns a second copy of the mechanism
response token as the mechListMIC.  We saw this with Windows 2000
Server.  We worked around the problem by changing get_negTokenResp which
parses out the SPNEGO token components to detect the duplicate token and
not return it as a mechListMIC.  This prevents subsequent errors when
attempting to parse the duplicate response as a mechListMIC and was
enough for it to work.  The decision as to whether a mechListMIC is
required happens elsewhere and is unchanged.

Index: src/lib/gssapi/spnego/spnego_mech.c
===================================================================
--- src/lib/gssapi/spnego/spnego_mech.c	(revision 40750)
+++ src/lib/gssapi/spnego/spnego_mech.c	(revision 40751)
@@ -3111,6 +3111,19 @@
 		*mechListMIC = get_input_token(&ptr, REMAIN);
 		if (*mechListMIC == GSS_C_NO_BUFFER)
 			return GSS_S_DEFECTIVE_TOKEN;
+
+                /* Handle Windows 2000 duplicate response token */
+                if (*responseToken &&
+                    ((*responseToken)->length ==
(*mechListMIC)->length) &&
+                    !memcmp((*responseToken)->value,
(*mechListMIC)->value,
+                            (*responseToken)->length))
+                {
+                    OM_uint32 tmpmin;
+
+                    gss_release_buffer(&tmpmin, *mechListMIC);
+                    free(*mechListMIC);
+                    *mechListMIC = NULL;
+                }
 	}
 	return GSS_S_COMPLETE;
 #undef REMAIN