Revert "gensec:spnego: ignore trailing bytes in SPNEGO_SERVER_START state"

This reverts commit 8841efe00eeefa66dfadaf357cf96d5cd846146b.

diff --git a/auth/gensec/spnego.c b/auth/gensec/spnego.c
index 9b32088a6a4c3176262b18db483c57e0eb18ecfa..fcb5a06439e5534c66610ce33421f89fab269150 100644 (file)
--- a/auth/gensec/spnego.c
+++ b/auth/gensec/spnego.c
@@ -1775,7 +1775,6 @@ static NTSTATUS gensec_spnego_update_in(struct gensec_security *gensec_security,
                                        const DATA_BLOB in, TALLOC_CTX *mem_ctx,
                                        DATA_BLOB *full_in)
 {
-       DATA_BLOB consume = data_blob_null;
        struct spnego_state *spnego_state =
                talloc_get_type_abort(gensec_security->private_data,
                struct spnego_state);
@@ -1842,26 +1841,17 @@ static NTSTATUS gensec_spnego_update_in(struct gensec_security *gensec_security,
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       consume = in;
        expected = spnego_state->in_needed - spnego_state->in_frag.length;
-       if (consume.length > expected) {
-               if (spnego_state->state_position != SPNEGO_SERVER_START) {
-                       /*
-                        * we got more than expected
-                        */
-                       return NT_STATUS_INVALID_PARAMETER;
-               }
-
+       if (in.length > expected) {
                /*
-                * In SPNEGO_SERVER_START we need to ignore unexpected
-                * bytes at the end.
+                * we got more than expected
                 */
-               consume.length = expected;
+               return NT_STATUS_INVALID_PARAMETER;
        }
 
-       if (consume.length == spnego_state->in_needed) {
+       if (in.length == spnego_state->in_needed) {
                /*
-                * if the consume.length contains the full blob
+                * if the in.length contains the full blob
                 * we are done.
                 *
                 * Note: this implies spnego_state->in_frag.length == 0,
@@ -1869,13 +1859,13 @@ static NTSTATUS gensec_spnego_update_in(struct gensec_security *gensec_security,
                 *       because we already know that we did not get
                 *       more than expected.
                 */
-               *full_in = consume;
+               *full_in = in;
                spnego_state->in_needed = 0;
                return NT_STATUS_OK;
        }
 
        ok = data_blob_append(spnego_state, &spnego_state->in_frag,
-                             consume.data, consume.length);
+                             in.data, in.length);
        if (!ok) {
                return NT_STATUS_NO_MEMORY;
        }