1 files changed, 36 insertions, 9 deletions

diff --git a/sshconnect2.c b/sshconnect2.c
index a96153903..bb72db5dd 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -312,6 +312,10 @@ Authmethod authmethods[] = {
                 NULL,
                 &options.gss_authentication,
                 NULL},
+        {"gssapi",
+                userauth_gssapi,
+                &options.gss_authentication,
+                NULL},
 #endif
         {"hostbased",
                 userauth_hostbased,
@@ -599,6 +603,7 @@ userauth_gssapi(Authctxt *authctxt)
         OM_uint32 min;
         int ok = 0;
         const char *gss_host;
+        int old_gssapi_method;
 
         if (options.gss_trust_dns)
                 gss_host = get_canonical_hostname(1);
@@ -637,13 +642,25 @@ userauth_gssapi(Authctxt *authctxt)
         packet_put_cstring(authctxt->service);
         packet_put_cstring(authctxt->method->name);
 
-        packet_put_int(1);
+        old_gssapi_method = !strcmp(authctxt->method->name, "gssapi");
+
+        /* Versions of Debian ssh-krb5 prior to 3.8.1p1-1 don't expect
+         * tagged OIDs.  As such we include both tagged and untagged oids
+         * for the old gssapi method.
+         * We only include tagged oids for the new gssapi-with-mic method.
+         */
+        packet_put_int(old_gssapi_method ? 2 : 1);
 
         packet_put_int((gss_supported->elements[mech].length) + 2);
         packet_put_char(SSH_GSS_OIDTYPE);
         packet_put_char(gss_supported->elements[mech].length);
         packet_put_raw(gss_supported->elements[mech].elements,
             gss_supported->elements[mech].length);
+        if (old_gssapi_method) {
+                packet_put_int(gss_supported->elements[mech].length);
+                packet_put_raw(gss_supported->elements[mech].elements,
+                               gss_supported->elements[mech].length);
+        }
 
         packet_send();
 
@@ -683,8 +700,10 @@ process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
         }
 
         if (status == GSS_S_COMPLETE) {
+                int old_gssapi_method = !strcmp(authctxt->method->name,
+                                                "gssapi");
                 /* send either complete or MIC, depending on mechanism */
-                if (!(flags & GSS_C_INTEG_FLAG)) {
+                if (old_gssapi_method || !(flags & GSS_C_INTEG_FLAG)) {
                         packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
                         packet_send();
                 } else {
@@ -718,7 +737,7 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
         Authctxt *authctxt = ctxt;
         Gssctxt *gssctxt;
         u_int oidlen;
-        u_char *oidv;
+        u_char *oidv, *oidv_free;
 
         if (authctxt == NULL)
                 fatal("input_gssapi_response: no authentication context");
@@ -726,22 +745,28 @@ input_gssapi_response(int type, u_int32_t plen, void *ctxt)
 
         /* Setup our OID */
         oidv = packet_get_string(&oidlen);
+        oidv_free = oidv;
 
         if (oidlen <= 2 ||
             oidv[0] != SSH_GSS_OIDTYPE ||
             oidv[1] != oidlen - 2) {
-                xfree(oidv);
                 debug("Badly encoded mechanism OID received");
-                userauth(authctxt, NULL);
-                return;
+                if (oidlen < 2) {
+                        xfree(oidv_free);
+                        userauth(authctxt, NULL);
+                        return;
+                }
+        } else {
+                oidlen -= 2;
+                oidv += 2;
         }
 
-        if (!ssh_gssapi_check_oid(gssctxt, oidv + 2, oidlen - 2))
+        if (!ssh_gssapi_check_oid(gssctxt, oidv, oidlen))
                 fatal("Server returned different OID than expected");
 
         packet_check_eom();
 
-        xfree(oidv);
+        xfree(oidv_free);
 
         if (GSS_ERROR(process_gssapi_token(ctxt, GSS_C_NO_BUFFER))) {
                 /* Start again with next method on list */
@@ -1390,6 +1415,8 @@ pubkey_prepare(Authctxt *authctxt)
 
         /* list of keys stored in the filesystem */
         for (i = 0; i < options.num_identity_files; i++) {
+                if (options.identity_files[i] == NULL)
+                        continue;
                 key = options.identity_keys[i];
                 if (key && key->type == KEY_RSA1)
                         continue;
@@ -1480,7 +1507,7 @@ userauth_pubkey(Authctxt *authctxt)
                 if (id->key && id->key->type != KEY_RSA1) {
                         debug("Offering public key: %s", id->filename);
                         sent = send_pubkey_test(authctxt, id);
-                } else if (id->key == NULL) {
+                } else if (id->key == NULL && id->filename) {
                         debug("Trying private key: %s", id->filename);
                         id->key = load_identity_file(id->filename);
                         if (id->key != NULL) {