add backwards compatibility with old GSI-enabled SSH daemons that didn't handle

empty username strings per the draft specification; the client will now
only send an empty username string if the server is new enough to handle it

diff --git a/openssh/compat.c b/openssh/compat.c
index 638f08209340055bb02b6956815ed53eef1155d6..e8a89cd38e5571280e49de137893d0999516b0b3 100644 (file)
--- a/openssh/compat.c
+++ b/openssh/compat.c
@@ -81,7 +81,7 @@ compat_datafellows(const char *version)
                { "OpenSSH_2.9p*",      SSH_OLD_GSSAPI },
                { "OpenSSH_2.*,"
                  "OpenSSH_3.0*,"
-                 "OpenSSH_3.1*",       SSH_BUG_EXTEOF},
+                 "OpenSSH_3.1*",       SSH_BUG_EXTEOF|SSH_BUG_GSS_EMPTYUSER},
                { "Sun_SSH_1.0*",       SSH_BUG_NOREKEY|SSH_BUG_EXTEOF},
                { "OpenSSH*",           0 },
                { "*MindTerm*",         0 },

diff --git a/openssh/compat.h b/openssh/compat.h
index cebf306e2db1ddca9729e9fb51ad8dbf7f382e01..98a8adfbe4b19a5cc0ab493b58a9bce7878af243 100644 (file)
--- a/openssh/compat.h
+++ b/openssh/compat.h
@@ -55,6 +55,7 @@
 #define SSH_BUG_EXTEOF         0x00200000
 #define SSH_BUG_K5USER         0x00400000
 #define SSH_OLD_GSSAPI         0x00800000
+#define SSH_BUG_GSS_EMPTYUSER  0x01000000
 
 void     enable_compat13(void);
 void     enable_compat20(void);

diff --git a/openssh/sshconnect2.c b/openssh/sshconnect2.c
index 9bba4daeea592cd5d368ac36ce3b8395b292778f..79d4980693c5acdd32ee7b7d51e073f2bfe115a6 100644 (file)
--- a/openssh/sshconnect2.c
+++ b/openssh/sshconnect2.c
@@ -515,8 +515,11 @@ userauth_gssapi(Authctxt *authctxt)
        authctxt->methoddata=(void *)gssctxt;
                
        packet_start(SSH2_MSG_USERAUTH_REQUEST);
-        if(options.implicit) packet_put_cstring("");
-        else packet_put_cstring(authctxt->server_user);
+        if(options.implicit && !(datafellows & SSH_BUG_GSS_EMPTYUSER)) {
+           packet_put_cstring("");
+       } else {
+           packet_put_cstring(authctxt->server_user);
+       }
        packet_put_cstring(authctxt->service);
         packet_put_cstring(authctxt->method->name);
 
@@ -627,8 +630,11 @@ userauth_external(Authctxt *authctxt)
                                 
         debug2("userauth_external");
         packet_start(SSH2_MSG_USERAUTH_REQUEST);
-       if(options.implicit) packet_put_cstring(""); 
-        else packet_put_cstring(authctxt->server_user);
+        if(options.implicit && !(datafellows & SSH_BUG_GSS_EMPTYUSER)) {
+           packet_put_cstring("");
+       } else {
+           packet_put_cstring(authctxt->server_user);
+       }
         packet_put_cstring(authctxt->service);
         packet_put_cstring(authctxt->method->name);
         packet_send();