upstream: switch over to the new authorized_keys options API and

remove the legacy one.

Includes a fairly big refactor of auth2-pubkey.c to retain less state
between key file lines.

feedback and ok markus@

OpenBSD-Commit-ID: dece6cae0f47751b9892080eb13d6625599573df

1 files changed, 2 insertions, 2 deletions

diff --git a/auth-pam.c b/auth-pam.c
index de29c04c9..50d2073d7 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -1077,7 +1077,7 @@ do_pam_chauthtok(void)
 }
 
 void
-do_pam_session(void)
+do_pam_session(struct ssh *ssh)
 {
         debug3("PAM: opening session");
 
@@ -1093,7 +1093,7 @@ do_pam_session(void)
                 sshpam_session_open = 1;
         else {
                 sshpam_session_open = 0;
-                disable_forwarding();
+                auth_restrict_session(ssh);
                 error("PAM: pam_open_session(): %s",
                     pam_strerror(sshpam_handle, sshpam_err));
         }