1 files changed, 39 insertions, 31 deletions

diff --git a/auth-rsa.c b/auth-rsa.c
index 4edaab056..4ab46cd51 100644
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-rsa.c,v 1.79 2010/12/03 23:55:27 djm Exp $ */
+/* $OpenBSD: auth-rsa.c,v 1.80 2011/05/23 03:30:07 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -160,44 +160,27 @@ auth_rsa_challenge_dialog(Key *key)
         return (success);
 }
 
-/*
- * check if there's user key matching client_n,
- * return key if login is allowed, NULL otherwise
- */
-
-int
-auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
+static int
+rsa_key_allowed_in_file(struct passwd *pw, char *file,
+    const BIGNUM *client_n, Key **rkey)
 {
-        char line[SSH_MAX_PUBKEY_BYTES], *file;
+        char line[SSH_MAX_PUBKEY_BYTES];
         int allowed = 0;
         u_int bits;
         FILE *f;
         u_long linenum = 0;
         Key *key;
 
-        /* Temporarily use the user's uid. */
-        temporarily_use_uid(pw);
-
-        /* The authorized keys. */
-        file = authorized_keys_file(pw);
         debug("trying public RSA key file %s", file);
-        f = auth_openkeyfile(file, pw, options.strict_modes);
-        if (!f) {
-                xfree(file);
-                restore_uid();
-                return (0);
-        }
-
-        /* Flag indicating whether the key is allowed. */
-        allowed = 0;
-
-        key = key_new(KEY_RSA1);
+        if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL)
+                return 0;
 
         /*
          * Go though the accepted keys, looking for the current key.  If
          * found, perform a challenge-response dialog to verify that the
          * user really has the corresponding private key.
          */
+        key = key_new(KEY_RSA1);
         while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
                 char *cp;
                 char *key_options;
@@ -235,7 +218,10 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 }
                 /* cp now points to the comment part. */
 
-                /* Check if the we have found the desired key (identified by its modulus). */
+                /*
+                 * Check if the we have found the desired key (identified
+                 * by its modulus).
+                 */
                 if (BN_cmp(key->rsa->n, client_n) != 0)
                         continue;
 
@@ -264,11 +250,7 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 break;
         }
 
-        /* Restore the privileged uid. */
-        restore_uid();
-
         /* Close the file. */
-        xfree(file);
         fclose(f);
 
         /* return key if allowed */
@@ -276,7 +258,33 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
                 *rkey = key;
         else
                 key_free(key);
-        return (allowed);
+
+        return allowed;
+}
+
+/*
+ * check if there's user key matching client_n,
+ * return key if login is allowed, NULL otherwise
+ */
+
+int
+auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
+{
+        char *file;
+        u_int i, allowed = 0;
+
+        temporarily_use_uid(pw);
+
+        for (i = 0; !allowed && i < options.num_authkeys_files; i++) {
+                file = expand_authorized_keys(
+                    options.authorized_keys_files[i], pw);
+                allowed = rsa_key_allowed_in_file(pw, file, client_n, rkey);
+                xfree(file);
+        }
+
+        restore_uid();
+
+        return allowed;
 }
 
 /*