1 files changed, 15 insertions, 3 deletions

diff --git a/sshconnect2.c b/sshconnect2.c
index 34b9d304e..d534e6190 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.247 2016/07/22 05:46:11 dtucker Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.251 2016/12/04 23:54:02 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -370,6 +370,7 @@ void	userauth(Authctxt *, char *);
 static int sign_and_send_pubkey(Authctxt *, Identity *);
 static void pubkey_prepare(Authctxt *);
 static void pubkey_cleanup(Authctxt *);
+static void pubkey_reset(Authctxt *);
 static Key *load_identity_file(Identity *);
 
 static Authmethod *authmethod_get(char *authlist);
@@ -461,6 +462,8 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
         pubkey_cleanup(&authctxt);
         ssh_dispatch_range(ssh, SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
 
+        if (!authctxt.success)
+                fatal("Authentication failed.");
         debug("Authentication succeeded (%s).", authctxt.method->name);
 }
 
@@ -615,8 +618,7 @@ input_userauth_failure(int type, u_int32_t seq, void *ctxt)
         if (partial != 0) {
                 verbose("Authenticated with partial success.");
                 /* reset state */
-                pubkey_cleanup(authctxt);
-                pubkey_prepare(authctxt);
+                pubkey_reset(authctxt);
         }
         debug("Authentications that can continue: %s", authlist);
 
@@ -1526,6 +1528,15 @@ pubkey_cleanup(Authctxt *authctxt)
         }
 }
 
+static void
+pubkey_reset(Authctxt *authctxt)
+{
+        Identity *id;
+
+        TAILQ_FOREACH(id, &authctxt->keys, next)
+                id->tried = 0;
+}
+
 static int
 try_identity(Identity *id)
 {
@@ -1574,6 +1585,7 @@ userauth_pubkey(Authctxt *authctxt)
                                 }
                                 key_free(id->key);
                                 id->key = NULL;
+                                id->isprivate = 0;
                         }
                 }
                 if (sent)