- (djm) Fix rsh path in RPMs. Report from Jason L Tibbitts III

[openssh.git] / auth-rsa.c

diff --git a/auth-rsa.c b/auth-rsa.c
index d7deabf2957cd01a409af9d0bbd826be25adb3f7..35fff1fda2d43d9027af92cf6513654301b04961 100644 (file)
--- a/auth-rsa.c
+++ b/auth-rsa.c
@@ -133,6 +133,7 @@ auth_rsa(struct passwd *pw, BIGNUM *client_n)
        unsigned long linenum = 0;
        struct stat st;
        RSA *pk;
+       int mname, mip;
 
        /* Temporarily use the user's uid. */
        temporarily_use_uid(pw->pw_uid);
@@ -390,10 +391,17 @@ auth_rsa(struct passwd *pw, BIGNUM *client_n)
                                        }
                                        patterns[i] = 0;
                                        options++;
-                                       if (!match_hostname(get_canonical_hostname(), patterns,
-                                                    strlen(patterns)) &&
-                                           !match_hostname(get_remote_ipaddr(), patterns,
-                                                    strlen(patterns))) {
+                                       /*
+                                        * Deny access if we get a negative
+                                        * match for the hostname or the ip
+                                        * or if we get not match at all
+                                        */
+                                       mname = match_hostname(get_canonical_hostname(),
+                                           patterns, strlen(patterns));
+                                       mip = match_hostname(get_remote_ipaddr(),
+                                           patterns, strlen(patterns));
+                                       if (mname == -1 || mip == -1 ||
+                                           (mname != 1 && mip != 1)) {
                                                log("RSA authentication tried for %.100s with correct key but not from a permitted host (host=%.200s, ip=%.200s).",
                                                    pw->pw_name, get_canonical_hostname(),
                                                    get_remote_ipaddr());