#! /bin/sh /usr/share/dpatch/dpatch-run
## 05_pattern_keyfiles.dpatch by Javier Serrano Polo <jasp00@terra.es>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: Names in keyfiles option are treated like shell patterns.

@DPATCH@
--- libpam-ssh-1.91.0.orig/pam_ssh.c	2008-04-22 07:35:07.000000000 +0200
+++ libpam-ssh-1.91.0/pam_ssh.c	2008-04-22 07:38:44.000000000 +0200
@@ -54,8 +54,10 @@
 # define WIFSIGNALED(x)	(WTERMSIG(x) != _WSTOPPED && WTERMSIG(x) != 0)
 #endif
 
+#include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
+#include <fnmatch.h>
 #include <pwd.h>
 #include <signal.h>
 #include <stdio.h>
@@ -629,10 +631,28 @@
 		return PAM_SERVICE_ERR;
 	}
 	for (file = strtok(keyfiles, SEP_KEYFILES); file;
-	     file = strtok(NULL, SEP_KEYFILES))
-		if (auth_via_key(pamh, file, dotdir, pwent, pass,
-                    allow_blank_passphrase) == PAM_SUCCESS)
-			authenticated = 1;
+	     file = strtok(NULL, SEP_KEYFILES)) {
+		struct dirent **namelist;
+		int n;
+
+		int filter(const struct dirent *d) {
+			return !fnmatch(file, d->d_name, 0);
+		}
+
+		n = scandir(dotdir, &namelist, filter, alphasort);
+		if (n == -1) {
+			pam_ssh_log(LOG_CRIT, "out of memory");
+			openpam_restore_cred(pamh);
+			return PAM_SERVICE_ERR;
+		}
+		while (n--) {
+			if (auth_via_key(pamh, namelist[n]->d_name, dotdir,
+                            pwent, pass, allow_blank_passphrase) == PAM_SUCCESS)
+				authenticated = 1;
+			free(namelist[n]);
+		}
+		free(namelist);
+	}
 	free(dotdir);
 	free(keyfiles);
 	if (!authenticated) {