fix match_hostname() logic for auth-rsa: deny access if we have a negative match or no match at all

1 files changed, 6 insertions, 6 deletions

diff --git a/usr.bin/ssh/match.c b/usr.bin/ssh/match.c
index 00dff8a8613..201e7870a9d 100644
--- a/usr.bin/ssh/match.c
+++ b/usr.bin/ssh/match.c
@@ -14,7 +14,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: match.c,v 1.6 2000/04/14 10:30:31 markus Exp $");
+RCSID("$Id: match.c,v 1.7 2000/06/06 19:32:14 markus Exp $");
 
 #include "ssh.h"
 
@@ -84,8 +84,8 @@ match_pattern(const char *s, const char *pattern)
 /*
  * Tries to match the host name (which must be in all lowercase) against the
  * comma-separated sequence of subpatterns (each possibly preceded by ! to
- * indicate negation).  Returns true if there is a positive match; zero
- * otherwise.
+ * indicate negation).  Returns -1 if negation matches, 1 if there is
+ * a positive match, 0 if there is no match at all.
  */
 
 int
@@ -127,15 +127,15 @@ match_hostname(const char *host, const char *pattern, unsigned int len)
 		/* Try to match the subpattern against the host name. */
 		if (match_pattern(host, sub)) {
 			if (negated)
-				return 0;	/* Fail */
+				return -1;		/* Negative */
 			else
-				got_positive = 1;
+				got_positive = 1;	/* Positive */
 		}
 	}
 
 	/*
 	 * Return success if got a positive match.  If there was a negative
-	 * match, we have already returned zero and never get here.
+	 * match, we have already returned -1 and never get here.
 	 */
 	return got_positive;
 }