id_filename_matches(Identity *id, Identity *private_id)

{

	const char *suffixes[] = { ".pub", "-cert.pub", NULL };

	size_t len = strlen(id->filename), plen = strlen(private_id->filename);

	size_t i, slen;

	if (strcmp(id->filename, private_id->filename) == 0)

		return 1;

	for (i = 0; suffixes[i]; i++) {

		slen = strlen(suffixes[i]);

		if (len > slen && plen == len - slen &&

		    strcmp(id->filename + (len - slen), suffixes[i]) == 0 &&

		    memcmp(id->filename, private_id->filename, plen) == 0)

			return 1;

	}

	return 0;

}

static int

		/*

		 * Exact key matches are preferred, but also allow

		 * filename matches for non-PKCS#11/agent keys that

		 * didn't load public keys. This supports the case

		 * of keeping just a private key file and public

		 * certificate on disk.

		 */

		if (!matched && !id->isprivate && id->agent_fd == -1 &&

		    (id->key->flags & SSHKEY_FLAG_EXT) == 0) {

			TAILQ_FOREACH(private_id, &authctxt->keys, next) {

				if (private_id->key == NULL &&

				    id_filename_matches(id, private_id)) {

					id = private_id;

					matched = 1;

					break;

				}

			}

		}