It's not legal to free a coroutine's state structure before invoking
[u/mdw/putty] / ssh.c
diff --git a/ssh.c b/ssh.c
index 7aec791..ad9ccae 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -439,6 +439,8 @@ enum {
 #define crState(t)     crStateP(t, ssh->t)
 #define crFinish(z)    } *crLine = 0; return (z); }
 #define crFinishV      } *crLine = 0; return; }
+#define crFinishFree(z, s)     } *crLine = 0; sfree(s); return (z); }
+#define crFinishFreeV(s)       } *crLine = 0; sfree(s); return; }
 #define crReturn(z)    \
        do {\
            *crLine =__LINE__; return (z); case __LINE__:;\
@@ -4244,6 +4246,7 @@ static void ssh_channel_try_eof(struct ssh_channel *c)
     if (ssh->version == 2 && bufchain_size(&c->v.v2.outbuffer) > 0)
         return;              /* can't send EOF: pending outgoing data */
 
+    c->pending_eof = FALSE;            /* we're about to send it */
     if (ssh->version == 1) {
         send_packet(ssh, SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
                     PKT_END);
@@ -4254,17 +4257,8 @@ static void ssh_channel_try_eof(struct ssh_channel *c)
         ssh2_pkt_adduint32(pktout, c->remoteid);
         ssh2_pkt_send(ssh, pktout);
         c->closes |= CLOSES_SENT_EOF;
-        if (!((CLOSES_SENT_EOF | CLOSES_RCVD_EOF) & ~c->closes)) {
-            /*
-             * Also send MSG_CLOSE.
-             */
-            pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
-            ssh2_pkt_adduint32(pktout, c->remoteid);
-            ssh2_pkt_send(ssh, pktout);
-            c->closes |= CLOSES_SENT_CLOSE;
-        }
+       ssh2_channel_check_close(c);
     }
-    c->pending_eof = FALSE;            /* we've sent it now */
 }
 
 void sshfwd_write_eof(struct ssh_channel *c)
@@ -6599,6 +6593,7 @@ static void ssh2_queue_chanreq_handler(struct ssh_channel *c,
     struct outstanding_channel_request *ocr =
        snew(struct outstanding_channel_request);
 
+    assert(!(c->closes & (CLOSES_SENT_CLOSE | CLOSES_RCVD_CLOSE)));
     ocr->handler = handler;
     ocr->ctx = ctx;
     ocr->next = NULL;
@@ -6610,6 +6605,33 @@ static void ssh2_queue_chanreq_handler(struct ssh_channel *c,
 }
 
 /*
+ * Construct the common parts of a CHANNEL_REQUEST.  If handler is not
+ * NULL then a reply will be requested and the handler will be called
+ * when it arrives.  The returned packet is ready to have any
+ * request-specific data added and be sent.  Note that if a handler is
+ * provided, it's essential that the request actually be sent.
+ *
+ * The handler will usually be passed the response packet in pktin.
+ * If pktin is NULL, this means that no reply will ever be forthcoming
+ * (e.g. because the entire connection is being destroyed) and the
+ * handler should free any storage it's holding.
+ */
+static struct Packet *ssh2_chanreq_init(struct ssh_channel *c, char *type,
+                                       cchandler_fn_t handler, void *ctx)
+{
+    struct Packet *pktout;
+
+    assert(!(c->closes & (CLOSES_SENT_CLOSE | CLOSES_RCVD_CLOSE)));
+    pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
+    ssh2_pkt_adduint32(pktout, c->remoteid);
+    ssh2_pkt_addstring(pktout, type);
+    ssh2_pkt_addbool(pktout, handler != NULL);
+    if (handler != NULL)
+       ssh2_queue_chanreq_handler(c, handler, ctx);
+    return pktout;
+}
+
+/*
  * Potentially enlarge the window on an SSH-2 channel.
  */
 static void ssh2_handle_winadj_response(struct ssh_channel *, struct Packet *,
@@ -6658,15 +6680,12 @@ static void ssh2_set_window(struct ssh_channel *c, int newwin)
         */
        if (newwin == c->v.v2.locmaxwin &&
             !(ssh->remote_bugs & BUG_CHOKES_ON_WINADJ)) {
-           pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-           ssh2_pkt_adduint32(pktout, c->remoteid);
-           ssh2_pkt_addstring(pktout, "winadj@putty.projects.tartarus.org");
-           ssh2_pkt_addbool(pktout, TRUE);
-           ssh2_pkt_send(ssh, pktout);
-
            up = snew(unsigned);
            *up = newwin - c->v.v2.locwindow;
-           ssh2_queue_chanreq_handler(c, ssh2_handle_winadj_response, up);
+           pktout = ssh2_chanreq_init(c, "winadj@putty.projects.tartarus.org",
+                                      ssh2_handle_winadj_response, up);
+           ssh2_pkt_send(ssh, pktout);
+
            if (c->v.v2.throttle_state != UNTHROTTLED)
                c->v.v2.throttle_state = UNTHROTTLING;
        } else {
@@ -6893,8 +6912,10 @@ static void ssh_channel_destroy(struct ssh_channel *c)
     }
 
     del234(ssh->channels, c);
-    if (ssh->version == 2)
+    if (ssh->version == 2) {
         bufchain_clear(&c->v.v2.outbuffer);
+       assert(c->v.v2.chanreq_head == NULL);
+    }
     sfree(c);
 
     /*
@@ -6929,7 +6950,7 @@ static void ssh2_channel_check_close(struct ssh_channel *c)
         == (CLOSES_SENT_EOF | CLOSES_RCVD_EOF) && !c->v.v2.chanreq_head) {
         /*
          * We have both sent and received EOF, and we have no
-         * outstanding winadj channel requests, which means the
+         * outstanding channel requests, which means the
          * channel is in final wind-up. But we haven't sent CLOSE, so
          * let's do so now.
          */
@@ -6940,6 +6961,7 @@ static void ssh2_channel_check_close(struct ssh_channel *c)
     }
 
     if (!((CLOSES_SENT_CLOSE | CLOSES_RCVD_CLOSE) & ~c->closes)) {
+       assert(c->v.v2.chanreq_head == NULL);
         /*
          * We have both sent and received CLOSE, which means we're
          * completely done with the channel.
@@ -7447,6 +7469,203 @@ static void ssh2_send_ttymode(void *data, char *mode, char *val)
     ssh2_pkt_adduint32(pktout, arg);
 }
 
+static void ssh2_maybe_setup_x11(struct ssh_channel *c, struct Packet *pktin,
+                                void *ctx)
+{
+    struct ssh2_maybe_setup_x11_state {
+       int crLine;
+    };
+    Ssh ssh = c->ssh;
+    struct Packet *pktout;
+    crStateP(ssh2_maybe_setup_x11_state, ctx);
+
+    crBeginState;
+
+    /*
+     * Potentially enable X11 forwarding.
+     */
+    if (ssh->mainchan && !ssh->ncmode && conf_get_int(ssh->conf, CONF_x11_forward) &&
+       (ssh->x11disp = x11_setup_display(conf_get_str(ssh->conf, CONF_x11_display),
+                                         conf_get_int(ssh->conf, CONF_x11_auth), ssh->conf))) {
+       logevent("Requesting X11 forwarding");
+       pktout = ssh2_chanreq_init(ssh->mainchan, "x11-req",
+                                  ssh2_maybe_setup_x11, s);
+       ssh2_pkt_addbool(pktout, 0);           /* many connections */
+       ssh2_pkt_addstring(pktout, ssh->x11disp->remoteauthprotoname);
+       /*
+        * Note that while we blank the X authentication data here, we don't
+        * take any special action to blank the start of an X11 channel,
+        * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
+        * without having session blanking enabled is likely to leak your
+        * cookie into the log.
+        */
+       dont_log_password(ssh, pktout, PKTLOG_BLANK);
+       ssh2_pkt_addstring(pktout, ssh->x11disp->remoteauthdatastring);
+       end_log_omission(ssh, pktout);
+       ssh2_pkt_adduint32(pktout, ssh->x11disp->screennum);
+       ssh2_pkt_send(ssh, pktout);
+
+       crWaitUntilV(pktin);
+
+       if (pktin) {
+           if (pktin->type == SSH2_MSG_CHANNEL_SUCCESS) {
+               logevent("X11 forwarding enabled");
+               ssh->X11_fwd_enabled = TRUE;
+           } else
+               logevent("X11 forwarding refused");
+       }
+    }
+    crFinishFreeV(s);
+}
+
+static void ssh2_maybe_setup_agent(struct ssh_channel *c, struct Packet *pktin,
+                                  void *ctx)
+{
+    struct ssh2_maybe_setup_agent_state {
+       int crLine;
+    };
+    Ssh ssh = c->ssh;
+    struct Packet *pktout;
+    crStateP(ssh2_maybe_setup_agent_state, ctx);
+
+    crBeginState;
+
+    if (ssh->mainchan && !ssh->ncmode && conf_get_int(ssh->conf, CONF_agentfwd) && agent_exists()) {
+       logevent("Requesting OpenSSH-style agent forwarding");
+       pktout = ssh2_chanreq_init(ssh->mainchan, "auth-agent-req@openssh.com",
+                                  ssh2_maybe_setup_agent, s);
+       ssh2_pkt_send(ssh, pktout);
+
+       crWaitUntilV(pktin);
+
+       if (pktin) {
+           if (pktin->type == SSH2_MSG_CHANNEL_SUCCESS) {
+               logevent("Agent forwarding enabled");
+               ssh->agentfwd_enabled = TRUE;
+           } else
+               logevent("Agent forwarding refused");
+       }
+    }
+    crFinishFreeV(s);
+}
+
+static void ssh2_maybe_setup_pty(struct ssh_channel *c, struct Packet *pktin,
+                                void *ctx)
+{
+    struct ssh2_maybe_setup_pty_state {
+       int crLine;
+    };
+    Ssh ssh = c->ssh;
+    struct Packet *pktout;
+    crStateP(ssh2_maybe_setup_pty_state, ctx);
+
+    crBeginState;
+
+    if (ssh->mainchan && !ssh->ncmode && !conf_get_int(ssh->conf, CONF_nopty)) {
+       /* Unpick the terminal-speed string. */
+       /* XXX perhaps we should allow no speeds to be sent. */
+        ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
+       sscanf(conf_get_str(ssh->conf, CONF_termspeed), "%d,%d", &ssh->ospeed, &ssh->ispeed);
+       /* Build the pty request. */
+       pktout = ssh2_chanreq_init(ssh->mainchan, "pty-req",
+                                  ssh2_maybe_setup_pty, s);
+       ssh2_pkt_addstring(pktout, conf_get_str(ssh->conf, CONF_termtype));
+       ssh2_pkt_adduint32(pktout, ssh->term_width);
+       ssh2_pkt_adduint32(pktout, ssh->term_height);
+       ssh2_pkt_adduint32(pktout, 0);         /* pixel width */
+       ssh2_pkt_adduint32(pktout, 0);         /* pixel height */
+       ssh2_pkt_addstring_start(pktout);
+       parse_ttymodes(ssh, ssh2_send_ttymode, (void *)pktout);
+       ssh2_pkt_addbyte(pktout, SSH2_TTY_OP_ISPEED);
+       ssh2_pkt_adduint32(pktout, ssh->ispeed);
+       ssh2_pkt_addbyte(pktout, SSH2_TTY_OP_OSPEED);
+       ssh2_pkt_adduint32(pktout, ssh->ospeed);
+       ssh2_pkt_addstring_data(pktout, "\0", 1); /* TTY_OP_END */
+       ssh2_pkt_send(ssh, pktout);
+       ssh->state = SSH_STATE_INTERMED;
+
+       crWaitUntilV(pktin);
+
+       if (pktin) {
+           if (pktin->type == SSH2_MSG_CHANNEL_SUCCESS) {
+               logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
+                         ssh->ospeed, ssh->ispeed);
+               ssh->got_pty = TRUE;
+           } else {
+               c_write_str(ssh, "Server refused to allocate pty\r\n");
+               ssh->editing = ssh->echoing = 1;
+           }
+       }
+    } else {
+       ssh->editing = ssh->echoing = 1;
+    }
+    crFinishFreeV(s);
+}
+
+static void ssh2_setup_env(struct ssh_channel *c, struct Packet *pktin,
+                          void *ctx)
+{
+    struct ssh2_setup_env_state {
+       int crLine;
+       int num_env, env_left, env_ok;
+    };
+    Ssh ssh = c->ssh;
+    struct Packet *pktout;
+    crStateP(ssh2_setup_env_state, ctx);
+
+    crBeginState;
+
+    /*
+     * Send environment variables.
+     * 
+     * Simplest thing here is to send all the requests at once, and
+     * then wait for a whole bunch of successes or failures.
+     */
+    s->num_env = 0;
+    if (ssh->mainchan && !ssh->ncmode) {
+       char *key, *val;
+
+       for (val = conf_get_str_strs(ssh->conf, CONF_environmt, NULL, &key);
+            val != NULL;
+            val = conf_get_str_strs(ssh->conf, CONF_environmt, key, &key)) {
+           pktout = ssh2_chanreq_init(ssh->mainchan, "env", ssh2_setup_env, s);
+           ssh2_pkt_addstring(pktout, key);
+           ssh2_pkt_addstring(pktout, val);
+           ssh2_pkt_send(ssh, pktout);
+
+           s->num_env++;
+       }
+       if (s->num_env)
+           logeventf(ssh, "Sent %d environment variables", s->num_env);
+    }
+
+    if (s->num_env) {
+       s->env_ok = 0;
+       s->env_left = s->num_env;
+
+       while (s->env_left > 0) {
+           crWaitUntilV(pktin);
+           if (!pktin) goto out;
+           if (pktin->type == SSH2_MSG_CHANNEL_SUCCESS)
+               s->env_ok++;
+           s->env_left--;
+       }
+
+       if (s->env_ok == s->num_env) {
+           logevent("All environment variables successfully set");
+       } else if (s->env_ok == 0) {
+           logevent("All environment variables refused");
+           c_write_str(ssh, "Server refused to set environment variables\r\n");
+       } else {
+           logeventf(ssh, "%d environment variables refused",
+                     s->num_env - s->env_ok);
+           c_write_str(ssh, "Server refused to set all environment variables\r\n");
+       }
+    }
+  out:;
+    crFinishFreeV(s);
+}
+
 /*
  * Handle the SSH-2 userauth and connection layers.
  */
@@ -7455,6 +7674,12 @@ static void ssh2_msg_authconn(Ssh ssh, struct Packet *pktin)
     do_ssh2_authconn(ssh, NULL, 0, pktin);
 }
 
+static void ssh2_response_authconn(struct ssh_channel *c, struct Packet *pktin,
+                                  void *ctx)
+{
+    do_ssh2_authconn(c->ssh, NULL, 0, pktin);
+}
+
 static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
                             struct Packet *pktin)
 {
@@ -7498,10 +7723,6 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
        int siglen, retlen, len;
        char *q, *agentreq, *ret;
        int try_send;
-       int requested_x11;
-       int requested_agent;
-       int requested_tty;
-       int num_env, env_left, env_ok;
        struct Packet *pktout;
        Filename *keyfile;
 #ifndef NO_GSSAPI
@@ -7538,9 +7759,6 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
     ssh->packet_dispatch[SSH2_MSG_CHANNEL_EXTENDED_DATA] = ssh2_msg_authconn;
     ssh->packet_dispatch[SSH2_MSG_CHANNEL_EOF] = ssh2_msg_authconn;
     ssh->packet_dispatch[SSH2_MSG_CHANNEL_CLOSE] = ssh2_msg_authconn;
-    ssh->packet_dispatch[SSH2_MSG_CHANNEL_REQUEST] = ssh2_msg_authconn;
-    ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = ssh2_msg_authconn;
-    ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = ssh2_msg_authconn;
     
     s->done_service_req = FALSE;
     s->we_are_in = s->userauth_success = FALSE;
@@ -8997,6 +9215,9 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
        ssh2_msg_channel_request;
     ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
        ssh2_msg_channel_open;
+    ssh->packet_dispatch[SSH2_MSG_CHANNEL_SUCCESS] = ssh2_msg_channel_response;
+    ssh->packet_dispatch[SSH2_MSG_CHANNEL_FAILURE] = ssh2_msg_channel_response;
+
 
     if (ssh->mainchan && conf_get_int(ssh->conf, CONF_ssh_simple)) {
        /*
@@ -9005,10 +9226,9 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
         * this one, so it's safe for it to advertise a very large
         * window and leave the flow control to TCP.
         */
-       s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-       ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
-       ssh2_pkt_addstring(s->pktout, "simple@putty.projects.tartarus.org");
-       ssh2_pkt_addbool(s->pktout, 0); /* no reply */
+       s->pktout = ssh2_chanreq_init(ssh->mainchan,
+                                     "simple@putty.projects.tartarus.org",
+                                     NULL, NULL);
        ssh2_pkt_send(ssh, s->pktout);
     }
 
@@ -9018,200 +9238,29 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
     ssh_setup_portfwd(ssh, ssh->conf);
 
     /*
-     * Send the CHANNEL_REQUESTS for the main channel.  We send them all
-     * and then start looking for responses, so it's important that the
-     * sending and receiving code below it is kept in sync.
+     * Send the CHANNEL_REQUESTS for the main channel.  Each one is
+     * handled by its own little asynchronous co-routine.
      */
 
     /*
      * Potentially enable X11 forwarding.
      */
-    if (ssh->mainchan && !ssh->ncmode && conf_get_int(ssh->conf, CONF_x11_forward) &&
-       (ssh->x11disp = x11_setup_display(conf_get_str(ssh->conf, CONF_x11_display),
-                                         conf_get_int(ssh->conf, CONF_x11_auth), ssh->conf))) {
-       logevent("Requesting X11 forwarding");
-       s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-       ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
-       ssh2_pkt_addstring(s->pktout, "x11-req");
-       ssh2_pkt_addbool(s->pktout, 1);        /* want reply */
-       ssh2_pkt_addbool(s->pktout, 0);        /* many connections */
-       ssh2_pkt_addstring(s->pktout, ssh->x11disp->remoteauthprotoname);
-       /*
-        * Note that while we blank the X authentication data here, we don't
-        * take any special action to blank the start of an X11 channel,
-        * so using MIT-MAGIC-COOKIE-1 and actually opening an X connection
-        * without having session blanking enabled is likely to leak your
-        * cookie into the log.
-        */
-       dont_log_password(ssh, s->pktout, PKTLOG_BLANK);
-       ssh2_pkt_addstring(s->pktout, ssh->x11disp->remoteauthdatastring);
-       end_log_omission(ssh, s->pktout);
-       ssh2_pkt_adduint32(s->pktout, ssh->x11disp->screennum);
-       ssh2_pkt_send(ssh, s->pktout);
-       s->requested_x11 = TRUE;
-    } else
-       s->requested_x11 = FALSE;
+    ssh2_maybe_setup_x11(ssh->mainchan, NULL, NULL);
 
     /*
      * Potentially enable agent forwarding.
      */
-    if (ssh->mainchan && !ssh->ncmode && conf_get_int(ssh->conf, CONF_agentfwd) && agent_exists()) {
-       logevent("Requesting OpenSSH-style agent forwarding");
-       s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-       ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
-       ssh2_pkt_addstring(s->pktout, "auth-agent-req@openssh.com");
-       ssh2_pkt_addbool(s->pktout, 1);        /* want reply */
-       ssh2_pkt_send(ssh, s->pktout);
-       s->requested_agent = TRUE;
-    } else
-       s->requested_agent = FALSE;
+    ssh2_maybe_setup_agent(ssh->mainchan, NULL, NULL);
 
     /*
      * Now allocate a pty for the session.
      */
-    if (ssh->mainchan && !ssh->ncmode && !conf_get_int(ssh->conf, CONF_nopty)) {
-       /* Unpick the terminal-speed string. */
-       /* XXX perhaps we should allow no speeds to be sent. */
-        ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
-       sscanf(conf_get_str(ssh->conf, CONF_termspeed), "%d,%d", &ssh->ospeed, &ssh->ispeed);
-       /* Build the pty request. */
-       s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-       ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
-       ssh2_pkt_addstring(s->pktout, "pty-req");
-       ssh2_pkt_addbool(s->pktout, 1);        /* want reply */
-       ssh2_pkt_addstring(s->pktout, conf_get_str(ssh->conf, CONF_termtype));
-       ssh2_pkt_adduint32(s->pktout, ssh->term_width);
-       ssh2_pkt_adduint32(s->pktout, ssh->term_height);
-       ssh2_pkt_adduint32(s->pktout, 0);              /* pixel width */
-       ssh2_pkt_adduint32(s->pktout, 0);              /* pixel height */
-       ssh2_pkt_addstring_start(s->pktout);
-       parse_ttymodes(ssh, ssh2_send_ttymode, (void *)s->pktout);
-       ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_ISPEED);
-       ssh2_pkt_adduint32(s->pktout, ssh->ispeed);
-       ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_OSPEED);
-       ssh2_pkt_adduint32(s->pktout, ssh->ospeed);
-       ssh2_pkt_addstring_data(s->pktout, "\0", 1); /* TTY_OP_END */
-       ssh2_pkt_send(ssh, s->pktout);
-       ssh->state = SSH_STATE_INTERMED;
-       s->requested_tty = TRUE;
-    } else
-       s->requested_tty = FALSE;
+    ssh2_maybe_setup_pty(ssh->mainchan, NULL, NULL);
 
     /*
      * Send environment variables.
-     * 
-     * Simplest thing here is to send all the requests at once, and
-     * then wait for a whole bunch of successes or failures.
      */
-    s->num_env = 0;
-    if (ssh->mainchan && !ssh->ncmode) {
-       char *key, *val;
-
-       for (val = conf_get_str_strs(ssh->conf, CONF_environmt, NULL, &key);
-            val != NULL;
-            val = conf_get_str_strs(ssh->conf, CONF_environmt, key, &key)) {
-           s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-           ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
-           ssh2_pkt_addstring(s->pktout, "env");
-           ssh2_pkt_addbool(s->pktout, 1);            /* want reply */
-           ssh2_pkt_addstring(s->pktout, key);
-           ssh2_pkt_addstring(s->pktout, val);
-           ssh2_pkt_send(ssh, s->pktout);
-
-           s->num_env++;
-       }
-       if (s->num_env)
-           logeventf(ssh, "Sent %d environment variables", s->num_env);
-    }
-
-    /*
-     * All CHANNEL_REQUESTs sent.  Now collect up the replies.  These
-     * must be in precisely the same order as the requests.
-     */
-
-    if (s->requested_x11) {
-       crWaitUntilV(pktin);
-
-       if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
-           if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
-               bombout(("Unexpected response to X11 forwarding request:"
-                        " packet type %d", pktin->type));
-               crStopV;
-           }
-           logevent("X11 forwarding refused");
-       } else {
-           logevent("X11 forwarding enabled");
-           ssh->X11_fwd_enabled = TRUE;
-       }
-    }
-
-    if (s->requested_agent) {
-       crWaitUntilV(pktin);
-
-       if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
-           if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
-               bombout(("Unexpected response to agent forwarding request:"
-                        " packet type %d", pktin->type));
-               crStopV;
-           }
-           logevent("Agent forwarding refused");
-       } else {
-           logevent("Agent forwarding enabled");
-           ssh->agentfwd_enabled = TRUE;
-       }
-    }
-
-    if (s->requested_tty) {
-       crWaitUntilV(pktin);
-
-       if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
-           if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
-               bombout(("Unexpected response to pty request:"
-                        " packet type %d", pktin->type));
-               crStopV;
-           }
-           c_write_str(ssh, "Server refused to allocate pty\r\n");
-           ssh->editing = ssh->echoing = 1;
-       } else {
-           logeventf(ssh, "Allocated pty (ospeed %dbps, ispeed %dbps)",
-                     ssh->ospeed, ssh->ispeed);
-            ssh->got_pty = TRUE;
-       }
-    } else {
-       ssh->editing = ssh->echoing = 1;
-    }
-
-    if (s->num_env) {
-       s->env_ok = 0;
-       s->env_left = s->num_env;
-
-       while (s->env_left > 0) {
-           crWaitUntilV(pktin);
-
-           if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
-               if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
-                   bombout(("Unexpected response to environment request:"
-                            " packet type %d", pktin->type));
-                   crStopV;
-               }
-           } else {
-               s->env_ok++;
-           }
-
-           s->env_left--;
-       }
-
-       if (s->env_ok == s->num_env) {
-           logevent("All environment variables successfully set");
-       } else if (s->env_ok == 0) {
-           logevent("All environment variables refused");
-           c_write_str(ssh, "Server refused to set environment variables\r\n");
-       } else {
-           logeventf(ssh, "%d environment variables refused",
-                     s->num_env - s->env_ok);
-           c_write_str(ssh, "Server refused to set all environment variables\r\n");
-       }
-    }
+    ssh2_setup_env(ssh->mainchan, NULL, NULL);
 
     /*
      * Start a shell or a remote command. We may have to attempt
@@ -9230,19 +9279,17 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
            cmd = conf_get_str(ssh->conf, CONF_remote_cmd);
        }
 
-       s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-       ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid); /* recipient channel */
        if (subsys) {
-           ssh2_pkt_addstring(s->pktout, "subsystem");
-           ssh2_pkt_addbool(s->pktout, 1);            /* want reply */
+           s->pktout = ssh2_chanreq_init(ssh->mainchan, "subsystem",
+                                         ssh2_response_authconn, NULL);
            ssh2_pkt_addstring(s->pktout, cmd);
        } else if (*cmd) {
-           ssh2_pkt_addstring(s->pktout, "exec");
-           ssh2_pkt_addbool(s->pktout, 1);            /* want reply */
+           s->pktout = ssh2_chanreq_init(ssh->mainchan, "exec",
+                                         ssh2_response_authconn, NULL);
            ssh2_pkt_addstring(s->pktout, cmd);
        } else {
-           ssh2_pkt_addstring(s->pktout, "shell");
-           ssh2_pkt_addbool(s->pktout, 1);            /* want reply */
+           s->pktout = ssh2_chanreq_init(ssh->mainchan, "shell",
+                                         ssh2_response_authconn, NULL);
        }
        ssh2_pkt_send(ssh, s->pktout);
 
@@ -9685,6 +9732,17 @@ static void ssh_free(void *handle)
                    pfd_close(c->u.pfd.s);
                break;
            }
+           if (ssh->version == 2) {
+               struct outstanding_channel_request *ocr, *nocr;
+               ocr = c->v.v2.chanreq_head;
+               while (ocr) {
+                   ocr->handler(c, NULL, ocr->ctx);
+                   nocr = ocr->next;
+                   sfree(ocr);
+                   ocr = nocr;
+               }
+               bufchain_clear(&c->v.v2.outbuffer);
+           }
            sfree(c);
        }
        freetree234(ssh->channels);
@@ -9870,10 +9928,8 @@ static void ssh_size(void *handle, int width, int height)
                            PKT_INT, ssh->term_width,
                            PKT_INT, 0, PKT_INT, 0, PKT_END);
            } else if (ssh->mainchan) {
-               pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-               ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
-               ssh2_pkt_addstring(pktout, "window-change");
-               ssh2_pkt_addbool(pktout, 0);
+               pktout = ssh2_chanreq_init(ssh->mainchan, "window-change",
+                                          NULL, NULL);
                ssh2_pkt_adduint32(pktout, ssh->term_width);
                ssh2_pkt_adduint32(pktout, ssh->term_height);
                ssh2_pkt_adduint32(pktout, 0);
@@ -10009,10 +10065,7 @@ static void ssh_special(void *handle, Telnet_Special code)
        if (ssh->version == 1) {
            logevent("Unable to send BREAK signal in SSH-1");
        } else if (ssh->mainchan) {
-           pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-           ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
-           ssh2_pkt_addstring(pktout, "break");
-           ssh2_pkt_addbool(pktout, 0);
+           pktout = ssh2_chanreq_init(ssh->mainchan, "break", NULL, NULL);
            ssh2_pkt_adduint32(pktout, 0);   /* default break length */
            ssh2_pkt_send(ssh, pktout);
        }
@@ -10037,10 +10090,7 @@ static void ssh_special(void *handle, Telnet_Special code)
        if (signame) {
            /* It's a signal. */
            if (ssh->version == 2 && ssh->mainchan) {
-               pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-               ssh2_pkt_adduint32(pktout, ssh->mainchan->remoteid);
-               ssh2_pkt_addstring(pktout, "signal");
-               ssh2_pkt_addbool(pktout, 0);
+               pktout = ssh2_chanreq_init(ssh->mainchan, "signal", NULL, NULL);
                ssh2_pkt_addstring(pktout, signame);
                ssh2_pkt_send(ssh, pktout);
                logeventf(ssh, "Sent signal SIG%s", signame);