I think rjk meant `setpgid', not `setpgrp'.
[u/mdw/putty] / ssh.c
diff --git a/ssh.c b/ssh.c
index e8d2431..8c71e6d 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -460,7 +460,7 @@ struct ssh_channel {
        struct ssh_agent_channel {
            unsigned char *message;
            unsigned char msglen[4];
-           int lensofar, totallen;
+           unsigned lensofar, totallen;
        } a;
        struct ssh_x11_channel {
            Socket s;
@@ -524,6 +524,9 @@ static void ssh_throttle_all(Ssh ssh, int enable, int bufsize);
 static void ssh2_set_window(struct ssh_channel *c, unsigned newwin);
 static int ssh_sendbuffer(void *handle);
 static void ssh_do_close(Ssh ssh);
+static unsigned long ssh_pkt_getuint32(Ssh ssh);
+static int ssh2_pkt_getbool(Ssh ssh);
+static void ssh_pkt_getstring(Ssh ssh, char **p, int *length);
 
 struct rdpkt1_state_tag {
     long len, pad, biglen, to_read;
@@ -972,15 +975,14 @@ static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
     }
 
     if (ssh->pktin.type == SSH1_MSG_DEBUG) {
-       /* log debug message */
-       char buf[512];
-       int stringlen = GET_32BIT(ssh->pktin.body);
-       strcpy(buf, "Remote debug message: ");
-       if (stringlen > 480)
-           stringlen = 480;
-       memcpy(buf + 8, ssh->pktin.body + 4, stringlen);
-       buf[8 + stringlen] = '\0';
+        char *buf, *msg;
+        int msglen;
+
+        ssh_pkt_getstring(ssh, &msg, &msglen);
+        buf = dupprintf("Remote debug message: %.*s", msglen, msg);
        logevent(buf);
+        sfree(buf);
+
        goto next_packet;
     } else if (ssh->pktin.type == SSH1_MSG_IGNORE) {
        /* do nothing */
@@ -989,17 +991,12 @@ static int ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
 
     if (ssh->pktin.type == SSH1_MSG_DISCONNECT) {
        /* log reason code in disconnect message */
-       char buf[256];
-       unsigned msglen = GET_32BIT(ssh->pktin.body);
-       unsigned nowlen;
-       strcpy(buf, "Remote sent disconnect: ");
-       nowlen = strlen(buf);
-       if (msglen > sizeof(buf) - nowlen - 1)
-           msglen = sizeof(buf) - nowlen - 1;
-       memcpy(buf + nowlen, ssh->pktin.body + 4, msglen);
-       buf[nowlen + msglen] = '\0';
-       /* logevent(buf); (this is now done within the bombout macro) */
-       bombout(("Server sent disconnect message:\n\"%s\"", buf+nowlen));
+       char *msg;
+       int msglen;
+
+        ssh_pkt_getstring(ssh, &msg, &msglen);
+
+       bombout(("Server sent disconnect message:\n\"%.*s\"", msglen, msg));
        crStop(0);
     }
 
@@ -1168,10 +1165,11 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
       case SSH2_MSG_DISCONNECT:
         {
             /* log reason code in disconnect message */
-            char *buf;
-           int nowlen;
-            int reason = GET_32BIT(ssh->pktin.data + 6);
-            unsigned msglen = GET_32BIT(ssh->pktin.data + 10);
+            char *buf, *msg;
+            int nowlen, reason, msglen;
+
+            reason = ssh_pkt_getuint32(ssh);
+            ssh_pkt_getstring(ssh, &msg, &msglen);
 
             if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
                 buf = dupprintf("Received disconnect message (%s)",
@@ -1183,7 +1181,7 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
             logevent(buf);
            sfree(buf);
             buf = dupprintf("Disconnection message text: %n%.*s",
-                           &nowlen, msglen, ssh->pktin.data + 14);
+                           &nowlen, msglen, msg);
             logevent(buf);
             bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"",
                      reason,
@@ -1199,19 +1197,19 @@ static int ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
       case SSH2_MSG_DEBUG:
        {
            /* log the debug message */
-           char buf[512];
-           /* int display = ssh->pktin.body[6]; */
-           int stringlen = GET_32BIT(ssh->pktin.data+7);
-           int prefix;
-           strcpy(buf, "Remote debug message: ");
-           prefix = strlen(buf);
-           if (stringlen > (int)(sizeof(buf)-prefix-1))
-               stringlen = sizeof(buf)-prefix-1;
-           memcpy(buf + prefix, ssh->pktin.data + 11, stringlen);
-           buf[prefix + stringlen] = '\0';
+           char *buf, *msg;
+           int msglen;
+           int always_display;
+
+           /* XXX maybe we should actually take notice of this */
+            always_display = ssh2_pkt_getbool(ssh);
+            ssh_pkt_getstring(ssh, &msg, &msglen);
+
+            buf = dupprintf("Remote debug message: %.*s", msglen, msg);
            logevent(buf);
+            sfree(buf);
        }
-        goto next_packet;              /* FIXME: print the debug message */
+        goto next_packet;
 
         /*
          * These packets we need do nothing about here.
@@ -2759,7 +2757,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen, int ispkt)
 
     fflush(stdout);
     {
-       if ((flags & FLAG_INTERACTIVE) && !*ssh->cfg.username) {
+       if (!*ssh->cfg.username) {
            if (ssh_get_line && !ssh_getline_pw_only) {
                if (!ssh_get_line("login as: ",
                                  s->username, sizeof(s->username), FALSE)) {
@@ -3584,7 +3582,8 @@ static void ssh1_protocol(Ssh ssh, unsigned char *in, int inlen, int ispkt)
            }
            if (sport && dport) {
                /* Set up a description of the source port. */
-               char *sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s",
+               static char *sportdesc;
+               sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s",
                        (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL,
                        (int)(*saddr?1:0), ":",
                        (int)(sserv ? strlen(sports) : 0), sports,
@@ -4788,6 +4787,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
        int siglen, retlen, len;
        char *q, *agentreq, *ret;
        int try_send;
+       int num_env, env_left, env_ok;
     };
     crState(do_ssh2_authconn_state);
 
@@ -4841,7 +4841,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
             * with change_username turned off we don't try to get
             * it again.
             */
-       } else if ((flags & FLAG_INTERACTIVE) && !*ssh->cfg.username) {
+       } else if (!*ssh->cfg.username) {
            if (ssh_get_line && !ssh_getline_pw_only) {
                if (!ssh_get_line("login as: ",
                                  s->username, sizeof(s->username), FALSE)) {
@@ -5003,7 +5003,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                     * Additionally, if we'd just tried password
                     * authentication, we should break out of this
                     * whole loop so as to go back to the username
-                    * prompt.
+                    * prompt (iff we're configured to allow
+                    * username change attempts).
                     */
                    if (s->type == AUTH_TYPE_NONE) {
                        /* do nothing */
@@ -5017,7 +5018,10 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                    } else {
                        c_write_str(ssh, "Access denied\r\n");
                        logevent("Access denied");
-                       if (s->type == AUTH_TYPE_PASSWORD) {
+                       if (s->type == AUTH_TYPE_PASSWORD &&
+                           ssh->cfg.change_username) {
+                           /* XXX perhaps we should allow
+                            * keyboard-interactive to do this too? */
                            s->we_are_in = FALSE;
                            break;
                        }
@@ -5253,7 +5257,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                    ssh2_pkt_addstring_data(ssh, (char *)pub_blob,
                                            pub_blob_len);
                    ssh2_pkt_send(ssh);
-                   logevent("Offered public key");     /* FIXME */
+                   logevent("Offered public key");
 
                    crWaitUntilV(ispkt);
                    if (ssh->pktin.type != SSH2_MSG_USERAUTH_PK_OK) {
@@ -5612,43 +5616,48 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
      * point; there's no need to send SERVICE_REQUEST.
      */
 
+    ssh->channels = newtree234(ssh_channelcmp);
+
     /*
-     * So now create a channel with a session in it.
+     * Create the main session channel.
      */
-    ssh->channels = newtree234(ssh_channelcmp);
-    ssh->mainchan = snew(struct ssh_channel);
-    ssh->mainchan->ssh = ssh;
-    ssh->mainchan->localid = alloc_channel_id(ssh);
-    ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_OPEN);
-    ssh2_pkt_addstring(ssh, "session");
-    ssh2_pkt_adduint32(ssh, ssh->mainchan->localid);
-    ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
-    ssh2_pkt_adduint32(ssh, ssh->mainchan->v.v2.locwindow);/* our window size */
-    ssh2_pkt_adduint32(ssh, 0x4000UL);      /* our max pkt size */
-    ssh2_pkt_send(ssh);
-    crWaitUntilV(ispkt);
-    if (ssh->pktin.type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
-       bombout(("Server refused to open a session"));
-       crStopV;
-       /* FIXME: error data comes back in FAILURE packet */
-    }
-    if (ssh_pkt_getuint32(ssh) != ssh->mainchan->localid) {
-       bombout(("Server's channel confirmation cited wrong channel"));
-       crStopV;
-    }
-    ssh->mainchan->remoteid = ssh_pkt_getuint32(ssh);
-    ssh->mainchan->type = CHAN_MAINSESSION;
-    ssh->mainchan->closes = 0;
-    ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(ssh);
-    ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(ssh);
-    bufchain_init(&ssh->mainchan->v.v2.outbuffer);
-    add234(ssh->channels, ssh->mainchan);
-    logevent("Opened channel for session");
+    if (!ssh->cfg.ssh_no_shell) {
+       ssh->mainchan = snew(struct ssh_channel);
+       ssh->mainchan->ssh = ssh;
+       ssh->mainchan->localid = alloc_channel_id(ssh);
+       ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_OPEN);
+       ssh2_pkt_addstring(ssh, "session");
+       ssh2_pkt_adduint32(ssh, ssh->mainchan->localid);
+       ssh->mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
+       ssh2_pkt_adduint32(ssh, ssh->mainchan->v.v2.locwindow);/* our window size */
+       ssh2_pkt_adduint32(ssh, 0x4000UL);      /* our max pkt size */
+       ssh2_pkt_send(ssh);
+       crWaitUntilV(ispkt);
+       if (ssh->pktin.type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
+           bombout(("Server refused to open a session"));
+           crStopV;
+           /* FIXME: error data comes back in FAILURE packet */
+       }
+       if (ssh_pkt_getuint32(ssh) != ssh->mainchan->localid) {
+           bombout(("Server's channel confirmation cited wrong channel"));
+           crStopV;
+       }
+       ssh->mainchan->remoteid = ssh_pkt_getuint32(ssh);
+       ssh->mainchan->type = CHAN_MAINSESSION;
+       ssh->mainchan->closes = 0;
+       ssh->mainchan->v.v2.remwindow = ssh_pkt_getuint32(ssh);
+       ssh->mainchan->v.v2.remmaxpkt = ssh_pkt_getuint32(ssh);
+       bufchain_init(&ssh->mainchan->v.v2.outbuffer);
+       add234(ssh->channels, ssh->mainchan);
+       update_specials_menu(ssh->frontend);
+       logevent("Opened channel for session");
+    } else
+       ssh->mainchan = NULL;
 
     /*
      * Potentially enable X11 forwarding.
      */
-    if (ssh->cfg.x11_forward) {
+    if (ssh->mainchan && ssh->cfg.x11_forward) {
        char proto[20], data[64];
        logevent("Requesting X11 forwarding");
        ssh->x11auth = x11_invent_auth(proto, sizeof(proto),
@@ -5766,7 +5775,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
            }
            if (sport && dport) {
                /* Set up a description of the source port. */
-               char *sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s",
+               static char *sportdesc;
+               sportdesc = dupprintf("%.*s%.*s%.*s%.*s%d%.*s",
                        (int)(*saddr?strlen(saddr):0), *saddr?saddr:NULL,
                        (int)(*saddr?1:0), ":",
                        (int)(sserv ? strlen(sports) : 0), sports,
@@ -5819,12 +5829,13 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                        ssh2_pkt_init(ssh, SSH2_MSG_GLOBAL_REQUEST);
                        ssh2_pkt_addstring(ssh, "tcpip-forward");
                        ssh2_pkt_addbool(ssh, 1);/* want reply */
-                       if (*saddr)
+                       if (*saddr) {
                            ssh2_pkt_addstring(ssh, saddr);
-                       if (ssh->cfg.rport_acceptall)
+                       } else if (ssh->cfg.rport_acceptall) {
                            ssh2_pkt_addstring(ssh, "0.0.0.0");
-                       else
+                       } else {
                            ssh2_pkt_addstring(ssh, "127.0.0.1");
+                       }
                        ssh2_pkt_adduint32(ssh, sport);
                        ssh2_pkt_send(ssh);
 
@@ -5861,7 +5872,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
     /*
      * Potentially enable agent forwarding.
      */
-    if (ssh->cfg.agentfwd && agent_exists()) {
+    if (ssh->mainchan && ssh->cfg.agentfwd && agent_exists()) {
        logevent("Requesting OpenSSH-style agent forwarding");
        ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
        ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
@@ -5897,7 +5908,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
     /*
      * Now allocate a pty for the session.
      */
-    if (!ssh->cfg.nopty) {
+    if (ssh->mainchan && !ssh->cfg.nopty) {
        /* Unpick the terminal-speed string. */
        /* XXX perhaps we should allow no speeds to be sent. */
         ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
@@ -5950,11 +5961,87 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
     }
 
     /*
+     * Send environment variables.
+     * 
+     * Simplest thing here is to send all the requests at once, and
+     * then wait for a whole bunch of successes or failures.
+     */
+    if (ssh->mainchan && *ssh->cfg.environmt) {
+       char *e = ssh->cfg.environmt;
+       char *var, *varend, *val;
+
+       s->num_env = 0;
+
+       while (*e) {
+           var = e;
+           while (*e && *e != '\t') e++;
+           varend = e;
+           if (*e == '\t') e++;
+           val = e;
+           while (*e) e++;
+           e++;
+
+           ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
+           ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
+           ssh2_pkt_addstring(ssh, "env");
+           ssh2_pkt_addbool(ssh, 1);          /* want reply */
+           ssh2_pkt_addstring_start(ssh);
+           ssh2_pkt_addstring_data(ssh, var, varend-var);
+           ssh2_pkt_addstring(ssh, val);
+           ssh2_pkt_send(ssh);
+
+           s->num_env++;
+       }
+
+       logeventf(ssh, "Sent %d environment variables", s->num_env);
+
+       s->env_ok = 0;
+       s->env_left = s->num_env;
+
+       while (s->env_left > 0) {
+           do {
+               crWaitUntilV(ispkt);
+               if (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
+                   unsigned i = ssh_pkt_getuint32(ssh);
+                   struct ssh_channel *c;
+                   c = find234(ssh->channels, &i, ssh_channelfind);
+                   if (!c)
+                       continue;              /* nonexistent channel */
+                   c->v.v2.remwindow += ssh_pkt_getuint32(ssh);
+               }
+           } while (ssh->pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
+
+           if (ssh->pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
+               if (ssh->pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
+                   bombout(("Unexpected response to environment request:"
+                            " packet type %d", ssh->pktin.type));
+                   crStopV;
+               }
+           } else {
+               s->env_ok++;
+           }
+
+           s->env_left--;
+       }
+
+       if (s->env_ok == s->num_env) {
+           logevent("All environment variables successfully set");
+       } else if (s->env_ok == 0) {
+           logevent("All environment variables refused");
+           c_write_str(ssh, "Server refused to set environment variables\r\n");
+       } else {
+           logeventf(ssh, "%d environment variables refused",
+                     s->num_env - s->env_ok);
+           c_write_str(ssh, "Server refused to set all environment variables\r\n");
+       }
+    }
+
+    /*
      * Start a shell or a remote command. We may have to attempt
      * this twice if the config data has provided a second choice
      * of command.
      */
-    while (1) {
+    if (ssh->mainchan) while (1) {
        int subsys;
        char *cmd;
 
@@ -6028,7 +6115,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
      */
     if (ssh->ldisc)
        ldisc_send(ssh->ldisc, NULL, 0, 0);/* cause ldisc to notice changes */
-    ssh->send_ok = 1;
+    if (ssh->mainchan)
+       ssh->send_ok = 1;
     while (1) {
        crReturnV;
        s->try_send = FALSE;
@@ -6145,7 +6233,9 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                /* Do pre-close processing on the channel. */
                switch (c->type) {
                  case CHAN_MAINSESSION:
-                   break;             /* nothing to see here, move along */
+                   ssh->mainchan = NULL;
+                   update_specials_menu(ssh->frontend);
+                   break;
                  case CHAN_X11:
                    if (c->u.x11.s != NULL)
                        x11_close(c->u.x11.s);
@@ -6171,8 +6261,10 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
 
                /*
                 * See if that was the last channel left open.
+                * (This is only our termination condition if we're
+                * not running in -N mode.)
                 */
-               if (count234(ssh->channels) == 0) {
+               if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) {
                    logevent("All channels closed. Disconnecting");
 #if 0
                     /*
@@ -6267,6 +6359,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                unsigned localid;
                char *type;
                int typelen, want_reply;
+               int reply = SSH2_MSG_CHANNEL_FAILURE; /* default */
                struct ssh_channel *c;
 
                localid = ssh_pkt_getuint32(ssh);
@@ -6298,18 +6391,94 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                 * the request type string to see if it's something
                 * we recognise.
                 */
-               if (typelen == 11 && !memcmp(type, "exit-status", 11) &&
-                   c == ssh->mainchan) {
-                   /* We recognise "exit-status" on the primary channel. */
-                   char buf[100];
-                   ssh->exitcode = ssh_pkt_getuint32(ssh);
-                   sprintf(buf, "Server sent command exit status %d",
-                           ssh->exitcode);
-                   logevent(buf);
-                   if (want_reply) {
-                       ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_SUCCESS);
-                       ssh2_pkt_adduint32(ssh, c->remoteid);
-                       ssh2_pkt_send(ssh);
+               if (c == ssh->mainchan) {
+                   /*
+                    * We recognise "exit-status" and "exit-signal" on
+                    * the primary channel.
+                    */
+                   if (typelen == 11 &&
+                       !memcmp(type, "exit-status", 11)) {
+
+                       ssh->exitcode = ssh_pkt_getuint32(ssh);
+                       logeventf(ssh, "Server sent command exit status %d",
+                                 ssh->exitcode);
+                       reply = SSH2_MSG_CHANNEL_SUCCESS;
+
+                   } else if (typelen == 11 &&
+                              !memcmp(type, "exit-signal", 11)) {
+
+                       int is_plausible = TRUE, is_int = FALSE;
+                       char *fmt_sig = "", *fmt_msg = "";
+                       char *msg;
+                       int msglen = 0, core = FALSE;
+                       /* ICK: older versions of OpenSSH (e.g. 3.4p1)
+                        * provide an `int' for the signal, despite its
+                        * having been a `string' in the drafts since at
+                        * least 2001. (Fixed in session.c 1.147.) Try to
+                        * infer which we can safely parse it as. */
+                       {
+                           unsigned char *p = ssh->pktin.body +
+                                              ssh->pktin.savedpos;
+                           long len = ssh->pktin.length - ssh->pktin.savedpos;
+                           unsigned long num = GET_32BIT(p); /* what is it? */
+                           /* If it's 0, it hardly matters; assume string */
+                           if (num == 0) {
+                               is_int = FALSE;
+                           } else {
+                               int maybe_int = FALSE, maybe_str = FALSE;
+#define CHECK_HYPOTHESIS(offset, result) \
+    do { \
+       long q = offset; \
+       if (q >= 0 && q+4 <= len) { \
+           q = q + 4 + GET_32BIT(p+q); \
+           if (q >= 0 && q+4 <= len && \
+                   (q = q + 4 + GET_32BIT(p+q)) && q == len) \
+               result = TRUE; \
+       } \
+    } while(0)
+                               CHECK_HYPOTHESIS(4+1, maybe_int);
+                               CHECK_HYPOTHESIS(4+num+1, maybe_str);
+#undef CHECK_HYPOTHESIS
+                               if (maybe_int && !maybe_str)
+                                   is_int = TRUE;
+                               else if (!maybe_int && maybe_str)
+                                   is_int = FALSE;
+                               else
+                                   /* Crikey. Either or neither. Panic. */
+                                   is_plausible = FALSE;
+                           }
+                       }
+                       if (is_plausible) {
+                           if (is_int) {
+                               /* Old non-standard OpenSSH. */
+                               int signum = ssh_pkt_getuint32(ssh);
+                               fmt_sig = dupprintf(" %d", signum);
+                           } else {
+                               /* As per the drafts. */
+                               char *sig;
+                               int siglen;
+                               ssh_pkt_getstring(ssh, &sig, &siglen);
+                               /* Signal name isn't supposed to be blank, but
+                                * let's cope gracefully if it is. */
+                               if (siglen) {
+                                   fmt_sig = dupprintf(" \"%.*s\"",
+                                                       siglen, sig);
+                               }
+                           }
+                           core = ssh2_pkt_getbool(ssh);
+                           ssh_pkt_getstring(ssh, &msg, &msglen);
+                           if (msglen) {
+                               fmt_msg = dupprintf(" (\"%.*s\")", msglen, msg);
+                           }
+                           /* ignore lang tag */
+                       } /* else don't attempt to parse */
+                       logeventf(ssh, "Server exited on signal%s%s%s",
+                                 fmt_sig, core ? " (core dumped)" : "",
+                                 fmt_msg);
+                       if (*fmt_sig) sfree(fmt_sig);
+                       if (*fmt_msg) sfree(fmt_msg);
+                       reply = SSH2_MSG_CHANNEL_SUCCESS;
+
                    }
                } else {
                    /*
@@ -6318,11 +6487,12 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                     * or respond with CHANNEL_FAILURE, depending
                     * on want_reply.
                     */
-                   if (want_reply) {
-                       ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_FAILURE);
-                       ssh2_pkt_adduint32(ssh, c->remoteid);
-                       ssh2_pkt_send(ssh);
-                   }
+                   reply = SSH2_MSG_CHANNEL_FAILURE;
+               }
+               if (want_reply) {
+                   ssh2_pkt_init(ssh, reply);
+                   ssh2_pkt_adduint32(ssh, c->remoteid);
+                   ssh2_pkt_send(ssh);
                }
            } else if (ssh->pktin.type == SSH2_MSG_GLOBAL_REQUEST) {
                char *type;
@@ -6452,7 +6622,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen, int ispkt)
                bombout(("Strange packet received: type %d", ssh->pktin.type));
                crStopV;
            }
-       } else {
+       } else if (ssh->mainchan) {
            /*
             * We have spare data. Add it to the channel buffer.
             */
@@ -6772,7 +6942,7 @@ static void ssh_size(void *handle, int width, int height)
                            PKT_INT, ssh->term_height,
                            PKT_INT, ssh->term_width,
                            PKT_INT, 0, PKT_INT, 0, PKT_END);
-           } else {
+           } else if (ssh->mainchan) {
                ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
                ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
                ssh2_pkt_addstring(ssh, "window-change");
@@ -6794,23 +6964,62 @@ static void ssh_size(void *handle, int width, int height)
  */
 static const struct telnet_special *ssh_get_specials(void *handle)
 {
+    static const struct telnet_special ignore_special[] = {
+       {"IGNORE message", TS_NOP},
+    };
+    static const struct telnet_special ssh2_session_specials[] = {
+       {NULL, TS_SEP},
+       {"Break", TS_BRK},
+       /* These are the signal names defined by draft-ietf-secsh-connect-19.
+        * They include all the ISO C signals, but are a subset of the POSIX
+        * required signals. */
+       {"SIGINT (Interrupt)", TS_SIGINT},
+       {"SIGTERM (Terminate)", TS_SIGTERM},
+       {"SIGKILL (Kill)", TS_SIGKILL},
+       {"SIGQUIT (Quit)", TS_SIGQUIT},
+       {"SIGHUP (Hangup)", TS_SIGHUP},
+       {"More signals", TS_SUBMENU},
+         {"SIGABRT", TS_SIGABRT}, {"SIGALRM", TS_SIGALRM},
+         {"SIGFPE",  TS_SIGFPE},  {"SIGILL",  TS_SIGILL},
+         {"SIGPIPE", TS_SIGPIPE}, {"SIGSEGV", TS_SIGSEGV},
+         {"SIGUSR1", TS_SIGUSR1}, {"SIGUSR2", TS_SIGUSR2},
+       {NULL, TS_EXITMENU}
+    };
+    static const struct telnet_special specials_end[] = {
+       {NULL, TS_EXITMENU}
+    };
+    static struct telnet_special ssh_specials[lenof(ignore_special) +
+                                             lenof(ssh2_session_specials) +
+                                             lenof(specials_end)];
     Ssh ssh = (Ssh) handle;
+    int i = 0;
+#define ADD_SPECIALS(name) \
+    do { \
+       assert((i + lenof(name)) <= lenof(ssh_specials)); \
+       memcpy(&ssh_specials[i], name, sizeof name); \
+       i += lenof(name); \
+    } while(0)
 
     if (ssh->version == 1) {
-       static const struct telnet_special ssh1_specials[] = {
-           {"IGNORE message", TS_NOP},
-           {NULL, 0}
-       };
-       return ssh1_specials;
+       /* Don't bother offering IGNORE if we've decided the remote
+        * won't cope with it, since we wouldn't bother sending it if
+        * asked anyway. */
+       if (!(ssh->remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE))
+           ADD_SPECIALS(ignore_special);
     } else if (ssh->version == 2) {
-       static const struct telnet_special ssh2_specials[] = {
-           {"Break", TS_BRK},
-           {"IGNORE message", TS_NOP},
-           {NULL, 0}
-       };
-       return ssh2_specials;
-    } else
+       /* XXX add rekey, when implemented */
+       ADD_SPECIALS(ignore_special);
+       if (ssh->mainchan)
+           ADD_SPECIALS(ssh2_session_specials);
+    } /* else we're not ready yet */
+
+    if (i) {
+       ADD_SPECIALS(specials_end);
+       return ssh_specials;
+    } else {
        return NULL;
+    }
+#undef ADD_SPECIALS
 }
 
 /*
@@ -6834,7 +7043,7 @@ static void ssh_special(void *handle, Telnet_Special code)
        }
        if (ssh->version == 1) {
            send_packet(ssh, SSH1_CMSG_EOF, PKT_END);
-       } else {
+       } else if (ssh->mainchan) {
            ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_EOF);
            ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
            ssh2_pkt_send(ssh);
@@ -6856,7 +7065,7 @@ static void ssh_special(void *handle, Telnet_Special code)
            || ssh->state == SSH_STATE_PREPACKET) return;
        if (ssh->version == 1) {
            logevent("Unable to send BREAK signal in SSH1");
-       } else {
+       } else if (ssh->mainchan) {
            ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
            ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
            ssh2_pkt_addstring(ssh, "break");
@@ -6865,7 +7074,37 @@ static void ssh_special(void *handle, Telnet_Special code)
            ssh2_pkt_send(ssh);
        }
     } else {
-       /* do nothing */
+       /* Is is a POSIX signal? */
+       char *signame = NULL;
+       if (code == TS_SIGABRT) signame = "ABRT";
+       if (code == TS_SIGALRM) signame = "ALRM";
+       if (code == TS_SIGFPE)  signame = "FPE";
+       if (code == TS_SIGHUP)  signame = "HUP";
+       if (code == TS_SIGILL)  signame = "ILL";
+       if (code == TS_SIGINT)  signame = "INT";
+       if (code == TS_SIGKILL) signame = "KILL";
+       if (code == TS_SIGPIPE) signame = "PIPE";
+       if (code == TS_SIGQUIT) signame = "QUIT";
+       if (code == TS_SIGSEGV) signame = "SEGV";
+       if (code == TS_SIGTERM) signame = "TERM";
+       if (code == TS_SIGUSR1) signame = "USR1";
+       if (code == TS_SIGUSR2) signame = "USR2";
+       /* The SSH-2 protocol does in principle support arbitrary named
+        * signals, including signame@domain, but we don't support those. */
+       if (signame) {
+           /* It's a signal. */
+           if (ssh->version == 2 && ssh->mainchan) {
+               ssh2_pkt_init(ssh, SSH2_MSG_CHANNEL_REQUEST);
+               ssh2_pkt_adduint32(ssh, ssh->mainchan->remoteid);
+               ssh2_pkt_addstring(ssh, "signal");
+               ssh2_pkt_addbool(ssh, 0);
+               ssh2_pkt_addstring(ssh, signame);
+               ssh2_pkt_send(ssh);
+               logeventf(ssh, "Sent signal SIG%s", signame);
+           }
+       } else {
+           /* Never heard of it. Do nothing */
+       }
     }
 }