X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/761187b670e753908faee88e95083585e6e36ac5..8eebd22198133e95ce25af1dd15dead0a5389371:/ssh.c

diff --git a/ssh.c b/ssh.c
index 0eb30262..6cc79bff 100644
--- a/ssh.c
+++ b/ssh.c
@@ -15,9 +15,6 @@
 #define TRUE 1
 #endif
 
-/* uncomment this for packet level debugging */
-/* #define DUMP_PACKETS */
-
 #define logevent(s) { logevent(s); \
                       if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) \
                       { fprintf(stderr, "%s\n", s); fflush(stderr); } }
@@ -112,6 +109,17 @@
 #define SSH2_MSG_CHANNEL_SUCCESS                  99	/* 0x63 */
 #define SSH2_MSG_CHANNEL_FAILURE                  100	/* 0x64 */
 
+/*
+ * Packet type contexts, so that ssh2_pkt_type can correctly decode
+ * the ambiguous type numbers back into the correct type strings.
+ */
+#define SSH2_PKTCTX_DHGROUP1         0x0001
+#define SSH2_PKTCTX_DHGEX            0x0002
+#define SSH2_PKTCTX_PUBLICKEY        0x0010
+#define SSH2_PKTCTX_PASSWORD         0x0020
+#define SSH2_PKTCTX_KBDINTER         0x0040
+#define SSH2_PKTCTX_AUTH_MASK        0x00F0
+
 #define SSH2_DISCONNECT_HOST_NOT_ALLOWED_TO_CONNECT 1	/* 0x1 */
 #define SSH2_DISCONNECT_PROTOCOL_ERROR            2	/* 0x2 */
 #define SSH2_DISCONNECT_KEY_EXCHANGE_FAILED       3	/* 0x3 */
@@ -159,6 +167,100 @@ static const char *const ssh2_disconnect_reasons[] = {
  */
 #define BUG_CHOKES_ON_SSH1_IGNORE                 1
 #define BUG_SSH2_HMAC                             2
+#define BUG_NEEDS_SSH1_PLAIN_PASSWORD        	  4
+#define BUG_CHOKES_ON_RSA	        	  8
+
+static int ssh_pkt_ctx = 0;
+
+#define translate(x) if (type == x) return #x
+#define translatec(x,ctx) if (type == x && (ssh_pkt_ctx & ctx)) return #x
+char *ssh1_pkt_type(int type)
+{
+    translate(SSH1_MSG_DISCONNECT);
+    translate(SSH1_SMSG_PUBLIC_KEY);
+    translate(SSH1_CMSG_SESSION_KEY);
+    translate(SSH1_CMSG_USER);
+    translate(SSH1_CMSG_AUTH_RSA);
+    translate(SSH1_SMSG_AUTH_RSA_CHALLENGE);
+    translate(SSH1_CMSG_AUTH_RSA_RESPONSE);
+    translate(SSH1_CMSG_AUTH_PASSWORD);
+    translate(SSH1_CMSG_REQUEST_PTY);
+    translate(SSH1_CMSG_WINDOW_SIZE);
+    translate(SSH1_CMSG_EXEC_SHELL);
+    translate(SSH1_CMSG_EXEC_CMD);
+    translate(SSH1_SMSG_SUCCESS);
+    translate(SSH1_SMSG_FAILURE);
+    translate(SSH1_CMSG_STDIN_DATA);
+    translate(SSH1_SMSG_STDOUT_DATA);
+    translate(SSH1_SMSG_STDERR_DATA);
+    translate(SSH1_CMSG_EOF);
+    translate(SSH1_SMSG_EXIT_STATUS);
+    translate(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION);
+    translate(SSH1_MSG_CHANNEL_OPEN_FAILURE);
+    translate(SSH1_MSG_CHANNEL_DATA);
+    translate(SSH1_MSG_CHANNEL_CLOSE);
+    translate(SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION);
+    translate(SSH1_SMSG_X11_OPEN);
+    translate(SSH1_CMSG_PORT_FORWARD_REQUEST);
+    translate(SSH1_MSG_PORT_OPEN);
+    translate(SSH1_CMSG_AGENT_REQUEST_FORWARDING);
+    translate(SSH1_SMSG_AGENT_OPEN);
+    translate(SSH1_MSG_IGNORE);
+    translate(SSH1_CMSG_EXIT_CONFIRMATION);
+    translate(SSH1_CMSG_X11_REQUEST_FORWARDING);
+    translate(SSH1_CMSG_AUTH_RHOSTS_RSA);
+    translate(SSH1_MSG_DEBUG);
+    translate(SSH1_CMSG_REQUEST_COMPRESSION);
+    translate(SSH1_CMSG_AUTH_TIS);
+    translate(SSH1_SMSG_AUTH_TIS_CHALLENGE);
+    translate(SSH1_CMSG_AUTH_TIS_RESPONSE);
+    translate(SSH1_CMSG_AUTH_CCARD);
+    translate(SSH1_SMSG_AUTH_CCARD_CHALLENGE);
+    translate(SSH1_CMSG_AUTH_CCARD_RESPONSE);
+    return "unknown";
+}
+char *ssh2_pkt_type(int type)
+{
+    translate(SSH2_MSG_DISCONNECT);
+    translate(SSH2_MSG_IGNORE);
+    translate(SSH2_MSG_UNIMPLEMENTED);
+    translate(SSH2_MSG_DEBUG);
+    translate(SSH2_MSG_SERVICE_REQUEST);
+    translate(SSH2_MSG_SERVICE_ACCEPT);
+    translate(SSH2_MSG_KEXINIT);
+    translate(SSH2_MSG_NEWKEYS);
+    translatec(SSH2_MSG_KEXDH_INIT, SSH2_PKTCTX_DHGROUP1);
+    translatec(SSH2_MSG_KEXDH_REPLY, SSH2_PKTCTX_DHGROUP1);
+    translatec(SSH2_MSG_KEX_DH_GEX_REQUEST, SSH2_PKTCTX_DHGEX);
+    translatec(SSH2_MSG_KEX_DH_GEX_GROUP, SSH2_PKTCTX_DHGEX);
+    translatec(SSH2_MSG_KEX_DH_GEX_INIT, SSH2_PKTCTX_DHGEX);
+    translatec(SSH2_MSG_KEX_DH_GEX_REPLY, SSH2_PKTCTX_DHGEX);
+    translate(SSH2_MSG_USERAUTH_REQUEST);
+    translate(SSH2_MSG_USERAUTH_FAILURE);
+    translate(SSH2_MSG_USERAUTH_SUCCESS);
+    translate(SSH2_MSG_USERAUTH_BANNER);
+    translatec(SSH2_MSG_USERAUTH_PK_OK, SSH2_PKTCTX_PUBLICKEY);
+    translatec(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, SSH2_PKTCTX_PASSWORD);
+    translatec(SSH2_MSG_USERAUTH_INFO_REQUEST, SSH2_PKTCTX_KBDINTER);
+    translatec(SSH2_MSG_USERAUTH_INFO_RESPONSE, SSH2_PKTCTX_KBDINTER);
+    translate(SSH2_MSG_GLOBAL_REQUEST);
+    translate(SSH2_MSG_REQUEST_SUCCESS);
+    translate(SSH2_MSG_REQUEST_FAILURE);
+    translate(SSH2_MSG_CHANNEL_OPEN);
+    translate(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
+    translate(SSH2_MSG_CHANNEL_OPEN_FAILURE);
+    translate(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
+    translate(SSH2_MSG_CHANNEL_DATA);
+    translate(SSH2_MSG_CHANNEL_EXTENDED_DATA);
+    translate(SSH2_MSG_CHANNEL_EOF);
+    translate(SSH2_MSG_CHANNEL_CLOSE);
+    translate(SSH2_MSG_CHANNEL_REQUEST);
+    translate(SSH2_MSG_CHANNEL_SUCCESS);
+    translate(SSH2_MSG_CHANNEL_FAILURE);
+    return "unknown";
+}
+#undef translate
+#undef translatec
 
 #define GET_32BIT(cp) \
     (((unsigned long)(unsigned char)(cp)[0] << 24) | \
@@ -195,26 +297,55 @@ enum { PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR, PKT_BIGNUM };
 
 extern char *x11_init(Socket *, char *, void *);
 extern void x11_close(Socket);
-extern void x11_send(Socket, char *, int);
+extern int x11_send(Socket, char *, int);
 extern void x11_invent_auth(char *, int, char *, int);
+extern void x11_unthrottle(Socket s);
+extern void x11_override_throttle(Socket s, int enable);
 
 extern char *pfd_newconnect(Socket * s, char *hostname, int port, void *c);
 extern char *pfd_addforward(char *desthost, int destport, int port);
 extern void pfd_close(Socket s);
-extern void pfd_send(Socket s, char *data, int len);
+extern int pfd_send(Socket s, char *data, int len);
 extern void pfd_confirm(Socket s);
+extern void pfd_unthrottle(Socket s);
+extern void pfd_override_throttle(Socket s, int enable);
+
+static void ssh2_pkt_init(int pkt_type);
+static void ssh2_pkt_addbool(unsigned char value);
+static void ssh2_pkt_adduint32(unsigned long value);
+static void ssh2_pkt_addstring_start(void);
+static void ssh2_pkt_addstring_str(char *data);
+static void ssh2_pkt_addstring_data(char *data, int len);
+static void ssh2_pkt_addstring(char *data);
+static char *ssh2_mpint_fmt(Bignum b, int *len);
+static void ssh2_pkt_addmp(Bignum b);
+static int ssh2_pkt_construct(void);
+static void ssh2_pkt_send(void);
 
 /*
- * Ciphers for SSH2. We miss out single-DES because it isn't
- * supported; also 3DES and Blowfish are both done differently from
- * SSH1. (3DES uses outer chaining; Blowfish has the opposite
- * endianness and different-sized keys.)
+ * Buffer management constants. There are several of these for
+ * various different purposes:
+ * 
+ *  - SSH1_BUFFER_LIMIT is the amount of backlog that must build up
+ *    on a local data stream before we throttle the whole SSH
+ *    connection (in SSH1 only). Throttling the whole connection is
+ *    pretty drastic so we set this high in the hope it won't
+ *    happen very often.
+ * 
+ *  - SSH_MAX_BACKLOG is the amount of backlog that must build up
+ *    on the SSH connection itself before we defensively throttle
+ *    _all_ local data streams. This is pretty drastic too (though
+ *    thankfully unlikely in SSH2 since the window mechanism should
+ *    ensure that the server never has any need to throttle its end
+ *    of the connection), so we set this high as well.
+ * 
+ *  - OUR_V2_WINSIZE is the maximum window size we present on SSH2
+ *    channels.
  */
-const static struct ssh2_ciphers *ciphers[] = {
-    &ssh2_aes,
-    &ssh2_blowfish,
-    &ssh2_3des,
-};
+
+#define SSH1_BUFFER_LIMIT 32768
+#define SSH_MAX_BACKLOG 32768
+#define OUR_V2_WINSIZE 16384
 
 const static struct ssh_kex *kex_algs[] = {
     &ssh_diffiehellman_gex,
@@ -271,7 +402,8 @@ enum {				       /* channel types */
     CHAN_MAINSESSION,
     CHAN_X11,
     CHAN_AGENT,
-    CHAN_SOCKDATA
+    CHAN_SOCKDATA,
+    CHAN_SOCKDATA_DORMANT	       /* one the remote hasn't confirmed */
 };
 
 /*
@@ -281,11 +413,16 @@ struct ssh_channel {
     unsigned remoteid, localid;
     int type;
     int closes;
-    struct ssh2_data_channel {
-	unsigned char *outbuffer;
-	unsigned outbuflen, outbufsize;
-	unsigned remwindow, remmaxpkt;
-    } v2;
+    union {
+	struct ssh1_data_channel {
+	    int throttling;
+	} v1;
+	struct ssh2_data_channel {
+	    bufchain outbuffer;
+	    unsigned remwindow, remmaxpkt;
+	    unsigned locwindow;
+	} v2;
+    } v;
     union {
 	struct ssh_agent_channel {
 	    unsigned char *message;
@@ -302,13 +439,37 @@ struct ssh_channel {
 };
 
 /*
- * 2-3-4 tree storing remote->local port forwardings (so we can
- * reject any attempt to open a port we didn't explicitly ask to
- * have forwarded).
+ * 2-3-4 tree storing remote->local port forwardings. SSH 1 and SSH
+ * 2 use this structure in different ways, reflecting SSH 2's
+ * altogether saner approach to port forwarding.
+ * 
+ * In SSH 1, you arrange a remote forwarding by sending the server
+ * the remote port number, and the local destination host:port.
+ * When a connection comes in, the server sends you back that
+ * host:port pair, and you connect to it. This is a ready-made
+ * security hole if you're not on the ball: a malicious server
+ * could send you back _any_ host:port pair, so if you trustingly
+ * connect to the address it gives you then you've just opened the
+ * entire inside of your corporate network just by connecting
+ * through it to a dodgy SSH server. Hence, we must store a list of
+ * host:port pairs we _are_ trying to forward to, and reject a
+ * connection request from the server if it's not in the list.
+ * 
+ * In SSH 2, each side of the connection minds its own business and
+ * doesn't send unnecessary information to the other. You arrange a
+ * remote forwarding by sending the server just the remote port
+ * number. When a connection comes in, the server tells you which
+ * of its ports was connected to; and _you_ have to remember what
+ * local host:port pair went with that port number.
+ * 
+ * Hence: in SSH 1 this structure stores host:port pairs we intend
+ * to allow connections to, and is indexed by those host:port
+ * pairs. In SSH 2 it stores a mapping from source port to
+ * destination host:port pair, and is indexed by source port.
  */
 struct ssh_rportfwd {
-    unsigned port;
-    char host[256];
+    unsigned sport, dport;
+    char dhost[256];
 };
 
 struct Packet {
@@ -351,6 +512,7 @@ static int ssh_echoing, ssh_editing;
 
 static tree234 *ssh_channels;	       /* indexed by local id */
 static struct ssh_channel *mainchan;   /* primary session channel */
+static int ssh_exitcode = -1;
 
 static tree234 *ssh_rportfwds;
 
@@ -369,17 +531,30 @@ static struct Packet pktout = { 0, 0, NULL, NULL, 0 };
 static unsigned char *deferred_send_data = NULL;
 static int deferred_len = 0, deferred_size = 0;
 
+/*
+ * Gross hack: pscp will try to start SFTP but fall back to scp1 if
+ * that fails. This variable is the means by which scp.c can reach
+ * into the SSH code and find out which one it got.
+ */
+int ssh_fallback_cmd = 0;
+
 static int ssh_version;
+static int ssh1_throttle_count;
+static int ssh_overall_bufsize;
+static int ssh_throttled_all;
+static int ssh1_stdout_throttling;
 static void (*ssh_protocol) (unsigned char *in, int inlen, int ispkt);
 static void ssh1_protocol(unsigned char *in, int inlen, int ispkt);
 static void ssh2_protocol(unsigned char *in, int inlen, int ispkt);
 static void ssh_size(void);
 static void ssh_special(Telnet_Special);
-static void ssh2_try_send(struct ssh_channel *c);
+static int ssh2_try_send(struct ssh_channel *c);
 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
 				  int len);
-
+static void ssh_throttle_all(int enable, int bufsize);
+static void ssh2_set_window(struct ssh_channel *c, unsigned newwin);
 static int (*s_rdpkt) (unsigned char **data, int *datalen);
+static int ssh_sendbuffer(void);
 
 static struct rdpkt1_state_tag {
     long len, pad, biglen, to_read;
@@ -417,15 +592,29 @@ static int ssh_channelfind(void *av, void *bv)
     return 0;
 }
 
-static int ssh_rportcmp(void *av, void *bv)
+static int ssh_rportcmp_ssh1(void *av, void *bv)
 {
     struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
     struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
     int i;
-    if ( (i = strcmp(a->host, b->host)) != 0)
+    if ( (i = strcmp(a->dhost, b->dhost)) != 0)
 	return i < 0 ? -1 : +1;
-    if (a->port > b->port)
+    if (a->dport > b->dport)
+	return +1;
+    if (a->dport < b->dport)
+	return -1;
+    return 0;
+}
+
+static int ssh_rportcmp_ssh2(void *av, void *bv)
+{
+    struct ssh_rportfwd *a = (struct ssh_rportfwd *) av;
+    struct ssh_rportfwd *b = (struct ssh_rportfwd *) bv;
+
+    if (a->sport > b->sport)
 	return +1;
+    if (a->sport < b->sport)
+	return -1;
     return 0;
 }
 
@@ -521,12 +710,6 @@ static int ssh1_rdpkt(unsigned char **data, int *datalen)
 	(*data)++, (*datalen)--;
     }
 
-#ifdef FWHACK
-    if (st->len == 0x52656d6f) {       /* "Remo"te server has closed ... */
-	st->len = 0x300;	       /* big enough to carry to end */
-    }
-#endif
-
     st->pad = 8 - (st->len % 8);
     st->biglen = st->len + st->pad;
     pktin.length = st->len - 5;
@@ -554,12 +737,13 @@ static int ssh1_rdpkt(unsigned char **data, int *datalen)
 	st->to_read -= st->chunk;
     }
 
+    if (cipher && detect_attack(pktin.data, st->biglen, NULL)) {
+        bombout(("Network attack (CRC compensation) detected!"));
+        crReturn(0);
+    }
+
     if (cipher)
 	cipher->decrypt(pktin.data, st->biglen);
-#ifdef DUMP_PACKETS
-    debug(("Got packet len=%d pad=%d\n", st->len, st->pad));
-    dmemdump(pktin.data, st->biglen);
-#endif
 
     st->realcrc = crc32(pktin.data, st->biglen - 4);
     st->gotcrc = GET_32BIT(pktin.data + st->biglen - 4);
@@ -573,10 +757,6 @@ static int ssh1_rdpkt(unsigned char **data, int *datalen)
     if (ssh1_compressing) {
 	unsigned char *decompblk;
 	int decomplen;
-#ifdef DUMP_PACKETS
-	debug(("Packet payload pre-decompression:\n"));
-	dmemdump(pktin.body - 1, pktin.length + 1);
-#endif
 	zlib_decompress_block(pktin.body - 1, pktin.length + 1,
 			      &decompblk, &decomplen);
 
@@ -591,35 +771,34 @@ static int ssh1_rdpkt(unsigned char **data, int *datalen)
 	memcpy(pktin.body - 1, decompblk, decomplen);
 	sfree(decompblk);
 	pktin.length = decomplen - 1;
-#ifdef DUMP_PACKETS
-	debug(("Packet payload post-decompression:\n"));
-	dmemdump(pktin.body - 1, pktin.length + 1);
-#endif
     }
 
+    pktin.type = pktin.body[-1];
+
+    log_packet(PKT_INCOMING, pktin.type, ssh1_pkt_type(pktin.type),
+	       pktin.body, pktin.length);
+
     if (pktin.type == SSH1_SMSG_STDOUT_DATA ||
 	pktin.type == SSH1_SMSG_STDERR_DATA ||
 	pktin.type == SSH1_MSG_DEBUG ||
 	pktin.type == SSH1_SMSG_AUTH_TIS_CHALLENGE ||
 	pktin.type == SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
-	long strlen = GET_32BIT(pktin.body);
-	if (strlen + 4 != pktin.length) {
+	long stringlen = GET_32BIT(pktin.body);
+	if (stringlen + 4 != pktin.length) {
 	    bombout(("Received data packet with bogus string length"));
 	    crReturn(0);
 	}
     }
 
-    pktin.type = pktin.body[-1];
-
     if (pktin.type == SSH1_MSG_DEBUG) {
 	/* log debug message */
 	char buf[80];
-	int strlen = GET_32BIT(pktin.body);
+	int stringlen = GET_32BIT(pktin.body);
 	strcpy(buf, "Remote: ");
-	if (strlen > 70)
-	    strlen = 70;
-	memcpy(buf + 8, pktin.body + 4, strlen);
-	buf[8 + strlen] = '\0';
+	if (stringlen > 70)
+	    stringlen = 70;
+	memcpy(buf + 8, pktin.body + 4, stringlen);
+	buf[8 + stringlen] = '\0';
 	logevent(buf);
 	goto next_packet;
     } else if (pktin.type == SSH1_MSG_IGNORE) {
@@ -639,6 +818,8 @@ static int ssh1_rdpkt(unsigned char **data, int *datalen)
 	memcpy(buf + nowlen, pktin.body + 4, msglen);
 	buf[nowlen + msglen] = '\0';
 	logevent(buf);
+	bombout(("Server sent disconnect message:\n\"%s\"", buf+nowlen));
+	crReturn(0);
     }
 
     crFinish(0);
@@ -682,11 +863,7 @@ static int ssh2_rdpkt(unsigned char **data, int *datalen)
 	pktin.data[st->i] = *(*data)++;
 	(*datalen)--;
     }
-#ifdef FWHACK
-    if (!memcmp(pktin.data, "Remo", 4)) {	/* "Remo"te server has closed ... */
-	/* FIXME */
-    }
-#endif
+
     if (sccipher)
 	sccipher->decrypt(pktin.data, st->cipherblk);
 
@@ -739,11 +916,6 @@ static int ssh2_rdpkt(unsigned char **data, int *datalen)
 	sccipher->decrypt(pktin.data + st->cipherblk,
 			  st->packetlen - st->cipherblk);
 
-#ifdef DUMP_PACKETS
-    debug(("Got packet len=%d pad=%d\n", st->len, st->pad));
-    dmemdump(pktin.data, st->packetlen);
-#endif
-
     /*
      * Check the MAC.
      */
@@ -776,11 +948,6 @@ static int ssh2_rdpkt(unsigned char **data, int *datalen)
 	    }
 	    pktin.length = 5 + newlen;
 	    memcpy(pktin.data + 5, newpayload, newlen);
-#ifdef DUMP_PACKETS
-	    debug(("Post-decompression payload:\n"));
-	    dmemdump(pktin.data + 5, newlen);
-#endif
-
 	    sfree(newpayload);
 	}
     }
@@ -788,30 +955,108 @@ static int ssh2_rdpkt(unsigned char **data, int *datalen)
     pktin.savedpos = 6;
     pktin.type = pktin.data[5];
 
-    if (pktin.type == SSH2_MSG_IGNORE || pktin.type == SSH2_MSG_DEBUG)
-	goto next_packet;	       /* FIXME: print DEBUG message */
-
-    if (pktin.type == SSH2_MSG_DISCONNECT) {
-	/* log reason code in disconnect message */
-	char buf[256];
-	int reason = GET_32BIT(pktin.data + 6);
-	unsigned msglen = GET_32BIT(pktin.data + 10);
-	unsigned nowlen;
-	if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
-	    sprintf(buf, "Received disconnect message (%s)",
-		    ssh2_disconnect_reasons[reason]);
-	} else {
-	    sprintf(buf, "Received disconnect message (unknown type %d)",
-		    reason);
+    log_packet(PKT_INCOMING, pktin.type, ssh2_pkt_type(pktin.type),
+	       pktin.data+6, pktin.length-6);
+
+    switch (pktin.type) {
+        /*
+         * These packets we must handle instantly.
+         */
+      case SSH2_MSG_DISCONNECT:
+        {
+            /* log reason code in disconnect message */
+            char buf[256];
+            int reason = GET_32BIT(pktin.data + 6);
+            unsigned msglen = GET_32BIT(pktin.data + 10);
+            unsigned nowlen;
+            if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
+                sprintf(buf, "Received disconnect message (%s)",
+                        ssh2_disconnect_reasons[reason]);
+            } else {
+                sprintf(buf, "Received disconnect message (unknown type %d)",
+                        reason);
+            }
+            logevent(buf);
+            strcpy(buf, "Disconnection message text: ");
+            nowlen = strlen(buf);
+            if (msglen > sizeof(buf) - nowlen - 1)
+                msglen = sizeof(buf) - nowlen - 1;
+            memcpy(buf + nowlen, pktin.data + 14, msglen);
+            buf[nowlen + msglen] = '\0';
+            logevent(buf);
+            bombout(("Server sent disconnect message\ntype %d (%s):\n\"%s\"",
+                     reason,
+                     (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
+                     ssh2_disconnect_reasons[reason] : "unknown",
+                     buf+nowlen));
+            crReturn(0);
+        }
+        break;
+      case SSH2_MSG_IGNORE:
+	goto next_packet;
+      case SSH2_MSG_DEBUG:
+	{
+	    /* log the debug message */
+	    char buf[512];
+	    /* int display = pktin.body[6]; */
+	    int stringlen = GET_32BIT(pktin.data+7);
+	    int prefix;
+	    strcpy(buf, "Remote debug message: ");
+	    prefix = strlen(buf);
+	    if (stringlen > sizeof(buf)-prefix-1)
+		stringlen = sizeof(buf)-prefix-1;
+	    memcpy(buf + prefix, pktin.data + 11, stringlen);
+	    buf[prefix + stringlen] = '\0';
+	    logevent(buf);
 	}
-	logevent(buf);
-	strcpy(buf, "Disconnection message text: ");
-	nowlen = strlen(buf);
-	if (msglen > sizeof(buf) - nowlen - 1)
-	    msglen = sizeof(buf) - nowlen - 1;
-	memcpy(buf + nowlen, pktin.data + 14, msglen);
-	buf[nowlen + msglen] = '\0';
-	logevent(buf);
+        goto next_packet;              /* FIXME: print the debug message */
+
+        /*
+         * These packets we need do nothing about here.
+         */
+      case SSH2_MSG_UNIMPLEMENTED:
+      case SSH2_MSG_SERVICE_REQUEST:
+      case SSH2_MSG_SERVICE_ACCEPT:
+      case SSH2_MSG_KEXINIT:
+      case SSH2_MSG_NEWKEYS:
+      case SSH2_MSG_KEXDH_INIT:
+      case SSH2_MSG_KEXDH_REPLY:
+      /* case SSH2_MSG_KEX_DH_GEX_REQUEST: duplicate case value */
+      /* case SSH2_MSG_KEX_DH_GEX_GROUP: duplicate case value */
+      case SSH2_MSG_KEX_DH_GEX_INIT:
+      case SSH2_MSG_KEX_DH_GEX_REPLY:
+      case SSH2_MSG_USERAUTH_REQUEST:
+      case SSH2_MSG_USERAUTH_FAILURE:
+      case SSH2_MSG_USERAUTH_SUCCESS:
+      case SSH2_MSG_USERAUTH_BANNER:
+      case SSH2_MSG_USERAUTH_PK_OK:
+      /* case SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ: duplicate case value */
+      /* case SSH2_MSG_USERAUTH_INFO_REQUEST: duplicate case value */
+      case SSH2_MSG_USERAUTH_INFO_RESPONSE:
+      case SSH2_MSG_GLOBAL_REQUEST:
+      case SSH2_MSG_REQUEST_SUCCESS:
+      case SSH2_MSG_REQUEST_FAILURE:
+      case SSH2_MSG_CHANNEL_OPEN:
+      case SSH2_MSG_CHANNEL_OPEN_CONFIRMATION:
+      case SSH2_MSG_CHANNEL_OPEN_FAILURE:
+      case SSH2_MSG_CHANNEL_WINDOW_ADJUST:
+      case SSH2_MSG_CHANNEL_DATA:
+      case SSH2_MSG_CHANNEL_EXTENDED_DATA:
+      case SSH2_MSG_CHANNEL_EOF:
+      case SSH2_MSG_CHANNEL_CLOSE:
+      case SSH2_MSG_CHANNEL_REQUEST:
+      case SSH2_MSG_CHANNEL_SUCCESS:
+      case SSH2_MSG_CHANNEL_FAILURE:
+        break;
+
+        /*
+         * For anything else we send SSH2_MSG_UNIMPLEMENTED.
+         */
+      default:
+	ssh2_pkt_init(SSH2_MSG_UNIMPLEMENTED);
+	ssh2_pkt_adduint32(st->incoming_sequence - 1);
+	ssh2_pkt_send();
+        break;
     }
 
     crFinish(0);
@@ -856,10 +1101,8 @@ static int s_wrpkt_prepare(void)
 
     pktout.body[-1] = pktout.type;
 
-#ifdef DUMP_PACKETS
-    debug(("Packet payload pre-compression:\n"));
-    dmemdump(pktout.body - 1, pktout.length + 1);
-#endif
+    log_packet(PKT_OUTGOING, pktout.type, ssh1_pkt_type(pktout.type),
+	       pktout.body, pktout.length);
 
     if (ssh1_compressing) {
 	unsigned char *compblk;
@@ -869,10 +1112,6 @@ static int s_wrpkt_prepare(void)
 	ssh1_pktout_size(complen - 1);
 	memcpy(pktout.body - 1, compblk, complen);
 	sfree(compblk);
-#ifdef DUMP_PACKETS
-	debug(("Packet payload post-compression:\n"));
-	dmemdump(pktout.body - 1, pktout.length + 1);
-#endif
     }
 
     len = pktout.length + 5;	       /* type and CRC */
@@ -885,10 +1124,6 @@ static int s_wrpkt_prepare(void)
     PUT_32BIT(pktout.data + biglen, crc);
     PUT_32BIT(pktout.data, len);
 
-#ifdef DUMP_PACKETS
-    debug(("Sending packet len=%d\n", biglen + 4));
-    dmemdump(pktout.data, biglen + 4);
-#endif
     if (cipher)
 	cipher->encrypt(pktout.data + 4, biglen);
 
@@ -897,9 +1132,11 @@ static int s_wrpkt_prepare(void)
 
 static void s_wrpkt(void)
 {
-    int len;
+    int len, backlog;
     len = s_wrpkt_prepare();
-    sk_write(s, pktout.data, len);
+    backlog = sk_write(s, pktout.data, len);
+    if (backlog > SSH_MAX_BACKLOG)
+	ssh_throttle_all(1, backlog);
 }
 
 static void s_wrpkt_defer(void)
@@ -1150,13 +1387,12 @@ static int ssh2_pkt_construct(void)
     int cipherblk, maclen, padding, i;
     static unsigned long outgoing_sequence = 0;
 
+    log_packet(PKT_OUTGOING, pktout.data[5], ssh2_pkt_type(pktout.data[5]),
+	       pktout.data + 6, pktout.length - 6);
+
     /*
      * Compress packet payload.
      */
-#ifdef DUMP_PACKETS
-    debug(("Pre-compression payload:\n"));
-    dmemdump(pktout.data + 5, pktout.length - 5);
-#endif
     {
 	unsigned char *newpayload;
 	int newlen;
@@ -1188,11 +1424,6 @@ static int ssh2_pkt_construct(void)
 			outgoing_sequence);
     outgoing_sequence++;	       /* whether or not we MACed */
 
-#ifdef DUMP_PACKETS
-    debug(("Sending packet len=%d\n", pktout.length + padding));
-    dmemdump(pktout.data, pktout.length + padding);
-#endif
-
     if (cscipher)
 	cscipher->encrypt(pktout.data, pktout.length + padding);
 
@@ -1205,8 +1436,12 @@ static int ssh2_pkt_construct(void)
  */
 static void ssh2_pkt_send(void)
 {
-    int len = ssh2_pkt_construct();
-    sk_write(s, pktout.data, len);
+    int len;
+    int backlog;
+    len = ssh2_pkt_construct();
+    backlog = sk_write(s, pktout.data, len);
+    if (backlog > SSH_MAX_BACKLOG)
+	ssh_throttle_all(1, backlog);
 }
 
 /*
@@ -1237,10 +1472,13 @@ static void ssh2_pkt_defer(void)
  */
 static void ssh_pkt_defersend(void)
 {
-    sk_write(s, deferred_send_data, deferred_len);
+    int backlog;
+    backlog = sk_write(s, deferred_send_data, deferred_len);
     deferred_len = deferred_size = 0;
     sfree(deferred_send_data);
     deferred_send_data = NULL;
+    if (backlog > SSH_MAX_BACKLOG)
+	ssh_throttle_all(1, backlog);
 }
 
 #if 0
@@ -1325,17 +1563,15 @@ static void ssh_detect_bugs(char *vstring)
     char *imp;			       /* pointer to implementation part */
     imp = vstring;
     imp += strcspn(imp, "-");
-    if (*imp)
-	imp++;
+    if (*imp) imp++;
     imp += strcspn(imp, "-");
-    if (*imp)
-	imp++;
+    if (*imp) imp++;
 
     ssh_remote_bugs = 0;
 
     if (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
 	!strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
-	!strcmp(imp, "1.2.22")) {
+	!strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25")) {
 	/*
 	 * These versions don't support SSH1_MSG_IGNORE, so we have
 	 * to use a different defence against password length
@@ -1345,6 +1581,26 @@ static void ssh_detect_bugs(char *vstring)
 	logevent("We believe remote version has SSH1 ignore bug");
     }
 
+    if (!strcmp(imp, "Cisco-1.25")) {
+	/*
+	 * These versions need a plain password sent; they can't
+	 * handle having a null and a random length of data after
+	 * the password.
+	 */
+	ssh_remote_bugs |= BUG_NEEDS_SSH1_PLAIN_PASSWORD;
+	logevent("We believe remote version needs a plain SSH1 password");
+    }
+
+    if (!strcmp(imp, "Cisco-1.25")) {
+	/*
+	 * These versions apparently have no clue whatever about
+	 * RSA authentication and will panic and die if they see
+	 * an AUTH_RSA message.
+	 */
+	ssh_remote_bugs |= BUG_CHOKES_ON_RSA;
+	logevent("We believe remote version can't handle RSA authentication");
+    }
+
     if (!strncmp(imp, "2.1.0", 5) || !strncmp(imp, "2.0.", 4) ||
 	!strncmp(imp, "2.2.0", 5) || !strncmp(imp, "2.3.0", 5) ||
 	!strncmp(imp, "2.1 ", 4)) {
@@ -1386,8 +1642,8 @@ static int do_ssh_init(unsigned char c)
 	crReturn(1);		       /* get another character */
     }
 
-    vstring = smalloc(16);
     vstrsize = 16;
+    vstring = smalloc(vstrsize);
     strcpy(vstring, "SSH-");
     vslen = 4;
     i = 0;
@@ -1413,10 +1669,10 @@ static int do_ssh_init(unsigned char c)
 
     vstring[vslen] = 0;
     vlog = smalloc(20 + vslen);
+    vstring[strcspn (vstring, "\r\n")] = '\0'; /* remove end-of-line chars */
     sprintf(vlog, "Server version: %s", vstring);
-    ssh_detect_bugs(vstring);
-    vlog[strcspn(vlog, "\r\n")] = '\0';
     logevent(vlog);
+    ssh_detect_bugs(vstring);
     sfree(vlog);
 
     /*
@@ -1499,6 +1755,9 @@ static void ssh_gotdata(unsigned char *data, int datalen)
     while (1) {
 	while (datalen > 0) {
 	    if (s_rdpkt(&data, &datalen) == 0) {
+		if (ssh_state == SSH_STATE_CLOSED) {
+		    return;
+		}
 		ssh_protocol(NULL, 0, 1);
 		if (ssh_state == SSH_STATE_CLOSED) {
 		    return;
@@ -1540,17 +1799,29 @@ static int ssh_receive(Plug plug, int urgent, char *data, int len)
     return 1;
 }
 
+static void ssh_sent(Plug plug, int bufsize)
+{
+    /*
+     * If the send backlog on the SSH socket itself clears, we
+     * should unthrottle the whole world if it was throttled.
+     */
+    if (bufsize < SSH_MAX_BACKLOG)
+	ssh_throttle_all(0, bufsize);
+}
+
 /*
  * Connect to specified host and port.
  * Returns an error message, or NULL on success.
  * Also places the canonical host name into `realhost'. It must be
  * freed by the caller.
  */
-static char *connect_to_host(char *host, int port, char **realhost)
+static char *connect_to_host(char *host, int port, char **realhost, int nodelay)
 {
     static struct plug_function_table fn_table = {
 	ssh_closing,
-	ssh_receive
+	ssh_receive,
+	ssh_sent,
+	NULL
     }, *fn_table_ptr = &fn_table;
 
     SockAddr addr;
@@ -1579,6 +1850,11 @@ static char *connect_to_host(char *host, int port, char **realhost)
     /*
      * Try to find host.
      */
+    {
+	char buf[200];
+	sprintf(buf, "Looking up host \"%.170s\"", host);
+	logevent(buf);
+    }
     addr = sk_namelookup(host, realhost);
     if ((err = sk_addr_error(addr)))
 	return err;
@@ -1590,9 +1866,17 @@ static char *connect_to_host(char *host, int port, char **realhost)
     /*
      * Open socket.
      */
-    s = sk_new(addr, port, 0, 1, &fn_table_ptr);
-    if ((err = sk_socket_error(s)))
+    {
+	char buf[200], addrbuf[100];
+	sk_getaddr(addr, addrbuf, 100);
+	sprintf(buf, "Connecting to %.100s port %d", addrbuf, port);
+	logevent(buf);
+    }
+    s = new_connection(addr, *realhost, port, 0, 1, nodelay, &fn_table_ptr);
+    if ((err = sk_socket_error(s))) {
+	s = NULL;
 	return err;
+    }
 
 #ifdef FWHACK
     sk_write(s, "connect ", 8);
@@ -1608,6 +1892,56 @@ static char *connect_to_host(char *host, int port, char **realhost)
 }
 
 /*
+ * Throttle or unthrottle the SSH connection.
+ */
+static void ssh1_throttle(int adjust)
+{
+    int old_count = ssh1_throttle_count;
+    ssh1_throttle_count += adjust;
+    assert(ssh1_throttle_count >= 0);
+    if (ssh1_throttle_count && !old_count) {
+	sk_set_frozen(s, 1);
+    } else if (!ssh1_throttle_count && old_count) {
+	sk_set_frozen(s, 0);
+    }
+}
+
+/*
+ * Throttle or unthrottle _all_ local data streams (for when sends
+ * on the SSH connection itself back up).
+ */
+static void ssh_throttle_all(int enable, int bufsize)
+{
+    int i;
+    struct ssh_channel *c;
+
+    if (enable == ssh_throttled_all)
+	return;
+    ssh_throttled_all = enable;
+    ssh_overall_bufsize = bufsize;
+    if (!ssh_channels)
+	return;
+    for (i = 0; NULL != (c = index234(ssh_channels, i)); i++) {
+	switch (c->type) {
+	  case CHAN_MAINSESSION:
+	    /*
+	     * This is treated separately, outside the switch.
+	     */
+	    break;
+	  case CHAN_X11:
+	    x11_override_throttle(c->u.x11.s, enable);
+	    break;
+	  case CHAN_AGENT:
+	    /* Agent channels require no buffer management. */
+	    break;
+	  case CHAN_SOCKDATA:
+	    pfd_override_throttle(c->u.x11.s, enable);
+	    break;
+	}
+    }
+}
+
+/*
  * Handle the key exchange and user authentication phases.
  */
 static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
@@ -1619,10 +1953,13 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
     struct RSAKey servkey, hostkey;
     struct MD5Context md5c;
     static unsigned long supported_ciphers_mask, supported_auths_mask;
-    static int tried_publickey;
+    static int tried_publickey, tried_agent;
+    static int tis_auth_refused, ccard_auth_refused;
     static unsigned char session_id[16];
     static int cipher_type;
     static char username[100];
+    static void *publickey_blob;
+    int publickey_bloblen;
 
     crBegin;
 
@@ -1712,31 +2049,45 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 
     logevent("Encrypted session key");
 
-    switch (cfg.cipher) {
-      case CIPHER_BLOWFISH:
-	cipher_type = SSH_CIPHER_BLOWFISH;
-	break;
-      case CIPHER_DES:
-	cipher_type = SSH_CIPHER_DES;
-	break;
-      case CIPHER_3DES:
-	cipher_type = SSH_CIPHER_3DES;
-	break;
-      case CIPHER_AES:
-	c_write_str("AES not supported in SSH1, falling back to 3DES\r\n");
-	cipher_type = SSH_CIPHER_3DES;
-	break;
-    }
-    if ((supported_ciphers_mask & (1 << cipher_type)) == 0) {
-	c_write_str
-	    ("Selected cipher not supported, falling back to 3DES\r\n");
-	cipher_type = SSH_CIPHER_3DES;
-	if ((supported_ciphers_mask & (1 << cipher_type)) == 0) {
-	    bombout(("Server violates SSH 1 protocol by "
-		     "not supporting 3DES encryption"));
+    {
+	int cipher_chosen = 0, warn = 0;
+	char *cipher_string = NULL;
+	for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
+	    int next_cipher = cfg.ssh_cipherlist[i];
+	    if (next_cipher == CIPHER_WARN) {
+		/* If/when we choose a cipher, warn about it */
+		warn = 1;
+	    } else if (next_cipher == CIPHER_AES) {
+		/* XXX Probably don't need to mention this. */
+		logevent("AES not supported in SSH1, skipping");
+	    } else {
+		switch (next_cipher) {
+		  case CIPHER_3DES:     cipher_type = SSH_CIPHER_3DES;
+					cipher_string = "3DES"; break;
+		  case CIPHER_BLOWFISH: cipher_type = SSH_CIPHER_BLOWFISH;
+					cipher_string = "Blowfish"; break;
+		  case CIPHER_DES:	cipher_type = SSH_CIPHER_DES;
+					cipher_string = "single-DES"; break;
+		}
+		if (supported_ciphers_mask & (1 << cipher_type))
+		    cipher_chosen = 1;
+	    }
+	}
+	if (!cipher_chosen) {
+	    if ((supported_ciphers_mask & (1 << SSH_CIPHER_3DES)) == 0)
+		bombout(("Server violates SSH 1 protocol by not "
+			 "supporting 3DES encryption"));
+	    else
+		/* shouldn't happen */
+		bombout(("No supported ciphers found"));
 	    crReturn(0);
 	}
+
+	/* Warn about chosen cipher if necessary. */
+	if (warn)
+	    askcipher(cipher_string, 0);
     }
+
     switch (cipher_type) {
       case SSH_CIPHER_3DES:
 	logevent("Using 3DES encryption");
@@ -1817,8 +2168,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 			    break;
 			  case 3:
 			  case 4:
-			    random_save_seed();
-			    exit(0);
+			    cleanup_exit(0);
 			    break;
 			  default:
 			    if (((c >= ' ' && c <= '~') ||
@@ -1853,7 +2203,19 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 
     crWaitUntil(ispkt);
 
-    tried_publickey = 0;
+    if ((ssh_remote_bugs & BUG_CHOKES_ON_RSA)) {
+	/* We must not attempt PK auth. Pretend we've already tried it. */
+	tried_publickey = tried_agent = 1;
+    } else {
+	tried_publickey = tried_agent = 0;
+    }
+    tis_auth_refused = ccard_auth_refused = 0;
+    /* Load the public half of cfg.keyfile so we notice if it's in Pageant */
+    if (*cfg.keyfile) {
+	if (!rsakey_pubblob(cfg.keyfile, &publickey_blob, &publickey_bloblen))
+	    publickey_blob = NULL;
+    } else
+	publickey_blob = NULL;
 
     while (pktin.type == SSH1_SMSG_FAILURE) {
 	static char password[100];
@@ -1861,13 +2223,9 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 	static int pos;
 	static char c;
 	static int pwpkt_type;
-	/*
-	 * Show password prompt, having first obtained it via a TIS
-	 * or CryptoCard exchange if we're doing TIS or CryptoCard
-	 * authentication.
-	 */
 	pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
-	if (agent_exists()) {
+
+	if (agent_exists() && !tried_agent) {
 	    /*
 	     * Attempt RSA authentication using Pageant.
 	     */
@@ -1877,6 +2235,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 	    static int authed = FALSE;
 	    void *r;
 
+	    tried_agent = 1;
 	    logevent("Pageant is running. Requesting keys.");
 
 	    /* Request the keys held by the agent. */
@@ -1905,6 +2264,11 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 			sprintf(buf, "Trying Pageant key #%d", i);
 			logevent(buf);
 		    }
+		    if (publickey_blob &&
+			!memcmp(p, publickey_blob, publickey_bloblen)) {
+			logevent("This key matches configured key file");
+			tried_publickey = 1;
+		    }
 		    p += 4;
 		    p += ssh1_read_bignum(p, &key.exponent);
 		    p += ssh1_read_bignum(p, &key.modulus);
@@ -1989,9 +2353,9 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 	if (*cfg.keyfile && !tried_publickey)
 	    pwpkt_type = SSH1_CMSG_AUTH_RSA;
 
-	if (pktin.type == SSH1_SMSG_FAILURE &&
-	    cfg.try_tis_auth &&
-	    (supported_auths_mask & (1 << SSH1_AUTH_TIS))) {
+	if (cfg.try_tis_auth &&
+	    (supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
+	    !tis_auth_refused) {
 	    pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
 	    logevent("Requested TIS authentication");
 	    send_packet(SSH1_CMSG_AUTH_TIS, PKT_END);
@@ -2000,6 +2364,8 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 		logevent("TIS authentication declined");
 		if (flags & FLAG_INTERACTIVE)
 		    c_write_str("TIS authentication refused.\r\n");
+		tis_auth_refused = 1;
+		continue;
 	    } else {
 		int challengelen = ((pktin.body[0] << 24) |
 				    (pktin.body[1] << 16) |
@@ -2009,12 +2375,17 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 		if (challengelen > sizeof(prompt) - 1)
 		    challengelen = sizeof(prompt) - 1;	/* prevent overrun */
 		memcpy(prompt, pktin.body + 4, challengelen);
-		prompt[challengelen] = '\0';
+		/* Prompt heuristic comes from OpenSSH */
+		strncpy(prompt + challengelen,
+		        memchr(prompt, '\n', challengelen) ?
+			"": "\r\nResponse: ",
+			(sizeof prompt) - challengelen);
+		prompt[(sizeof prompt) - 1] = '\0';
 	    }
 	}
-	if (pktin.type == SSH1_SMSG_FAILURE &&
-	    cfg.try_tis_auth &&
-	    (supported_auths_mask & (1 << SSH1_AUTH_CCARD))) {
+	if (cfg.try_tis_auth &&
+	    (supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
+	    !ccard_auth_refused) {
 	    pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
 	    logevent("Requested CryptoCard authentication");
 	    send_packet(SSH1_CMSG_AUTH_CCARD, PKT_END);
@@ -2022,6 +2393,8 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 	    if (pktin.type != SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
 		logevent("CryptoCard authentication declined");
 		c_write_str("CryptoCard authentication refused.\r\n");
+		ccard_auth_refused = 1;
+		continue;
 	    } else {
 		int challengelen = ((pktin.body[0] << 24) |
 				    (pktin.body[1] << 16) |
@@ -2031,7 +2404,9 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 		if (challengelen > sizeof(prompt) - 1)
 		    challengelen = sizeof(prompt) - 1;	/* prevent overrun */
 		memcpy(prompt, pktin.body + 4, challengelen);
-		strncpy(prompt + challengelen, "\r\nResponse : ",
+		strncpy(prompt + challengelen,
+		        memchr(prompt, '\n', challengelen) ?
+			"" : "\r\nResponse: ",
 			sizeof(prompt) - challengelen);
 		prompt[sizeof(prompt) - 1] = '\0';
 	    }
@@ -2053,6 +2428,11 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 	    sfree(comment);
 	}
 
+	/*
+	 * Show password prompt, having first obtained it via a TIS
+	 * or CryptoCard exchange if we're doing TIS or CryptoCard
+	 * authentication.
+	 */
 	if (ssh_get_line) {
 	    if (!ssh_get_line(prompt, password, sizeof(password), TRUE)) {
 		/*
@@ -2068,7 +2448,9 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 		crReturn(1);
 	    }
 	} else {
-	    c_write_str(prompt);
+	    /* Prompt may have come from server. We've munged it a bit, so
+	     * we know it to be zero-terminated at least once. */
+	    c_write_untrusted(prompt, strlen(prompt));
 	    pos = 0;
 	    ssh_send_ok = 1;
 	    while (pos >= 0) {
@@ -2091,8 +2473,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 			break;
 		      case 3:
 		      case 4:
-			random_save_seed();
-			exit(0);
+			cleanup_exit(0);
 			break;
 		      default:
 			if (pos < sizeof(password)-1)
@@ -2117,7 +2498,7 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 	    tried_publickey = 1;
 	    i = loadrsakey(cfg.keyfile, &pubkey, password);
 	    if (i == 0) {
-		c_write_str("Couldn't load public key from ");
+		c_write_str("Couldn't load private key from ");
 		c_write_str(cfg.keyfile);
 		c_write_str(".\r\n");
 		continue;	       /* go and try password */
@@ -2206,26 +2587,17 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 		 * use of the fact that the password is interpreted
 		 * as a C string: so we can append a NUL, then some
 		 * random data.
+		 * 
+		 * One server (a Cisco one) can deal with neither
+		 * SSH1_MSG_IGNORE _nor_ a padded password string.
+		 * For this server we are left with no defences
+		 * against password length sniffing.
 		 */
-		if (ssh_remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE) {
-		    char string[64];
-		    char *s;
-		    int len;
-
-		    len = strlen(password);
-		    if (len < sizeof(string)) {
-			s = string;
-			strcpy(string, password);
-			len++;	       /* cover the zero byte */
-			while (len < sizeof(string)) {
-			    string[len++] = (char) random_byte();
-			}
-		    } else {
-			s = password;
-		    }
-		    send_packet(pwpkt_type, PKT_INT, len,
-				PKT_DATA, s, len, PKT_END);
-		} else {
+		if (!(ssh_remote_bugs & BUG_CHOKES_ON_SSH1_IGNORE)) {
+		    /*
+		     * The server can deal with SSH1_MSG_IGNORE, so
+		     * we can use the primary defence.
+		     */
 		    int bottom, top, pwlen, i;
 		    char *randomstr;
 
@@ -2257,7 +2629,45 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 					 PKT_STR, randomstr, PKT_END);
 			}
 		    }
+		    logevent("Sending password with camouflage packets");
 		    ssh_pkt_defersend();
+		} 
+		else if (!(ssh_remote_bugs & BUG_NEEDS_SSH1_PLAIN_PASSWORD)) {
+		    /*
+		     * The server can't deal with SSH1_MSG_IGNORE
+		     * but can deal with padded passwords, so we
+		     * can use the secondary defence.
+		     */
+		    char string[64];
+		    char *s;
+		    int len;
+
+		    len = strlen(password);
+		    if (len < sizeof(string)) {
+			s = string;
+			strcpy(string, password);
+			len++;	       /* cover the zero byte */
+			while (len < sizeof(string)) {
+			    string[len++] = (char) random_byte();
+			}
+		    } else {
+			s = password;
+		    }
+		    logevent("Sending length-padded password");
+		    send_packet(pwpkt_type, PKT_INT, len,
+				PKT_DATA, s, len, PKT_END);
+		} else {
+		    /*
+		     * The server has _both_
+		     * BUG_CHOKES_ON_SSH1_IGNORE and
+		     * BUG_NEEDS_SSH1_PLAIN_PASSWORD. There is
+		     * therefore nothing we can do.
+		     */
+		    int len;
+		    len = strlen(password);
+		    logevent("Sending unpadded password");
+		    send_packet(pwpkt_type, PKT_INT, len,
+				PKT_DATA, password, len, PKT_END);
 		}
 	    } else {
 		send_packet(pwpkt_type, PKT_STR, password, PKT_END);
@@ -2288,34 +2698,64 @@ static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 void sshfwd_close(struct ssh_channel *c)
 {
     if (c && !c->closes) {
-	if (ssh_version == 1) {
-	    send_packet(SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
-			PKT_END);
-	} else {
-	    ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
-	    ssh2_pkt_adduint32(c->remoteid);
-	    ssh2_pkt_send();
+	/*
+	 * If the channel's remoteid is -1, we have sent
+	 * CHANNEL_OPEN for this channel, but it hasn't even been
+	 * acknowledged by the server. So we must set a close flag
+	 * on it now, and then when the server acks the channel
+	 * open, we can close it then.
+	 */
+	if (c->remoteid != -1) {
+	    if (ssh_version == 1) {
+		send_packet(SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
+			    PKT_END);
+	    } else {
+		ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
+		ssh2_pkt_adduint32(c->remoteid);
+		ssh2_pkt_send();
+	    }
 	}
 	c->closes = 1;
 	if (c->type == CHAN_X11) {
 	    c->u.x11.s = NULL;
 	    logevent("Forwarded X11 connection terminated");
-	} else if (c->type == CHAN_SOCKDATA) {
+	} else if (c->type == CHAN_SOCKDATA ||
+		   c->type == CHAN_SOCKDATA_DORMANT) {
 	    c->u.pfd.s = NULL;
 	    logevent("Forwarded port closed");
 	}
     }
 }
 
-void sshfwd_write(struct ssh_channel *c, char *buf, int len)
+int sshfwd_write(struct ssh_channel *c, char *buf, int len)
 {
     if (ssh_version == 1) {
 	send_packet(SSH1_MSG_CHANNEL_DATA,
 		    PKT_INT, c->remoteid,
 		    PKT_INT, len, PKT_DATA, buf, len, PKT_END);
+	/*
+	 * In SSH1 we can return 0 here - implying that forwarded
+	 * connections are never individually throttled - because
+	 * the only circumstance that can cause throttling will be
+	 * the whole SSH connection backing up, in which case
+	 * _everything_ will be throttled as a whole.
+	 */
+	return 0;
     } else {
 	ssh2_add_channel_data(c, buf, len);
-	ssh2_try_send(c);
+	return ssh2_try_send(c);
+    }
+}
+
+void sshfwd_unthrottle(struct ssh_channel *c, int bufsize)
+{
+    if (ssh_version == 1) {
+	if (c->v.v1.throttling && bufsize < SSH1_BUFFER_LIMIT) {
+	    c->v.v1.throttling = 0;
+	    ssh1_throttle(-1);
+	}
+    } else {
+	ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
     }
 }
 
@@ -2383,7 +2823,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 	char sports[256], dports[256], host[256];
 	char buf[1024];
 
-	ssh_rportfwds = newtree234(ssh_rportcmp);
+	ssh_rportfwds = newtree234(ssh_rportcmp_ssh1);
         /* Add port forwardings. */
 	e = cfg.portfwd;
 	while (*e) {
@@ -2416,13 +2856,14 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 		} else {
 		    struct ssh_rportfwd *pf;
 		    pf = smalloc(sizeof(*pf));
-		    strcpy(pf->host, host);
-		    pf->port = dport;
+		    strcpy(pf->dhost, host);
+		    pf->dport = dport;
 		    if (add234(ssh_rportfwds, pf) != pf) {
 			sprintf(buf, 
-				"Duplicate remote port forwarding to %s:%s",
+				"Duplicate remote port forwarding to %s:%d",
 				host, dport);
 			logevent(buf);
+			sfree(pf);
 		    } else {
 			sprintf(buf, "Requesting remote port %d forward to %s:%d",
 				sport, host, dport);
@@ -2478,12 +2919,26 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 	zlib_decompress_init();
     }
 
-    if (*cfg.remote_cmd_ptr)
-	send_packet(SSH1_CMSG_EXEC_CMD, PKT_STR, cfg.remote_cmd_ptr,
-		    PKT_END);
-    else
-	send_packet(SSH1_CMSG_EXEC_SHELL, PKT_END);
-    logevent("Started session");
+    /*
+     * Start the shell or command.
+     * 
+     * Special case: if the first-choice command is an SSH2
+     * subsystem (hence not usable here) and the second choice
+     * exists, we fall straight back to that.
+     */
+    {
+	char *cmd = cfg.remote_cmd_ptr;
+	
+	if (cfg.ssh_subsys && cfg.remote_cmd_ptr2) {
+	    cmd = cfg.remote_cmd_ptr2;
+	    ssh_fallback_cmd = TRUE;
+	}
+	if (*cmd)
+	    send_packet(SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
+	else
+	    send_packet(SSH1_CMSG_EXEC_SHELL, PKT_END);
+	logevent("Started session");
+    }
 
     ssh_state = SSH_STATE_SESSION;
     if (size_needed)
@@ -2491,7 +2946,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
     if (eof_needed)
 	ssh_special(TS_EOF);
 
-    ldisc_send(NULL, 0);	       /* cause ldisc to notice changes */
+    ldisc_send(NULL, 0, 0);	       /* cause ldisc to notice changes */
     ssh_send_ok = 1;
     ssh_channels = newtree234(ssh_channelcmp);
     while (1) {
@@ -2500,8 +2955,13 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 	    if (pktin.type == SSH1_SMSG_STDOUT_DATA ||
 		pktin.type == SSH1_SMSG_STDERR_DATA) {
 		long len = GET_32BIT(pktin.body);
-		from_backend(pktin.type == SSH1_SMSG_STDERR_DATA,
-			     pktin.body + 4, len);
+		int bufsize =
+		    from_backend(pktin.type == SSH1_SMSG_STDERR_DATA,
+				 pktin.body + 4, len);
+		if (!ssh1_stdout_throttling && bufsize > SSH1_BUFFER_LIMIT) {
+		    ssh1_stdout_throttling = 1;
+		    ssh1_throttle(+1);
+		}
 	    } else if (pktin.type == SSH1_MSG_DISCONNECT) {
 		ssh_state = SSH_STATE_CLOSED;
 		logevent("Received disconnect request");
@@ -2532,6 +2992,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 			c->remoteid = GET_32BIT(pktin.body);
 			c->localid = alloc_channel_id();
 			c->closes = 0;
+			c->v.v1.throttling = 0;
 			c->type = CHAN_X11;	/* identify channel type */
 			add234(ssh_channels, c);
 			send_packet(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
@@ -2554,6 +3015,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 		    c->remoteid = GET_32BIT(pktin.body);
 		    c->localid = alloc_channel_id();
 		    c->closes = 0;
+		    c->v.v1.throttling = 0;
 		    c->type = CHAN_AGENT;	/* identify channel type */
 		    c->u.a.lensofar = 0;
 		    add234(ssh_channels, c);
@@ -2575,13 +3037,13 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 		for(h = host, p = pktin.body+8; hostsize != 0; hostsize--) {
 		    if (h+1 < host+sizeof(host))
 			*h++ = *p;
-		    *p++;
+		    p++;
 		}
 		*h = 0;
 		port = GET_32BIT(p);
 
-		strcpy(pf.host, host);
-		pf.port = port;
+		strcpy(pf.dhost, host);
+		pf.dport = port;
 
 		if (find234(ssh_rportfwds, &pf, NULL) == NULL) {
 		    sprintf(buf, "Rejected remote port open request for %s:%d",
@@ -2606,6 +3068,7 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 			c->remoteid = GET_32BIT(pktin.body);
 			c->localid = alloc_channel_id();
 			c->closes = 0;
+			c->v.v1.throttling = 0;
 			c->type = CHAN_SOCKDATA;	/* identify channel type */
 			add234(ssh_channels, c);
 			send_packet(SSH1_MSG_CHANNEL_OPEN_CONFIRMATION,
@@ -2616,17 +3079,41 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 		}
 
 	    } else if (pktin.type == SSH1_MSG_CHANNEL_OPEN_CONFIRMATION) {
-		    unsigned int remoteid = GET_32BIT(pktin.body);
-		    unsigned int localid = GET_32BIT(pktin.body+4);
-		    struct ssh_channel *c;
-		    
-		    c = find234(ssh_channels, &remoteid, ssh_channelfind);
-		    if (c) {
-			c->remoteid = localid;
-			pfd_confirm(c->u.pfd.s);
-		    } else {
-			sshfwd_close(c);
-		    }
+		unsigned int remoteid = GET_32BIT(pktin.body);
+		unsigned int localid = GET_32BIT(pktin.body+4);
+		struct ssh_channel *c;
+
+		c = find234(ssh_channels, &remoteid, ssh_channelfind);
+		if (c && c->type == CHAN_SOCKDATA_DORMANT) {
+		    c->remoteid = localid;
+		    c->type = CHAN_SOCKDATA;
+		    c->v.v1.throttling = 0;
+		    pfd_confirm(c->u.pfd.s);
+		}
+
+		if (c && c->closes) {
+		    /*
+		     * We have a pending close on this channel,
+		     * which we decided on before the server acked
+		     * the channel open. So now we know the
+		     * remoteid, we can close it again.
+		     */
+		    send_packet(SSH1_MSG_CHANNEL_CLOSE, PKT_INT, c->remoteid,
+				PKT_END);
+		}
+
+	    } else if (pktin.type == SSH1_MSG_CHANNEL_OPEN_FAILURE) {
+		unsigned int remoteid = GET_32BIT(pktin.body);
+		unsigned int localid = GET_32BIT(pktin.body+4);
+		struct ssh_channel *c;
+
+		c = find234(ssh_channels, &remoteid, ssh_channelfind);
+		if (c && c->type == CHAN_SOCKDATA_DORMANT) {
+		    logevent("Forwarded connection refused by server");
+		    pfd_close(c->u.pfd.s);
+		    del234(ssh_channels, c);
+		    sfree(c);
+		}
 
 	    } else if (pktin.type == SSH1_MSG_CHANNEL_CLOSE ||
 		       pktin.type == SSH1_MSG_CHANNEL_CLOSE_CONFIRMATION) {
@@ -2667,13 +3154,14 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 		struct ssh_channel *c;
 		c = find234(ssh_channels, &i, ssh_channelfind);
 		if (c) {
+		    int bufsize;
 		    switch (c->type) {
 		      case CHAN_X11:
-			x11_send(c->u.x11.s, p, len);
+			bufsize = x11_send(c->u.x11.s, p, len);
 			break;
 		      case CHAN_SOCKDATA:
-			      pfd_send(c->u.pfd.s, p, len);
-			      break;
+			bufsize = pfd_send(c->u.pfd.s, p, len);
+			break;
 		      case CHAN_AGENT:
 			/* Data for an agent message. Buffer it. */
 			while (len > 0) {
@@ -2725,8 +3213,13 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 				c->u.a.lensofar = 0;
 			    }
 			}
+			bufsize = 0;   /* agent channels never back up */
 			break;
 		    }
+		    if (!c->v.v1.throttling && bufsize > SSH1_BUFFER_LIMIT) {
+			c->v.v1.throttling = 1;
+			ssh1_throttle(+1);
+		    }
 		}
 	    } else if (pktin.type == SSH1_SMSG_SUCCESS) {
 		/* may be from EXEC_SHELL on some servers */
@@ -2734,7 +3227,21 @@ static void ssh1_protocol(unsigned char *in, int inlen, int ispkt)
 		/* may be from EXEC_SHELL on some servers
 		 * if no pty is available or in other odd cases. Ignore */
 	    } else if (pktin.type == SSH1_SMSG_EXIT_STATUS) {
+		char buf[100];
+		ssh_exitcode = GET_32BIT(pktin.body);
+		sprintf(buf, "Server sent command exit status %d",
+			ssh_exitcode);
+		logevent(buf);
 		send_packet(SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
+                /*
+                 * In case `helpful' firewalls or proxies tack
+                 * extra human-readable text on the end of the
+                 * session which we might mistake for another
+                 * encrypted packet, we close the session once
+                 * we've sent EXIT_CONFIRMATION.
+                 */
+                ssh_state = SSH_STATE_CLOSED;
+                crReturnV;
 	    } else {
 		bombout(("Strange packet received: type %d", pktin.type));
 		crReturnV;
@@ -2808,7 +3315,7 @@ static void ssh2_mkkey(Bignum K, char *H, char *sessid, char chr,
  */
 static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
 {
-    static int i, j, len, nbits, pbits;
+    static int i, j, len, nbits, pbits, warn;
     static char *str;
     static Bignum p, g, e, f, K;
     static int kex_init_value, kex_reply_value;
@@ -2825,8 +3332,10 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
     static void *hkey;		       /* actual host key */
     static unsigned char exchange_hash[20];
     static unsigned char keyspace[40];
-    static const struct ssh2_ciphers *preferred_cipher;
+    static int n_preferred_ciphers;
+    static const struct ssh2_ciphers *preferred_ciphers[CIPHER_MAX];
     static const struct ssh_compress *preferred_comp;
+    static int cipherstr_started;
     static int first_kex;
 
     crBegin;
@@ -2834,27 +3343,49 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
     first_kex = 1;
 
     /*
-     * Set up the preferred cipher and compression.
+     * Set up the preferred ciphers. (NULL => warn below here)
      */
-    if (cfg.cipher == CIPHER_BLOWFISH) {
-	preferred_cipher = &ssh2_blowfish;
-    } else if (cfg.cipher == CIPHER_DES) {
-	logevent("Single DES not supported in SSH2; using 3DES");
-	preferred_cipher = &ssh2_3des;
-    } else if (cfg.cipher == CIPHER_3DES) {
-	preferred_cipher = &ssh2_3des;
-    } else if (cfg.cipher == CIPHER_AES) {
-	preferred_cipher = &ssh2_aes;
-    } else {
-	/* Shouldn't happen, but we do want to initialise to _something_. */
-	preferred_cipher = &ssh2_3des;
-    }
-    if (cfg.compression)
-	preferred_comp = &ssh_zlib;
-    else
-	preferred_comp = &ssh_comp_none;
-
-    /*
+    n_preferred_ciphers = 0;
+    for (i = 0; i < CIPHER_MAX; i++) {
+	switch (cfg.ssh_cipherlist[i]) {
+	  case CIPHER_BLOWFISH:
+	    preferred_ciphers[n_preferred_ciphers] = &ssh2_blowfish;
+	    n_preferred_ciphers++;
+	    break;
+	  case CIPHER_DES:
+	    if (cfg.ssh2_des_cbc) {
+		preferred_ciphers[n_preferred_ciphers] = &ssh2_des;
+		n_preferred_ciphers++;
+	    }
+	    break;
+	  case CIPHER_3DES:
+	    preferred_ciphers[n_preferred_ciphers] = &ssh2_3des;
+	    n_preferred_ciphers++;
+	    break;
+	  case CIPHER_AES:
+	    preferred_ciphers[n_preferred_ciphers] = &ssh2_aes;
+	    n_preferred_ciphers++;
+	    break;
+	  case CIPHER_WARN:
+	    /* Flag for later. Don't bother if it's the last in
+	     * the list. */
+	    if (i < CIPHER_MAX - 1) {
+		preferred_ciphers[n_preferred_ciphers] = NULL;
+		n_preferred_ciphers++;
+	    }
+	    break;
+	}
+    }
+
+    /*
+     * Set up preferred compression.
+     */
+    if (cfg.compression)
+	preferred_comp = &ssh_zlib;
+    else
+	preferred_comp = &ssh_comp_none;
+
+    /*
      * Be prepared to work around the buggy MAC problem.
      */
     if (cfg.buggymac || (ssh_remote_bugs & BUG_SSH2_HMAC))
@@ -2885,24 +3416,28 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
     }
     /* List client->server encryption algorithms. */
     ssh2_pkt_addstring_start();
-    for (i = 0; i < lenof(ciphers) + 1; i++) {
-	const struct ssh2_ciphers *c =
-	    i == 0 ? preferred_cipher : ciphers[i - 1];
+    cipherstr_started = 0;
+    for (i = 0; i < n_preferred_ciphers; i++) {
+	const struct ssh2_ciphers *c = preferred_ciphers[i];
+	if (!c) continue;	       /* warning flag */
 	for (j = 0; j < c->nciphers; j++) {
-	    ssh2_pkt_addstring_str(c->list[j]->name);
-	    if (i < lenof(ciphers) || j < c->nciphers - 1)
+	    if (cipherstr_started)
 		ssh2_pkt_addstring_str(",");
+	    ssh2_pkt_addstring_str(c->list[j]->name);
+	    cipherstr_started = 1;
 	}
     }
     /* List server->client encryption algorithms. */
     ssh2_pkt_addstring_start();
-    for (i = 0; i < lenof(ciphers) + 1; i++) {
-	const struct ssh2_ciphers *c =
-	    i == 0 ? preferred_cipher : ciphers[i - 1];
+    cipherstr_started = 0;
+    for (i = 0; i < n_preferred_ciphers; i++) {
+	const struct ssh2_ciphers *c = preferred_ciphers[i];
+	if (!c) continue; /* warning flag */
 	for (j = 0; j < c->nciphers; j++) {
-	    ssh2_pkt_addstring_str(c->list[j]->name);
-	    if (i < lenof(ciphers) || j < c->nciphers - 1)
+	    if (cipherstr_started)
 		ssh2_pkt_addstring_str(",");
+	    ssh2_pkt_addstring_str(c->list[j]->name);
+	    cipherstr_started = 1;
 	}
     }
     /* List client->server MAC algorithms. */
@@ -2987,31 +3522,55 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
 	}
     }
     ssh2_pkt_getstring(&str, &len);    /* client->server cipher */
-    for (i = 0; i < lenof(ciphers) + 1; i++) {
-	const struct ssh2_ciphers *c =
-	    i == 0 ? preferred_cipher : ciphers[i - 1];
-	for (j = 0; j < c->nciphers; j++) {
-	    if (in_commasep_string(c->list[j]->name, str, len)) {
-		cscipher_tobe = c->list[j];
-		break;
+    warn = 0;
+    for (i = 0; i < n_preferred_ciphers; i++) {
+	const struct ssh2_ciphers *c = preferred_ciphers[i];
+	if (!c) {
+	    warn = 1;
+	} else {
+	    for (j = 0; j < c->nciphers; j++) {
+		if (in_commasep_string(c->list[j]->name, str, len)) {
+		    cscipher_tobe = c->list[j];
+		    break;
+		}
 	    }
 	}
-	if (cscipher_tobe)
+	if (cscipher_tobe) {
+	    if (warn)
+		askcipher(cscipher_tobe->name, 1);
 	    break;
+	}
+    }
+    if (!cscipher_tobe) {
+	bombout(("Couldn't agree a client-to-server cipher (available: %s)", str));
+	crReturn(0);
     }
+
     ssh2_pkt_getstring(&str, &len);    /* server->client cipher */
-    for (i = 0; i < lenof(ciphers) + 1; i++) {
-	const struct ssh2_ciphers *c =
-	    i == 0 ? preferred_cipher : ciphers[i - 1];
-	for (j = 0; j < c->nciphers; j++) {
-	    if (in_commasep_string(c->list[j]->name, str, len)) {
-		sccipher_tobe = c->list[j];
-		break;
+    warn = 0;
+    for (i = 0; i < n_preferred_ciphers; i++) {
+	const struct ssh2_ciphers *c = preferred_ciphers[i];
+	if (!c) {
+	    warn = 1;
+	} else {
+	    for (j = 0; j < c->nciphers; j++) {
+		if (in_commasep_string(c->list[j]->name, str, len)) {
+		    sccipher_tobe = c->list[j];
+		    break;
+		}
 	    }
 	}
-	if (sccipher_tobe)
+	if (sccipher_tobe) {
+	    if (warn)
+		askcipher(sccipher_tobe->name, 2);
 	    break;
+	}
+    }
+    if (!sccipher_tobe) {
+	bombout(("Couldn't agree a server-to-client cipher (available: %s)", str));
+	crReturn(0);
     }
+
     ssh2_pkt_getstring(&str, &len);    /* client->server mac */
     for (i = 0; i < nmacs; i++) {
 	if (in_commasep_string(maclist[i]->name, str, len)) {
@@ -3068,6 +3627,7 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
      */
     if (kex == &ssh_diffiehellman_gex) {
 	logevent("Doing Diffie-Hellman group exchange");
+	ssh_pkt_ctx |= SSH2_PKTCTX_DHGEX;
 	/*
 	 * Work out how big a DH group we will need to allow that
 	 * much data.
@@ -3088,6 +3648,7 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
 	kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
 	kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
     } else {
+	ssh_pkt_ctx |= SSH2_PKTCTX_DHGROUP1;
 	dh_setup_group1();
 	kex_init_value = SSH2_MSG_KEXDH_INIT;
 	kex_reply_value = SSH2_MSG_KEXDH_REPLY;
@@ -3139,15 +3700,6 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
     }
 
     /*
-     * Expect SSH2_MSG_NEWKEYS from server.
-     */
-    crWaitUntil(ispkt);
-    if (pktin.type != SSH2_MSG_NEWKEYS) {
-	bombout(("expected new-keys packet from server"));
-	crReturn(0);
-    }
-
-    /*
      * Authenticate remote host: verify host key. (We've already
      * checked the signature of the exchange hash.)
      */
@@ -3170,6 +3722,15 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
     ssh2_pkt_send();
 
     /*
+     * Expect SSH2_MSG_NEWKEYS from server.
+     */
+    crWaitUntil(ispkt);
+    if (pktin.type != SSH2_MSG_NEWKEYS) {
+	bombout(("expected new-keys packet from server"));
+	crReturn(0);
+    }
+
+    /*
      * Create and initialise session keys.
      */
     cscipher = cscipher_tobe;
@@ -3233,33 +3794,57 @@ static int do_ssh2_transport(unsigned char *in, int inlen, int ispkt)
 static void ssh2_add_channel_data(struct ssh_channel *c, char *buf,
 				  int len)
 {
-    if (c->v2.outbufsize < c->v2.outbuflen + len) {
-	c->v2.outbufsize = c->v2.outbuflen + len + 1024;
-	c->v2.outbuffer = srealloc(c->v2.outbuffer, c->v2.outbufsize);
-    }
-    memcpy(c->v2.outbuffer + c->v2.outbuflen, buf, len);
-    c->v2.outbuflen += len;
+    bufchain_add(&c->v.v2.outbuffer, buf, len);
 }
 
 /*
  * Attempt to send data on an SSH2 channel.
  */
-static void ssh2_try_send(struct ssh_channel *c)
+static int ssh2_try_send(struct ssh_channel *c)
 {
-    while (c->v2.remwindow > 0 && c->v2.outbuflen > 0) {
-	unsigned len = c->v2.remwindow;
-	if (len > c->v2.outbuflen)
-	    len = c->v2.outbuflen;
-	if (len > c->v2.remmaxpkt)
-	    len = c->v2.remmaxpkt;
+    while (c->v.v2.remwindow > 0 && bufchain_size(&c->v.v2.outbuffer) > 0) {
+	int len;
+	void *data;
+	bufchain_prefix(&c->v.v2.outbuffer, &data, &len);
+	if ((unsigned)len > c->v.v2.remwindow)
+	    len = c->v.v2.remwindow;
+	if ((unsigned)len > c->v.v2.remmaxpkt)
+	    len = c->v.v2.remmaxpkt;
 	ssh2_pkt_init(SSH2_MSG_CHANNEL_DATA);
 	ssh2_pkt_adduint32(c->remoteid);
 	ssh2_pkt_addstring_start();
-	ssh2_pkt_addstring_data(c->v2.outbuffer, len);
+	ssh2_pkt_addstring_data(data, len);
+	ssh2_pkt_send();
+	bufchain_consume(&c->v.v2.outbuffer, len);
+	c->v.v2.remwindow -= len;
+    }
+
+    /*
+     * After having sent as much data as we can, return the amount
+     * still buffered.
+     */
+    return bufchain_size(&c->v.v2.outbuffer);
+}
+
+/*
+ * Potentially enlarge the window on an SSH2 channel.
+ */
+static void ssh2_set_window(struct ssh_channel *c, unsigned newwin)
+{
+    /*
+     * Never send WINDOW_ADJUST for a channel that the remote side
+     * already thinks it's closed; there's no point, since it won't
+     * be sending any more data anyway.
+     */
+    if (c->closes != 0)
+	return;
+
+    if (newwin > c->v.v2.locwindow) {
+	ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
+	ssh2_pkt_adduint32(c->remoteid);
+	ssh2_pkt_adduint32(newwin - c->v.v2.locwindow);
 	ssh2_pkt_send();
-	c->v2.outbuflen -= len;
-	memmove(c->v2.outbuffer, c->v2.outbuffer + len, c->v2.outbuflen);
-	c->v2.remwindow -= len;
+	c->v.v2.locwindow = newwin;
     }
 }
 
@@ -3279,15 +3864,20 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 	AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
 	AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
 	AUTH_TYPE_PASSWORD,
-	AUTH_TYPE_KEYBOARD_INTERACTIVE
+	AUTH_TYPE_KEYBOARD_INTERACTIVE,
+	AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
     } type;
     static int gotit, need_pw, can_pubkey, can_passwd, can_keyb_inter;
     static int tried_pubkey_config, tried_agent, tried_keyb_inter;
+    static int kbd_inter_running;
     static int we_are_in;
     static int num_prompts, echo;
     static char username[100];
+    static int got_username;
     static char pwprompt[200];
     static char password[100];
+    static void *publickey_blob;
+    static int publickey_bloblen;
 
     crBegin;
 
@@ -3327,6 +3917,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
      *    the username they will want to be able to get back and
      *    retype it!
      */
+    username[0] = '\0';
+    got_username = FALSE;
     do {
 	static int pos;
 	static char c;
@@ -3335,7 +3927,13 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 	 * Get a username.
 	 */
 	pos = 0;
-	if ((flags & FLAG_INTERACTIVE) && !*cfg.username) {
+	if (got_username && !cfg.change_username) {
+	    /*
+	     * We got a username last time round this loop, and
+	     * with change_username turned off we don't try to get
+	     * it again.
+	     */
+	} else if ((flags & FLAG_INTERACTIVE) && !*cfg.username) {
 	    if (ssh_get_line) {
 		if (!ssh_get_line("login as: ",
 				  username, sizeof(username), FALSE)) {
@@ -3375,8 +3973,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 			    break;
 			  case 3:
 			  case 4:
-			    random_save_seed();
-			    exit(0);
+			    cleanup_exit(0);
 			    break;
 			  default:
 			    if (((c >= ' ' && c <= '~') ||
@@ -3400,12 +3997,15 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		c_write_str(stuff);
 	    }
 	}
+	got_username = TRUE;
 
 	/*
 	 * Send an authentication request using method "none": (a)
 	 * just in case it succeeds, and (b) so that we know what
 	 * authentication methods we can usefully try next.
 	 */
+	ssh_pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
+
 	ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
 	ssh2_pkt_addstring(username);
 	ssh2_pkt_addstring("ssh-connection");	/* service requested */
@@ -3417,6 +4017,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 
 	tried_pubkey_config = FALSE;
 	tried_agent = FALSE;
+	tried_keyb_inter = FALSE;
+	kbd_inter_running = FALSE;
+	/* Load the pub half of cfg.keyfile so we notice if it's in Pageant */
+	if (*cfg.keyfile) {
+	    publickey_blob = ssh2_userkey_loadpub(cfg.keyfile, NULL,
+						  &publickey_bloblen);
+	} else
+	    publickey_blob = NULL;
 
 	while (1) {
 	    /*
@@ -3448,9 +4056,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		break;
 	    }
 
-	    if (pktin.type != SSH2_MSG_USERAUTH_FAILURE) {
-		bombout(
-			("Strange packet received during authentication: type %d",
+	    if (kbd_inter_running &&
+		pktin.type == SSH2_MSG_USERAUTH_INFO_REQUEST) {
+		/*
+		 * This is a further prompt in keyboard-interactive
+		 * authentication. Do nothing.
+		 */
+	    } else if (pktin.type != SSH2_MSG_USERAUTH_FAILURE) {
+		bombout(("Strange packet received during authentication: type %d",
 			 pktin.type));
 		crReturnV;
 	    }
@@ -3462,10 +4075,11 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 	     * we can look at the string in it and know what we can
 	     * helpfully try next.
 	     */
-	    {
+	    if (pktin.type == SSH2_MSG_USERAUTH_FAILURE) {
 		char *methods;
 		int methlen;
 		ssh2_pkt_getstring(&methods, &methlen);
+		kbd_inter_running = FALSE;
 		if (!ssh2_pkt_getbool()) {
 		    /*
 		     * We have received an unequivocal Access
@@ -3495,6 +4109,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 			if (type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
 			    c_write_str("Server refused our key\r\n");
 			logevent("Server refused public key");
+		    } else if (type == AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
+			/* server declined keyboard-interactive; ignore */
 		    } else {
 			c_write_str("Access denied\r\n");
 			logevent("Access denied");
@@ -3512,57 +4128,12 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		    in_commasep_string("publickey", methods, methlen);
 		can_passwd =
 		    in_commasep_string("password", methods, methlen);
-		can_passwd =
-		    in_commasep_string("password", methods, methlen);
-		can_keyb_inter = 
+		can_keyb_inter = cfg.try_ki_auth &&
 		    in_commasep_string("keyboard-interactive", methods, methlen);
 	    }
 
 	    method = 0;
-
-	    if (!method && can_keyb_inter && !tried_keyb_inter) {
-		method = AUTH_KEYBOARD_INTERACTIVE;
-		type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
-		tried_keyb_inter = TRUE;
-
-		ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		ssh2_pkt_addstring(username);
-		ssh2_pkt_addstring("ssh-connection");	/* service requested */
-		ssh2_pkt_addstring("keyboard-interactive");	/* method */
-		ssh2_pkt_addstring(""); /* lang */
-		ssh2_pkt_addstring("");
-		ssh2_pkt_send();
-
-		crWaitUntilV(ispkt);
-		if (pktin.type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
-		    if (pktin.type == SSH2_MSG_USERAUTH_FAILURE)
-			gotit = TRUE;
-		    logevent("Keyboard-interactive authentication refused");
-		    type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
-		    continue;
-		}
-
-		/* We've got packet with that "interactive" info
-		   dump banners, and set its prompt as ours */
-		{
-		    char *name, *inst, *lang, *prompt;
-		    int name_len, inst_len, lang_len, prompt_len;
-		    ssh2_pkt_getstring(&name, &name_len);
-		    ssh2_pkt_getstring(&inst, &inst_len);
-		    ssh2_pkt_getstring(&lang, &lang_len);
-		    if (name_len > 0)
-			c_write_untrusted(name, name_len);
-		    if (inst_len > 0)
-			c_write_untrusted(inst, inst_len);
-		    num_prompts = ssh2_pkt_getuint32();
-
-		    ssh2_pkt_getstring(&prompt, &prompt_len);
-		    strncpy(pwprompt, prompt, sizeof(pwprompt));
-		    need_pw = TRUE;
-
-		    echo = ssh2_pkt_getbool();
-		}
-	    }
+	    ssh_pkt_ctx &= ~SSH2_PKTCTX_AUTH_MASK;
 
 	    if (!method && can_pubkey && agent_exists() && !tried_agent) {
 		/*
@@ -3574,6 +4145,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		static int authed = FALSE;
 		void *r;
 
+		ssh_pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
+
 		tried_agent = TRUE;
 
 		logevent("Pageant is running. Requesting keys.");
@@ -3607,6 +4180,12 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 			}
 			pklen = GET_32BIT(p);
 			p += 4;
+			if (publickey_blob &&
+			    pklen == publickey_bloblen &&
+			    !memcmp(p, publickey_blob, publickey_bloblen)) {
+			    logevent("This key matches configured key file");
+			    tried_pubkey_config = 1;
+			}
 			pkblob = p;
 			p += pklen;
 			alglen = GET_32BIT(pkblob);
@@ -3710,6 +4289,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 
 		tried_pubkey_config = TRUE;
 
+		ssh_pkt_ctx |= SSH2_PKTCTX_PUBLICKEY;
+
 		/*
 		 * Try the public key supplied in the configuration.
 		 *
@@ -3757,8 +4338,67 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		}
 	    }
 
+	    if (!method && can_keyb_inter && !tried_keyb_inter) {
+		method = AUTH_KEYBOARD_INTERACTIVE;
+		type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
+		tried_keyb_inter = TRUE;
+
+		ssh_pkt_ctx |= SSH2_PKTCTX_KBDINTER;
+
+		ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
+		ssh2_pkt_addstring(username);
+		ssh2_pkt_addstring("ssh-connection");	/* service requested */
+		ssh2_pkt_addstring("keyboard-interactive");	/* method */
+		ssh2_pkt_addstring(""); /* lang */
+		ssh2_pkt_addstring("");
+		ssh2_pkt_send();
+
+		crWaitUntilV(ispkt);
+		if (pktin.type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
+		    if (pktin.type == SSH2_MSG_USERAUTH_FAILURE)
+			gotit = TRUE;
+		    logevent("Keyboard-interactive authentication refused");
+		    type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
+		    continue;
+		}
+
+		kbd_inter_running = TRUE;
+	    }
+
+	    if (kbd_inter_running) {
+		method = AUTH_KEYBOARD_INTERACTIVE;
+		type = AUTH_TYPE_KEYBOARD_INTERACTIVE;
+		tried_keyb_inter = TRUE;
+
+		ssh_pkt_ctx |= SSH2_PKTCTX_KBDINTER;
+
+		/* We've got packet with that "interactive" info
+		   dump banners, and set its prompt as ours */
+		{
+		    char *name, *inst, *lang, *prompt;
+		    int name_len, inst_len, lang_len, prompt_len;
+		    ssh2_pkt_getstring(&name, &name_len);
+		    ssh2_pkt_getstring(&inst, &inst_len);
+		    ssh2_pkt_getstring(&lang, &lang_len);
+		    if (name_len > 0)
+			c_write_untrusted(name, name_len);
+		    if (inst_len > 0)
+			c_write_untrusted(inst, inst_len);
+		    num_prompts = ssh2_pkt_getuint32();
+
+		    ssh2_pkt_getstring(&prompt, &prompt_len);
+		    strncpy(pwprompt, prompt, sizeof(pwprompt));
+		    pwprompt[prompt_len < sizeof(pwprompt) ?
+			     prompt_len : sizeof(pwprompt)-1] = '\0';
+		    need_pw = TRUE;
+
+		    echo = ssh2_pkt_getbool();
+		}
+	    }
+
 	    if (!method && can_passwd) {
 		method = AUTH_PASSWORD;
+		ssh_pkt_ctx |= SSH2_PKTCTX_PASSWORD;
 		sprintf(pwprompt, "%.90s@%.90s's password: ", username,
 			savedhost);
 		need_pw = TRUE;
@@ -3812,8 +4452,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 				break;
 			      case 3:
 			      case 4:
-				random_save_seed();
-				exit(0);
+				cleanup_exit(0);
 				break;
 			      default:
 				if (pos < sizeof(password)-1)
@@ -3988,7 +4627,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
     ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
     ssh2_pkt_addstring("session");
     ssh2_pkt_adduint32(mainchan->localid);
-    ssh2_pkt_adduint32(0x8000UL);      /* our window size */
+    mainchan->v.v2.locwindow = OUR_V2_WINSIZE;
+    ssh2_pkt_adduint32(mainchan->v.v2.locwindow);      /* our window size */
     ssh2_pkt_adduint32(0x4000UL);      /* our max pkt size */
     ssh2_pkt_send();
     crWaitUntilV(ispkt);
@@ -4004,10 +4644,9 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
     mainchan->remoteid = ssh2_pkt_getuint32();
     mainchan->type = CHAN_MAINSESSION;
     mainchan->closes = 0;
-    mainchan->v2.remwindow = ssh2_pkt_getuint32();
-    mainchan->v2.remmaxpkt = ssh2_pkt_getuint32();
-    mainchan->v2.outbuffer = NULL;
-    mainchan->v2.outbuflen = mainchan->v2.outbufsize = 0;
+    mainchan->v.v2.remwindow = ssh2_pkt_getuint32();
+    mainchan->v.v2.remmaxpkt = ssh2_pkt_getuint32();
+    bufchain_init(&mainchan->v.v2.outbuffer);
     add234(ssh_channels, mainchan);
     logevent("Opened channel for session");
 
@@ -4036,13 +4675,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		c = find234(ssh_channels, &i, ssh_channelfind);
 		if (!c)
 		    continue;	       /* nonexistent channel */
-		c->v2.remwindow += ssh2_pkt_getuint32();
+		c->v.v2.remwindow += ssh2_pkt_getuint32();
 	    }
 	} while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 
 	if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
 	    if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
-		bombout(("Server got confused by X11 forwarding request"));
+		bombout(("Unexpected response to X11 forwarding request:"
+			 " packet type %d", pktin.type));
 		crReturnV;
 	    }
 	    logevent("X11 forwarding refused");
@@ -4053,6 +4693,102 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
     }
 
     /*
+     * Enable port forwardings.
+     */
+    {
+	static char *e;		       /* preserve across crReturn */
+	char type;
+	int n;
+	int sport,dport;
+	char sports[256], dports[256], host[256];
+	char buf[1024];
+
+	ssh_rportfwds = newtree234(ssh_rportcmp_ssh2);
+        /* Add port forwardings. */
+	e = cfg.portfwd;
+	while (*e) {
+	    type = *e++;
+	    n = 0;
+	    while (*e && *e != '\t')
+		sports[n++] = *e++;
+	    sports[n] = 0;
+	    if (*e == '\t')
+		e++;
+	    n = 0;
+	    while (*e && *e != ':')
+		host[n++] = *e++;
+	    host[n] = 0;
+	    if (*e == ':')
+		e++;
+	    n = 0;
+	    while (*e)
+		dports[n++] = *e++;
+	    dports[n] = 0;
+	    e++;
+	    dport = atoi(dports);
+	    sport = atoi(sports);
+	    if (sport && dport) {
+		if (type == 'L') {
+		    pfd_addforward(host, dport, sport);
+		    sprintf(buf, "Local port %d forwarding to %s:%d",
+			    sport, host, dport);
+		    logevent(buf);
+		} else {
+		    struct ssh_rportfwd *pf;
+		    pf = smalloc(sizeof(*pf));
+		    strcpy(pf->dhost, host);
+		    pf->dport = dport;
+		    pf->sport = sport;
+		    if (add234(ssh_rportfwds, pf) != pf) {
+			sprintf(buf, 
+				"Duplicate remote port forwarding to %s:%d",
+				host, dport);
+			logevent(buf);
+			sfree(pf);
+		    } else {
+			sprintf(buf, "Requesting remote port %d (forwarded to %s:%d)",
+				sport, host, dport);
+			logevent(buf);
+			ssh2_pkt_init(SSH2_MSG_GLOBAL_REQUEST);
+			ssh2_pkt_addstring("tcpip-forward");
+			ssh2_pkt_addbool(1);/* want reply */
+			if (cfg.rport_acceptall)
+			    ssh2_pkt_addstring("0.0.0.0");
+			else
+			    ssh2_pkt_addstring("127.0.0.1");
+			ssh2_pkt_adduint32(sport);
+			ssh2_pkt_send();
+
+			do {
+			    crWaitUntilV(ispkt);
+			    if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
+				unsigned i = ssh2_pkt_getuint32();
+				struct ssh_channel *c;
+				c = find234(ssh_channels, &i, ssh_channelfind);
+				if (!c)
+				    continue;/* nonexistent channel */
+				c->v.v2.remwindow += ssh2_pkt_getuint32();
+			    }
+			} while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
+
+			if (pktin.type != SSH2_MSG_REQUEST_SUCCESS) {
+			    if (pktin.type != SSH2_MSG_REQUEST_FAILURE) {
+				bombout(("Unexpected response to port "
+					 "forwarding request: packet type %d",
+					 pktin.type));
+				crReturnV;
+			    }
+			    logevent("Server refused this port forwarding");
+			} else {
+			    logevent("Remote port forwarding enabled");
+			}
+		    }
+		}
+	    }
+	}
+    }
+
+    /*
      * Potentially enable agent forwarding.
      */
     if (cfg.agentfwd && agent_exists()) {
@@ -4071,14 +4807,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		c = find234(ssh_channels, &i, ssh_channelfind);
 		if (!c)
 		    continue;	       /* nonexistent channel */
-		c->v2.remwindow += ssh2_pkt_getuint32();
+		c->v.v2.remwindow += ssh2_pkt_getuint32();
 	    }
 	} while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 
 	if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
 	    if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
-		bombout(
-			("Server got confused by agent forwarding request"));
+		bombout(("Unexpected response to agent forwarding request:"
+			 " packet type %d", pktin.type));
 		crReturnV;
 	    }
 	    logevent("Agent forwarding refused");
@@ -4114,13 +4850,14 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		c = find234(ssh_channels, &i, ssh_channelfind);
 		if (!c)
 		    continue;	       /* nonexistent channel */
-		c->v2.remwindow += ssh2_pkt_getuint32();
+		c->v.v2.remwindow += ssh2_pkt_getuint32();
 	    }
 	} while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 
 	if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
 	    if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
-		bombout(("Server got confused by pty request"));
+		bombout(("Unexpected response to pty request:"
+			 " packet type %d", pktin.type));
 		crReturnV;
 	    }
 	    c_write_str("Server refused to allocate pty\r\n");
@@ -4133,43 +4870,71 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
     }
 
     /*
-     * Start a shell or a remote command.
+     * Start a shell or a remote command. We may have to attempt
+     * this twice if the config data has provided a second choice
+     * of command.
      */
-    ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
-    ssh2_pkt_adduint32(mainchan->remoteid);	/* recipient channel */
-    if (cfg.ssh_subsys) {
-	ssh2_pkt_addstring("subsystem");
-	ssh2_pkt_addbool(1);	       /* want reply */
-	ssh2_pkt_addstring(cfg.remote_cmd_ptr);
-    } else if (*cfg.remote_cmd_ptr) {
-	ssh2_pkt_addstring("exec");
-	ssh2_pkt_addbool(1);	       /* want reply */
-	ssh2_pkt_addstring(cfg.remote_cmd_ptr);
-    } else {
-	ssh2_pkt_addstring("shell");
-	ssh2_pkt_addbool(1);	       /* want reply */
-    }
-    ssh2_pkt_send();
-    do {
-	crWaitUntilV(ispkt);
-	if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
-	    unsigned i = ssh2_pkt_getuint32();
-	    struct ssh_channel *c;
-	    c = find234(ssh_channels, &i, ssh_channelfind);
-	    if (!c)
-		continue;	       /* nonexistent channel */
-	    c->v2.remwindow += ssh2_pkt_getuint32();
+    while (1) {
+	int subsys;
+	char *cmd;
+
+	if (ssh_fallback_cmd) {
+	    subsys = cfg.ssh_subsys2;
+	    cmd = cfg.remote_cmd_ptr2;
+	} else {
+	    subsys = cfg.ssh_subsys;
+	    cmd = cfg.remote_cmd_ptr;
 	}
-    } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
-    if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
-	if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
-	    bombout(("Server got confused by shell/command request"));
+
+	ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
+	ssh2_pkt_adduint32(mainchan->remoteid);	/* recipient channel */
+	if (subsys) {
+	    ssh2_pkt_addstring("subsystem");
+	    ssh2_pkt_addbool(1);	       /* want reply */
+	    ssh2_pkt_addstring(cmd);
+	} else if (*cmd) {
+	    ssh2_pkt_addstring("exec");
+	    ssh2_pkt_addbool(1);	       /* want reply */
+	    ssh2_pkt_addstring(cmd);
+	} else {
+	    ssh2_pkt_addstring("shell");
+	    ssh2_pkt_addbool(1);	       /* want reply */
+	}
+	ssh2_pkt_send();
+	do {
+	    crWaitUntilV(ispkt);
+	    if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
+		unsigned i = ssh2_pkt_getuint32();
+		struct ssh_channel *c;
+		c = find234(ssh_channels, &i, ssh_channelfind);
+		if (!c)
+		    continue;	       /* nonexistent channel */
+		c->v.v2.remwindow += ssh2_pkt_getuint32();
+	    }
+	} while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
+	if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
+	    if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
+		bombout(("Unexpected response to shell/command request:"
+			 " packet type %d", pktin.type));
+		crReturnV;
+	    }
+	    /*
+	     * We failed to start the command. If this is the
+	     * fallback command, we really are finished; if it's
+	     * not, and if the fallback command exists, try falling
+	     * back to it before complaining.
+	     */
+	    if (!ssh_fallback_cmd && cfg.remote_cmd_ptr2 != NULL) {
+		logevent("Primary command failed; attempting fallback");
+		ssh_fallback_cmd = TRUE;
+		continue;
+	    }
+	    bombout(("Server refused to start a shell/command"));
 	    crReturnV;
+	} else {
+	    logevent("Started a shell/command");
 	}
-	bombout(("Server refused to start a shell/command"));
-	crReturnV;
-    } else {
-	logevent("Started a shell/command");
+	break;
     }
 
     ssh_state = SSH_STATE_SESSION;
@@ -4181,7 +4946,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
     /*
      * Transfer data!
      */
-    ldisc_send(NULL, 0);	       /* cause ldisc to notice changes */
+    ldisc_send(NULL, 0, 0);	       /* cause ldisc to notice changes */
     ssh_send_ok = 1;
     while (1) {
 	static int try_send;
@@ -4202,18 +4967,21 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		    continue;	       /* extended but not stderr */
 		ssh2_pkt_getstring(&data, &length);
 		if (data) {
+		    int bufsize;
+		    c->v.v2.locwindow -= length;
 		    switch (c->type) {
 		      case CHAN_MAINSESSION:
-			from_backend(pktin.type ==
-				     SSH2_MSG_CHANNEL_EXTENDED_DATA, data,
-				     length);
+			bufsize =
+			    from_backend(pktin.type ==
+					 SSH2_MSG_CHANNEL_EXTENDED_DATA,
+					 data, length);
 			break;
 		      case CHAN_X11:
-			x11_send(c->u.x11.s, data, length);
+			bufsize = x11_send(c->u.x11.s, data, length);
 			break;
 		      case CHAN_SOCKDATA:
-			      pfd_send(c->u.pfd.s, data, length);
-			      break;
+			bufsize = pfd_send(c->u.pfd.s, data, length);
+			break;
 		      case CHAN_AGENT:
 			while (length > 0) {
 			    if (c->u.a.lensofar < 4) {
@@ -4262,24 +5030,20 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 				c->u.a.lensofar = 0;
 			    }
 			}
+			bufsize = 0;
 			break;
 		    }
 		    /*
-		     * Enlarge the window again at the remote
-		     * side, just in case it ever runs down and
-		     * they fail to send us any more data.
+		     * If we are not buffering too much data,
+		     * enlarge the window again at the remote side.
 		     */
-		    ssh2_pkt_init(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
-		    ssh2_pkt_adduint32(c->remoteid);
-		    ssh2_pkt_adduint32(length);
-		    ssh2_pkt_send();
+		    if (bufsize < OUR_V2_WINSIZE)
+			ssh2_set_window(c, OUR_V2_WINSIZE - bufsize);
 		}
 	    } else if (pktin.type == SSH2_MSG_DISCONNECT) {
 		ssh_state = SSH_STATE_CLOSED;
 		logevent("Received disconnect message");
 		crReturnV;
-	    } else if (pktin.type == SSH2_MSG_CHANNEL_REQUEST) {
-		continue;	       /* exit status et al; ignore (FIXME?) */
 	    } else if (pktin.type == SSH2_MSG_CHANNEL_EOF) {
 		unsigned i = ssh2_pkt_getuint32();
 		struct ssh_channel *c;
@@ -4298,8 +5062,8 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		} else if (c->type == CHAN_AGENT) {
 		    sshfwd_close(c);
 		} else if (c->type == CHAN_SOCKDATA) {
-			pfd_close(c->u.pfd.s);
-			sshfwd_close(c);
+		    pfd_close(c->u.pfd.s);
+		    sshfwd_close(c);
 		}
 	    } else if (pktin.type == SSH2_MSG_CHANNEL_CLOSE) {
 		unsigned i = ssh2_pkt_getuint32();
@@ -4308,36 +5072,56 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		c = find234(ssh_channels, &i, ssh_channelfind);
 		if (!c)
 		    continue;	       /* nonexistent channel */
-		if (c->closes == 0) {
-		    ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
-		    ssh2_pkt_adduint32(c->remoteid);
-		    ssh2_pkt_send();
-		}
 		/* Do pre-close processing on the channel. */
 		switch (c->type) {
 		  case CHAN_MAINSESSION:
 		    break;	       /* nothing to see here, move along */
 		  case CHAN_X11:
+		    if (c->u.x11.s != NULL)
+			x11_close(c->u.x11.s);
+		    sshfwd_close(c);
 		    break;
 		  case CHAN_AGENT:
+		    sshfwd_close(c);
 		    break;
 		  case CHAN_SOCKDATA:
-			  break;
+		    if (c->u.pfd.s != NULL)
+			pfd_close(c->u.pfd.s);
+		    sshfwd_close(c);
+		    break;
+		}
+		if (c->closes == 0) {
+		    ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
+		    ssh2_pkt_adduint32(c->remoteid);
+		    ssh2_pkt_send();
 		}
 		del234(ssh_channels, c);
-		sfree(c->v2.outbuffer);
+		bufchain_clear(&c->v.v2.outbuffer);
 		sfree(c);
 
 		/*
 		 * See if that was the last channel left open.
 		 */
 		if (count234(ssh_channels) == 0) {
+#if 0
+                    /*
+                     * We used to send SSH_MSG_DISCONNECT here,
+                     * because I'd believed that _every_ conforming
+                     * SSH2 connection had to end with a disconnect
+                     * being sent by at least one side; apparently
+                     * I was wrong and it's perfectly OK to
+                     * unceremoniously slam the connection shut
+                     * when you're done, and indeed OpenSSH feels
+                     * this is more polite than sending a
+                     * DISCONNECT. So now we don't.
+                     */
 		    logevent("All channels closed. Disconnecting");
 		    ssh2_pkt_init(SSH2_MSG_DISCONNECT);
 		    ssh2_pkt_adduint32(SSH2_DISCONNECT_BY_APPLICATION);
 		    ssh2_pkt_addstring("All open channels closed");
 		    ssh2_pkt_addstring("en");	/* language tag */
 		    ssh2_pkt_send();
+#endif
 		    ssh_state = SSH_STATE_CLOSED;
 		    crReturnV;
 		}
@@ -4348,16 +5132,140 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		c = find234(ssh_channels, &i, ssh_channelfind);
 		if (!c)
 		    continue;	       /* nonexistent channel */
-		c->v2.remwindow += ssh2_pkt_getuint32();
+		c->v.v2.remwindow += ssh2_pkt_getuint32();
 		try_send = TRUE;
+	    } else if (pktin.type == SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
+		unsigned i = ssh2_pkt_getuint32();
+		struct ssh_channel *c;
+		c = find234(ssh_channels, &i, ssh_channelfind);
+		if (!c)
+		    continue;	       /* nonexistent channel */
+		if (c->type != CHAN_SOCKDATA_DORMANT)
+		    continue;	       /* dunno why they're confirming this */
+		c->remoteid = ssh2_pkt_getuint32();
+		c->type = CHAN_SOCKDATA;
+		c->v.v2.remwindow = ssh2_pkt_getuint32();
+		c->v.v2.remmaxpkt = ssh2_pkt_getuint32();
+		bufchain_init(&c->v.v2.outbuffer);
+		if (c->u.pfd.s)
+		    pfd_confirm(c->u.pfd.s);
+		if (c->closes) {
+		    /*
+		     * We have a pending close on this channel,
+		     * which we decided on before the server acked
+		     * the channel open. So now we know the
+		     * remoteid, we can close it again.
+		     */
+		    ssh2_pkt_init(SSH2_MSG_CHANNEL_CLOSE);
+		    ssh2_pkt_adduint32(c->remoteid);
+		    ssh2_pkt_send();
+		}
+	    } else if (pktin.type == SSH2_MSG_CHANNEL_OPEN_FAILURE) {
+		unsigned i = ssh2_pkt_getuint32();
+		struct ssh_channel *c;
+		c = find234(ssh_channels, &i, ssh_channelfind);
+		if (!c)
+		    continue;	       /* nonexistent channel */
+		if (c->type != CHAN_SOCKDATA_DORMANT)
+		    continue;	       /* dunno why they're failing this */
+
+		logevent("Forwarded connection refused by server");
+
+		pfd_close(c->u.pfd.s);
+
+		del234(ssh_channels, c);
+		sfree(c);
+	    } else if (pktin.type == SSH2_MSG_CHANNEL_REQUEST) {
+ 		unsigned localid;
+		char *type;
+		int typelen, want_reply;
+		struct ssh_channel *c;
+
+		localid = ssh2_pkt_getuint32();
+		ssh2_pkt_getstring(&type, &typelen);
+		want_reply = ssh2_pkt_getbool();
+
+		/*
+		 * First, check that the channel exists. Otherwise,
+		 * we can instantly disconnect with a rude message.
+		 */
+		c = find234(ssh_channels, &localid, ssh_channelfind);
+		if (!c) {
+		    char buf[80];
+		    sprintf(buf, "Received channel request for nonexistent"
+			    " channel %d", localid);
+		    logevent(buf);
+		    ssh2_pkt_init(SSH2_MSG_DISCONNECT);
+		    ssh2_pkt_adduint32(SSH2_DISCONNECT_BY_APPLICATION);
+		    ssh2_pkt_addstring(buf);
+		    ssh2_pkt_addstring("en");	/* language tag */
+		    ssh2_pkt_send();
+		    connection_fatal(buf);
+		    ssh_state = SSH_STATE_CLOSED;
+		    crReturnV;
+		}
+
+		/*
+		 * Having got the channel number, we now look at
+		 * the request type string to see if it's something
+		 * we recognise.
+		 */
+		if (typelen == 11 && !memcmp(type, "exit-status", 11) &&
+		    c == mainchan) {
+		    /* We recognise "exit-status" on the primary channel. */
+		    char buf[100];
+		    ssh_exitcode = ssh2_pkt_getuint32();
+		    sprintf(buf, "Server sent command exit status %d",
+			    ssh_exitcode);
+		    logevent(buf);
+		    if (want_reply) {
+			ssh2_pkt_init(SSH2_MSG_CHANNEL_SUCCESS);
+			ssh2_pkt_adduint32(c->remoteid);
+			ssh2_pkt_send();
+		    }
+		} else {
+		    /*
+		     * This is a channel request we don't know
+		     * about, so we now either ignore the request
+		     * or respond with CHANNEL_FAILURE, depending
+		     * on want_reply.
+		     */
+		    if (want_reply) {
+			ssh2_pkt_init(SSH2_MSG_CHANNEL_FAILURE);
+			ssh2_pkt_adduint32(c->remoteid);
+			ssh2_pkt_send();
+		    }
+		}
+	    } else if (pktin.type == SSH2_MSG_GLOBAL_REQUEST) {
+		char *type;
+		int typelen, want_reply;
+
+		ssh2_pkt_getstring(&type, &typelen);
+		want_reply = ssh2_pkt_getbool();
+
+                /*
+                 * We currently don't support any global requests
+                 * at all, so we either ignore the request or
+                 * respond with REQUEST_FAILURE, depending on
+                 * want_reply.
+                 */
+                if (want_reply) {
+                    ssh2_pkt_init(SSH2_MSG_REQUEST_FAILURE);
+                    ssh2_pkt_send();
+		}
 	    } else if (pktin.type == SSH2_MSG_CHANNEL_OPEN) {
 		char *type;
 		int typelen;
 		char *error = NULL;
 		struct ssh_channel *c;
+		unsigned remid, winsize, pktsize;
 		ssh2_pkt_getstring(&type, &typelen);
 		c = smalloc(sizeof(struct ssh_channel));
 
+		remid = ssh2_pkt_getuint32();
+		winsize = ssh2_pkt_getuint32();
+		pktsize = ssh2_pkt_getuint32();
+
 		if (typelen == 3 && !memcmp(type, "x11", 3)) {
 		    if (!ssh_X11_fwd_enabled)
 			error = "X11 forwarding is not enabled";
@@ -4367,6 +5275,32 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		    } else {
 			c->type = CHAN_X11;
 		    }
+		} else if (typelen == 15 &&
+			   !memcmp(type, "forwarded-tcpip", 15)) {
+		    struct ssh_rportfwd pf, *realpf;
+		    char *dummy;
+		    int dummylen;
+		    ssh2_pkt_getstring(&dummy, &dummylen);/* skip address */
+		    pf.sport = ssh2_pkt_getuint32();
+		    realpf = find234(ssh_rportfwds, &pf, NULL);
+		    if (realpf == NULL) {
+			error = "Remote port is not recognised";
+		    } else {
+			char *e = pfd_newconnect(&c->u.pfd.s, realpf->dhost,
+						 realpf->dport, c);
+			char buf[1024];
+			sprintf(buf, "Received remote port open request for %s:%d",
+				realpf->dhost, realpf->dport);
+			logevent(buf);
+			if (e != NULL) {
+			    sprintf(buf, "Port open failed: %s", e);
+			    logevent(buf);
+			    error = "Port open failed";
+			} else {
+			    logevent("Forwarded port opened successfully");
+			    c->type = CHAN_SOCKDATA;
+			}
+		    }
 		} else if (typelen == 22 &&
 			   !memcmp(type, "auth-agent@openssh.com", 3)) {
 		    if (!ssh_agentfwd_enabled)
@@ -4379,7 +5313,7 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		    error = "Unsupported channel type requested";
 		}
 
-		c->remoteid = ssh2_pkt_getuint32();
+		c->remoteid = remid;
 		if (error) {
 		    ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_FAILURE);
 		    ssh2_pkt_adduint32(c->remoteid);
@@ -4391,15 +5325,15 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 		} else {
 		    c->localid = alloc_channel_id();
 		    c->closes = 0;
-		    c->v2.remwindow = ssh2_pkt_getuint32();
-		    c->v2.remmaxpkt = ssh2_pkt_getuint32();
-		    c->v2.outbuffer = NULL;
-		    c->v2.outbuflen = c->v2.outbufsize = 0;
+		    c->v.v2.locwindow = OUR_V2_WINSIZE;
+		    c->v.v2.remwindow = winsize;
+		    c->v.v2.remmaxpkt = pktsize;
+		    bufchain_init(&c->v.v2.outbuffer);
 		    add234(ssh_channels, c);
 		    ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION);
 		    ssh2_pkt_adduint32(c->remoteid);
 		    ssh2_pkt_adduint32(c->localid);
-		    ssh2_pkt_adduint32(0x8000UL);	/* our window size */
+		    ssh2_pkt_adduint32(c->v.v2.locwindow);
 		    ssh2_pkt_adduint32(0x4000UL);	/* our max pkt size */
 		    ssh2_pkt_send();
 		}
@@ -4420,8 +5354,27 @@ static void do_ssh2_authconn(unsigned char *in, int inlen, int ispkt)
 	    /*
 	     * Try to send data on all channels if we can.
 	     */
-	    for (i = 0; NULL != (c = index234(ssh_channels, i)); i++)
-		ssh2_try_send(c);
+	    for (i = 0; NULL != (c = index234(ssh_channels, i)); i++) {
+		int bufsize = ssh2_try_send(c);
+		if (bufsize == 0) {
+		    switch (c->type) {
+		      case CHAN_MAINSESSION:
+			/* stdin need not receive an unthrottle
+			 * notification since it will be polled */
+			break;
+		      case CHAN_X11:
+			x11_unthrottle(c->u.x11.s);
+			break;
+		      case CHAN_AGENT:
+			/* agent sockets are request/response and need no
+			 * buffer management */
+			break;
+		      case CHAN_SOCKDATA:
+			pfd_unthrottle(c->u.pfd.s);
+			break;
+		    }
+		}
+	    }
 	}
     }
 
@@ -4443,7 +5396,7 @@ static void ssh2_protocol(unsigned char *in, int inlen, int ispkt)
  *
  * Returns an error message, or NULL on success.
  */
-static char *ssh_init(char *host, int port, char **realhost)
+static char *ssh_init(char *host, int port, char **realhost, int nodelay)
 {
     char *p;
 
@@ -4455,8 +5408,11 @@ static char *ssh_init(char *host, int port, char **realhost)
     ssh_send_ok = 0;
     ssh_editing = 0;
     ssh_echoing = 0;
+    ssh1_throttle_count = 0;
+    ssh_overall_bufsize = 0;
+    ssh_fallback_cmd = 0;
 
-    p = connect_to_host(host, port, realhost);
+    p = connect_to_host(host, port, realhost, nodelay);
     if (p != NULL)
 	return p;
 
@@ -4466,12 +5422,44 @@ static char *ssh_init(char *host, int port, char **realhost)
 /*
  * Called to send data down the Telnet connection.
  */
-static void ssh_send(char *buf, int len)
+static int ssh_send(char *buf, int len)
 {
     if (s == NULL || ssh_protocol == NULL)
-	return;
+	return 0;
 
     ssh_protocol(buf, len, 0);
+
+    return ssh_sendbuffer();
+}
+
+/*
+ * Called to query the current amount of buffered stdin data.
+ */
+static int ssh_sendbuffer(void)
+{
+    int override_value;
+
+    if (s == NULL || ssh_protocol == NULL)
+	return 0;
+
+    /*
+     * If the SSH socket itself has backed up, add the total backup
+     * size on that to any individual buffer on the stdin channel.
+     */
+    override_value = 0;
+    if (ssh_throttled_all)
+	override_value = ssh_overall_bufsize;
+
+    if (ssh_version == 1) {
+	return override_value;
+    } else if (ssh_version == 2) {
+	if (!mainchan || mainchan->closes > 0)
+	    return override_value;
+	else
+	    return override_value + bufchain_size(&mainchan->v.v2.outbuffer);
+    }
+
+    return 0;
 }
 
 /*
@@ -4555,16 +5543,33 @@ void *new_sock_channel(Socket s)
     c = smalloc(sizeof(struct ssh_channel));
 
     if (c) {
-	c->remoteid = GET_32BIT(pktin.body);
+	c->remoteid = -1;	       /* to be set when open confirmed */
 	c->localid = alloc_channel_id();
 	c->closes = 0;
-	c->type = CHAN_SOCKDATA;	/* identify channel type */
+	c->type = CHAN_SOCKDATA_DORMANT;/* identify channel type */
 	c->u.pfd.s = s;
 	add234(ssh_channels, c);
     }
     return c;
 }
 
+/*
+ * This is called when stdout/stderr (the entity to which
+ * from_backend sends data) manages to clear some backlog.
+ */
+void ssh_unthrottle(int bufsize)
+{
+    if (ssh_version == 1) {
+	if (ssh1_stdout_throttling && bufsize < SSH1_BUFFER_LIMIT) {
+	    ssh1_stdout_throttling = 0;
+	    ssh1_throttle(-1);
+	}
+    } else {
+	if (mainchan && mainchan->closes == 0)
+	    ssh2_set_window(mainchan, OUR_V2_WINSIZE - bufsize);
+    }
+}
+
 void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
 {
     struct ssh_channel *c = (struct ssh_channel *)channel;
@@ -4573,12 +5578,32 @@ void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
     sprintf(buf, "Opening forwarded connection to %.512s:%d", hostname, port);
     logevent(buf);
 
-    send_packet(SSH1_MSG_PORT_OPEN,
-		PKT_INT, c->localid,
-		PKT_STR, hostname,
-		PKT_INT, port,
-		//PKT_STR, org,
-		PKT_END);
+    if (ssh_version == 1) {
+	send_packet(SSH1_MSG_PORT_OPEN,
+		    PKT_INT, c->localid,
+		    PKT_STR, hostname,
+		    PKT_INT, port,
+		    //PKT_STR, <org:orgport>,
+		    PKT_END);
+    } else {
+	ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
+	ssh2_pkt_addstring("direct-tcpip");
+	ssh2_pkt_adduint32(c->localid);
+	c->v.v2.locwindow = OUR_V2_WINSIZE;
+	ssh2_pkt_adduint32(c->v.v2.locwindow);/* our window size */
+	ssh2_pkt_adduint32(0x4000UL);      /* our max pkt size */
+	ssh2_pkt_addstring(hostname);
+	ssh2_pkt_adduint32(port);
+	/*
+	 * We make up values for the originator data; partly it's
+	 * too much hassle to keep track, and partly I'm not
+	 * convinced the server should be told details like that
+	 * about my local network configuration.
+	 */
+	ssh2_pkt_addstring("client-side-connection");
+	ssh2_pkt_adduint32(0);
+	ssh2_pkt_send();
+    }
 }
 
 
@@ -4601,13 +5626,21 @@ static int ssh_ldisc(int option)
     return FALSE;
 }
 
+static int ssh_return_exitcode(void)
+{
+    return ssh_exitcode;
+}
+
 Backend ssh_backend = {
     ssh_init,
     ssh_send,
+    ssh_sendbuffer,
     ssh_size,
     ssh_special,
     ssh_socket,
+    ssh_return_exitcode,
     ssh_sendok,
     ssh_ldisc,
+    ssh_unthrottle,
     22
-};
\ No newline at end of file
+};