X-Git-Url: https://git.distorted.org.uk/u/mdw/putty/blobdiff_plain/d87d258a8f5d8fc9c43e73cc59ff4258b3755485..4a693cfc5c3ee0e639bbee0215345e921715ab04:/ssh.c

diff --git a/ssh.c b/ssh.c
index 017b48bf..e3b8a334 100644
--- a/ssh.c
+++ b/ssh.c
@@ -884,12 +884,26 @@ struct ssh_tag {
     struct Packet *(*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
 
     /*
-     * We maintain a full _copy_ of a Config structure here, not
-     * merely a pointer to it. That way, when we're passed a new
-     * one for reconfiguration, we can check the differences and
-     * potentially reconfigure port forwardings etc in mid-session.
+     * We maintain our own copy of a Conf structure here. That way,
+     * when we're passed a new one for reconfiguration, we can check
+     * the differences and potentially reconfigure port forwardings
+     * etc in mid-session.
      */
-    Config cfg;
+    Conf *conf;
+
+    /*
+     * Values cached out of conf so as to avoid the tree234 lookup
+     * cost every time they're used.
+     */
+    int logomitdata;
+
+    /*
+     * Dynamically allocated username string created during SSH
+     * login. Stored in here rather than in the coroutine state so
+     * that it'll be reliably freed if we shut down the SSH session
+     * at some unexpected moment.
+     */
+    char *username;
 
     /*
      * Used to transfer data back from async callbacks.
@@ -978,13 +992,13 @@ static void logeventf(Ssh ssh, const char *fmt, ...)
 
 static void dont_log_password(Ssh ssh, struct Packet *pkt, int blanktype)
 {
-    if (ssh->cfg.logomitpass)
+    if (conf_get_int(ssh->conf, CONF_logomitpass))
 	pkt->logmode = blanktype;
 }
 
 static void dont_log_data(Ssh ssh, struct Packet *pkt, int blanktype)
 {
-    if (ssh->cfg.logomitdata)
+    if (ssh->logomitdata)
 	pkt->logmode = blanktype;
 }
 
@@ -993,26 +1007,27 @@ static void end_log_omission(Ssh ssh, struct Packet *pkt)
     pkt->logmode = PKTLOG_EMIT;
 }
 
-/* Helper function for common bits of parsing cfg.ttymodes. */
-static void parse_ttymodes(Ssh ssh, char *modes,
+/* Helper function for common bits of parsing ttymodes. */
+static void parse_ttymodes(Ssh ssh,
 			   void (*do_mode)(void *data, char *mode, char *val),
 			   void *data)
 {
-    while (*modes) {
-	char *t = strchr(modes, '\t');
-	char *m = snewn(t-modes+1, char);
-	char *val;
-	strncpy(m, modes, t-modes);
-	m[t-modes] = '\0';
-	if (*(t+1) == 'A')
-	    val = get_ttymode(ssh->frontend, m);
+    char *key, *val;
+
+    for (val = conf_get_str_strs(ssh->conf, CONF_ttymodes, NULL, &key);
+	 val != NULL;
+	 val = conf_get_str_strs(ssh->conf, CONF_ttymodes, key, &key)) {
+	/*
+	 * val[0] is either 'V', indicating that an explicit value
+	 * follows it, or 'A' indicating that we should pass the
+	 * value through from the local environment via get_ttymode.
+	 */
+	if (val[0] == 'A')
+	    val = get_ttymode(ssh->frontend, key);
 	else
-	    val = dupstr(t+2);
+	    val++;		       /* skip the 'V' */
 	if (val)
-	    do_mode(data, m, val);
-	sfree(m);
-	sfree(val);
-	modes += strlen(modes) + 1;
+	    do_mode(data, key, val);
     }
 }
 
@@ -1300,7 +1315,7 @@ static struct Packet *ssh1_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
     if (ssh->logctx) {
 	int nblanks = 0;
 	struct logblank_t blank;
-	if (ssh->cfg.logomitdata) {
+	if (ssh->logomitdata) {
 	    int do_blank = FALSE, blank_prefix = 0;
 	    /* "Session data" packets - omit the data field */
 	    if ((st->pktin->type == SSH1_SMSG_STDOUT_DATA) ||
@@ -1533,7 +1548,7 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
     if (ssh->logctx) {
 	int nblanks = 0;
 	struct logblank_t blank;
-	if (ssh->cfg.logomitdata) {
+	if (ssh->logomitdata) {
 	    int do_blank = FALSE, blank_prefix = 0;
 	    /* "Session data" packets - omit the data field */
 	    if (st->pktin->type == SSH2_MSG_CHANNEL_DATA) {
@@ -2417,8 +2432,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
      *    with SSH1_MSG_IGNOREs -- but this string never seems to change,
      *    so we can't distinguish them.
      */
-    if (ssh->cfg.sshbug_ignore1 == FORCE_ON ||
-	(ssh->cfg.sshbug_ignore1 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_ignore1) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_ignore1) == AUTO &&
 	 (!strcmp(imp, "1.2.18") || !strcmp(imp, "1.2.19") ||
 	  !strcmp(imp, "1.2.20") || !strcmp(imp, "1.2.21") ||
 	  !strcmp(imp, "1.2.22") || !strcmp(imp, "Cisco-1.25") ||
@@ -2432,8 +2447,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version has SSH-1 ignore bug");
     }
 
-    if (ssh->cfg.sshbug_plainpw1 == FORCE_ON ||
-	(ssh->cfg.sshbug_plainpw1 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_plainpw1) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_plainpw1) == AUTO &&
 	 (!strcmp(imp, "Cisco-1.25") || !strcmp(imp, "OSU_1.4alpha3")))) {
 	/*
 	 * These versions need a plain password sent; they can't
@@ -2444,8 +2459,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version needs a plain SSH-1 password");
     }
 
-    if (ssh->cfg.sshbug_rsa1 == FORCE_ON ||
-	(ssh->cfg.sshbug_rsa1 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_rsa1) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_rsa1) == AUTO &&
 	 (!strcmp(imp, "Cisco-1.25")))) {
 	/*
 	 * These versions apparently have no clue whatever about
@@ -2456,8 +2471,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version can't handle SSH-1 RSA authentication");
     }
 
-    if (ssh->cfg.sshbug_hmac2 == FORCE_ON ||
-	(ssh->cfg.sshbug_hmac2 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_hmac2) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_hmac2) == AUTO &&
 	 !wc_match("* VShell", imp) &&
 	 (wc_match("2.1.0*", imp) || wc_match("2.0.*", imp) ||
 	  wc_match("2.2.0*", imp) || wc_match("2.3.0*", imp) ||
@@ -2469,8 +2484,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version has SSH-2 HMAC bug");
     }
 
-    if (ssh->cfg.sshbug_derivekey2 == FORCE_ON ||
-	(ssh->cfg.sshbug_derivekey2 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_derivekey2) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_derivekey2) == AUTO &&
 	 !wc_match("* VShell", imp) &&
 	 (wc_match("2.0.0*", imp) || wc_match("2.0.10*", imp) ))) {
 	/*
@@ -2482,8 +2497,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version has SSH-2 key-derivation bug");
     }
 
-    if (ssh->cfg.sshbug_rsapad2 == FORCE_ON ||
-	(ssh->cfg.sshbug_rsapad2 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_rsapad2) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_rsapad2) == AUTO &&
 	 (wc_match("OpenSSH_2.[5-9]*", imp) ||
 	  wc_match("OpenSSH_3.[0-2]*", imp)))) {
 	/*
@@ -2493,8 +2508,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version has SSH-2 RSA padding bug");
     }
 
-    if (ssh->cfg.sshbug_pksessid2 == FORCE_ON ||
-	(ssh->cfg.sshbug_pksessid2 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_pksessid2) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_pksessid2) == AUTO &&
 	 wc_match("OpenSSH_2.[0-2]*", imp))) {
 	/*
 	 * These versions have the SSH-2 session-ID bug in
@@ -2504,8 +2519,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version has SSH-2 public-key-session-ID bug");
     }
 
-    if (ssh->cfg.sshbug_rekey2 == FORCE_ON ||
-	(ssh->cfg.sshbug_rekey2 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_rekey2) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_rekey2) == AUTO &&
 	 (wc_match("DigiSSH_2.0", imp) ||
 	  wc_match("OpenSSH_2.[0-4]*", imp) ||
 	  wc_match("OpenSSH_2.5.[0-3]*", imp) ||
@@ -2520,8 +2535,8 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version has SSH-2 rekey bug");
     }
 
-    if (ssh->cfg.sshbug_maxpkt2 == FORCE_ON ||
-	(ssh->cfg.sshbug_maxpkt2 == AUTO &&
+    if (conf_get_int(ssh->conf, CONF_sshbug_maxpkt2) == FORCE_ON ||
+	(conf_get_int(ssh->conf, CONF_sshbug_maxpkt2) == AUTO &&
 	 (wc_match("1.36_sshlib GlobalSCAPE", imp) ||
           wc_match("1.36 sshlib: GlobalScape", imp)))) {
 	/*
@@ -2531,7 +2546,7 @@ static void ssh_detect_bugs(Ssh ssh, char *vstring)
 	logevent("We believe remote version ignores SSH-2 maximum packet size");
     }
 
-    if (ssh->cfg.sshbug_ignore2 == FORCE_ON) {
+    if (conf_get_int(ssh->conf, CONF_sshbug_ignore2) == FORCE_ON) {
 	/*
 	 * Servers that don't support SSH2_MSG_IGNORE. Currently,
 	 * none detected automatically.
@@ -2674,16 +2689,16 @@ static int do_ssh_init(Ssh ssh, unsigned char c)
     /* Anything greater or equal to "1.99" means protocol 2 is supported. */
     s->proto2 = ssh_versioncmp(s->version, "1.99") >= 0;
 
-    if (ssh->cfg.sshprot == 0 && !s->proto1) {
+    if (conf_get_int(ssh->conf, CONF_sshprot) == 0 && !s->proto1) {
 	bombout(("SSH protocol version 1 required by user but not provided by server"));
 	crStop(0);
     }
-    if (ssh->cfg.sshprot == 3 && !s->proto2) {
+    if (conf_get_int(ssh->conf, CONF_sshprot) == 3 && !s->proto2) {
 	bombout(("SSH protocol version 2 required by user but not provided by server"));
 	crStop(0);
     }
 
-    if (s->proto2 && (ssh->cfg.sshprot >= 2 || !s->proto1))
+    if (s->proto2 && (conf_get_int(ssh->conf, CONF_sshprot) >= 2 || !s->proto1))
 	ssh->version = 2;
     else
 	ssh->version = 1;
@@ -2691,7 +2706,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c)
     logeventf(ssh, "Using SSH protocol version %d", ssh->version);
 
     /* Send the version string, if we haven't already */
-    if (ssh->cfg.sshprot != 3)
+    if (conf_get_int(ssh->conf, CONF_sshprot) != 3)
 	ssh_send_verstring(ssh, s->version);
 
     if (ssh->version == 2) {
@@ -2723,7 +2738,7 @@ static int do_ssh_init(Ssh ssh, unsigned char c)
 
     update_specials_menu(ssh->frontend);
     ssh->state = SSH_STATE_BEFORE_SIZE;
-    ssh->pinger = pinger_new(&ssh->cfg, &ssh_backend, ssh);
+    ssh->pinger = pinger_new(ssh->conf, &ssh_backend, ssh);
 
     sfree(s->vstring);
 
@@ -2976,11 +2991,14 @@ static const char *connect_to_host(Ssh ssh, char *host, int port,
 
     SockAddr addr;
     const char *err;
-
-    if (*ssh->cfg.loghost) {
+    char *loghost;
+    int addressfamily, sshprot;
+    
+    loghost = conf_get_str(ssh->conf, CONF_loghost);
+    if (*loghost) {
 	char *colon;
 
-	ssh->savedhost = dupstr(ssh->cfg.loghost);
+	ssh->savedhost = dupstr(loghost);
 	ssh->savedport = 22;	       /* default ssh port */
 
 	/*
@@ -3005,11 +3023,11 @@ static const char *connect_to_host(Ssh ssh, char *host, int port,
     /*
      * Try to find host.
      */
+    addressfamily = conf_get_int(ssh->conf, CONF_addressfamily);
     logeventf(ssh, "Looking up host \"%s\"%s", host,
-	      (ssh->cfg.addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" :
-	       (ssh->cfg.addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : "")));
-    addr = name_lookup(host, port, realhost, &ssh->cfg,
-		       ssh->cfg.addressfamily);
+	      (addressfamily == ADDRTYPE_IPV4 ? " (IPv4)" :
+	       (addressfamily == ADDRTYPE_IPV6 ? " (IPv6)" : "")));
+    addr = name_lookup(host, port, realhost, ssh->conf, addressfamily);
     if ((err = sk_addr_error(addr)) != NULL) {
 	sk_addr_free(addr);
 	return err;
@@ -3021,7 +3039,7 @@ static const char *connect_to_host(Ssh ssh, char *host, int port,
      */
     ssh->fn = &fn_table;
     ssh->s = new_connection(addr, *realhost, port,
-			    0, 1, nodelay, keepalive, (Plug) ssh, &ssh->cfg);
+			    0, 1, nodelay, keepalive, (Plug) ssh, ssh->conf);
     if ((err = sk_socket_error(ssh->s)) != NULL) {
 	ssh->s = NULL;
 	notify_remote_exit(ssh->frontend);
@@ -3032,9 +3050,10 @@ static const char *connect_to_host(Ssh ssh, char *host, int port,
      * If the SSH version number's fixed, set it now, and if it's SSH-2,
      * send the version string too.
      */
-    if (ssh->cfg.sshprot == 0)
+    sshprot = conf_get_int(ssh->conf, CONF_sshprot);
+    if (sshprot == 0)
 	ssh->version = 1;
-    if (ssh->cfg.sshprot == 3) {
+    if (sshprot == 3) {
 	ssh->version = 2;
 	ssh_send_verstring(ssh, NULL);
     }
@@ -3042,9 +3061,9 @@ static const char *connect_to_host(Ssh ssh, char *host, int port,
     /*
      * loghost, if configured, overrides realhost.
      */
-    if (*ssh->cfg.loghost) {
+    if (*loghost) {
 	sfree(*realhost);
-	*realhost = dupstr(ssh->cfg.loghost);
+	*realhost = dupstr(loghost);
     }
 
     return NULL;
@@ -3209,7 +3228,6 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 	int tis_auth_refused, ccard_auth_refused;
 	unsigned char session_id[16];
 	int cipher_type;
-	char username[100];
 	void *publickey_blob;
 	int publickey_bloblen;
 	char *publickey_comment;
@@ -3226,6 +3244,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 	char *commentp;
 	int commentlen;
         int dlgret;
+	Filename *keyfile;
     };
     crState(do_ssh1_login_state);
 
@@ -3365,7 +3384,8 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 	char *cipher_string = NULL;
 	int i;
 	for (i = 0; !cipher_chosen && i < CIPHER_MAX; i++) {
-	    int next_cipher = ssh->cfg.ssh_cipherlist[i];
+	    int next_cipher = conf_get_int_int(ssh->conf,
+					       CONF_ssh_cipherlist, i);
 	    if (next_cipher == CIPHER_WARN) {
 		/* If/when we choose a cipher, warn about it */
 		warn = 1;
@@ -3480,14 +3500,13 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 
     fflush(stdout); /* FIXME eh? */
     {
-	if (!get_remote_username(&ssh->cfg, s->username,
-				 sizeof(s->username))) {
+	if ((ssh->username = get_remote_username(ssh->conf)) == NULL) {
 	    int ret; /* need not be kept over crReturn */
 	    s->cur_prompt = new_prompts(ssh->frontend);
 	    s->cur_prompt->to_server = TRUE;
 	    s->cur_prompt->name = dupstr("SSH login name");
-	    add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
-		       lenof(s->username)); 
+	    /* 512 is an arbitrary upper limit on username size */
+	    add_prompt(s->cur_prompt, dupstr("login as: "), TRUE, 512);
 	    ret = get_userpass_input(s->cur_prompt, NULL, 0);
 	    while (ret < 0) {
 		ssh->send_ok = 1;
@@ -3503,14 +3522,13 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 		ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
 		crStop(0);
 	    }
-	    memcpy(s->username, s->cur_prompt->prompts[0]->result,
-		   lenof(s->username));
+	    ssh->username = dupstr(s->cur_prompt->prompts[0]->result);
 	    free_prompts(s->cur_prompt);
 	}
 
-	send_packet(ssh, SSH1_CMSG_USER, PKT_STR, s->username, PKT_END);
+	send_packet(ssh, SSH1_CMSG_USER, PKT_STR, ssh->username, PKT_END);
 	{
-	    char *userlog = dupprintf("Sent username \"%s\"", s->username);
+	    char *userlog = dupprintf("Sent username \"%s\"", ssh->username);
 	    logevent(userlog);
 	    if (flags & FLAG_INTERACTIVE &&
 		(!((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)))) {
@@ -3533,24 +3551,25 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
     /*
      * Load the public half of any configured keyfile for later use.
      */
-    if (!filename_is_null(ssh->cfg.keyfile)) {
+    s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
+    if (!filename_is_null(*s->keyfile)) {
 	int keytype;
 	logeventf(ssh, "Reading private key file \"%.150s\"",
-		  filename_to_str(&ssh->cfg.keyfile));
-	keytype = key_type(&ssh->cfg.keyfile);
+		  filename_to_str(s->keyfile));
+	keytype = key_type(s->keyfile);
 	if (keytype == SSH_KEYTYPE_SSH1) {
 	    const char *error;
-	    if (rsakey_pubblob(&ssh->cfg.keyfile,
+	    if (rsakey_pubblob(s->keyfile,
 			       &s->publickey_blob, &s->publickey_bloblen,
 			       &s->publickey_comment, &error)) {
-		s->publickey_encrypted = rsakey_encrypted(&ssh->cfg.keyfile,
+		s->publickey_encrypted = rsakey_encrypted(s->keyfile,
 							  NULL);
 	    } else {
 		char *msgbuf;
 		logeventf(ssh, "Unable to load private key (%s)", error);
 		msgbuf = dupprintf("Unable to load private key file "
 				   "\"%.150s\" (%s)\r\n",
-				   filename_to_str(&ssh->cfg.keyfile),
+				   filename_to_str(s->keyfile),
 				   error);
 		c_write_str(ssh, msgbuf);
 		sfree(msgbuf);
@@ -3562,7 +3581,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 		      key_type_to_str(keytype));
 	    msgbuf = dupprintf("Unable to use key file \"%.150s\""
 			       " (%s)\r\n",
-			       filename_to_str(&ssh->cfg.keyfile),
+			       filename_to_str(s->keyfile),
 			       key_type_to_str(keytype));
 	    c_write_str(ssh, msgbuf);
 	    sfree(msgbuf);
@@ -3574,7 +3593,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
     while (pktin->type == SSH1_SMSG_FAILURE) {
 	s->pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
 
-	if (ssh->cfg.tryagent && agent_exists() && !s->tried_agent) {
+	if (conf_get_int(ssh->conf, CONF_tryagent) && agent_exists() && !s->tried_agent) {
 	    /*
 	     * Attempt RSA authentication using Pageant.
 	     */
@@ -3758,8 +3777,9 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 	    int got_passphrase; /* need not be kept over crReturn */
 	    if (flags & FLAG_VERBOSE)
 		c_write_str(ssh, "Trying public key authentication.\r\n");
+	    s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
 	    logeventf(ssh, "Trying public key \"%s\"",
-		      filename_to_str(&ssh->cfg.keyfile));
+		      filename_to_str(s->keyfile));
 	    s->tried_publickey = 1;
 	    got_passphrase = FALSE;
 	    while (!got_passphrase) {
@@ -3801,7 +3821,8 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 		/*
 		 * Try decrypting key with passphrase.
 		 */
-		ret = loadrsakey(&ssh->cfg.keyfile, &s->key, passphrase,
+		s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
+		ret = loadrsakey(s->keyfile, &s->key, passphrase,
 				 &error);
 		if (passphrase) {
 		    memset(passphrase, 0, strlen(passphrase));
@@ -3812,7 +3833,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 		    got_passphrase = TRUE;
 		} else if (ret == 0) {
 		    c_write_str(ssh, "Couldn't load private key from ");
-		    c_write_str(ssh, filename_to_str(&ssh->cfg.keyfile));
+		    c_write_str(ssh, filename_to_str(s->keyfile));
 		    c_write_str(ssh, " (");
 		    c_write_str(ssh, error);
 		    c_write_str(ssh, ").\r\n");
@@ -3895,7 +3916,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 	 */
 	s->cur_prompt = new_prompts(ssh->frontend);
 
-	if (ssh->cfg.try_tis_auth &&
+	if (conf_get_int(ssh->conf, CONF_try_tis_auth) &&
 	    (s->supported_auths_mask & (1 << SSH1_AUTH_TIS)) &&
 	    !s->tis_auth_refused) {
 	    s->pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
@@ -3938,7 +3959,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 		sfree(instr_suf);
 	    }
 	}
-	if (ssh->cfg.try_tis_auth &&
+	if (conf_get_int(ssh->conf, CONF_try_tis_auth) &&
 	    (s->supported_auths_mask & (1 << SSH1_AUTH_CCARD)) &&
 	    !s->ccard_auth_refused) {
 	    s->pwpkt_type = SSH1_CMSG_AUTH_CCARD_RESPONSE;
@@ -3988,8 +4009,8 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
 	    }
 	    s->cur_prompt->to_server = TRUE;
 	    s->cur_prompt->name = dupstr("SSH password");
-	    add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
-						s->username, ssh->savedhost),
+	    add_prompt(s->cur_prompt, dupprintf("%s@%s's password: ",
+						ssh->username, ssh->savedhost),
 		       FALSE, SSH_MAX_PASSWORD_LEN);
 	}
 
@@ -4365,11 +4386,11 @@ static void ssh_rportfwd_succfail(Ssh ssh, struct Packet *pktin, void *ctx)
     }
 }
 
-static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
+static void ssh_setup_portfwd(Ssh ssh, Conf *conf)
 {
-    const char *portfwd_strptr = cfg->portfwd;
     struct ssh_portfwd *epf;
     int i;
+    char *key, *val;
 
     if (!ssh->portfwds) {
 	ssh->portfwds = newtree234(ssh_portcmp);
@@ -4387,80 +4408,34 @@ static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
 	    epf->status = DESTROY;
     }
 
-    while (*portfwd_strptr) {
+    for (val = conf_get_str_strs(conf, CONF_portfwd, NULL, &key);
+	 val != NULL;
+	 val = conf_get_str_strs(conf, CONF_portfwd, key, &key)) {
+	char *kp, *kp2, *vp, *vp2;
 	char address_family, type;
 	int sport,dport,sserv,dserv;
-	char sports[256], dports[256], saddr[256], host[256];
-	int n;
+	char *sports, *dports, *saddr, *host;
+
+	kp = key;
 
 	address_family = 'A';
 	type = 'L';
-	if (*portfwd_strptr == 'A' ||
-	    *portfwd_strptr == '4' ||
-	    *portfwd_strptr == '6')
-	    address_family = *portfwd_strptr++;
-	if (*portfwd_strptr == 'L' ||
-	    *portfwd_strptr == 'R' ||
-	    *portfwd_strptr == 'D')
-	    type = *portfwd_strptr++;
-
-	saddr[0] = '\0';
-
-	n = 0;
-	while (*portfwd_strptr && *portfwd_strptr != '\t') {
-	    if (*portfwd_strptr == ':') {
-		/*
-		 * We've seen a colon in the middle of the
-		 * source port number. This means that
-		 * everything we've seen until now is the
-		 * source _address_, so we'll move it into
-		 * saddr and start sports from the beginning
-		 * again.
-		 */
-		portfwd_strptr++;
-		sports[n] = '\0';
-		if (ssh->version == 1 && type == 'R') {
-		    logeventf(ssh, "SSH-1 cannot handle remote source address "
-			      "spec \"%s\"; ignoring", sports);
-		} else
-		    strcpy(saddr, sports);
-		n = 0;
-	    }
-	    if (n < lenof(sports)-1) sports[n++] = *portfwd_strptr++;
-	}
-	sports[n] = 0;
-	if (type != 'D') {
-	    if (*portfwd_strptr == '\t')
-		portfwd_strptr++;
-	    n = 0;
-	    while (*portfwd_strptr && *portfwd_strptr != ':') {
-		if (n < lenof(host)-1) host[n++] = *portfwd_strptr++;
-	    }
-	    host[n] = 0;
-	    if (*portfwd_strptr == ':')
-		portfwd_strptr++;
-	    n = 0;
-	    while (*portfwd_strptr) {
-		if (n < lenof(dports)-1) dports[n++] = *portfwd_strptr++;
-	    }
-	    dports[n] = 0;
-	    portfwd_strptr++;
-	    dport = atoi(dports);
-	    dserv = 0;
-	    if (dport == 0) {
-		dserv = 1;
-		dport = net_service_lookup(dports);
-		if (!dport) {
-		    logeventf(ssh, "Service lookup failed for destination"
-			      " port \"%s\"", dports);
-		}
-	    }
+	if (*kp == 'A' || *kp == '4' || *kp == '6')
+	    address_family = *kp++;
+	if (*kp == 'L' || *kp == 'R')
+	    type = *kp++;
+
+	if ((kp2 = strchr(kp, ':')) != NULL) {
+	    /*
+	     * There's a colon in the middle of the source port
+	     * string, which means that the part before it is
+	     * actually a source address.
+	     */
+	    saddr = dupprintf("%.*s", (int)(kp2 - kp), kp);
+	    sports = kp2+1;
 	} else {
-	    while (*portfwd_strptr) portfwd_strptr++;
-	    host[0] = 0;
-	    dports[0] = 0;
-	    dport = dserv = -1;
-	    portfwd_strptr++;	       /* eat the NUL and move to next one */
+	    saddr = NULL;
+	    sports = kp;
 	}
 	sport = atoi(sports);
 	sserv = 0;
@@ -4472,16 +4447,44 @@ static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
 			  " port \"%s\"", sports);
 	    }
 	}
+
+	if (type == 'L' && !strcmp(val, "D")) {
+            /* dynamic forwarding */
+	    host = NULL;
+	    dports = NULL;
+	    dport = -1;
+	    dserv = 0;
+            type = 'D';
+        } else {
+            /* ordinary forwarding */
+	    vp = val;
+	    vp2 = vp + strcspn(vp, ":");
+	    host = dupprintf("%.*s", (int)(vp2 - vp), vp);
+	    if (vp2)
+		vp2++;
+	    dports = vp2;
+	    dport = atoi(dports);
+	    dserv = 0;
+	    if (dport == 0) {
+		dserv = 1;
+		dport = net_service_lookup(dports);
+		if (!dport) {
+		    logeventf(ssh, "Service lookup failed for destination"
+			      " port \"%s\"", dports);
+		}
+	    }
+	}
+
 	if (sport && dport) {
 	    /* Set up a description of the source port. */
 	    struct ssh_portfwd *pfrec, *epfrec;
 
 	    pfrec = snew(struct ssh_portfwd);
 	    pfrec->type = type;
-	    pfrec->saddr = *saddr ? dupstr(saddr) : NULL;
+	    pfrec->saddr = saddr;
 	    pfrec->sserv = sserv ? dupstr(sports) : NULL;
 	    pfrec->sport = sport;
-	    pfrec->daddr = *host ? dupstr(host) : NULL;
+	    pfrec->daddr = host;
 	    pfrec->dserv = dserv ? dupstr(dports) : NULL;
 	    pfrec->dport = dport;
 	    pfrec->local = NULL;
@@ -4509,6 +4512,9 @@ static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
 	    } else {
 		pfrec->status = CREATE;
 	    }
+	} else {
+	    sfree(saddr);
+	    sfree(host);
 	}
     }
 
@@ -4562,8 +4568,8 @@ static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
 		    ssh2_pkt_addbool(pktout, 0);/* _don't_ want reply */
 		    if (epf->saddr) {
 			ssh2_pkt_addstring(pktout, epf->saddr);
-		    } else if (ssh->cfg.rport_acceptall) {
-			/* XXX: ssh->cfg.rport_acceptall may not represent
+		    } else if (conf_get_int(conf, CONF_rport_acceptall)) {
+			/* XXX: rport_acceptall may not represent
 			 * what was used to open the original connection,
 			 * since it's reconfigurable. */
 			ssh2_pkt_addstring(pktout, "0.0.0.0");
@@ -4612,7 +4618,7 @@ static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
 	    if (epf->type == 'L') {
 		const char *err = pfd_addforward(epf->daddr, epf->dport,
 						 epf->saddr, epf->sport,
-						 ssh, cfg,
+						 ssh, conf,
 						 &epf->local,
 						 epf->addressfamily);
 
@@ -4624,7 +4630,7 @@ static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
 	    } else if (epf->type == 'D') {
 		const char *err = pfd_addforward(NULL, -1,
 						 epf->saddr, epf->sport,
-						 ssh, cfg,
+						 ssh, conf,
 						 &epf->local,
 						 epf->addressfamily);
 
@@ -4680,7 +4686,7 @@ static void ssh_setup_portfwd(Ssh ssh, const Config *cfg)
 			ssh2_pkt_addbool(pktout, 1);/* want reply */
 			if (epf->saddr) {
 			    ssh2_pkt_addstring(pktout, epf->saddr);
-			} else if (cfg->rport_acceptall) {
+			} else if (conf_get_int(conf, CONF_rport_acceptall)) {
 			    ssh2_pkt_addstring(pktout, "0.0.0.0");
 			} else {
 			    ssh2_pkt_addstring(pktout, "127.0.0.1");
@@ -4736,7 +4742,7 @@ static void ssh1_smsg_x11_open(Ssh ssh, struct Packet *pktin)
 	c->ssh = ssh;
 
 	if (x11_init(&c->u.x11.s, ssh->x11disp, c,
-		     NULL, -1, &ssh->cfg) != NULL) {
+		     NULL, -1, ssh->conf) != NULL) {
 	    logevent("Opening X11 forward connection failed");
 	    sfree(c);
 	    send_packet(ssh, SSH1_MSG_CHANNEL_OPEN_FAILURE,
@@ -4822,7 +4828,7 @@ static void ssh1_msg_port_open(Ssh ssh, struct Packet *pktin)
 	logeventf(ssh, "Received remote port open request for %s:%d",
 		  pf.dhost, port);
 	e = pfd_newconnect(&c->u.pfd.s, pf.dhost, port,
-			   c, &ssh->cfg, pfp->pfrec->addressfamily);
+			   c, ssh->conf, pfp->pfrec->addressfamily);
 	if (e != NULL) {
 	    logeventf(ssh, "Port open failed: %s", e);
 	    sfree(c);
@@ -5054,7 +5060,7 @@ static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
     ssh->packet_dispatch[SSH1_MSG_CHANNEL_DATA] = ssh1_msg_channel_data;
     ssh->packet_dispatch[SSH1_SMSG_EXIT_STATUS] = ssh1_smsg_exit_status;
 
-    if (ssh->cfg.agentfwd && agent_exists()) {
+    if (conf_get_int(ssh->conf, CONF_agentfwd) && agent_exists()) {
 	logevent("Requesting agent forwarding");
 	send_packet(ssh, SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
 	do {
@@ -5073,9 +5079,9 @@ static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
 	}
     }
 
-    if (ssh->cfg.x11_forward &&
-	(ssh->x11disp = x11_setup_display(ssh->cfg.x11_display,
-					  ssh->cfg.x11_auth, &ssh->cfg))) {
+    if (conf_get_int(ssh->conf, CONF_x11_forward) &&
+	(ssh->x11disp = x11_setup_display(conf_get_str(ssh->conf, CONF_x11_display),
+					  conf_get_int(ssh->conf, CONF_x11_auth), ssh->conf))) {
 	logevent("Requesting X11 forwarding");
 	/*
 	 * Note that while we blank the X authentication data here, we don't
@@ -5116,24 +5122,23 @@ static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
 	}
     }
 
-    ssh_setup_portfwd(ssh, &ssh->cfg);
+    ssh_setup_portfwd(ssh, ssh->conf);
     ssh->packet_dispatch[SSH1_MSG_PORT_OPEN] = ssh1_msg_port_open;
 
-    if (!ssh->cfg.nopty) {
+    if (!conf_get_int(ssh->conf, CONF_nopty)) {
 	struct Packet *pkt;
 	/* Unpick the terminal-speed string. */
 	/* XXX perhaps we should allow no speeds to be sent. */
 	ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
-	sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
+	sscanf(conf_get_str(ssh->conf, CONF_termspeed), "%d,%d", &ssh->ospeed, &ssh->ispeed);
 	/* Send the pty request. */
 	pkt = ssh1_pkt_init(SSH1_CMSG_REQUEST_PTY);
-	ssh_pkt_addstring(pkt, ssh->cfg.termtype);
+	ssh_pkt_addstring(pkt, conf_get_str(ssh->conf, CONF_termtype));
 	ssh_pkt_adduint32(pkt, ssh->term_height);
 	ssh_pkt_adduint32(pkt, ssh->term_width);
 	ssh_pkt_adduint32(pkt, 0); /* width in pixels */
 	ssh_pkt_adduint32(pkt, 0); /* height in pixels */
-	parse_ttymodes(ssh, ssh->cfg.ttymodes,
-		       ssh1_send_ttymode, (void *)pkt);
+	parse_ttymodes(ssh, ssh1_send_ttymode, (void *)pkt);
 	ssh_pkt_addbyte(pkt, SSH1_TTY_OP_ISPEED);
 	ssh_pkt_adduint32(pkt, ssh->ispeed);
 	ssh_pkt_addbyte(pkt, SSH1_TTY_OP_OSPEED);
@@ -5158,7 +5163,7 @@ static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
 	ssh->editing = ssh->echoing = 1;
     }
 
-    if (ssh->cfg.compression) {
+    if (conf_get_int(ssh->conf, CONF_compression)) {
 	send_packet(ssh, SSH1_CMSG_REQUEST_COMPRESSION, PKT_INT, 6, PKT_END);
 	do {
 	    crReturnV;
@@ -5186,12 +5191,11 @@ static void do_ssh1_connection(Ssh ssh, unsigned char *in, int inlen,
      * exists, we fall straight back to that.
      */
     {
-	char *cmd = ssh->cfg.remote_cmd_ptr;
-
-	if (!cmd) cmd = ssh->cfg.remote_cmd;
+	char *cmd = conf_get_str(ssh->conf, CONF_remote_cmd);
 	
-	if (ssh->cfg.ssh_subsys && ssh->cfg.remote_cmd_ptr2) {
-	    cmd = ssh->cfg.remote_cmd_ptr2;
+	if (conf_get_int(ssh->conf, CONF_ssh_subsys) &&
+	    conf_get_str(ssh->conf, CONF_remote_cmd2)) {
+	    cmd = conf_get_str(ssh->conf, CONF_remote_cmd2);
 	    ssh->fallback_cmd = TRUE;
 	}
 	if (*cmd)
@@ -5462,7 +5466,7 @@ static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
 	 */
 	s->n_preferred_kex = 0;
 	for (i = 0; i < KEX_MAX; i++) {
-	    switch (ssh->cfg.ssh_kexlist[i]) {
+	    switch (conf_get_int_int(ssh->conf, CONF_ssh_kexlist, i)) {
 	      case KEX_DHGEX:
 		s->preferred_kex[s->n_preferred_kex++] =
 		    &ssh_diffiehellman_gex;
@@ -5494,12 +5498,12 @@ static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
 	 */
 	s->n_preferred_ciphers = 0;
 	for (i = 0; i < CIPHER_MAX; i++) {
-	    switch (ssh->cfg.ssh_cipherlist[i]) {
+	    switch (conf_get_int_int(ssh->conf, CONF_ssh_cipherlist, i)) {
 	      case CIPHER_BLOWFISH:
 		s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_blowfish;
 		break;
 	      case CIPHER_DES:
-		if (ssh->cfg.ssh2_des_cbc) {
+		if (conf_get_int(ssh->conf, CONF_ssh2_des_cbc)) {
 		    s->preferred_ciphers[s->n_preferred_ciphers++] = &ssh2_des;
 		}
 		break;
@@ -5525,7 +5529,7 @@ static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
 	/*
 	 * Set up preferred compression.
 	 */
-	if (ssh->cfg.compression)
+	if (conf_get_int(ssh->conf, CONF_compression))
 	    s->preferred_comp = &ssh_zlib;
 	else
 	    s->preferred_comp = &ssh_comp_none;
@@ -6321,8 +6325,8 @@ static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
      */
     ssh->kex_in_progress = FALSE;
     ssh->last_rekey = GETTICKCOUNT();
-    if (ssh->cfg.ssh_rekey_time != 0)
-	ssh->next_rekey = schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
+    if (conf_get_int(ssh->conf, CONF_ssh_rekey_time) != 0)
+	ssh->next_rekey = schedule_timer(conf_get_int(ssh->conf, CONF_ssh_rekey_time)*60*TICKSPERSEC,
 					 ssh2_timer, ssh);
 
     /*
@@ -6403,9 +6407,9 @@ static int do_ssh2_transport(Ssh ssh, void *vin, int inlen,
              * hit the event log _too_ often. */
             ssh->outgoing_data_size = 0;
             ssh->incoming_data_size = 0;
-            if (ssh->cfg.ssh_rekey_time != 0) {
+            if (conf_get_int(ssh->conf, CONF_ssh_rekey_time) != 0) {
                 ssh->next_rekey =
-                    schedule_timer(ssh->cfg.ssh_rekey_time*60*TICKSPERSEC,
+                    schedule_timer(conf_get_int(ssh->conf, CONF_ssh_rekey_time)*60*TICKSPERSEC,
                                    ssh2_timer, ssh);
             }
             goto wait_for_rekey;       /* this is still utterly horrid */
@@ -6511,7 +6515,7 @@ static void ssh2_channel_init(struct ssh_channel *c)
     c->pending_close = FALSE;
     c->throttling_conn = FALSE;
     c->v.v2.locwindow = c->v.v2.locmaxwin = c->v.v2.remlocwin =
-	ssh->cfg.ssh_simple ? OUR_V2_BIGWIN : OUR_V2_WINSIZE;
+	conf_get_int(ssh->conf, CONF_ssh_simple) ? OUR_V2_BIGWIN : OUR_V2_WINSIZE;
     c->v.v2.winadj_head = c->v.v2.winadj_tail = NULL;
     c->v.v2.throttle_state = UNTHROTTLED;
     bufchain_init(&c->v.v2.outbuffer);
@@ -6796,7 +6800,7 @@ static void ssh2_msg_channel_data(Ssh ssh, struct Packet *pktin)
 	 * throttle the whole channel.
 	 */
 	if ((bufsize > c->v.v2.locmaxwin ||
-	     (ssh->cfg.ssh_simple && bufsize > 0)) &&
+	     (conf_get_int(ssh->conf, CONF_ssh_simple) && bufsize > 0)) &&
 	    !c->throttling_conn) {
 	    c->throttling_conn = 1;
 	    ssh_throttle_conn(ssh, +1);
@@ -6871,7 +6875,7 @@ static void ssh2_msg_channel_close(Ssh ssh, struct Packet *pktin)
      * (This is only our termination condition if we're
      * not running in -N mode.)
      */
-    if (!ssh->cfg.ssh_no_shell && count234(ssh->channels) == 0) {
+    if (!conf_get_int(ssh->conf, CONF_ssh_no_shell) && count234(ssh->channels) == 0) {
 	/*
 	 * We used to send SSH_MSG_DISCONNECT here,
 	 * because I'd believed that _every_ conforming
@@ -7186,7 +7190,7 @@ static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
 	if (!ssh->X11_fwd_enabled)
 	    error = "X11 forwarding is not enabled";
 	else if ((x11err = x11_init(&c->u.x11.s, ssh->x11disp, c,
-				    addrstr, peerport, &ssh->cfg)) != NULL) {
+				    addrstr, peerport, ssh->conf)) != NULL) {
 	    logeventf(ssh, "Local X11 connection failed: %s", x11err);
 	    error = "Unable to open an X11 connection";
 	} else {
@@ -7213,7 +7217,7 @@ static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
 	    const char *e = pfd_newconnect(&c->u.pfd.s,
 					   realpf->dhost,
 					   realpf->dport, c,
-					   &ssh->cfg,
+					   ssh->conf,
 					   realpf->pfrec->addressfamily);
 	    logeventf(ssh, "Attempting to forward remote port to "
 		      "%s:%d", realpf->dhost, realpf->dport);
@@ -7269,7 +7273,7 @@ static void ssh2_msg_channel_open(Ssh ssh, struct Packet *pktin)
 static void ssh2_msg_userauth_banner(Ssh ssh, struct Packet *pktin)
 {
     /* Arbitrary limit to prevent unbounded inflation of buffer */
-    if (ssh->cfg.ssh_show_banner &&
+    if (conf_get_int(ssh->conf, CONF_ssh_show_banner) &&
 	bufchain_size(&ssh->banner) <= 131072) {
 	char *banner = NULL;
 	int size = 0;
@@ -7327,7 +7331,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 	int we_are_in, userauth_success;
 	prompts_t *cur_prompt;
 	int num_prompts;
-	char username[100];
+	char *username;
 	char *password;
 	int got_username;
 	void *publickey_blob;
@@ -7346,6 +7350,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 	int try_send;
 	int num_env, env_left, env_ok;
 	struct Packet *pktout;
+	Filename *keyfile;
 #ifndef NO_GSSAPI
 	struct ssh_gss_library *gsslib;
 	Ssh_gss_ctx gss_ctx;
@@ -7365,7 +7370,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
     s->tried_gssapi = FALSE;
 #endif
 
-    if (!ssh->cfg.ssh_no_userauth) {
+    if (!conf_get_int(ssh->conf, CONF_ssh_no_userauth)) {
 	/*
 	 * Request userauth protocol, and await a response to it.
 	 */
@@ -7408,28 +7413,29 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 	 * Load the public half of any configured public key file
 	 * for later use.
 	 */
-	if (!filename_is_null(ssh->cfg.keyfile)) {
+	s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
+	if (!filename_is_null(*s->keyfile)) {
 	    int keytype;
 	    logeventf(ssh, "Reading private key file \"%.150s\"",
-		      filename_to_str(&ssh->cfg.keyfile));
-	    keytype = key_type(&ssh->cfg.keyfile);
+		      filename_to_str(s->keyfile));
+	    keytype = key_type(s->keyfile);
 	    if (keytype == SSH_KEYTYPE_SSH2) {
 		const char *error;
 		s->publickey_blob =
-		    ssh2_userkey_loadpub(&ssh->cfg.keyfile,
+		    ssh2_userkey_loadpub(s->keyfile,
 					 &s->publickey_algorithm,
 					 &s->publickey_bloblen, 
 					 &s->publickey_comment, &error);
 		if (s->publickey_blob) {
 		    s->publickey_encrypted =
-			ssh2_userkey_encrypted(&ssh->cfg.keyfile, NULL);
+			ssh2_userkey_encrypted(s->keyfile, NULL);
 		} else {
 		    char *msgbuf;
 		    logeventf(ssh, "Unable to load private key (%s)", 
 			      error);
 		    msgbuf = dupprintf("Unable to load private key file "
 				       "\"%.150s\" (%s)\r\n",
-				       filename_to_str(&ssh->cfg.keyfile),
+				       filename_to_str(s->keyfile),
 				       error);
 		    c_write_str(ssh, msgbuf);
 		    sfree(msgbuf);
@@ -7440,7 +7446,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 			  key_type_to_str(keytype));
 		msgbuf = dupprintf("Unable to use key file \"%.150s\""
 				   " (%s)\r\n",
-				   filename_to_str(&ssh->cfg.keyfile),
+				   filename_to_str(s->keyfile),
 				   key_type_to_str(keytype));
 		c_write_str(ssh, msgbuf);
 		sfree(msgbuf);
@@ -7455,7 +7461,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 	s->nkeys = 0;
 	s->agent_response = NULL;
 	s->pkblob_in_agent = NULL;
-	if (ssh->cfg.tryagent && agent_exists()) {
+	if (conf_get_int(ssh->conf, CONF_tryagent) && agent_exists()) {
 
 	    void *r;
 
@@ -7538,26 +7544,24 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
      *    the username they will want to be able to get back and
      *    retype it!
      */
-    s->username[0] = '\0';
     s->got_username = FALSE;
     while (!s->we_are_in) {
 	/*
 	 * Get a username.
 	 */
-	if (s->got_username && !ssh->cfg.change_username) {
+	if (s->got_username && !conf_get_int(ssh->conf, CONF_change_username)) {
 	    /*
 	     * We got a username last time round this loop, and
 	     * with change_username turned off we don't try to get
 	     * it again.
 	     */
-	} else if (!get_remote_username(&ssh->cfg, s->username,
-					sizeof(s->username))) {
+	} else if ((ssh->username = get_remote_username(ssh->conf)) == NULL) {
 	    int ret; /* need not be kept over crReturn */
 	    s->cur_prompt = new_prompts(ssh->frontend);
 	    s->cur_prompt->to_server = TRUE;
 	    s->cur_prompt->name = dupstr("SSH login name");
-	    add_prompt(s->cur_prompt, dupstr("login as: "), TRUE,
-		       lenof(s->username)); 
+	    /* 512 is an arbitrary limit :-( */
+	    add_prompt(s->cur_prompt, dupstr("login as: "), TRUE, 512); 
 	    ret = get_userpass_input(s->cur_prompt, NULL, 0);
 	    while (ret < 0) {
 		ssh->send_ok = 1;
@@ -7574,13 +7578,12 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		ssh_disconnect(ssh, "No username provided", NULL, 0, TRUE);
 		crStopV;
 	    }
-	    memcpy(s->username, s->cur_prompt->prompts[0]->result,
-		   lenof(s->username));
+	    ssh->username = dupstr(s->cur_prompt->prompts[0]->result);
 	    free_prompts(s->cur_prompt);
 	} else {
 	    char *stuff;
 	    if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
-		stuff = dupprintf("Using username \"%s\".\r\n", s->username);
+		stuff = dupprintf("Using username \"%s\".\r\n", ssh->username);
 		c_write_str(ssh, stuff);
 		sfree(stuff);
 	    }
@@ -7595,7 +7598,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 	ssh->pkt_actx = SSH2_PKTCTX_NOAUTH;
 
 	s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-	ssh2_pkt_addstring(s->pktout, s->username);
+	ssh2_pkt_addstring(s->pktout, ssh->username);
 	ssh2_pkt_addstring(s->pktout, "ssh-connection");/* service requested */
 	ssh2_pkt_addstring(s->pktout, "none");    /* method */
 	ssh2_pkt_send(ssh, s->pktout);
@@ -7707,7 +7710,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 			c_write_str(ssh, "Access denied\r\n");
 			logevent("Access denied");
 			if (s->type == AUTH_TYPE_PASSWORD &&
-			    ssh->cfg.change_username) {
+			    conf_get_int(ssh->conf, CONF_change_username)) {
 			    /* XXX perhaps we should allow
 			     * keyboard-interactive to do this too? */
 			    s->we_are_in = FALSE;
@@ -7723,12 +7726,12 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		    in_commasep_string("publickey", methods, methlen);
 		s->can_passwd =
 		    in_commasep_string("password", methods, methlen);
-		s->can_keyb_inter = ssh->cfg.try_ki_auth &&
+		s->can_keyb_inter = conf_get_int(ssh->conf, CONF_try_ki_auth) &&
 		    in_commasep_string("keyboard-interactive", methods, methlen);
 #ifndef NO_GSSAPI
 		if (!ssh->gsslibs)
-		    ssh->gsslibs = ssh_gss_setup(&ssh->cfg);
-		s->can_gssapi = ssh->cfg.try_gssapi_auth &&
+		    ssh->gsslibs = ssh_gss_setup(ssh->conf);
+		s->can_gssapi = conf_get_int(ssh->conf, CONF_try_gssapi_auth) &&
 		    in_commasep_string("gssapi-with-mic", methods, methlen) &&
 		    ssh->gsslibs->nlibraries > 0;
 #endif
@@ -7761,7 +7764,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 
 		/* See if server will accept it */
 		s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		ssh2_pkt_addstring(s->pktout, s->username);
+		ssh2_pkt_addstring(s->pktout, ssh->username);
 		ssh2_pkt_addstring(s->pktout, "ssh-connection");
 						    /* service requested */
 		ssh2_pkt_addstring(s->pktout, "publickey");
@@ -7796,7 +7799,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		     * Construct a SIGN_REQUEST.
 		     */
 		    s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		    ssh2_pkt_addstring(s->pktout, s->username);
+		    ssh2_pkt_addstring(s->pktout, ssh->username);
 		    ssh2_pkt_addstring(s->pktout, "ssh-connection");
 							/* service requested */
 		    ssh2_pkt_addstring(s->pktout, "publickey");
@@ -7900,7 +7903,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		 * willing to accept it.
 		 */
 		s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		ssh2_pkt_addstring(s->pktout, s->username);
+		ssh2_pkt_addstring(s->pktout, ssh->username);
 		ssh2_pkt_addstring(s->pktout, "ssh-connection");
 						/* service requested */
 		ssh2_pkt_addstring(s->pktout, "publickey");	/* method */
@@ -7974,8 +7977,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		    /*
 		     * Try decrypting the key.
 		     */
-		    key = ssh2_load_userkey(&ssh->cfg.keyfile, passphrase,
-					    &error);
+		    s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
+		    key = ssh2_load_userkey(s->keyfile, passphrase, &error);
 		    if (passphrase) {
 			/* burn the evidence */
 			memset(passphrase, 0, strlen(passphrase));
@@ -8008,7 +8011,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		     * Hallelujah. Generate a signature and send it.
 		     */
 		    s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		    ssh2_pkt_addstring(s->pktout, s->username);
+		    ssh2_pkt_addstring(s->pktout, ssh->username);
 		    ssh2_pkt_addstring(s->pktout, "ssh-connection");
 						    /* service requested */
 		    ssh2_pkt_addstring(s->pktout, "publickey");
@@ -8081,7 +8084,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		    int i, j;
 		    s->gsslib = NULL;
 		    for (i = 0; i < ngsslibs; i++) {
-			int want_id = ssh->cfg.ssh_gsslist[i];
+			int want_id = conf_get_int_int(ssh->conf,
+						       CONF_ssh_gsslist, i);
 			for (j = 0; j < ssh->gsslibs->nlibraries; j++)
 			    if (ssh->gsslibs->libraries[j].id == want_id) {
 				s->gsslib = &ssh->gsslibs->libraries[j];
@@ -8104,7 +8108,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 
 		/* Sending USERAUTH_REQUEST with "gssapi-with-mic" method */
 		s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		ssh2_pkt_addstring(s->pktout, s->username);
+		ssh2_pkt_addstring(s->pktout, ssh->username);
 		ssh2_pkt_addstring(s->pktout, "ssh-connection");
 		ssh2_pkt_addstring(s->pktout, "gssapi-with-mic");
 
@@ -8175,7 +8179,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 			(s->gsslib,
 			 &s->gss_ctx,
 			 s->gss_srv_name,
-			 ssh->cfg.gssapifwd,
+			 conf_get_int(ssh->conf, CONF_gssapifwd),
 			 &s->gss_rcvtok,
 			 &s->gss_sndtok);
 
@@ -8231,7 +8235,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		ssh_pkt_addstring_start(s->pktout);
 		ssh_pkt_addstring_data(s->pktout, (char *)ssh->v2_session_id, ssh->v2_session_id_len);
 		ssh_pkt_addbyte(s->pktout, SSH2_MSG_USERAUTH_REQUEST);
-		ssh_pkt_addstring(s->pktout, s->username);
+		ssh_pkt_addstring(s->pktout, ssh->username);
 		ssh_pkt_addstring(s->pktout, "ssh-connection");
 		ssh_pkt_addstring(s->pktout, "gssapi-with-mic");
 
@@ -8262,7 +8266,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		ssh->pkt_actx = SSH2_PKTCTX_KBDINTER;
 
 		s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		ssh2_pkt_addstring(s->pktout, s->username);
+		ssh2_pkt_addstring(s->pktout, ssh->username);
 		ssh2_pkt_addstring(s->pktout, "ssh-connection");
 							/* service requested */
 		ssh2_pkt_addstring(s->pktout, "keyboard-interactive");
@@ -8417,8 +8421,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		s->cur_prompt = new_prompts(ssh->frontend);
 		s->cur_prompt->to_server = TRUE;
 		s->cur_prompt->name = dupstr("SSH password");
-		add_prompt(s->cur_prompt, dupprintf("%.90s@%.90s's password: ",
-						    s->username,
+		add_prompt(s->cur_prompt, dupprintf("%s@%s's password: ",
+						    ssh->username,
 						    ssh->savedhost),
 			   FALSE, SSH_MAX_PASSWORD_LEN);
 
@@ -8458,7 +8462,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		 * people who find out how long their password is!
 		 */
 		s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		ssh2_pkt_addstring(s->pktout, s->username);
+		ssh2_pkt_addstring(s->pktout, ssh->username);
 		ssh2_pkt_addstring(s->pktout, "ssh-connection");
 							/* service requested */
 		ssh2_pkt_addstring(s->pktout, "password");
@@ -8587,7 +8591,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 		     * (see above for padding rationale)
 		     */
 		    s->pktout = ssh2_pkt_init(SSH2_MSG_USERAUTH_REQUEST);
-		    ssh2_pkt_addstring(s->pktout, s->username);
+		    ssh2_pkt_addstring(s->pktout, ssh->username);
 		    ssh2_pkt_addstring(s->pktout, "ssh-connection");
 							/* service requested */
 		    ssh2_pkt_addstring(s->pktout, "password");
@@ -8692,9 +8696,9 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
     /*
      * Create the main session channel.
      */
-    if (ssh->cfg.ssh_no_shell) {
+    if (conf_get_int(ssh->conf, CONF_ssh_no_shell)) {
 	ssh->mainchan = NULL;
-    } else if (*ssh->cfg.ssh_nc_host) {
+    } else if (*conf_get_str(ssh->conf, CONF_ssh_nc_host)) {
 	/*
 	 * Just start a direct-tcpip channel and use it as the main
 	 * channel.
@@ -8704,14 +8708,15 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 	ssh2_channel_init(ssh->mainchan);
 	logeventf(ssh,
 		  "Opening direct-tcpip channel to %s:%d in place of session",
-		  ssh->cfg.ssh_nc_host, ssh->cfg.ssh_nc_port);
+		  conf_get_str(ssh->conf, CONF_ssh_nc_host),
+		  conf_get_int(ssh->conf, CONF_ssh_nc_port));
 	s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_OPEN);
 	ssh2_pkt_addstring(s->pktout, "direct-tcpip");
 	ssh2_pkt_adduint32(s->pktout, ssh->mainchan->localid);
 	ssh2_pkt_adduint32(s->pktout, ssh->mainchan->v.v2.locwindow);/* our window size */
 	ssh2_pkt_adduint32(s->pktout, OUR_V2_MAXPKT);      /* our max pkt size */
-	ssh2_pkt_addstring(s->pktout, ssh->cfg.ssh_nc_host);
-	ssh2_pkt_adduint32(s->pktout, ssh->cfg.ssh_nc_port);
+	ssh2_pkt_addstring(s->pktout, conf_get_str(ssh->conf, CONF_ssh_nc_host));
+	ssh2_pkt_adduint32(s->pktout, conf_get_int(ssh->conf, CONF_ssh_nc_port));
 	/*
 	 * There's nothing meaningful to put in the originator
 	 * fields, but some servers insist on syntactically correct
@@ -8789,7 +8794,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
     ssh->packet_dispatch[SSH2_MSG_CHANNEL_OPEN] =
 	ssh2_msg_channel_open;
 
-    if (ssh->mainchan && ssh->cfg.ssh_simple) {
+    if (ssh->mainchan && conf_get_int(ssh->conf, CONF_ssh_simple)) {
 	/*
 	 * This message indicates to the server that we promise
 	 * not to try to run any other channel in parallel with
@@ -8806,9 +8811,9 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
     /*
      * Potentially enable X11 forwarding.
      */
-    if (ssh->mainchan && !ssh->ncmode && ssh->cfg.x11_forward &&
-	(ssh->x11disp = x11_setup_display(ssh->cfg.x11_display,
-					  ssh->cfg.x11_auth, &ssh->cfg))) {
+    if (ssh->mainchan && !ssh->ncmode && conf_get_int(ssh->conf, CONF_x11_forward) &&
+	(ssh->x11disp = x11_setup_display(conf_get_str(ssh->conf, CONF_x11_display),
+					  conf_get_int(ssh->conf, CONF_x11_auth), ssh->conf))) {
 	logevent("Requesting X11 forwarding");
 	s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
 	ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
@@ -8847,12 +8852,12 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
     /*
      * Enable port forwardings.
      */
-    ssh_setup_portfwd(ssh, &ssh->cfg);
+    ssh_setup_portfwd(ssh, ssh->conf);
 
     /*
      * Potentially enable agent forwarding.
      */
-    if (ssh->mainchan && !ssh->ncmode && ssh->cfg.agentfwd && agent_exists()) {
+    if (ssh->mainchan && !ssh->ncmode && conf_get_int(ssh->conf, CONF_agentfwd) && agent_exists()) {
 	logevent("Requesting OpenSSH-style agent forwarding");
 	s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
 	ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
@@ -8878,24 +8883,23 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
     /*
      * Now allocate a pty for the session.
      */
-    if (ssh->mainchan && !ssh->ncmode && !ssh->cfg.nopty) {
+    if (ssh->mainchan && !ssh->ncmode && !conf_get_int(ssh->conf, CONF_nopty)) {
 	/* Unpick the terminal-speed string. */
 	/* XXX perhaps we should allow no speeds to be sent. */
         ssh->ospeed = 38400; ssh->ispeed = 38400; /* last-resort defaults */
-	sscanf(ssh->cfg.termspeed, "%d,%d", &ssh->ospeed, &ssh->ispeed);
+	sscanf(conf_get_str(ssh->conf, CONF_termspeed), "%d,%d", &ssh->ospeed, &ssh->ispeed);
 	/* Build the pty request. */
 	s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
 	ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);	/* recipient channel */
 	ssh2_pkt_addstring(s->pktout, "pty-req");
 	ssh2_pkt_addbool(s->pktout, 1);	       /* want reply */
-	ssh2_pkt_addstring(s->pktout, ssh->cfg.termtype);
+	ssh2_pkt_addstring(s->pktout, conf_get_str(ssh->conf, CONF_termtype));
 	ssh2_pkt_adduint32(s->pktout, ssh->term_width);
 	ssh2_pkt_adduint32(s->pktout, ssh->term_height);
 	ssh2_pkt_adduint32(s->pktout, 0);	       /* pixel width */
 	ssh2_pkt_adduint32(s->pktout, 0);	       /* pixel height */
 	ssh2_pkt_addstring_start(s->pktout);
-	parse_ttymodes(ssh, ssh->cfg.ttymodes,
-		       ssh2_send_ttymode, (void *)s->pktout);
+	parse_ttymodes(ssh, ssh2_send_ttymode, (void *)s->pktout);
 	ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_ISPEED);
 	ssh2_pkt_adduint32(s->pktout, ssh->ispeed);
 	ssh2_pkt_addbyte(s->pktout, SSH2_TTY_OP_OSPEED);
@@ -8928,63 +8932,57 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
      * Simplest thing here is to send all the requests at once, and
      * then wait for a whole bunch of successes or failures.
      */
-    if (ssh->mainchan && !ssh->ncmode && *ssh->cfg.environmt) {
-	char *e = ssh->cfg.environmt;
-	char *var, *varend, *val;
+    if (ssh->mainchan && !ssh->ncmode) {
+	char *key, *val;
 
 	s->num_env = 0;
 
-	while (*e) {
-	    var = e;
-	    while (*e && *e != '\t') e++;
-	    varend = e;
-	    if (*e == '\t') e++;
-	    val = e;
-	    while (*e) e++;
-	    e++;
-
+	for (val = conf_get_str_strs(ssh->conf, CONF_environmt, NULL, &key);
+	     val != NULL;
+	     val = conf_get_str_strs(ssh->conf, CONF_environmt, key, &key)) {
 	    s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
 	    ssh2_pkt_adduint32(s->pktout, ssh->mainchan->remoteid);
 	    ssh2_pkt_addstring(s->pktout, "env");
 	    ssh2_pkt_addbool(s->pktout, 1);	       /* want reply */
-	    ssh2_pkt_addstring_start(s->pktout);
-	    ssh2_pkt_addstring_data(s->pktout, var, varend-var);
+	    ssh2_pkt_addstring(s->pktout, key);
 	    ssh2_pkt_addstring(s->pktout, val);
 	    ssh2_pkt_send(ssh, s->pktout);
 
 	    s->num_env++;
 	}
 
-	logeventf(ssh, "Sent %d environment variables", s->num_env);
+	if (s->num_env) {
+	    logeventf(ssh, "Sent %d environment variables", s->num_env);
 
-	s->env_ok = 0;
-	s->env_left = s->num_env;
+	    s->env_ok = 0;
+	    s->env_left = s->num_env;
 
-	while (s->env_left > 0) {
-	    crWaitUntilV(pktin);
+	    while (s->env_left > 0) {
+		crWaitUntilV(pktin);
 
-	    if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
-		if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
-		    bombout(("Unexpected response to environment request:"
-			     " packet type %d", pktin->type));
-		    crStopV;
+		if (pktin->type != SSH2_MSG_CHANNEL_SUCCESS) {
+		    if (pktin->type != SSH2_MSG_CHANNEL_FAILURE) {
+			bombout(("Unexpected response to environment request:"
+				 " packet type %d", pktin->type));
+			crStopV;
+		    }
+		} else {
+		    s->env_ok++;
 		}
-	    } else {
-		s->env_ok++;
-	    }
 
-	    s->env_left--;
-	}
+		s->env_left--;
+	    }
 
-	if (s->env_ok == s->num_env) {
-	    logevent("All environment variables successfully set");
-	} else if (s->env_ok == 0) {
-	    logevent("All environment variables refused");
-	    c_write_str(ssh, "Server refused to set environment variables\r\n");
-	} else {
-	    logeventf(ssh, "%d environment variables refused",
-		      s->num_env - s->env_ok);
-	    c_write_str(ssh, "Server refused to set all environment variables\r\n");
+	    if (s->env_ok == s->num_env) {
+		logevent("All environment variables successfully set");
+	    } else if (s->env_ok == 0) {
+		logevent("All environment variables refused");
+		c_write_str(ssh, "Server refused to set environment variables\r\n");
+	    } else {
+		logeventf(ssh, "%d environment variables refused",
+			  s->num_env - s->env_ok);
+		c_write_str(ssh, "Server refused to set all environment variables\r\n");
+	    }
 	}
     }
 
@@ -8998,12 +8996,11 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 	char *cmd;
 
 	if (ssh->fallback_cmd) {
-	    subsys = ssh->cfg.ssh_subsys2;
-	    cmd = ssh->cfg.remote_cmd_ptr2;
+	    subsys = conf_get_int(ssh->conf, CONF_ssh_subsys2);
+	    cmd = conf_get_str(ssh->conf, CONF_remote_cmd2);
 	} else {
-	    subsys = ssh->cfg.ssh_subsys;
-	    cmd = ssh->cfg.remote_cmd_ptr;
-	    if (!cmd) cmd = ssh->cfg.remote_cmd;
+	    subsys = conf_get_int(ssh->conf, CONF_ssh_subsys);
+	    cmd = conf_get_str(ssh->conf, CONF_remote_cmd);
 	}
 
 	s->pktout = ssh2_pkt_init(SSH2_MSG_CHANNEL_REQUEST);
@@ -9036,7 +9033,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 	     * not, and if the fallback command exists, try falling
 	     * back to it before complaining.
 	     */
-	    if (!ssh->fallback_cmd && ssh->cfg.remote_cmd_ptr2 != NULL) {
+	    if (!ssh->fallback_cmd &&
+		*conf_get_str(ssh->conf, CONF_remote_cmd2)) {
 		logevent("Primary command failed; attempting fallback");
 		ssh->fallback_cmd = TRUE;
 		continue;
@@ -9226,7 +9224,7 @@ static void ssh2_timer(void *ctx, long now)
     if (ssh->state == SSH_STATE_CLOSED)
 	return;
 
-    if (!ssh->kex_in_progress && ssh->cfg.ssh_rekey_time != 0 &&
+    if (!ssh->kex_in_progress && conf_get_int(ssh->conf, CONF_ssh_rekey_time) != 0 &&
 	now - ssh->next_rekey >= 0) {
 	do_ssh2_transport(ssh, "timeout", -1, NULL);
     }
@@ -9267,21 +9265,26 @@ static void ssh2_protocol(Ssh ssh, void *vin, int inlen,
     }
 }
 
+static void ssh_cache_conf_values(Ssh ssh)
+{
+    ssh->logomitdata = conf_get_int(ssh->conf, CONF_logomitdata);
+}
+
 /*
  * Called to set up the connection.
  *
  * Returns an error message, or NULL on success.
  */
 static const char *ssh_init(void *frontend_handle, void **backend_handle,
-			    Config *cfg,
-			    char *host, int port, char **realhost, int nodelay,
-			    int keepalive)
+			    Conf *conf, char *host, int port, char **realhost,
+			    int nodelay, int keepalive)
 {
     const char *p;
     Ssh ssh;
 
     ssh = snew(struct ssh_tag);
-    ssh->cfg = *cfg;		       /* STRUCTURE COPY */
+    ssh->conf = conf_copy(conf);
+    ssh_cache_conf_values(ssh);
     ssh->version = 0;		       /* when not ready yet */
     ssh->s = NULL;
     ssh->cipher = NULL;
@@ -9343,6 +9346,7 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle,
     ssh->deferred_rekey_reason = NULL;
     bufchain_init(&ssh->queued_incoming_data);
     ssh->frozen = FALSE;
+    ssh->username = NULL;
 
     *backend_handle = ssh;
 
@@ -9352,8 +9356,8 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle,
 #endif
 
     ssh->frontend = frontend_handle;
-    ssh->term_width = ssh->cfg.width;
-    ssh->term_height = ssh->cfg.height;
+    ssh->term_width = conf_get_int(ssh->conf, CONF_width);
+    ssh->term_height = conf_get_int(ssh->conf, CONF_height);
 
     ssh->channels = NULL;
     ssh->rportfwds = NULL;
@@ -9374,7 +9378,8 @@ static const char *ssh_init(void *frontend_handle, void **backend_handle,
 
     ssh->incoming_data_size = ssh->outgoing_data_size =
 	ssh->deferred_data_size = 0L;
-    ssh->max_data_size = parse_blocksize(ssh->cfg.ssh_rekey_data);
+    ssh->max_data_size = parse_blocksize(conf_get_str(ssh->conf,
+						      CONF_ssh_rekey_data));
     ssh->kex_in_progress = FALSE;
 
 #ifndef NO_GSSAPI
@@ -9478,6 +9483,8 @@ static void ssh_free(void *handle)
     if (ssh->pinger)
 	pinger_free(ssh->pinger);
     bufchain_clear(&ssh->queued_incoming_data);
+    sfree(ssh->username);
+    conf_free(ssh->conf);
 #ifndef NO_GSSAPI
     if (ssh->gsslibs)
 	ssh_gss_cleanup(ssh->gsslibs);
@@ -9490,19 +9497,21 @@ static void ssh_free(void *handle)
 /*
  * Reconfigure the SSH backend.
  */
-static void ssh_reconfig(void *handle, Config *cfg)
+static void ssh_reconfig(void *handle, Conf *conf)
 {
     Ssh ssh = (Ssh) handle;
     char *rekeying = NULL, rekey_mandatory = FALSE;
     unsigned long old_max_data_size;
+    int i, rekey_time;
 
-    pinger_reconfig(ssh->pinger, &ssh->cfg, cfg);
+    pinger_reconfig(ssh->pinger, ssh->conf, conf);
     if (ssh->portfwds)
-	ssh_setup_portfwd(ssh, cfg);
+	ssh_setup_portfwd(ssh, conf);
 
-    if (ssh->cfg.ssh_rekey_time != cfg->ssh_rekey_time &&
-	cfg->ssh_rekey_time != 0) {
-	long new_next = ssh->last_rekey + cfg->ssh_rekey_time*60*TICKSPERSEC;
+    rekey_time = conf_get_int(conf, CONF_ssh_rekey_time);
+    if (conf_get_int(ssh->conf, CONF_ssh_rekey_time) != rekey_time &&
+	rekey_time != 0) {
+	long new_next = ssh->last_rekey + rekey_time*60*TICKSPERSEC;
 	long now = GETTICKCOUNT();
 
 	if (new_next - now < 0) {
@@ -9513,7 +9522,8 @@ static void ssh_reconfig(void *handle, Config *cfg)
     }
 
     old_max_data_size = ssh->max_data_size;
-    ssh->max_data_size = parse_blocksize(cfg->ssh_rekey_data);
+    ssh->max_data_size = parse_blocksize(conf_get_str(ssh->conf,
+						      CONF_ssh_rekey_data));
     if (old_max_data_size != ssh->max_data_size &&
 	ssh->max_data_size != 0) {
 	if (ssh->outgoing_data_size > ssh->max_data_size ||
@@ -9521,19 +9531,27 @@ static void ssh_reconfig(void *handle, Config *cfg)
 	    rekeying = "data limit lowered";
     }
 
-    if (ssh->cfg.compression != cfg->compression) {
+    if (conf_get_int(ssh->conf, CONF_compression) !=
+	conf_get_int(conf, CONF_compression)) {
 	rekeying = "compression setting changed";
 	rekey_mandatory = TRUE;
     }
 
-    if (ssh->cfg.ssh2_des_cbc != cfg->ssh2_des_cbc ||
-	memcmp(ssh->cfg.ssh_cipherlist, cfg->ssh_cipherlist,
-	       sizeof(ssh->cfg.ssh_cipherlist))) {
+    for (i = 0; i < CIPHER_MAX; i++)
+	if (conf_get_int_int(ssh->conf, CONF_ssh_cipherlist, i) !=
+	    conf_get_int_int(conf, CONF_ssh_cipherlist, i)) {
+	rekeying = "cipher settings changed";
+	rekey_mandatory = TRUE;
+    }
+    if (conf_get_int(ssh->conf, CONF_ssh2_des_cbc) !=
+	conf_get_int(conf, CONF_ssh2_des_cbc)) {
 	rekeying = "cipher settings changed";
 	rekey_mandatory = TRUE;
     }
 
-    ssh->cfg = *cfg;		       /* STRUCTURE COPY */
+    conf_free(ssh->conf);
+    ssh->conf = conf_copy(conf);
+    ssh_cache_conf_values(ssh);
 
     if (rekeying) {
 	if (!ssh->kex_in_progress) {
@@ -9611,7 +9629,7 @@ static void ssh_size(void *handle, int width, int height)
 	ssh->size_needed = TRUE;       /* buffer for later */
 	break;
       case SSH_STATE_SESSION:
-	if (!ssh->cfg.nopty) {
+	if (!conf_get_int(ssh->conf, CONF_nopty)) {
 	    if (ssh->version == 1) {
 		send_packet(ssh, SSH1_CMSG_WINDOW_SIZE,
 			    PKT_INT, ssh->term_height,
@@ -9835,7 +9853,7 @@ static void ssh_unthrottle(void *handle, int bufsize)
 	    ssh2_set_window(ssh->mainchan,
 			    bufsize < ssh->mainchan->v.v2.locmaxwin ?
 			    ssh->mainchan->v.v2.locmaxwin - bufsize : 0);
-	    if (ssh->cfg.ssh_simple)
+	    if (conf_get_int(ssh->conf, CONF_ssh_simple))
 		buflimit = 0;
 	    else
 		buflimit = ssh->mainchan->v.v2.locmaxwin;