* New upstream release (closes: #474301). Important changes not previously

  backported to 4.7p1:
  - 4.9/4.9p1 (http://www.openssh.com/txt/release-4.9):
    + Added chroot(2) support for sshd(8), controlled by a new option
      "ChrootDirectory" (closes: #139047, LP: #24777).
    + Linked sftp-server(8) into sshd(8). The internal sftp server is used
      when the command "internal-sftp" is specified in a Subsystem or
      ForceCommand declaration. When used with ChrootDirectory, the
      internal sftp server requires no special configuration of files
      inside the chroot environment.
    + Added a protocol extension method "posix-rename@openssh.com" for
      sftp-server(8) to perform POSIX atomic rename() operations; sftp(1)
      prefers this if available (closes: #308561).
    + Removed the fixed limit of 100 file handles in sftp-server(8).
    + ssh(8) will now skip generation of SSH protocol 1 ephemeral server
      keys when in inetd mode and protocol 2 connections are negotiated.
      This speeds up protocol 2 connections to inetd-mode servers that
      also allow Protocol 1.
    + Accept the PermitRootLogin directive in a sshd_config(5) Match
      block. Allows for, e.g. permitting root only from the local network.
    + Reworked sftp(1) argument splitting and escaping to be more
      internally consistent (i.e. between sftp commands) and more
      consistent with sh(1). Please note that this will change the
      interpretation of some quoted strings, especially those with
      embedded backslash escape sequences.
    + Support "Banner=none" in sshd_config(5) to disable sending of a
      pre-login banner (e.g. in a Match block).
    + ssh(1) ProxyCommands are now executed with $SHELL rather than
      /bin/sh.
    + ssh(1)'s ConnectTimeout option is now applied to both the TCP
      connection and the SSH banner exchange (previously it just covered
      the TCP connection). This allows callers of ssh(1) to better detect
      and deal with stuck servers that accept a TCP connection but don't
      progress the protocol, and also makes ConnectTimeout useful for
      connections via a ProxyCommand.
    + scp(1) incorrectly reported "stalled" on slow copies (closes:
      #140828).
    + scp(1) date underflow for timestamps before epoch.
    + ssh(1) used the obsolete SIG DNS RRtype for host keys in DNS,
      instead of the current standard RRSIG.
    + Correctly drain ACKs when a sftp(1) upload write fails midway,
      avoids a fatal() exit from what should be a recoverable condition.
    + Fixed ssh-keygen(1) selective host key hashing (i.e. "ssh-keygen -HF
      hostname") to not include any IP address in the data to be hashed.
    + Make ssh(1) skip listening on the IPv6 wildcard address when a
      binding address of 0.0.0.0 is used against an old SSH server that
      does not support the RFC4254 syntax for wildcard bind addresses.
    + Enable IPV6_V6ONLY socket option on sshd(8) listen socket, as is
      already done for X11/TCP forwarding sockets (closes: #439661).
    + Fix FD leak that could hang a ssh(1) connection multiplexing master.
    + Make ssh(1) -q option documentation consistent with reality.
    + Fixed sshd(8) PAM support not calling pam_session_close(), or
      failing to call it with root privileges (closes: #372680).
    + Fix activation of OpenSSL engine support when requested in configure
      (LP: #119295).
  - 5.1/5.1p1 (http://www.openssh.com/txt/release-5.1):
    + Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1)
      and ssh-keygen(1). Visual fingerprint display is controlled by a new
      ssh_config(5) option "VisualHostKey". The intent is to render SSH
      host keys in a visual form that is amenable to easy recall and
      rejection of changed host keys.
    + sshd_config(5) now supports CIDR address/masklen matching in "Match
      address" blocks, with a fallback to classic wildcard matching.
    + sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys
      from="..." restrictions, also with a fallback to classic wildcard
      matching.
    + Added an extended test mode (-T) to sshd(8) to request that it write
      its effective configuration to stdout and exit. Extended test mode
      also supports the specification of connection parameters (username,
      source address and hostname) to test the application of
      sshd_config(5) Match rules.
    + ssh(1) now prints the number of bytes transferred and the overall
      connection throughput for SSH protocol 2 sessions when in verbose
      mode (previously these statistics were displayed for protocol 1
      connections only).
    + sftp-server(8) now supports extension methods statvfs@openssh.com
      and fstatvfs@openssh.com that implement statvfs(2)-like operations.
    + sftp(1) now has a "df" command to the sftp client that uses the
      statvfs@openssh.com to produce a df(1)-like display of filesystem
      space and inode utilisation (requires statvfs@openssh.com support on
      the server).
    + Added a MaxSessions option to sshd_config(5) to allow control of the
      number of multiplexed sessions supported over a single TCP
      connection. This allows increasing the number of allowed sessions
      above the previous default of 10, disabling connection multiplexing
      (MaxSessions=1) or disallowing login/shell/subsystem sessions
      entirely (MaxSessions=0).
    + Added a no-more-sessions@openssh.com global request extension that
      is sent from ssh(1) to sshd(8) when the client knows that it will
      never request another session (i.e. when session multiplexing is
      disabled). This allows a server to disallow further session requests
      and terminate the session in cases where the client has been
      hijacked.
    + ssh-keygen(1) now supports the use of the -l option in combination
      with -F to search for a host in ~/.ssh/known_hosts and display its
      fingerprint.
    + ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of
      "rsa1".
    + Added an AllowAgentForwarding option to sshd_config(8) to control
      whether authentication agent forwarding is permitted. Note that this
      is a loose control, as a client may install their own unofficial
      forwarder.
    + ssh(1) and sshd(8): avoid unnecessary malloc/copy/free when
      receiving network data, resulting in a ~10% speedup.
    + ssh(1) and sshd(8) will now try additional addresses when connecting
      to a port forward destination whose DNS name resolves to more than
      one address. The previous behaviour was to try the only first
      address and give up if that failed.
    + ssh(1) and sshd(8) now support signalling that channels are
      half-closed for writing, through a channel protocol extension
      notification "eow@openssh.com". This allows propagation of closed
      file descriptors, so that commands such as "ssh -2 localhost od
      /bin/ls | true" do not send unnecessary data over the wire.
    + sshd(8): increased the default size of ssh protocol 1 ephemeral keys
      from 768 to 1024 bits.
    + When ssh(1) has been requested to fork after authentication ("ssh
      -f") with ExitOnForwardFailure enabled, delay the fork until after
      replies for any -R forwards have been seen. Allows for robust
      detection of -R forward failure when using -f.
    + "Match group" blocks in sshd_config(5) now support negation of
      groups. E.g. "Match group staff,!guests".
    + sftp(1) and sftp-server(8) now allow chmod-like operations to set
      set[ug]id/sticky bits.
    + The MaxAuthTries option is now permitted in sshd_config(5) match
      blocks.
    + Multiplexed ssh(1) sessions now support a subset of the ~ escapes
      that are available to a primary connection.
    + ssh(1) connection multiplexing will now fall back to creating a new
      connection in most error cases (closes: #352830).
    + Make ssh(1) deal more gracefully with channel requests that fail.
      Previously it would optimistically assume that requests would always
      succeed, which could cause hangs if they did not (e.g. when the
      server runs out of file descriptors).
    + ssh(1) now reports multiplexing errors via the multiplex slave's
      stderr where possible (subject to LogLevel in the mux master).
    + Prevent sshd(8) from erroneously applying public key restrictions
      leaned from ~/.ssh/authorized_keys to other authentication methods
      when public key authentication subsequently fails (LP: #161047).
    + Fixed an UMAC alignment problem that manifested on Itanium
      platforms.

1 files changed, 345 insertions, 408 deletions

diff --git a/clientloop.c b/clientloop.c
index 7037c4192..abe5609de 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.181 2007/08/15 08:14:46 markus Exp $ */
+/* $OpenBSD: clientloop.c,v 1.201 2008/07/16 11:51:14 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -86,6 +86,7 @@
 #include <pwd.h>
 #include <unistd.h>
 
+#include "openbsd-compat/sys-queue.h"
 #include "xmalloc.h"
 #include "ssh.h"
 #include "ssh1.h"
@@ -120,7 +121,7 @@ extern int stdin_null_flag;
 extern int no_shell_flag;
 
 /* Control socket */
-extern int control_fd;
+extern int muxserver_sock;
 
 /*
  * Name of the host we are connecting to.  This is the name given on the
@@ -143,36 +144,46 @@ static int in_non_blocking_mode = 0;
 
 /* Common data for the client loop code. */
 static volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */
-static int escape_char;         /* Escape character. */
-static int escape_pending;      /* Last character was the escape character */
+static int escape_char1;        /* Escape character. (proto1 only) */
+static int escape_pending1;     /* Last character was an escape (proto1 only) */
 static int last_was_cr;         /* Last character was a newline. */
-static int exit_status;         /* Used to store the exit status of the command. */
-static int stdin_eof;           /* EOF has been encountered on standard error. */
+static int exit_status;         /* Used to store the command exit status. */
+static int stdin_eof;           /* EOF has been encountered on stderr. */
 static Buffer stdin_buffer;     /* Buffer for stdin data. */
 static Buffer stdout_buffer;    /* Buffer for stdout data. */
 static Buffer stderr_buffer;    /* Buffer for stderr data. */
-static u_long stdin_bytes, stdout_bytes, stderr_bytes;
 static u_int buffer_high;/* Soft max buffer size. */
 static int connection_in;       /* Connection to server (input). */
 static int connection_out;      /* Connection to server (output). */
 static int need_rekeying;       /* Set to non-zero if rekeying is requested. */
 static int session_closed = 0;  /* In SSH2: login session closed. */
-static int server_alive_timeouts = 0;
 
 static void client_init_dispatch(void);
 int     session_ident = -1;
 
-struct confirm_ctx {
-        int want_tty;
-        int want_subsys;
-        int want_x_fwd;
-        int want_agent_fwd;
-        Buffer cmd;
-        char *term;
-        struct termios tio;
-        char **env;
+/* Track escape per proto2 channel */
+struct escape_filter_ctx {
+        int escape_pending;
+        int escape_char;
 };
 
+/* Context for channel confirmation replies */
+struct channel_reply_ctx {
+        const char *request_type;
+        int id, do_close;
+};
+
+/* Global request success/failure callbacks */
+struct global_confirm {
+        TAILQ_ENTRY(global_confirm) entry;
+        global_confirm_cb *cb;
+        void *ctx;
+        int ref_count;
+};
+TAILQ_HEAD(global_confirms, global_confirm);
+static struct global_confirms global_confirms =
+    TAILQ_HEAD_INITIALIZER(global_confirms);
+
 /*XXX*/
 extern Kex *xxx_kex;
 
@@ -380,7 +391,10 @@ client_check_initial_eof_on_stdin(void)
                 /* Check for immediate EOF on stdin. */
                 len = read(fileno(stdin), buf, 1);
                 if (len == 0) {
-                        /* EOF.  Record that we have seen it and send EOF to server. */
+                        /*
+                         * EOF.  Record that we have seen it and send
+                         * EOF to server.
+                         */
                         debug("Sending eof.");
                         stdin_eof = 1;
                         packet_start(SSH_CMSG_EOF);
@@ -391,8 +405,8 @@ client_check_initial_eof_on_stdin(void)
                          * and also process it as an escape character if
                          * appropriate.
                          */
-                        if ((u_char) buf[0] == escape_char)
-                                escape_pending = 1;
+                        if ((u_char) buf[0] == escape_char1)
+                                escape_pending1 = 1;
                         else
                                 buffer_append(&stdin_buffer, buf, 1);
                 }
@@ -422,7 +436,6 @@ client_make_packets_from_stdin_data(void)
                 packet_put_string(buffer_ptr(&stdin_buffer), len);
                 packet_send();
                 buffer_consume(&stdin_buffer, len);
-                stdin_bytes += len;
                 /* If we have a pending EOF, send it now. */
                 if (stdin_eof && buffer_len(&stdin_buffer) == 0) {
                         packet_start(SSH_CMSG_EOF);
@@ -467,15 +480,26 @@ client_check_window_change(void)
 static void
 client_global_request_reply(int type, u_int32_t seq, void *ctxt)
 {
-        server_alive_timeouts = 0;
-        client_global_request_reply_fwd(type, seq, ctxt);
+        struct global_confirm *gc;
+
+        if ((gc = TAILQ_FIRST(&global_confirms)) == NULL)
+                return;
+        if (gc->cb != NULL)
+                gc->cb(type, seq, gc->ctx);
+        if (--gc->ref_count <= 0) {
+                TAILQ_REMOVE(&global_confirms, gc, entry);
+                bzero(gc, sizeof(*gc));
+                xfree(gc);
+        }
+
+        keep_alive_timeouts = 0;
 }
 
 static void
 server_alive_check(void)
 {
         if (compat20) {
-                if (++server_alive_timeouts > options.server_alive_count_max) {
+                if (++keep_alive_timeouts > options.server_alive_count_max) {
                         logit("Timeout, server not responding.");
                         cleanup_exit(255);
                 }
@@ -483,6 +507,8 @@ server_alive_check(void)
                 packet_put_cstring("keepalive@openssh.com");
                 packet_put_char(1);     /* boolean: want reply */
                 packet_send();
+                /* Insert an empty placeholder to maintain ordering */
+                client_register_global_confirm(NULL, NULL);
         } else {
                 packet_send_ignore(0);
                 packet_send();
@@ -538,8 +564,8 @@ client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp,
         if (packet_have_data_to_write())
                 FD_SET(connection_out, *writesetp);
 
-        if (control_fd != -1)
-                FD_SET(control_fd, *readsetp);
+        if (muxserver_sock != -1)
+                FD_SET(muxserver_sock, *readsetp);
 
         /*
          * Wait for something to happen.  This will suspend the process until
@@ -581,9 +607,11 @@ client_suspend_self(Buffer *bin, Buffer *bout, Buffer *berr)
 {
         /* Flush stdout and stderr buffers. */
         if (buffer_len(bout) > 0)
-                atomicio(vwrite, fileno(stdout), buffer_ptr(bout), buffer_len(bout));
+                atomicio(vwrite, fileno(stdout), buffer_ptr(bout),
+                    buffer_len(bout));
         if (buffer_len(berr) > 0)
-                atomicio(vwrite, fileno(stderr), buffer_ptr(berr), buffer_len(berr));
+                atomicio(vwrite, fileno(stderr), buffer_ptr(berr),
+                    buffer_len(berr));
 
         leave_raw_mode();
 
@@ -623,9 +651,13 @@ client_process_net_input(fd_set *readset)
                 /* Read as much as possible. */
                 len = read(connection_in, buf, sizeof(buf));
                 if (len == 0) {
-                        /* Received EOF.  The remote host has closed the connection. */
-                        snprintf(buf, sizeof buf, "Connection to %.300s closed by remote host.\r\n",
-                                 host);
+                        /*
+                         * Received EOF.  The remote host has closed the
+                         * connection.
+                         */
+                        snprintf(buf, sizeof buf,
+                            "Connection to %.300s closed by remote host.\r\n",
+                            host);
                         buffer_append(&stderr_buffer, buf, strlen(buf));
                         quit_pending = 1;
                         return;
@@ -634,13 +666,18 @@ client_process_net_input(fd_set *readset)
                  * There is a kernel bug on Solaris that causes select to
                  * sometimes wake up even though there is no data available.
                  */
-                if (len < 0 && (errno == EAGAIN || errno == EINTR))
+                if (len < 0 &&
+                    (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK))
                         len = 0;
 
                 if (len < 0) {
-                        /* An error has encountered.  Perhaps there is a network problem. */
-                        snprintf(buf, sizeof buf, "Read from remote host %.300s: %.100s\r\n",
-                                 host, strerror(errno));
+                        /*
+                         * An error has encountered.  Perhaps there is a
+                         * network problem.
+                         */
+                        snprintf(buf, sizeof buf,
+                            "Read from remote host %.300s: %.100s\r\n",
+                            host, strerror(errno));
                         buffer_append(&stderr_buffer, buf, strlen(buf));
                         quit_pending = 1;
                         return;
@@ -650,289 +687,81 @@ client_process_net_input(fd_set *readset)
 }
 
 static void
-client_subsystem_reply(int type, u_int32_t seq, void *ctxt)
+client_status_confirm(int type, Channel *c, void *ctx)
 {
-        int id;
-        Channel *c;
-
-        id = packet_get_int();
-        packet_check_eom();
-
-        if ((c = channel_lookup(id)) == NULL) {
-                error("%s: no channel for id %d", __func__, id);
-                return;
-        }
-
-        if (type == SSH2_MSG_CHANNEL_SUCCESS)
-                debug2("Request suceeded on channel %d", id);
-        else if (type == SSH2_MSG_CHANNEL_FAILURE) {
-                error("Request failed on channel %d", id);
-                channel_free(c);
+        struct channel_reply_ctx *cr = (struct channel_reply_ctx *)ctx;
+        char errmsg[256];
+        int tochan;
+
+        /* XXX supress on mux _client_ quietmode */
+        tochan = options.log_level >= SYSLOG_LEVEL_ERROR &&
+            c->ctl_fd != -1 && c->extended_usage == CHAN_EXTENDED_WRITE;
+
+        if (type == SSH2_MSG_CHANNEL_SUCCESS) {
+                debug2("%s request accepted on channel %d",
+                    cr->request_type, c->self);
+        } else if (type == SSH2_MSG_CHANNEL_FAILURE) {
+                if (tochan) {
+                        snprintf(errmsg, sizeof(errmsg),
+                            "%s request failed\r\n", cr->request_type);
+                } else {
+                        snprintf(errmsg, sizeof(errmsg),
+                            "%s request failed on channel %d",
+                            cr->request_type, c->self);
+                }
+                /* If error occurred on primary session channel, then exit */
+                if (cr->do_close && c->self == session_ident)
+                        fatal("%s", errmsg);
+                /* If error occurred on mux client, append to their stderr */
+                if (tochan)
+                        buffer_append(&c->extended, errmsg, strlen(errmsg));
+                else
+                        error("%s", errmsg);
+                if (cr->do_close) {
+                        chan_read_failed(c);
+                        chan_write_failed(c);
+                }
         }
+        xfree(cr);
 }
 
 static void
-client_extra_session2_setup(int id, void *arg)
+client_abandon_status_confirm(Channel *c, void *ctx)
 {
-        struct confirm_ctx *cctx = arg;
-        const char *display;
-        Channel *c;
-        int i;
-
-        if (cctx == NULL)
-                fatal("%s: cctx == NULL", __func__);
-        if ((c = channel_lookup(id)) == NULL)
-                fatal("%s: no channel for id %d", __func__, id);
-
-        display = getenv("DISPLAY");
-        if (cctx->want_x_fwd && options.forward_x11 && display != NULL) {
-                char *proto, *data;
-                /* Get reasonable local authentication information. */
-                client_x11_get_proto(display, options.xauth_location,
-                    options.forward_x11_trusted, &proto, &data);
-                /* Request forwarding with authentication spoofing. */
-                debug("Requesting X11 forwarding with authentication spoofing.");
-                x11_request_forwarding_with_spoofing(id, display, proto, data);
-                /* XXX wait for reply */
-        }
-
-        if (cctx->want_agent_fwd && options.forward_agent) {
-                debug("Requesting authentication agent forwarding.");
-                channel_request_start(id, "auth-agent-req@openssh.com", 0);
-                packet_send();
-        }
-
-        client_session2_setup(id, cctx->want_tty, cctx->want_subsys,
-            cctx->term, &cctx->tio, c->rfd, &cctx->cmd, cctx->env,
-            client_subsystem_reply);
-
-        c->confirm_ctx = NULL;
-        buffer_free(&cctx->cmd);
-        xfree(cctx->term);
-        if (cctx->env != NULL) {
-                for (i = 0; cctx->env[i] != NULL; i++)
-                        xfree(cctx->env[i]);
-                xfree(cctx->env);
-        }
-        xfree(cctx);
+        xfree(ctx);
 }
 
 static void
-client_process_control(fd_set *readset)
+client_expect_confirm(int id, const char *request, int do_close)
 {
-        Buffer m;
-        Channel *c;
-        int client_fd, new_fd[3], ver, allowed, window, packetmax;
-        socklen_t addrlen;
-        struct sockaddr_storage addr;
-        struct confirm_ctx *cctx;
-        char *cmd;
-        u_int i, len, env_len, command, flags;
-        uid_t euid;
-        gid_t egid;
-
-        /*
-         * Accept connection on control socket
-         */
-        if (control_fd == -1 || !FD_ISSET(control_fd, readset))
-                return;
-
-        memset(&addr, 0, sizeof(addr));
-        addrlen = sizeof(addr);
-        if ((client_fd = accept(control_fd,
-            (struct sockaddr*)&addr, &addrlen)) == -1) {
-                error("%s accept: %s", __func__, strerror(errno));
-                return;
-        }
-
-        if (getpeereid(client_fd, &euid, &egid) < 0) {
-                error("%s getpeereid failed: %s", __func__, strerror(errno));
-                close(client_fd);
-                return;
-        }
-        if ((euid != 0) && (getuid() != euid)) {
-                error("control mode uid mismatch: peer euid %u != uid %u",
-                    (u_int) euid, (u_int) getuid());
-                close(client_fd);
-                return;
-        }
-
-        unset_nonblock(client_fd);
-
-        /* Read command */
-        buffer_init(&m);
-        if (ssh_msg_recv(client_fd, &m) == -1) {
-                error("%s: client msg_recv failed", __func__);
-                close(client_fd);
-                buffer_free(&m);
-                return;
-        }
-        if ((ver = buffer_get_char(&m)) != SSHMUX_VER) {
-                error("%s: wrong client version %d", __func__, ver);
-                buffer_free(&m);
-                close(client_fd);
-                return;
-        }
-
-        allowed = 1;
-        command = buffer_get_int(&m);
-        flags = buffer_get_int(&m);
-
-        buffer_clear(&m);
-
-        switch (command) {
-        case SSHMUX_COMMAND_OPEN:
-                if (options.control_master == SSHCTL_MASTER_ASK ||
-                    options.control_master == SSHCTL_MASTER_AUTO_ASK)
-                        allowed = ask_permission("Allow shared connection "
-                            "to %s? ", host);
-                /* continue below */
-                break;
-        case SSHMUX_COMMAND_TERMINATE:
-                if (options.control_master == SSHCTL_MASTER_ASK ||
-                    options.control_master == SSHCTL_MASTER_AUTO_ASK)
-                        allowed = ask_permission("Terminate shared connection "
-                            "to %s? ", host);
-                if (allowed)
-                        quit_pending = 1;
-                /* FALLTHROUGH */
-        case SSHMUX_COMMAND_ALIVE_CHECK:
-                /* Reply for SSHMUX_COMMAND_TERMINATE and ALIVE_CHECK */
-                buffer_clear(&m);
-                buffer_put_int(&m, allowed);
-                buffer_put_int(&m, getpid());
-                if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) {
-                        error("%s: client msg_send failed", __func__);
-                        close(client_fd);
-                        buffer_free(&m);
-                        return;
-                }
-                buffer_free(&m);
-                close(client_fd);
-                return;
-        default:
-                error("Unsupported command %d", command);
-                buffer_free(&m);
-                close(client_fd);
-                return;
-        }
-
-        /* Reply for SSHMUX_COMMAND_OPEN */
-        buffer_clear(&m);
-        buffer_put_int(&m, allowed);
-        buffer_put_int(&m, getpid());
-        if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) {
-                error("%s: client msg_send failed", __func__);
-                close(client_fd);
-                buffer_free(&m);
-                return;
-        }
-
-        if (!allowed) {
-                error("Refused control connection");
-                close(client_fd);
-                buffer_free(&m);
-                return;
-        }
+        struct channel_reply_ctx *cr = xmalloc(sizeof(*cr));
 
-        buffer_clear(&m);
-        if (ssh_msg_recv(client_fd, &m) == -1) {
-                error("%s: client msg_recv failed", __func__);
-                close(client_fd);
-                buffer_free(&m);
-                return;
-        }
-        if ((ver = buffer_get_char(&m)) != SSHMUX_VER) {
-                error("%s: wrong client version %d", __func__, ver);
-                buffer_free(&m);
-                close(client_fd);
-                return;
-        }
+        cr->request_type = request;
+        cr->do_close = do_close;
 
-        cctx = xcalloc(1, sizeof(*cctx));
-        cctx->want_tty = (flags & SSHMUX_FLAG_TTY) != 0;
-        cctx->want_subsys = (flags & SSHMUX_FLAG_SUBSYS) != 0;
-        cctx->want_x_fwd = (flags & SSHMUX_FLAG_X11_FWD) != 0;
-        cctx->want_agent_fwd = (flags & SSHMUX_FLAG_AGENT_FWD) != 0;
-        cctx->term = buffer_get_string(&m, &len);
-
-        cmd = buffer_get_string(&m, &len);
-        buffer_init(&cctx->cmd);
-        buffer_append(&cctx->cmd, cmd, strlen(cmd));
-
-        env_len = buffer_get_int(&m);
-        env_len = MIN(env_len, 4096);
-        debug3("%s: receiving %d env vars", __func__, env_len);
-        if (env_len != 0) {
-                cctx->env = xcalloc(env_len + 1, sizeof(*cctx->env));
-                for (i = 0; i < env_len; i++)
-                        cctx->env[i] = buffer_get_string(&m, &len);
-                cctx->env[i] = NULL;
-        }
+        channel_register_status_confirm(id, client_status_confirm,
+            client_abandon_status_confirm, cr);
+}
 
-        debug2("%s: accepted tty %d, subsys %d, cmd %s", __func__,
-            cctx->want_tty, cctx->want_subsys, cmd);
-        xfree(cmd);
-
-        /* Gather fds from client */
-        new_fd[0] = mm_receive_fd(client_fd);
-        new_fd[1] = mm_receive_fd(client_fd);
-        new_fd[2] = mm_receive_fd(client_fd);
-
-        debug2("%s: got fds stdin %d, stdout %d, stderr %d", __func__,
-            new_fd[0], new_fd[1], new_fd[2]);
-
-        /* Try to pick up ttymodes from client before it goes raw */
-        if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1)
-                error("%s: tcgetattr: %s", __func__, strerror(errno));
-
-        /* This roundtrip is just for synchronisation of ttymodes */
-        buffer_clear(&m);
-        if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) {
-                error("%s: client msg_send failed", __func__);
-                close(client_fd);
-                close(new_fd[0]);
-                close(new_fd[1]);
-                close(new_fd[2]);
-                buffer_free(&m);
-                xfree(cctx->term);
-                if (env_len != 0) {
-                        for (i = 0; i < env_len; i++)
-                                xfree(cctx->env[i]);
-                        xfree(cctx->env);
-                }
+void
+client_register_global_confirm(global_confirm_cb *cb, void *ctx)
+{
+        struct global_confirm *gc, *last_gc;
+
+        /* Coalesce identical callbacks */
+        last_gc = TAILQ_LAST(&global_confirms, global_confirms);
+        if (last_gc && last_gc->cb == cb && last_gc->ctx == ctx) {
+                if (++last_gc->ref_count >= INT_MAX)
+                        fatal("%s: last_gc->ref_count = %d",
+                            __func__, last_gc->ref_count);
                 return;
         }
-        buffer_free(&m);
-
-        /* enable nonblocking unless tty */
-        if (!isatty(new_fd[0]))
-                set_nonblock(new_fd[0]);
-        if (!isatty(new_fd[1]))
-                set_nonblock(new_fd[1]);
-        if (!isatty(new_fd[2]))
-                set_nonblock(new_fd[2]);
-
-        set_nonblock(client_fd);
-
-        window = CHAN_SES_WINDOW_DEFAULT;
-        packetmax = CHAN_SES_PACKET_DEFAULT;
-        if (cctx->want_tty) {
-                window >>= 1;
-                packetmax >>= 1;
-        }
-        
-        c = channel_new("session", SSH_CHANNEL_OPENING,
-            new_fd[0], new_fd[1], new_fd[2], window, packetmax,
-            CHAN_EXTENDED_WRITE, "client-session", /*nonblock*/0);
 
-        /* XXX */
-        c->ctl_fd = client_fd;
-
-        debug3("%s: channel_new: %d", __func__, c->self);
-
-        channel_send_open(c->self);
-        channel_register_confirm(c->self, client_extra_session2_setup, cctx);
+        gc = xmalloc(sizeof(*gc));
+        gc->cb = cb;
+        gc->ctx = ctx;
+        gc->ref_count = 1;
+        TAILQ_INSERT_TAIL(&global_confirms, gc, entry);
 }
 
 static void
@@ -945,6 +774,9 @@ process_cmdline(void)
         u_short cancel_port;
         Forward fwd;
 
+        bzero(&fwd, sizeof(fwd));
+        fwd.listen_host = fwd.connect_host = NULL;
+
         leave_raw_mode();
         handler = signal(SIGINT, SIG_IGN);
         cmd = s = read_passphrase("\r\nssh> ", RP_ECHO);
@@ -1044,11 +876,18 @@ out:
         enter_raw_mode();
         if (cmd)
                 xfree(cmd);
+        if (fwd.listen_host != NULL)
+                xfree(fwd.listen_host);
+        if (fwd.connect_host != NULL)
+                xfree(fwd.connect_host);
 }
 
-/* process the characters one by one */
+/* 
+ * Process the characters one by one, call with c==NULL for proto1 case.
+ */
 static int
-process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
+process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
+    char *buf, int len)
 {
         char string[1024];
         pid_t pid;
@@ -1056,7 +895,20 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
         u_int i;
         u_char ch;
         char *s;
+        int *escape_pendingp, escape_char;
+        struct escape_filter_ctx *efc;
 
+        if (c == NULL) {
+                escape_pendingp = &escape_pending1;
+                escape_char = escape_char1;
+        } else {
+                if (c->filter_ctx == NULL)
+                        return 0;
+                efc = (struct escape_filter_ctx *)c->filter_ctx;
+                escape_pendingp = &efc->escape_pending;
+                escape_char = efc->escape_char;
+        }
+        
         if (len <= 0)
                 return (0);
 
@@ -1064,25 +916,42 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
                 /* Get one character at a time. */
                 ch = buf[i];
 
-                if (escape_pending) {
+                if (*escape_pendingp) {
                         /* We have previously seen an escape character. */
                         /* Clear the flag now. */
-                        escape_pending = 0;
+                        *escape_pendingp = 0;
 
                         /* Process the escaped character. */
                         switch (ch) {
                         case '.':
                                 /* Terminate the connection. */
-                                snprintf(string, sizeof string, "%c.\r\n", escape_char);
+                                snprintf(string, sizeof string, "%c.\r\n",
+                                    escape_char);
                                 buffer_append(berr, string, strlen(string));
 
-                                quit_pending = 1;
+                                if (c && c->ctl_fd != -1) {
+                                        chan_read_failed(c);
+                                        chan_write_failed(c);
+                                        return 0;
+                                } else
+                                        quit_pending = 1;
                                 return -1;
 
                         case 'Z' - 64:
-                                /* Suspend the program. */
-                                /* Print a message to that effect to the user. */
-                                snprintf(string, sizeof string, "%c^Z [suspend ssh]\r\n", escape_char);
+                                /* XXX support this for mux clients */
+                                if (c && c->ctl_fd != -1) {
+ noescape:
+                                        snprintf(string, sizeof string,
+                                            "%c%c escape not available to "
+                                            "multiplexed sessions\r\n",
+                                            escape_char, ch);
+                                        buffer_append(berr, string,
+                                            strlen(string));
+                                        continue;
+                                }
+                                /* Suspend the program. Inform the user */
+                                snprintf(string, sizeof string,
+                                    "%c^Z [suspend ssh]\r\n", escape_char);
                                 buffer_append(berr, string, strlen(string));
 
                                 /* Restore terminal modes and suspend. */
@@ -1107,16 +976,20 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
                         case 'R':
                                 if (compat20) {
                                         if (datafellows & SSH_BUG_NOREKEY)
-                                                logit("Server does not support re-keying");
+                                                logit("Server does not "
+                                                    "support re-keying");
                                         else
                                                 need_rekeying = 1;
                                 }
                                 continue;
 
                         case '&':
+                                if (c && c->ctl_fd != -1)
+                                        goto noescape;
                                 /*
-                                 * Detach the program (continue to serve connections,
-                                 * but put in background and no more new connections).
+                                 * Detach the program (continue to serve
+                                 * connections, but put in background and no
+                                 * more new connections).
                                  */
                                 /* Restore tty modes. */
                                 leave_raw_mode();
@@ -1145,9 +1018,9 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
                                         return -1;
                                 } else if (!stdin_eof) {
                                         /*
-                                         * Sending SSH_CMSG_EOF alone does not always appear
-                                         * to be enough.  So we try to send an EOF character
-                                         * first.
+                                         * Sending SSH_CMSG_EOF alone does not
+                                         * always appear to be enough.  So we
+                                         * try to send an EOF character first.
                                          */
                                         packet_start(SSH_CMSG_STDIN_DATA);
                                         packet_put_string("\004", 1);
@@ -1162,27 +1035,50 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len)
                                 continue;
 
                         case '?':
-                                snprintf(string, sizeof string,
+                                if (c && c->ctl_fd != -1) {
+                                        snprintf(string, sizeof string,
 "%c?\r\n\
 Supported escape sequences:\r\n\
-%c.  - terminate connection\r\n\
-%cB  - send a BREAK to the remote system\r\n\
-%cC  - open a command line\r\n\
-%cR  - Request rekey (SSH protocol 2 only)\r\n\
-%c^Z - suspend ssh\r\n\
-%c#  - list forwarded connections\r\n\
-%c&  - background ssh (when waiting for connections to terminate)\r\n\
-%c?  - this message\r\n\
-%c%c  - send the escape character by typing it twice\r\n\
+  %c.  - terminate session\r\n\
+  %cB  - send a BREAK to the remote system\r\n\
+  %cC  - open a command line\r\n\
+  %cR  - Request rekey (SSH protocol 2 only)\r\n\
+  %c#  - list forwarded connections\r\n\
+  %c?  - this message\r\n\
+  %c%c  - send the escape character by typing it twice\r\n\
 (Note that escapes are only recognized immediately after newline.)\r\n",
-                                    escape_char, escape_char, escape_char, escape_char,
-                                    escape_char, escape_char, escape_char, escape_char,
-                                    escape_char, escape_char, escape_char);
+                                            escape_char, escape_char,
+                                            escape_char, escape_char,
+                                            escape_char, escape_char,
+                                            escape_char, escape_char,
+                                            escape_char);
+                                } else {
+                                        snprintf(string, sizeof string,
+"%c?\r\n\
+Supported escape sequences:\r\n\
+  %c.  - terminate connection (and any multiplexed sessions)\r\n\
+  %cB  - send a BREAK to the remote system\r\n\
+  %cC  - open a command line\r\n\
+  %cR  - Request rekey (SSH protocol 2 only)\r\n\
+  %c^Z - suspend ssh\r\n\
+  %c#  - list forwarded connections\r\n\
+  %c&  - background ssh (when waiting for connections to terminate)\r\n\
+  %c?  - this message\r\n\
+  %c%c  - send the escape character by typing it twice\r\n\
+(Note that escapes are only recognized immediately after newline.)\r\n",
+                                            escape_char, escape_char,
+                                            escape_char, escape_char,
+                                            escape_char, escape_char,
+                                            escape_char, escape_char,
+                                            escape_char, escape_char,
+                                            escape_char);
+                                }
                                 buffer_append(berr, string, strlen(string));
                                 continue;
 
                         case '#':
-                                snprintf(string, sizeof string, "%c#\r\n", escape_char);
+                                snprintf(string, sizeof string, "%c#\r\n",
+                                    escape_char);
                                 buffer_append(berr, string, strlen(string));
                                 s = channel_open_message();
                                 buffer_append(berr, s, strlen(s));
@@ -1203,12 +1099,15 @@ Supported escape sequences:\r\n\
                         }
                 } else {
                         /*
-                         * The previous character was not an escape char. Check if this
-                         * is an escape.
+                         * The previous character was not an escape char.
+                         * Check if this is an escape.
                          */
                         if (last_was_cr && ch == escape_char) {
-                                /* It is. Set the flag and continue to next character. */
-                                escape_pending = 1;
+                                /*
+                                 * It is. Set the flag and continue to
+                                 * next character.
+                                 */
+                                *escape_pendingp = 1;
                                 continue;
                         }
                 }
@@ -1234,7 +1133,8 @@ client_process_input(fd_set *readset)
         if (FD_ISSET(fileno(stdin), readset)) {
                 /* Read as much as possible. */
                 len = read(fileno(stdin), buf, sizeof(buf));
-                if (len < 0 && (errno == EAGAIN || errno == EINTR))
+                if (len < 0 &&
+                    (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK))
                         return;         /* we'll try again later */
                 if (len <= 0) {
                         /*
@@ -1243,7 +1143,8 @@ client_process_input(fd_set *readset)
                          * if it was an error condition.
                          */
                         if (len < 0) {
-                                snprintf(buf, sizeof buf, "read: %.100s\r\n", strerror(errno));
+                                snprintf(buf, sizeof buf, "read: %.100s\r\n",
+                                    strerror(errno));
                                 buffer_append(&stderr_buffer, buf, strlen(buf));
                         }
                         /* Mark that we have seen EOF. */
@@ -1259,7 +1160,7 @@ client_process_input(fd_set *readset)
                                 packet_start(SSH_CMSG_EOF);
                                 packet_send();
                         }
-                } else if (escape_char == SSH_ESCAPECHAR_NONE) {
+                } else if (escape_char1 == SSH_ESCAPECHAR_NONE) {
                         /*
                          * Normal successful read, and no escape character.
                          * Just append the data to buffer.
@@ -1267,11 +1168,12 @@ client_process_input(fd_set *readset)
                         buffer_append(&stdin_buffer, buf, len);
                 } else {
                         /*
-                         * Normal, successful read.  But we have an escape character
-                         * and have to process the characters one by one.
+                         * Normal, successful read.  But we have an escape
+                         * character and have to process the characters one
+                         * by one.
                          */
-                        if (process_escapes(&stdin_buffer, &stdout_buffer,
-                            &stderr_buffer, buf, len) == -1)
+                        if (process_escapes(NULL, &stdin_buffer,
+                            &stdout_buffer, &stderr_buffer, buf, len) == -1)
                                 return;
                 }
         }
@@ -1289,14 +1191,16 @@ client_process_output(fd_set *writeset)
                 len = write(fileno(stdout), buffer_ptr(&stdout_buffer),
                     buffer_len(&stdout_buffer));
                 if (len <= 0) {
-                        if (errno == EINTR || errno == EAGAIN)
+                        if (errno == EINTR || errno == EAGAIN ||
+                            errno == EWOULDBLOCK)
                                 len = 0;
                         else {
                                 /*
                                  * An error or EOF was encountered.  Put an
                                  * error message to stderr buffer.
                                  */
-                                snprintf(buf, sizeof buf, "write stdout: %.50s\r\n", strerror(errno));
+                                snprintf(buf, sizeof buf,
+                                    "write stdout: %.50s\r\n", strerror(errno));
                                 buffer_append(&stderr_buffer, buf, strlen(buf));
                                 quit_pending = 1;
                                 return;
@@ -1304,7 +1208,6 @@ client_process_output(fd_set *writeset)
                 }
                 /* Consume printed data from the buffer. */
                 buffer_consume(&stdout_buffer, len);
-                stdout_bytes += len;
         }
         /* Write buffered output to stderr. */
         if (FD_ISSET(fileno(stderr), writeset)) {
@@ -1312,17 +1215,20 @@ client_process_output(fd_set *writeset)
                 len = write(fileno(stderr), buffer_ptr(&stderr_buffer),
                     buffer_len(&stderr_buffer));
                 if (len <= 0) {
-                        if (errno == EINTR || errno == EAGAIN)
+                        if (errno == EINTR || errno == EAGAIN ||
+                            errno == EWOULDBLOCK)
                                 len = 0;
                         else {
-                                /* EOF or error, but can't even print error message. */
+                                /*
+                                 * EOF or error, but can't even print
+                                 * error message.
+                                 */
                                 quit_pending = 1;
                                 return;
                         }
                 }
                 /* Consume printed characters from the buffer. */
                 buffer_consume(&stderr_buffer, len);
-                stderr_bytes += len;
         }
 }
 
@@ -1341,16 +1247,39 @@ client_process_output(fd_set *writeset)
 static void
 client_process_buffered_input_packets(void)
 {
-        dispatch_run(DISPATCH_NONBLOCK, &quit_pending, compat20 ? xxx_kex : NULL);
+        dispatch_run(DISPATCH_NONBLOCK, &quit_pending,
+            compat20 ? xxx_kex : NULL);
 }
 
 /* scan buf[] for '~' before sending data to the peer */
 
-static int
-simple_escape_filter(Channel *c, char *buf, int len)
+/* Helper: allocate a new escape_filter_ctx and fill in its escape char */
+void *
+client_new_escape_filter_ctx(int escape_char)
+{
+        struct escape_filter_ctx *ret;
+
+        ret = xmalloc(sizeof(*ret));
+        ret->escape_pending = 0;
+        ret->escape_char = escape_char;
+        return (void *)ret;
+}
+
+/* Free the escape filter context on channel free */
+void
+client_filter_cleanup(int cid, void *ctx)
+{
+        xfree(ctx);
+}
+
+int
+client_simple_escape_filter(Channel *c, char *buf, int len)
 {
-        /* XXX we assume c->extended is writeable */
-        return process_escapes(&c->input, &c->output, &c->extended, buf, len);
+        if (c->extended_usage != CHAN_EXTENDED_WRITE)
+                return 0;
+
+        return process_escapes(c, &c->input, &c->output, &c->extended,
+            buf, len);
 }
 
 static void
@@ -1374,6 +1303,7 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
         fd_set *readset = NULL, *writeset = NULL;
         double start_time, total_time;
         int max_fd = 0, max_fd2 = 0, len, rekeying = 0;
+        u_int64_t ibytes, obytes;
         u_int nalloc = 0;
         char buf[100];
 
@@ -1382,7 +1312,7 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
         start_time = get_current_time();
 
         /* Initialize variables. */
-        escape_pending = 0;
+        escape_pending1 = 0;
         last_was_cr = 1;
         exit_status = -1;
         stdin_eof = 0;
@@ -1390,8 +1320,8 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
         connection_in = packet_get_connection_in();
         connection_out = packet_get_connection_out();
         max_fd = MAX(connection_in, connection_out);
-        if (control_fd != -1)
-                max_fd = MAX(max_fd, control_fd);
+        if (muxserver_sock != -1)
+                max_fd = MAX(max_fd, muxserver_sock);
 
         if (!compat20) {
                 /* enable nonblocking unless tty */
@@ -1405,11 +1335,8 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
                 max_fd = MAX(max_fd, fileno(stdout));
                 max_fd = MAX(max_fd, fileno(stderr));
         }
-        stdin_bytes = 0;
-        stdout_bytes = 0;
-        stderr_bytes = 0;
         quit_pending = 0;
-        escape_char = escape_char_arg;
+        escape_char1 = escape_char_arg;
 
         /* Initialize buffers. */
         buffer_init(&stdin_buffer);
@@ -1437,9 +1364,11 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 
         if (compat20) {
                 session_ident = ssh2_chan_id;
-                if (escape_char != SSH_ESCAPECHAR_NONE)
+                if (escape_char_arg != SSH_ESCAPECHAR_NONE)
                         channel_register_filter(session_ident,
-                            simple_escape_filter, NULL);
+                            client_simple_escape_filter, NULL,
+                            client_filter_cleanup,
+                            client_new_escape_filter_ctx(escape_char_arg));
                 if (session_ident != -1)
                         channel_register_cleanup(session_ident,
                             client_channel_closed, 0);
@@ -1511,7 +1440,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
                 client_process_net_input(readset);
 
                 /* Accept control connections.  */
-                client_process_control(readset);
+                if (muxserver_sock != -1 &&FD_ISSET(muxserver_sock, readset)) {
+                        if (muxserver_accept_control())
+                                quit_pending = 1;
+                }
 
                 if (quit_pending)
                         break;
@@ -1526,7 +1458,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
                         client_process_output(writeset);
                 }
 
-                /* Send as much buffered packet data as possible to the sender. */
+                /*
+                 * Send as much buffered packet data as possible to the
+                 * sender.
+                 */
                 if (FD_ISSET(connection_out, writeset))
                         packet_write_poll();
         }
@@ -1573,7 +1508,8 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
          * that the connection has been closed.
          */
         if (have_pty && options.log_level > SYSLOG_LEVEL_QUIET) {
-                snprintf(buf, sizeof buf, "Connection to %.64s closed.\r\n", host);
+                snprintf(buf, sizeof buf,
+                    "Connection to %.64s closed.\r\n", host);
                 buffer_append(&stderr_buffer, buf, strlen(buf));
         }
 
@@ -1586,7 +1522,6 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
                         break;
                 }
                 buffer_consume(&stdout_buffer, len);
-                stdout_bytes += len;
         }
 
         /* Output any buffered data for stderr. */
@@ -1598,7 +1533,6 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
                         break;
                 }
                 buffer_consume(&stderr_buffer, len);
-                stderr_bytes += len;
         }
 
         /* Clear and free any buffers. */
@@ -1609,13 +1543,13 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 
         /* Report bytes transferred, and transfer rates. */
         total_time = get_current_time() - start_time;
-        debug("Transferred: stdin %lu, stdout %lu, stderr %lu bytes in %.1f seconds",
-            stdin_bytes, stdout_bytes, stderr_bytes, total_time);
+        packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
+        packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
+        verbose("Transferred: sent %llu, received %llu bytes, in %.1f seconds",
+            obytes, ibytes, total_time);
         if (total_time > 0)
-                debug("Bytes per second: stdin %.1f, stdout %.1f, stderr %.1f",
-                    stdin_bytes / total_time, stdout_bytes / total_time,
-                    stderr_bytes / total_time);
-
+                verbose("Bytes per second: sent %.1f, received %.1f",
+                    obytes / total_time, ibytes / total_time);
         /* Return the exit status of the program. */
         debug("Exit status %d", exit_status);
         return exit_status;
@@ -1706,7 +1640,6 @@ client_request_forwarded_tcpip(const char *request_type, int rchan)
         Channel *c = NULL;
         char *listen_address, *originator_address;
         int listen_port, originator_port;
-        int sock;
 
         /* Get rest of the packet */
         listen_address = packet_get_string(NULL);
@@ -1715,19 +1648,13 @@ client_request_forwarded_tcpip(const char *request_type, int rchan)
         originator_port = packet_get_int();
         packet_check_eom();
 
-        debug("client_request_forwarded_tcpip: listen %s port %d, originator %s port %d",
-            listen_address, listen_port, originator_address, originator_port);
+        debug("client_request_forwarded_tcpip: listen %s port %d, "
+            "originator %s port %d", listen_address, listen_port,
+            originator_address, originator_port);
+
+        c = channel_connect_by_listen_address(listen_port,
+            "forwarded-tcpip", originator_address);
 
-        sock = channel_connect_by_listen_address(listen_port);
-        if (sock < 0) {
-                xfree(originator_address);
-                xfree(listen_address);
-                return NULL;
-        }
-        c = channel_new("forwarded-tcpip",
-            SSH_CHANNEL_CONNECTING, sock, sock, -1,
-            CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
-            originator_address, 1);
         xfree(originator_address);
         xfree(listen_address);
         return c;
@@ -1743,7 +1670,8 @@ client_request_x11(const char *request_type, int rchan)
 
         if (!options.forward_x11) {
                 error("Warning: ssh server tried X11 forwarding.");
-                error("Warning: this is probably a break-in attempt by a malicious server.");
+                error("Warning: this is probably a break-in attempt by a "
+                    "malicious server.");
                 return NULL;
         }
         originator = packet_get_string(NULL);
@@ -1776,7 +1704,8 @@ client_request_agent(const char *request_type, int rchan)
 
         if (!options.forward_agent) {
                 error("Warning: ssh server tried agent forwarding.");
-                error("Warning: this is probably a break-in attempt by a malicious server.");
+                error("Warning: this is probably a break-in attempt by a "
+                    "malicious server.");
                 return NULL;
         }
         sock = ssh_get_authentication_socket();
@@ -1819,7 +1748,7 @@ client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun)
 #if defined(SSH_TUN_FILTER)
         if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
                 channel_register_filter(c->self, sys_tun_infilter,
-                    sys_tun_outfilter);
+                    sys_tun_outfilter, NULL, NULL);
 #endif
 
         packet_start(SSH2_MSG_CHANNEL_OPEN);
@@ -1902,7 +1831,11 @@ client_input_channel_req(int type, u_int32_t seq, void *ctxt)
         if (id == -1) {
                 error("client_input_channel_req: request for channel -1");
         } else if ((c = channel_lookup(id)) == NULL) {
-                error("client_input_channel_req: channel %d: unknown channel", id);
+                error("client_input_channel_req: channel %d: "
+                    "unknown channel", id);
+        } else if (strcmp(rtype, "eow@openssh.com") == 0) {
+                packet_check_eom();
+                chan_rcvd_eow(c);
         } else if (strcmp(rtype, "exit-status") == 0) {
                 exitval = packet_get_int();
                 if (id == session_ident) {
@@ -1947,8 +1880,7 @@ client_input_global_request(int type, u_int32_t seq, void *ctxt)
 
 void
 client_session2_setup(int id, int want_tty, int want_subsystem,
-    const char *term, struct termios *tiop, int in_fd, Buffer *cmd, char **env,
-    dispatch_fn *subsys_repl)
+    const char *term, struct termios *tiop, int in_fd, Buffer *cmd, char **env)
 {
         int len;
         Channel *c = NULL;
@@ -1960,20 +1892,21 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
 
         if (want_tty) {
                 struct winsize ws;
-                struct termios tio;
 
                 /* Store window size in the packet. */
                 if (ioctl(in_fd, TIOCGWINSZ, &ws) < 0)
                         memset(&ws, 0, sizeof(ws));
 
-                channel_request_start(id, "pty-req", 0);
+                channel_request_start(id, "pty-req", 1);
+                client_expect_confirm(id, "PTY allocation", 0);
                 packet_put_cstring(term != NULL ? term : "");
                 packet_put_int((u_int)ws.ws_col);
                 packet_put_int((u_int)ws.ws_row);
                 packet_put_int((u_int)ws.ws_xpixel);
                 packet_put_int((u_int)ws.ws_ypixel);
-                tio = get_saved_tio();
-                tty_make_modes(-1, tiop != NULL ? tiop : &tio);
+                if (tiop == NULL)
+                        tiop = get_saved_tio();
+                tty_make_modes(-1, tiop);
                 packet_send();
                 /* XXX wait for reply */
                 c->client_tty = 1;
@@ -2021,22 +1954,21 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
                 if (len > 900)
                         len = 900;
                 if (want_subsystem) {
-                        debug("Sending subsystem: %.*s", len, (u_char*)buffer_ptr(cmd));
-                        channel_request_start(id, "subsystem", subsys_repl != NULL);
-                        if (subsys_repl != NULL) {
-                                /* register callback for reply */
-                                /* XXX we assume that client_loop has already been called */
-                                dispatch_set(SSH2_MSG_CHANNEL_FAILURE, subsys_repl);
-                                dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, subsys_repl);
-                        }
+                        debug("Sending subsystem: %.*s",
+                            len, (u_char*)buffer_ptr(cmd));
+                        channel_request_start(id, "subsystem", 1);
+                        client_expect_confirm(id, "subsystem", 1);
                 } else {
-                        debug("Sending command: %.*s", len, (u_char*)buffer_ptr(cmd));
-                        channel_request_start(id, "exec", 0);
+                        debug("Sending command: %.*s",
+                            len, (u_char*)buffer_ptr(cmd));
+                        channel_request_start(id, "exec", 1);
+                        client_expect_confirm(id, "exec", 1);
                 }
                 packet_put_string(buffer_ptr(cmd), buffer_len(cmd));
                 packet_send();
         } else {
-                channel_request_start(id, "shell", 0);
+                channel_request_start(id, "shell", 1);
+                client_expect_confirm(id, "shell", 1);
                 packet_send();
         }
 }
@@ -2055,6 +1987,8 @@ client_init_dispatch_20(void)
         dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure);
         dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req);
         dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust);
+        dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &channel_input_status_confirm);
+        dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &channel_input_status_confirm);
         dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &client_input_global_request);
 
         /* rekeying */
@@ -2064,6 +1998,7 @@ client_init_dispatch_20(void)
         dispatch_set(SSH2_MSG_REQUEST_FAILURE, &client_global_request_reply);
         dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &client_global_request_reply);
 }
+
 static void
 client_init_dispatch_13(void)
 {
@@ -2083,6 +2018,7 @@ client_init_dispatch_13(void)
         dispatch_set(SSH_SMSG_X11_OPEN, options.forward_x11 ?
             &x11_input_open : &deny_input_open);
 }
+
 static void
 client_init_dispatch_15(void)
 {
@@ -2090,6 +2026,7 @@ client_init_dispatch_15(void)
         dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof);
         dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, & channel_input_oclose);
 }
+
 static void
 client_init_dispatch(void)
 {
@@ -2107,7 +2044,7 @@ cleanup_exit(int i)
 {
         leave_raw_mode();
         leave_non_blocking();
-        if (options.control_path != NULL && control_fd != -1)
+        if (options.control_path != NULL && muxserver_sock != -1)
                 unlink(options.control_path);
         _exit(i);
 }