upstream commit

update sftp client and server to new buffer API. pretty
 much just mechanical changes; with & ok markus

1 files changed, 500 insertions, 361 deletions

diff --git a/sftp-client.c b/sftp-client.c
index 990b58d14..574da833a 100644
--- a/sftp-client.c
+++ b/sftp-client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-client.c,v 1.115 2014/04/21 14:36:16 logan Exp $ */
+/* $OpenBSD: sftp-client.c,v 1.116 2015/01/14 13:54:13 djm Exp $ */
 /*
  * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org>
  *
@@ -47,7 +47,8 @@
 #include <unistd.h>
 
 #include "xmalloc.h"
-#include "buffer.h"
+#include "ssherr.h"
+#include "sshbuf.h"
 #include "log.h"
 #include "atomicio.h"
 #include "progressmeter.h"
@@ -83,8 +84,8 @@ struct sftp_conn {
         struct bwlimit bwlimit_in, bwlimit_out;
 };
 
-static char *
-get_handle(struct sftp_conn *conn, u_int expected_id, u_int *len,
+static u_char *
+get_handle(struct sftp_conn *conn, u_int expected_id, size_t *len,
     const char *errfmt, ...) __attribute__((format(printf, 4, 5)));
 
 /* ARGSUSED */
@@ -98,36 +99,39 @@ sftpio(void *_bwlimit, size_t amount)
 }
 
 static void
-send_msg(struct sftp_conn *conn, Buffer *m)
+send_msg(struct sftp_conn *conn, struct sshbuf *m)
 {
         u_char mlen[4];
         struct iovec iov[2];
 
-        if (buffer_len(m) > SFTP_MAX_MSG_LENGTH)
-                fatal("Outbound message too long %u", buffer_len(m));
+        if (sshbuf_len(m) > SFTP_MAX_MSG_LENGTH)
+                fatal("Outbound message too long %zu", sshbuf_len(m));
 
         /* Send length first */
-        put_u32(mlen, buffer_len(m));
+        put_u32(mlen, sshbuf_len(m));
         iov[0].iov_base = mlen;
         iov[0].iov_len = sizeof(mlen);
-        iov[1].iov_base = buffer_ptr(m);
-        iov[1].iov_len = buffer_len(m);
+        iov[1].iov_base = (u_char *)sshbuf_ptr(m);
+        iov[1].iov_len = sshbuf_len(m);
 
         if (atomiciov6(writev, conn->fd_out, iov, 2,
             conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) !=
-            buffer_len(m) + sizeof(mlen))
+            sshbuf_len(m) + sizeof(mlen))
                 fatal("Couldn't send packet: %s", strerror(errno));
 
-        buffer_clear(m);
+        sshbuf_reset(m);
 }
 
 static void
-get_msg(struct sftp_conn *conn, Buffer *m)
+get_msg(struct sftp_conn *conn, struct sshbuf *m)
 {
         u_int msg_len;
+        u_char *p;
+        int r;
 
-        buffer_append_space(m, 4);
-        if (atomicio6(read, conn->fd_in, buffer_ptr(m), 4,
+        if ((r = sshbuf_reserve(m, 4, &p)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        if (atomicio6(read, conn->fd_in, p, 4,
             conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) {
                 if (errno == EPIPE)
                         fatal("Connection closed");
@@ -135,12 +139,14 @@ get_msg(struct sftp_conn *conn, Buffer *m)
                         fatal("Couldn't read packet: %s", strerror(errno));
         }
 
-        msg_len = buffer_get_int(m);
+        if ((r = sshbuf_get_u32(m, &msg_len)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
         if (msg_len > SFTP_MAX_MSG_LENGTH)
                 fatal("Received message too long %u", msg_len);
 
-        buffer_append_space(m, msg_len);
-        if (atomicio6(read, conn->fd_in, buffer_ptr(m), msg_len,
+        if ((r = sshbuf_reserve(m, msg_len, &p)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        if (atomicio6(read, conn->fd_in, p, msg_len,
             conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in)
             != msg_len) {
                 if (errno == EPIPE)
@@ -151,46 +157,56 @@ get_msg(struct sftp_conn *conn, Buffer *m)
 }
 
 static void
-send_string_request(struct sftp_conn *conn, u_int id, u_int code, char *s,
+send_string_request(struct sftp_conn *conn, u_int id, u_int code, const char *s,
     u_int len)
 {
-        Buffer msg;
-
-        buffer_init(&msg);
-        buffer_put_char(&msg, code);
-        buffer_put_int(&msg, id);
-        buffer_put_string(&msg, s, len);
-        send_msg(conn, &msg);
+        struct sshbuf *msg;
+        int r;
+
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        if ((r = sshbuf_put_u8(msg, code)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_string(msg, s, len)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message fd %d T:%u I:%u", conn->fd_out, code, id);
-        buffer_free(&msg);
+        sshbuf_free(msg);
 }
 
 static void
 send_string_attrs_request(struct sftp_conn *conn, u_int id, u_int code,
-    char *s, u_int len, Attrib *a)
+    const void *s, u_int len, Attrib *a)
 {
-        Buffer msg;
-
-        buffer_init(&msg);
-        buffer_put_char(&msg, code);
-        buffer_put_int(&msg, id);
-        buffer_put_string(&msg, s, len);
-        encode_attrib(&msg, a);
-        send_msg(conn, &msg);
+        struct sshbuf *msg;
+        int r;
+
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        if ((r = sshbuf_put_u8(msg, code)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_string(msg, s, len)) != 0 ||
+            (r = encode_attrib(msg, a)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message fd %d T:%u I:%u", conn->fd_out, code, id);
-        buffer_free(&msg);
+        sshbuf_free(msg);
 }
 
 static u_int
 get_status(struct sftp_conn *conn, u_int expected_id)
 {
-        Buffer msg;
-        u_int type, id, status;
+        struct sshbuf *msg;
+        u_char type;
+        u_int id, status;
+        int r;
 
-        buffer_init(&msg);
-        get_msg(conn, &msg);
-        type = buffer_get_char(&msg);
-        id = buffer_get_int(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        get_msg(conn, msg);
+        if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+            (r = sshbuf_get_u32(msg, &id)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         if (id != expected_id)
                 fatal("ID mismatch (%u != %u)", id, expected_id);
@@ -198,112 +214,136 @@ get_status(struct sftp_conn *conn, u_int expected_id)
                 fatal("Expected SSH2_FXP_STATUS(%u) packet, got %u",
                     SSH2_FXP_STATUS, type);
 
-        status = buffer_get_int(&msg);
-        buffer_free(&msg);
+        if ((r = sshbuf_get_u32(msg, &status)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        sshbuf_free(msg);
 
         debug3("SSH2_FXP_STATUS %u", status);
 
         return status;
 }
 
-static char *
-get_handle(struct sftp_conn *conn, u_int expected_id, u_int *len,
+static u_char *
+get_handle(struct sftp_conn *conn, u_int expected_id, size_t *len,
     const char *errfmt, ...)
 {
-        Buffer msg;
-        u_int type, id;
-        char *handle, errmsg[256];
+        struct sshbuf *msg;
+        u_int id, status;
+        u_char type;
+        u_char *handle;
+        char errmsg[256];
         va_list args;
-        int status;
+        int r;
 
         va_start(args, errfmt);
         if (errfmt != NULL)
                 vsnprintf(errmsg, sizeof(errmsg), errfmt, args);
         va_end(args);
 
-        buffer_init(&msg);
-        get_msg(conn, &msg);
-        type = buffer_get_char(&msg);
-        id = buffer_get_int(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        get_msg(conn, msg);
+        if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+            (r = sshbuf_get_u32(msg, &id)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         if (id != expected_id)
                 fatal("%s: ID mismatch (%u != %u)",
                     errfmt == NULL ? __func__ : errmsg, id, expected_id);
         if (type == SSH2_FXP_STATUS) {
-                status = buffer_get_int(&msg);
+                if ((r = sshbuf_get_u32(msg, &status)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
                 if (errfmt != NULL)
                         error("%s: %s", errmsg, fx2txt(status));
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return(NULL);
         } else if (type != SSH2_FXP_HANDLE)
                 fatal("%s: Expected SSH2_FXP_HANDLE(%u) packet, got %u",
                     errfmt == NULL ? __func__ : errmsg, SSH2_FXP_HANDLE, type);
 
-        handle = buffer_get_string(&msg, len);
-        buffer_free(&msg);
+        if ((r = sshbuf_get_string(msg, &handle, len)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        sshbuf_free(msg);
 
-        return(handle);
+        return handle;
 }
 
 static Attrib *
 get_decode_stat(struct sftp_conn *conn, u_int expected_id, int quiet)
 {
-        Buffer msg;
-        u_int type, id;
-        Attrib *a;
+        struct sshbuf *msg;
+        u_int id;
+        u_char type;
+        int r;
+        static Attrib a;
 
-        buffer_init(&msg);
-        get_msg(conn, &msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        get_msg(conn, msg);
 
-        type = buffer_get_char(&msg);
-        id = buffer_get_int(&msg);
+        if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+            (r = sshbuf_get_u32(msg, &id)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         debug3("Received stat reply T:%u I:%u", type, id);
         if (id != expected_id)
                 fatal("ID mismatch (%u != %u)", id, expected_id);
         if (type == SSH2_FXP_STATUS) {
-                int status = buffer_get_int(&msg);
+                u_int status;
 
+                if ((r = sshbuf_get_u32(msg, &status)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
                 if (quiet)
                         debug("Couldn't stat remote file: %s", fx2txt(status));
                 else
                         error("Couldn't stat remote file: %s", fx2txt(status));
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return(NULL);
         } else if (type != SSH2_FXP_ATTRS) {
                 fatal("Expected SSH2_FXP_ATTRS(%u) packet, got %u",
                     SSH2_FXP_ATTRS, type);
         }
-        a = decode_attrib(&msg);
-        buffer_free(&msg);
+        if ((r = decode_attrib(msg, &a)) != 0) {
+                error("%s: couldn't decode attrib: %s", __func__, ssh_err(r));
+                sshbuf_free(msg);
+                return NULL;
+        }
+        sshbuf_free(msg);
 
-        return(a);
+        return &a;
 }
 
 static int
 get_decode_statvfs(struct sftp_conn *conn, struct sftp_statvfs *st,
     u_int expected_id, int quiet)
 {
-        Buffer msg;
-        u_int type, id, flag;
+        struct sshbuf *msg;
+        u_char type;
+        u_int id;
+        u_int64_t flag;
+        int r;
 
-        buffer_init(&msg);
-        get_msg(conn, &msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        get_msg(conn, msg);
 
-        type = buffer_get_char(&msg);
-        id = buffer_get_int(&msg);
+        if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+            (r = sshbuf_get_u32(msg, &id)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         debug3("Received statvfs reply T:%u I:%u", type, id);
         if (id != expected_id)
                 fatal("ID mismatch (%u != %u)", id, expected_id);
         if (type == SSH2_FXP_STATUS) {
-                int status = buffer_get_int(&msg);
+                u_int status;
 
+                if ((r = sshbuf_get_u32(msg, &status)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
                 if (quiet)
                         debug("Couldn't statvfs: %s", fx2txt(status));
                 else
                         error("Couldn't statvfs: %s", fx2txt(status));
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return -1;
         } else if (type != SSH2_FXP_EXTENDED_REPLY) {
                 fatal("Expected SSH2_FXP_EXTENDED_REPLY(%u) packet, got %u",
@@ -311,22 +351,23 @@ get_decode_statvfs(struct sftp_conn *conn, struct sftp_statvfs *st,
         }
 
         memset(st, 0, sizeof(*st));
-        st->f_bsize = buffer_get_int64(&msg);
-        st->f_frsize = buffer_get_int64(&msg);
-        st->f_blocks = buffer_get_int64(&msg);
-        st->f_bfree = buffer_get_int64(&msg);
-        st->f_bavail = buffer_get_int64(&msg);
-        st->f_files = buffer_get_int64(&msg);
-        st->f_ffree = buffer_get_int64(&msg);
-        st->f_favail = buffer_get_int64(&msg);
-        st->f_fsid = buffer_get_int64(&msg);
-        flag = buffer_get_int64(&msg);
-        st->f_namemax = buffer_get_int64(&msg);
+        if ((r = sshbuf_get_u64(msg, &st->f_bsize)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_frsize)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_blocks)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_bfree)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_bavail)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_files)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_ffree)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_favail)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_fsid)) != 0 ||
+            (r = sshbuf_get_u64(msg, &flag)) != 0 ||
+            (r = sshbuf_get_u64(msg, &st->f_namemax)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         st->f_flag = (flag & SSH2_FXE_STATVFS_ST_RDONLY) ? ST_RDONLY : 0;
         st->f_flag |= (flag & SSH2_FXE_STATVFS_ST_NOSUID) ? ST_NOSUID : 0;
 
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
         return 0;
 }
@@ -335,9 +376,10 @@ struct sftp_conn *
 do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests,
     u_int64_t limit_kbps)
 {
-        u_int type;
-        Buffer msg;
+        u_char type;
+        struct sshbuf *msg;
         struct sftp_conn *ret;
+        int r;
 
         ret = xcalloc(1, sizeof(*ret));
         ret->msg_id = 1;
@@ -348,52 +390,61 @@ do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests,
         ret->exts = 0;
         ret->limit_kbps = 0;
 
-        buffer_init(&msg);
-        buffer_put_char(&msg, SSH2_FXP_INIT);
-        buffer_put_int(&msg, SSH2_FILEXFER_VERSION);
-        send_msg(ret, &msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_INIT)) != 0 ||
+            (r = sshbuf_put_u32(msg, SSH2_FILEXFER_VERSION)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(ret, msg);
 
-        buffer_clear(&msg);
+        sshbuf_reset(msg);
 
-        get_msg(ret, &msg);
+        get_msg(ret, msg);
 
         /* Expecting a VERSION reply */
-        if ((type = buffer_get_char(&msg)) != SSH2_FXP_VERSION) {
+        if ((r = sshbuf_get_u8(msg, &type)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        if (type != SSH2_FXP_VERSION) {
                 error("Invalid packet back from SSH2_FXP_INIT (type %u)",
                     type);
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return(NULL);
         }
-        ret->version = buffer_get_int(&msg);
+        if ((r = sshbuf_get_u32(msg, &ret->version)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         debug2("Remote version: %u", ret->version);
 
         /* Check for extensions */
-        while (buffer_len(&msg) > 0) {
-                char *name = buffer_get_string(&msg, NULL);
-                char *value = buffer_get_string(&msg, NULL);
+        while (sshbuf_len(msg) > 0) {
+                char *name;
+                u_char *value;
+                size_t vlen;
                 int known = 0;
 
+                if ((r = sshbuf_get_cstring(msg, &name, NULL)) != 0 ||
+                    (r = sshbuf_get_string(msg, &value, &vlen)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
                 if (strcmp(name, "posix-rename@openssh.com") == 0 &&
-                    strcmp(value, "1") == 0) {
+                    strcmp((char *)value, "1") == 0) {
                         ret->exts |= SFTP_EXT_POSIX_RENAME;
                         known = 1;
                 } else if (strcmp(name, "statvfs@openssh.com") == 0 &&
-                    strcmp(value, "2") == 0) {
+                    strcmp((char *)value, "2") == 0) {
                         ret->exts |= SFTP_EXT_STATVFS;
                         known = 1;
                 } else if (strcmp(name, "fstatvfs@openssh.com") == 0 &&
-                    strcmp(value, "2") == 0) {
+                    strcmp((char *)value, "2") == 0) {
                         ret->exts |= SFTP_EXT_FSTATVFS;
                         known = 1;
                 } else if (strcmp(name, "hardlink@openssh.com") == 0 &&
-                    strcmp(value, "1") == 0) {
+                    strcmp((char *)value, "1") == 0) {
                         ret->exts |= SFTP_EXT_HARDLINK;
                         known = 1;
-                } else if (strcmp(name, "fsync@openssh.com") == 0 &&
-                    strcmp(value, "1") == 0) {
-                        ret->exts |= SFTP_EXT_FSYNC;
-                        known = 1;
+                } else if (strcmp(name, "fsync@openssh.com") == 0 &&
+                    strcmp((char *)value, "1") == 0) {
+                        ret->exts |= SFTP_EXT_FSYNC;
+                        known = 1;
                 }
                 if (known) {
                         debug2("Server supports extension \"%s\" revision %s",
@@ -405,7 +456,7 @@ do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests,
                 free(value);
         }
 
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
         /* Some filexfer v.0 servers don't support large packets */
         if (ret->version == 0)
@@ -429,54 +480,62 @@ sftp_proto_version(struct sftp_conn *conn)
 }
 
 int
-do_close(struct sftp_conn *conn, char *handle, u_int handle_len)
+do_close(struct sftp_conn *conn, const u_char *handle, u_int handle_len)
 {
         u_int id, status;
-        Buffer msg;
+        struct sshbuf *msg;
+        int r;
 
-        buffer_init(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
 
         id = conn->msg_id++;
-        buffer_put_char(&msg, SSH2_FXP_CLOSE);
-        buffer_put_int(&msg, id);
-        buffer_put_string(&msg, handle, handle_len);
-        send_msg(conn, &msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_CLOSE)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message SSH2_FXP_CLOSE I:%u", id);
 
         status = get_status(conn, id);
         if (status != SSH2_FX_OK)
                 error("Couldn't close file: %s", fx2txt(status));
 
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
-        return status;
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 
 static int
-do_lsreaddir(struct sftp_conn *conn, char *path, int print_flag,
+do_lsreaddir(struct sftp_conn *conn, const char *path, int print_flag,
     SFTP_DIRENT ***dir)
 {
-        Buffer msg;
-        u_int count, type, id, handle_len, i, expected_id, ents = 0;
+        struct sshbuf *msg;
+        u_int count, id, i, expected_id, ents = 0;
+        size_t handle_len;
+        u_char type;
         char *handle;
         int status = SSH2_FX_FAILURE;
+        int r;
 
         if (dir)
                 *dir = NULL;
 
         id = conn->msg_id++;
 
-        buffer_init(&msg);
-        buffer_put_char(&msg, SSH2_FXP_OPENDIR);
-        buffer_put_int(&msg, id);
-        buffer_put_cstring(&msg, path);
-        send_msg(conn, &msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPENDIR)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_cstring(msg, path)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
 
         handle = get_handle(conn, id, &handle_len,
             "remote readdir(\"%s\")", path);
         if (handle == NULL) {
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return -1;
         }
 
@@ -491,18 +550,20 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int print_flag,
 
                 debug3("Sending SSH2_FXP_READDIR I:%u", id);
 
-                buffer_clear(&msg);
-                buffer_put_char(&msg, SSH2_FXP_READDIR);
-                buffer_put_int(&msg, id);
-                buffer_put_string(&msg, handle, handle_len);
-                send_msg(conn, &msg);
+                sshbuf_reset(msg);
+                if ((r = sshbuf_put_u8(msg, SSH2_FXP_READDIR)) != 0 ||
+                    (r = sshbuf_put_u32(msg, id)) != 0 ||
+                    (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
+                send_msg(conn, msg);
 
-                buffer_clear(&msg);
+                sshbuf_reset(msg);
 
-                get_msg(conn, &msg);
+                get_msg(conn, msg);
 
-                type = buffer_get_char(&msg);
-                id = buffer_get_int(&msg);
+                if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+                    (r = sshbuf_get_u32(msg, &id)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
                 debug3("Received reply T:%u I:%u", type, id);
 
@@ -510,27 +571,43 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int print_flag,
                         fatal("ID mismatch (%u != %u)", id, expected_id);
 
                 if (type == SSH2_FXP_STATUS) {
-                        status = buffer_get_int(&msg);
-                        debug3("Received SSH2_FXP_STATUS %d", status);
-                        if (status == SSH2_FX_EOF)
+                        u_int rstatus;
+
+                        if ((r = sshbuf_get_u32(msg, &rstatus)) != 0)
+                                fatal("%s: buffer error: %s",
+                                    __func__, ssh_err(r));
+                        debug3("Received SSH2_FXP_STATUS %d", rstatus);
+                        if (rstatus == SSH2_FX_EOF)
                                 break;
-                        error("Couldn't read directory: %s", fx2txt(status));
+                        error("Couldn't read directory: %s", fx2txt(rstatus));
                         goto out;
                 } else if (type != SSH2_FXP_NAME)
                         fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
                             SSH2_FXP_NAME, type);
 
-                count = buffer_get_int(&msg);
+                if ((r = sshbuf_get_u32(msg, &count)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
                 if (count == 0)
                         break;
                 debug3("Received %d SSH2_FXP_NAME responses", count);
                 for (i = 0; i < count; i++) {
                         char *filename, *longname;
-                        Attrib *a;
-
-                        filename = buffer_get_string(&msg, NULL);
-                        longname = buffer_get_string(&msg, NULL);
-                        a = decode_attrib(&msg);
+                        Attrib a;
+
+                        if ((r = sshbuf_get_cstring(msg, &filename,
+                            NULL)) != 0 ||
+                            (r = sshbuf_get_cstring(msg, &longname,
+                            NULL)) != 0)
+                                fatal("%s: buffer error: %s",
+                                    __func__, ssh_err(r));
+                        if ((r = decode_attrib(msg, &a)) != 0) {
+                                error("%s: couldn't decode attrib: %s",
+                                    __func__, ssh_err(r));
+                                free(filename);
+                                free(longname);
+                                sshbuf_free(msg);
+                                return -1;
+                        }
 
                         if (print_flag)
                                 printf("%s\n", longname);
@@ -548,7 +625,7 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int print_flag,
                                 (*dir)[ents] = xcalloc(1, sizeof(***dir));
                                 (*dir)[ents]->filename = xstrdup(filename);
                                 (*dir)[ents]->longname = xstrdup(longname);
-                                memcpy(&(*dir)[ents]->a, a, sizeof(*a));
+                                memcpy(&(*dir)[ents]->a, &a, sizeof(a));
                                 (*dir)[++ents] = NULL;
                         }
                         free(filename);
@@ -558,7 +635,7 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int print_flag,
         status = 0;
 
  out:
-        buffer_free(&msg);
+        sshbuf_free(msg);
         do_close(conn, handle, handle_len);
         free(handle);
 
@@ -577,7 +654,7 @@ do_lsreaddir(struct sftp_conn *conn, char *path, int print_flag,
 }
 
 int
-do_readdir(struct sftp_conn *conn, char *path, SFTP_DIRENT ***dir)
+do_readdir(struct sftp_conn *conn, const char *path, SFTP_DIRENT ***dir)
 {
         return(do_lsreaddir(conn, path, 0, dir));
 }
@@ -597,7 +674,7 @@ void free_sftp_dirents(SFTP_DIRENT **s)
 }
 
 int
-do_rm(struct sftp_conn *conn, char *path)
+do_rm(struct sftp_conn *conn, const char *path)
 {
         u_int status, id;
 
@@ -608,11 +685,11 @@ do_rm(struct sftp_conn *conn, char *path)
         status = get_status(conn, id);
         if (status != SSH2_FX_OK)
                 error("Couldn't delete file: %s", fx2txt(status));
-        return(status);
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 int
-do_mkdir(struct sftp_conn *conn, char *path, Attrib *a, int print_flag)
+do_mkdir(struct sftp_conn *conn, const char *path, Attrib *a, int print_flag)
 {
         u_int status, id;
 
@@ -624,11 +701,11 @@ do_mkdir(struct sftp_conn *conn, char *path, Attrib *a, int print_flag)
         if (status != SSH2_FX_OK && print_flag)
                 error("Couldn't create directory: %s", fx2txt(status));
 
-        return(status);
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 int
-do_rmdir(struct sftp_conn *conn, char *path)
+do_rmdir(struct sftp_conn *conn, const char *path)
 {
         u_int status, id;
 
@@ -640,11 +717,11 @@ do_rmdir(struct sftp_conn *conn, char *path)
         if (status != SSH2_FX_OK)
                 error("Couldn't remove directory: %s", fx2txt(status));
 
-        return(status);
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 Attrib *
-do_stat(struct sftp_conn *conn, char *path, int quiet)
+do_stat(struct sftp_conn *conn, const char *path, int quiet)
 {
         u_int id;
 
@@ -658,7 +735,7 @@ do_stat(struct sftp_conn *conn, char *path, int quiet)
 }
 
 Attrib *
-do_lstat(struct sftp_conn *conn, char *path, int quiet)
+do_lstat(struct sftp_conn *conn, const char *path, int quiet)
 {
         u_int id;
 
@@ -679,7 +756,8 @@ do_lstat(struct sftp_conn *conn, char *path, int quiet)
 
 #ifdef notyet
 Attrib *
-do_fstat(struct sftp_conn *conn, char *handle, u_int handle_len, int quiet)
+do_fstat(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
+    int quiet)
 {
         u_int id;
 
@@ -692,7 +770,7 @@ do_fstat(struct sftp_conn *conn, char *handle, u_int handle_len, int quiet)
 #endif
 
 int
-do_setstat(struct sftp_conn *conn, char *path, Attrib *a)
+do_setstat(struct sftp_conn *conn, const char *path, Attrib *a)
 {
         u_int status, id;
 
@@ -705,11 +783,11 @@ do_setstat(struct sftp_conn *conn, char *path, Attrib *a)
                 error("Couldn't setstat on \"%s\": %s", path,
                     fx2txt(status));
 
-        return(status);
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 int
-do_fsetstat(struct sftp_conn *conn, char *handle, u_int handle_len,
+do_fsetstat(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
     Attrib *a)
 {
         u_int status, id;
@@ -722,181 +800,201 @@ do_fsetstat(struct sftp_conn *conn, char *handle, u_int handle_len,
         if (status != SSH2_FX_OK)
                 error("Couldn't fsetstat: %s", fx2txt(status));
 
-        return(status);
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 char *
-do_realpath(struct sftp_conn *conn, char *path)
+do_realpath(struct sftp_conn *conn, const char *path)
 {
-        Buffer msg;
-        u_int type, expected_id, count, id;
+        struct sshbuf *msg;
+        u_int expected_id, count, id;
         char *filename, *longname;
-        Attrib *a;
+        Attrib a;
+        u_char type;
+        int r;
 
         expected_id = id = conn->msg_id++;
         send_string_request(conn, id, SSH2_FXP_REALPATH, path,
             strlen(path));
 
-        buffer_init(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
 
-        get_msg(conn, &msg);
-        type = buffer_get_char(&msg);
-        id = buffer_get_int(&msg);
+        get_msg(conn, msg);
+        if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+            (r = sshbuf_get_u32(msg, &id)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         if (id != expected_id)
                 fatal("ID mismatch (%u != %u)", id, expected_id);
 
         if (type == SSH2_FXP_STATUS) {
-                u_int status = buffer_get_int(&msg);
+                u_int status;
 
+                if ((r = sshbuf_get_u32(msg, &status)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
                 error("Couldn't canonicalize: %s", fx2txt(status));
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return NULL;
         } else if (type != SSH2_FXP_NAME)
                 fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
                     SSH2_FXP_NAME, type);
 
-        count = buffer_get_int(&msg);
+        if ((r = sshbuf_get_u32(msg, &count)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
         if (count != 1)
                 fatal("Got multiple names (%d) from SSH_FXP_REALPATH", count);
 
-        filename = buffer_get_string(&msg, NULL);
-        longname = buffer_get_string(&msg, NULL);
-        a = decode_attrib(&msg);
+        if ((r = sshbuf_get_cstring(msg, &filename, NULL)) != 0 ||
+            (r = sshbuf_get_cstring(msg, &longname, NULL)) != 0 ||
+            (r = decode_attrib(msg, &a)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         debug3("SSH_FXP_REALPATH %s -> %s size %lu", path, filename,
-            (unsigned long)a->size);
+            (unsigned long)a.size);
 
         free(longname);
 
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
         return(filename);
 }
 
 int
-do_rename(struct sftp_conn *conn, char *oldpath, char *newpath,
+do_rename(struct sftp_conn *conn, const char *oldpath, const char *newpath,
     int force_legacy)
 {
-        Buffer msg;
+        struct sshbuf *msg;
         u_int status, id;
-        int use_ext = (conn->exts & SFTP_EXT_POSIX_RENAME) && !force_legacy;
+        int r, use_ext = (conn->exts & SFTP_EXT_POSIX_RENAME) && !force_legacy;
 
-        buffer_init(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
 
         /* Send rename request */
         id = conn->msg_id++;
         if (use_ext) {
-                buffer_put_char(&msg, SSH2_FXP_EXTENDED);
-                buffer_put_int(&msg, id);
-                buffer_put_cstring(&msg, "posix-rename@openssh.com");
+                if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+                    (r = sshbuf_put_u32(msg, id)) != 0 ||
+                    (r = sshbuf_put_cstring(msg,
+                    "posix-rename@openssh.com")) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
         } else {
-                buffer_put_char(&msg, SSH2_FXP_RENAME);
-                buffer_put_int(&msg, id);
+                if ((r = sshbuf_put_u8(msg, SSH2_FXP_RENAME)) != 0 ||
+                    (r = sshbuf_put_u32(msg, id)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
         }
-        buffer_put_cstring(&msg, oldpath);
-        buffer_put_cstring(&msg, newpath);
-        send_msg(conn, &msg);
+        if ((r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
+            (r = sshbuf_put_cstring(msg, newpath)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message %s \"%s\" -> \"%s\"",
-            use_ext ? "posix-rename@openssh.com" : "SSH2_FXP_RENAME",
-            oldpath, newpath);
-        buffer_free(&msg);
+            use_ext ? "posix-rename@openssh.com" :
+            "SSH2_FXP_RENAME", oldpath, newpath);
+        sshbuf_free(msg);
 
         status = get_status(conn, id);
         if (status != SSH2_FX_OK)
                 error("Couldn't rename file \"%s\" to \"%s\": %s", oldpath,
                     newpath, fx2txt(status));
 
-        return(status);
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 int
-do_hardlink(struct sftp_conn *conn, char *oldpath, char *newpath)
+do_hardlink(struct sftp_conn *conn, const char *oldpath, const char *newpath)
 {
-        Buffer msg;
+        struct sshbuf *msg;
         u_int status, id;
+        int r;
 
         if ((conn->exts & SFTP_EXT_HARDLINK) == 0) {
                 error("Server does not support hardlink@openssh.com extension");
                 return -1;
         }
 
-        buffer_init(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
 
         /* Send link request */
         id = conn->msg_id++;
-        buffer_put_char(&msg, SSH2_FXP_EXTENDED);
-        buffer_put_int(&msg, id);
-        buffer_put_cstring(&msg, "hardlink@openssh.com");
-        buffer_put_cstring(&msg, oldpath);
-        buffer_put_cstring(&msg, newpath);
-        send_msg(conn, &msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_cstring(msg, "hardlink@openssh.com")) != 0 ||
+            (r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
+            (r = sshbuf_put_cstring(msg, newpath)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message hardlink@openssh.com \"%s\" -> \"%s\"",
                oldpath, newpath);
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
         status = get_status(conn, id);
         if (status != SSH2_FX_OK)
                 error("Couldn't link file \"%s\" to \"%s\": %s", oldpath,
                     newpath, fx2txt(status));
 
-        return(status);
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 int
-do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath)
+do_symlink(struct sftp_conn *conn, const char *oldpath, const char *newpath)
 {
-        Buffer msg;
+        struct sshbuf *msg;
         u_int status, id;
+        int r;
 
         if (conn->version < 3) {
                 error("This server does not support the symlink operation");
                 return(SSH2_FX_OP_UNSUPPORTED);
         }
 
-        buffer_init(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
 
         /* Send symlink request */
         id = conn->msg_id++;
-        buffer_put_char(&msg, SSH2_FXP_SYMLINK);
-        buffer_put_int(&msg, id);
-        buffer_put_cstring(&msg, oldpath);
-        buffer_put_cstring(&msg, newpath);
-        send_msg(conn, &msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_SYMLINK)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_cstring(msg, oldpath)) != 0 ||
+            (r = sshbuf_put_cstring(msg, newpath)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message SSH2_FXP_SYMLINK \"%s\" -> \"%s\"", oldpath,
             newpath);
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
         status = get_status(conn, id);
         if (status != SSH2_FX_OK)
                 error("Couldn't symlink file \"%s\" to \"%s\": %s", oldpath,
                     newpath, fx2txt(status));
 
-        return(status);
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 int
-do_fsync(struct sftp_conn *conn, char *handle, u_int handle_len)
+do_fsync(struct sftp_conn *conn, u_char *handle, u_int handle_len)
 {
-        Buffer msg;
+        struct sshbuf *msg;
         u_int status, id;
+        int r;
 
         /* Silently return if the extension is not supported */
         if ((conn->exts & SFTP_EXT_FSYNC) == 0)
                 return -1;
 
-        buffer_init(&msg);
-
         /* Send fsync request */
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
         id = conn->msg_id++;
-
-        buffer_put_char(&msg, SSH2_FXP_EXTENDED);
-        buffer_put_int(&msg, id);
-        buffer_put_cstring(&msg, "fsync@openssh.com");
-        buffer_put_string(&msg, handle, handle_len);
-        send_msg(conn, &msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_cstring(msg, "fsync@openssh.com")) != 0 ||
+            (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message fsync@openssh.com I:%u", id);
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
         status = get_status(conn, id);
         if (status != SSH2_FX_OK)
@@ -907,50 +1005,58 @@ do_fsync(struct sftp_conn *conn, char *handle, u_int handle_len)
 
 #ifdef notyet
 char *
-do_readlink(struct sftp_conn *conn, char *path)
+do_readlink(struct sftp_conn *conn, const char *path)
 {
-        Buffer msg;
-        u_int type, expected_id, count, id;
+        struct sshbuf *msg;
+        u_int expected_id, count, id;
         char *filename, *longname;
-        Attrib *a;
+        Attrib a;
+        u_char type;
+        int r;
 
         expected_id = id = conn->msg_id++;
         send_string_request(conn, id, SSH2_FXP_READLINK, path, strlen(path));
 
-        buffer_init(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
 
-        get_msg(conn, &msg);
-        type = buffer_get_char(&msg);
-        id = buffer_get_int(&msg);
+        get_msg(conn, msg);
+        if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+            (r = sshbuf_get_u32(msg, &id)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         if (id != expected_id)
                 fatal("ID mismatch (%u != %u)", id, expected_id);
 
         if (type == SSH2_FXP_STATUS) {
-                u_int status = buffer_get_int(&msg);
+                u_int status;
 
+                if ((r = sshbuf_get_u32(msg, &status)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
                 error("Couldn't readlink: %s", fx2txt(status));
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return(NULL);
         } else if (type != SSH2_FXP_NAME)
                 fatal("Expected SSH2_FXP_NAME(%u) packet, got %u",
                     SSH2_FXP_NAME, type);
 
-        count = buffer_get_int(&msg);
+        if ((r = sshbuf_get_u32(msg, &count)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
         if (count != 1)
                 fatal("Got multiple names (%d) from SSH_FXP_READLINK", count);
 
-        filename = buffer_get_string(&msg, NULL);
-        longname = buffer_get_string(&msg, NULL);
-        a = decode_attrib(&msg);
+        if ((r = sshbuf_get_cstring(msg, &filename, NULL)) != 0 ||
+            (r = sshbuf_get_cstring(msg, &longname, NULL)) != 0 ||
+            (r = decode_attrib(msg, &a)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
 
         debug3("SSH_FXP_READLINK %s -> %s", path, filename);
 
         free(longname);
 
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
-        return(filename);
+        return filename;
 }
 #endif
 
@@ -958,8 +1064,9 @@ int
 do_statvfs(struct sftp_conn *conn, const char *path, struct sftp_statvfs *st,
     int quiet)
 {
-        Buffer msg;
+        struct sshbuf *msg;
         u_int id;
+        int r;
 
         if ((conn->exts & SFTP_EXT_STATVFS) == 0) {
                 error("Server does not support statvfs@openssh.com extension");
@@ -968,24 +1075,26 @@ do_statvfs(struct sftp_conn *conn, const char *path, struct sftp_statvfs *st,
 
         id = conn->msg_id++;
 
-        buffer_init(&msg);
-        buffer_clear(&msg);
-        buffer_put_char(&msg, SSH2_FXP_EXTENDED);
-        buffer_put_int(&msg, id);
-        buffer_put_cstring(&msg, "statvfs@openssh.com");
-        buffer_put_cstring(&msg, path);
-        send_msg(conn, &msg);
-        buffer_free(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        sshbuf_reset(msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_cstring(msg, "statvfs@openssh.com")) != 0 ||
+            (r = sshbuf_put_cstring(msg, path)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
+        sshbuf_free(msg);
 
         return get_decode_statvfs(conn, st, id, quiet);
 }
 
 #ifdef notyet
 int
-do_fstatvfs(struct sftp_conn *conn, const char *handle, u_int handle_len,
+do_fstatvfs(struct sftp_conn *conn, const u_char *handle, u_int handle_len,
     struct sftp_statvfs *st, int quiet)
 {
-        Buffer msg;
+        struct sshbuf *msg;
         u_int id;
 
         if ((conn->exts & SFTP_EXT_FSTATVFS) == 0) {
@@ -995,14 +1104,16 @@ do_fstatvfs(struct sftp_conn *conn, const char *handle, u_int handle_len,
 
         id = conn->msg_id++;
 
-        buffer_init(&msg);
-        buffer_clear(&msg);
-        buffer_put_char(&msg, SSH2_FXP_EXTENDED);
-        buffer_put_int(&msg, id);
-        buffer_put_cstring(&msg, "fstatvfs@openssh.com");
-        buffer_put_string(&msg, handle, handle_len);
-        send_msg(conn, &msg);
-        buffer_free(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        sshbuf_reset(msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_EXTENDED)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_cstring(msg, "fstatvfs@openssh.com")) != 0 ||
+            (r = sshbuf_put_string(msg, handle, handle_len)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
+        sshbuf_free(msg);
 
         return get_decode_statvfs(conn, st, id, quiet);
 }
@@ -1010,42 +1121,48 @@ do_fstatvfs(struct sftp_conn *conn, const char *handle, u_int handle_len,
 
 static void
 send_read_request(struct sftp_conn *conn, u_int id, u_int64_t offset,
-    u_int len, char *handle, u_int handle_len)
+    u_int len, const u_char *handle, u_int handle_len)
 {
-        Buffer msg;
-
-        buffer_init(&msg);
-        buffer_clear(&msg);
-        buffer_put_char(&msg, SSH2_FXP_READ);
-        buffer_put_int(&msg, id);
-        buffer_put_string(&msg, handle, handle_len);
-        buffer_put_int64(&msg, offset);
-        buffer_put_int(&msg, len);
-        send_msg(conn, &msg);
-        buffer_free(&msg);
+        struct sshbuf *msg;
+        int r;
+
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+        sshbuf_reset(msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_READ)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_string(msg, handle, handle_len)) != 0 ||
+            (r = sshbuf_put_u64(msg, offset)) != 0 ||
+            (r = sshbuf_put_u32(msg, len)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
+        sshbuf_free(msg);
 }
 
 int
-do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
-    Attrib *a, int preserve_flag, int resume_flag, int fsync_flag)
+do_download(struct sftp_conn *conn, const char *remote_path,
+    const char *local_path, Attrib *a, int preserve_flag, int resume_flag,
+    int fsync_flag)
 {
         Attrib junk;
-        Buffer msg;
-        char *handle;
-        int local_fd = -1, status = 0, write_error;
-        int read_error, write_errno, reordered = 0;
+        struct sshbuf *msg;
+        u_char *handle;
+        int local_fd = -1, write_error;
+        int read_error, write_errno, reordered = 0, r;
         u_int64_t offset = 0, size, highwater;
-        u_int handle_len, mode, type, id, buflen, num_req, max_req;
+        u_int mode, id, buflen, num_req, max_req, status = SSH2_FX_OK;
         off_t progress_counter;
+        size_t handle_len;
         struct stat st;
         struct request {
                 u_int id;
-                u_int len;
+                size_t len;
                 u_int64_t offset;
                 TAILQ_ENTRY(request) tq;
         };
         TAILQ_HEAD(reqhead, request) requests;
         struct request *req;
+        u_char type;
 
         TAILQ_INIT(&requests);
 
@@ -1070,23 +1187,26 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
                 size = 0;
 
         buflen = conn->transfer_buflen;
-        buffer_init(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
+
+        attrib_clear(&junk); /* Send empty attributes */
 
         /* Send open request */
         id = conn->msg_id++;
-        buffer_put_char(&msg, SSH2_FXP_OPEN);
-        buffer_put_int(&msg, id);
-        buffer_put_cstring(&msg, remote_path);
-        buffer_put_int(&msg, SSH2_FXF_READ);
-        attrib_clear(&junk); /* Send empty attributes */
-        encode_attrib(&msg, &junk);
-        send_msg(conn, &msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPEN)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_cstring(msg, remote_path)) != 0 ||
+            (r = sshbuf_put_u32(msg, SSH2_FXF_READ)) != 0 ||
+            (r = encode_attrib(msg, &junk)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, remote_path);
 
         handle = get_handle(conn, id, &handle_len,
             "remote open(\"%s\")", remote_path);
         if (handle == NULL) {
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return(-1);
         }
 
@@ -1113,7 +1233,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
                             "local file is larger than remote", local_path);
  fail:
                         do_close(conn, handle, handle_len);
-                        buffer_free(&msg);
+                        sshbuf_free(msg);
                         free(handle);
                         if (local_fd != -1)
                                 close(local_fd);
@@ -1131,8 +1251,8 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
                 start_progress_meter(remote_path, size, &progress_counter);
 
         while (num_req > 0 || max_req > 0) {
-                char *data;
-                u_int len;
+                u_char *data;
+                size_t len;
 
                 /*
                  * Simulate EOF on interrupt: stop sending new requests and
@@ -1161,10 +1281,11 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
                             req->len, handle, handle_len);
                 }
 
-                buffer_clear(&msg);
-                get_msg(conn, &msg);
-                type = buffer_get_char(&msg);
-                id = buffer_get_int(&msg);
+                sshbuf_reset(msg);
+                get_msg(conn, msg);
+                if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+                    (r = sshbuf_get_u32(msg, &id)) != 0)
+                        fatal("%s: buffer error: %s", __func__, ssh_err(r));
                 debug3("Received reply T:%u I:%u R:%d", type, id, max_req);
 
                 /* Find the request in our queue */
@@ -1177,7 +1298,9 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
 
                 switch (type) {
                 case SSH2_FXP_STATUS:
-                        status = buffer_get_int(&msg);
+                        if ((r = sshbuf_get_u32(msg, &status)) != 0)
+                                fatal("%s: buffer error: %s",
+                                    __func__, ssh_err(r));
                         if (status != SSH2_FX_EOF)
                                 read_error = 1;
                         max_req = 0;
@@ -1186,13 +1309,15 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
                         num_req--;
                         break;
                 case SSH2_FXP_DATA:
-                        data = buffer_get_string(&msg, &len);
+                        if ((r = sshbuf_get_string(msg, &data, &len)) != 0)
+                                fatal("%s: buffer error: %s",
+                                    __func__, ssh_err(r));
                         debug3("Received data %llu -> %llu",
                             (unsigned long long)req->offset,
                             (unsigned long long)req->offset + len - 1);
                         if (len > req->len)
                                 fatal("Received more data than asked for "
-                                    "%u > %u", len, req->len);
+                                    "%zu > %zu", len, req->len);
                         if ((lseek(local_fd, req->offset, SEEK_SET) == -1 ||
                             atomicio(vwrite, local_fd, data, len) != len) &&
                             !write_error) {
@@ -1269,12 +1394,13 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
         } else if (write_error) {
                 error("Couldn't write to \"%s\": %s", local_path,
                     strerror(write_errno));
-                status = -1;
+                status = SSH2_FX_FAILURE;
                 do_close(conn, handle, handle_len);
         } else {
-                status = do_close(conn, handle, handle_len);
-                if (interrupted || status != SSH2_FX_OK)
-                        status = -1;
+                if (do_close(conn, handle, handle_len) != 0 || interrupted)
+                        status = SSH2_FX_FAILURE;
+                else
+                        status = SSH2_FX_OK;
                 /* Override umask and utimes if asked */
 #ifdef HAVE_FCHMOD
                 if (preserve_flag && fchmod(local_fd, mode) == -1)
@@ -1301,16 +1427,16 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path,
                 }
         }
         close(local_fd);
-        buffer_free(&msg);
+        sshbuf_free(msg);
         free(handle);
 
         return(status);
 }
 
 static int
-download_dir_internal(struct sftp_conn *conn, char *src, char *dst, int depth,
-    Attrib *dirattrib, int preserve_flag, int print_flag, int resume_flag,
-    int fsync_flag)
+download_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
+    int depth, Attrib *dirattrib, int preserve_flag, int print_flag,
+    int resume_flag, int fsync_flag)
 {
         int i, ret = 0;
         SFTP_DIRENT **dir_entries;
@@ -1400,9 +1526,9 @@ download_dir_internal(struct sftp_conn *conn, char *src, char *dst, int depth,
 }
 
 int
-download_dir(struct sftp_conn *conn, char *src, char *dst,
-    Attrib *dirattrib, int preserve_flag, int print_flag,
-    int resume_flag, int fsync_flag)
+download_dir(struct sftp_conn *conn, const char *src, const char *dst,
+    Attrib *dirattrib, int preserve_flag, int print_flag, int resume_flag,
+    int fsync_flag)
 {
         char *src_canon;
         int ret;
@@ -1419,15 +1545,16 @@ download_dir(struct sftp_conn *conn, char *src, char *dst,
 }
 
 int
-do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
-    int preserve_flag, int resume, int fsync_flag)
+do_upload(struct sftp_conn *conn, const char *local_path,
+    const char *remote_path, int preserve_flag, int resume, int fsync_flag)
 {
-        int local_fd;
-        int status = SSH2_FX_OK;
-        u_int handle_len, id, type;
+        int r, local_fd;
+        u_int status = SSH2_FX_OK;
+        u_int id;
+        u_char type;
         off_t offset, progress_counter;
-        char *handle, *data;
-        Buffer msg;
+        u_char *handle, *data;
+        struct sshbuf *msg;
         struct stat sb;
         Attrib a, *c = NULL;
         u_int32_t startid;
@@ -1440,6 +1567,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
         };
         TAILQ_HEAD(ackhead, outstanding_ack) acks;
         struct outstanding_ack *ack = NULL;
+        size_t handle_len;
 
         TAILQ_INIT(&acks);
 
@@ -1487,26 +1615,28 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
                 }
         }
 
-        buffer_init(&msg);
+        if ((msg = sshbuf_new()) == NULL)
+                fatal("%s: sshbuf_new failed", __func__);
 
         /* Send open request */
         id = conn->msg_id++;
-        buffer_put_char(&msg, SSH2_FXP_OPEN);
-        buffer_put_int(&msg, id);
-        buffer_put_cstring(&msg, remote_path);
-        buffer_put_int(&msg, SSH2_FXF_WRITE|SSH2_FXF_CREAT|
-                      (resume ? SSH2_FXF_APPEND : SSH2_FXF_TRUNC));
-        encode_attrib(&msg, &a);
-        send_msg(conn, &msg);
+        if ((r = sshbuf_put_u8(msg, SSH2_FXP_OPEN)) != 0 ||
+            (r = sshbuf_put_u32(msg, id)) != 0 ||
+            (r = sshbuf_put_cstring(msg, remote_path)) != 0 ||
+            (r = sshbuf_put_u32(msg, SSH2_FXF_WRITE|SSH2_FXF_CREAT|
+            (resume ? SSH2_FXF_APPEND : SSH2_FXF_TRUNC))) != 0 ||
+            (r = encode_attrib(msg, &a)) != 0)
+                fatal("%s: buffer error: %s", __func__, ssh_err(r));
+        send_msg(conn, msg);
         debug3("Sent message SSH2_FXP_OPEN I:%u P:%s", id, remote_path);
 
-        buffer_clear(&msg);
+        sshbuf_reset(msg);
 
         handle = get_handle(conn, id, &handle_len,
             "remote open(\"%s\")", remote_path);
         if (handle == NULL) {
                 close(local_fd);
-                buffer_free(&msg);
+                sshbuf_free(msg);
                 return -1;
         }
 
@@ -1546,13 +1676,16 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
                         ack->len = len;
                         TAILQ_INSERT_TAIL(&acks, ack, tq);
 
-                        buffer_clear(&msg);
-                        buffer_put_char(&msg, SSH2_FXP_WRITE);
-                        buffer_put_int(&msg, ack->id);
-                        buffer_put_string(&msg, handle, handle_len);
-                        buffer_put_int64(&msg, offset);
-                        buffer_put_string(&msg, data, len);
-                        send_msg(conn, &msg);
+                        sshbuf_reset(msg);
+                        if ((r = sshbuf_put_u8(msg, SSH2_FXP_WRITE)) != 0 ||
+                            (r = sshbuf_put_u32(msg, ack->id)) != 0 ||
+                            (r = sshbuf_put_string(msg, handle,
+                            handle_len)) != 0 ||
+                            (r = sshbuf_put_u64(msg, offset)) != 0 ||
+                            (r = sshbuf_put_string(msg, data, len)) != 0)
+                                fatal("%s: buffer error: %s",
+                                    __func__, ssh_err(r));
+                        send_msg(conn, msg);
                         debug3("Sent message SSH2_FXP_WRITE I:%u O:%llu S:%u",
                             id, (unsigned long long)offset, len);
                 } else if (TAILQ_FIRST(&acks) == NULL)
@@ -1563,27 +1696,31 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
 
                 if (id == startid || len == 0 ||
                     id - ackid >= conn->num_requests) {
-                        u_int r_id;
+                        u_int rid;
 
-                        buffer_clear(&msg);
-                        get_msg(conn, &msg);
-                        type = buffer_get_char(&msg);
-                        r_id = buffer_get_int(&msg);
+                        sshbuf_reset(msg);
+                        get_msg(conn, msg);
+                        if ((r = sshbuf_get_u8(msg, &type)) != 0 ||
+                            (r = sshbuf_get_u32(msg, &rid)) != 0)
+                                fatal("%s: buffer error: %s",
+                                    __func__, ssh_err(r));
 
                         if (type != SSH2_FXP_STATUS)
                                 fatal("Expected SSH2_FXP_STATUS(%d) packet, "
                                     "got %d", SSH2_FXP_STATUS, type);
 
-                        status = buffer_get_int(&msg);
-                        debug3("SSH2_FXP_STATUS %d", status);
+                        if ((r = sshbuf_get_u32(msg, &status)) != 0)
+                                fatal("%s: buffer error: %s",
+                                    __func__, ssh_err(r));
+                        debug3("SSH2_FXP_STATUS %u", status);
 
                         /* Find the request in our queue */
                         for (ack = TAILQ_FIRST(&acks);
-                            ack != NULL && ack->id != r_id;
+                            ack != NULL && ack->id != rid;
                             ack = TAILQ_NEXT(ack, tq))
                                 ;
                         if (ack == NULL)
-                                fatal("Can't find request for ID %u", r_id);
+                                fatal("Can't find request for ID %u", rid);
                         TAILQ_REMOVE(&acks, ack, tq);
                         debug3("In write loop, ack for %u %u bytes at %lld",
                             ack->id, ack->len, (long long)ack->offset);
@@ -1595,7 +1732,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
                 if (offset < 0)
                         fatal("%s: offset < 0", __func__);
         }
-        buffer_free(&msg);
+        sshbuf_free(msg);
 
         if (showprogress)
                 stop_progress_meter();
@@ -1604,13 +1741,13 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
         if (status != SSH2_FX_OK) {
                 error("Couldn't write to remote file \"%s\": %s",
                     remote_path, fx2txt(status));
-                status = -1;
+                status = SSH2_FX_FAILURE;
         }
 
         if (close(local_fd) == -1) {
                 error("Couldn't close local file \"%s\": %s", local_path,
                     strerror(errno));
-                status = -1;
+                status = SSH2_FX_FAILURE;
         }
 
         /* Override umask and utimes if asked */
@@ -1621,17 +1758,19 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path,
                 (void)do_fsync(conn, handle, handle_len);
 
         if (do_close(conn, handle, handle_len) != SSH2_FX_OK)
-                status = -1;
+                status = SSH2_FX_FAILURE;
+
         free(handle);
 
-        return status;
+        return status == SSH2_FX_OK ? 0 : -1;
 }
 
 static int
-upload_dir_internal(struct sftp_conn *conn, char *src, char *dst, int depth,
-    int preserve_flag, int print_flag, int resume, int fsync_flag)
+upload_dir_internal(struct sftp_conn *conn, const char *src, const char *dst,
+    int depth, int preserve_flag, int print_flag, int resume, int fsync_flag)
 {
-        int ret = 0, status;
+        int ret = 0;
+        u_int status;
         DIR *dirp;
         struct dirent *dp;
         char *filename, *new_src, *new_dst;
@@ -1721,8 +1860,8 @@ upload_dir_internal(struct sftp_conn *conn, char *src, char *dst, int depth,
 }
 
 int
-upload_dir(struct sftp_conn *conn, char *src, char *dst, int preserve_flag,
-    int print_flag, int resume, int fsync_flag)
+upload_dir(struct sftp_conn *conn, const char *src, const char *dst,
+    int preserve_flag, int print_flag, int resume, int fsync_flag)
 {
         char *dst_canon;
         int ret;
@@ -1740,7 +1879,7 @@ upload_dir(struct sftp_conn *conn, char *src, char *dst, int preserve_flag,
 }
 
 char *
-path_append(char *p1, char *p2)
+path_append(const char *p1, const char *p2)
 {
         char *ret;
         size_t len = strlen(p1) + strlen(p2) + 2;