1 files changed, 187 insertions, 76 deletions

diff --git a/channels.c b/channels.c
index 218744d1a..65a6a7f00 100644
--- a/channels.c
+++ b/channels.c
@@ -39,7 +39,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.187 2003/03/05 22:33:43 markus Exp $");
+RCSID("$OpenBSD: channels.c,v 1.194 2003/08/29 10:04:36 markus Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -54,7 +54,7 @@ RCSID("$OpenBSD: channels.c,v 1.187 2003/03/05 22:33:43 markus Exp $");
 #include "key.h"
 #include "authfd.h"
 #include "pathnames.h"
-
+#include "bufaux.h"
 
 /* -- channel core */
 
@@ -142,12 +142,12 @@ channel_lookup(int id)
         Channel *c;
 
         if (id < 0 || id >= channels_alloc) {
-                log("channel_lookup: %d: bad id", id);
+                logit("channel_lookup: %d: bad id", id);
                 return NULL;
         }
         c = channels[id];
         if (c == NULL) {
-                log("channel_lookup: %d: bad id: channel free", id);
+                logit("channel_lookup: %d: bad id: channel free", id);
                 return NULL;
         }
         return c;
@@ -177,7 +177,7 @@ channel_register_fds(Channel *c, int rfd, int wfd, int efd,
 
         /* XXX ugly hack: nonblock is only set by the server */
         if (nonblock && isatty(c->rfd)) {
-                debug("channel %d: rfd %d isatty", c->self, c->rfd);
+                debug2("channel %d: rfd %d isatty", c->self, c->rfd);
                 c->isatty = 1;
                 if (!isatty(c->wfd)) {
                         error("channel %d: wfd %d is not a tty?",
@@ -229,13 +229,12 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
         if (found == -1) {
                 /* There are no free slots.  Take last+1 slot and expand the array.  */
                 found = channels_alloc;
+                channels_alloc += 10;
                 if (channels_alloc > 10000)
                         fatal("channel_new: internal error: channels_alloc %d "
                             "too big.", channels_alloc);
-                channels = xrealloc(channels,
-                    (channels_alloc + 10) * sizeof(Channel *));
-                channels_alloc += 10;
                 debug2("channel: expanding %d", channels_alloc);
+                channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
                 for (i = found; i < channels_alloc; i++)
                         channels[i] = NULL;
         }
@@ -257,7 +256,7 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
         c->local_consumed = 0;
         c->local_maxpacket = maxpack;
         c->remote_id = -1;
-        c->remote_name = remote_name;
+        c->remote_name = xstrdup(remote_name);
         c->remote_window = 0;
         c->remote_maxpacket = 0;
         c->force_drain = 0;
@@ -305,7 +304,7 @@ channel_close_fd(int *fdp)
 static void
 channel_close_fds(Channel *c)
 {
-        debug3("channel_close_fds: channel %d: r %d w %d e %d",
+        debug3("channel %d: close_fds r %d w %d e %d",
             c->self, c->rfd, c->wfd, c->efd);
 
         channel_close_fd(&c->sock);
@@ -325,11 +324,11 @@ channel_free(Channel *c)
         for (n = 0, i = 0; i < channels_alloc; i++)
                 if (channels[i])
                         n++;
-        debug("channel_free: channel %d: %s, nchannels %d", c->self,
+        debug("channel %d: free: %s, nchannels %d", c->self,
             c->remote_name ? c->remote_name : "???", n);
 
         s = channel_open_message();
-        debug3("channel_free: status: %s", s);
+        debug3("channel %d: status: %s", c->self, s);
         xfree(s);
 
         if (c->sock != -1)
@@ -420,7 +419,7 @@ channel_not_very_much_buffered_data(void)
                         }
 #endif
                         if (buffer_len(&c->output) > packet_get_maxsize()) {
-                                debug2("channel %d: big output buffer %d > %d",
+                                debug2("channel %d: big output buffer %u > %u",
                                     c->self, buffer_len(&c->output),
                                     packet_get_maxsize());
                                 return 0;
@@ -576,7 +575,7 @@ channel_send_open(int id)
         Channel *c = channel_lookup(id);
 
         if (c == NULL) {
-                log("channel_send_open: %d: bad id", id);
+                logit("channel_send_open: %d: bad id", id);
                 return;
         }
         debug2("channel %d: send open", id);
@@ -594,10 +593,10 @@ channel_request_start(int id, char *service, int wantconfirm)
         Channel *c = channel_lookup(id);
 
         if (c == NULL) {
-                log("channel_request_start: %d: unknown channel id", id);
+                logit("channel_request_start: %d: unknown channel id", id);
                 return;
         }
-        debug("channel %d: request %s", id, service) ;
+        debug2("channel %d: request %s", id, service) ;
         packet_start(SSH2_MSG_CHANNEL_REQUEST);
         packet_put_int(c->remote_id);
         packet_put_cstring(service);
@@ -609,7 +608,7 @@ channel_register_confirm(int id, channel_callback_fn *fn)
         Channel *c = channel_lookup(id);
 
         if (c == NULL) {
-                log("channel_register_comfirm: %d: bad id", id);
+                logit("channel_register_comfirm: %d: bad id", id);
                 return;
         }
         c->confirm = fn;
@@ -620,7 +619,7 @@ channel_register_cleanup(int id, channel_callback_fn *fn)
         Channel *c = channel_lookup(id);
 
         if (c == NULL) {
-                log("channel_register_cleanup: %d: bad id", id);
+                logit("channel_register_cleanup: %d: bad id", id);
                 return;
         }
         c->detach_user = fn;
@@ -631,7 +630,7 @@ channel_cancel_cleanup(int id)
         Channel *c = channel_lookup(id);
 
         if (c == NULL) {
-                log("channel_cancel_cleanup: %d: bad id", id);
+                logit("channel_cancel_cleanup: %d: bad id", id);
                 return;
         }
         c->detach_user = NULL;
@@ -642,7 +641,7 @@ channel_register_filter(int id, channel_filter_fn *fn)
         Channel *c = channel_lookup(id);
 
         if (c == NULL) {
-                log("channel_register_filter: %d: bad id", id);
+                logit("channel_register_filter: %d: bad id", id);
                 return;
         }
         c->input_filter = fn;
@@ -740,7 +739,7 @@ channel_pre_input_draining(Channel *c, fd_set * readset, fd_set * writeset)
                 packet_put_int(c->remote_id);
                 packet_send();
                 c->type = SSH_CHANNEL_CLOSED;
-                debug("channel %d: closing after input drain.", c->self);
+                debug2("channel %d: closing after input drain.", c->self);
         }
 }
 
@@ -781,7 +780,7 @@ x11_open_helper(Buffer *b)
                 proto_len = ucp[6] + 256 * ucp[7];
                 data_len = ucp[8] + 256 * ucp[9];
         } else {
-                debug("Initial X11 packet contains bad byte order byte: 0x%x",
+                debug2("Initial X11 packet contains bad byte order byte: 0x%x",
                     ucp[0]);
                 return -1;
         }
@@ -794,14 +793,14 @@ x11_open_helper(Buffer *b)
         /* Check if authentication protocol matches. */
         if (proto_len != strlen(x11_saved_proto) ||
             memcmp(ucp + 12, x11_saved_proto, proto_len) != 0) {
-                debug("X11 connection uses different authentication protocol.");
+                debug2("X11 connection uses different authentication protocol.");
                 return -1;
         }
         /* Check if authentication data matches our fake data. */
         if (data_len != x11_fake_data_len ||
             memcmp(ucp + 12 + ((proto_len + 3) & ~3),
                 x11_fake_data, x11_fake_data_len) != 0) {
-                debug("X11 auth data does not match fake data.");
+                debug2("X11 auth data does not match fake data.");
                 return -1;
         }
         /* Check fake data length */
@@ -834,7 +833,7 @@ channel_pre_x11_open_13(Channel *c, fd_set * readset, fd_set * writeset)
                  * We have received an X11 connection that has bad
                  * authentication information.
                  */
-                log("X11 connection rejected because of wrong authentication.");
+                logit("X11 connection rejected because of wrong authentication.");
                 buffer_clear(&c->input);
                 buffer_clear(&c->output);
                 channel_close_fd(&c->sock);
@@ -857,8 +856,8 @@ channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
                 c->type = SSH_CHANNEL_OPEN;
                 channel_pre_open(c, readset, writeset);
         } else if (ret == -1) {
-                log("X11 connection rejected because of wrong authentication.");
-                debug("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
+                logit("X11 connection rejected because of wrong authentication.");
+                debug2("X11 rejected %d i%d/o%d", c->self, c->istate, c->ostate);
                 chan_read_failed(c);
                 buffer_clear(&c->input);
                 chan_ibuf_empty(c);
@@ -868,7 +867,7 @@ channel_pre_x11_open(Channel *c, fd_set * readset, fd_set * writeset)
                         chan_write_failed(c);
                 else
                         c->type = SSH_CHANNEL_OPEN;
-                debug("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
+                debug2("X11 closed %d i%d/o%d", c->self, c->istate, c->ostate);
         }
 }
 
@@ -926,7 +925,7 @@ channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset)
         strlcpy(c->path, host, sizeof(c->path));
         c->host_port = ntohs(s4_req.dest_port);
 
-        debug("channel %d: dynamic request: socks4 host %s port %u command %u",
+        debug2("channel %d: dynamic request: socks4 host %s port %u command %u",
             c->self, host, c->host_port, s4_req.command);
 
         if (s4_req.command != 1) {
@@ -942,6 +941,117 @@ channel_decode_socks4(Channel *c, fd_set * readset, fd_set * writeset)
         return 1;
 }
 
+/* try to decode a socks5 header */
+#define SSH_SOCKS5_AUTHDONE     0x1000
+#define SSH_SOCKS5_NOAUTH       0x00
+#define SSH_SOCKS5_IPV4         0x01
+#define SSH_SOCKS5_DOMAIN       0x03
+#define SSH_SOCKS5_IPV6         0x04
+#define SSH_SOCKS5_CONNECT      0x01
+#define SSH_SOCKS5_SUCCESS      0x00
+
+static int
+channel_decode_socks5(Channel *c, fd_set * readset, fd_set * writeset)
+{
+        struct {
+                u_int8_t version;
+                u_int8_t command;
+                u_int8_t reserved;
+                u_int8_t atyp;
+        } s5_req, s5_rsp;
+        u_int16_t dest_port;
+        u_char *p, dest_addr[255+1];
+        int i, have, found, nmethods, addrlen, af;
+
+        debug2("channel %d: decode socks5", c->self);
+        p = buffer_ptr(&c->input);
+        if (p[0] != 0x05)
+                return -1;
+        have = buffer_len(&c->input);
+        if (!(c->flags & SSH_SOCKS5_AUTHDONE)) {
+                /* format: ver | nmethods | methods */
+                if (have < 2) 
+                        return 0;
+                nmethods = p[1];
+                if (have < nmethods + 2)
+                        return 0;
+                /* look for method: "NO AUTHENTICATION REQUIRED" */
+                for (found = 0, i = 2 ; i < nmethods + 2; i++) {
+                        if (p[i] == SSH_SOCKS5_NOAUTH ) {
+                                found = 1;
+                                break;
+                        }
+                }
+                if (!found) {
+                        debug("channel %d: method SSH_SOCKS5_NOAUTH not found",
+                            c->self);
+                        return -1;
+                }
+                buffer_consume(&c->input, nmethods + 2);
+                buffer_put_char(&c->output, 0x05);              /* version */
+                buffer_put_char(&c->output, SSH_SOCKS5_NOAUTH); /* method */
+                FD_SET(c->sock, writeset);
+                c->flags |= SSH_SOCKS5_AUTHDONE;
+                debug2("channel %d: socks5 auth done", c->self);
+                return 0;                               /* need more */
+        }
+        debug2("channel %d: socks5 post auth", c->self);
+        if (have < sizeof(s5_req)+1)
+                return 0;                       /* need more */
+        memcpy((char *)&s5_req, p, sizeof(s5_req));
+        if (s5_req.version != 0x05 ||
+            s5_req.command != SSH_SOCKS5_CONNECT ||
+            s5_req.reserved != 0x00) {
+                debug2("channel %d: only socks5 connect supported", c->self);
+                return -1;
+        }
+        switch(s5_req.atyp){
+        case SSH_SOCKS5_IPV4:
+                addrlen = 4;
+                af = AF_INET;
+                break;
+        case SSH_SOCKS5_DOMAIN:
+                addrlen = p[sizeof(s5_req)];
+                af = -1;
+                break;
+        case SSH_SOCKS5_IPV6:
+                addrlen = 16;
+                af = AF_INET6;
+                break;
+        default:
+                debug2("channel %d: bad socks5 atyp %d", c->self, s5_req.atyp);
+                return -1;
+        }
+        if (have < 4 + addrlen + 2)
+                return 0;
+        buffer_consume(&c->input, sizeof(s5_req));
+        if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
+                buffer_consume(&c->input, 1);    /* host string length */
+        buffer_get(&c->input, (char *)&dest_addr, addrlen);
+        buffer_get(&c->input, (char *)&dest_port, 2);
+        dest_addr[addrlen] = '\0';
+        if (s5_req.atyp == SSH_SOCKS5_DOMAIN)
+                strlcpy(c->path, dest_addr, sizeof(c->path));
+        else if (inet_ntop(af, dest_addr, c->path, sizeof(c->path)) == NULL)
+                return -1;
+        c->host_port = ntohs(dest_port);
+        
+        debug2("channel %d: dynamic request: socks5 host %s port %u command %u",
+            c->self, c->path, c->host_port, s5_req.command);
+
+        s5_rsp.version = 0x05;
+        s5_rsp.command = SSH_SOCKS5_SUCCESS;
+        s5_rsp.reserved = 0;                    /* ignored */
+        s5_rsp.atyp = SSH_SOCKS5_IPV4;
+        ((struct in_addr *)&dest_addr)->s_addr = INADDR_ANY;
+        dest_port = 0;                          /* ignored */
+
+        buffer_append(&c->output, (char *)&s5_rsp, sizeof(s5_rsp));
+        buffer_append(&c->output, (char *)&dest_addr, sizeof(struct in_addr));
+        buffer_append(&c->output, (char *)&dest_port, sizeof(dest_port));
+        return 1;
+}
+
 /* dynamic port forwarding */
 static void
 channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
@@ -954,7 +1064,7 @@ channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
         debug2("channel %d: pre_dynamic: have %d", c->self, have);
         /* buffer_dump(&c->input); */
         /* check if the fixed size part of the packet is in buffer. */
-        if (have < 4) {
+        if (have < 3) {
                 /* need more */
                 FD_SET(c->sock, readset);
                 return;
@@ -965,6 +1075,9 @@ channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
         case 0x04:
                 ret = channel_decode_socks4(c, readset, writeset);
                 break;
+        case 0x05:
+                ret = channel_decode_socks5(c, readset, writeset);
+                break;
         default:
                 ret = -1;
                 break;
@@ -998,7 +1111,7 @@ channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
                 addrlen = sizeof(addr);
                 newsock = accept(c->sock, &addr, &addrlen);
                 if (c->single_connection) {
-                        debug("single_connection: closing X11 listener.");
+                        debug2("single_connection: closing X11 listener.");
                         channel_close_fd(&c->sock);
                         chan_mark_dead(c);
                 }
@@ -1014,8 +1127,7 @@ channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 
                 nc = channel_new("accepted x11 socket",
                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
-                    c->local_window_max, c->local_maxpacket,
-                    0, xstrdup(buf), 1);
+                    c->local_window_max, c->local_maxpacket, 0, buf, 1);
                 if (compat20) {
                         packet_start(SSH2_MSG_CHANNEL_OPEN);
                         packet_put_cstring("x11");
@@ -1025,7 +1137,7 @@ channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
                         /* originator ipaddr and port */
                         packet_put_cstring(remote_ipaddr);
                         if (datafellows & SSH_BUG_X11FWD) {
-                                debug("ssh2 x11 bug compat mode");
+                                debug2("ssh2 x11 bug compat mode");
                         } else {
                                 packet_put_int(remote_port);
                         }
@@ -1130,10 +1242,8 @@ channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
                         return;
                 }
                 set_nodelay(newsock);
-                nc = channel_new(rtype,
-                    nextstate, newsock, newsock, -1,
-                    c->local_window_max, c->local_maxpacket,
-                    0, xstrdup(rtype), 1);
+                nc = channel_new(rtype, nextstate, newsock, newsock, -1,
+                    c->local_window_max, c->local_maxpacket, 0, rtype, 1);
                 nc->listening_port = c->listening_port;
                 nc->host_port = c->host_port;
                 strlcpy(nc->path, c->path, sizeof(nc->path));
@@ -1159,7 +1269,6 @@ static void
 channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
 {
         Channel *nc;
-        char *name;
         int newsock;
         struct sockaddr addr;
         socklen_t addrlen;
@@ -1171,11 +1280,10 @@ channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
                         error("accept from auth socket: %.100s", strerror(errno));
                         return;
                 }
-                name = xstrdup("accepted auth socket");
                 nc = channel_new("accepted auth socket",
                     SSH_CHANNEL_OPENING, newsock, newsock, -1,
                     c->local_window_max, c->local_maxpacket,
-                    0, name, 1);
+                    0, "accepted auth socket", 1);
                 if (compat20) {
                         packet_start(SSH2_MSG_CHANNEL_OPEN);
                         packet_put_cstring("auth-agent@openssh.com");
@@ -1248,16 +1356,16 @@ channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
                 if (len < 0 && (errno == EINTR || errno == EAGAIN))
                         return 1;
                 if (len <= 0) {
-                        debug("channel %d: read<=0 rfd %d len %d",
+                        debug2("channel %d: read<=0 rfd %d len %d",
                             c->self, c->rfd, len);
                         if (c->type != SSH_CHANNEL_OPEN) {
-                                debug("channel %d: not open", c->self);
+                                debug2("channel %d: not open", c->self);
                                 chan_mark_dead(c);
                                 return -1;
                         } else if (compat13) {
                                 buffer_clear(&c->output);
                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
-                                debug("channel %d: input draining.", c->self);
+                                debug2("channel %d: input draining.", c->self);
                         } else {
                                 chan_read_failed(c);
                         }
@@ -1265,7 +1373,7 @@ channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
                 }
                 if (c->input_filter != NULL) {
                         if (c->input_filter(c, buf, len) == -1) {
-                                debug("channel %d: filter stops", c->self);
+                                debug2("channel %d: filter stops", c->self);
                                 chan_read_failed(c);
                         }
                 } else {
@@ -1298,12 +1406,12 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
                         return 1;
                 if (len <= 0) {
                         if (c->type != SSH_CHANNEL_OPEN) {
-                                debug("channel %d: not open", c->self);
+                                debug2("channel %d: not open", c->self);
                                 chan_mark_dead(c);
                                 return -1;
                         } else if (compat13) {
                                 buffer_clear(&c->output);
-                                debug("channel %d: input draining.", c->self);
+                                debug2("channel %d: input draining.", c->self);
                                 c->type = SSH_CHANNEL_INPUT_DRAINING;
                         } else {
                                 chan_write_failed(c);
@@ -1510,16 +1618,16 @@ channel_garbage_collect(Channel *c)
         if (c->detach_user != NULL) {
                 if (!chan_is_dead(c, 0))
                         return;
-                debug("channel %d: gc: notify user", c->self);
+                debug2("channel %d: gc: notify user", c->self);
                 c->detach_user(c->self, NULL);
                 /* if we still have a callback */
                 if (c->detach_user != NULL)
                         return;
-                debug("channel %d: gc: user detached", c->self);
+                debug2("channel %d: gc: user detached", c->self);
         }
         if (!chan_is_dead(c, 1))
                 return;
-        debug("channel %d: garbage collecting", c->self);
+        debug2("channel %d: garbage collecting", c->self);
         channel_free(c);
 }
 
@@ -1718,11 +1826,11 @@ channel_input_data(int type, u_int32_t seq, void *ctxt)
 
         if (compat20) {
                 if (data_len > c->local_maxpacket) {
-                        log("channel %d: rcvd big packet %d, maxpack %d",
+                        logit("channel %d: rcvd big packet %d, maxpack %d",
                             c->self, data_len, c->local_maxpacket);
                 }
                 if (data_len > c->local_window) {
-                        log("channel %d: rcvd too much data %d, win %d",
+                        logit("channel %d: rcvd too much data %d, win %d",
                             c->self, data_len, c->local_window);
                         xfree(data);
                         return;
@@ -1749,7 +1857,7 @@ channel_input_extended_data(int type, u_int32_t seq, void *ctxt)
         if (c == NULL)
                 packet_disconnect("Received extended_data for bad channel %d.", id);
         if (c->type != SSH_CHANNEL_OPEN) {
-                log("channel %d: ext data for non open", id);
+                logit("channel %d: ext data for non open", id);
                 return;
         }
         if (c->flags & CHAN_EOF_RCVD) {
@@ -1763,13 +1871,13 @@ channel_input_extended_data(int type, u_int32_t seq, void *ctxt)
         if (c->efd == -1 ||
             c->extended_usage != CHAN_EXTENDED_WRITE ||
             tcode != SSH2_EXTENDED_DATA_STDERR) {
-                log("channel %d: bad ext data", c->self);
+                logit("channel %d: bad ext data", c->self);
                 return;
         }
         data = packet_get_string(&data_len);
         packet_check_eom();
         if (data_len > c->local_window) {
-                log("channel %d: rcvd too much extended_data %d, win %d",
+                logit("channel %d: rcvd too much extended_data %d, win %d",
                     c->self, data_len, c->local_window);
                 xfree(data);
                 return;
@@ -1894,7 +2002,7 @@ channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt)
                         c->confirm(c->self, NULL);
                         debug2("callback done");
                 }
-                debug("channel %d: open confirm rwindow %u rmax %u", c->self,
+                debug2("channel %d: open confirm rwindow %u rmax %u", c->self,
                     c->remote_window, c->remote_maxpacket);
         }
         packet_check_eom();
@@ -1935,7 +2043,7 @@ channel_input_open_failure(int type, u_int32_t seq, void *ctxt)
                         msg  = packet_get_string(NULL);
                         lang = packet_get_string(NULL);
                 }
-                log("channel %d: open failed: %s%s%s", id,
+                logit("channel %d: open failed: %s%s%s", id,
                     reason2txt(reason), msg ? ": ": "", msg ? msg : "");
                 if (msg != NULL)
                         xfree(msg);
@@ -1962,7 +2070,7 @@ channel_input_window_adjust(int type, u_int32_t seq, void *ctxt)
         c = channel_lookup(id);
 
         if (c == NULL || c->type != SSH_CHANNEL_OPEN) {
-                log("Received window adjust for "
+                logit("Received window adjust for "
                     "non-open channel %d.", id);
                 return;
         }
@@ -1997,8 +2105,8 @@ channel_input_port_open(int type, u_int32_t seq, void *ctxt)
                     originator_string, 1);
                 c->remote_id = remote_id;
         }
+        xfree(originator_string);
         if (c == NULL) {
-                xfree(originator_string);
                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
                 packet_put_int(remote_id);
                 packet_send();
@@ -2059,7 +2167,7 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
                         continue;
                 }
                 /* Create a port to listen for the host. */
-                sock = socket(ai->ai_family, SOCK_STREAM, 0);
+                sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
                 if (sock < 0) {
                         /* this is no error since kernel may not support ipv6 */
                         verbose("socket: %.100s", strerror(errno));
@@ -2095,7 +2203,7 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por
                 /* Allocate a channel number for the socket. */
                 c = channel_new("port listener", type, sock, sock, -1,
                     CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
-                    0, xstrdup("port listener"), 1);
+                    0, "port listener", 1);
                 strlcpy(c->path, host, sizeof(c->path));
                 c->host_port = port_to_connect;
                 c->listening_port = listen_port;
@@ -2168,7 +2276,7 @@ channel_request_remote_forwarding(u_short listen_port,
                         success = 1;
                         break;
                 case SSH_SMSG_FAILURE:
-                        log("Warning: Server denied remote port forwarding.");
+                        logit("Warning: Server denied remote port forwarding.");
                         break;
                 default:
                         /* Unknown packet */
@@ -2207,9 +2315,13 @@ channel_input_port_forward_request(int is_root, int gateway_ports)
          * privileged port.
          */
         if (port < IPPORT_RESERVED && !is_root)
-                packet_disconnect("Requested forwarding of port %d but user is not root.",
-                                  port);
+                packet_disconnect(
+                    "Requested forwarding of port %d but user is not root.",
+                    port);
+        if (host_port == 0)
+                packet_disconnect("Dynamic forwarding denied.");
 #endif
+
         /* Initiate forwarding */
         channel_setup_local_fwd_listener(port, hostname, host_port, gateway_ports);
 
@@ -2281,7 +2393,7 @@ connect_to(const char *host, u_short port)
                         error("connect_to: getnameinfo failed");
                         continue;
                 }
-                sock = socket(ai->ai_family, SOCK_STREAM, 0);
+                sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
                 if (sock < 0) {
                         if (ai->ai_next == NULL)
                                 error("socket: %.100s", strerror(errno));
@@ -2341,7 +2453,7 @@ channel_connect_to(const char *host, u_short port)
 
         }
         if (!permit) {
-                log("Received request to connect to host %.100s port %d, "
+                logit("Received request to connect to host %.100s port %d, "
                     "but the request was denied.", host, port);
                 return -1;
         }
@@ -2382,7 +2494,8 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
                 for (ai = aitop; ai; ai = ai->ai_next) {
                         if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
                                 continue;
-                        sock = socket(ai->ai_family, SOCK_STREAM, 0);
+                        sock = socket(ai->ai_family, ai->ai_socktype,
+                            ai->ai_protocol);
                         if (sock < 0) {
                                 if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
                                         error("socket: %.100s", strerror(errno));
@@ -2401,7 +2514,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
                         }
 #endif
                         if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
-                                debug("bind port %d: %.100s", port, strerror(errno));
+                                debug2("bind port %d: %.100s", port, strerror(errno));
                                 close(sock);
 
                                 if (ai->ai_next)
@@ -2450,7 +2563,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
                 nc = channel_new("x11 listener",
                     SSH_CHANNEL_X11_LISTENER, sock, sock, -1,
                     CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
-                    0, xstrdup("X11 inet listener"), 1);
+                    0, "X11 inet listener", 1);
                 nc->single_connection = single_connection;
         }
 
@@ -2548,14 +2661,14 @@ x11_connect_display(void)
         }
         for (ai = aitop; ai; ai = ai->ai_next) {
                 /* Create a socket. */
-                sock = socket(ai->ai_family, SOCK_STREAM, 0);
+                sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
                 if (sock < 0) {
-                        debug("socket: %.100s", strerror(errno));
+                        debug2("socket: %.100s", strerror(errno));
                         continue;
                 }
                 /* Connect it to the display. */
                 if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0) {
-                        debug("connect %.100s port %d: %.100s", buf,
+                        debug2("connect %.100s port %d: %.100s", buf,
                             6000 + display_number, strerror(errno));
                         close(sock);
                         continue;
@@ -2607,11 +2720,11 @@ x11_input_open(int type, u_int32_t seq, void *ctxt)
                 c->remote_id = remote_id;
                 c->force_drain = 1;
         }
+        xfree(remote_host);
         if (c == NULL) {
                 /* Send refusal to the remote host. */
                 packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
                 packet_put_int(remote_id);
-                xfree(remote_host);
         } else {
                 /* Send a confirmation to the remote host. */
                 packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
@@ -2733,7 +2846,6 @@ auth_input_open_request(int type, u_int32_t seq, void *ctxt)
 {
         Channel *c = NULL;
         int remote_id, sock;
-        char *name;
 
         /* Read the remote channel number from the message. */
         remote_id = packet_get_int();
@@ -2752,9 +2864,8 @@ auth_input_open_request(int type, u_int32_t seq, void *ctxt)
          * agent.
          */
         if (sock >= 0) {
-                name = xstrdup("authentication agent connection");
                 c = channel_new("", SSH_CHANNEL_OPEN, sock, sock,
-                    -1, 0, 0, 0, name, 1);
+                    -1, 0, 0, 0, "authentication agent connection", 1);
                 c->remote_id = remote_id;
                 c->force_drain = 1;
         }