struct rdpkt1_state_tag rdpkt1_state;
    struct rdpkt2_state_tag rdpkt2_state;

    void (*protocol) (Ssh ssh, unsigned char *in, int inlen, int ispkt);
    int (*s_rdpkt) (Ssh ssh, unsigned char **data, int *datalen);
};

#define logevent(s) { logevent(ssh->frontend, s); \
                      if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) \
                      { fprintf(stderr, "%s\n", s); fflush(stderr); } }
#define logevent(s) do { \
    logevent(ssh->frontend, s); \
    if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) { \
	fprintf(stderr, "%s\n", s); \
	fflush(stderr); \
    } \
} while (0)

/* logevent, only printf-formatted. */
void logeventf(Ssh ssh, char *fmt, ...)
{
    va_list ap;
    char stuff[200];
    char *buf;

    va_start(ap, fmt);
    vsprintf(stuff, fmt, ap);
    buf = dupvprintf(fmt, ap);
    va_end(ap);
    logevent(stuff);
    logevent(buf);
    if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) {
	fprintf(stderr, "%s\n", buf);
	fflush(stderr);
    }
    sfree(buf);
}

#define bombout(msg) ( ssh->state = SSH_STATE_CLOSED, \
                          (ssh->s ? sk_close(ssh->s), ssh->s = NULL : 0), \
                          logeventf msg, connection_fatal msg )

static int ssh_channelcmp(void *av, void *bv)

    switch (ssh->pktin.type) {
        /*
         * These packets we must handle instantly.
         */
      case SSH2_MSG_DISCONNECT:
        {
            /* log reason code in disconnect message */
            char buf[256];
            char *buf;
	    int nowlen;
            int reason = GET_32BIT(ssh->pktin.data + 6);
            unsigned msglen = GET_32BIT(ssh->pktin.data + 10);
            unsigned nowlen;

            if (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) {
                sprintf(buf, "Received disconnect message (%s)",
                        ssh2_disconnect_reasons[reason]);
                buf = dupprintf("Received disconnect message (%s)",
				ssh2_disconnect_reasons[reason]);
            } else {
                sprintf(buf, "Received disconnect message (unknown type %d)",
                        reason);
                buf = dupprintf("Received disconnect message (unknown"
				" type %d)", reason);
            }
            logevent(buf);
	    sfree(buf);
            strcpy(buf, "Disconnection message text: ");
            buf = dupprintf("Disconnection message text: %n%.*s",
            nowlen = strlen(buf);
            if (msglen > sizeof(buf) - nowlen - 1)
                msglen = sizeof(buf) - nowlen - 1;
            memcpy(buf + nowlen, ssh->pktin.data + 14, msglen);
			    msglen, &nowlen, ssh->pktin.data + 14);
            buf[nowlen + msglen] = '\0';
            logevent(buf);
            bombout((ssh,"Server sent disconnect message\ntype %d (%s):\n\"%s\"",
                     reason,
                     (reason > 0 && reason < lenof(ssh2_disconnect_reasons)) ?
                     ssh2_disconnect_reasons[reason] : "unknown",
                     buf+nowlen));
	    sfree(buf);
            crReturn(0);
        }
        break;
      case SSH2_MSG_IGNORE:
	goto next_packet;
      case SSH2_MSG_DEBUG:
	{

	return 0;		       /* arrgh, no way to decline (FIXME?) */
    value = ssh->pktin.data[ssh->pktin.savedpos] != 0;
    ssh->pktin.savedpos++;
    return value;
}
static void ssh2_pkt_getstring(Ssh ssh, char **p, int *length)
{
    int len;
    *p = NULL;
    *length = 0;
    if (ssh->pktin.length - ssh->pktin.savedpos < 4)
	return;
    *length = GET_32BIT(ssh->pktin.data + ssh->pktin.savedpos);
    len = GET_32BIT(ssh->pktin.data + ssh->pktin.savedpos);
    if (len < 0)
	return;
    *length = len;
    ssh->pktin.savedpos += 4;
    if (ssh->pktin.length - ssh->pktin.savedpos < *length)
	return;
    *p = ssh->pktin.data + ssh->pktin.savedpos;
    ssh->pktin.savedpos += *length;
}
static Bignum ssh2_pkt_getmp(Ssh ssh)

    if (port < 0)
	port = 22;		       /* default ssh port */
    ssh->savedport = port;

    /*
     * Try to find host.
     */
    {
	char buf[200];
	sprintf(buf, "Looking up host \"%.170s\"", host);
    logeventf(ssh, "Looking up host \"%s\"", host);
	logevent(buf);
    }
    addr = sk_namelookup(host, realhost);
    if ((err = sk_addr_error(addr)))
	return err;

    /*
     * Open socket.
     */
    {
	char buf[200], addrbuf[100];
	char addrbuf[100];
	sk_getaddr(addr, addrbuf, 100);
	sprintf(buf, "Connecting to %.100s port %d", addrbuf, port);
	logeventf(ssh, "Connecting to %s port %d", addrbuf, port);
	logevent(buf);
    }
    ssh->fn = &fn_table;
    ssh->s = new_connection(addr, *realhost, port, 0, 1, nodelay, (Plug) ssh);
    if ((err = sk_socket_error(ssh->s))) {
	ssh->s = NULL;
	return err;
    }

    sfree(s->rsabuf);

    ssh->cipher = (s->cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
		   s->cipher_type == SSH_CIPHER_DES ? &ssh_des :
		   &ssh_3des);
    ssh->v1_cipher_ctx = ssh->cipher->make_context();
    ssh->cipher->sesskey(ssh->v1_cipher_ctx, ssh->session_key);
    {
	char buf[256];
	sprintf(buf, "Initialised %.200s encryption", ssh->cipher->text_name);
    logeventf(ssh, "Initialised %s encryption", ssh->cipher->text_name);
	logevent(buf);
    }

    ssh->crcda_ctx = crcda_make_context();
    logevent("Installing CRC compensation attack detector");

    crWaitUntil(ispkt);

    if (ssh->pktin.type != SSH1_SMSG_SUCCESS) {

	}
	if (s->pwpkt_type == SSH1_CMSG_AUTH_RSA) {
	    char *comment = NULL;
	    int type;
	    char msgbuf[256];
	    if (flags & FLAG_VERBOSE)
		c_write_str(ssh, "Trying public key authentication.\r\n");
	    sprintf(msgbuf, "Trying public key \"%.200s\"", cfg.keyfile);
	    logeventf(ssh, "Trying public key \"%s\"", cfg.keyfile);
	    logevent(msgbuf);
	    type = key_type(cfg.keyfile);
	    if (type != SSH_KEYTYPE_SSH1) {
		sprintf(msgbuf, "Key is of wrong type (%s)",
			key_type_to_str(type));
		logevent(msgbuf);
		c_write_str(ssh, msgbuf);
		c_write_str(ssh, "\r\n");

    }

    {
	char type;
	int n;
	int sport,dport,sserv,dserv;
	char sports[256], dports[256], host[256];
	char buf[1024];

	ssh->rportfwds = newtree234(ssh_rportcmp_ssh1);
        /* Add port forwardings. */
	ssh->portfwd_strptr = cfg.portfwd;
	while (*ssh->portfwd_strptr) {
	    type = *ssh->portfwd_strptr++;
	    n = 0;

	    ssh->portfwd_strptr++;
	    dport = atoi(dports);
	    dserv = 0;
	    if (dport == 0) {
		dserv = 1;
		dport = net_service_lookup(dports);
		if (!dport) {
		    sprintf(buf,
			    "Service lookup failed for destination port \"%s\"",
			    dports);
		    logeventf(ssh, "Service lookup failed for"
			      " destination port \"%s\"", dports);
		    logevent(buf);
		}
	    }
	    sport = atoi(sports);
	    sserv = 0;
	    if (sport == 0) {
		sserv = 1;
		sport = net_service_lookup(sports);
		if (!sport) {
		    sprintf(buf,
			    "Service lookup failed for source port \"%s\"",
			    sports);
		    logeventf(ssh, "Service lookup failed for source"
			      " port \"%s\"", sports);
		    logevent(buf);
		}
	    }
	    if (sport && dport) {
		if (type == 'L') {
		    pfd_addforward(host, dport, sport, ssh);
		    sprintf(buf, "Local port %.*s%.*s%d%.*s forwarding to"
			    " %s:%.*s%.*s%d%.*s",
			    (int)(sserv ? strlen(sports) : 0), sports,
			    sserv, "(", sport, sserv, ")",
			    host,
			    (int)(dserv ? strlen(dports) : 0), dports,
			    dserv, "(", dport, dserv, ")");
		    logeventf(ssh, "Local port %.*s%.*s%d%.*s forwarding to"
			      " %s:%.*s%.*s%d%.*s",
			      (int)(sserv ? strlen(sports) : 0), sports,
			      sserv, "(", sport, sserv, ")",
			      host,
			      (int)(dserv ? strlen(dports) : 0), dports,
			      dserv, "(", dport, dserv, ")");
		    logevent(buf);
		} else {
		    struct ssh_rportfwd *pf;
		    pf = smalloc(sizeof(*pf));
		    strcpy(pf->dhost, host);
		    pf->dport = dport;
		    if (add234(ssh->rportfwds, pf) != pf) {
			sprintf(buf, 
				"Duplicate remote port forwarding to %s:%d",
				host, dport);
			logeventf(ssh, 
				  "Duplicate remote port forwarding to %s:%d",
				  host, dport);
			logevent(buf);
			sfree(pf);
		    } else {
			sprintf(buf, "Requesting remote port %.*s%.*s%d%.*s"
				" forward to %s:%.*s%.*s%d%.*s",
			    (int)(sserv ? strlen(sports) : 0), sports,
			    sserv, "(", sport, sserv, ")",
			    host,
			    (int)(dserv ? strlen(dports) : 0), dports,
			    dserv, "(", dport, dserv, ")");
			logeventf(ssh, "Requesting remote port %.*s%.*s%d%.*s"
				  " forward to %s:%.*s%.*s%d%.*s",
				  (int)(sserv ? strlen(sports) : 0), sports,
				  sserv, "(", sport, sserv, ")",
				  host,
				  (int)(dserv ? strlen(dports) : 0), dports,
				  dserv, "(", dport, dserv, ")");
			logevent(buf);
			send_packet(ssh, SSH1_CMSG_PORT_FORWARD_REQUEST,
				    PKT_INT, sport,
				    PKT_STR, host,
				    PKT_INT, dport,
				    PKT_END);
			do {
			    crReturnV;

}

/*
 * Utility routine for decoding comma-separated strings in KEXINIT.
 */
static int in_commasep_string(char *needle, char *haystack, int haylen)
{
    int needlen;
    if (!needle || !haystack)	       /* protect against null pointers */
	return 0;
    int needlen = strlen(needle);
    needlen = strlen(needle);
    while (1) {
	/*
	 * Is it at the start of the string?
	 */
	if (haylen >= needlen &&       /* haystack is long enough */
	    !memcmp(needle, haystack, needlen) &&	/* initial match */
	    (haylen == needlen || haystack[needlen] == ',')

    ssh->exhash = ssh->exhashbase;
    sha_string(&ssh->exhash, ssh->pktout.data + 5, ssh->pktout.length - 5);

    ssh2_pkt_send(ssh);

    if (!ispkt)
	crWaitUntil(ispkt);
    if (ssh->pktin.length > 5)
    sha_string(&ssh->exhash, ssh->pktin.data + 5, ssh->pktin.length - 5);
	sha_string(&ssh->exhash, ssh->pktin.data + 5, ssh->pktin.length - 5);

    /*
     * Now examine the other side's KEXINIT to see what we're up
     * to.
     */
    {
	char *str;

	    if (s->cscipher_tobe) {
		if (s->warn)
		    askcipher(ssh->frontend, s->cscipher_tobe->name, 1);
		break;
	    }
	}
	if (!s->cscipher_tobe) {
	    bombout((ssh,"Couldn't agree a client-to-server cipher (available: %s)", str));
	    bombout((ssh,"Couldn't agree a client-to-server cipher (available: %s)",
		     str ? str : "(null)"));
	    crReturn(0);
	}

	ssh2_pkt_getstring(ssh, &str, &len);    /* server->client cipher */
	s->warn = 0;
	for (i = 0; i < s->n_preferred_ciphers; i++) {
	    const struct ssh2_ciphers *c = s->preferred_ciphers[i];

	    if (s->sccipher_tobe) {
		if (s->warn)
		    askcipher(ssh->frontend, s->sccipher_tobe->name, 2);
		break;
	    }
	}
	if (!s->sccipher_tobe) {
	    bombout((ssh,"Couldn't agree a server-to-client cipher (available: %s)", str));
	    bombout((ssh,"Couldn't agree a server-to-client cipher (available: %s)",
		     str ? str : "(null)"));
	    crReturn(0);
	}

	ssh2_pkt_getstring(ssh, &str, &len);    /* client->server mac */
	for (i = 0; i < s->nmacs; i++) {
	    if (in_commasep_string(s->maclist[i]->name, str, len)) {
		s->csmac_tobe = s->maclist[i];

	ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'B',keyspace);
	ssh->sccipher->setiv(ssh->sc_cipher_ctx, keyspace);
	ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'E',keyspace);
	ssh->csmac->setkey(ssh->cs_mac_ctx, keyspace);
	ssh2_mkkey(ssh,s->K,s->exchange_hash,ssh->v2_session_id,'F',keyspace);
	ssh->scmac->setkey(ssh->sc_mac_ctx, keyspace);
    }
    {
	char buf[256];
	sprintf(buf, "Initialised %.200s client->server encryption",
		ssh->cscipher->text_name);
    logeventf(ssh, "Initialised %.200s client->server encryption",
	      ssh->cscipher->text_name);
	logevent(buf);
	sprintf(buf, "Initialised %.200s server->client encryption",
		ssh->sccipher->text_name);
    logeventf(ssh, "Initialised %.200s server->client encryption",
	      ssh->sccipher->text_name);
	logevent(buf);
	if (ssh->cscomp->text_name) {
	    sprintf(buf, "Initialised %.200s compression",
		    ssh->cscomp->text_name);
    if (ssh->cscomp->text_name)
	logeventf(ssh, "Initialised %s compression",
		  ssh->cscomp->text_name);
	    logevent(buf);
	}
	if (ssh->sccomp->text_name) {
	    sprintf(buf, "Initialised %.200s decompression",
		    ssh->sccomp->text_name);
    if (ssh->sccomp->text_name)
	logeventf(ssh, "Initialised %s decompression",
		  ssh->sccomp->text_name);
	    logevent(buf);
	}
    }


    /*
     * If this is the first key exchange phase, we must pass the
     * SSH2_MSG_NEWKEYS packet to the next layer, not because it
     * wants to see it but because it will need time to initialise
     * itself before it sees an actual packet. In subsequent key
     * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because

		} while (ret == 0);
		if (ret < 0)
		    cleanup_exit(0);
		c_write_str(ssh, "\r\n");
	    }
	    s->username[strcspn(s->username, "\n\r")] = '\0';
	} else {
	    char stuff[200];
	    char *stuff;
	    strncpy(s->username, cfg.username, sizeof(s->username));
	    s->username[sizeof(s->username)-1] = '\0';
	    if ((flags & FLAG_VERBOSE) || (flags & FLAG_INTERACTIVE)) {
		sprintf(stuff, "Using username \"%s\".\r\n", s->username);
		stuff = dupprintf("Using username \"%s\".\r\n", s->username);
		c_write_str(ssh, stuff);
		sfree(stuff);
	    }
	}
	s->got_username = TRUE;

	/*
	 * Send an authentication request using method "none": (a)
	 * just in case it succeeds, and (b) so that we know what

		      "Reading private key file \"%.150s\"", cfg.keyfile);
	    keytype = key_type(cfg.keyfile);
	    if (keytype == SSH_KEYTYPE_SSH2) {
		s->publickey_blob =
		    ssh2_userkey_loadpub(cfg.keyfile, NULL,
					 &s->publickey_bloblen);
	    } else {
		char msgbuf[256];
		char *msgbuf;
		logeventf(ssh->frontend,
			  "Unable to use this key file (%s)",
			  key_type_to_str(keytype));
		sprintf(msgbuf, "Unable to use key file \"%.150s\" (%s)\r\n",
			cfg.keyfile, key_type_to_str(keytype));
		msgbuf = dupprintf("Unable to use key file \"%.150s\""
				   " (%s)\r\n", cfg.keyfile,
				   key_type_to_str(keytype));
		c_write_str(ssh, msgbuf);
		sfree(msgbuf);
		s->publickey_blob = NULL;
	    }
	} else
	    s->publickey_blob = NULL;

	while (1) {
	    /*

     * Enable port forwardings.
     */
    {
	char type;
	int n;
	int sport,dport,sserv,dserv;
	char sports[256], dports[256], host[256];
	char buf[1024];

	ssh->rportfwds = newtree234(ssh_rportcmp_ssh2);
        /* Add port forwardings. */
	ssh->portfwd_strptr = cfg.portfwd;
	while (*ssh->portfwd_strptr) {
	    type = *ssh->portfwd_strptr++;
	    n = 0;

	    ssh->portfwd_strptr++;
	    dport = atoi(dports);
	    dserv = 0;
	    if (dport == 0) {
		dserv = 1;
		dport = net_service_lookup(dports);
		if (!dport) {
		    sprintf(buf,
			    "Service lookup failed for destination port \"%s\"",
			    dports);
		    logeventf(ssh, "Service lookup failed for destination"
			      " port \"%s\"", dports);
		    logevent(buf);
		}
	    }
	    sport = atoi(sports);
	    sserv = 0;
	    if (sport == 0) {
		sserv = 1;
		sport = net_service_lookup(sports);
		if (!sport) {
		    sprintf(buf,
			    "Service lookup failed for source port \"%s\"",
			    sports);
		    logeventf(ssh, "Service lookup failed for source"
			      " port \"%s\"", sports);
		    logevent(buf);
		}
	    }
	    if (sport && dport) {
		if (type == 'L') {
		    pfd_addforward(host, dport, sport, ssh);
		    sprintf(buf, "Local port %.*s%.*s%d%.*s forwarding to"
			    " %s:%.*s%.*s%d%.*s",
			    (int)(sserv ? strlen(sports) : 0), sports,
			    sserv, "(", sport, sserv, ")",
			    host,
			    (int)(dserv ? strlen(dports) : 0), dports,
			    dserv, "(", dport, dserv, ")");
		    logeventf(ssh, "Local port %.*s%.*s%d%.*s forwarding to"
			      " %s:%.*s%.*s%d%.*s",
			      (int)(sserv ? strlen(sports) : 0), sports,
			      sserv, "(", sport, sserv, ")",
			      host,
			      (int)(dserv ? strlen(dports) : 0), dports,
			      dserv, "(", dport, dserv, ")");
		    logevent(buf);
		} else {
		    struct ssh_rportfwd *pf;
		    pf = smalloc(sizeof(*pf));
		    strcpy(pf->dhost, host);
		    pf->dport = dport;
		    pf->sport = sport;
		    if (add234(ssh->rportfwds, pf) != pf) {
			sprintf(buf, 
				"Duplicate remote port forwarding to %s:%d",
				host, dport);
			logeventf(ssh, "Duplicate remote port forwarding"
				  " to %s:%d", host, dport);
			logevent(buf);
			sfree(pf);
		    } else {
			sprintf(buf, "Requesting remote port %.*s%.*s%d%.*s"
				" forward to %s:%.*s%.*s%d%.*s",
			    (int)(sserv ? strlen(sports) : 0), sports,
			    sserv, "(", sport, sserv, ")",
			    host,
			    (int)(dserv ? strlen(dports) : 0), dports,
			    dserv, "(", dport, dserv, ")");
			logeventf(ssh, "Requesting remote port %.*s%.*s%d%.*s"
				  " forward to %s:%.*s%.*s%d%.*s",
				  (int)(sserv ? strlen(sports) : 0), sports,
				  sserv, "(", sport, sserv, ")",
				  host,
				  (int)(dserv ? strlen(dports) : 0), dports,
				  dserv, "(", dport, dserv, ")");
			logevent(buf);
			ssh2_pkt_init(ssh, SSH2_MSG_GLOBAL_REQUEST);
			ssh2_pkt_addstring(ssh, "tcpip-forward");
			ssh2_pkt_addbool(ssh, 1);/* want reply */
			if (cfg.rport_acceptall)
			    ssh2_pkt_addstring(ssh, "0.0.0.0");
			else
			    ssh2_pkt_addstring(ssh, "127.0.0.1");

		    pf.sport = ssh2_pkt_getuint32(ssh);
		    realpf = find234(ssh->rportfwds, &pf, NULL);
		    if (realpf == NULL) {
			error = "Remote port is not recognised";
		    } else {
			char *e = pfd_newconnect(&c->u.pfd.s, realpf->dhost,
						 realpf->dport, c);
			char buf[1024];
			sprintf(buf, "Received remote port open request for %s:%d",
				realpf->dhost, realpf->dport);
			logeventf(ssh, "Received remote port open request"
				  " for %s:%d", realpf->dhost, realpf->dport);
			logevent(buf);
			if (e != NULL) {
			    sprintf(buf, "Port open failed: %s", e);
			    logeventf(ssh, "Port open failed: %s", e);
			    logevent(buf);
			    error = "Port open failed";
			} else {
			    logevent("Forwarded port opened successfully");
			    c->type = CHAN_SOCKDATA;
			}
		    }
		} else if (typelen == 22 &&

    }
}

void ssh_send_port_open(void *channel, char *hostname, int port, char *org)
{
    struct ssh_channel *c = (struct ssh_channel *)channel;
    Ssh ssh = c->ssh;
    char buf[1024];

    sprintf(buf, "Opening forwarded connection to %.512s:%d", hostname, port);
    logeventf(ssh, "Opening forwarded connection to %s:%d", hostname, port);
    logevent(buf);

    if (ssh->version == 1) {
	send_packet(ssh, SSH1_MSG_PORT_OPEN,
		    PKT_INT, c->localid,
		    PKT_STR, hostname,
		    PKT_INT, port,
		    //PKT_STR, <org:orgport>,