#define TRUE 1
#endif

#define logevent(s) { logevent(s); \
                      if ((flags & FLAG_STDERR) && (flags & FLAG_VERBOSE)) \
                      fprintf(stderr, "%s\n", s); }

#define bombout(msg) ( ssh_state == SSH_STATE_CLOSED, closesocket(s), \
                       s = INVALID_SOCKET, connection_fatal msg )

#define SSH1_MSG_DISCONNECT                       1    /* 0x1 */
#define SSH1_SMSG_PUBLIC_KEY                      2    /* 0x2 */
#define SSH1_CMSG_SESSION_KEY                     3    /* 0x3 */
#define SSH1_CMSG_USER                            4    /* 0x4 */
#define SSH1_CMSG_AUTH_RSA                        6    /* 0x6 */
#define SSH1_SMSG_AUTH_RSA_CHALLENGE              7    /* 0x7 */
#define SSH1_CMSG_AUTH_RSA_RESPONSE               8    /* 0x8 */

static int size_needed = FALSE;

static void s_write (char *buf, int len) {
    while (len > 0) {
	int i = send (s, buf, len, 0);
        noise_ultralight(i);
        if (i <= 0) {
            bombout(("Lost connection while sending"));
            return;
        }
	if (i > 0)
	    len -= i, buf += i;
    }
}

static int s_read (char *buf, int len) {
    int ret = 0;

    pktin.type = pktin.data[pad];
    pktin.body = pktin.data + pad + 1;

    realcrc = crc32(pktin.data, biglen-4);
    gotcrc = GET_32BIT(pktin.data+biglen-4);
    if (gotcrc != realcrc) {
	bombout(("Incorrect CRC received on packet"));
        crReturn(0);
    }

    if (pktin.type == SSH1_SMSG_STDOUT_DATA ||
        pktin.type == SSH1_SMSG_STDERR_DATA ||
        pktin.type == SSH1_MSG_DEBUG ||
        pktin.type == SSH1_SMSG_AUTH_TIS_CHALLENGE ||
        pktin.type == SSH1_SMSG_AUTH_CCARD_CHALLENGE) {
	long strlen = GET_32BIT(pktin.body);
	if (strlen + 4 != pktin.length) {
	    bombout(("Received data packet with bogus string length"));
            crReturn(0);
        }
    }

    if (pktin.type == SSH1_MSG_DEBUG) {
	/* log debug message */
	char buf[80];
	int strlen = GET_32BIT(pktin.body);
	strcpy(buf, "Remote: ");

        debug(("  %02x", (unsigned char)pktin.data[i]));
    debug(("\r\n"));
#endif

    /*
     * Check the MAC.
     */
    if (scmac && !scmac->verify(pktin.data, len+4, incoming_sequence)) {
	bombout(("Incorrect MAC received on packet"));
        crReturn(0);
    }
    incoming_sequence++;               /* whether or not we MACed */

    pktin.savedpos = 6;
    pktin.type = pktin.data[5];

    if (pktin.type == SSH2_MSG_IGNORE || pktin.type == SSH2_MSG_DEBUG)
        goto next_packet;              /* FIXME: print DEBUG message */

    char *p;
    int i, j, length;
    Bignum b;

    ssh2_pkt_getstring(&p, &length);
    if (!p)
        return NULL;
    if (p[0] & 0x80) {
        bombout(("internal error: Can't handle negative mpints"));
        return NULL;
    }
    b = newbn((length+1)/2);
    for (i = 0; i < length; i++) {
        j = length - 1 - i;
        if (j & 1)
            b[j/2+1] |= ((unsigned char)p[i]) << 8;
        else
            b[j/2+1] |= ((unsigned char)p[i]);

    static unsigned char session_id[16];
    int cipher_type;

    crBegin;

    if (!ispkt) crWaitUntil(ispkt);

    if (pktin.type != SSH1_SMSG_PUBLIC_KEY) {
	bombout(("Public key packet not received"));
        crReturn(0);
    }

    logevent("Received public keys");

    memcpy(cookie, pktin.body, 8);

    i = makekey(pktin.body+8, &servkey, &keystr1, 0);
    j = makekey(pktin.body+8+i, &hostkey, &keystr2, 0);

    cipher = cipher_type == SSH_CIPHER_BLOWFISH ? &ssh_blowfish_ssh1 :
             cipher_type == SSH_CIPHER_DES ? &ssh_des :
             &ssh_3des;
    cipher->sesskey(session_key);

    crWaitUntil(ispkt);

    if (pktin.type != SSH1_SMSG_SUCCESS) {
	bombout(("Encryption not successfully enabled"));
        crReturn(0);
    }

    logevent("Successfully started encryption");

    fflush(stdout);
    {
	static char username[100];
	static int pos = 0;

            crWaitUntil(ispkt);
            if (pktin.type == SSH1_SMSG_FAILURE) {
                if (flags & FLAG_VERBOSE)
                    c_write("Server refused our public key.\r\n", 32);
                continue;              /* go and try password */
            }
            if (pktin.type != SSH1_SMSG_AUTH_RSA_CHALLENGE) {
                bombout(("Bizarre response to offer of public key"));
                crReturn(0);
            }
            ssh1_read_bignum(pktin.body, &challenge);
            response = rsadecrypt(challenge, &pubkey);
            freebn(pubkey.private_exponent);   /* burn the evidence */

            for (i = 0; i < 32; i += 2) {
                buffer[i] = response[16-i/2] >> 8;
                buffer[i+1] = response[16-i/2] & 0xFF;

            crWaitUntil(ispkt);
            if (pktin.type == SSH1_SMSG_FAILURE) {
                if (flags & FLAG_VERBOSE)
                    c_write("Failed to authenticate with our public key.\r\n",
                            45);
                continue;              /* go and try password */
            } else if (pktin.type != SSH1_SMSG_SUCCESS) {
                bombout(("Bizarre response to RSA authentication response"));
                crReturn(0);
            }

            break;                     /* we're through! */
        } else {
            send_packet(pwpkt_type, PKT_STR, password, PKT_END);
        }
	logevent("Sent password");
	memset(password, 0, strlen(password));
	crWaitUntil(ispkt);
	if (pktin.type == SSH1_SMSG_FAILURE) {
            if (flags & FLAG_VERBOSE)
                c_write("Access denied\r\n", 15);
	    logevent("Authentication refused");
	} else if (pktin.type == SSH1_MSG_DISCONNECT) {
	    logevent("Received disconnect request");
            ssh_state = SSH_STATE_CLOSED;
	    crReturn(1);
	} else if (pktin.type != SSH1_SMSG_SUCCESS) {
	    bombout(("Strange packet received, type %d", pktin.type));
            crReturn(0);
	}
    }

    logevent("Authentication successful");

    crFinish(1);
}

        crReturnV;

    if (cfg.agentfwd && agent_exists()) {
        logevent("Requesting agent forwarding");
        send_packet(SSH1_CMSG_AGENT_REQUEST_FORWARDING, PKT_END);
        do { crReturnV; } while (!ispkt);
        if (pktin.type != SSH1_SMSG_SUCCESS && pktin.type != SSH1_SMSG_FAILURE) {
            bombout(("Protocol confusion"));
            crReturnV;
        } else if (pktin.type == SSH1_SMSG_FAILURE) {
            logevent("Agent forwarding refused");
        } else
            logevent("Agent forwarding enabled");
    }

    if (!cfg.nopty) {
	send_packet(SSH1_CMSG_REQUEST_PTY,
	            PKT_STR, cfg.termtype,
	            PKT_INT, rows, PKT_INT, cols,
	            PKT_INT, 0, PKT_INT, 0,
	            PKT_CHAR, 0,
	            PKT_END);
        ssh_state = SSH_STATE_INTERMED;
        do { crReturnV; } while (!ispkt);
        if (pktin.type != SSH1_SMSG_SUCCESS && pktin.type != SSH1_SMSG_FAILURE) {
            bombout(("Protocol confusion"));
            crReturnV;
        } else if (pktin.type == SSH1_SMSG_FAILURE) {
            c_write("Server refused to allocate pty\r\n", 32);
        }
	logevent("Allocated pty");
    }

    if (*cfg.remote_cmd)

		/* may be from EXEC_SHELL on some servers */
	    } else if (pktin.type == SSH1_SMSG_FAILURE) {
		/* may be from EXEC_SHELL on some servers
		 * if no pty is available or in other odd cases. Ignore */
	    } else if (pktin.type == SSH1_SMSG_EXIT_STATUS) {
		send_packet(SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
	    } else {
		bombout(("Strange packet received: type %d", pktin.type));
                crReturnV;
	    }
	} else {
	    send_packet(SSH1_CMSG_STDIN_DATA,
	                PKT_INT, inlen, PKT_DATA, in, inlen, PKT_END);
	}
    }

    sha_string(&exhash, pktin.data+5, pktin.length-5);

    /*
     * Now examine the other side's KEXINIT to see what we're up
     * to.
     */
    if (pktin.type != SSH2_MSG_KEXINIT) {
        bombout(("expected key exchange packet from server"));
        crReturn(0);
    }
    kex = NULL; hostkey = NULL; cscipher_tobe = NULL; sccipher_tobe = NULL;
    csmac_tobe = NULL; scmac_tobe = NULL; cscomp_tobe = NULL; sccomp_tobe = NULL;
    pktin.savedpos += 16;              /* skip garbage cookie */
    ssh2_pkt_getstring(&str, &len);    /* key exchange algorithms */
    for (i = 0; i < lenof(kex_algs); i++) {
        if (in_commasep_string(kex_algs[i]->name, str, len)) {

        }
    }

    /*
     * Currently we only support Diffie-Hellman and DSS, so let's
     * bomb out if those aren't selected.
     */
    if (kex != &ssh_diffiehellman || hostkey != &ssh_dss) {
        bombout(("internal fault: chaos in SSH 2 transport layer"));
        crReturn(0);
    }

    /*
     * Now we begin the fun. Generate and send e for Diffie-Hellman.
     */
    e = dh_create_e();
    ssh2_pkt_init(SSH2_MSG_KEXDH_INIT);
    ssh2_pkt_addmp(e);
    ssh2_pkt_send();

    crWaitUntil(ispkt);
    if (pktin.type != SSH2_MSG_KEXDH_REPLY) {
        bombout(("expected key exchange packet from server"));
        crReturn(0);
    }
    ssh2_pkt_getstring(&hostkeydata, &hostkeylen);
    f = ssh2_pkt_getmp();
    ssh2_pkt_getstring(&sigdata, &siglen);

    K = dh_find_K(f);

    debug(("Exchange hash is:\r\n"));
    for (i = 0; i < 20; i++)
        debug((" %02x", exchange_hash[i]));
    debug(("\r\n"));
#endif

    hostkey->setkey(hostkeydata, hostkeylen);
    if (!hostkey->verifysig(sigdata, siglen, exchange_hash, 20)) {
        bombout(("Server failed host key check"));
        crReturn(0);
    }

    /*
     * Expect SSH2_MSG_NEWKEYS from server.
     */
    crWaitUntil(ispkt);
    if (pktin.type != SSH2_MSG_NEWKEYS) {
        bombout(("expected new-keys packet from server"));
        crReturn(0);
    }

    /*
     * Authenticate remote host: verify host key. (We've already
     * checked the signature of the exchange hash.)
     */
    keystr = hostkey->fmtkey();
    verify_ssh_host_key(savedhost, keystr);

    /*
     * Request userauth protocol, and await a response to it.
     */
    ssh2_pkt_init(SSH2_MSG_SERVICE_REQUEST);
    ssh2_pkt_addstring("ssh-userauth");
    ssh2_pkt_send();
    crWaitUntilV(ispkt);
    if (pktin.type != SSH2_MSG_SERVICE_ACCEPT) {
        bombout(("Server refused user authentication protocol"));
        crReturnV;
    }

    /*
     * FIXME: currently we support only password authentication.
     * (This places us technically in violation of the SSH2 spec.
     * We must fix this.)
     */
    while (1) {

    ssh2_pkt_addstring("session");
    ssh2_pkt_adduint32(mainchan->localid);
    ssh2_pkt_adduint32(0x7FFFFFFFUL);  /* our window size */
    ssh2_pkt_adduint32(0x4000UL);  /* our max pkt size */
    ssh2_pkt_send();
    crWaitUntilV(ispkt);
    if (pktin.type != SSH2_MSG_CHANNEL_OPEN_CONFIRMATION) {
        bombout(("Server refused to open a session"));
        crReturnV;
        /* FIXME: error data comes back in FAILURE packet */
    }
    if (ssh2_pkt_getuint32() != mainchan->localid) {
        bombout(("Server's channel confirmation cited wrong channel"));
        crReturnV;
    }
    mainchan->remoteid = ssh2_pkt_getuint32();
    mainchan->u.v2.remwindow = ssh2_pkt_getuint32();
    mainchan->u.v2.remmaxpkt = ssh2_pkt_getuint32();
    mainchan->u.v2.outbuffer = NULL;
    mainchan->u.v2.outbuflen = mainchan->u.v2.outbufsize = 0;
    logevent("Opened channel for session");

                    continue;          /* wrong channel */
                mainchan->u.v2.remwindow += ssh2_pkt_getuint32();
            }
        } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);

        if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
            if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
                bombout(("Server got confused by pty request"));
                crReturnV;
            }
            c_write("Server refused to allocate pty\r\n", 32);
        } else {
            logevent("Allocated pty");
        }
    }

            if (ssh2_pkt_getuint32() != mainchan->localid)
                continue;          /* wrong channel */
            mainchan->u.v2.remwindow += ssh2_pkt_getuint32();
        }
    } while (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST);
    if (pktin.type != SSH2_MSG_CHANNEL_SUCCESS) {
        if (pktin.type != SSH2_MSG_CHANNEL_FAILURE) {
            bombout(("Server got confused by shell/command request"));
            crReturnV;
        }
        bombout(("Server refused to start a shell/command"));
        crReturnV;
    } else {
        logevent("Started a shell/command");
    }

    /*
     * Transfer data!
     */
    ssh_send_ok = 1;
    while (1) {

	    } else if (pktin.type == SSH2_MSG_CHANNEL_WINDOW_ADJUST) {
                /* FIXME: be able to handle other channels here */
                if (ssh2_pkt_getuint32() != mainchan->localid)
                    continue;          /* wrong channel */
                mainchan->u.v2.remwindow += ssh2_pkt_getuint32();
                try_send = TRUE;
	    } else {
		bombout(("Strange packet received: type %d", pktin.type));
                crReturnV;
	    }
	} else {
            /*
             * We have spare data. Add it to the channel buffer.
             */
            if (mainchan->u.v2.outbufsize <
                mainchan->u.v2.outbuflen + inlen) {

     * possibility that FD_READ may arrive with FD_CLOSE already in
     * the queue; so it's possible that we can get here even with s
     * invalid. If so, we return 1 and don't worry about it.
     */
    if (s == INVALID_SOCKET)
	return 1;

    if (WSAGETSELECTERROR(lParam) != 0) {
        closesocket(s);
        s = INVALID_SOCKET;
	return -WSAGETSELECTERROR(lParam);
    }

    switch (WSAGETSELECTEVENT(lParam)) {
      case FD_READ:
      case FD_CLOSE:
	ret = recv(s, buf, sizeof(buf), 0);
	if (ret < 0 && WSAGetLastError() == WSAEWOULDBLOCK)
	    return 1;
	if (ret < 0) {		       /* any _other_ error */
            closesocket(s);
            s = INVALID_SOCKET;
	    return -10000-WSAGetLastError();
        }
	if (ret == 0) {
	    s = INVALID_SOCKET;
	    return 0;
	}
	ssh_gotdata (buf, ret);
        if (ssh_state == SSH_STATE_CLOSED) {
            closesocket(s);

	    sprintf(logbuf, "Remote exit status: %d", GET_32BIT(pktin.body));
	    logevent(logbuf);
	    send_packet(SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
	    logevent("Closing connection");
	    closesocket(s);
	    s = INVALID_SOCKET;
	} else {
	    bombout(("Strange packet received: type %d", pktin.type));
            return 0;
	}
    }

    return len;
}

/*