- andreas@cvs.openbsd.org 2009/05/27 06:31:25

     [canohost.h canohost.c]
     Add clear_cached_addr(), needed for upcoming changes allowing the peer
     address to change.
     ok markus@

8 files changed, 528 insertions, 411 deletions

diff --git a/ChangeLog b/ChangeLog
index f2e6e8cc..bd1367e7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -51,6 +51,17 @@
      [sshd_config.5]
      clarify we cd to user's home after chroot; ok markus@ on
      earlier version; tweaks and ok jmc@
+   - andreas@cvs.openbsd.org 2009/05/25 06:48:01
+     [channels.c packet.c clientloop.c packet.h serverloop.c monitor_wrap.c
+     monitor.c]
+     Put the globals in packet.c into a struct and don't access it directly
+     from other files. No functional changes.
+     ok markus@ djm@
+   - andreas@cvs.openbsd.org 2009/05/27 06:31:25
+     [canohost.h canohost.c]
+     Add clear_cached_addr(), needed for upcoming changes allowing the peer
+     address to change.
+     ok markus@
 
 20090616
  - (dtucker) [configure.ac defines.h] Bug #1607: handle the case where fsid_t
diff --git a/channels.c b/channels.c
index dea60ba2..efb04d65 100644
--- a/channels.c
+++ b/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.295 2009/02/12 03:00:56 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.296 2009/05/25 06:48:00 andreas Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2431,7 +2431,7 @@ channel_input_status_confirm(int type, u_int32_t seq, void *ctxt)
 	int id;
 
 	/* Reset keepalive timeout */
-	keep_alive_timeouts = 0;
+	packet_set_alive_timeouts(0);
 
 	id = packet_get_int();
 	packet_check_eom();
diff --git a/clientloop.c b/clientloop.c
index a2d2d1d0..2cb8c3a4 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.209 2009/02/12 03:00:56 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.210 2009/05/25 06:48:01 andreas Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -491,13 +491,13 @@ client_global_request_reply(int type, u_int32_t seq, void *ctxt)
 		xfree(gc);
 	}
 
-	keep_alive_timeouts = 0;
+	packet_set_alive_timeouts(0);
 }
 
 static void
 server_alive_check(void)
 {
-	if (++keep_alive_timeouts > options.server_alive_count_max) {
+	if (packet_inc_alive_timeouts() > options.server_alive_count_max) {
 		logit("Timeout, server not responding.");
 		cleanup_exit(255);
 	}
diff --git a/monitor.c b/monitor.c
index f57e74ba..61242e6d 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.101 2009/02/12 03:26:22 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.102 2009/05/25 06:48:01 andreas Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -100,7 +100,6 @@ extern Newkeys *current_keys[];
 extern z_stream incoming_stream;
 extern z_stream outgoing_stream;
 extern u_char session_id[];
-extern Buffer input, output;
 extern Buffer auth_debug;
 extern int auth_debug_init;
 extern Buffer loginmsg;
@@ -1670,13 +1669,14 @@ monitor_apply_keystate(struct monitor *pmonitor)
 
 	/* Network I/O buffers */
 	/* XXX inefficient for large buffers, need: buffer_init_from_string */
-	buffer_clear(&input);
-	buffer_append(&input, child_state.input, child_state.ilen);
+	buffer_clear(packet_get_input());
+	buffer_append(packet_get_input(), child_state.input, child_state.ilen);
 	memset(child_state.input, 0, child_state.ilen);
 	xfree(child_state.input);
 
-	buffer_clear(&output);
-	buffer_append(&output, child_state.output, child_state.olen);
+	buffer_clear(packet_get_output());
+	buffer_append(packet_get_output(), child_state.output,
+		      child_state.olen);
 	memset(child_state.output, 0, child_state.olen);
 	xfree(child_state.output);
 }
diff --git a/monitor_wrap.c b/monitor_wrap.c
index db3251b9..d71d4a8c 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.65 2009/03/05 07:18:19 djm Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.66 2009/05/25 06:48:01 andreas Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -80,11 +80,9 @@
 
 /* Imports */
 extern int compat20;
-extern Newkeys *newkeys[];
 extern z_stream incoming_stream;
 extern z_stream outgoing_stream;
 extern struct monitor *pmonitor;
-extern Buffer input, output;
 extern Buffer loginmsg;
 extern ServerOptions options;
 
@@ -509,7 +507,7 @@ mm_newkeys_to_blob(int mode, u_char **blobp, u_int *lenp)
 	Enc *enc;
 	Mac *mac;
 	Comp *comp;
-	Newkeys *newkey = newkeys[mode];
+	Newkeys *newkey = (Newkeys *)packet_get_newkeys(mode);
 
 	debug3("%s: converting %p", __func__, newkey);
 
@@ -571,7 +569,7 @@ mm_send_kex(Buffer *m, Kex *kex)
 void
 mm_send_keystate(struct monitor *monitor)
 {
-	Buffer m;
+	Buffer m, *input, *output;
 	u_char *blob, *p;
 	u_int bloblen, plen;
 	u_int32_t seqnr, packets;
@@ -609,7 +607,8 @@ mm_send_keystate(struct monitor *monitor)
 	}
 
 	debug3("%s: Sending new keys: %p %p",
-	    __func__, newkeys[MODE_OUT], newkeys[MODE_IN]);
+	    __func__, packet_get_newkeys(MODE_OUT),
+	    packet_get_newkeys(MODE_IN));
 
 	/* Keys from Kex */
 	if (!mm_newkeys_to_blob(MODE_OUT, &blob, &bloblen))
@@ -656,8 +655,10 @@ mm_send_keystate(struct monitor *monitor)
 	buffer_put_string(&m, &incoming_stream, sizeof(incoming_stream));
 
 	/* Network I/O buffers */
-	buffer_put_string(&m, buffer_ptr(&input), buffer_len(&input));
-	buffer_put_string(&m, buffer_ptr(&output), buffer_len(&output));
+	input = (Buffer *)packet_get_input();
+	output = (Buffer *)packet_get_output();
+	buffer_put_string(&m, buffer_ptr(input), buffer_len(input));
+	buffer_put_string(&m, buffer_ptr(output), buffer_len(output));
 
 	mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m);
 	debug3("%s: Finished sending state", __func__);
diff --git a/packet.c b/packet.c
index 5afc84ce..fdc64888 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.160 2009/02/13 11:50:21 markus Exp $ */
+/* $OpenBSD: packet.c,v 1.161 2009/05/25 06:48:01 andreas Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -86,92 +86,117 @@
 
 #define PACKET_MAX_SIZE (256 * 1024)
 
-/*
- * This variable contains the file descriptors used for communicating with
- * the other side.  connection_in is used for reading; connection_out for
- * writing.  These can be the same descriptor, in which case it is assumed to
- * be a socket.
- */
-static int connection_in = -1;
-static int connection_out = -1;
+struct packet_state {
+	u_int32_t seqnr;
+	u_int32_t packets;
+	u_int64_t blocks;
+	u_int64_t bytes;
+};
 
-/* Protocol flags for the remote side. */
-static u_int remote_protocol_flags = 0;
+struct packet {
+	TAILQ_ENTRY(packet) next;
+	u_char type;
+	Buffer payload;
+};
 
-/* Encryption context for receiving data.  This is only used for decryption. */
-static CipherContext receive_context;
+struct session_state {
+	/*
+	 * This variable contains the file descriptors used for
+	 * communicating with the other side.  connection_in is used for
+	 * reading; connection_out for writing.  These can be the same
+	 * descriptor, in which case it is assumed to be a socket.
+	 */
+	int connection_in;
+	int connection_out;
 
-/* Encryption context for sending data.  This is only used for encryption. */
-static CipherContext send_context;
+	/* Protocol flags for the remote side. */
+	u_int remote_protocol_flags;
 
-/* Buffer for raw input data from the socket. */
-Buffer input;
+	/* Encryption context for receiving data.  Only used for decryption. */
+	CipherContext receive_context;
 
-/* Buffer for raw output data going to the socket. */
-Buffer output;
+	/* Encryption context for sending data.  Only used for encryption. */
+	CipherContext send_context;
 
-/* Buffer for the partial outgoing packet being constructed. */
-static Buffer outgoing_packet;
+	/* Buffer for raw input data from the socket. */
+	Buffer input;
 
-/* Buffer for the incoming packet currently being processed. */
-static Buffer incoming_packet;
+	/* Buffer for raw output data going to the socket. */
+	Buffer output;
 
-/* Scratch buffer for packet compression/decompression. */
-static Buffer compression_buffer;
-static int compression_buffer_ready = 0;
+	/* Buffer for the partial outgoing packet being constructed. */
+	Buffer outgoing_packet;
 
-/* Flag indicating whether packet compression/decompression is enabled. */
-static int packet_compression = 0;
+	/* Buffer for the incoming packet currently being processed. */
+	Buffer incoming_packet;
 
-/* default maximum packet size */
-u_int max_packet_size = 32768;
+	/* Scratch buffer for packet compression/decompression. */
+	Buffer compression_buffer;
+	int compression_buffer_ready;
 
-/* Flag indicating whether this module has been initialized. */
-static int initialized = 0;
+	/*
+	 * Flag indicating whether packet compression/decompression is
+	 * enabled.
+	 */
+	int packet_compression;
 
-/* Set to true if the connection is interactive. */
-static int interactive_mode = 0;
+	/* default maximum packet size */
+	u_int max_packet_size;
 
-/* Set to true if we are the server side. */
-static int server_side = 0;
+	/* Flag indicating whether this module has been initialized. */
+	int initialized;
 
-/* Set to true if we are authenticated. */
-static int after_authentication = 0;
+	/* Set to true if the connection is interactive. */
+	int interactive_mode;
 
-int keep_alive_timeouts = 0;
+	/* Set to true if we are the server side. */
+	int server_side;
 
-/* Set to the maximum time that we will wait to send or receive a packet */
-static int packet_timeout_ms = -1;
+	/* Set to true if we are authenticated. */
+	int after_authentication;
 
-/* Session key information for Encryption and MAC */
-Newkeys *newkeys[MODE_MAX];
-static struct packet_state {
-	u_int32_t seqnr;
-	u_int32_t packets;
-	u_int64_t blocks;
-	u_int64_t bytes;
-} p_read, p_send;
+	int keep_alive_timeouts;
 
-static u_int64_t max_blocks_in, max_blocks_out;
-static u_int32_t rekey_limit;
+	/* The maximum time that we will wait to send or receive a packet */
+	int packet_timeout_ms;
 
-/* Session key for protocol v1 */
-static u_char ssh1_key[SSH_SESSION_KEY_LENGTH];
-static u_int ssh1_keylen;
+	/* Session key information for Encryption and MAC */
+	Newkeys *newkeys[MODE_MAX];
+	struct packet_state p_read, p_send;
 
-/* roundup current message to extra_pad bytes */
-static u_char extra_pad = 0;
+	u_int64_t max_blocks_in, max_blocks_out;
+	u_int32_t rekey_limit;
 
-/* XXX discard incoming data after MAC error */
-static u_int packet_discard = 0;
-static Mac *packet_discard_mac = NULL;
+	/* Session key for protocol v1 */
+	u_char ssh1_key[SSH_SESSION_KEY_LENGTH];
+	u_int ssh1_keylen;
 
-struct packet {
-	TAILQ_ENTRY(packet) next;
-	u_char type;
-	Buffer payload;
+	/* roundup current message to extra_pad bytes */
+	u_char extra_pad;
+
+	/* XXX discard incoming data after MAC error */
+	u_int packet_discard;
+	Mac *packet_discard_mac;
+
+	/* Used in packet_read_poll2() */
+	u_int packlen;
+
+	TAILQ_HEAD(, packet) outgoing;
 };
-TAILQ_HEAD(, packet) outgoing;
+
+static struct session_state *active_state;
+
+static struct session_state *
+alloc_session_state()
+{
+    struct session_state *s = xcalloc(1, sizeof(*s));
+
+    s->connection_in = -1;
+    s->connection_out = -1;
+    s->max_packet_size = 32768;
+    s->packet_timeout_ms = -1;
+    return s;
+}
 
 /*
  * Sets the descriptors used for communication.  Disables encryption until
@@ -184,21 +209,23 @@ packet_set_connection(int fd_in, int fd_out)
 
 	if (none == NULL)
 		fatal("packet_set_connection: cannot load cipher 'none'");
-	connection_in = fd_in;
-	connection_out = fd_out;
-	cipher_init(&send_context, none, (const u_char *)"",
+	if (active_state == NULL)
+		active_state = alloc_session_state();
+	active_state->connection_in = fd_in;
+	active_state->connection_out = fd_out;
+	cipher_init(&active_state->send_context, none, (const u_char *)"",
 	    0, NULL, 0, CIPHER_ENCRYPT);
-	cipher_init(&receive_context, none, (const u_char *)"",
+	cipher_init(&active_state->receive_context, none, (const u_char *)"",
 	    0, NULL, 0, CIPHER_DECRYPT);
-	newkeys[MODE_IN] = newkeys[MODE_OUT] = NULL;
-	if (!initialized) {
-		initialized = 1;
-		buffer_init(&input);
-		buffer_init(&output);
-		buffer_init(&outgoing_packet);
-		buffer_init(&incoming_packet);
-		TAILQ_INIT(&outgoing);
-		p_send.packets = p_read.packets = 0;
+	active_state->newkeys[MODE_IN] = active_state->newkeys[MODE_OUT] = NULL;
+	if (!active_state->initialized) {
+		active_state->initialized = 1;
+		buffer_init(&active_state->input);
+		buffer_init(&active_state->output);
+		buffer_init(&active_state->outgoing_packet);
+		buffer_init(&active_state->incoming_packet);
+		TAILQ_INIT(&active_state->outgoing);
+		active_state->p_send.packets = active_state->p_read.packets = 0;
 	}
 }
 
@@ -206,27 +233,29 @@ void
 packet_set_timeout(int timeout, int count)
 {
 	if (timeout == 0 || count == 0) {
-		packet_timeout_ms = -1;
+		active_state->packet_timeout_ms = -1;
 		return;
 	}
 	if ((INT_MAX / 1000) / count < timeout)
-		packet_timeout_ms = INT_MAX;
+		active_state->packet_timeout_ms = INT_MAX;
 	else
-		packet_timeout_ms = timeout * count * 1000;
+		active_state->packet_timeout_ms = timeout * count * 1000;
 }
 
 static void
 packet_stop_discard(void)
 {
-	if (packet_discard_mac) {
+	if (active_state->packet_discard_mac) {
 		char buf[1024];
 		
 		memset(buf, 'a', sizeof(buf));
-		while (buffer_len(&incoming_packet) < PACKET_MAX_SIZE)
-			buffer_append(&incoming_packet, buf, sizeof(buf));
-		(void) mac_compute(packet_discard_mac,
-		    p_read.seqnr,
-		    buffer_ptr(&incoming_packet),
+		while (buffer_len(&active_state->incoming_packet) <
+		    PACKET_MAX_SIZE)
+			buffer_append(&active_state->incoming_packet, buf,
+			    sizeof(buf));
+		(void) mac_compute(active_state->packet_discard_mac,
+		    active_state->p_read.seqnr,
+		    buffer_ptr(&active_state->incoming_packet),
 		    PACKET_MAX_SIZE);
 	}
 	logit("Finished discarding for %.200s", get_remote_ipaddr());
@@ -239,10 +268,11 @@ packet_start_discard(Enc *enc, Mac *mac, u_int packet_length, u_int discard)
 	if (enc == NULL || !cipher_is_cbc(enc->cipher))
 		packet_disconnect("Packet corrupt");
 	if (packet_length != PACKET_MAX_SIZE && mac && mac->enabled)
-		packet_discard_mac = mac;
-	if (buffer_len(&input) >= discard)
+		active_state->packet_discard_mac = mac;
+	if (buffer_len(&active_state->input) >= discard)
 		packet_stop_discard();
-	packet_discard = discard - buffer_len(&input);
+	active_state->packet_discard = discard -
+	    buffer_len(&active_state->input);
 }
 
 /* Returns 1 if remote host is connected via socket, 0 if not. */
@@ -254,15 +284,17 @@ packet_connection_is_on_socket(void)
 	socklen_t fromlen, tolen;
 
 	/* filedescriptors in and out are the same, so it's a socket */
-	if (connection_in == connection_out)
+	if (active_state->connection_in == active_state->connection_out)
 		return 1;
 	fromlen = sizeof(from);
 	memset(&from, 0, sizeof(from));
-	if (getpeername(connection_in, (struct sockaddr *)&from, &fromlen) < 0)
+	if (getpeername(active_state->connection_in, (struct sockaddr *)&from,
+	    &fromlen) < 0)
 		return 0;
 	tolen = sizeof(to);
 	memset(&to, 0, sizeof(to));
-	if (getpeername(connection_out, (struct sockaddr *)&to, &tolen) < 0)
+	if (getpeername(active_state->connection_out, (struct sockaddr *)&to,
+	    &tolen) < 0)
 		return 0;
 	if (fromlen != tolen || memcmp(&from, &to, fromlen) != 0)
 		return 0;
@@ -283,9 +315,9 @@ packet_get_keyiv(int mode, u_char *iv, u_int len)
 	CipherContext *cc;
 
 	if (mode == MODE_OUT)
-		cc = &send_context;
+		cc = &active_state->send_context;
 	else
-		cc = &receive_context;
+		cc = &active_state->receive_context;
 
 	cipher_get_keyiv(cc, iv, len);
 }
@@ -296,9 +328,9 @@ packet_get_keycontext(int mode, u_char *dat)
 	CipherContext *cc;
 
 	if (mode == MODE_OUT)
-		cc = &send_context;
+		cc = &active_state->send_context;
 	else
-		cc = &receive_context;
+		cc = &active_state->receive_context;
 
 	return (cipher_get_keycontext(cc, dat));
 }
@@ -309,9 +341,9 @@ packet_set_keycontext(int mode, u_char *dat)
 	CipherContext *cc;
 
 	if (mode == MODE_OUT)
-		cc = &send_context;
+		cc = &active_state->send_context;
 	else
-		cc = &receive_context;
+		cc = &active_state->receive_context;
 
 	cipher_set_keycontext(cc, dat);
 }
@@ -322,9 +354,9 @@ packet_get_keyiv_len(int mode)
 	CipherContext *cc;
 
 	if (mode == MODE_OUT)
-		cc = &send_context;
+		cc = &active_state->send_context;
 	else
-		cc = &receive_context;
+		cc = &active_state->receive_context;
 
 	return (cipher_get_keyiv_len(cc));
 }
@@ -335,9 +367,9 @@ packet_set_iv(int mode, u_char *dat)
 	CipherContext *cc;
 
 	if (mode == MODE_OUT)
-		cc = &send_context;
+		cc = &active_state->send_context;
 	else
-		cc = &receive_context;
+		cc = &active_state->receive_context;
 
 	cipher_set_keyiv(cc, dat);
 }
@@ -345,7 +377,7 @@ packet_set_iv(int mode, u_char *dat)
 int
 packet_get_ssh1_cipher(void)
 {
-	return (cipher_get_number(receive_context.cipher));
+	return (cipher_get_number(active_state->receive_context.cipher));
 }
 
 void
@@ -354,7 +386,8 @@ packet_get_state(int mode, u_int32_t *seqnr, u_int64_t *blocks, u_int32_t *packe
 {
 	struct packet_state *state;
 
-	state = (mode == MODE_IN) ? &p_read : &p_send;
+	state = (mode == MODE_IN) ?
+	    &active_state->p_read : &active_state->p_send;
 	if (seqnr)
 		*seqnr = state->seqnr;
 	if (blocks)
@@ -371,7 +404,8 @@ packet_set_state(int mode, u_int32_t seqnr, u_int64_t blocks, u_int32_t packets,
 {
 	struct packet_state *state;
 
-	state = (mode == MODE_IN) ? &p_read : &p_send;
+	state = (mode == MODE_IN) ?
+	    &active_state->p_read : &active_state->p_send;
 	state->seqnr = seqnr;
 	state->blocks = blocks;
 	state->packets = packets;
@@ -387,7 +421,8 @@ packet_connection_is_ipv4(void)
 	socklen_t tolen = sizeof(to);
 
 	memset(&to, 0, sizeof(to));
-	if (getsockname(connection_out, (struct sockaddr *)&to, &tolen) < 0)
+	if (getsockname(active_state->connection_out, (struct sockaddr *)&to,
+	    &tolen) < 0)
 		return 0;
 	if (to.ss_family == AF_INET)
 		return 1;
@@ -405,10 +440,10 @@ void
 packet_set_nonblocking(void)
 {
 	/* Set the socket into non-blocking mode. */
-	set_nonblock(connection_in);
+	set_nonblock(active_state->connection_in);
 
-	if (connection_out != connection_in)
-		set_nonblock(connection_out);
+	if (active_state->connection_out != active_state->connection_in)
+		set_nonblock(active_state->connection_out);
 }
 
 /* Returns the socket used for reading. */
@@ -416,7 +451,7 @@ packet_set_nonblocking(void)
 int
 packet_get_connection_in(void)
 {
-	return connection_in;
+	return active_state->connection_in;
 }
 
 /* Returns the descriptor used for writing. */
@@ -424,7 +459,7 @@ packet_get_connection_in(void)
 int
 packet_get_connection_out(void)
 {
-	return connection_out;
+	return active_state->connection_out;
 }
 
 /* Closes the connection and clears and frees internal data structures. */
@@ -432,26 +467,26 @@ packet_get_connection_out(void)
 void
 packet_close(void)
 {
-	if (!initialized)
+	if (!active_state->initialized)
 		return;
-	initialized = 0;
-	if (connection_in == connection_out) {
-		shutdown(connection_out, SHUT_RDWR);
-		close(connection_out);
+	active_state->initialized = 0;
+	if (active_state->connection_in == active_state->connection_out) {
+		shutdown(active_state->connection_out, SHUT_RDWR);
+		close(active_state->connection_out);
 	} else {
-		close(connection_in);
-		close(connection_out);
+		close(active_state->connection_in);
+		close(active_state->connection_out);
 	}
-	buffer_free(&input);
-	buffer_free(&output);
-	buffer_free(&outgoing_packet);
-	buffer_free(&incoming_packet);
-	if (compression_buffer_ready) {
-		buffer_free(&compression_buffer);
+	buffer_free(&active_state->input);
+	buffer_free(&active_state->output);
+	buffer_free(&active_state->outgoing_packet);
+	buffer_free(&active_state->incoming_packet);
+	if (active_state->compression_buffer_ready) {
+		buffer_free(&active_state->compression_buffer);
 		buffer_compress_uninit();
 	}
-	cipher_cleanup(&send_context);
-	cipher_cleanup(&receive_context);
+	cipher_cleanup(&active_state->send_context);
+	cipher_cleanup(&active_state->receive_context);
 }
 
 /* Sets remote side protocol flags. */
@@ -459,7 +494,7 @@ packet_close(void)
 void
 packet_set_protocol_flags(u_int protocol_flags)
 {
-	remote_protocol_flags = protocol_flags;
+	active_state->remote_protocol_flags = protocol_flags;
 }
 
 /* Returns the remote protocol flags set earlier by the above function. */
@@ -467,7 +502,7 @@ packet_set_protocol_flags(u_int protocol_flags)
 u_int
 packet_get_protocol_flags(void)
 {
-	return remote_protocol_flags;
+	return active_state->remote_protocol_flags;
 }
 
 /*
@@ -478,18 +513,18 @@ packet_get_protocol_flags(void)
 static void
 packet_init_compression(void)
 {
-	if (compression_buffer_ready == 1)
+	if (active_state->compression_buffer_ready == 1)
 		return;
-	compression_buffer_ready = 1;
-	buffer_init(&compression_buffer);
+	active_state->compression_buffer_ready = 1;
+	buffer_init(&active_state->compression_buffer);
 }
 
 void
 packet_start_compression(int level)
 {
-	if (packet_compression && !compat20)
+	if (active_state->packet_compression && !compat20)
 		fatal("Compression already enabled.");
-	packet_compression = 1;
+	active_state->packet_compression = 1;
 	packet_init_compression();
 	buffer_compress_init_send(level);
 	buffer_compress_init_recv();
@@ -513,19 +548,21 @@ packet_set_encryption_key(const u_char *key, u_int keylen,
 		fatal("packet_set_encryption_key: keylen too small: %d", keylen);
 	if (keylen > SSH_SESSION_KEY_LENGTH)
 		fatal("packet_set_encryption_key: keylen too big: %d", keylen);
-	memcpy(ssh1_key, key, keylen);
-	ssh1_keylen = keylen;
-	cipher_init(&send_context, cipher, key, keylen, NULL, 0, CIPHER_ENCRYPT);
-	cipher_init(&receive_context, cipher, key, keylen, NULL, 0, CIPHER_DECRYPT);
+	memcpy(active_state->ssh1_key, key, keylen);
+	active_state->ssh1_keylen = keylen;
+	cipher_init(&active_state->send_context, cipher, key, keylen, NULL,
+	    0, CIPHER_ENCRYPT);
+	cipher_init(&active_state->receive_context, cipher, key, keylen, NULL,
+	    0, CIPHER_DECRYPT);
 }
 
 u_int
 packet_get_encryption_key(u_char *key)
 {
 	if (key == NULL)
-		return (ssh1_keylen);
-	memcpy(key, ssh1_key, ssh1_keylen);
-	return (ssh1_keylen);
+		return (active_state->ssh1_keylen);
+	memcpy(key, active_state->ssh1_key, active_state->ssh1_keylen);
+	return (active_state->ssh1_keylen);
 }
 
 /* Start constructing a packet to send. */
@@ -539,8 +576,8 @@ packet_start(u_char type)
 	len = compat20 ? 6 : 9;
 	memset(buf, 0, len - 1);
 	buf[len - 1] = type;
-	buffer_clear(&outgoing_packet);
-	buffer_append(&outgoing_packet, buf, len);
+	buffer_clear(&active_state->outgoing_packet);
+	buffer_append(&active_state->outgoing_packet, buf, len);
 }
 
 /* Append payload. */
@@ -549,43 +586,43 @@ packet_put_char(int value)
 {
 	char ch = value;
 
-	buffer_append(&outgoing_packet, &ch, 1);
+	buffer_append(&active_state->outgoing_packet, &ch, 1);
 }
 
 void
 packet_put_int(u_int value)
 {
-	buffer_put_int(&outgoing_packet, value);
+	buffer_put_int(&active_state->outgoing_packet, value);
 }
 
 void
 packet_put_string(const void *buf, u_int len)
 {
-	buffer_put_string(&outgoing_packet, buf, len);
+	buffer_put_string(&active_state->outgoing_packet, buf, len);
 }
 
 void
 packet_put_cstring(const char *str)
 {
-	buffer_put_cstring(&outgoing_packet, str);
+	buffer_put_cstring(&active_state->outgoing_packet, str);
 }
 
 void
 packet_put_raw(const void *buf, u_int len)
 {
-	buffer_append(&outgoing_packet, buf, len);
+	buffer_append(&active_state->outgoing_packet, buf, len);
 }
 
 void
 packet_put_bignum(BIGNUM * value)
 {
-	buffer_put_bignum(&outgoing_packet, value);
+	buffer_put_bignum(&active_state->outgoing_packet, value);
 }
 
 void
 packet_put_bignum2(BIGNUM * value)
 {
-	buffer_put_bignum2(&outgoing_packet, value);
+	buffer_put_bignum2(&active_state->outgoing_packet, value);
 }
 
 /*
@@ -605,24 +642,27 @@ packet_send1(void)
 	 * If using packet compression, compress the payload of the outgoing
 	 * packet.
 	 */
-	if (packet_compression) {
-		buffer_clear(&compression_buffer);
+	if (active_state->packet_compression) {
+		buffer_clear(&active_state->compression_buffer);
 		/* Skip padding. */
-		buffer_consume(&outgoing_packet, 8);
+		buffer_consume(&active_state->outgoing_packet, 8);
 		/* padding */
-		buffer_append(&compression_buffer, "\0\0\0\0\0\0\0\0", 8);
-		buffer_compress(&outgoing_packet, &compression_buffer);
-		buffer_clear(&outgoing_packet);
-		buffer_append(&outgoing_packet, buffer_ptr(&compression_buffer),
-		    buffer_len(&compression_buffer));
+		buffer_append(&active_state->compression_buffer,
+		    "\0\0\0\0\0\0\0\0", 8);
+		buffer_compress(&active_state->outgoing_packet,
+		    &active_state->compression_buffer);
+		buffer_clear(&active_state->outgoing_packet);
+		buffer_append(&active_state->outgoing_packet,
+		    buffer_ptr(&active_state->compression_buffer),
+		    buffer_len(&active_state->compression_buffer));
 	}
 	/* Compute packet length without padding (add checksum, remove padding). */
-	len = buffer_len(&outgoing_packet) + 4 - 8;
+	len = buffer_len(&active_state->outgoing_packet) + 4 - 8;
 
 	/* Insert padding. Initialized to zero in packet_start1() */
 	padding = 8 - len % 8;
-	if (!send_context.plaintext) {
-		cp = buffer_ptr(&outgoing_packet);
+	if (!active_state->send_context.plaintext) {
+		cp = buffer_ptr(&active_state->outgoing_packet);
 		for (i = 0; i < padding; i++) {
 			if (i % 4 == 0)
 				rnd = arc4random();
@@ -630,33 +670,36 @@ packet_send1(void)
 			rnd >>= 8;
 		}
 	}
-	buffer_consume(&outgoing_packet, 8 - padding);
+	buffer_consume(&active_state->outgoing_packet, 8 - padding);
 
 	/* Add check bytes. */
-	checksum = ssh_crc32(buffer_ptr(&outgoing_packet),
-	    buffer_len(&outgoing_packet));
+	checksum = ssh_crc32(buffer_ptr(&active_state->outgoing_packet),
+	    buffer_len(&active_state->outgoing_packet));
 	put_u32(buf, checksum);
-	buffer_append(&outgoing_packet, buf, 4);
+	buffer_append(&active_state->outgoing_packet, buf, 4);
 
 #ifdef PACKET_DEBUG
 	fprintf(stderr, "packet_send plain: ");
-	buffer_dump(&outgoing_packet);
+	buffer_dump(&active_state->outgoing_packet);
 #endif
 
 	/* Append to output. */
 	put_u32(buf, len);
-	buffer_append(&output, buf, 4);
-	cp = buffer_append_space(&output, buffer_len(&outgoing_packet));
-	cipher_crypt(&send_context, cp, buffer_ptr(&outgoing_packet),
-	    buffer_len(&outgoing_packet));
+	buffer_append(&active_state->output, buf, 4);
+	cp = buffer_append_space(&active_state->output,
+	    buffer_len(&active_state->outgoing_packet));
+	cipher_crypt(&active_state->send_context, cp,
+	    buffer_ptr(&active_state->outgoing_packet),
+	    buffer_len(&active_state->outgoing_packet));
 
 #ifdef PACKET_DEBUG
 	fprintf(stderr, "encrypted: ");
-	buffer_dump(&output);
+	buffer_dump(&active_state->output);
 #endif
-	p_send.packets++;
-	p_send.bytes += len + buffer_len(&outgoing_packet);
-	buffer_clear(&outgoing_packet);
+	active_state->p_send.packets++;
+	active_state->p_send.bytes += len +
+	    buffer_len(&active_state->outgoing_packet);
+	buffer_clear(&active_state->outgoing_packet);
 
 	/*
 	 * Note that the packet is now only buffered in output.  It won't be
@@ -678,22 +721,22 @@ set_newkeys(int mode)
 	debug2("set_newkeys: mode %d", mode);
 
 	if (mode == MODE_OUT) {
-		cc = &send_context;
+		cc = &active_state->send_context;
 		crypt_type = CIPHER_ENCRYPT;
-		p_send.packets = p_send.blocks = 0;
-		max_blocks = &max_blocks_out;
+		active_state->p_send.packets = active_state->p_send.blocks = 0;
+		max_blocks = &active_state->max_blocks_out;
 	} else {
-		cc = &receive_context;
+		cc = &active_state->receive_context;
 		crypt_type = CIPHER_DECRYPT;
-		p_read.packets = p_read.blocks = 0;
-		max_blocks = &max_blocks_in;
+		active_state->p_read.packets = active_state->p_read.blocks = 0;
+		max_blocks = &active_state->max_blocks_in;
 	}
-	if (newkeys[mode] != NULL) {
+	if (active_state->newkeys[mode] != NULL) {
 		debug("set_newkeys: rekeying");
 		cipher_cleanup(cc);
-		enc  = &newkeys[mode]->enc;
-		mac  = &newkeys[mode]->mac;
-		comp = &newkeys[mode]->comp;
+		enc  = &active_state->newkeys[mode]->enc;
+		mac  = &active_state->newkeys[mode]->mac;
+		comp = &active_state->newkeys[mode]->comp;
 		mac_clear(mac);
 		xfree(enc->name);
 		xfree(enc->iv);
@@ -701,14 +744,14 @@ set_newkeys(int mode)
 		xfree(mac->name);
 		xfree(mac->key);
 		xfree(comp->name);
-		xfree(newkeys[mode]);
+		xfree(active_state->newkeys[mode]);
 	}
-	newkeys[mode] = kex_get_newkeys(mode);
-	if (newkeys[mode] == NULL)
+	active_state->newkeys[mode] = kex_get_newkeys(mode);
+	if (active_state->newkeys[mode] == NULL)
 		fatal("newkeys: no keys for mode %d", mode);
-	enc  = &newkeys[mode]->enc;
-	mac  = &newkeys[mode]->mac;
-	comp = &newkeys[mode]->comp;
+	enc  = &active_state->newkeys[mode]->enc;
+	mac  = &active_state->newkeys[mode]->mac;
+	comp = &active_state->newkeys[mode]->comp;
 	if (mac_init(mac) == 0)
 		mac->enabled = 1;
 	DBG(debug("cipher_init_context: %d", mode));
@@ -719,8 +762,8 @@ set_newkeys(int mode)
 	   memset(enc->key, 0, enc->key_len);
 	   memset(mac->key, 0, mac->key_len); */
 	if ((comp->type == COMP_ZLIB ||
-	    (comp->type == COMP_DELAYED && after_authentication)) &&
-	    comp->enabled == 0) {
+	    (comp->type == COMP_DELAYED &&
+	     active_state->after_authentication)) && comp->enabled == 0) {
 		packet_init_compression();
 		if (mode == MODE_OUT)
 			buffer_compress_init_send(6);
@@ -736,8 +779,9 @@ set_newkeys(int mode)
 		*max_blocks = (u_int64_t)1 << (enc->block_size*2);
 	else
 		*max_blocks = ((u_int64_t)1 << 30) / enc->block_size;
-	if (rekey_limit)
-		*max_blocks = MIN(*max_blocks, rekey_limit / enc->block_size);
+	if (active_state->rekey_limit)
+		*max_blocks = MIN(*max_blocks,
+		    active_state->rekey_limit / enc->block_size);
 }
 
 /*
@@ -755,12 +799,12 @@ packet_enable_delayed_compress(void)
 	 * Remember that we are past the authentication step, so rekeying
 	 * with COMP_DELAYED will turn on compression immediately.
 	 */
-	after_authentication = 1;
+	active_state->after_authentication = 1;
 	for (mode = 0; mode < MODE_MAX; mode++) {
 		/* protocol error: USERAUTH_SUCCESS received before NEWKEYS */
-		if (newkeys[mode] == NULL)
+		if (active_state->newkeys[mode] == NULL)
 			continue;
-		comp = &newkeys[mode]->comp;
+		comp = &active_state->newkeys[mode]->comp;
 		if (comp && !comp->enabled && comp->type == COMP_DELAYED) {
 			packet_init_compression();
 			if (mo