- markus@cvs.openbsd.org 2001/05/04 23:47:34

     [channels.c channels.h clientloop.c nchan.c nchan.h serverloop.c ssh.c]
     move to Channel **channels (instead of Channel *channels), fixes realloc
     problems.  channel_new now returns a Channel *, favour Channel * over
     channel id.  remove old channel_allocate interface.

1 files changed, 193 insertions, 162 deletions

diff --git a/channels.c b/channels.c
index 503a8145..2bb0e985 100644
--- a/channels.c
+++ b/channels.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.112 2001/05/04 14:34:34 markus Exp $");
+RCSID("$OpenBSD: channels.c,v 1.113 2001/05/04 23:47:33 markus Exp $");
 
 #include <openssl/rsa.h>
 #include <openssl/dsa.h>
@@ -72,18 +72,17 @@ RCSID("$OpenBSD: channels.c,v 1.112 2001/05/04 14:34:34 markus Exp $");
  * Pointer to an array containing all allocated channels.  The array is
  * dynamically extended as needed.
  */
-static Channel *channels = NULL;
+static Channel **channels = NULL;
 
 /*
  * Size of the channel array.  All slots of the array must always be
- * initialized (at least the type field); unused slots are marked with type
- * SSH_CHANNEL_FREE.
+ * initialized (at least the type field); unused slots set to NULL
  */
 static int channels_alloc = 0;
 
 /*
  * Maximum file descriptor value used in any of the channels.  This is
- * updated in channel_allocate.
+ * updated in channel_new.
  */
 static int channel_max_fd = 0;
 
@@ -150,12 +149,13 @@ Channel *
 channel_lookup(int id)
 {
 	Channel *c;
+
 	if (id < 0 || id > channels_alloc) {
 		log("channel_lookup: %d: bad id", id);
 		return NULL;
 	}
-	c = &channels[id];
-	if (c->type == SSH_CHANNEL_FREE) {
+	c = channels[id];
+	if (c == NULL) {
 		log("channel_lookup: %d: bad id: channel free", id);
 		return NULL;
 	}
@@ -212,7 +212,7 @@ channel_register_fds(Channel *c, int rfd, int wfd, int efd,
  * remote_name to be freed.
  */
 
-int
+Channel *
 channel_new(char *ctype, int type, int rfd, int wfd, int efd,
     int window, int maxpack, int extusage, char *remote_name, int nonblock)
 {
@@ -223,9 +223,9 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 	if (channels_alloc == 0) {
 		chan_init();
 		channels_alloc = 10;
-		channels = xmalloc(channels_alloc * sizeof(Channel));
+		channels = xmalloc(channels_alloc * sizeof(Channel *));
 		for (i = 0; i < channels_alloc; i++)
-			channels[i].type = SSH_CHANNEL_FREE;
+			channels[i] = NULL;
 		/*
 		 * Kludge: arrange a call to channel_stop_listening if we
 		 * terminate with fatal().
@@ -234,7 +234,7 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 	}
 	/* Try to find a free slot where to put the new channel. */
 	for (found = -1, i = 0; i < channels_alloc; i++)
-		if (channels[i].type == SSH_CHANNEL_FREE) {
+		if (channels[i] == NULL) {
 			/* Found a free slot. */
 			found = i;
 			break;
@@ -244,12 +244,12 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 		found = channels_alloc;
 		channels_alloc += 10;
 		debug2("channel: expanding %d", channels_alloc);
-		channels = xrealloc(channels, channels_alloc * sizeof(Channel));
+		channels = xrealloc(channels, channels_alloc * sizeof(Channel *));
 		for (i = found; i < channels_alloc; i++)
-			channels[i].type = SSH_CHANNEL_FREE;
+			channels[i] = NULL;
 	}
-	/* Initialize and return new channel number. */
-	c = &channels[found];
+	/* Initialize and return new channel. */
+	c = channels[found] = xmalloc(sizeof(Channel));
 	buffer_init(&c->input);
 	buffer_init(&c->output);
 	buffer_init(&c->extended);
@@ -272,16 +272,9 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd,
 	c->dettach_user = NULL;
 	c->input_filter = NULL;
 	debug("channel %d: new [%s]", found, remote_name);
-	return found;
-}
-/* old interface XXX */
-int
-channel_allocate(int type, int sock, char *remote_name)
-{
-	return channel_new("", type, sock, sock, -1, 0, 0, 0, remote_name, 1);
+	return c;
 }
 
-
 /* Close all channel fd/socket. */
 
 void
@@ -308,18 +301,16 @@ channel_close_fds(Channel *c)
 /* Free the channel and close its fd/socket. */
 
 void
-channel_free(int id)
+channel_free(Channel *c)
 {
-	Channel *c = channel_lookup(id);
-	char *s = channel_open_message();
+	char *s;
 
-	if (c == NULL)
-		packet_disconnect("channel free: bad local channel %d", id);
-	debug("channel_free: channel %d: status: %s", id, s);
+	s = channel_open_message();
+	debug("channel_free: channel %d: status: %s", c->self, s);
 	xfree(s);
 
 	if (c->dettach_user != NULL) {
-		debug("channel_free: channel %d: dettaching channel user", id);
+		debug("channel_free: channel %d: dettaching channel user", c->self);
 		c->dettach_user(c->self, NULL);
 	}
 	if (c->sock != -1)
@@ -328,11 +319,12 @@ channel_free(int id)
 	buffer_free(&c->input);
 	buffer_free(&c->output);
 	buffer_free(&c->extended);
-	c->type = SSH_CHANNEL_FREE;
 	if (c->remote_name) {
 		xfree(c->remote_name);
 		c->remote_name = NULL;
 	}
+	channels[c->self] = NULL;
+	xfree(c);
 }
 
 /*
@@ -428,7 +420,7 @@ void
 channel_pre_output_draining(Channel *c, fd_set * readset, fd_set * writeset)
 {
 	if (buffer_len(&c->output) == 0)
-		channel_free(c->self);
+		chan_mark_dead(c);
 	else
 		FD_SET(c->sock, writeset);
 }
@@ -640,7 +632,7 @@ channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
 		break;
 	}
 	if (ret < 0) {
-		channel_free(c->self);
+		chan_mark_dead(c);
 	} else if (ret == 0) {
 		debug2("channel %d: pre_dynamic: need more", c->self);
 		/* need more */
@@ -656,8 +648,9 @@ channel_pre_dynamic(Channel *c, fd_set * readset, fd_set * writeset)
 void
 channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 {
+	Channel *nc;
 	struct sockaddr addr;
-	int newsock, newch, oldch;
+	int newsock;
 	socklen_t addrlen;
 	char buf[16384], *remote_ipaddr;
 	int remote_port;
@@ -675,16 +668,19 @@ channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 		snprintf(buf, sizeof buf, "X11 connection from %.200s port %d",
 		    remote_ipaddr, remote_port);
 
-		oldch = c->self;
-		newch = channel_new("x11",
+		nc = channel_new("accepted x11 socket",
 		    SSH_CHANNEL_OPENING, newsock, newsock, -1,
 		    c->local_window_max, c->local_maxpacket,
 		    0, xstrdup(buf), 1);
-		c = channel_lookup(oldch);
+		if (nc == NULL) {
+			close(newsock);
+			xfree(remote_ipaddr);
+			return;
+		}
 		if (compat20) {
 			packet_start(SSH2_MSG_CHANNEL_OPEN);
 			packet_put_cstring("x11");
-			packet_put_int(newch);
+			packet_put_int(nc->self);
 			packet_put_int(c->local_window_max);
 			packet_put_int(c->local_maxpacket);
 			/* originator ipaddr and port */
@@ -697,7 +693,7 @@ channel_post_x11_listener(Channel *c, fd_set * readset, fd_set * writeset)
 			packet_send();
 		} else {
 			packet_start(SSH_SMSG_X11_OPEN);
-			packet_put_int(newch);
+			packet_put_int(nc->self);
 			if (have_hostname_in_open)
 				packet_put_string(buf, strlen(buf));
 			packet_send();
@@ -764,7 +760,7 @@ channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
 {
 	Channel *nc;
 	struct sockaddr addr;
-	int newsock, newch, nextstate, oldch;
+	int newsock, nextstate;
 	socklen_t addrlen;
 	char *rtype;
 
@@ -784,16 +780,13 @@ channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
 			error("accept: %.100s", strerror(errno));
 			return;
 		}
-		oldch = c->self;
-		newch = channel_new(rtype,
+		nc = channel_new(rtype,
 		    nextstate, newsock, newsock, -1,
 		    c->local_window_max, c->local_maxpacket,
 		    0, xstrdup(rtype), 1);
-
-		c = channel_lookup(oldch);
-		nc = channel_lookup(newch);
 		if (nc == NULL) {
-			error("xxx: no new channel:");
+			error("channel_post_port_listener: no new channel:");
+			close(newsock);
 			return;
 		}
 		nc->listening_port = c->listening_port;
@@ -812,8 +805,9 @@ channel_post_port_listener(Channel *c, fd_set * readset, fd_set * writeset)
 void
 channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
 {
+	Channel *nc;
+	int newsock;
 	struct sockaddr addr;
-	int newsock, newch, oldch;
 	socklen_t addrlen;
 
 	if (FD_ISSET(c->sock, readset)) {
@@ -823,21 +817,23 @@ channel_post_auth_listener(Channel *c, fd_set * readset, fd_set * writeset)
 			error("accept from auth socket: %.100s", strerror(errno));
 			return;
 		}
-		oldch = c->self;
-		newch = channel_new("accepted auth socket",
+		nc = channel_new("accepted auth socket",
 		    SSH_CHANNEL_OPENING, newsock, newsock, -1,
 		    c->local_window_max, c->local_maxpacket,
 		    0, xstrdup("accepted auth socket"), 1);
-		c = channel_lookup(oldch);
+		if (nc == NULL) {
+			error("channel_post_auth_listener: channel_new failed");
+			close(newsock);
+		}
 		if (compat20) {
 			packet_start(SSH2_MSG_CHANNEL_OPEN);
 			packet_put_cstring("auth-agent@openssh.com");
-			packet_put_int(newch);
+			packet_put_int(nc->self);
 			packet_put_int(c->local_window_max);
 			packet_put_int(c->local_maxpacket);
 		} else {
 			packet_start(SSH_SMSG_AGENT_OPEN);
-			packet_put_int(newch);
+			packet_put_int(nc->self);
 		}
 		packet_send();
 	}
@@ -881,7 +877,7 @@ channel_handle_rfd(Channel *c, fd_set * readset, fd_set * writeset)
 			    c->self, c->rfd, len);
 			if (c->type != SSH_CHANNEL_OPEN) {
 				debug("channel %d: not open", c->self);
-				channel_free(c->self);
+				chan_mark_dead(c);
 				return -1;
 			} else if (compat13) {
 				buffer_consume(&c->output, buffer_len(&c->output));
@@ -920,7 +916,7 @@ channel_handle_wfd(Channel *c, fd_set * readset, fd_set * writeset)
 		if (len <= 0) {
 			if (c->type != SSH_CHANNEL_OPEN) {
 				debug("channel %d: not open", c->self);
-				channel_free(c->self);
+				chan_mark_dead(c);
 				return -1;
 			} else if (compat13) {
 				buffer_consume(&c->output, buffer_len(&c->output));
@@ -1138,13 +1134,12 @@ channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
 		did_init = 1;
 	}
 	for (i = 0; i < channels_alloc; i++) {
-		c = &channels[i];
-		if (c->type == SSH_CHANNEL_FREE)
+		c = channels[i];
+		if (c == NULL)
 			continue;
 		if (ftab[c->type] == NULL)
 			continue;
 		(*ftab[c->type])(c, readset, writeset);
-		c = &channels[i]; /* XXX realloc */
 		if (chan_is_dead(c)) {
 			/*
 			 * we have to remove the fd's from the select mask
@@ -1161,7 +1156,7 @@ channel_handler(chan_fn *ftab[], fd_set * readset, fd_set * writeset)
 				if (c->extended_usage == CHAN_EXTENDED_WRITE)
 					FD_CLR(c->efd, writeset);
 			}
-			channel_free(c->self);
+			channel_free(c);
 		}
 	}
 }
@@ -1207,7 +1202,10 @@ channel_output_poll()
 	Channel *c;
 
 	for (i = 0; i < channels_alloc; i++) {
-		c = &channels[i];
+
+		c = channels[i];
+		if (c == NULL)
+			continue;
 
 		/* We are only interested in channels that can have buffered incoming data. */
 		if (compat13) {
@@ -1391,8 +1389,8 @@ channel_not_very_much_buffered_data()
 	Channel *c;
 
 	for (i = 0; i < channels_alloc; i++) {
-		c = &channels[i];
-		if (c->type == SSH_CHANNEL_OPEN) {
+		c = channels[i];
+		if (c != NULL && c->type == SSH_CHANNEL_OPEN) {
 			if (!compat20 && buffer_len(&c->input) > packet_get_maxsize()) {
 				debug("channel %d: big input buffer %d",
 				    c->self, buffer_len(&c->input));
@@ -1486,7 +1484,7 @@ channel_input_close_confirmation(int type, int plen, void *ctxt)
 	if (c->type != SSH_CHANNEL_CLOSED)
 		packet_disconnect("Received close confirmation for "
 		    "non-closed channel %d (type %d).", id, c->type);
-	channel_free(c->self);
+	channel_free(c);
 }
 
 void
@@ -1554,7 +1552,7 @@ channel_input_open_failure(int type, int plen, void *ctxt)
 			xfree(lang);
 	}
 	/* Free the channel.  This will also close the socket. */
-	channel_free(id);
+	channel_free(c);
 }
 
 void
@@ -1615,21 +1613,26 @@ void
 channel_stop_listening()
 {
 	int i;
+	Channel *c;
+
 	for (i = 0; i < channels_alloc; i++) {
-		switch (channels[i].type) {
-		case SSH_CHANNEL_AUTH_SOCKET:
-			close(channels[i].sock);
-			unlink(channels[i].path);
-			channel_free(i);
-			break;
-		case SSH_CHANNEL_PORT_LISTENER:
-		case SSH_CHANNEL_RPORT_LISTENER:
-		case SSH_CHANNEL_X11_LISTENER:
-			close(channels[i].sock);
-			channel_free(i);
-			break;
-		default:
-			break;
+		c = channels[i];
+		if (c != NULL) {
+			switch (c->type) {
+			case SSH_CHANNEL_AUTH_SOCKET:
+				close(c->sock);
+				unlink(c->path);
+				channel_free(c);
+				break;
+			case SSH_CHANNEL_PORT_LISTENER:
+			case SSH_CHANNEL_RPORT_LISTENER:
+			case SSH_CHANNEL_X11_LISTENER:
+				close(c->sock);
+				channel_free(c);
+				break;
+			default:
+				break;
+			}
 		}
 	}
 }
@@ -1643,9 +1646,10 @@ void
 channel_close_all()
 {
 	int i;
+
 	for (i = 0; i < channels_alloc; i++)
-		if (channels[i].type != SSH_CHANNEL_FREE)
-			channel_close_fds(&channels[i]);
+		if (channels[i] != NULL)
+			channel_close_fds(channels[i]);
 }
 
 /* Returns true if any channel is still open. */
@@ -1653,10 +1657,14 @@ channel_close_all()
 int
 channel_still_open()
 {
-	u_int i;
-	for (i = 0; i < channels_alloc; i++)
-		switch (channels[i].type) {
-		case SSH_CHANNEL_FREE:
+	int i;
+	Channel *c;
+
+	for (i = 0; i < channels_alloc; i++) {
+		c = channels[i];
+		if (c == NULL)
+			continue;
+		switch (c->type) {
 		case SSH_CHANNEL_X11_LISTENER:
 		case SSH_CHANNEL_PORT_LISTENER:
 		case SSH_CHANNEL_RPORT_LISTENER:
@@ -1679,9 +1687,10 @@ channel_still_open()
 				fatal("cannot happen: OUT_DRAIN");
 			return 1;
 		default:
-			fatal("channel_still_open: bad channel type %d", channels[i].type);
+			fatal("channel_still_open: bad channel type %d", c->type);
 			/* NOTREACHED */
 		}
+	}
 	return 0;
 }
 
@@ -1690,12 +1699,16 @@ channel_still_open()
 int
 channel_find_open()
 {
-	u_int i;
-	for (i = 0; i < channels_alloc; i++)
-		switch (channels[i].type) {
+	int i;
+	Channel *c;
+
+	for (i = 0; i < channels_alloc; i++) {
+		c = channels[i];
+		if (c == NULL)
+			continue;
+		switch (c->type) {
 		case SSH_CHANNEL_CLOSED:
 		case SSH_CHANNEL_DYNAMIC:
-		case SSH_CHANNEL_FREE:
 		case SSH_CHANNEL_X11_LISTENER:
 		case SSH_CHANNEL_PORT_LISTENER:
 		case SSH_CHANNEL_RPORT_LISTENER:
@@ -1713,9 +1726,10 @@ channel_find_open()
 				fatal("cannot happen: OUT_DRAIN");
 			return i;
 		default:
-			fatal("channel_find_open: bad channel type %d", channels[i].type);
+			fatal("channel_find_open: bad channel type %d", c->type);
 			/* NOTREACHED */
 		}
+	}
 	return -1;
 }
 
@@ -1730,16 +1744,18 @@ char *
 channel_open_message()
 {
 	Buffer buffer;
+	Channel *c;
+	char buf[1024], *cp;
 	int i;
-	char buf[512], *cp;
 
 	buffer_init(&buffer);
 	snprintf(buf, sizeof buf, "The following connections are open:\r\n");
 	buffer_append(&buffer, buf, strlen(buf));
 	for (i = 0; i < channels_alloc; i++) {
-		Channel *c = &channels[i];
+		c = channels[i];
+		if (c == NULL)
+			continue;
 		switch (c->type) {
-		case SSH_CHANNEL_FREE:
 		case SSH_CHANNEL_X11_LISTENER:
 		case SSH_CHANNEL_PORT_LISTENER:
 		case SSH_CHANNEL_RPORT_LISTENER:
@@ -1797,7 +1813,8 @@ channel_request_forwarding(
     const char *host_to_connect, u_short port_to_connect,
     int gateway_ports, int remote_fwd)
 {
-	int success, ch, sock, on = 1, ctype;
+	Channel *c;
+	int success, sock, on = 1, ctype;
 	struct addrinfo hints, *ai, *aitop;
 	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
 	const char *host;
@@ -1813,7 +1830,7 @@ channel_request_forwarding(
 		ctype  =SSH_CHANNEL_PORT_LISTENER;
 	}
 
-	if (strlen(host) > sizeof(channels[0].path) - 1) {
+	if (strlen(host) > SSH_CHANNEL_PATH_LEN - 1) {
 		error("Forward host name too long.");
 		return success;
 	}
@@ -1874,12 +1891,17 @@ channel_request_forwarding(
 			continue;
 		}
 		/* Allocate a channel number for the socket. */
-		ch = channel_new("port listener", ctype, sock, sock, -1,
+		c = channel_new("port listener", ctype, sock, sock, -1,
 		    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
 		    0, xstrdup("port listener"), 1);
-		strlcpy(channels[ch].path, host, sizeof(channels[ch].path));
-		channels[ch].host_port = port_to_connect;
-		channels[ch].listening_port = listen_port;
+		if (c == NULL) {
+			error("channel_request_forwarding: channel_new failed");
+			close(sock);
+			continue;
+		}
+		strlcpy(c->path, host, sizeof(c->path));
+		c->host_port = port_to_connect;
+		c->listening_port = listen_port;
 		success = 1;
 	}
 	if (success == 0)
@@ -2116,11 +2138,12 @@ channel_connect_to(const char *host, u_short port)
 void
 channel_input_port_open(int type, int plen, void *ctxt)
 {
+	Channel *c = NULL;
 	u_short host_port;
 	char *host, *originator_string;
-	int remote_channel, sock = -1, newch;
+	int remote_id, sock = -1;
 
-	remote_channel = packet_get_int();
+	remote_id = packet_get_int();
 	host = packet_get_string(NULL);
 	host_port = packet_get_int();
 
@@ -2132,20 +2155,26 @@ channel_input_port_open(int type, int plen, void *ctxt)
 	packet_done();
 	sock = channel_connect_to(host, host_port);
 	if (sock != -1) {
-		newch = channel_allocate(SSH_CHANNEL_CONNECTING,
-		    sock, originator_string);
-		channels[newch].remote_id = remote_channel;
-
+		c = channel_new("connected socket",
+		    SSH_CHANNEL_CONNECTING, sock, sock, -1, 0, 0, 0,
+		    originator_string, 1);
+		if (c == NULL) {
+			error("channel_input_port_open: channel_new failed");
+			close(sock);
+		} else {
+			c->remote_id = remote_id;
+		}
+	}
+	if (c == NULL) {
+		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
+		packet_put_int(remote_id);
+	} else {
 		/*XXX delay answer? */
 		packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
-		packet_put_int(remote_channel);
-		packet_put_int(newch);
-		packet_send();
-	} else {
-		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-		packet_put_int(remote_channel);
-		packet_send();
+		packet_put_int(remote_id);
+		packet_put_int(c->self);
 	}
+	packet_send();
 	xfree(host);
 }
 
@@ -2430,46 +2459,45 @@ x11_connect_display(void)
 void
 x11_input_open(int type, int plen, void *ctxt)
 {
-	int remote_channel, sock = 0, newch;
+	Channel *c = NULL;
+	int remote_id, sock = 0;
 	char *remote_host;
-	u_int remote_len;
 
-	/* Get remote channel number. */
-	remote_channel = packet_get_int();
+	debug("Received X11 open request.");
 
-	/* Get remote originator name. */
+	remote_id = packet_get_int();
 	if (have_hostname_in_open) {
-		remote_host = packet_get_string(&remote_len);
-		remote_len += 4;
+		remote_host = packet_get_string(NULL);
 	} else {
 		remote_host = xstrdup("unknown (remote did not supply name)");
-		remote_len = 0;
 	}
-
-	debug("Received X11 open request.");
-	packet_integrity_check(plen, 4 + remote_len, SSH_SMSG_X11_OPEN);
+	packet_done();
 
 	/* Obtain a connection to the real X display. */
 	sock = x11_connect_display();
-	if (sock == -1) {
+	if (sock != -1) {
+		/* Allocate a channel for this connection. */
+		c = channel_new("connected x11 socket",
+		    SSH_CHANNEL_X11_OPEN, sock, sock, -1, 0, 0, 0,
+		    remote_host, 1);
+		if (c == NULL) {
+			error("x11_input_open: channel_new failed");
+			close(sock);
+		} else {
+			c->remote_id = remote_id;
+		}
+	}
+	if (c == NULL) {
 		/* Send refusal to the remote host. */
 		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-		packet_put_int(remote_channel);
-		packet_send();
+		packet_put_int(remote_id);
 	} else {
-		/* Allocate a channel for this connection. */
-		newch = channel_allocate(
-		     (x11_saved_proto == NULL) ?
-		     SSH_CHANNEL_OPEN : SSH_CHANNEL_X11_OPEN,
-		     sock, remote_host);
-		channels[newch].remote_id = remote_channel;
-
 		/* Send a confirmation to the remote host. */
 		packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
-		packet_put_int(remote_channel);
-		packet_put_int(newch);
-		packet_send();
+		packet_put_int(remote_id);
+		packet_put_int(c->self);
 	}
+	packet_send();
 }
 
 /* dummy protocol handler that denies SSH-1 requests (agent/x11) */
@@ -2602,7 +2630,8 @@ cleanup_socket(void)
 int
 auth_input_request_forwarding(struct passwd * pw)
 {
-	int sock, newch;
+	Channel *nc;
+	int sock;
 	struct sockaddr_un sunaddr;
 
 	if (auth_get_socket_name() != NULL)
@@ -2657,13 +2686,16 @@ auth_input_request_forwarding(struct passwd * pw)
 		packet_disconnect("listen: %.100s", strerror(errno));
 
 	/* Allocate a channel for the authentication agent socket. */
-	newch = channel_new("auth socket",
+	nc = channel_new("auth socket",
 	    SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
 	    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
 	    0, xstrdup("auth socket"), 1);
-
-	strlcpy(channels[newch].path, channel_forwarded_auth_socket_name,
-	    sizeof(channels[newch].path));
+	if (nc == NULL) {
+		error("auth_input_request_forwarding: channel_new failed");
+		close(sock);
+		return 0;
+	}
+	strlcpy(nc->path, channel_forwarded_auth_socket_name, sizeof(nc->path));
 	return 1;
 }
 
@@ -2672,13 +2704,14 @@ auth_input_request_forwarding(struct passwd * pw)
 void
 auth_input_open_request(int type, int plen, void *ctxt)
 {
-	int remch, sock, newch;
+	Channel *c = NULL;
+	int remote_id, sock;
 	char *dummyname;
 
 	packet_integrity_check(plen, 4, type);
 
 	/* Read the remote channel number from the message. */
-	remch = packet_get_int();
+	remote_id = packet_get_int();
 
 	/*
 	 * Get a connection to the local authentication agent (this may again
@@ -2692,28 +2725,26 @@ auth_input_open_request(int type, int plen, void *ctxt)
 	 * because authentication forwarding is only enabled if we have an
 	 * agent.
 	 */
-	if (sock < 0) {
+	if (sock >= 0) {
+		dummyname = xstrdup("authentication agent connection");
+		c = channel_new("", SSH_CHANNEL_OPEN, sock, sock, -1, 0, 0, 0, dummyname, 1);
+		if (c == NULL) {
+			error("auth_input_open_request: channel_new failed");
+			close(sock);
+		} else {
+			c->remote_id = remote_id;
+		}
+	}
+	if (c == NULL) {
 		packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE);
-		packet_put_int(remch);
-		packet_send();
-		return;
+		packet_put_int(remote_id);
+	} else {
+		/* Send a confirmation to the remote host. */
+		debug("Forwarding authentication connection.");
+		packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
+		packet_put_int(remote_id);
+		packet_put_int(c->self);
 	}
-	debug("Forwarding authentication connection.");
-
-	/*
-	 * Dummy host name.  This will be freed when the channel is freed; it
-	 * will still be valid in the packet_put_string below since the
-	 * channel cannot yet be freed at that point.
-	 */
-	dummyname = xstrdup("authentication agent connection");
-
-	newch = channel_allocate(SSH_CHANNEL_OPEN, sock, dummyname);
-	channels[newch].remote_id = remch;
-
-	/* Send a confirmation to the remote host. */
-	packet_start(SSH_MSG_CHANNEL_OPEN_CONFIRMATION);
-	packet_put_int(remch);
-	packet_put_int(newch);
 	packet_send();
 }