upstream commit

refactor channels.c

Move static state to a "struct ssh_channels" that is allocated at
runtime and tracked as a member of struct ssh.

Explicitly pass "struct ssh" to all channels functions.

Replace use of the legacy packet APIs in channels.c.

Rework sshd_config PermitOpen handling: previously the configuration
parser would call directly into the channels layer. After the refactor
this is not possible, as the channels structures are allocated at
connection time and aren't available when the configuration is parsed.
The server config parser now tracks PermitOpen itself and explicitly
configures the channels code later.

ok markus@

Upstream-ID: 11828f161656b965cc306576422613614bea2d8f

1 files changed, 100 insertions, 91 deletions

diff --git a/clientloop.c b/clientloop.c
index 2934c476..1218b3b7 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.302 2017/08/30 03:59:08 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.303 2017/09/12 06:32:07 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -177,6 +177,7 @@ struct channel_reply_ctx {
 };
 
 /* Global request success/failure callbacks */
+/* XXX move to struct ssh? */
 struct global_confirm {
 	TAILQ_ENTRY(global_confirm) entry;
 	global_confirm_cb *cb;
@@ -244,13 +245,13 @@ get_current_time(void)
  * control master process, or if there is no ControlPersist timeout.
  */
 static void
-set_control_persist_exit_time(void)
+set_control_persist_exit_time(struct ssh *ssh)
 {
 	if (muxserver_sock == -1 || !options.control_persist
 	    || options.control_persist_timeout == 0) {
 		/* not using a ControlPersist timeout */
 		control_persist_exit_time = 0;
-	} else if (channel_still_open()) {
+	} else if (channel_still_open(ssh)) {
 		/* some client connections are still open */
 		if (control_persist_exit_time > 0)
 			debug2("%s: cancel scheduled exit", __func__);
@@ -288,8 +289,9 @@ client_x11_display_valid(const char *display)
 #define SSH_X11_PROTO		"MIT-MAGIC-COOKIE-1"
 #define X11_TIMEOUT_SLACK	60
 int
-client_x11_get_proto(const char *display, const char *xauth_path,
-    u_int trusted, u_int timeout, char **_proto, char **_data)
+client_x11_get_proto(struct ssh *ssh, const char *display,
+    const char *xauth_path, u_int trusted, u_int timeout,
+    char **_proto, char **_data)
 {
 	char cmd[1024], line[512], xdisplay[512];
 	char xauthfile[PATH_MAX], xauthdir[PATH_MAX];
@@ -373,7 +375,8 @@ client_x11_get_proto(const char *display, const char *xauth_path,
 					x11_refuse_time = UINT_MAX;
 				else
 					x11_refuse_time = now + timeout;
-				channel_set_x11_refuse_time(x11_refuse_time);
+				channel_set_x11_refuse_time(ssh,
+				    x11_refuse_time);
 			}
 			if (system(cmd) == 0)
 				generated = 1;
@@ -446,7 +449,7 @@ client_x11_get_proto(const char *display, const char *xauth_path,
  */
 
 static void
-client_check_window_change(void)
+client_check_window_change(struct ssh *ssh)
 {
 	if (!received_window_change_signal)
 		return;
@@ -455,7 +458,7 @@ client_check_window_change(void)
 
 	debug2("%s: changed", __func__);
 
-	channel_send_window_changes();
+	channel_send_window_changes(ssh);
 }
 
 static int
@@ -466,7 +469,7 @@ client_global_request_reply(int type, u_int32_t seq, struct ssh *ssh)
 	if ((gc = TAILQ_FIRST(&global_confirms)) == NULL)
 		return 0;
 	if (gc->cb != NULL)
-		gc->cb(type, seq, gc->ctx);
+		gc->cb(ssh, type, seq, gc->ctx);
 	if (--gc->ref_count <= 0) {
 		TAILQ_REMOVE(&global_confirms, gc, entry);
 		explicit_bzero(gc, sizeof(*gc));
@@ -497,7 +500,8 @@ server_alive_check(void)
  * one of the file descriptors).
  */
 static void
-client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp,
+client_wait_until_can_do_something(struct ssh *ssh,
+    fd_set **readsetp, fd_set **writesetp,
     int *maxfdp, u_int *nallocp, int rekeying)
 {
 	struct timeval tv, *tvp;
@@ -510,7 +514,7 @@ client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp,
 	    nallocp, &minwait_secs);
 
 	/* channel_prepare_select could have closed the last channel */
-	if (session_closed && !channel_still_open() &&
+	if (session_closed && !channel_still_open(ssh) &&
 	    !packet_have_data_to_write()) {
 		/* clear mask since we did not call select() */
 		memset(*readsetp, 0, *nallocp);
@@ -537,7 +541,7 @@ client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp,
 	}
 	if (options.rekey_interval > 0 && !rekeying)
 		timeout_secs = MINIMUM(timeout_secs, packet_get_rekey_timeout());
-	set_control_persist_exit_time();
+	set_control_persist_exit_time(ssh);
 	if (control_persist_exit_time > 0) {
 		timeout_secs = MINIMUM(timeout_secs,
 			control_persist_exit_time - now);
@@ -668,7 +672,7 @@ client_process_net_input(fd_set *readset)
 }
 
 static void
-client_status_confirm(int type, Channel *c, void *ctx)
+client_status_confirm(struct ssh *ssh, int type, Channel *c, void *ctx)
 {
 	struct channel_reply_ctx *cr = (struct channel_reply_ctx *)ctx;
 	char errmsg[256];
@@ -707,8 +711,7 @@ client_status_confirm(int type, Channel *c, void *ctx)
 		 * their stderr.
 		 */
 		if (tochan) {
-			buffer_append(&c->extended, errmsg,
-			    strlen(errmsg));
+			buffer_append(c->extended, errmsg, strlen(errmsg));
 		} else
 			error("%s", errmsg);
 		if (cr->action == CONFIRM_TTY) {
@@ -719,23 +722,23 @@ client_status_confirm(int type, Channel *c, void *ctx)
 			if (c->self == session_ident)
 				leave_raw_mode(0);
 			else
-				mux_tty_alloc_failed(c);
+				mux_tty_alloc_failed(ssh, c);
 		} else if (cr->action == CONFIRM_CLOSE) {
-			chan_read_failed(c);
-			chan_write_failed(c);
+			chan_read_failed(ssh, c);
+			chan_write_failed(ssh, c);
 		}
 	}
 	free(cr);
 }
 
 static void
-client_abandon_status_confirm(Channel *c, void *ctx)
+client_abandon_status_confirm(struct ssh *ssh, Channel *c, void *ctx)
 {
 	free(ctx);
 }
 
 void
-client_expect_confirm(int id, const char *request,
+client_expect_confirm(struct ssh *ssh, int id, const char *request,
     enum confirm_action action)
 {
 	struct channel_reply_ctx *cr = xcalloc(1, sizeof(*cr));
@@ -743,7 +746,7 @@ client_expect_confirm(int id, const char *request,
 	cr->request_type = request;
 	cr->action = action;
 
-	channel_register_status_confirm(id, client_status_confirm,
+	channel_register_status_confirm(ssh, id, client_status_confirm,
 	    client_abandon_status_confirm, cr);
 }
 
@@ -769,7 +772,7 @@ client_register_global_confirm(global_confirm_cb *cb, void *ctx)
 }
 
 static void
-process_cmdline(void)
+process_cmdline(struct ssh *ssh)
 {
 	void (*handler)(int);
 	char *s, *cmd;
@@ -843,12 +846,12 @@ process_cmdline(void)
 			goto out;
 		}
 		if (remote)
-			ok = channel_request_rforward_cancel(&fwd) == 0;
+			ok = channel_request_rforward_cancel(ssh, &fwd) == 0;
 		else if (dynamic)
-			ok = channel_cancel_lport_listener(&fwd,
+			ok = channel_cancel_lport_listener(ssh, &fwd,
 			    0, &options.fwd_opts) > 0;
 		else
-			ok = channel_cancel_lport_listener(&fwd,
+			ok = channel_cancel_lport_listener(ssh, &fwd,
 			    CHANNEL_CANCEL_PORT_STATIC,
 			    &options.fwd_opts) > 0;
 		if (!ok) {
@@ -862,13 +865,13 @@ process_cmdline(void)
 			goto out;
 		}
 		if (local || dynamic) {
-			if (!channel_setup_local_fwd_listener(&fwd,
+			if (!channel_setup_local_fwd_listener(ssh, &fwd,
 			    &options.fwd_opts)) {
 				logit("Port forwarding failed.");
 				goto out;
 			}
 		} else {
-			if (channel_request_remote_forwarding(&fwd) < 0) {
+			if (channel_request_remote_forwarding(ssh, &fwd) < 0) {
 				logit("Port forwarding failed.");
 				goto out;
 			}
@@ -945,7 +948,8 @@ print_escape_help(Buffer *b, int escape_char, int mux_client, int using_stderr)
  * Process the characters one by one.
  */
 static int
-process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
+process_escapes(struct ssh *ssh, Channel *c,
+    Buffer *bin, Buffer *bout, Buffer *berr,
     char *buf, int len)
 {
 	char string[1024];
@@ -981,13 +985,15 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
 				buffer_append(berr, string, strlen(string));
 
 				if (c && c->ctl_chan != -1) {
-					chan_read_failed(c);
-					chan_write_failed(c);
-					if (c->detach_user)
-						c->detach_user(c->self, NULL);
+					chan_read_failed(ssh, c);
+					chan_write_failed(ssh, c);
+					if (c->detach_user) {
+						c->detach_user(ssh,
+						    c->self, NULL);
+					}
 					c->type = SSH_CHANNEL_ABANDONED;
-					buffer_clear(&c->input);
-					chan_ibuf_empty(c);
+					buffer_clear(c->input);
+					chan_ibuf_empty(ssh, c);
 					return 0;
 				} else
 					quit_pending = 1;
@@ -1025,7 +1031,7 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
 				snprintf(string, sizeof string,
 				    "%cB\r\n", efc->escape_char);
 				buffer_append(berr, string, strlen(string));
-				channel_request_start(c->self, "break", 0);
+				channel_request_start(ssh, c->self, "break", 0);
 				packet_put_int(1000);
 				packet_send();
 				continue;
@@ -1077,7 +1083,7 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
 				    options.request_tty == REQUEST_TTY_FORCE);
 
 				/* Stop listening for new connections. */
-				channel_stop_listening();
+				channel_stop_listening(ssh);
 
 				snprintf(string, sizeof string,
 				    "%c& [backgrounded]\n", efc->escape_char);
@@ -1107,7 +1113,7 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
 				snprintf(string, sizeof string, "%c#\r\n",
 				    efc->escape_char);
 				buffer_append(berr, string, strlen(string));
-				s = channel_open_message();
+				s = channel_open_message(ssh);
 				buffer_append(berr, s, strlen(s));
 				free(s);
 				continue;
@@ -1115,7 +1121,7 @@ process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr,
 			case 'C':
 				if (c && c->ctl_chan != -1)
 					goto noescape;
-				process_cmdline();
+				process_cmdline(ssh);
 				continue;
 
 			default:
@@ -1186,25 +1192,25 @@ client_new_escape_filter_ctx(int escape_char)
 
 /* Free the escape filter context on channel free */
 void
-client_filter_cleanup(int cid, void *ctx)
+client_filter_cleanup(struct ssh *ssh, int cid, void *ctx)
 {
 	free(ctx);
 }
 
 int
-client_simple_escape_filter(Channel *c, char *buf, int len)
+client_simple_escape_filter(struct ssh *ssh, Channel *c, char *buf, int len)
 {
 	if (c->extended_usage != CHAN_EXTENDED_WRITE)
 		return 0;
 
-	return process_escapes(c, &c->input, &c->output, &c->extended,
+	return process_escapes(ssh, c, c->input, c->output, c->extended,
 	    buf, len);
 }
 
 static void
-client_channel_closed(int id, void *arg)
+client_channel_closed(struct ssh *ssh, int id, void *arg)
 {
-	channel_cancel_cleanup(id);
+	channel_cancel_cleanup(ssh, id);
 	session_closed = 1;
 	leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
 }
@@ -1215,9 +1221,9 @@ client_channel_closed(int id, void *arg)
  * remote host.  If escape_char != SSH_ESCAPECHAR_NONE, it is the character
  * used as an escape character for terminating or suspending the session.
  */
-
 int
-client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
+client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
+    int ssh2_chan_id)
 {
 	fd_set *readset = NULL, *writeset = NULL;
 	double start_time, total_time;
@@ -1295,13 +1301,13 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 	session_ident = ssh2_chan_id;
 	if (session_ident != -1) {
 		if (escape_char_arg != SSH_ESCAPECHAR_NONE) {
-			channel_register_filter(session_ident,
+			channel_register_filter(ssh, session_ident,
 			    client_simple_escape_filter, NULL,
 			    client_filter_cleanup,
 			    client_new_escape_filter_ctx(
 			    escape_char_arg));
 		}
-		channel_register_cleanup(session_ident,
+		channel_register_cleanup(ssh, session_ident,
 		    client_channel_closed, 0);
 	}
 
@@ -1311,15 +1317,15 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 		/* Process buffered packets sent by the server. */
 		client_process_buffered_input_packets();
 
-		if (session_closed && !channel_still_open())
+		if (session_closed && !channel_still_open(ssh))
 			break;
 
-		if (ssh_packet_is_rekeying(active_state)) {
+		if (ssh_packet_is_rekeying(ssh)) {
 			debug("rekeying in progress");
 		} else if (need_rekeying) {
 			/* manual rekey request */
 			debug("need rekeying");
-			if ((r = kex_start_rekex(active_state)) != 0)
+			if ((r = kex_start_rekex(ssh)) != 0)
 				fatal("%s: kex_start_rekex: %s", __func__,
 				    ssh_err(r));
 			need_rekeying = 0;
@@ -1329,13 +1335,13 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 			 * enqueue them for sending to the server.
 			 */
 			if (packet_not_very_much_data_to_write())
-				channel_output_poll();
+				channel_output_poll(ssh);
 
 			/*
 			 * Check if the window size has changed, and buffer a
 			 * message about it to the server if so.
 			 */
-			client_check_window_change();
+			client_check_window_change(ssh);
 
 			if (quit_pending)
 				break;
@@ -1345,15 +1351,15 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 		 * available on one of the descriptors).
 		 */
 		max_fd2 = max_fd;
-		client_wait_until_can_do_something(&readset, &writeset,
-		    &max_fd2, &nalloc, ssh_packet_is_rekeying(active_state));
+		client_wait_until_can_do_something(ssh, &readset, &writeset,
+		    &max_fd2, &nalloc, ssh_packet_is_rekeying(ssh));
 
 		if (quit_pending)
 			break;
 
 		/* Do channel operations unless rekeying in progress. */
-		if (!ssh_packet_is_rekeying(active_state))
-			channel_after_select(active_state, readset, writeset);
+		if (!ssh_packet_is_rekeying(ssh))
+			channel_after_select(ssh, readset, writeset);
 
 		/* Buffer input from the connection.  */
 		client_process_net_input(readset);
@@ -1395,7 +1401,7 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 	packet_send();
 	packet_write_wait();
 
-	channel_free_all();
+	channel_free_all(ssh);
 
 	if (have_pty)
 		leave_raw_mode(options.request_tty == REQUEST_TTY_FORCE);
@@ -1463,8 +1469,8 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 /*********/
 
 static Channel *
-client_request_forwarded_tcpip(const char *request_type, int rchan,
-    u_int rwindow, u_int rmaxpack)
+client_request_forwarded_tcpip(struct ssh *ssh, const char *request_type,
+    int rchan, u_int rwindow, u_int rmaxpack)
 {
 	Channel *c = NULL;
 	struct sshbuf *b = NULL;
@@ -1482,7 +1488,7 @@ client_request_forwarded_tcpip(const char *request_type, int rchan,
 	debug("%s: listen %s port %d, originator %s port %d", __func__,
 	    listen_address, listen_port, originator_address, originator_port);
 
-	c = channel_connect_by_listen_address(listen_address, listen_port,
+	c = channel_connect_by_listen_address(ssh, listen_address, listen_port,
 	    "forwarded-tcpip", originator_address);
 
 	if (c != NULL && c->type == SSH_CHANNEL_MUX_CLIENT) {
@@ -1501,7 +1507,7 @@ client_request_forwarded_tcpip(const char *request_type, int rchan,
 		    (r = sshbuf_put_u32(b, listen_port)) != 0 ||
 		    (r = sshbuf_put_cstring(b, originator_address)) != 0 ||
 		    (r = sshbuf_put_u32(b, originator_port)) != 0 ||
-		    (r = sshbuf_put_stringb(&c->output, b)) != 0) {
+		    (r = sshbuf_put_stringb(c->output, b)) != 0) {
 			error("%s: compose for muxclient %s", __func__,
 			    ssh_err(r));
 			goto out;
@@ -1516,7 +1522,8 @@ client_request_forwarded_tcpip(const char *request_type, int rchan,
 }
 
 static Channel *
-client_request_forwarded_streamlocal(const char *request_type, int rchan)
+client_request_forwarded_streamlocal(struct ssh *ssh,
+    const char *request_type, int rchan)
 {
 	Channel *c = NULL;
 	char *listen_path;
@@ -1530,14 +1537,14 @@ client_request_forwarded_streamlocal(const char *request_type, int rchan)
 
 	debug("%s: %s", __func__, listen_path);
 
-	c = channel_connect_by_listen_path(listen_path,
+	c = channel_connect_by_listen_path(ssh, listen_path,
 	    "forwarded-streamlocal@openssh.com", "forwarded-streamlocal");
 	free(listen_path);
 	return c;
 }
 
 static Channel *
-client_request_x11(const char *request_type, int rchan)
+client_request_x11(struct ssh *ssh, const char *request_type, int rchan)
 {
 	Channel *c = NULL;
 	char *originator;
@@ -1567,10 +1574,10 @@ client_request_x11(const char *request_type, int rchan)
 	debug("client_request_x11: request from %s %d", originator,
 	    originator_port);
 	free(originator);
-	sock = x11_connect_display();
+	sock = x11_connect_display(ssh);
 	if (sock < 0)
 		return NULL;
-	c = channel_new("x11",
+	c = channel_new(ssh, "x11",
 	    SSH_CHANNEL_X11_OPEN, sock, sock, -1,
 	    CHAN_TCP_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT, 0, "x11", 1);
 	c->force_drain = 1;
@@ -1578,7 +1585,7 @@ client_request_x11(const char *request_type, int rchan)
 }
 
 static Channel *
-client_request_agent(const char *request_type, int rchan)
+client_request_agent(struct ssh *ssh, const char *request_type, int rchan)
 {
 	Channel *c = NULL;
 	int r, sock;
@@ -1595,7 +1602,7 @@ client_request_agent(const char *request_type, int rchan)
 			    __func__, ssh_err(r));
 		return NULL;
 	}
-	c = channel_new("authentication agent connection",
+	c = channel_new(ssh, "authentication agent connection",
 	    SSH_CHANNEL_OPEN, sock, sock, -1,
 	    CHAN_X11_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0,
 	    "authentication agent connection", 1);
@@ -1604,7 +1611,8 @@ client_request_agent(const char *request_type, int rchan)
 }
 
 int
-client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun)
+client_request_tun_fwd(struct ssh *ssh, int tun_mode,
+    int local_tun, int remote_tun)
 {
 	Channel *c;
 	int fd;
@@ -1620,7 +1628,7 @@ client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun)
 		return -1;
 	}
 
-	c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
+	c = channel_new(ssh, "tun", SSH_CHANNEL_OPENING, fd, fd, -1,
 	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
 	c->datagram = 1;
 
@@ -1660,14 +1668,14 @@ client_input_channel_open(int type, u_int32_t seq, struct ssh *ssh)
 	    ctype, rchan, rwindow, rmaxpack);
 
 	if (strcmp(ctype, "forwarded-tcpip") == 0) {
-		c = client_request_forwarded_tcpip(ctype, rchan, rwindow,
+		c = client_request_forwarded_tcpip(ssh, ctype, rchan, rwindow,
 		    rmaxpack);
 	} else if (strcmp(ctype, "forwarded-streamlocal@openssh.com") == 0) {
-		c = client_request_forwarded_streamlocal(ctype, rchan);
+		c = client_request_forwarded_streamlocal(ssh, ctype, rchan);
 	} else if (strcmp(ctype, "x11") == 0) {
-		c = client_request_x11(ctype, rchan);
+		c = client_request_x11(ssh, ctype, rchan);
 	} else if (strcmp(ctype, "auth-agent@openssh.com") == 0) {
-		c = client_request_agent(ctype, rchan);
+		c = client_request_agent(ssh, ctype, rchan);
 	}
 	if (c != NULL && c->type == SSH_CHANNEL_MUX_CLIENT) {
 		debug3("proxied to downstream: %s", ctype);
@@ -1707,7 +1715,7 @@ client_input_channel_req(int type, u_int32_t seq, struct ssh *ssh)
 	char *rtype;
 
 	id = packet_get_int();
-	c = channel_lookup(id);
+	c = channel_lookup(ssh, id);
 	if (channel_proxy_upstream(c, type, seq, ssh))
 		return 0;
 	rtype = packet_get_string(NULL);
@@ -1723,11 +1731,11 @@ client_input_channel_req(int type, u_int32_t seq, struct ssh *ssh)
 		    "unknown channel", id);
 	} else if (strcmp(rtype, "eow@openssh.com") == 0) {
 		packet_check_eom();
-		chan_rcvd_eow(c);
+		chan_rcvd_eow(ssh, c);
 	} else if (strcmp(rtype, "exit-status") == 0) {
 		exitval = packet_get_int();
 		if (c->ctl_chan != -1) {
-			mux_exit_message(c, exitval);
+			mux_exit_message(ssh, c, exitval);
 			success = 1;
 		} else if (id == session_ident) {
 			/* Record exit value of local session */
@@ -1895,9 +1903,9 @@ update_known_hosts(struct hostkeys_update_ctx *ctx)
 }
 
 static void
-client_global_hostkeys_private_confirm(int type, u_int32_t seq, void *_ctx)
+client_global_hostkeys_private_confirm(struct ssh *ssh, int type,
+    u_int32_t seq, void *_ctx)
 {
-	struct ssh *ssh = active_state; /* XXX */
 	struct hostkeys_update_ctx *ctx = (struct hostkeys_update_ctx *)_ctx;
 	size_t i, ndone;
 	struct sshbuf *signdata;
@@ -2161,7 +2169,7 @@ client_input_global_request(int type, u_int32_t seq, struct ssh *ssh)
 }
 
 void
-client_session2_setup(int id, int want_tty, int want_subsystem,
+client_session2_setup(struct ssh *ssh, int id, int want_tty, int want_subsystem,
     const char *term, struct termios *tiop, int in_fd, Buffer *cmd, char **env)
 {
 	int len;
@@ -2169,8 +2177,8 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
 
 	debug2("%s: id %d", __func__, id);
 
-	if ((c = channel_lookup(id)) == NULL)
-		fatal("client_session2_setup: channel %d: unknown channel", id);
+	if ((c = channel_lookup(ssh, id)) == NULL)
+		fatal("%s: channel %d: unknown channel", __func__, id);
 
 	packet_set_interactive(want_tty,
 	    options.ip_qos_interactive, options.ip_qos_bulk);
@@ -2182,8 +2190,8 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
 		if (ioctl(in_fd, TIOCGWINSZ, &ws) < 0)
 			memset(&ws, 0, sizeof(ws));
 
-		channel_request_start(id, "pty-req", 1);
-		client_expect_confirm(id, "PTY allocation", CONFIRM_TTY);
+		channel_request_start(ssh, id, "pty-req", 1);
+		client_expect_confirm(ssh, id, "PTY allocation", CONFIRM_TTY);
 		packet_put_cstring(term != NULL ? term : "");
 		packet_put_int((u_int)ws.ws_col);
 		packet_put_int((u_int)ws.ws_row);
@@ -2226,7 +2234,7 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
 			}
 
 			debug("Sending env %s = %s", name, val);
-			channel_request_start(id, "env", 0);
+			channel_request_start(ssh, id, "env", 0);
 			packet_put_cstring(name);
 			packet_put_cstring(val);
 			packet_send();
@@ -2241,19 +2249,20 @@ client_session2_setup(int id, int want_tty, int want_subsystem,
 		if (want_subsystem) {
 			debug("Sending subsystem: %.*s",
 			    len, (u_char*)buffer_ptr(cmd));
-			channel_request_start(id, "subsystem", 1);
-			client_expect_confirm(id, "subsystem", CONFIRM_CLOSE);
+			channel_request_start(ssh, id, "subsystem", 1);
+			client_expect_confirm(ssh, id, "subsystem",
+			    CONFIRM_CLOSE);
 		} else {
 			debug("Sending command: %.*s",
 			    len, (u_char*)buffer_ptr(cmd));
-			channel_request_start(id, "exec", 1);
-			client_expect_confirm(id, "exec", CONFIRM_CLOSE);
+			channel_request_start(ssh, id, "exec", 1);
+			client_expect_confirm(ssh, id, "exec", CONFIRM_CLOSE);
 		}
 		packet_put_string(buffer_ptr(cmd), buffer_len(cmd));
 		packet_send();
 	} else {
-		channel_request_start(id, "shell", 1);
-		client_expect_confirm(id, "shell", CONFIRM_CLOSE);
+		channel_request_start(ssh, id, "shell", 1);
+		client_expect_confirm(ssh, id, "shell", CONFIRM_CLOSE);
 		packet_send();
 	}
 }