ttssh2/ttxssh/ssh.c

/*
 * Copyright (c) 1998-2001, Robert O'Callahan
 * (C) 2004-2017 TeraTerm Project
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "ttxssh.h"
#include "util.h"
#include "resource.h"
#include "libputty.h"
#include "key.h"
#include "ttcommon.h"

#include <openssl/bn.h>
#include <openssl/evp.h>
#include <openssl/dh.h>
#include <openssl/engine.h>
#include <openssl/rsa.h>
#include <openssl/dsa.h>
#include <openssl/md5.h>
#include <limits.h>
#include <malloc.h>
#include <string.h>
#include <stdlib.h>
#include <process.h>
#include <time.h>
#include <commctrl.h>
#include "buffer.h"
#include "ssh.h"
#include "crypt.h"
#include "fwd.h"
#include "sftp.h"
#include "kex.h"
#include "dlglib.h"

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/utime.h>
#include <assert.h>

#include <direct.h>
#include <io.h>

// SSH2 macro
#ifdef _DEBUG
#define SSH2_DEBUG
#endif

//#define DONT_WANTCONFIRM 1  // (2005.3.28 yutaka)
#undef DONT_WANTCONFIRM // (2008.11.25 maya)

//
// SSH2 data structure
//

// channel data structure
#define CHANNEL_MAX 100

//
// msg �� NULL �����������������BNULL �������� "(null)" �������B
//
#define NonNull(msg) ((msg)?(msg):"(null)")

typedef enum {
        GetPayloadError = 0,
        GetPayloadOK = 1,
        GetPayloadTruncate = 2
} PayloadStat;

static struct global_confirm global_confirms;

static Channel_t channels[CHANNEL_MAX];

static char ssh_ttymodes[] = "\x01\x03\x02\x1c\x03\x08\x04\x15\x05\x04";

static CRITICAL_SECTION g_ssh_scp_lock;   /* SCP���M�p���b�N */

static void try_send_credentials(PTInstVar pvar);
static void prep_compression(PTInstVar pvar);

// �����v���g�^�C�v����
void SSH2_send_kexinit(PTInstVar pvar);
static BOOL handle_SSH2_kexinit(PTInstVar pvar);
static void SSH2_dh_kex_init(PTInstVar pvar);
static void SSH2_dh_gex_kex_init(PTInstVar pvar);
static void SSH2_ecdh_kex_init(PTInstVar pvar);
static BOOL handle_SSH2_dh_common_reply(PTInstVar pvar);
static BOOL handle_SSH2_dh_gex_reply(PTInstVar pvar);
static BOOL handle_SSH2_newkeys(PTInstVar pvar);
static BOOL handle_SSH2_service_accept(PTInstVar pvar);
static BOOL handle_SSH2_userauth_success(PTInstVar pvar);
static BOOL handle_SSH2_userauth_failure(PTInstVar pvar);
static BOOL handle_SSH2_userauth_banner(PTInstVar pvar);
static BOOL handle_SSH2_open_confirm(PTInstVar pvar);
static BOOL handle_SSH2_open_failure(PTInstVar pvar);
static BOOL handle_SSH2_client_global_request(PTInstVar pvar);
static BOOL handle_SSH2_request_success(PTInstVar pvar);
static BOOL handle_SSH2_request_failure(PTInstVar pvar);
static BOOL handle_SSH2_channel_success(PTInstVar pvar);
static BOOL handle_SSH2_channel_failure(PTInstVar pvar);
static BOOL handle_SSH2_channel_data(PTInstVar pvar);
static BOOL handle_SSH2_channel_extended_data(PTInstVar pvar);
static BOOL handle_SSH2_channel_eof(PTInstVar pvar);
static BOOL handle_SSH2_channel_close(PTInstVar pvar);
static BOOL handle_SSH2_channel_open(PTInstVar pvar);
static BOOL handle_SSH2_window_adjust(PTInstVar pvar);
static BOOL handle_SSH2_channel_request(PTInstVar pvar);
void SSH2_dispatch_init(int stage);
int SSH2_dispatch_enabled_check(unsigned char message);
void SSH2_dispatch_add_message(unsigned char message);
void SSH2_dispatch_add_range_message(unsigned char begin, unsigned char end);
int dh_pub_is_valid(DH *dh, BIGNUM *dh_pub);
static void start_ssh_heartbeat_thread(PTInstVar pvar);
void ssh2_channel_send_close(PTInstVar pvar, Channel_t *c);
static BOOL SSH_agent_response(PTInstVar pvar, Channel_t *c, int local_channel_num, unsigned char *data, unsigned int buflen);
static void ssh2_scp_get_packetlist(Channel_t *c, unsigned char **buf, unsigned int *buflen);
static void ssh2_scp_free_packetlist(Channel_t *c);
static void get_window_pixel_size(PTInstVar pvar, int *x, int *y);

// �}�N��
#define remained_payload(pvar) ((pvar)->ssh_state.payload + payload_current_offset(pvar))
#define remained_payloadlen(pvar) ((pvar)->ssh_state.payloadlen - (pvar)->ssh_state.payload_grabbed)
#define payload_current_offset(pvar) ((pvar)->ssh_state.payload_grabbed - 1)

//
// Global request confirm
//
static void client_init_global_confirm(void)
{
        memset(&global_confirms, 0, sizeof(global_confirms));
        global_confirms.ref_count = 0;
}

void client_register_global_confirm(global_confirm_cb *cb, void *ctx)
{
        struct global_confirm *gc = &global_confirms;

        if (gc->ref_count == 0) {
                gc->cb = cb;
                gc->ctx = ctx;
                gc->ref_count = 1;
        }
}

static int client_global_request_reply(PTInstVar pvar, int type, unsigned int seq, void *ctxt)
{
        struct global_confirm *gc = &global_confirms;

        if (gc->ref_count >= 1) {
                if (gc->cb)
                        gc->cb(pvar, type, seq, gc->ctx);
                gc->ref_count = 0;
        }

        return 0;
}

//
// channel function
//
static Channel_t *ssh2_channel_new(unsigned int window, unsigned int maxpack,
                                   enum channel_type type, int local_num)
{
        int i, found;
        Channel_t *c;

        found = -1;
        for (i = 0 ; i < CHANNEL_MAX ; i++) {
                if (channels[i].used == 0) { // free channel
                        found = i;
                        break;
                }
        }
        if (found == -1) { // not free channel
                return (NULL);
        }

        // setup
        c = &channels[found];
        memset(c, 0, sizeof(Channel_t));
        c->used = 1;
        c->self_id = i;
        c->remote_id = -1;
        c->local_window = window;
        c->local_window_max = window;
        c->local_consumed = 0;
        c->local_maxpacket = maxpack;
        c->remote_window = 0;
        c->remote_maxpacket = 0;
        c->type = type;
        c->local_num = local_num;  // alloc_channel()�����l��������������
        c->bufchain = NULL;
        c->bufchain_amount = 0;
        c->bufchain_recv_suspended = FALSE;
        if (type == TYPE_SCP) {
                c->scp.state = SCP_INIT;
                c->scp.progress_window = NULL;
                c->scp.thread = (HANDLE)-1;
                c->scp.localfp = NULL;
                c->scp.filemtime = 0;
                c->scp.fileatime = 0;
        }
        if (type == TYPE_AGENT) {
                c->agent_msg = buffer_init();
                c->agent_request_len = 0;
        }
        c->state = 0;

        return (c);
}

// remote_window�������������������A�������������o�b�t�@�����X�g�i�������j���������������B
// �������m�������������� ssh2_channel_retry_send_bufchain() �����������B
static void ssh2_channel_add_bufchain(PTInstVar pvar, Channel_t *c, unsigned char *buf, unsigned int buflen)
{
        bufchain_t *p, *old;

        // allocate new buffer
        p = malloc(sizeof(bufchain_t));
        if (p == NULL)
                return;
        p->msg = buffer_init();
        if (p == NULL) {
                free(p);
                return;
        }
        buffer_put_raw(p->msg, buf, buflen);
        p->next = NULL;

        if (c->bufchain == NULL) {
                c->bufchain = p;
        } else {
                old = c->bufchain;
                while (old->next)
                        old = old->next;
                old->next = p;
        }

        // �o�b�t�@�T�C�Y�����v���X�V����(�L�^�p)
        c->bufchain_amount += buflen;

        // remote_window�����������������Alocal connection�������p�P�b�g���M��
        // ���~�w�����o���B���������m���~�����������������B
        FWD_suspend_resume_local_connection(pvar, c, FALSE);
}

// remote_window�����������������A���X�g���c���������f�[�^�������������B
// ���M���������������������������B
static void ssh2_channel_retry_send_bufchain(PTInstVar pvar, Channel_t *c)
{
        bufchain_t *ch;
        unsigned int size;
        bufchain_t* ch_origin = c->bufchain;

        while (c->bufchain) {
                // ����������������
                ch = c->bufchain;
                size = buffer_len(ch->msg);
                if (size >= c->remote_window)
                        break;

                if (c->local_num == -1) { // shell or SCP
                        SSH2_send_channel_data(pvar, c, buffer_ptr(ch->msg), size, TRUE);
                } else { // port-forwarding
                        SSH_channel_send(pvar, c->local_num, -1, buffer_ptr(ch->msg), size, TRUE);
                }

                c->bufchain = ch->next;

                buffer_free(ch->msg);
                free(ch);

                // �o�b�t�@�T�C�Y�����v���X�V����(�L�^�p)
                c->bufchain_amount -= size;
        }

        // ���X���������X�g���������������A
        // local connection�������p�P�b�g���m�����J�����B
        if (ch_origin && c->bufchain == NULL) {
                FWD_suspend_resume_local_connection(pvar, c, TRUE);
        }
}

// channel close�����`���l���\���������X�g�����p����
// (2007.4.26 yutaka)
static void ssh2_channel_delete(Channel_t *c)
{
        bufchain_t *ch, *ptr;
        enum scp_state prev_state;

        ch = c->bufchain;
        while (ch) {
                if (ch->msg)
                        buffer_free(ch->msg);
                ptr = ch;
                ch = ch->next;
                free(ptr);
        }

        if (c->type == TYPE_SCP) {
                // SCP���������������������������B
                prev_state = c->scp.state;

                c->scp.state = SCP_CLOSING;
                if (c->scp.localfp != NULL) {
                        fclose(c->scp.localfp);
                        if (c->scp.dir == FROMREMOTE) {
                                if (c->scp.fileatime > 0 && c->scp.filemtime > 0) {
                                        struct _utimbuf filetime;
                                        filetime.actime = c->scp.fileatime;
                                        filetime.modtime = c->scp.filemtime;
                                        _utime(c->scp.localfilefull, &filetime);
                                }

                                // SCP���M���������������������A���[�J�����������t�@�C�����c�[�����������B
                                // (2017.2.12 yutaka)
                                if (prev_state != SCP_CLOSING)
                                        remove(c->scp.localfilefull);
                        }
                }
                if (c->scp.progress_window != NULL) {
                        DestroyWindow(c->scp.progress_window);
                        c->scp.progress_window = NULL;
                }
                if (c->scp.thread != (HANDLE)-1L) {
                        WaitForSingleObject(c->scp.thread, INFINITE);
                        CloseHandle(c->scp.thread);
                        c->scp.thread = (HANDLE)-1L;
                }

                ssh2_scp_free_packetlist(c);
        }
        if (c->type == TYPE_AGENT) {
                buffer_free(c->agent_msg);
        }

        memset(c, 0, sizeof(Channel_t));
        c->used = 0;
}

// connection close������������
void ssh2_channel_free(void)
{
        int i;
        Channel_t *c;

        for (i = 0 ; i < CHANNEL_MAX ; i++) {
                c = &channels[i];
                ssh2_channel_delete(c);
        }
}

static Channel_t *ssh2_channel_lookup(int id)
{
        Channel_t *c;

        if (id < 0 || id >= CHANNEL_MAX) {
                logprintf(LOG_LEVEL_VERBOSE, "%s: invalid channel id. (%d)", __FUNCTION__, id);
                return (NULL);
        }
        c = &channels[id];
        if (c->used == 0) { // already freed
                logprintf(LOG_LEVEL_VERBOSE, "%s: channel was already freed. id:%d", __FUNCTION__, id);
                return (NULL);
        }
        return (c);
}

// SSH1��������������channel�\���������ASSH2������Channel_t�����������B
// TODO: �����I�����`���l���\������1�������������B
// (2005.6.12 yutaka)
Channel_t *ssh2_local_channel_lookup(int local_num)
{
        int i;
        Channel_t *c;

        for (i = 0 ; i < CHANNEL_MAX ; i++) {
                c = &channels[i];
                if (c->local_num == local_num)
                        return (c);
        }
        return (NULL);
}

//
// SSH heartbeat mutex
//
// TTSSH�� thread-safe �������������A�}���`�X���b�h�������p�P�b�g���M�����������B
// �V���O���X���b�h�����R���e�L�X�g�X�C�b�`�������������������������A
// ���b�N�������K�v�����������A���������B(2007.12.26 yutaka)
//
static CRITICAL_SECTION g_ssh_heartbeat_lock;   /* �����M�p���b�N */

void ssh_heartbeat_lock_initialize(void)
{
        //InitializeCriticalSection(&g_ssh_heartbeat_lock);
}

void ssh_heartbeat_lock_finalize(void)
{
        //DeleteCriticalSection(&g_ssh_heartbeat_lock);
}

void ssh_heartbeat_lock(void)
{
        //EnterCriticalSection(&g_ssh_heartbeat_lock);
}

void ssh_heartbeat_unlock(void)
{
        //LeaveCriticalSection(&g_ssh_heartbeat_lock);
}

//
// SSH memory dump (for debug)
//
// (2005.3.7 yutaka)
//
#define MEMTAG_MAX 300
#define LOGDUMP "ssh2connect.log"
#define LOG_PACKET_DUMP "ssh2packet.log"
#define SENDTOME "Please send '"LOGDUMP"' file to Tera Term developer team."

typedef struct memtag {
        char *name;
        char *desc;
        time_t time;
        int len;
        char *data;
} memtag_t;

static memtag_t memtags[MEMTAG_MAX];
static int memtag_count = 0;
static int memtag_use = 0;

/* �_���v���C�����t�H�[�}�b�g�\������ */
static void displine_memdump(FILE *fp, int addr, int *bytes, int byte_cnt)
{
        int i, c;

        /* �������A�h���X�\�� */
        fprintf(fp, "%08X : ", addr);

        /* �o�C�i���\���i4�o�C�g�������������}���j*/
        for (i = 0 ; i < byte_cnt ; i++) {
                if (i > 0 && i % 4 == 0)
                        fprintf(fp, " ");

                fprintf(fp, "%02X", bytes[i]);
        }

        /* ASCII�\���������������������� */
        fprintf(fp, "   %*s%*s", (16-byte_cnt)*2+1, " ", (16-byte_cnt+3)/4, " ");

        /* ASCII�\�� */
        for (i = 0 ; i < byte_cnt ; i++) {
                c = bytes[i];
                if (isprint(c)) {
                        fprintf(fp, "%c", c);
                } else {
                        fprintf(fp, ".");
                }
        }

        fprintf(fp, "\n");
}


/* �_���v���[�`�� */
static void dump_memdump(FILE *fp, char *data, int len)
{
        int c, addr;
        int bytes[16], *ptr;
        int byte_cnt;
        int i;

        addr = 0;
        byte_cnt = 0;
        ptr = bytes;
        for (i = 0 ; i < len ; i++) {
                c = data[i];
                *ptr++ = c & 0xff;
                byte_cnt++;

                if (byte_cnt == 16) {
                        displine_memdump(fp, addr, bytes, byte_cnt);

                        addr += 16;
                        byte_cnt = 0;
                        ptr = bytes;
                }
        }

        if (byte_cnt > 0) {
                displine_memdump(fp, addr, bytes, byte_cnt);
        }
}

void init_memdump(void)
{
        int i;

        if (memtag_use > 0) 
                return;

        for (i = 0 ; i < MEMTAG_MAX ; i++) {
                memtags[i].name = NULL;
                memtags[i].desc = NULL;
                memtags[i].data = NULL;
                memtags[i].len = 0;
        }
        memtag_use++;
}

void finish_memdump(void)
{
        int i;

        // initialize�������������������������������B(2005.4.3 yutaka)
        if (memtag_use <= 0)
                return;
        memtag_use--;

        for (i = 0 ; i < MEMTAG_MAX ; i++) {
                free(memtags[i].name);
                free(memtags[i].desc);
                free(memtags[i].data);
                memtags[i].len = 0;
        }
        memtag_count = 0;
}

void save_memdump(char *filename)
{
        FILE *fp;
        int i;
        time_t t;
        struct tm *tm;

        fp = fopen(filename, "w");
        if (fp == NULL)
                return;

        t = time(NULL);
        tm = localtime(&t);

        fprintf(fp, "<<< Tera Term SSH2 log dump >>>\n");
        fprintf(fp, "saved time: %04d/%02d/%02d %02d:%02d:%02d\n",
                tm->tm_year + 1900,
                tm->tm_mon + 1,
                tm->tm_mday,
                tm->tm_hour,
                tm->tm_min,
                tm->tm_sec);
        fprintf(fp, "\n");

        for (i = 0 ; i < memtag_count ; i++) {
                fprintf(fp, "============================================\n");
                fprintf(fp, "name: %s\n", memtags[i].name);
                fprintf(fp, "--------------------------------------------\n");
                fprintf(fp, "description: %s\n", memtags[i].desc);
                fprintf(fp, "--------------------------------------------\n");
                fprintf(fp, "time: %s", ctime(&memtags[i].time));
                fprintf(fp, "============================================\n");
                dump_memdump(fp, memtags[i].data, memtags[i].len);
                fprintf(fp, "\n\n\n");
        }

        fprintf(fp, "[EOF]\n");

        fclose(fp);
}

void push_memdump(char *name, char *desc, char *data, int len)
{
        memtag_t *ptr;
        char *dp;

        dp = malloc(len);
        if (dp == NULL)
                return;
        memcpy(dp, data, len);

        if (memtag_count >= MEMTAG_MAX)
                return;

        ptr = &memtags[memtag_count];
        memtag_count++;
        ptr->name = _strdup(name);
        ptr->desc = _strdup(desc);
        ptr->time = time(NULL);
        ptr->data = dp;
        ptr->len = len;
}

void push_bignum_memdump(char *name, char *desc, BIGNUM *bignum)
{
        int len;
        char *buf;

        len = BN_num_bytes(bignum);
        buf = malloc(len); // allocate
        if (buf == NULL)
                return;
        BN_bn2bin(bignum, buf);
        push_memdump(name, desc, buf, len); // at push_bignum_memdump()
        free(buf); // free
}

static unsigned int get_predecryption_amount(PTInstVar pvar)
{
        static int small_block_decryption_sizes[] = { 5, 5, 6, 6, 8 };

        if (SSHv1(pvar)) {
                return 0;
        } else {
                unsigned int block_size = CRYPT_get_decryption_block_size(pvar);

                if (block_size < 5) {
                        return small_block_decryption_sizes[block_size];
                } else {
                        return block_size;
                }
        }
}

/* Get up to 'limit' bytes into the payload buffer.
   'limit' is counted from the start of the payload data.
   Returns the amount of data in the payload buffer, or
   -1 if there is an error.
   We can return more than limit in some cases. */
static int buffer_packet_data(PTInstVar pvar, int limit)
{
        if (pvar->ssh_state.payloadlen >= 0) {
                return pvar->ssh_state.payloadlen;
        } else {
                int cur_decompressed_bytes =
                        pvar->ssh_state.decompress_stream.next_out - pvar->ssh_state.postdecompress_inbuf;

                while (limit > cur_decompressed_bytes) {
                        int result;

                        pvar->ssh_state.payload = pvar->ssh_state.postdecompress_inbuf + 1;
                        if (pvar->ssh_state.postdecompress_inbuflen == cur_decompressed_bytes) {
                                buf_ensure_size(&pvar->ssh_state.postdecompress_inbuf,
                                                &pvar->ssh_state.postdecompress_inbuflen,
                                                min(limit, cur_decompressed_bytes * 2));
                        }

                        pvar->ssh_state.decompress_stream.next_out =
                                pvar->ssh_state.postdecompress_inbuf + cur_decompressed_bytes;
                        pvar->ssh_state.decompress_stream.avail_out =
                                min(limit, pvar->ssh_state.postdecompress_inbuflen) - cur_decompressed_bytes;

                        result = inflate(&pvar->ssh_state.decompress_stream, Z_SYNC_FLUSH);
                        cur_decompressed_bytes =
                                pvar->ssh_state.decompress_stream.next_out - pvar->ssh_state.postdecompress_inbuf;

                        switch (result) {
                        case Z_OK:
                                break;
                        case Z_BUF_ERROR:
                                pvar->ssh_state.payloadlen = cur_decompressed_bytes;
                                return cur_decompressed_bytes;
                        default:
                                UTIL_get_lang_msg("MSG_SSH_INVALID_COMPDATA_ERROR", pvar,
                                                  "Invalid compressed data in received packet");
                                notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                                return -1;
                        }
                }

                return cur_decompressed_bytes;
        }
}

/* For use by the protocol processing code.
   Gets N bytes of uncompressed payload. Returns FALSE if data not available
   and a fatal error has been signaled.
   The data is available in the payload buffer. This buffer address
   can change during a call to grab_payload, so take care!
   The payload pointer is set to point to the first byte of the actual data
   (after the packet type byte).
*/
static BOOL grab_payload(PTInstVar pvar, int num_bytes)
{
        /* Accept maximum of 4MB of payload data */
        int in_buffer = buffer_packet_data(pvar, PACKET_MAX_SIZE);

        if (in_buffer < 0) {
                return FALSE;
        } else {
                pvar->ssh_state.payload_grabbed += num_bytes;
                if (pvar->ssh_state.payload_grabbed > in_buffer) {
                        char buf[128];
                        UTIL_get_lang_msg("MSG_SSH_TRUNCATED_PKT_ERROR", pvar,
                                          "Received truncated packet (%ld > %d) @ grab_payload()");
                        _snprintf_s(buf, sizeof(buf), _TRUNCATE, pvar->ts->UIMsg,
                                    pvar->ssh_state.payload_grabbed, in_buffer);
                        notify_fatal_error(pvar, buf, TRUE);
                        return FALSE;
                } else {
                        return TRUE;
                }
        }
}

static BOOL grab_payload_limited(PTInstVar pvar, int num_bytes)
{
        int in_buffer;

        pvar->ssh_state.payload_grabbed += num_bytes;
        in_buffer = buffer_packet_data(pvar, pvar->ssh_state.payload_grabbed);

        if (in_buffer < 0) {
                return FALSE;
        } else {
                if (pvar->ssh_state.payload_grabbed > in_buffer) {
                        char buf[128];
                        UTIL_get_lang_msg("MSG_SSH_TRUNCATED_PKT_LIM_ERROR", pvar,
                                          "Received truncated packet (%ld > %d) @ grab_payload_limited()");
                        _snprintf_s(buf, sizeof(buf), _TRUNCATE, pvar->ts->UIMsg,
                                    pvar->ssh_state.payload_grabbed, in_buffer);
                        notify_fatal_error(pvar, buf, TRUE);
                        return FALSE;
                } else {
                        return TRUE;
                }
        }
}

static PayloadStat get_byte_from_payload(PTInstVar pvar, unsigned char *val)
{
        unsigned char *data;

        data = remained_payload(pvar);
        if (!grab_payload(pvar, 1)) {
                return GetPayloadError;
        }

        *val = *data;
        return GetPayloadOK;
}
#define get_boolean_from_payload(pvar, val) get_byte_from_payload(pvar, val)

static PayloadStat get_bytearray_from_payload(PTInstVar pvar, unsigned char *buff, unsigned int len)
{
        unsigned char *data;

        data = remained_payload(pvar);
        if (!grab_payload(pvar, len)) {
                return GetPayloadError;
        }

        memcpy_s(buff, len, data, len);
        return GetPayloadOK;
}

static PayloadStat get_uint32_from_payload(PTInstVar pvar, unsigned int *val)
{
        unsigned char *data;

        data = remained_payload(pvar);
        if (!grab_payload(pvar, 4)) {
                return  GetPayloadError;
        }

        *val = get_uint32(data);
        return GetPayloadOK;
}

static PayloadStat get_string_from_payload(
        PTInstVar pvar, unsigned char *buff, unsigned int bufflen, unsigned int *len, BOOL null_terminate)
{
        unsigned int size;
        unsigned char *data;

        if (!get_uint32_from_payload(pvar, &size)) {
                return GetPayloadError;
        }

        data = remained_payload(pvar);
        if (!grab_payload(pvar, size)) {
                return GetPayloadError;
        }

        *len = size;

        if (size < bufflen) {
                memcpy_s(buff, bufflen, data, size);
                if (null_terminate) {
                        buff[size] = 0;
                }
                return GetPayloadOK;
        }
        else if (size == bufflen) {
                memcpy_s(buff, bufflen, data, bufflen);
                if (null_terminate) {
                        buff[bufflen-1] = 0;
                        return GetPayloadTruncate;
                }
                else {
                        return GetPayloadOK;
                }
        }
        else {
                memcpy_s(buff, bufflen, data, bufflen);
                if (null_terminate) {
                        buff[bufflen-1] = 0;
                }
                return GetPayloadTruncate;
        }
}
#define get_namelist_from_payload(pvar, buff, bufflen, size) get_string_from_payload(pvar, buff, bufflen, size, TRUE)

static PayloadStat get_mpint_from_payload(PTInstVar pvar, BIGNUM *bn)
{
        unsigned int len;
        unsigned char *data;

        if (!get_uint32_from_payload(pvar, &len)) {
                return GetPayloadError;
        }

        data = remained_payload(pvar);
        if (!grab_payload(pvar, len)) {
                return GetPayloadError;
        }

        BN_bin2bn(data, len, bn);

        return GetPayloadOK;
}

#define do_crc(buf, len) (~(uint32)crc32(0xFFFFFFFF, (buf), (len)))

/*
 * Decrypt the payload, checksum it, eat the padding, get the packet type and return it.
 * 'data' points to the start of the packet --- its length field.
 * 'len' is the length of the * payload + padding (+ length of CRC for SSHv1).
 * 'padding' is the length of the padding alone.
 */
static int prep_packet_ssh1(PTInstVar pvar, char *data, unsigned int len, unsigned int padding)
{
        pvar->ssh_state.payload = data + 4;
        pvar->ssh_state.payloadlen = len;

        if (CRYPT_detect_attack(pvar, pvar->ssh_state.payload, len)) {
                UTIL_get_lang_msg("MSG_SSH_COREINS_ERROR", pvar, "'CORE insertion attack' detected.  Aborting connection.");
                notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
        }

        CRYPT_decrypt(pvar, pvar->ssh_state.payload, len);
        /* PKT guarantees that the data is always 4-byte aligned */
        if (do_crc(pvar->ssh_state.payload, len - 4) != get_uint32_MSBfirst(pvar->ssh_state.payload + len - 4)) {
                UTIL_get_lang_msg("MSG_SSH_CORRUPTDATA_ERROR", pvar, "Detected corrupted data; connection terminating.");
                notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                return SSH_MSG_NONE;
        }

        pvar->ssh_state.payload += padding;
        pvar->ssh_state.payloadlen -= padding + 4;

        pvar->ssh_state.payload_grabbed = 0;

        if (pvar->ssh_state.decompressing) {
                if (pvar->ssh_state.decompress_stream.avail_in != 0) {
                        UTIL_get_lang_msg("MSG_SSH_DECOMPRESS_ERROR", pvar,
                                          "Internal error: a packet was not fully decompressed.\n"
                                          "This is a bug, please report it.");
                        notify_nonfatal_error(pvar, pvar->ts->UIMsg);
                }

                pvar->ssh_state.decompress_stream.next_in = pvar->ssh_state.payload;
                pvar->ssh_state.decompress_stream.avail_in = pvar->ssh_state.payloadlen;
                pvar->ssh_state.decompress_stream.next_out = pvar->ssh_state.postdecompress_inbuf;
                pvar->ssh_state.payloadlen = -1;
        } else {
                pvar->ssh_state.payload++;
        }

        if (!grab_payload_limited(pvar, 1)) {
                return SSH_MSG_NONE;
        }

        pvar->ssh_state.receiver_sequence_number++;

        return pvar->ssh_state.payload[-1];
}

/*
 * �p�P�b�g�����������������������s���B(SSHv2�p)
 * �E�f�[�^����
 * �EMAC ������
 * �Epadding ����������
 * �E���b�Z�[�W�^�C�v��������������
 *
 * ����:
 *   data - ssh �p�P�b�g���������w���|�C���^
 *   len - �p�P�b�g�� (�������p�P�b�g������(4�o�C�g)���������l)
 *   aadlen - ���������������������F���������������������f�[�^������
 *   authlen - �F���f�[�^(AEAD tag)��
 */

static int prep_packet_ssh2(PTInstVar pvar, char *data, unsigned int len, unsigned int aadlen, unsigned int authlen)
{
        unsigned int padding;

        if (authlen > 0) {
                if (!CRYPT_decrypt_aead(pvar, data, len, aadlen, authlen)) {
                        UTIL_get_lang_msg("MSG_SSH_CORRUPTDATA_ERROR", pvar, "Detected corrupted data; connection terminating.");
                        notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                        return SSH_MSG_NONE;
                }
        }
        else if (aadlen > 0) {
                // EtM ������������ MAC ���������s��
                if (!CRYPT_verify_receiver_MAC(pvar, pvar->ssh_state.receiver_sequence_number, data, len + 4, data + len + 4)) {
                        UTIL_get_lang_msg("MSG_SSH_CORRUPTDATA_ERROR", pvar, "Detected corrupted data; connection terminating.");
                        notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                        return SSH_MSG_NONE;
                }

                // �p�P�b�g������(����4�o�C�g)�������������������������A�������X�L�b�v�������������B
                CRYPT_decrypt(pvar, data + 4, len);
        }
        else {
                // E&M �����������������O���������������B
                // ���O�������������������������B
                unsigned int already_decrypted = get_predecryption_amount(pvar);

                // ���O�����������������X�L�b�v�����A�c�������������������B
                CRYPT_decrypt(pvar, data + already_decrypted, (4 + len) - already_decrypted);

                // E&M ������������ MAC ���������s���B
                if (!CRYPT_verify_receiver_MAC(pvar, pvar->ssh_state.receiver_sequence_number, data, len + 4, data + len + 4)) {
                        UTIL_get_lang_msg("MSG_SSH_CORRUPTDATA_ERROR", pvar, "Detected corrupted data; connection terminating.");
                        notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                        return SSH_MSG_NONE;
                }
        }

        // �p�f�B���O��������
        padding = (unsigned int) data[4];

        // �p�P�b�g��(4�o�C�g) �������p�f�B���O��(1�o�C�g)�������X�L�b�v���� SSH �y�C���[�h������
        pvar->ssh_state.payload = data + 4 + 1;

        // �p�f�B���O������(1�o�C�g)���p�f�B���O���������������y�C���[�h��
        pvar->ssh_state.payloadlen = len - 1 - padding;

        pvar->ssh_state.payload_grabbed = 0;

        // data compression
        if (pvar->ssh2_keys[MODE_IN].comp.enabled &&
           (pvar->stoc_compression == COMP_ZLIB ||
            pvar->stoc_compression == COMP_DELAYED && pvar->userauth_success)) {

                if (pvar->decomp_buffer == NULL) {
                        pvar->decomp_buffer = buffer_init();
                        if (pvar->decomp_buffer == NULL)
                                return SSH_MSG_NONE;
                }
                // ���x�m�������o�b�t�@���g�������������������Y�������B
                buffer_clear(pvar->decomp_buffer);

                // packet size��padding�������������y�C���[�h�����������W�J�����B
                buffer_decompress(&pvar->ssh_state.decompress_stream,
                                  pvar->ssh_state.payload,
                                  pvar->ssh_state.payloadlen,
                                  pvar->decomp_buffer);

                // �|�C���^���X�V�B
                pvar->ssh_state.payload = buffer_ptr(pvar->decomp_buffer);
                pvar->ssh_state.payload++;
                pvar->ssh_state.payloadlen = buffer_len(pvar->decomp_buffer);
        } else {
                pvar->ssh_state.payload++;
        }

        if (!grab_payload_limited(pvar, 1)) {
                return SSH_MSG_NONE;
        }

        pvar->ssh_state.receiver_sequence_number++;

        return pvar->ssh_state.payload[-1];
}

/* Create a packet to be sent. The SSH protocol packet type is in 'type';
   'len' contains the length of the packet payload, in bytes (this
   does not include the space for any of the packet headers or padding,
   or for the packet type byte).
   Returns a pointer to the payload data area, a region of length 'len',
   to be filled by the caller. */
unsigned char *begin_send_packet(PTInstVar pvar, int type, int len)
{
        unsigned char *buf;

        pvar->ssh_state.outgoing_packet_len = len + 1;

        if (pvar->ssh_state.compressing) {
                buf_ensure_size(&pvar->ssh_state.precompress_outbuf,
                                &pvar->ssh_state.precompress_outbuflen, 1 + len);
                buf = pvar->ssh_state.precompress_outbuf;
        } else {
                /* For SSHv2,
                   Encrypted_length is 4(packetlength) + 1(paddinglength) + 1(packettype)
                   + len(payload) + 4(minpadding), rounded up to nearest block_size
                   We only need a reasonable upper bound for the buffer size */
                buf_ensure_size(&pvar->ssh_state.outbuf,
                                &pvar->ssh_state.outbuflen,
                                (int)(len + 30 + CRYPT_get_sender_MAC_size(pvar) +
                                CRYPT_get_encryption_block_size(pvar)));
                buf = pvar->ssh_state.outbuf + 12;
        }

        buf[0] = (unsigned char) type;
        return buf + 1;
}


// ���M���g���C����������
//
// WinSock�� send() ���o�b�t�@�T�C�Y(len)�������������l��������������������
// ���������������A�����������G���[���������B
// �����������ATCP�R�l�N�V�������f�������o���h���B
// (2006.12.9 yutaka)
static int retry_send_packet(PTInstVar pvar, char *data, int len)
{
        int n;
        int err;

        while (len > 0) {
                n = (pvar->Psend)(pvar->socket, data, len, 0);

                if (n < 0) {
                        err = WSAGetLastError();
                        if (err < WSABASEERR || err == WSAEWOULDBLOCK) {
                                // send()�����l��0�������A�����G���[������ 10000 �������������A
                                // ���������������������B
                                // PuTTY 0.58���������Q�l�B
                                // (2007.2.4 yutak)
                                return 0; // success
                        }
                        return 1; // error
                }

                len -= n;
                data += n;
        }

        return 0; // success
}

static BOOL send_packet_blocking(PTInstVar pvar, char *data, int len)
{
        // �p�P�b�g���M�����o�b�t�@���g�������������A�u���b�L���O�����M�����������K�v�������B
        // �m���u���b�L���O�����M����WSAEWOULDBLOCK�����������������A�����o�b�t�@�����M��������
        // ���������������������������������B(2007.10.30 yutaka)
        u_long do_block = 0;
        int code = 0;
        char *kind = NULL, buf[256];

        if ((pvar->PWSAAsyncSelect) (pvar->socket, pvar->NotificationWindow, 0, 0) == SOCKET_ERROR) {
                code = WSAGetLastError();
                kind = "WSAAsyncSelect1";
                goto error;
        }
        if (ioctlsocket(pvar->socket, FIONBIO, &do_block) == SOCKET_ERROR) {
                code = WSAGetLastError();
                kind = "ioctlsocket";
                goto error;
        }
        if (retry_send_packet(pvar, data, len) != 0) {
                code = WSAGetLastError();
                kind = "retry_send_packet";
                goto error;
        }
        if ((pvar->PWSAAsyncSelect) (pvar->socket, pvar->NotificationWindow,
                                     pvar->notification_msg,
                                     pvar->notification_events) == SOCKET_ERROR) {
                code = WSAGetLastError();
                kind = "WSAAsyncSelect2";
                goto error;
        }
        return TRUE;

error:
        UTIL_get_lang_msg("MSG_SSH_SEND_PKT_ERROR", pvar,
                          "A communications error occurred while sending an SSH packet.\n"
                          "The connection will close. (%s:%d)");
        _snprintf_s(buf, sizeof(buf), _TRUNCATE, pvar->ts->UIMsg,
                    kind, code);
        notify_fatal_error(pvar, buf, TRUE);
        return FALSE;
}

/* if skip_compress is true, then the data has already been compressed
   into outbuf + 12 */
void finish_send_packet_special(PTInstVar pvar, int skip_compress)
{
        unsigned int len = pvar->ssh_state.outgoing_packet_len;
        unsigned char *data;
        unsigned int data_length;
        buffer_t *msg = NULL; // for SSH2 packet compression

        if (pvar->ssh_state.compressing) {
                if (!skip_compress) {
                        buf_ensure_size(&pvar->ssh_state.outbuf,
                                        &pvar->ssh_state.outbuflen,
                                        (int)(len + (len >> 6) + 50 + CRYPT_get_sender_MAC_size(pvar)));
                        pvar->ssh_state.compress_stream.next_in = pvar->ssh_state.precompress_outbuf;
                        pvar->ssh_state.compress_stream.avail_in = len;
                        pvar->ssh_state.compress_stream.next_out = pvar->ssh_state.outbuf + 12;
                        pvar->ssh_state.compress_stream.avail_out = pvar->ssh_state.outbuflen - 12;

                        if (deflate(&pvar->ssh_state.compress_stream, Z_SYNC_FLUSH) != Z_OK) {
                                UTIL_get_lang_msg("MSG_SSH_COMP_ERROR", pvar,
                                                  "An error occurred while compressing packet data.\n"
                                                  "The connection will close.");
                                notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                                return;
                        }
                }

                len = pvar->ssh_state.outbuflen - 12 - pvar->ssh_state.compress_stream.avail_out;
        }

        if (SSHv1(pvar)) {
                int padding = 8 - ((len + 4) % 8);

                data = pvar->ssh_state.outbuf + 8 - padding;
                data_length = padding + len + 8;

                set_uint32(data, len + 4);
                if (CRYPT_get_receiver_cipher(pvar) != SSH_CIPHER_NONE) {
                        CRYPT_set_random_data(pvar, data + 4, padding);
                } else {
                        memset(data + 4, 0, padding);
                }
                set_uint32(data + data_length - 4, do_crc(data + 4, data_length - 8));
                CRYPT_encrypt(pvar, data + 4, data_length - 4);
        } else { //for SSH2(yutaka)
                unsigned int block_size = CRYPT_get_encryption_block_size(pvar);
                unsigned int encryption_size;
                unsigned int padding;
                BOOL ret;
                struct Mac *mac = &pvar->ssh2_keys[MODE_OUT].mac;
                struct Enc *enc = &pvar->ssh2_keys[MODE_OUT].enc;
                unsigned int aadlen = 0, maclen = 0, authlen = 0;

                /*
                 �f�[�^�\��
                 pvar->ssh_state.outbuf:
                 offset: 0 1 2 3 4 5 6 7 8 9 10 11 12 ...         EOD
                         <--ignore---> ^^^^^^^^    <---- payload --->
                                       packet length

                                                ^^padding

                                       <---------------------------->
                                          SSH2 sending data on TCP
                
                 NOTE:
                   payload = type(1) + raw-data
                   len = ssh_state.outgoing_packet_len = payload size
                 */
                // �p�P�b�g���k���L���������A�p�P�b�g�����k�����������M�p�P�b�g���\�z�����B(2005.7.9 yutaka)
                // support of "Compression delayed" (2006.6.23 maya)
                if ((pvar->ctos_compression == COMP_ZLIB ||
                     pvar->ctos_compression == COMP_DELAYED && pvar->userauth_success) &&
                    pvar->ssh2_keys[MODE_OUT].comp.enabled) {
                        // �����o�b�t�@�� packet-length(4) + padding(1) + payload(any) �������B
                        msg = buffer_init();
                        if (msg == NULL) {
                                // TODO: error check
                                logprintf(LOG_LEVEL_ERROR, "%s: buffer_init returns NULL.", __FUNCTION__);
                                return;
                        }

                        // ���k�������w�b�_�������y�C���[�h�����B
                        buffer_append(msg, "\0\0\0\0\0", 5);  // 5 = packet-length(4) + padding(1)
                        if (buffer_compress(&pvar->ssh_state.compress_stream, pvar->ssh_state.outbuf + 12, len, msg) == -1) {
                                UTIL_get_lang_msg("MSG_SSH_COMP_ERROR", pvar,
                                                  "An error occurred while compressing packet data.\n"
                                                  "The connection will close.");
                                notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                                return;
                        }
                        data = buffer_ptr(msg);
                        len = buffer_len(msg) - 5;  // 'len' is overwritten.

                } else {
                        // �����k
                        data = pvar->ssh_state.outbuf + 7;
                }

                // ���M�p�P�b�g�\�z(input parameter: data, len)
                if (block_size < 8) {
                        block_size = 8;
                }

                if (enc) {
                        authlen = enc->auth_len;
                }

                if (mac && mac->etm || authlen > 0) {
                        // ���������������������AMAC ����������������������
                        aadlen = 4;
                }

                encryption_size = 4 - aadlen + 1 + len;
                padding = block_size - (encryption_size % block_size);
                if (padding < 4)
                        padding += block_size;
                encryption_size += padding;
                set_uint32(data, encryption_size - 4 + aadlen);
                data[4] = (unsigned char) padding;
                if (msg) {
                        // �p�P�b�g���k�������A�o�b�t�@���g�������B(2011.6.10 yutaka)
                        buffer_append_space(msg, padding + EVP_MAX_MD_SIZE);
                        // realloc()���������A�|�C���^�����������\�������������A���x���������B
                        data = buffer_ptr(msg);
                }

                CRYPT_set_random_data(pvar, data + 5 + len, padding);

                if (authlen > 0) {
                        CRYPT_encrypt_aead(pvar, data, encryption_size, aadlen, authlen);
                        maclen = authlen;
                }
                else if (aadlen) {
                        // �p�P�b�g������
                        CRYPT_encrypt(pvar, data + aadlen, encryption_size);

                        // EtM �������������� MAC ���v�Z����
                        ret = CRYPT_build_sender_MAC(pvar, pvar->ssh_state.sender_sequence_number,
                                                     data, aadlen + encryption_size, data + aadlen + encryption_size);
                        if (ret) {
                                maclen = CRYPT_get_sender_MAC_size(pvar);
                        }
                }
                else {
                        // E&M �������� MAC ���v�Z����
                        ret = CRYPT_build_sender_MAC(pvar, pvar->ssh_state.sender_sequence_number,
                                                     data, encryption_size, data + encryption_size);
                        if (ret) {
                                maclen = CRYPT_get_sender_MAC_size(pvar);
                        }

                        // �p�P�b�g������
                        CRYPT_encrypt(pvar, data, encryption_size);
                }

                data_length = encryption_size + aadlen + maclen;

                logprintf(150,
                                  "%s: built packet info: aadlen:%d, enclen:%d, padlen:%d, datalen:%d, maclen:%d, mode:%s",
                                  __FUNCTION__,
                                  aadlen, encryption_size, padding, data_length, maclen, aadlen ? "EtM" : "E&M");
        }

        send_packet_blocking(pvar, data, data_length);

        buffer_free(msg);

        pvar->ssh_state.sender_sequence_number++;

        // ���M�������L�^
        pvar->ssh_heartbeat_tick = time(NULL);
}

static void destroy_packet_buf(PTInstVar pvar)
{
        memset(pvar->ssh_state.outbuf, 0, pvar->ssh_state.outbuflen);
        if (pvar->ssh_state.compressing) {
                memset(pvar->ssh_state.precompress_outbuf, 0,
                       pvar->ssh_state.precompress_outbuflen);
        }
}

/* The handlers are added to the queue for each message. When one of the
   handlers fires, if it returns FALSE, then all handlers in the set are
   removed from their queues. */
static void enque_handlers(PTInstVar pvar, int num_msgs,
                           const int *messages,
                           const SSHPacketHandler *handlers)
{
        SSHPacketHandlerItem *first_item;
        SSHPacketHandlerItem *last_item = NULL;
        int i;

        for (i = 0; i < num_msgs; i++) {
                SSHPacketHandlerItem *item =
                        (SSHPacketHandlerItem *)
                        malloc(sizeof(SSHPacketHandlerItem));
                SSHPacketHandlerItem *cur_item =
                        pvar->ssh_state.packet_handlers[messages[i]];

                item->handler = handlers[i];

                if (cur_item == NULL) {
                        pvar->ssh_state.packet_handlers[messages[i]] = item;
                        item->next_for_message = item;
                        item->last_for_message = item;
                        item->active_for_message = messages[i];
                } else {
                        item->next_for_message = cur_item;
                        item->last_for_message = cur_item->last_for_message;
                        cur_item->last_for_message->next_for_message = item;
                        cur_item->last_for_message = item;
                        item->active_for_message = -1;
                }

                if (last_item != NULL) {
                        last_item->next_in_set = item;
                } else {
                        first_item = item;
                }
                last_item = item;
        }

        if (last_item != NULL) {
                last_item->next_in_set = first_item;
        }
}

static SSHPacketHandler get_handler(PTInstVar pvar, int message)
{
        SSHPacketHandlerItem *cur_item =
                pvar->ssh_state.packet_handlers[message];

        if (cur_item == NULL) {
                return NULL;
        } else {
                return cur_item->handler;
        }
}

/* Called only by SSH_handle_packet */
static void deque_handlers(PTInstVar pvar, int message)
{
        SSHPacketHandlerItem *cur_item =
                pvar->ssh_state.packet_handlers[message];
        SSHPacketHandlerItem *first_item_in_set = cur_item;

        if (cur_item == NULL)
                return;

        do {
                SSHPacketHandlerItem *next_in_set = cur_item->next_in_set;

                if (cur_item->active_for_message >= 0) {
                        SSHPacketHandlerItem *replacement =
                                cur_item->next_for_message;

                        if (replacement == cur_item) {
                                replacement = NULL;
                        } else {
                                replacement->active_for_message =
                                        cur_item->active_for_message;
                        }
                        pvar->ssh_state.packet_handlers[cur_item->active_for_message] =
                                replacement;
                }
                cur_item->next_for_message->last_for_message =
                        cur_item->last_for_message;
                cur_item->last_for_message->next_for_message =
                        cur_item->next_for_message;

                free(cur_item);
                cur_item = next_in_set;
        } while (cur_item != first_item_in_set);
}

static void enque_handler(PTInstVar pvar, int message,
                          SSHPacketHandler handler)
{
        enque_handlers(pvar, 1, &message, &handler);
}

static void chop_newlines(char *buf)
{
        int len = strlen(buf);

        while (len > 0 && (buf[len - 1] == '\n' || buf[len - 1] == '\r')) {
                buf[len - 1] = 0;
                len--;
        }
}

/********************/
/* Message handlers */
/********************/

static BOOL handle_forwarding_success(PTInstVar pvar)
{
        return FALSE;
}

static BOOL handle_forwarding_failure(PTInstVar pvar)
{
        return FALSE;
}

static void enque_forwarding_request_handlers(PTInstVar pvar)
{
        static const int msgs[] = { SSH_SMSG_SUCCESS, SSH_SMSG_FAILURE };
        static const SSHPacketHandler handlers[]
        = { handle_forwarding_success, handle_forwarding_failure };

        enque_handlers(pvar, 2, msgs, handlers);
}

static BOOL handle_auth_failure(PTInstVar pvar)
{
        logputs(LOG_LEVEL_VERBOSE, "Authentication failed");

        // retry count������ (2005.7.15 yutaka)
        pvar->userauth_retry_count++;

        AUTH_set_generic_mode(pvar);
        AUTH_advance_to_next_cred(pvar);
        pvar->ssh_state.status_flags &= ~STATUS_DONT_SEND_CREDENTIALS;
        try_send_credentials(pvar);
        return FALSE;
}

static BOOL handle_rsa_auth_refused(PTInstVar pvar)
{
        if (pvar->auth_state.cur_cred.method == SSH_AUTH_PAGEANT) {
                if (pvar->pageant_keycount <= pvar->pageant_keycurrent) {
                        // �S�������������I������
                        safefree(pvar->pageant_key);
                }
                else {
                        // ������������
                        pvar->ssh_state.status_flags &= ~STATUS_DONT_SEND_CREDENTIALS;
                        try_send_credentials(pvar);
                        return TRUE;
                }
        }
        AUTH_destroy_cur_cred(pvar);
        return handle_auth_failure(pvar);
}

static BOOL handle_TIS_challenge(PTInstVar pvar)
{
        if (grab_payload(pvar, 4)) {
                int len = get_payload_uint32(pvar, 0);

                if (grab_payload(pvar, len)) {
                        logputs(LOG_LEVEL_VERBOSE, "Received TIS challenge");

                        AUTH_set_TIS_mode(pvar, pvar->ssh_state.payload + 4, len, 0);
                        AUTH_advance_to_next_cred(pvar);
                        pvar->ssh_state.status_flags &= ~STATUS_DONT_SEND_CREDENTIALS;
                        try_send_credentials(pvar);
                }
        }
        return FALSE;
}

static BOOL handle_auth_required(PTInstVar pvar)
{
        logputs(LOG_LEVEL_VERBOSE, "Server requires authentication");

        pvar->ssh_state.status_flags &= ~STATUS_DONT_SEND_CREDENTIALS;
        try_send_credentials(pvar);
        /* the first AUTH_advance_to_next_cred is issued early by ttxssh.c */

        return FALSE;
}

static BOOL handle_ignore(PTInstVar pvar)
{
        if (SSHv1(pvar)) {
                logputs(LOG_LEVEL_VERBOSE, "SSH_MSG_IGNORE was received.");

                if (grab_payload(pvar, 4)
                 && grab_payload(pvar, get_payload_uint32(pvar, 0))) {
                        /* ignore it! but it must be decompressed */
                }
        }
        else {
                logputs(LOG_LEVEL_VERBOSE, "SSH2_MSG_IGNORE was received.");

                // ���b�Z�[�W�� SSH2_MSG_IGNORE ����������������
                // Cisco ���[�^���� (2006.11.28 maya)
        }
        return TRUE;
}

static BOOL handle_debug(PTInstVar pvar)
{
        BOOL always_display;
        char *description;
        int description_len;
        char buf[2048];

        if (SSHv1(pvar)) {
                logputs(LOG_LEVEL_VERBOSE, "SSH_MSG_DEBUG was received.");

                if (grab_payload(pvar, 4)
                 && grab_payload(pvar, description_len =
                                 get_payload_uint32(pvar, 0))) {
                        always_display = FALSE;
                        description = pvar->ssh_state.payload + 4;
                        description[description_len] = 0;
                } else {
                        return TRUE;
                }
        } else {
                logputs(LOG_LEVEL_VERBOSE, "SSH2_MSG_DEBUG was received.");

                if (grab_payload(pvar, 5)
                 && grab_payload(pvar,
                                 (description_len = get_payload_uint32(pvar, 1)) + 4)
                 && grab_payload(pvar,
                                 get_payload_uint32(pvar, 5 + description_len))) {
                        always_display = pvar->ssh_state.payload[0] != 0;
                        description = pvar->ssh_state.payload + 5;
                        description[description_len] = 0;
                } else {
                        return TRUE;
                }
        }

        chop_newlines(description);
        _snprintf_s(buf, sizeof(buf), _TRUNCATE, "DEBUG message from server: %s",
                    description);
        if (always_display) {
                notify_nonfatal_error(pvar, buf);
        } else {
                logputs(LOG_LEVEL_VERBOSE, buf);
        }
        return TRUE;
}

static BOOL handle_disconnect(PTInstVar pvar)
{
        int reason_code;
        char *description;
        int description_len;
        char buf[2048];
        char *explanation = "";
        char uimsg[MAX_UIMSG];

        if (SSHv1(pvar)) {
                logputs(LOG_LEVEL_VERBOSE, "SSH_MSG_DISCONNECT was received.");

                if (grab_payload(pvar, 4)
                 && grab_payload(pvar, description_len = get_payload_uint32(pvar, 0))) {
                        reason_code = -1;
                        description = pvar->ssh_state.payload + 4;
                        description[description_len] = 0;
                } else {
                        return TRUE;
                }
        } else {
                logputs(LOG_LEVEL_VERBOSE, "SSH2_MSG_DISCONNECT was received.");

                if (grab_payload(pvar, 8)
                 && grab_payload(pvar,
                                 (description_len = get_payload_uint32(pvar, 4)) + 4)
                 && grab_payload(pvar,
                                 get_payload_uint32(pvar, 8 + description_len))) {
                        reason_code = get_payload_uint32(pvar, 0);
                        description = pvar->ssh_state.payload + 8;
                        description[description_len] = 0;
                } else {
                        return TRUE;
                }
        }

        chop_newlines(description);
        if (description[0] == 0) {
                description = NULL;
        }

        if (get_handler(pvar, SSH_SMSG_FAILURE) == handle_forwarding_failure) {
                UTIL_get_lang_msg("MSG_SSH_UNABLE_FWD_ERROR", pvar,
                                  "\nIt may have disconnected because it was unable to forward a port you requested to be forwarded from the server.\n"
                                  "This often happens when someone is already forwarding that port from the server.");
                strncpy_s(uimsg, sizeof(uimsg), pvar->ts->UIMsg, _TRUNCATE);
                explanation = uimsg;
        }

        if (description != NULL) {
                UTIL_get_lang_msg("MSG_SSH_SERVER_DISCON_ERROR", pvar,
                                  "Server disconnected with message '%s'%s");
                _snprintf_s(buf, sizeof(buf), _TRUNCATE,
                            pvar->ts->UIMsg, description,
                            explanation);
        } else {
                UTIL_get_lang_msg("MSG_SSH_SERVER_DISCON_NORES_ERROR", pvar,
                                  "Server disconnected (no reason given).%s");
                _snprintf_s(buf, sizeof(buf), _TRUNCATE,
                            pvar->ts->UIMsg, explanation);
        }

        if (SSHv2(pvar)) {
                // SSH2_MSG_DISCONNECT �������������������������M��������������
                notify_fatal_error(pvar, buf, FALSE);
        }
        else {
                // SSH1 ���������d�l�����������������A���O����������������
                notify_fatal_error(pvar, buf, TRUE);
        }

        return TRUE;
}

static BOOL handle_unimplemented(PTInstVar pvar)
{
        /* Should never receive this since we only send base 2.0 protocol messages */
        grab_payload(pvar, 4);
        return TRUE;
}

static BOOL handle_crypt_success(PTInstVar pvar)
{
        logputs(LOG_LEVEL_VERBOSE, "Secure mode successfully achieved");
        return FALSE;
}

static BOOL handle_noauth_success(PTInstVar pvar)
{
        logputs(LOG_LEVEL_VERBOSE, "Server does not require authentication");
        prep_compression(pvar);
        return FALSE;
}

static BOOL handle_auth_success(PTInstVar pvar)
{
        logputs(LOG_LEVEL_VERBOSE, "Authentication accepted");
        prep_compression(pvar);

        // �n�[�g�r�[�g�E�X���b�h���J�n (2004.12.11 yutaka)
        start_ssh_heartbeat_thread(pvar);

        return FALSE;
}

static BOOL handle_server_public_key(PTInstVar pvar)
{
        int server_key_public_exponent_len;
        int server_key_public_modulus_pos;
        int server_key_public_modulus_len;
        int host_key_bits_pos;
        int host_key_public_exponent_len;
        int host_key_public_modulus_pos;
        int host_key_public_modulus_len;
        int protocol_flags_pos;
        int supported_ciphers;
        char *inmsg;
        Key hostkey;
        int supported_types;

        logputs(LOG_LEVEL_VERBOSE, "SSH_SMSG_PUBLIC_KEY was received.");

        if (!grab_payload(pvar, 14))
                return FALSE;
        server_key_public_exponent_len = get_mpint_len(pvar, 12);

        if (!grab_payload(pvar, server_key_public_exponent_len + 2))
                return FALSE;
        server_key_public_modulus_pos = 14 + server_key_public_exponent_len;
        server_key_public_modulus_len =
                get_mpint_len(pvar, server_key_public_modulus_pos);

        if (!grab_payload(pvar, server_key_public_modulus_len + 6))
                return FALSE;
        host_key_bits_pos =
                server_key_public_modulus_pos + 2 + server_key_public_modulus_len;
        host_key_public_exponent_len =
                get_mpint_len(pvar, host_key_bits_pos + 4);

        if (!grab_payload(pvar, host_key_public_exponent_len + 2))
                return FALSE;
        host_key_public_modulus_pos =
                host_key_bits_pos + 6 + host_key_public_exponent_len;
        host_key_public_modulus_len =
                get_mpint_len(pvar, host_key_public_modulus_pos);

        if (!grab_payload(pvar, host_key_public_modulus_len + 12))
                return FALSE;
        protocol_flags_pos =
                host_key_public_modulus_pos + 2 + host_key_public_modulus_len;

        inmsg = pvar->ssh_state.payload;

        CRYPT_set_server_cookie(pvar, inmsg);
        if (!CRYPT_set_server_RSA_key(pvar,
                                      get_uint32(inmsg + 8),
                                      pvar->ssh_state.payload + 12,
                                      inmsg + server_key_public_modulus_pos))
                return FALSE;
        if (!CRYPT_set_host_RSA_key(pvar,
                                    get_uint32(inmsg + host_key_bits_pos),
                                    inmsg + host_key_bits_pos + 4,
                                    inmsg + host_key_public_modulus_pos))
                return FALSE;
        pvar->ssh_state.server_protocol_flags =
                get_uint32(inmsg + protocol_flags_pos);

        supported_ciphers = get_uint32(inmsg + protocol_flags_pos + 4);
        if (!CRYPT_set_supported_ciphers(pvar,
                                         supported_ciphers,
                                         supported_ciphers))
                return FALSE;

        // SSH1 �T�[�o���A�T�|�[�g�����������F������������������
        // RSA ���L������ PAGEANT ���L��������
        supported_types = get_uint32(inmsg + protocol_flags_pos + 8);
        if ((supported_types & (1 << SSH_AUTH_RSA)) > 0) {
                supported_types |= (1 << SSH_AUTH_PAGEANT);
        }
        if (!AUTH_set_supported_auth_types(pvar,
                                           supported_types))
                return FALSE;

        /* this must be the LAST THING in this function, since it can cause
           host_is_OK to be called. */
        hostkey.type = KEY_RSA1;
        hostkey.bits = get_uint32(inmsg + host_key_bits_pos);
        hostkey.exp = inmsg + host_key_bits_pos + 4;
        hostkey.mod = inmsg + host_key_public_modulus_pos;
        HOSTS_check_host_key(pvar, pvar->ssh_state.hostname, pvar->ssh_state.tcpport, &hostkey);

        return FALSE;
}

/*
The ID must have already been found to start with "SSH-". It must
be null-terminated.
*/
static BOOL parse_protocol_ID(PTInstVar pvar, char *ID)
{
        char *str;

        for (str = ID + 4; *str >= '0' && *str <= '9'; str++) {
        }

        if (*str != '.') {
                return FALSE;
        }

        pvar->protocol_major = atoi(ID + 4);
        pvar->protocol_minor = atoi(str + 1);

        for (str = str + 1; *str >= '0' && *str <= '9'; str++) {
        }

        return *str == '-';
}

/*
On entry, the pvar->protocol_xxx fields hold the server's advertised
protocol number. We replace the fields with the protocol number we will
actually use, or return FALSE if there is no usable protocol version.
*/
static int negotiate_protocol(PTInstVar pvar)
{
        switch (pvar->protocol_major) {
        case 1:
                if (pvar->protocol_minor == 99 &&
                    pvar->settings.ssh_protocol_version == 2) {
                        // �T�[�o�� 1.99 �����[�U�� SSH2 ���I������������������
                        // 2.0 ����������
                        pvar->protocol_major = 2;
                        pvar->protocol_minor = 0;
                        return 0;
                }

                if (pvar->settings.ssh_protocol_version == 2) {
                        // �o�[�W��������
                        return -1;
                }

                if (pvar->protocol_minor > 5) {
                        pvar->protocol_minor = 5;
                }

                return 0;

        // for SSH2(yutaka)
        case 2:
                if (pvar->settings.ssh_protocol_version == 1) {
                        // �o�[�W��������
                        return -1;
                }

                return 0;                       // SSH2 support

        default:
                return 1;
        }
}

static void init_protocol(PTInstVar pvar)
{
        CRYPT_initialize_random_numbers(pvar);

        // known_hosts�t�@�C�������z�X�g���J������������������
        HOSTS_prefetch_host_key(pvar, pvar->ssh_state.hostname, pvar->ssh_state.tcpport);

        /* while we wait for a response from the server... */

        if (SSHv1(pvar)) {
                enque_handler(pvar, SSH_MSG_DISCONNECT, handle_disconnect);
                enque_handler(pvar, SSH_MSG_IGNORE, handle_ignore);
                enque_handler(pvar, SSH_MSG_DEBUG, handle_debug);
                enque_handler(pvar, SSH_SMSG_PUBLIC_KEY, handle_server_public_key);

        } else {  // for SSH2(yutaka)
                enque_handler(pvar, SSH2_MSG_DISCONNECT, handle_disconnect);
                enque_handler(pvar, SSH2_MSG_IGNORE, handle_ignore);
                enque_handler(pvar, SSH2_MSG_DEBUG, handle_debug);
                enque_handler(pvar, SSH2_MSG_KEXINIT, handle_SSH2_kexinit);
                enque_handler(pvar, SSH2_MSG_KEXDH_INIT, handle_unimplemented);
                enque_handler(pvar, SSH2_MSG_KEXDH_REPLY, handle_SSH2_dh_common_reply);
                enque_handler(pvar, SSH2_MSG_KEX_DH_GEX_REPLY, handle_SSH2_dh_gex_reply);
                enque_handler(pvar, SSH2_MSG_NEWKEYS, handle_SSH2_newkeys);
                enque_handler(pvar, SSH2_MSG_SERVICE_ACCEPT, handle_SSH2_service_accept);
                enque_handler(pvar, SSH2_MSG_USERAUTH_SUCCESS, handle_SSH2_userauth_success);
                enque_handler(pvar, SSH2_MSG_USERAUTH_FAILURE, handle_SSH2_userauth_failure);
                enque_handler(pvar, SSH2_MSG_USERAUTH_BANNER, handle_SSH2_userauth_banner);
                enque_handler(pvar, SSH2_MSG_USERAUTH_INFO_REQUEST, handle_SSH2_userauth_msg60);

                enque_handler(pvar, SSH2_MSG_UNIMPLEMENTED, handle_unimplemented);

                // ���[�U�F�������f�B�X�p�b�`���[�`��
                enque_handler(pvar, SSH2_MSG_CHANNEL_CLOSE, handle_SSH2_channel_close);
                enque_handler(pvar, SSH2_MSG_CHANNEL_DATA, handle_SSH2_channel_data);
                enque_handler(pvar, SSH2_MSG_CHANNEL_EOF, handle_SSH2_channel_eof);
                enque_handler(pvar, SSH2_MSG_CHANNEL_EXTENDED_DATA, handle_SSH2_channel_extended_data);
                enque_handler(pvar, SSH2_MSG_CHANNEL_OPEN, handle_SSH2_channel_open);
                enque_handler(pvar, SSH2_MSG_CHANNEL_OPEN_CONFIRMATION, handle_SSH2_open_confirm);
                enque_handler(pvar, SSH2_MSG_CHANNEL_OPEN_FAILURE, handle_SSH2_open_failure);
                enque_handler(pvar, SSH2_MSG_CHANNEL_REQUEST, handle_SSH2_channel_request);
                enque_handler(pvar, SSH2_MSG_CHANNEL_WINDOW_ADJUST, handle_SSH2_window_adjust);
                enque_handler(pvar, SSH2_MSG_CHANNEL_SUCCESS, handle_SSH2_channel_success);
                enque_handler(pvar, SSH2_MSG_CHANNEL_FAILURE, handle_SSH2_channel_failure);
                enque_handler(pvar, SSH2_MSG_GLOBAL_REQUEST, handle_SSH2_client_global_request);
                enque_handler(pvar, SSH2_MSG_REQUEST_FAILURE, handle_SSH2_request_failure);
                enque_handler(pvar, SSH2_MSG_REQUEST_SUCCESS, handle_SSH2_request_success);

                client_init_global_confirm();

        }
}

void server_version_check(PTInstVar pvar)
{
        char *server_swver;

        pvar->server_compat_flag = 0;

        if ((server_swver = strchr(pvar->server_version_string+4, '-')) == NULL) {
                logputs(LOG_LEVEL_WARNING, "Can't get server software version string.");
                return;
        }
        server_swver++;

        if (strncmp(server_swver, "Cisco-1", 7) == 0) {
                pvar->server_compat_flag |= SSH_BUG_DHGEX_LARGE;
                logputs(LOG_LEVEL_INFO, "Server version string is matched to \"Cisco-1\", compatibility flag SSH_BUG_DHGEX_LARGE is enabled.");
        }
}

BOOL SSH_handle_server_ID(PTInstVar pvar, char *ID, int ID_len)
{
        static char prefix[64];
        int negotiate;
        char uimsg[MAX_UIMSG];

        // initialize SSH2 memory dump (2005.3.7 yutaka)
        init_memdump();
        push_memdump("pure server ID", "start protocol version exchange", ID, ID_len);

        if (ID_len <= 0) {
                return FALSE;
        } else {
                int buf_len;
                char *buf;

                strncpy_s(prefix, sizeof(prefix), "Received server identification string: ", _TRUNCATE);
                buf_len = strlen(prefix) + ID_len + 1;
                buf = (char *) malloc(buf_len);
                strncpy_s(buf, buf_len, prefix, _TRUNCATE);
                strncat_s(buf, buf_len, ID, _TRUNCATE);
                chop_newlines(buf);
                logputs(LOG_LEVEL_VERBOSE, buf);
                free(buf);

                if (ID[ID_len - 1] != '\n') {
                        pvar->ssh_state.status_flags |= STATUS_IN_PARTIAL_ID_STRING;
                        return FALSE;
                } else if ((pvar->ssh_state.status_flags & STATUS_IN_PARTIAL_ID_STRING) != 0) {
                        pvar->ssh_state.status_flags &= ~STATUS_IN_PARTIAL_ID_STRING;
                        return FALSE;
                } else if (strncmp(ID, "SSH-", 4) != 0) {
                        return FALSE;
                } else {
                        ID[ID_len - 1] = 0;

                        if (ID_len > 1 && ID[ID_len - 2] == '\r') {
                                ID[ID_len - 2] = 0;
                        }

                        pvar->ssh_state.server_ID = _strdup(ID);

                        if (!parse_protocol_ID(pvar, ID)) {
                                UTIL_get_lang_msg("MSG_SSH_VERSION_ERROR", pvar,
                                                  "This program does not understand the server's version of the protocol.");
                                notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                        }
                        else if ((negotiate = negotiate_protocol(pvar)) == 1) {
                                UTIL_get_lang_msg("MSG_SSH_VERSION_ERROR", pvar,
                                                  "This program does not understand the server's version of the protocol.");
                                notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                        }
                        else if (negotiate == -1) {
                                UTIL_get_lang_msg("MSG_SSH_VERSION_MISMATCH", pvar,
                                                  "Protocol version mismatch. server:%d.%d client:%d");
                                _snprintf_s(uimsg, sizeof(uimsg), _TRUNCATE, pvar->ts->UIMsg,
                                            pvar->protocol_major, pvar->protocol_minor, pvar->settings.ssh_protocol_version);
                                notify_fatal_error(pvar, uimsg, TRUE);
                        }
                        else {
                                char TTSSH_ID[1024];
                                int TTSSH_ID_len;

                                // SSH �o�[�W������ teraterm �����Z�b�g����
                                // SCP �R�}���h������ (2008.2.3 maya)
                                pvar->cv->isSSH = pvar->protocol_major;

                                // �������g���o�[�W�������������� (2005.3.3 yutaka)
                                _snprintf_s(TTSSH_ID, sizeof(TTSSH_ID), _TRUNCATE,
                                            "SSH-%d.%d-TTSSH/%d.%d Win32\r\n",
                                            pvar->protocol_major, pvar->protocol_minor,
                                            TTSSH_VERSION_MAJOR, TTSSH_VERSION_MINOR);
                                TTSSH_ID_len = strlen(TTSSH_ID);

                                // for SSH2(yutaka)
                                // �N���C�A���g�o�[�W�����������i���s���������������j
                                strncpy_s(pvar->client_version_string, sizeof(pvar->client_version_string),
                                          TTSSH_ID, _TRUNCATE);

                                // �T�[�o�o�[�W�����������i���s���������������j(2005.3.9 yutaka)
                                _snprintf_s(pvar->server_version_string,
                                            sizeof(pvar->server_version_string), _TRUNCATE,
                                            "%s", pvar->ssh_state.server_ID);

                                // �T�[�o�o�[�W�������`�F�b�N
                                server_version_check(pvar);

                                if ((pvar->Psend) (pvar->socket, TTSSH_ID, TTSSH_ID_len, 0) != TTSSH_ID_len) {
                                        UTIL_get_lang_msg("MSG_SSH_SEND_ID_ERROR", pvar,
                                                          "An error occurred while sending the SSH ID string.\n"
                                                          "The connection will close.");
                                        notify_fatal_error(pvar, pvar->ts->UIMsg, TRUE);
                                } else {
                                        // ���s������
                                        chop_newlines(pvar->client_version_string);
                                        logprintf(LOG_LEVEL_VERBOSE, "Sent client identification string: %s", pvar->client_version_string);

                                        push_memdump("server ID", NULL, pvar->server_version_string, strlen(pvar->server_version_string));
                                        push_memdump("client ID", NULL, pvar->client_version_string, strlen(pvar->client_version_string));

                                        // SSH�n���h�����o�^���s��
                                        init_protocol(pvar);

                                        SSH2_dispatch_init(1);
                                        SSH2_dispatch_add_message(SSH2_MSG_KEXINIT);
                                }
                        }

                        return TRUE;
                }
        }
}

static BOOL handle_exit(PTInstVar pvar)
{
        if (grab_payload(pvar, 4)) {
                begin_send_packet(pvar, SSH_CMSG_EXIT_CONFIRMATION, 0);
                finish_send_packet(pvar);
                notify_closed_connection(pvar, "disconnected by server request");
        }
        return TRUE;
}

static BOOL handle_data(PTInstVar pvar)
{
        if (grab_payload_limited(pvar, 4)) {
                pvar->ssh_state.payload_datalen = get_payload_uint32(pvar, 0);
                pvar->ssh_state.payload_datastart = 4;
        }
        return TRUE;
}

static BOOL handle_channel_open(PTInstVar pvar)
{
        int host_len;
        int originator_len;

        if ((pvar->ssh_state.
                 server_protocol_flags & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) != 0) {
                if (grab_payload(pvar, 8)
                 && grab_payload(pvar,
                                 8 + (host_len = get_payload_uint32(pvar, 4)))
                 && grab_payload(pvar, originator_len =
                                 get_payload_uint32(pvar, host_len + 12))) {
                        int local_port = get_payload_uint32(pvar, 8 + host_len);

                        pvar->ssh_state.payload[8 + host_len] = 0;
                        FWD_open(pvar, get_payload_uint32(pvar, 0),
                                 pvar->ssh_state.payload + 8, local_port,
                                 pvar->ssh_state.payload + 16 + host_len,
                                 originator_len,
                                 NULL);
                }
        } else {
                if (grab_payload(pvar, 8)
                 && grab_payload(pvar,
                                 4 + (host_len = get_payload_uint32(pvar, 4)))) {
                        int local_port = get_payload_uint32(pvar, 8 + host_len);

                        pvar->ssh_state.payload[8 + host_len] = 0;
                        FWD_open(pvar, get_payload_uint32(pvar, 0),
                                 pvar->ssh_state.payload + 8, local_port, NULL, 0,
                                 NULL);
                }
        }

        return TRUE;
}

static BOOL handle_X11_channel_open(PTInstVar pvar)
{
        int originator_len;

        if ((pvar->ssh_state.server_protocol_flags & SSH_PROTOFLAG_HOST_IN_FWD_OPEN) != 0) {
                if (grab_payload(pvar, 8)
                 && grab_payload(pvar, originator_len = get_payload_uint32(pvar, 4))) {
                        FWD_X11_open(pvar, get_payload_uint32(pvar, 0),
                                     pvar->ssh_state.payload + 8, originator_len, NULL);
                }
        } else {
                if (grab_payload(pvar, 4)) {
                        FWD_X11_open(pvar, get_payload_uint32(pvar, 0), NULL, 0, NULL);
                }
        }

        return TRUE;
}

static BOOL handle_channel_open_confirmation(PTInstVar pvar)
{
        if (grab_payload(pvar, 8)) {
                FWD_confirmed_open(pvar, get_payload_uint32(pvar, 0),
                                   get_payload_uint32(pvar, 4));
        }
        return FALSE;
}

static BOOL handle_channel_open_failure(PTInstVar pvar)
{
        if (grab_payload(pvar, 4)) {
                FWD_failed_open(pvar, get_payload_uint32(pvar, 0), -1);
        }
        return FALSE;
}

static BOOL handle_channel_data(PTInstVar pvar)
{
        int len;

        if (grab_payload(pvar, 8)
         && grab_payload(pvar, len = get_payload_uint32(pvar, 4))) {
                FWDChannel *channel;
                int local_channel_num = get_payload_uint32(pvar, 0);
                if (!FWD_check_local_channel_num(pvar, local_channel_num)) {
                        return FALSE;
                }
                channel = pvar->fwd_state.channels + local_channel_num;
                if (channel->type == TYPE_AGENT) {
                        SSH_agent_response(pvar, NULL, local_channel_num,
                                           pvar->ssh_state.payload + 8, len);
                }
                else {
                        FWD_received_data(pvar, local_channel_num,
                                          pvar->ssh_state.payload + 8, len);
                }
        }
        return TRUE;
}

static BOOL handle_channel_input_eof(PTInstVar pvar)
{
        if (grab_payload(pvar, 4)) {
                int local_channel_num = get_payload_uint32(pvar, 0);
                FWDChannel *channel;
                if (!FWD_check_local_channel_num(pvar, local_channel_num)) {
                        return FALSE;
                }
                channel = pvar->fwd_state.channels + local_channel_num;
                if (channel->type == TYPE_AGENT) {
                        channel->status |= FWD_CLOSED_REMOTE_IN;
                        SSH_channel_input_eof(pvar, channel->remote_num, local_channel_num);
                }
                else {
                        FWD_channel_input_eof(pvar, local_channel_num);
                }
        }
        return TRUE;
}

static BOOL handle_channel_output_eof(PTInstVar pvar)
{
        if (grab_payload(pvar, 4)) {
                int local_channel_num = get_payload_uint32(pvar, 0);
                FWDChannel *channel;
                if (!FWD_check_local_channel_num(pvar, local_channel_num)) {
                        return FALSE;
                }
                channel = pvar->fwd_state.channels + local_channel_num;
                if (channel->type == TYPE_AGENT) {
                        channel->status |= FWD_CLOSED_REMOTE_OUT;
                        SSH_channel_output_eof(pvar, channel->remote_num);
                        FWD_free_channel(pvar, local_channel_num);
                }
                else {
                        FWD_channel_output_eof(pvar, local_channel_num);
                }
        }
        return TRUE;
}

static BOOL handle_agent_open(PTInstVar pvar)
{
        if (grab_payload(pvar, 4)) {
                int remote_id = get_payload_uint32(pvar, 0);
                int local_id;

                if (pvar->agentfwd_enable && FWD_agent_forward_confirm(pvar)) {
                        local_id = FWD_agent_open(pvar, remote_id);
                        if (local_id == -1) {
                                SSH_fail_channel_open(pvar, remote_id);
                        }
                        else {
                                SSH_confirm_channel_open(pvar, remote_id, local_id);
                        }
                }
                else {
                        SSH_fail_channel_open(pvar, remote_id);
                }
        }
        /*
        else {
                // ���m��������channel����������������������������
        }
        */

        return TRUE;
}


// �n���h�����O�������b�Z�[�W����������

#define HANDLE_MESSAGE_MAX 30
static unsigned char handle_messages[HANDLE_MESSAGE_MAX];
static int handle_message_count = 0;
static int handle_message_stage = 0;

void SSH2_dispatch_init(int stage)
{
        handle_message_count = 0;
        handle_message_stage = stage;

        SSH2_dispatch_add_message(SSH2_MSG_IGNORE);
        SSH2_dispatch_add_message(SSH2_MSG_DEBUG);
        SSH2_dispatch_add_message(SSH2_MSG_DISCONNECT);
        SSH2_dispatch_add_message(SSH2_MSG_UNIMPLEMENTED);
}

int SSH2_dispatch_enabled_check(unsigned char message)
{
        int i;

        for (i = 0 ; i < handle_message_count ; i++) {
                if (handle_messages[i] == message)
                        return 1;
        }
        return 0;
}

void SSH2_dispatch_add_message(unsigned char message)
{
        int i;

        if (handle_message_count >= HANDLE_MESSAGE_MAX) {
                // TODO: error check
                logprintf(LOG_LEVEL_ERROR, "%s: too many handlers. handlers:%d, max:%d", __FUNCTION__,
                        handle_message_count, HANDLE_MESSAGE_MAX);
                return;
        }

        // �������o�^�������������b�Z�[�W������������
        for (i=0; i<handle_message_count; i++) {
                if (handle_messages[i] == message) {
                        return;
                }
        }

        handle_messages[handle_message_count++] = message;
}

void SSH2_dispatch_add_range_message(unsigned char begin, unsigned char end)
{
        unsigned char c;

        for (c = begin ; c <= end ; c++) {
                SSH2_dispatch_add_message(c);
        }
}

void SSH1_handle_packet(PTInstVar pvar, char *data, unsigned int len, unsigned int padding)
{
        unsigned char message = prep_packet_ssh1(pvar, data, len, padding);

        // SSH�����b�Z�[�W�^�C�v���`�F�b�N
        if (message != SSH_MSG_NONE) {
                // ���b�Z�[�W�^�C�v���������n���h�����N��
                SSHPacketHandler handler = get_handler(pvar, message);

                if (handler == NULL) {
                        char buf[1024];

                        UTIL_get_lang_msg("MSG_SSH_UNEXP_MSG_ERROR", pvar, "Unexpected packet type received: %d");
                        _snprintf_s(buf, sizeof(buf), _TRUNCATE, pvar->ts->UIMsg, message, handle_message_stage);
                        notify_fatal_error(pvar, buf, TRUE);
                } else {
                        if (!handler(pvar)) {
                                deque_handlers(pvar, message);
                        }
                }
        }
}

void SSH2_handle_packet(PTInstVar pvar, char *data, unsigned int len, unsigned int aadlen, unsigned int authlen)
{
        unsigned char message = prep_packet_ssh2(pvar, data, len, aadlen, authlen);

        // SSH�����b�Z�[�W�^�C�v���`�F�b�N
        if (message != SSH_MSG_NONE) {
                // ���b�Z�[�W�^�C�v���������n���h�����N��
                SSHPacketHandler handler = get_handler(pvar, message);

                // �z���O�����b�Z�[�W�^�C�v�������������A�{�[�g�������B
                if (!SSH2_dispatch_enabled_check(message) || handler == NULL) {
                        char buf[1024];

                        UTIL_get_lang_msg("MSG_SSH_UNEXP_MSG2_ERROR", pvar, "Unexpected SSH2 message(%d) on current stage(%d)");
                        _snprintf_s(buf, sizeof(buf), _TRUNCATE, pvar->ts->UIMsg, message, handle_message_stage);
                        notify_fatal_error(pvar, buf, TRUE);
                        return;
                }

                if (handler == NULL) {
                        unsigned char *outmsg = begin_send_packet(pvar, SSH2_MSG_UNIMPLEMENTED, 4);

                        set_uint32(outmsg, pvar->ssh_state.receiver_sequence_number - 1);
                        finish_send_packet(pvar);

                        logprintf(LOG_LEVEL_VERBOSE, "%s: SSH2_MSG_UNIMPLEMENTED was sent.", __FUNCTION__);
                        /* XXX need to decompress incoming packet, but how? */
                } else {
                        if (!handler(pvar)) {
                                deque_handlers(pvar, message);
                        }
                }
        }
}

static BOOL handle_pty_success(PTInstVar pvar)
{
        FWD_enter_interactive_mode(pvar);
        enque_handler(pvar, SSH_SMSG_EXITSTATUS, handle_exit);
        enque_handler(pvar, SSH_SMSG_STDOUT_DATA, handle_data);
        enque_handler(pvar, SSH_SMSG_STDERR_DATA, handle_data);
        enque_handler(pvar, SSH_MSG_CHANNEL_DATA, handle_channel_data);
        enque_handler(pvar, SSH_MSG_CHANNEL_INPUT_EOF, handle_channel_input_eof);
        enque_handler(pvar, SSH_MSG_CHANNEL_OUTPUT_CLOSED, handle_channel_output_eof);
        enque_handler(pvar, SSH_MSG_PORT_OPEN, handle_channel_open);
        enque_handler(pvar, SSH_SMSG_X11_OPEN, handle_X11_channel_open);
        enque_handler(pvar, SSH_SMSG_AGENT_OPEN, handle_agent_open);
        return FALSE;
}

static BOOL handle_pty_failure(PTInstVar pvar)
{
        UTIL_get_lang_msg("MSG_SSH_ALLOC_TERMINAL_ERROR", pvar,
                          "The server cannot allocate a pseudo-terminal. "
                          "You may encounter some problems with the terminal.");
        notify_nonfatal_error(pvar, pvar->ts->UIMsg);
        return handle_pty_success(pvar);
}

static void prep_pty(PTInstVar pvar)
{
        int len = strlen(pvar->ts->TermType);
        unsigned char *outmsg = begin_send_packet(pvar, SSH_CMSG_REQUEST_PTY, 4 + len + 16 + sizeof(ssh_ttymodes));
        static const int msgs[] = { SSH_SMSG_SUCCESS, SSH_SMSG_FAILURE };
        static const SSHPacketHandler handlers[]
        = { handle_pty_success, handle_pty_failure };
        int x, y;

        get_window_pixel_size(pvar, &x, &y);

        set_uint32(outmsg, len);
        memcpy(outmsg + 4, pvar->ts->TermType, len);
        set_uint32(outmsg + 4 + len, pvar->ssh_state.win_rows);
        set_uint32(outmsg + 4 + len + 4, pvar->ssh_state.win_cols);
        set_uint32(outmsg + 4 + len + 8, x);
        set_uint32(outmsg + 4 + len + 12, y);
        memcpy(outmsg + 4 + len + 16, ssh_ttymodes, sizeof(ssh_ttymodes));
        finish_send_packet(pvar);

        enque_handlers(pvar, 2, msgs, handlers);

        begin_send_packet(pvar, SSH_CMSG_EXEC_SHELL, 0);
        finish_send_packet(pvar);
}

static BOOL handle_agent_request_success(PTInstVar pvar)
{
        pvar->agentfwd_enable = TRUE;
        prep_pty(pvar);
        return FALSE;
}

static BOOL handle_agent_request_failure(PTInstVar pvar)
{
        prep_pty(pvar);
        return FALSE;
}

static void prep_agent_request(PTInstVar pvar)
{
        static const int msgs[] = { SSH_SMSG_SUCCESS, SSH_SMSG_FAILURE };
        static const SSHPacketHandler handlers[] = { handle_agent_request_success, handle_agent_request_failure };

        enque_handlers(pvar, 2, msgs, handlers);

        begin_send_packet(pvar, SSH_CMSG_AGENT_REQUEST_FORWARDING, 0);
        finish_send_packet(pvar);
}

static void prep_forwarding(PTInstVar pvar)
{