agent-skill-manager 1.22.0 → 2.1.0

package/node_modules/ssh2/lib/client.js

@@ -1,2176 +0,0 @@
-// TODO:
-//    * add `.connected` or similar property to allow immediate connection
-//      status checking
-//    * add/improve debug output during user authentication phase
-'use strict';
-
-const {
-  createHash,
-  getHashes,
-  randomFillSync,
-} = require('crypto');
-const { Socket } = require('net');
-const { lookup: dnsLookup } = require('dns');
-const EventEmitter = require('events');
-const HASHES = getHashes();
-
-const {
-  COMPAT,
-  CHANNEL_EXTENDED_DATATYPE: { STDERR },
-  CHANNEL_OPEN_FAILURE,
-  DEFAULT_CIPHER,
-  DEFAULT_COMPRESSION,
-  DEFAULT_KEX,
-  DEFAULT_MAC,
-  DEFAULT_SERVER_HOST_KEY,
-  DISCONNECT_REASON,
-  DISCONNECT_REASON_BY_VALUE,
-  SUPPORTED_CIPHER,
-  SUPPORTED_COMPRESSION,
-  SUPPORTED_KEX,
-  SUPPORTED_MAC,
-  SUPPORTED_SERVER_HOST_KEY,
-} = require('./protocol/constants.js');
-const { init: cryptoInit } = require('./protocol/crypto.js');
-const Protocol = require('./protocol/Protocol.js');
-const { parseKey } = require('./protocol/keyParser.js');
-const { SFTP } = require('./protocol/SFTP.js');
-const {
-  bufferCopy,
-  makeBufferParser,
-  makeError,
-  readUInt32BE,
-  sigSSHToASN1,
-  writeUInt32BE,
-} = require('./protocol/utils.js');
-
-const { AgentContext, createAgent, isAgent } = require('./agent.js');
-const {
-  Channel,
-  MAX_WINDOW,
-  PACKET_SIZE,
-  windowAdjust,
-  WINDOW_THRESHOLD,
-} = require('./Channel.js');
-const {
-  ChannelManager,
-  generateAlgorithmList,
-  isWritable,
-  onChannelOpenFailure,
-  onCHANNEL_CLOSE,
-} = require('./utils.js');
-
-const bufferParser = makeBufferParser();
-const sigParser = makeBufferParser();
-const RE_OPENSSH = /^OpenSSH_(?:(?![0-4])\d)|(?:\d{2,})/;
-const noop = (err) => {};
-
-class Client extends EventEmitter {
-  constructor() {
-    super();
-
-    this.config = {
-      host: undefined,
-      port: undefined,
-      localAddress: undefined,
-      localPort: undefined,
-      forceIPv4: undefined,
-      forceIPv6: undefined,
-      keepaliveCountMax: undefined,
-      keepaliveInterval: undefined,
-      readyTimeout: undefined,
-      ident: undefined,
-
-      username: undefined,
-      password: undefined,
-      privateKey: undefined,
-      tryKeyboard: undefined,
-      agent: undefined,
-      allowAgentFwd: undefined,
-      authHandler: undefined,
-
-      hostHashAlgo: undefined,
-      hostHashCb: undefined,
-      strictVendor: undefined,
-      debug: undefined
-    };
-
-    this._agent = undefined;
-    this._readyTimeout = undefined;
-    this._chanMgr = undefined;
-    this._callbacks = undefined;
-    this._forwarding = undefined;
-    this._forwardingUnix = undefined;
-    this._acceptX11 = undefined;
-    this._agentFwdEnabled = undefined;
-    this._remoteVer = undefined;
-
-    this._protocol = undefined;
-    this._sock = undefined;
-    this._resetKA = undefined;
-  }
-
-  connect(cfg) {
-    if (this._sock && isWritable(this._sock)) {
-      this.once('close', () => {
-        this.connect(cfg);
-      });
-      this.end();
-      return this;
-    }
-
-    this.config.host = cfg.hostname || cfg.host || 'localhost';
-    this.config.port = cfg.port || 22;
-    this.config.localAddress = (typeof cfg.localAddress === 'string'
-                                ? cfg.localAddress
-                                : undefined);
-    this.config.localPort = (typeof cfg.localPort === 'string'
-                             || typeof cfg.localPort === 'number'
-                             ? cfg.localPort
-                             : undefined);
-    this.config.forceIPv4 = cfg.forceIPv4 || false;
-    this.config.forceIPv6 = cfg.forceIPv6 || false;
-    this.config.keepaliveCountMax = (typeof cfg.keepaliveCountMax === 'number'
-                                     && cfg.keepaliveCountMax >= 0
-                                     ? cfg.keepaliveCountMax
-                                     : 3);
-    this.config.keepaliveInterval = (typeof cfg.keepaliveInterval === 'number'
-                                     && cfg.keepaliveInterval > 0
-                                     ? cfg.keepaliveInterval
-                                     : 0);
-    this.config.readyTimeout = (typeof cfg.readyTimeout === 'number'
-                                && cfg.readyTimeout >= 0
-                                ? cfg.readyTimeout
-                                : 20000);
-    this.config.ident = (typeof cfg.ident === 'string'
-                         || Buffer.isBuffer(cfg.ident)
-                         ? cfg.ident
-                         : undefined);
-
-    const algorithms = {
-      kex: undefined,
-      serverHostKey: undefined,
-      cs: {
-        cipher: undefined,
-        mac: undefined,
-        compress: undefined,
-        lang: [],
-      },
-      sc: undefined,
-    };
-    let allOfferDefaults = true;
-    if (typeof cfg.algorithms === 'object' && cfg.algorithms !== null) {
-      algorithms.kex = generateAlgorithmList(cfg.algorithms.kex,
-                                             DEFAULT_KEX,
-                                             SUPPORTED_KEX);
-      if (algorithms.kex !== DEFAULT_KEX)
-        allOfferDefaults = false;
-
-      algorithms.serverHostKey =
-        generateAlgorithmList(cfg.algorithms.serverHostKey,
-                              DEFAULT_SERVER_HOST_KEY,
-                              SUPPORTED_SERVER_HOST_KEY);
-      if (algorithms.serverHostKey !== DEFAULT_SERVER_HOST_KEY)
-        allOfferDefaults = false;
-
-      algorithms.cs.cipher = generateAlgorithmList(cfg.algorithms.cipher,
-                                                   DEFAULT_CIPHER,
-                                                   SUPPORTED_CIPHER);
-      if (algorithms.cs.cipher !== DEFAULT_CIPHER)
-        allOfferDefaults = false;
-
-      algorithms.cs.mac = generateAlgorithmList(cfg.algorithms.hmac,
-                                                DEFAULT_MAC,
-                                                SUPPORTED_MAC);
-      if (algorithms.cs.mac !== DEFAULT_MAC)
-        allOfferDefaults = false;
-
-      algorithms.cs.compress = generateAlgorithmList(cfg.algorithms.compress,
-                                                     DEFAULT_COMPRESSION,
-                                                     SUPPORTED_COMPRESSION);
-      if (algorithms.cs.compress !== DEFAULT_COMPRESSION)
-        allOfferDefaults = false;
-
-      if (!allOfferDefaults)
-        algorithms.sc = algorithms.cs;
-    }
-
-    if (typeof cfg.username === 'string')
-      this.config.username = cfg.username;
-    else if (typeof cfg.user === 'string')
-      this.config.username = cfg.user;
-    else
-      throw new Error('Invalid username');
-
-    this.config.password = (typeof cfg.password === 'string'
-                            ? cfg.password
-                            : undefined);
-    this.config.privateKey = (typeof cfg.privateKey === 'string'
-                              || Buffer.isBuffer(cfg.privateKey)
-                              ? cfg.privateKey
-                              : undefined);
-    this.config.localHostname = (typeof cfg.localHostname === 'string'
-                                 ? cfg.localHostname
-                                 : undefined);
-    this.config.localUsername = (typeof cfg.localUsername === 'string'
-                                 ? cfg.localUsername
-                                 : undefined);
-    this.config.tryKeyboard = (cfg.tryKeyboard === true);
-    if (typeof cfg.agent === 'string' && cfg.agent.length)
-      this.config.agent = createAgent(cfg.agent);
-    else if (isAgent(cfg.agent))
-      this.config.agent = cfg.agent;
-    else
-      this.config.agent = undefined;
-    this.config.allowAgentFwd = (cfg.agentForward === true
-                                 && this.config.agent !== undefined);
-    let authHandler = this.config.authHandler = (
-      typeof cfg.authHandler === 'function'
-      || Array.isArray(cfg.authHandler)
-      ? cfg.authHandler
-      : undefined
-    );
-
-    this.config.strictVendor = (typeof cfg.strictVendor === 'boolean'
-                                ? cfg.strictVendor
-                                : true);
-
-    const debug = this.config.debug = (typeof cfg.debug === 'function'
-                                       ? cfg.debug
-                                       : undefined);
-
-    if (cfg.agentForward === true && !this.config.allowAgentFwd) {
-      throw new Error(
-        'You must set a valid agent path to allow agent forwarding'
-      );
-    }
-
-    let callbacks = this._callbacks = [];
-    this._chanMgr = new ChannelManager(this);
-    this._forwarding = {};
-    this._forwardingUnix = {};
-    this._acceptX11 = 0;
-    this._agentFwdEnabled = false;
-    this._agent = (this.config.agent ? this.config.agent : undefined);
-    this._remoteVer = undefined;
-    let privateKey;
-
-    if (this.config.privateKey) {
-      privateKey = parseKey(this.config.privateKey, cfg.passphrase);
-      if (privateKey instanceof Error)
-        throw new Error(`Cannot parse privateKey: ${privateKey.message}`);
-      if (Array.isArray(privateKey)) {
-        // OpenSSH's newer format only stores 1 key for now
-        privateKey = privateKey[0];
-      }
-      if (privateKey.getPrivatePEM() === null) {
-        throw new Error(
-          'privateKey value does not contain a (valid) private key'
-        );
-      }
-    }
-
-    let hostVerifier;
-    if (typeof cfg.hostVerifier === 'function') {
-      const hashCb = cfg.hostVerifier;
-      let hashAlgo;
-      if (HASHES.indexOf(cfg.hostHash) !== -1) {
-        // Default to old behavior of hashing on user's behalf
-        hashAlgo = cfg.hostHash;
-      }
-      hostVerifier = (key, verify) => {
-        if (hashAlgo)
-          key = createHash(hashAlgo).update(key).digest('hex');
-        const ret = hashCb(key, verify);
-        if (ret !== undefined)
-          verify(ret);
-      };
-    }
-
-    const sock = this._sock = (cfg.sock || new Socket());
-    let ready = false;
-    let sawHeader = false;
-    if (this._protocol)
-      this._protocol.cleanup();
-    const DEBUG_HANDLER = (!debug ? undefined : (p, display, msg) => {
-      debug(`Debug output from server: ${JSON.stringify(msg)}`);
-    });
-    let serverSigAlgs;
-    const proto = this._protocol = new Protocol({
-      ident: this.config.ident,
-      offer: (allOfferDefaults ? undefined : algorithms),
-      onWrite: (data) => {
-        if (isWritable(sock))
-          sock.write(data);
-      },
-      onError: (err) => {
-        if (err.level === 'handshake')
-          clearTimeout(this._readyTimeout);
-        if (!proto._destruct)
-          sock.removeAllListeners('data');
-        this.emit('error', err);
-        try {
-          sock.end();
-        } catch {}
-      },
-      onHeader: (header) => {
-        sawHeader = true;
-        this._remoteVer = header.versions.software;
-        if (header.greeting)
-          this.emit('greeting', header.greeting);
-      },
-      onHandshakeComplete: (negotiated) => {
-        this.emit('handshake', negotiated);
-        if (!ready) {
-          ready = true;
-          proto.service('ssh-userauth');
-        }
-      },
-      debug,
-      hostVerifier,
-      messageHandlers: {
-        DEBUG: DEBUG_HANDLER,
-        DISCONNECT: (p, reason, desc) => {
-          if (reason !== DISCONNECT_REASON.BY_APPLICATION) {
-            if (!desc) {
-              desc = DISCONNECT_REASON_BY_VALUE[reason];
-              if (desc === undefined)
-                desc = `Unexpected disconnection reason: ${reason}`;
-            }
-            const err = new Error(desc);
-            err.code = reason;
-            this.emit('error', err);
-          }
-          sock.end();
-        },
-        SERVICE_ACCEPT: (p, name) => {
-          if (name === 'ssh-userauth')
-            tryNextAuth();
-        },
-        EXT_INFO: (p, exts) => {
-          if (serverSigAlgs === undefined) {
-            for (const ext of exts) {
-              if (ext.name === 'server-sig-algs') {
-                serverSigAlgs = ext.algs;
-                return;
-              }
-            }
-            serverSigAlgs = null;
-          }
-        },
-        USERAUTH_BANNER: (p, msg) => {
-          this.emit('banner', msg);
-        },
-        USERAUTH_SUCCESS: (p) => {
-          // Start keepalive mechanism
-          resetKA();
-
-          clearTimeout(this._readyTimeout);
-
-          this.emit('ready');
-        },
-        USERAUTH_FAILURE: (p, authMethods, partialSuccess) => {
-          // For key-based authentication, check if we should retry the current
-          // key with a different algorithm first
-          if (curAuth.keyAlgos) {
-            const oldKeyAlgo = curAuth.keyAlgos[0][0];
-            if (debug)
-              debug(`Client: ${curAuth.type} (${oldKeyAlgo}) auth failed`);
-            curAuth.keyAlgos.shift();
-            if (curAuth.keyAlgos.length) {
-              const [keyAlgo, hashAlgo] = curAuth.keyAlgos[0];
-              switch (curAuth.type) {
-                case 'agent':
-                  proto.authPK(
-                    curAuth.username,
-                    curAuth.agentCtx.currentKey(),
-                    keyAlgo
-                  );
-                  return;
-                case 'publickey':
-                  proto.authPK(curAuth.username, curAuth.key, keyAlgo);
-                  return;
-                case 'hostbased':
-                  proto.authHostbased(curAuth.username,
-                                      curAuth.key,
-                                      curAuth.localHostname,
-                                      curAuth.localUsername,
-                                      keyAlgo,
-                                      (buf, cb) => {
-                    const signature = curAuth.key.sign(buf, hashAlgo);
-                    if (signature instanceof Error) {
-                      signature.message =
-                        `Error while signing with key: ${signature.message}`;
-                      signature.level = 'client-authentication';
-                      this.emit('error', signature);
-                      return tryNextAuth();
-                    }
-
-                    cb(signature);
-                  });
-                  return;
-              }
-            } else {
-              curAuth.keyAlgos = undefined;
-            }
-          }
-
-          if (curAuth.type === 'agent') {
-            const pos = curAuth.agentCtx.pos();
-            debug && debug(`Client: Agent key #${pos + 1} failed`);
-            return tryNextAgentKey();
-          }
-
-          debug && debug(`Client: ${curAuth.type} auth failed`);
-
-          curPartial = partialSuccess;
-          curAuthsLeft = authMethods;
-          tryNextAuth();
-        },
-        USERAUTH_PASSWD_CHANGEREQ: (p, prompt) => {
-          if (curAuth.type === 'password') {
-            // TODO: support a `changePrompt()` on `curAuth` that defaults to
-            // emitting 'change password' as before
-            this.emit('change password', prompt, (newPassword) => {
-              proto.authPassword(
-                this.config.username,
-                this.config.password,
-                newPassword
-              );
-            });
-          }
-        },
-        USERAUTH_PK_OK: (p) => {
-          let keyAlgo;
-          let hashAlgo;
-          if (curAuth.keyAlgos)
-            [keyAlgo, hashAlgo] = curAuth.keyAlgos[0];
-          if (curAuth.type === 'agent') {
-            const key = curAuth.agentCtx.currentKey();
-            proto.authPK(curAuth.username, key, keyAlgo, (buf, cb) => {
-              const opts = { hash: hashAlgo };
-              curAuth.agentCtx.sign(key, buf, opts, (err, signed) => {
-                if (err) {
-                  err.level = 'agent';
-                  this.emit('error', err);
-                } else {
-                  return cb(signed);
-                }
-
-                tryNextAgentKey();
-              });
-            });
-          } else if (curAuth.type === 'publickey') {
-            proto.authPK(curAuth.username, curAuth.key, keyAlgo, (buf, cb) => {
-              const signature = curAuth.key.sign(buf, hashAlgo);
-              if (signature instanceof Error) {
-                signature.message =
-                  `Error signing data with key: ${signature.message}`;
-                signature.level = 'client-authentication';
-                this.emit('error', signature);
-                return tryNextAuth();
-              }
-              cb(signature);
-            });
-          }
-        },
-        USERAUTH_INFO_REQUEST: (p, name, instructions, prompts) => {
-          if (curAuth.type === 'keyboard-interactive') {
-            const nprompts = (Array.isArray(prompts) ? prompts.length : 0);
-            if (nprompts === 0) {
-              debug && debug(
-                'Client: Sending automatic USERAUTH_INFO_RESPONSE'
-              );
-              proto.authInfoRes();
-              return;
-            }
-            // We sent a keyboard-interactive user authentication request and
-            // now the server is sending us the prompts we need to present to
-            // the user
-            curAuth.prompt(
-              name,
-              instructions,
-              '',
-              prompts,
-              (answers) => {
-                proto.authInfoRes(answers);
-              }
-            );
-          }
-        },
-        REQUEST_SUCCESS: (p, data) => {
-          if (callbacks.length)
-            callbacks.shift()(false, data);
-        },
-        REQUEST_FAILURE: (p) => {
-          if (callbacks.length)
-            callbacks.shift()(true);
-        },
-        GLOBAL_REQUEST: (p, name, wantReply, data) => {
-          switch (name) {
-            case 'hostkeys-00@openssh.com':
-              // Automatically verify keys before passing to end user
-              hostKeysProve(this, data, (err, keys) => {
-                if (err)
-                  return;
-                this.emit('hostkeys', keys);
-              });
-              if (wantReply)
-                proto.requestSuccess();
-              break;
-            default:
-              // Auto-reject all other global requests, this can be especially
-              // useful if the server is sending us dummy keepalive global
-              // requests
-              if (wantReply)
-                proto.requestFailure();
-          }
-        },
-        CHANNEL_OPEN: (p, info) => {
-          // Handle incoming requests from server, typically a forwarded TCP or
-          // X11 connection
-          onCHANNEL_OPEN(this, info);
-        },
-        CHANNEL_OPEN_CONFIRMATION: (p, info) => {
-          const channel = this._chanMgr.get(info.recipient);
-          if (typeof channel !== 'function')
-            return;
-
-          const isSFTP = (channel.type === 'sftp');
-          const type = (isSFTP ? 'session' : channel.type);
-          const chanInfo = {
-            type,
-            incoming: {
-              id: info.recipient,
-              window: MAX_WINDOW,
-              packetSize: PACKET_SIZE,
-              state: 'open'
-            },
-            outgoing: {
-              id: info.sender,
-              window: info.window,
-              packetSize: info.packetSize,
-              state: 'open'
-            }
-          };
-          const instance = (
-            isSFTP
-            ? new SFTP(this, chanInfo, { debug })
-            : new Channel(this, chanInfo)
-          );
-          this._chanMgr.update(info.recipient, instance);
-          channel(undefined, instance);
-        },
-        CHANNEL_OPEN_FAILURE: (p, recipient, reason, description) => {
-          const channel = this._chanMgr.get(recipient);
-          if (typeof channel !== 'function')
-            return;
-
-          const info = { reason, description };
-          onChannelOpenFailure(this, recipient, info, channel);
-        },
-        CHANNEL_DATA: (p, recipient, data) => {
-          const channel = this._chanMgr.get(recipient);
-          if (typeof channel !== 'object' || channel === null)
-            return;
-
-          // The remote party should not be sending us data if there is no
-          // window space available ...
-          // TODO: raise error on data with not enough window?
-          if (channel.incoming.window === 0)
-            return;
-
-          channel.incoming.window -= data.length;
-
-          if (channel.push(data) === false) {
-            channel._waitChanDrain = true;
-            return;
-          }
-
-          if (channel.incoming.window <= WINDOW_THRESHOLD)
-            windowAdjust(channel);
-        },
-        CHANNEL_EXTENDED_DATA: (p, recipient, data, type) => {
-          if (type !== STDERR)
-            return;
-
-          const channel = this._chanMgr.get(recipient);
-          if (typeof channel !== 'object' || channel === null)
-            return;
-
-          // The remote party should not be sending us data if there is no
-          // window space available ...
-          // TODO: raise error on data with not enough window?
-          if (channel.incoming.window === 0)
-            return;
-
-          channel.incoming.window -= data.length;
-
-          if (!channel.stderr.push(data)) {
-            channel._waitChanDrain = true;
-            return;
-          }
-
-          if (channel.incoming.window <= WINDOW_THRESHOLD)
-            windowAdjust(channel);
-        },
-        CHANNEL_WINDOW_ADJUST: (p, recipient, amount) => {
-          const channel = this._chanMgr.get(recipient);
-          if (typeof channel !== 'object' || channel === null)
-            return;
-
-          // The other side is allowing us to send `amount` more bytes of data
-          channel.outgoing.window += amount;
-
-          if (channel._waitWindow) {
-            channel._waitWindow = false;
-
-            if (channel._chunk) {
-              channel._write(channel._chunk, null, channel._chunkcb);
-            } else if (channel._chunkcb) {
-              channel._chunkcb();
-            } else if (channel._chunkErr) {
-              channel.stderr._write(channel._chunkErr,
-                                    null,
-                                    channel._chunkcbErr);
-            } else if (channel._chunkcbErr) {
-              channel._chunkcbErr();
-            }
-          }
-        },
-        CHANNEL_SUCCESS: (p, recipient) => {
-          const channel = this._chanMgr.get(recipient);
-          if (typeof channel !== 'object' || channel === null)
-            return;
-
-          this._resetKA();
-
-          if (channel._callbacks.length)
-            channel._callbacks.shift()(false);
-        },
-        CHANNEL_FAILURE: (p, recipient) => {
-          const channel = this._chanMgr.get(recipient);
-          if (typeof channel !== 'object' || channel === null)
-            return;
-
-          this._resetKA();
-
-          if (channel._callbacks.length)
-            channel._callbacks.shift()(true);
-        },
-        CHANNEL_REQUEST: (p, recipient, type, wantReply, data) => {
-          const channel = this._chanMgr.get(recipient);
-          if (typeof channel !== 'object' || channel === null)
-            return;
-
-          const exit = channel._exit;
-          if (exit.code !== undefined)
-            return;
-          switch (type) {
-            case 'exit-status':
-              channel.emit('exit', exit.code = data);
-              return;
-            case 'exit-signal':
-              channel.emit('exit',
-                           exit.code = null,
-                           exit.signal = `SIG${data.signal}`,
-                           exit.dump = data.coreDumped,
-                           exit.desc = data.errorMessage);
-              return;
-          }
-
-          // Keepalive request? OpenSSH will send one as a channel request if
-          // there is a channel open
-
-          if (wantReply)
-            p.channelFailure(channel.outgoing.id);
-        },
-        CHANNEL_EOF: (p, recipient) => {
-          const channel = this._chanMgr.get(recipient);
-          if (typeof channel !== 'object' || channel === null)
-            return;
-
-          if (channel.incoming.state !== 'open')
-            return;
-          channel.incoming.state = 'eof';
-
-          if (channel.readable)
-            channel.push(null);
-          if (channel.stderr.readable)
-            channel.stderr.push(null);
-        },
-        CHANNEL_CLOSE: (p, recipient) => {
-          onCHANNEL_CLOSE(this, recipient, this._chanMgr.get(recipient));
-        },
-      },
-    });
-
-    sock.pause();
-
-    // TODO: check keepalive implementation
-    // Keepalive-related
-    const kainterval = this.config.keepaliveInterval;
-    const kacountmax = this.config.keepaliveCountMax;
-    let kacount = 0;
-    let katimer;
-    const sendKA = () => {
-      if (++kacount > kacountmax) {
-        clearInterval(katimer);
-        if (sock.readable) {
-          const err = new Error('Keepalive timeout');
-          err.level = 'client-timeout';
-          this.emit('error', err);
-          sock.destroy();
-        }
-        return;
-      }
-      if (isWritable(sock)) {
-        // Append dummy callback to keep correct callback order
-        callbacks.push(resetKA);
-        proto.ping();
-      } else {
-        clearInterval(katimer);
-      }
-    };
-    function resetKA() {
-      if (kainterval > 0) {
-        kacount = 0;
-        clearInterval(katimer);
-        if (isWritable(sock))
-          katimer = setInterval(sendKA, kainterval);
-      }
-    }
-    this._resetKA = resetKA;
-
-    const onDone = (() => {
-      let called = false;
-      return () => {
-        if (called)
-          return;
-        called = true;
-        if (wasConnected && !sawHeader) {
-          const err =
-            makeError('Connection lost before handshake', 'protocol', true);
-          this.emit('error', err);
-        }
-      };
-    })();
-    const onConnect = (() => {
-      let called = false;
-      return () => {
-        if (called)
-          return;
-        called = true;
-
-        wasConnected = true;
-        debug && debug('Socket connected');
-        this.emit('connect');
-
-        cryptoInit.then(() => {
-          proto.start();
-          sock.on('data', (data) => {
-            try {
-              proto.parse(data, 0, data.length);
-            } catch (ex) {
-              this.emit('error', ex);
-              try {
-                if (isWritable(sock))
-                  sock.end();
-              } catch {}
-            }
-          });
-
-          // Drain stderr if we are connection hopping using an exec stream
-          if (sock.stderr && typeof sock.stderr.resume === 'function')
-            sock.stderr.resume();
-
-          sock.resume();
-        }).catch((err) => {
-          this.emit('error', err);
-          try {
-            if (isWritable(sock))
-              sock.end();
-          } catch {}
-        });
-      };
-    })();
-    let wasConnected = false;
-    sock.on('connect', onConnect)
-        .on('timeout', () => {
-      this.emit('timeout');
-    }).on('error', (err) => {
-      debug && debug(`Socket error: ${err.message}`);
-      clearTimeout(this._readyTimeout);
-      err.level = 'client-socket';
-      this.emit('error', err);
-    }).on('end', () => {
-      debug && debug('Socket ended');
-      onDone();
-      proto.cleanup();
-      clearTimeout(this._readyTimeout);
-      clearInterval(katimer);
-      this.emit('end');
-    }).on('close', () => {
-      debug && debug('Socket closed');
-      onDone();
-      proto.cleanup();
-      clearTimeout(this._readyTimeout);
-      clearInterval(katimer);
-      this.emit('close');
-
-      // Notify outstanding channel requests of disconnection ...
-      const callbacks_ = callbacks;
-      callbacks = this._callbacks = [];
-      const err = new Error('No response from server');
-      for (let i = 0; i < callbacks_.length; ++i)
-        callbacks_[i](err);
-
-      // Simulate error for any channels waiting to be opened
-      this._chanMgr.cleanup(err);
-    });
-
-    // Begin authentication handling ===========================================
-    let curAuth;
-    let curPartial = null;
-    let curAuthsLeft = null;
-    const authsAllowed = ['none'];
-    if (this.config.password !== undefined)
-      authsAllowed.push('password');
-    if (privateKey !== undefined)
-      authsAllowed.push('publickey');
-    if (this._agent !== undefined)
-      authsAllowed.push('agent');
-    if (this.config.tryKeyboard)
-      authsAllowed.push('keyboard-interactive');
-    if (privateKey !== undefined
-        && this.config.localHostname !== undefined
-        && this.config.localUsername !== undefined) {
-      authsAllowed.push('hostbased');
-    }
-
-    if (Array.isArray(authHandler))
-      authHandler = makeSimpleAuthHandler(authHandler);
-    else if (typeof authHandler !== 'function')
-      authHandler = makeSimpleAuthHandler(authsAllowed);
-
-    let hasSentAuth = false;
-    const doNextAuth = (nextAuth) => {
-      if (hasSentAuth)
-        return;
-      hasSentAuth = true;
-
-      if (nextAuth === false) {
-        const err = new Error('All configured authentication methods failed');
-        err.level = 'client-authentication';
-        this.emit('error', err);
-        this.end();
-        return;
-      }
-
-      if (typeof nextAuth === 'string') {
-        // Remain backwards compatible with original `authHandler()` usage,
-        // which only supported passing names of next method to try using data
-        // from the `connect()` config object
-
-        const type = nextAuth;
-        if (authsAllowed.indexOf(type) === -1)
-          return skipAuth(`Authentication method not allowed: ${type}`);
-
-        const username = this.config.username;
-        switch (type) {
-          case 'password':
-            nextAuth = { type, username, password: this.config.password };
-            break;
-          case 'publickey':
-            nextAuth = { type, username, key: privateKey };
-            break;
-          case 'hostbased':
-            nextAuth = {
-              type,
-              username,
-              key: privateKey,
-              localHostname: this.config.localHostname,
-              localUsername: this.config.localUsername,
-            };
-            break;
-          case 'agent':
-            nextAuth = {
-              type,
-              username,
-              agentCtx: new AgentContext(this._agent),
-            };
-            break;
-          case 'keyboard-interactive':
-            nextAuth = {
-              type,
-              username,
-              prompt: (...args) => this.emit('keyboard-interactive', ...args),
-            };
-            break;
-          case 'none':
-            nextAuth = { type, username };
-            break;
-          default:
-            return skipAuth(
-              `Skipping unsupported authentication method: ${nextAuth}`
-            );
-        }
-      } else if (typeof nextAuth !== 'object' || nextAuth === null) {
-        return skipAuth(
-          `Skipping invalid authentication attempt: ${nextAuth}`
-        );
-      } else {
-        const username = nextAuth.username;
-        if (typeof username !== 'string') {
-          return skipAuth(
-            `Skipping invalid authentication attempt: ${nextAuth}`
-          );
-        }
-        const type = nextAuth.type;
-        switch (type) {
-          case 'password': {
-            const { password } = nextAuth;
-            if (typeof password !== 'string' && !Buffer.isBuffer(password))
-              return skipAuth('Skipping invalid password auth attempt');
-            nextAuth = { type, username, password };
-            break;
-          }
-          case 'publickey': {
-            const key = parseKey(nextAuth.key, nextAuth.passphrase);
-            if (key instanceof Error)
-              return skipAuth('Skipping invalid key auth attempt');
-            if (!key.isPrivateKey())
-              return skipAuth('Skipping non-private key');
-            nextAuth = { type, username, key };
-            break;
-          }
-          case 'hostbased': {
-            const { localHostname, localUsername } = nextAuth;
-            const key = parseKey(nextAuth.key, nextAuth.passphrase);
-            if (key instanceof Error
-                || typeof localHostname !== 'string'
-                || typeof localUsername !== 'string') {
-              return skipAuth('Skipping invalid hostbased auth attempt');
-            }
-            if (!key.isPrivateKey())
-              return skipAuth('Skipping non-private key');
-            nextAuth = { type, username, key, localHostname, localUsername };
-            break;
-          }
-          case 'agent': {
-            let agent = nextAuth.agent;
-            if (typeof agent === 'string' && agent.length) {
-              agent = createAgent(agent);
-            } else if (!isAgent(agent)) {
-              return skipAuth(
-                `Skipping invalid agent: ${nextAuth.agent}`
-              );
-            }
-            nextAuth = { type, username, agentCtx: new AgentContext(agent) };
-            break;
-          }
-          case 'keyboard-interactive': {
-            const { prompt } = nextAuth;
-            if (typeof prompt !== 'function') {
-              return skipAuth(
-                'Skipping invalid keyboard-interactive auth attempt'
-              );
-            }
-            nextAuth = { type, username, prompt };
-            break;
-          }
-          case 'none':
-            nextAuth = { type, username };
-            break;
-          default:
-            return skipAuth(
-              `Skipping unsupported authentication method: ${nextAuth}`
-            );
-        }
-      }
-      curAuth = nextAuth;
-
-      // Begin authentication method's process
-      try {
-        const username = curAuth.username;
-        switch (curAuth.type) {
-          case 'password':
-            proto.authPassword(username, curAuth.password);
-            break;
-          case 'publickey': {
-            let keyAlgo;
-            curAuth.keyAlgos = getKeyAlgos(this, curAuth.key, serverSigAlgs);
-            if (curAuth.keyAlgos) {
-              if (curAuth.keyAlgos.length) {
-                keyAlgo = curAuth.keyAlgos[0][0];
-              } else {
-                return skipAuth(
-                  'Skipping key authentication (no mutual hash algorithm)'
-                );
-              }
-            }
-            proto.authPK(username, curAuth.key, keyAlgo);
-            break;
-          }
-          case 'hostbased': {
-            let keyAlgo;
-            let hashAlgo;
-            curAuth.keyAlgos = getKeyAlgos(this, curAuth.key, serverSigAlgs);
-            if (curAuth.keyAlgos) {
-              if (curAuth.keyAlgos.length) {
-                [keyAlgo, hashAlgo] = curAuth.keyAlgos[0];
-              } else {
-                return skipAuth(
-                  'Skipping hostbased authentication (no mutual hash algorithm)'
-                );
-              }
-            }
-
-            proto.authHostbased(username,
-                                curAuth.key,
-                                curAuth.localHostname,
-                                curAuth.localUsername,
-                                keyAlgo,
-                                (buf, cb) => {
-              const signature = curAuth.key.sign(buf, hashAlgo);
-              if (signature instanceof Error) {
-                signature.message =
-                  `Error while signing with key: ${signature.message}`;
-                signature.level = 'client-authentication';
-                this.emit('error', signature);
-                return tryNextAuth();
-              }
-
-              cb(signature);
-            });
-            break;
-          }
-          case 'agent':
-            curAuth.agentCtx.init((err) => {
-              if (err) {
-                err.level = 'agent';
-                this.emit('error', err);
-                return tryNextAuth();
-              }
-              tryNextAgentKey();
-            });
-            break;
-          case 'keyboard-interactive':
-            proto.authKeyboard(username);
-            break;
-          case 'none':
-            proto.authNone(username);
-            break;
-        }
-      } finally {
-        hasSentAuth = false;
-      }
-    };
-
-    function skipAuth(msg) {
-      debug && debug(msg);
-      process.nextTick(tryNextAuth);
-    }
-
-    function tryNextAuth() {
-      hasSentAuth = false;
-      const auth = authHandler(curAuthsLeft, curPartial, doNextAuth);
-      if (hasSentAuth || auth === undefined)
-        return;
-      doNextAuth(auth);
-    }
-
-    const tryNextAgentKey = () => {
-      if (curAuth.type === 'agent') {
-        const key = curAuth.agentCtx.nextKey();
-        if (key === false) {
-          debug && debug('Agent: No more keys left to try');
-          debug && debug('Client: agent auth failed');
-          tryNextAuth();
-        } else {
-          const pos = curAuth.agentCtx.pos();
-          let keyAlgo;
-          curAuth.keyAlgos = getKeyAlgos(this, key, serverSigAlgs);
-          if (curAuth.keyAlgos) {
-            if (curAuth.keyAlgos.length) {
-              keyAlgo = curAuth.keyAlgos[0][0];
-            } else {
-              debug && debug(
-                `Agent: Skipping key #${pos + 1} (no mutual hash algorithm)`
-              );
-              tryNextAgentKey();
-              return;
-            }
-          }
-          debug && debug(`Agent: Trying key #${pos + 1}`);
-          proto.authPK(curAuth.username, key, keyAlgo);
-        }
-      }
-    };
-
-    const startTimeout = () => {
-      if (this.config.readyTimeout > 0) {
-        this._readyTimeout = setTimeout(() => {
-          const err = new Error('Timed out while waiting for handshake');
-          err.level = 'client-timeout';
-          this.emit('error', err);
-          sock.destroy();
-        }, this.config.readyTimeout);
-      }
-    };
-
-    if (!cfg.sock) {
-      let host = this.config.host;
-      const forceIPv4 = this.config.forceIPv4;
-      const forceIPv6 = this.config.forceIPv6;
-
-      debug && debug(`Client: Trying ${host} on port ${this.config.port} ...`);
-
-      const doConnect = () => {
-        startTimeout();
-        sock.connect({
-          host,
-          port: this.config.port,
-          localAddress: this.config.localAddress,
-          localPort: this.config.localPort
-        });
-        sock.setMaxListeners(0);
-        sock.setTimeout(typeof cfg.timeout === 'number' ? cfg.timeout : 0);
-      };
-
-      if ((!forceIPv4 && !forceIPv6) || (forceIPv4 && forceIPv6)) {
-        doConnect();
-      } else {
-        dnsLookup(host, (forceIPv4 ? 4 : 6), (err, address, family) => {
-          if (err) {
-            const type = (forceIPv4 ? 'IPv4' : 'IPv6');
-            const error = new Error(
-              `Error while looking up ${type} address for '${host}': ${err}`
-            );
-            clearTimeout(this._readyTimeout);
-            error.level = 'client-dns';
-            this.emit('error', error);
-            this.emit('close');
-            return;
-          }
-          host = address;
-          doConnect();
-        });
-      }
-    } else {
-      // Custom socket passed in
-      startTimeout();
-      if (typeof sock.connecting === 'boolean') {
-        // net.Socket
-
-        if (!sock.connecting) {
-          // Already connected
-          onConnect();
-        }
-      } else {
-        // Assume socket/stream is already "connected"
-        onConnect();
-      }
-    }
-
-    return this;
-  }
-
-  end() {
-    if (this._sock && isWritable(this._sock)) {
-      this._protocol.disconnect(DISCONNECT_REASON.BY_APPLICATION);
-      this._sock.end();
-    }
-    return this;
-  }
-
-  destroy() {
-    this._sock && isWritable(this._sock) && this._sock.destroy();
-    return this;
-  }
-
-  exec(cmd, opts, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    if (typeof opts === 'function') {
-      cb = opts;
-      opts = {};
-    }
-
-    const extraOpts = { allowHalfOpen: (opts.allowHalfOpen !== false) };
-
-    openChannel(this, 'session', extraOpts, (err, chan) => {
-      if (err) {
-        cb(err);
-        return;
-      }
-
-      const todo = [];
-
-      function reqCb(err) {
-        if (err) {
-          chan.close();
-          cb(err);
-          return;
-        }
-        if (todo.length)
-          todo.shift()();
-      }
-
-      if (this.config.allowAgentFwd === true
-          || (opts
-              && opts.agentForward === true
-              && this._agent !== undefined)) {
-        todo.push(() => reqAgentFwd(chan, reqCb));
-      }
-
-      if (typeof opts === 'object' && opts !== null) {
-        if (typeof opts.env === 'object' && opts.env !== null)
-          reqEnv(chan, opts.env);
-        if ((typeof opts.pty === 'object' && opts.pty !== null)
-            || opts.pty === true) {
-          todo.push(() => reqPty(chan, opts.pty, reqCb));
-        }
-        if ((typeof opts.x11 === 'object' && opts.x11 !== null)
-            || opts.x11 === 'number'
-            || opts.x11 === true) {
-          todo.push(() => reqX11(chan, opts.x11, reqCb));
-        }
-      }
-
-      todo.push(() => reqExec(chan, cmd, opts, cb));
-      todo.shift()();
-    });
-
-    return this;
-  }
-
-  shell(wndopts, opts, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    if (typeof wndopts === 'function') {
-      cb = wndopts;
-      wndopts = opts = undefined;
-    } else if (typeof opts === 'function') {
-      cb = opts;
-      opts = undefined;
-    }
-    if (wndopts && (wndopts.x11 !== undefined || wndopts.env !== undefined)) {
-      opts = wndopts;
-      wndopts = undefined;
-    }
-
-    openChannel(this, 'session', (err, chan) => {
-      if (err) {
-        cb(err);
-        return;
-      }
-
-      const todo = [];
-
-      function reqCb(err) {
-        if (err) {
-          chan.close();
-          cb(err);
-          return;
-        }
-        if (todo.length)
-          todo.shift()();
-      }
-
-      if (this.config.allowAgentFwd === true
-          || (opts
-              && opts.agentForward === true
-              && this._agent !== undefined)) {
-        todo.push(() => reqAgentFwd(chan, reqCb));
-      }
-
-      if (wndopts !== false)
-        todo.push(() => reqPty(chan, wndopts, reqCb));
-
-      if (typeof opts === 'object' && opts !== null) {
-        if (typeof opts.env === 'object' && opts.env !== null)
-          reqEnv(chan, opts.env);
-        if ((typeof opts.x11 === 'object' && opts.x11 !== null)
-            || opts.x11 === 'number'
-            || opts.x11 === true) {
-          todo.push(() => reqX11(chan, opts.x11, reqCb));
-        }
-      }
-
-      todo.push(() => reqShell(chan, cb));
-      todo.shift()();
-    });
-
-    return this;
-  }
-
-  subsys(name, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    openChannel(this, 'session', (err, chan) => {
-      if (err) {
-        cb(err);
-        return;
-      }
-
-      reqSubsystem(chan, name, (err, stream) => {
-        if (err) {
-          cb(err);
-          return;
-        }
-
-        cb(undefined, stream);
-      });
-    });
-
-    return this;
-  }
-
-  forwardIn(bindAddr, bindPort, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    // Send a request for the server to start forwarding TCP connections to us
-    // on a particular address and port
-
-    const wantReply = (typeof cb === 'function');
-
-    if (wantReply) {
-      this._callbacks.push((had_err, data) => {
-        if (had_err) {
-          cb(had_err !== true
-             ? had_err
-             : new Error(`Unable to bind to ${bindAddr}:${bindPort}`));
-          return;
-        }
-
-        let realPort = bindPort;
-        if (bindPort === 0 && data && data.length >= 4) {
-          realPort = readUInt32BE(data, 0);
-          if (!(this._protocol._compatFlags & COMPAT.DYN_RPORT_BUG))
-            bindPort = realPort;
-        }
-
-        this._forwarding[`${bindAddr}:${bindPort}`] = realPort;
-
-        cb(undefined, realPort);
-      });
-    }
-
-    this._protocol.tcpipForward(bindAddr, bindPort, wantReply);
-
-    return this;
-  }
-
-  unforwardIn(bindAddr, bindPort, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    // Send a request to stop forwarding us new connections for a particular
-    // address and port
-
-    const wantReply = (typeof cb === 'function');
-
-    if (wantReply) {
-      this._callbacks.push((had_err) => {
-        if (had_err) {
-          cb(had_err !== true
-             ? had_err
-             : new Error(`Unable to unbind from ${bindAddr}:${bindPort}`));
-          return;
-        }
-
-        delete this._forwarding[`${bindAddr}:${bindPort}`];
-
-        cb();
-      });
-    }
-
-    this._protocol.cancelTcpipForward(bindAddr, bindPort, wantReply);
-
-    return this;
-  }
-
-  forwardOut(srcIP, srcPort, dstIP, dstPort, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    // Send a request to forward a TCP connection to the server
-
-    const cfg = {
-      srcIP: srcIP,
-      srcPort: srcPort,
-      dstIP: dstIP,
-      dstPort: dstPort
-    };
-
-    if (typeof cb !== 'function')
-      cb = noop;
-
-    openChannel(this, 'direct-tcpip', cfg, cb);
-
-    return this;
-  }
-
-  openssh_noMoreSessions(cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    const wantReply = (typeof cb === 'function');
-
-    if (!this.config.strictVendor
-        || (this.config.strictVendor && RE_OPENSSH.test(this._remoteVer))) {
-      if (wantReply) {
-        this._callbacks.push((had_err) => {
-          if (had_err) {
-            cb(had_err !== true
-               ? had_err
-               : new Error('Unable to disable future sessions'));
-            return;
-          }
-
-          cb();
-        });
-      }
-
-      this._protocol.openssh_noMoreSessions(wantReply);
-      return this;
-    }
-
-    if (!wantReply)
-      return this;
-
-    process.nextTick(
-      cb,
-      new Error(
-        'strictVendor enabled and server is not OpenSSH or compatible version'
-      )
-    );
-
-    return this;
-  }
-
-  openssh_forwardInStreamLocal(socketPath, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    const wantReply = (typeof cb === 'function');
-
-    if (!this.config.strictVendor
-        || (this.config.strictVendor && RE_OPENSSH.test(this._remoteVer))) {
-      if (wantReply) {
-        this._callbacks.push((had_err) => {
-          if (had_err) {
-            cb(had_err !== true
-               ? had_err
-               : new Error(`Unable to bind to ${socketPath}`));
-            return;
-          }
-          this._forwardingUnix[socketPath] = true;
-          cb();
-        });
-      }
-
-      this._protocol.openssh_streamLocalForward(socketPath, wantReply);
-      return this;
-    }
-
-    if (!wantReply)
-      return this;
-
-    process.nextTick(
-      cb,
-      new Error(
-        'strictVendor enabled and server is not OpenSSH or compatible version'
-      )
-    );
-
-    return this;
-  }
-
-  openssh_unforwardInStreamLocal(socketPath, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    const wantReply = (typeof cb === 'function');
-
-    if (!this.config.strictVendor
-        || (this.config.strictVendor && RE_OPENSSH.test(this._remoteVer))) {
-      if (wantReply) {
-        this._callbacks.push((had_err) => {
-          if (had_err) {
-            cb(had_err !== true
-               ? had_err
-               : new Error(`Unable to unbind from ${socketPath}`));
-            return;
-          }
-          delete this._forwardingUnix[socketPath];
-          cb();
-        });
-      }
-
-      this._protocol.openssh_cancelStreamLocalForward(socketPath, wantReply);
-      return this;
-    }
-
-    if (!wantReply)
-      return this;
-
-    process.nextTick(
-      cb,
-      new Error(
-        'strictVendor enabled and server is not OpenSSH or compatible version'
-      )
-    );
-
-    return this;
-  }
-
-  openssh_forwardOutStreamLocal(socketPath, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    if (typeof cb !== 'function')
-      cb = noop;
-
-    if (!this.config.strictVendor
-        || (this.config.strictVendor && RE_OPENSSH.test(this._remoteVer))) {
-      openChannel(this, 'direct-streamlocal@openssh.com', { socketPath }, cb);
-      return this;
-    }
-    process.nextTick(
-      cb,
-      new Error(
-        'strictVendor enabled and server is not OpenSSH or compatible version'
-      )
-    );
-
-    return this;
-  }
-
-  sftp(env, cb) {
-    if (!this._sock || !isWritable(this._sock))
-      throw new Error('Not connected');
-
-    if (typeof env === 'function') {
-      cb = env;
-      env = undefined;
-    }
-
-    openChannel(this, 'sftp', (err, sftp) => {
-      if (err) {
-        cb(err);
-        return;
-      }
-
-      const reqSubsystemCb = (err, sftp_) => {
-        if (err) {
-          cb(err);
-          return;
-        }
-
-        function removeListeners() {
-          sftp.removeListener('ready', onReady);
-          sftp.removeListener('error', onError);
-          sftp.removeListener('exit', onExit);
-          sftp.removeListener('close', onExit);
-        }
-
-        function onReady() {
-          // TODO: do not remove exit/close in case remote end closes the
-          // channel abruptly and we need to notify outstanding callbacks
-          removeListeners();
-          cb(undefined, sftp);
-        }
-
-        function onError(err) {
-          removeListeners();
-          cb(err);
-        }
-
-        function onExit(code, signal) {
-          removeListeners();
-          let msg;
-          if (typeof code === 'number')
-            msg = `Received exit code ${code} while establishing SFTP session`;
-          else if (signal !== undefined)
-            msg = `Received signal ${signal} while establishing SFTP session`;
-          else
-            msg = 'Received unexpected SFTP session termination';
-          const err = new Error(msg);
-          err.code = code;
-          err.signal = signal;
-          cb(err);
-        }
-
-        sftp.on('ready', onReady)
-            .on('error', onError)
-            .on('exit', onExit)
-            .on('close', onExit);
-
-        sftp._init();
-      };
-
-      if (typeof env === 'object' && env !== null) {
-        reqEnv(sftp, env, (err) => {
-          if (err) {
-            cb(err);
-            return;
-          }
-
-          reqSubsystem(sftp, 'sftp', reqSubsystemCb);
-        });
-      } else {
-        reqSubsystem(sftp, 'sftp', reqSubsystemCb);
-      }
-    });
-
-    return this;
-  }
-
-  setNoDelay(noDelay) {
-    if (this._sock && typeof this._sock.setNoDelay === 'function')
-      this._sock.setNoDelay(noDelay);
-
-    return this;
-  }
-}
-
-function openChannel(self, type, opts, cb) {
-  // Ask the server to open a channel for some purpose
-  // (e.g. session (sftp, exec, shell), or forwarding a TCP connection
-  const initWindow = MAX_WINDOW;
-  const maxPacket = PACKET_SIZE;
-
-  if (typeof opts === 'function') {
-    cb = opts;
-    opts = {};
-  }
-
-  const wrapper = (err, stream) => {
-    cb(err, stream);
-  };
-  wrapper.type = type;
-
-  const localChan = self._chanMgr.add(wrapper);
-
-  if (localChan === -1) {
-    cb(new Error('No free channels available'));
-    return;
-  }
-
-  switch (type) {
-    case 'session':
-    case 'sftp':
-      self._protocol.session(localChan, initWindow, maxPacket);
-      break;
-    case 'direct-tcpip':
-      self._protocol.directTcpip(localChan, initWindow, maxPacket, opts);
-      break;
-    case 'direct-streamlocal@openssh.com':
-      self._protocol.openssh_directStreamLocal(
-        localChan, initWindow, maxPacket, opts
-      );
-      break;
-    default:
-      throw new Error(`Unsupported channel type: ${type}`);
-  }
-}
-
-function reqX11(chan, screen, cb) {
-  // Asks server to start sending us X11 connections
-  const cfg = {
-    single: false,
-    protocol: 'MIT-MAGIC-COOKIE-1',
-    cookie: undefined,
-    screen: 0
-  };
-
-  if (typeof screen === 'function') {
-    cb = screen;
-  } else if (typeof screen === 'object' && screen !== null) {
-    if (typeof screen.single === 'boolean')
-      cfg.single = screen.single;
-    if (typeof screen.screen === 'number')
-      cfg.screen = screen.screen;
-    if (typeof screen.protocol === 'string')
-      cfg.protocol = screen.protocol;
-    if (typeof screen.cookie === 'string')
-      cfg.cookie = screen.cookie;
-    else if (Buffer.isBuffer(screen.cookie))
-      cfg.cookie = screen.cookie.hexSlice(0, screen.cookie.length);
-  }
-  if (cfg.cookie === undefined)
-    cfg.cookie = randomCookie();
-
-  const wantReply = (typeof cb === 'function');
-
-  if (chan.outgoing.state !== 'open') {
-    if (wantReply)
-      cb(new Error('Channel is not open'));
-    return;
-  }
-
-  if (wantReply) {
-    chan._callbacks.push((had_err) => {
-      if (had_err) {
-        cb(had_err !== true ? had_err : new Error('Unable to request X11'));
-        return;
-      }
-
-      chan._hasX11 = true;
-      ++chan._client._acceptX11;
-      chan.once('close', () => {
-        if (chan._client._acceptX11)
-          --chan._client._acceptX11;
-      });
-
-      cb();
-    });
-  }
-
-  chan._client._protocol.x11Forward(chan.outgoing.id, cfg, wantReply);
-}
-
-function reqPty(chan, opts, cb) {
-  let rows = 24;
-  let cols = 80;
-  let width = 640;
-  let height = 480;
-  let term = 'vt100';
-  let modes = null;
-
-  if (typeof opts === 'function') {
-    cb = opts;
-  } else if (typeof opts === 'object' && opts !== null) {
-    if (typeof opts.rows === 'number')
-      rows = opts.rows;
-    if (typeof opts.cols === 'number')
-      cols = opts.cols;
-    if (typeof opts.width === 'number')
-      width = opts.width;
-    if (typeof opts.height === 'number')
-      height = opts.height;
-    if (typeof opts.term === 'string')
-      term = opts.term;
-    if (typeof opts.modes === 'object')
-      modes = opts.modes;
-  }
-
-  const wantReply = (typeof cb === 'function');
-
-  if (chan.outgoing.state !== 'open') {
-    if (wantReply)
-      cb(new Error('Channel is not open'));
-    return;
-  }
-
-  if (wantReply) {
-    chan._callbacks.push((had_err) => {
-      if (had_err) {
-        cb(had_err !== true
-           ? had_err
-           : new Error('Unable to request a pseudo-terminal'));
-        return;
-      }
-      cb();
-    });
-  }
-
-  chan._client._protocol.pty(chan.outgoing.id,
-                             rows,
-                             cols,
-                             height,
-                             width,
-                             term,
-                             modes,
-                             wantReply);
-}
-
-function reqAgentFwd(chan, cb) {
-  const wantReply = (typeof cb === 'function');
-
-  if (chan.outgoing.state !== 'open') {
-    wantReply && cb(new Error('Channel is not open'));
-    return;
-  }
-  if (chan._client._agentFwdEnabled) {
-    wantReply && cb(false);
-    return;
-  }
-
-  chan._client._agentFwdEnabled = true;
-
-  chan._callbacks.push((had_err) => {
-    if (had_err) {
-      chan._client._agentFwdEnabled = false;
-      if (wantReply) {
-        cb(had_err !== true
-           ? had_err
-           : new Error('Unable to request agent forwarding'));
-      }
-      return;
-    }
-
-    if (wantReply)
-      cb();
-  });
-
-  chan._client._protocol.openssh_agentForward(chan.outgoing.id, true);
-}
-
-function reqShell(chan, cb) {
-  if (chan.outgoing.state !== 'open') {
-    cb(new Error('Channel is not open'));
-    return;
-  }
-
-  chan._callbacks.push((had_err) => {
-    if (had_err) {
-      cb(had_err !== true ? had_err : new Error('Unable to open shell'));
-      return;
-    }
-    chan.subtype = 'shell';
-    cb(undefined, chan);
-  });
-
-  chan._client._protocol.shell(chan.outgoing.id, true);
-}
-
-function reqExec(chan, cmd, opts, cb) {
-  if (chan.outgoing.state !== 'open') {
-    cb(new Error('Channel is not open'));
-    return;
-  }
-
-  chan._callbacks.push((had_err) => {
-    if (had_err) {
-      cb(had_err !== true ? had_err : new Error('Unable to exec'));
-      return;
-    }
-    chan.subtype = 'exec';
-    chan.allowHalfOpen = (opts.allowHalfOpen !== false);
-    cb(undefined, chan);
-  });
-
-  chan._client._protocol.exec(chan.outgoing.id, cmd, true);
-}
-
-function reqEnv(chan, env, cb) {
-  const wantReply = (typeof cb === 'function');
-
-  if (chan.outgoing.state !== 'open') {
-    if (wantReply)
-      cb(new Error('Channel is not open'));
-    return;
-  }
-
-  if (wantReply) {
-    chan._callbacks.push((had_err) => {
-      if (had_err) {
-        cb(had_err !== true
-           ? had_err
-           : new Error('Unable to set environment'));
-        return;
-      }
-      cb();
-    });
-  }
-
-  const keys = Object.keys(env || {});
-
-  for (let i = 0; i < keys.length; ++i) {
-    const key = keys[i];
-    const val = env[key];
-    chan._client._protocol.env(chan.outgoing.id, key, val, wantReply);
-  }
-}
-
-function reqSubsystem(chan, name, cb) {
-  if (chan.outgoing.state !== 'open') {
-    cb(new Error('Channel is not open'));
-    return;
-  }
-
-  chan._callbacks.push((had_err) => {
-    if (had_err) {
-      cb(had_err !== true
-         ? had_err
-         : new Error(`Unable to start subsystem: ${name}`));
-      return;
-    }
-    chan.subtype = 'subsystem';
-    cb(undefined, chan);
-  });
-
-  chan._client._protocol.subsystem(chan.outgoing.id, name, true);
-}
-
-// TODO: inline implementation into single call site
-function onCHANNEL_OPEN(self, info) {
-  // The server is trying to open a channel with us, this is usually when
-  // we asked the server to forward us connections on some port and now they
-  // are asking us to accept/deny an incoming connection on their side
-
-  let localChan = -1;
-  let reason;
-
-  const accept = () => {
-    const chanInfo = {
-      type: info.type,
-      incoming: {
-        id: localChan,
-        window: MAX_WINDOW,
-        packetSize: PACKET_SIZE,
-        state: 'open'
-      },
-      outgoing: {
-        id: info.sender,
-        window: info.window,
-        packetSize: info.packetSize,
-        state: 'open'
-      }
-    };
-    const stream = new Channel(self, chanInfo);
-    self._chanMgr.update(localChan, stream);
-
-    self._protocol.channelOpenConfirm(info.sender,
-                                      localChan,
-                                      MAX_WINDOW,
-                                      PACKET_SIZE);
-    return stream;
-  };
-  const reject = () => {
-    if (reason === undefined) {
-      if (localChan === -1)
-        reason = CHANNEL_OPEN_FAILURE.RESOURCE_SHORTAGE;
-      else
-        reason = CHANNEL_OPEN_FAILURE.CONNECT_FAILED;
-    }
-
-    if (localChan !== -1)
-      self._chanMgr.remove(localChan);
-
-    self._protocol.channelOpenFail(info.sender, reason, '');
-  };
-  const reserveChannel = () => {
-    localChan = self._chanMgr.add();
-
-    if (localChan === -1) {
-      reason = CHANNEL_OPEN_FAILURE.RESOURCE_SHORTAGE;
-      if (self.config.debug) {
-        self.config.debug(
-          'Client: Automatic rejection of incoming channel open: '
-            + 'no channels available'
-        );
-      }
-    }
-
-    return (localChan !== -1);
-  };
-
-  const data = info.data;
-  switch (info.type) {
-    case 'forwarded-tcpip': {
-      const val = self._forwarding[`${data.destIP}:${data.destPort}`];
-      if (val !== undefined && reserveChannel()) {
-        if (data.destPort === 0)
-          data.destPort = val;
-        self.emit('tcp connection', data, accept, reject);
-        return;
-      }
-      break;
-    }
-    case 'forwarded-streamlocal@openssh.com':
-      if (self._forwardingUnix[data.socketPath] !== undefined
-          && reserveChannel()) {
-        self.emit('unix connection', data, accept, reject);
-        return;
-      }
-      break;
-    case 'auth-agent@openssh.com':
-      if (self._agentFwdEnabled
-          && typeof self._agent.getStream === 'function'
-          && reserveChannel()) {
-        self._agent.getStream((err, stream) => {
-          if (err)
-            return reject();
-
-          const upstream = accept();
-          upstream.pipe(stream).pipe(upstream);
-        });
-        return;
-      }
-      break;
-    case 'x11':
-      if (self._acceptX11 !== 0 && reserveChannel()) {
-        self.emit('x11', data, accept, reject);
-        return;
-      }
-      break;
-    default:
-      // Automatically reject any unsupported channel open requests
-      reason = CHANNEL_OPEN_FAILURE.UNKNOWN_CHANNEL_TYPE;
-      if (self.config.debug) {
-        self.config.debug(
-          'Client: Automatic rejection of unsupported incoming channel open '
-            + `type: ${info.type}`
-        );
-      }
-  }
-
-  if (reason === undefined) {
-    reason = CHANNEL_OPEN_FAILURE.ADMINISTRATIVELY_PROHIBITED;
-    if (self.config.debug) {
-       self.config.debug(
-        'Client: Automatic rejection of unexpected incoming channel open for: '
-          + info.type
-      );
-    }
-  }
-
-  reject();
-}
-
-const randomCookie = (() => {
-  const buffer = Buffer.allocUnsafe(16);
-  return () => {
-    randomFillSync(buffer, 0, 16);
-    return buffer.hexSlice(0, 16);
-  };
-})();
-
-function makeSimpleAuthHandler(authList) {
-  if (!Array.isArray(authList))
-    throw new Error('authList must be an array');
-
-  let a = 0;
-  return (authsLeft, partialSuccess, cb) => {
-    if (a === authList.length)
-      return false;
-    return authList[a++];
-  };
-}
-
-function hostKeysProve(client, keys_, cb) {
-  if (!client._sock || !isWritable(client._sock))
-    return;
-
-  if (typeof cb !== 'function')
-    cb = noop;
-
-  if (!Array.isArray(keys_))
-    throw new TypeError('Invalid keys argument type');
-
-  const keys = [];
-  for (const key of keys_) {
-    const parsed = parseKey(key);
-    if (parsed instanceof Error)
-      throw parsed;
-    keys.push(parsed);
-  }
-
-  if (!client.config.strictVendor
-      || (client.config.strictVendor && RE_OPENSSH.test(client._remoteVer))) {
-    client._callbacks.push((had_err, data) => {
-      if (had_err) {
-        cb(had_err !== true
-           ? had_err
-           : new Error('Server failed to prove supplied keys'));
-        return;
-      }
-
-      // TODO: move all of this parsing/verifying logic out of the client?
-      const ret = [];
-      let keyIdx = 0;
-      bufferParser.init(data, 0);
-      while (bufferParser.avail()) {
-        if (keyIdx === keys.length)
-          break;
-        const key = keys[keyIdx++];
-        const keyPublic = key.getPublicSSH();
-
-        const sigEntry = bufferParser.readString();
-        sigParser.init(sigEntry, 0);
-        const type = sigParser.readString(true);
-        let value = sigParser.readString();
-
-        let algo;
-        if (type !== key.type) {
-          if (key.type === 'ssh-rsa') {
-            switch (type) {
-              case 'rsa-sha2-256':
-                algo = 'sha256';
-                break;
-              case 'rsa-sha2-512':
-                algo = 'sha512';
-                break;
-              default:
-                continue;
-            }
-          } else {
-            continue;
-          }
-        }
-
-        const sessionID = client._protocol._kex.sessionID;
-        const verifyData = Buffer.allocUnsafe(
-          4 + 29 + 4 + sessionID.length + 4 + keyPublic.length
-        );
-        let p = 0;
-        writeUInt32BE(verifyData, 29, p);
-        verifyData.utf8Write('hostkeys-prove-00@openssh.com', p += 4, 29);
-        writeUInt32BE(verifyData, sessionID.length, p += 29);
-        bufferCopy(sessionID, verifyData, 0, sessionID.length, p += 4);
-        writeUInt32BE(verifyData, keyPublic.length, p += sessionID.length);
-        bufferCopy(keyPublic, verifyData, 0, keyPublic.length, p += 4);
-
-        if (!(value = sigSSHToASN1(value, type)))
-          continue;
-        if (key.verify(verifyData, value, algo) === true)
-          ret.push(key);
-      }
-      sigParser.clear();
-      bufferParser.clear();
-
-      cb(null, ret);
-    });
-
-    client._protocol.openssh_hostKeysProve(keys);
-    return;
-  }
-
-  process.nextTick(
-    cb,
-    new Error(
-      'strictVendor enabled and server is not OpenSSH or compatible version'
-    )
-  );
-}
-
-function getKeyAlgos(client, key, serverSigAlgs) {
-  switch (key.type) {
-    case 'ssh-rsa':
-      if (client._protocol._compatFlags & COMPAT.IMPLY_RSA_SHA2_SIGALGS) {
-        if (!Array.isArray(serverSigAlgs))
-          serverSigAlgs = ['rsa-sha2-256', 'rsa-sha2-512'];
-        else
-          serverSigAlgs = ['rsa-sha2-256', 'rsa-sha2-512', ...serverSigAlgs];
-      }
-      if (Array.isArray(serverSigAlgs)) {
-        if (serverSigAlgs.indexOf('rsa-sha2-256') !== -1)
-          return [['rsa-sha2-256', 'sha256']];
-        if (serverSigAlgs.indexOf('rsa-sha2-512') !== -1)
-          return [['rsa-sha2-512', 'sha512']];
-        if (serverSigAlgs.indexOf('ssh-rsa') === -1)
-          return [];
-      }
-      return [['ssh-rsa', 'sha1']];
-  }
-}
-
-module.exports = Client;