Command injection in mscdex/ssh2

@@ -0,0 +1,4 @@
+node_modules
+lib/protocol/crypto/poly1305.js
+.eslint-plugins
+!.eslintrc.js

@@ -0,0 +1,22 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const RULES_DIR = path.join(__dirname, 'rules');
+
+let cache;
+module.exports = {
+  get rules() {
+    if (!cache) {
+      cache = {};
+      const files = fs.readdirSync(RULES_DIR)
+        .filter(filename => filename.endsWith('.js'));
+      for (const file of files) {
+        const name = file.slice(0, -3);
+        cache[name] = require(path.resolve(RULES_DIR, file));
+      }
+    }
+    return cache;
+  },
+};

@@ -0,0 +1,500 @@
+/**
+ * @fileoverview Rule to flag statements without curly braces
+ * @author Nicholas C. Zakas
+ */
+"use strict";
+
+//------------------------------------------------------------------------------
+// Requirements
+//------------------------------------------------------------------------------
+
+const astUtils = require("./utils/ast-utils");
+
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
+
+module.exports = {
+    meta: {
+        type: "suggestion",
+
+        docs: {
+            description: "enforce consistent brace style for all control statements",
+            category: "Best Practices",
+            recommended: false,
+            url: "https://eslint.org/docs/rules/curly"
+        },
+
+        schema: {
+            anyOf: [
+                {
+                    type: "array",
+                    items: [
+                        {
+                            enum: ["all"]
+                        }
+                    ],
+                    minItems: 0,
+                    maxItems: 1
+                },
+                {
+                    type: "array",
+                    items: [
+                        {
+                            enum: ["multi", "multi-line", "multi-or-nest"]
+                        },
+                        {
+                            enum: ["consistent"]
+                        }
+                    ],
+                    minItems: 0,
+                    maxItems: 2
+                }
+            ]
+        },
+
+        fixable: "code",
+
+        messages: {
+            missingCurlyAfter: "Expected { after '{{name}}'.",
+            missingCurlyAfterCondition: "Expected { after '{{name}}' condition.",
+            unexpectedCurlyAfter: "Unnecessary { after '{{name}}'.",
+            unexpectedCurlyAfterCondition: "Unnecessary { after '{{name}}' condition."
+        }
+    },
+
+    create(context) {
+
+        const multiOnly = (context.options[0] === "multi");
+        const multiLine = (context.options[0] === "multi-line");
+        const multiOrNest = (context.options[0] === "multi-or-nest");
+        const consistent = (context.options[1] === "consistent");
+
+        const sourceCode = context.getSourceCode();
+
+        //--------------------------------------------------------------------------
+        // Helpers
+        //--------------------------------------------------------------------------
+
+        /**
+         * Determines if a given node is a one-liner that's on the same line as it's preceding code.
+         * @param {ASTNode} node The node to check.
+         * @returns {boolean} True if the node is a one-liner that's on the same line as it's preceding code.
+         * @private
+         */
+        function isCollapsedOneLiner(node) {
+            const before = sourceCode.getTokenBefore(node);
+            const last = sourceCode.getLastToken(node);
+            const lastExcludingSemicolon = astUtils.isSemicolonToken(last) ? sourceCode.getTokenBefore(last) : last;
+
+            return before.loc.start.line === lastExcludingSemicolon.loc.end.line;
+        }
+
+        /**
+         * Determines if a given node is a one-liner.
+         * @param {ASTNode} node The node to check.
+         * @returns {boolean} True if the node is a one-liner.
+         * @private
+         */
+        function isOneLiner(node) {
+            if (node.type === "EmptyStatement") {
+                return true;
+            }
+
+            const first = sourceCode.getFirstToken(node);
+            const last = sourceCode.getLastToken(node);
+            const lastExcludingSemicolon = astUtils.isSemicolonToken(last) ? sourceCode.getTokenBefore(last) : last;
+
+            return first.loc.start.line === lastExcludingSemicolon.loc.end.line;
+        }
+
+        /**
+         * Determines if the given node is a lexical declaration (let, const, function, or class)
+         * @param {ASTNode} node The node to check
+         * @returns {boolean} True if the node is a lexical declaration
+         * @private
+         */
+        function isLexicalDeclaration(node) {
+            if (node.type === "VariableDeclaration") {
+                return node.kind === "const" || node.kind === "let";
+            }
+
+            return node.type === "FunctionDeclaration" || node.type === "ClassDeclaration";
+        }
+
+        /**
+         * Checks if the given token is an `else` token or not.
+         * @param {Token} token The token to check.
+         * @returns {boolean} `true` if the token is an `else` token.
+         */
+        function isElseKeywordToken(token) {
+            return token.value === "else" && token.type === "Keyword";
+        }
+
+        /**
+         * Gets the `else` keyword token of a given `IfStatement` node.
+         * @param {ASTNode} node A `IfStatement` node to get.
+         * @returns {Token} The `else` keyword token.
+         */
+        function getElseKeyword(node) {
+            return node.alternate && sourceCode.getFirstTokenBetween(node.consequent, node.alternate, isElseKeywordToken);
+        }
+
+        /**
+         * Determines whether the given node has an `else` keyword token as the first token after.
+         * @param {ASTNode} node The node to check.
+         * @returns {boolean} `true` if the node is followed by an `else` keyword token.
+         */
+        function isFollowedByElseKeyword(node) {
+            const nextToken = sourceCode.getTokenAfter(node);
+
+            return Boolean(nextToken) && isElseKeywordToken(nextToken);
+        }
+
+        /**
+         * Determines if a semicolon needs to be inserted after removing a set of curly brackets, in order to avoid a SyntaxError.
+         * @param {Token} closingBracket The } token
+         * @returns {boolean} `true` if a semicolon needs to be inserted after the last statement in the block.
+         */
+        function needsSemicolon(closingBracket) {
+            const tokenBefore = sourceCode.getTokenBefore(closingBracket);
+            const tokenAfter = sourceCode.getTokenAfter(closingBracket);
+            const lastBlockNode = sourceCode.getNodeByRangeIndex(tokenBefore.range[0]);
+
+            if (astUtils.isSemicolonToken(tokenBefore)) {
+
+                // If the last statement already has a semicolon, don't add another one.
+                return false;
+            }
+
+            if (!tokenAfter) {
+
+                // If there are no statements after this block, there is no need to add a semicolon.
+                return false;
+            }
+
+            if (lastBlockNode.type === "BlockStatement" && lastBlockNode.parent.type !== "FunctionExpression" && lastBlockNode.parent.type !== "ArrowFunctionExpression") {
+
+                /*
+                 * If the last node surrounded by curly brackets is a BlockStatement (other than a FunctionExpression or an ArrowFunctionExpression),
+                 * don't insert a semicolon. Otherwise, the semicolon would be parsed as a separate statement, which would cause
+                 * a SyntaxError if it was followed by `else`.
+                 */
+                return false;
+            }
+
+            if (tokenBefore.loc.end.line === tokenAfter.loc.start.line) {
+
+                // If the next token is on the same line, insert a semicolon.
+                return true;
+            }
+
+            if (/^[([/`+-]/u.test(tokenAfter.value)) {
+
+                // If the next token starts with a character that would disrupt ASI, insert a semicolon.
+                return true;
+            }
+
+            if (tokenBefore.type === "Punctuator" && (tokenBefore.value === "++" || tokenBefore.value === "--")) {
+
+                // If the last token is ++ or --, insert a semicolon to avoid disrupting ASI.
+                return true;
+            }
+
+            // Otherwise, do not insert a semicolon.
+            return false;
+        }
+
+        /**
+         * Determines whether the code represented by the given node contains an `if` statement
+         * that would become associated with an `else` keyword directly appended to that code.
+         *
+         * Examples where it returns `true`:
+         *
+         *    if (a)
+         *        foo();
+         *
+         *    if (a) {
+         *        foo();
+         *    }
+         *
+         *    if (a)
+         *        foo();
+         *    else if (b)
+         *        bar();
+         *
+         *    while (a)
+         *        if (b)
+         *            if(c)
+         *                foo();
+         *            else
+         *                bar();
+         *
+         * Examples where it returns `false`:
+         *
+         *    if (a)
+         *        foo();
+         *    else
+         *        bar();
+         *
+         *    while (a) {
+         *        if (b)
+         *            if(c)
+         *                foo();
+         *            else
+         *                bar();
+         *    }
+         *
+         *    while (a)
+         *        if (b) {
+         *            if(c)
+         *                foo();
+         *        }
+         *        else
+         *            bar();
+         * @param {ASTNode} node Node representing the code to check.
+         * @returns {boolean} `true` if an `if` statement within the code would become associated with an `else` appended to that code.
+         */
+        function hasUnsafeIf(node) {
+            switch (node.type) {
+                case "IfStatement":
+                    if (!node.alternate) {
+                        return true;
+                    }
+                    return hasUnsafeIf(node.alternate);
+                case "ForStatement":
+                case "ForInStatement":
+                case "ForOfStatement":
+                case "LabeledStatement":
+                case "WithStatement":
+                case "WhileStatement":
+                    return hasUnsafeIf(node.body);
+                default:
+                    return false;
+            }
+        }
+
+        /**
+         * Determines whether the existing curly braces around the single statement are necessary to preserve the semantics of the code.
+         * The braces, which make the given block body, are necessary in either of the following situations:
+         *
+         * 1. The statement is a lexical declaration.
+         * 2. Without the braces, an `if` within the statement would become associated with an `else` after the closing brace:
+         *
+         *     if (a) {
+         *         if (b)
+         *             foo();
+         *     }
+         *     else
+         *         bar();
+         *
+         *     if (a)
+         *         while (b)
+         *             while (c) {
+         *                 while (d)
+         *                     if (e)
+         *                         while(f)
+         *                             foo();
+         *            }
+         *     else
+         *         bar();
+         * @param {ASTNode} node `BlockStatement` body with exactly one statement directly inside. The statement can have its own nested statements.
+         * @returns {boolean} `true` if the braces are necessary - removing them (replacing the given `BlockStatement` body with its single statement content)
+         * would change the semantics of the code or produce a syntax error.
+         */
+        const blockParentTypes = ['IfStatement', 'ForStatement', 'ForInStatement', 'ForOfStatement', 'WhileStatement'];
+        function areBracesNecessary(node) {
+            const statement = node.body[0];
+            let parent;
+            if (node.type === 'BlockStatement' && (parent = node.parent) && blockParentTypes.includes(parent.type) && (node.loc.start.line - parent.loc.start.line) > 0)
+              return true;
+            return isLexicalDeclaration(statement) ||
+                hasUnsafeIf(statement) && isFollowedByElseKeyword(node);
+        }
+
+        /**
+         * Prepares to check the body of a node to see if it's a block statement.
+         * @param {ASTNode} node The node to report if there's a problem.
+         * @param {ASTNode} body The body node to check for blocks.
+         * @param {string} name The name to report if there's a problem.
+         * @param {{ condition: boolean }} opts Options to pass to the report functions
+         * @returns {Object} a prepared check object, with "actual", "expected", "check" properties.
+         *   "actual" will be `true` or `false` whether the body is already a block statement.
+         *   "expected" will be `true` or `false` if the body should be a block statement or not, or
+         *   `null` if it doesn't matter, depending on the rule options. It can be modified to change
+         *   the final behavior of "check".
+         *   "check" will be a function reporting appropriate problems depending on the other
+         *   properties.
+         */
+        function prepareCheck(node, body, name, opts) {
+            const hasBlock = (body.type === "BlockStatement");
+            let expected = null;
+
+            if (hasBlock && (body.body.length !== 1 || areBracesNecessary(body))) {
+                expected = true;
+            } else if (multiOnly) {
+                expected = false;
+            } else if (multiLine) {
+                if (!isCollapsedOneLiner(body)) {
+                    expected = true;
+                }
+
+                // otherwise, the body is allowed to have braces or not to have braces
+
+            } else if (multiOrNest) {
+                if (hasBlock) {
+                    const statement = body.body[0];
+                    const leadingCommentsInBlock = sourceCode.getCommentsBefore(statement);
+
+                    expected = !isOneLiner(statement) || leadingCommentsInBlock.length > 0;
+                } else {
+                    const leadingCommentsInBlock = sourceCode.getCommentsBefore(body);
+
+                    expected = !isOneLiner(body) || (leadingCommentsInBlock.length > 0 && (leadingCommentsInBlock[0].loc.end.line - leadingCommentsInBlock[0].loc.start.line) > 0);
+                }
+            } else {
+
+                // default "all"
+                expected = true;
+            }
+
+            return {
+                actual: hasBlock,
+                expected,
+                check() {
+                    if (this.expected !== null && this.expected !== this.actual) {
+                        if (this.expected) {
+                            context.report({
+                                node,
+                                loc: (name !== "else" ? node : getElseKeyword(node)).loc.start,
+                                messageId: opts && opts.condition ? "missingCurlyAfterCondition" : "missingCurlyAfter",
+                                data: {
+                                    name
+                                },
+                                fix: fixer => fixer.replaceText(body, `{${sourceCode.getText(body)}}`)
+                            });
+                        } else {
+                            context.report({
+                                node,
+                                loc: (name !== "else" ? node : getElseKeyword(node)).loc.start,
+                                messageId: opts && opts.condition ? "unexpectedCurlyAfterCondition" : "unexpectedCurlyAfter",
+                                data: {
+                                    name
+                                },
+                                fix(fixer) {
+
+                                    /*
+                                     * `do while` expressions sometimes need a space to be inserted after `do`.
+                                     * e.g. `do{foo()} while (bar)` should be corrected to `do foo() while (bar)`
+                                     */
+                                    const needsPrecedingSpace = node.type === "DoWhileStatement" &&
+                                        sourceCode.getTokenBefore(body).range[1] === body.range[0] &&
+                                        !astUtils.canTokensBeAdjacent("do", sourceCode.getFirstToken(body, { skip: 1 }));
+
+                                    const openingBracket = sourceCode.getFirstToken(body);
+                                    const closingBracket = sourceCode.getLastToken(body);
+                                    const lastTokenInBlock = sourceCode.getTokenBefore(closingBracket);
+
+                                    if (needsSemicolon(closingBracket)) {
+
+                                        /*
+                                         * If removing braces would cause a SyntaxError due to multiple statements on the same line (or
+                                         * change the semantics of the code due to ASI), don't perform a fix.
+                                         */
+                                        return null;
+                                    }
+
+                                    const resultingBodyText = sourceCode.getText().slice(openingBracket.range[1], lastTokenInBlock.range[0]) +
+                                        sourceCode.getText(lastTokenInBlock) +
+                                        sourceCode.getText().slice(lastTokenInBlock.range[1], closingBracket.range[0]);
+
+                                    return fixer.replaceText(body, (needsPrecedingSpace ? " " : "") + resultingBodyText);
+                                }
+                            });
+                        }
+                    }
+                }
+            };
+        }
+
+        /**
+         * Prepares to check the bodies of a "if", "else if" and "else" chain.
+         * @param {ASTNode} node The first IfStatement node of the chain.
+         * @returns {Object[]} prepared checks for each body of the chain. See `prepareCheck` for more
+         *   information.
+         */
+        function prepareIfChecks(node) {
+            const preparedChecks = [];
+
+            for (let currentNode = node; currentNode; currentNode = currentNode.alternate) {
+                preparedChecks.push(prepareCheck(currentNode, currentNode.consequent, "if", { condition: true }));
+                if (currentNode.alternate && currentNode.alternate.type !== "IfStatement") {
+                    preparedChecks.push(prepareCheck(currentNode, currentNode.alternate, "else"));
+                    break;
+                }
+            }
+
+            if (consistent) {
+
+                /*
+                 * If any node should have or already have braces, make sure they
+                 * all have braces.
+                 * If all nodes shouldn't have braces, make sure they don't.
+                 */
+                const expected = preparedChecks.some(preparedCheck => {
+                    if (preparedCheck.expected !== null) {
+                        return preparedCheck.expected;
+                    }
+                    return preparedCheck.actual;
+                });
+
+                preparedChecks.forEach(preparedCheck => {
+                    preparedCheck.expected = expected;
+                });
+            }
+
+            return preparedChecks;
+        }
+
+        //--------------------------------------------------------------------------
+        // Public
+        //--------------------------------------------------------------------------
+
+        return {
+            IfStatement(node) {
+                const parent = node.parent;
+                const isElseIf = parent.type === "IfStatement" && parent.alternate === node;
+
+                if (!isElseIf) {
+
+                    // This is a top `if`, check the whole `if-else-if` chain
+                    prepareIfChecks(node).forEach(preparedCheck => {
+                        preparedCheck.check();
+                    });
+                }
+
+                // Skip `else if`, it's already checked (when the top `if` was visited)
+            },
+
+            WhileStatement(node) {
+                prepareCheck(node, node.body, "while", { condition: true }).check();
+            },
+
+            DoWhileStatement(node) {
+                prepareCheck(node, node.body, "do").check();
+            },
+
+            ForStatement(node) {
+                prepareCheck(node, node.body, "for", { condition: true }).check();
+            },
+
+            ForInStatement(node) {
+                prepareCheck(node, node.body, "for-in").check();
+            },
+
+            ForOfStatement(node) {
+                prepareCheck(node, node.body, "for-of").check();
+            }
+        };
+    }
+};

@@ -0,0 +1,332 @@
+/**
+ * @fileoverview A rule to choose between single and double quote marks
+ * @author Matt DuVall <http://www.mattduvall.com/>, Brandon Payton
+ */
+
+"use strict";
+
+//------------------------------------------------------------------------------
+// Requirements
+//------------------------------------------------------------------------------
+
+const astUtils = require("./utils/ast-utils");
+
+//------------------------------------------------------------------------------
+// Constants
+//------------------------------------------------------------------------------
+
+const QUOTE_SETTINGS = {
+    double: {
+        quote: "\"",
+        alternateQuote: "'",
+        description: "doublequote"
+    },
+    single: {
+        quote: "'",
+        alternateQuote: "\"",
+        description: "singlequote"
+    },
+    backtick: {
+        quote: "`",
+        alternateQuote: "\"",
+        description: "backtick"
+    }
+};
+
+// An unescaped newline is a newline preceded by an even number of backslashes.
+const UNESCAPED_LINEBREAK_PATTERN = new RegExp(String.raw`(^|[^\\])(\\\\)*[${Array.from(astUtils.LINEBREAKS).join("")}]`, "u");
+
+/**
+ * Switches quoting of javascript string between ' " and `
+ * escaping and unescaping as necessary.
+ * Only escaping of the minimal set of characters is changed.
+ * Note: escaping of newlines when switching from backtick to other quotes is not handled.
+ * @param {string} str A string to convert.
+ * @returns {string} The string with changed quotes.
+ * @private
+ */
+QUOTE_SETTINGS.double.convert =
+QUOTE_SETTINGS.single.convert =
+QUOTE_SETTINGS.backtick.convert = function(str) {
+    const newQuote = this.quote;
+    const oldQuote = str[0];
+
+    if (newQuote === oldQuote) {
+        return str;
+    }
+    return newQuote + str.slice(1, -1).replace(/\\(\$\{|\r\n?|\n|.)|["'`]|\$\{|(\r\n?|\n)/gu, (match, escaped, newline) => {
+        if (escaped === oldQuote || oldQuote === "`" && escaped === "${") {
+            return escaped; // unescape
+        }
+        if (match === newQuote || newQuote === "`" && match === "${") {
+            return `\\${match}`; // escape
+        }
+        if (newline && oldQuote === "`") {
+            return "\\n"; // escape newlines
+        }
+        return match;
+    }) + newQuote;
+};
+
+const AVOID_ESCAPE = "avoid-escape";
+
+//------------------------------------------------------------------------------
+// Rule Definition
+//------------------------------------------------------------------------------
+
+module.exports = {
+    meta: {
+        type: "layout",
+
+        docs: {
+            description: "enforce the consistent use of either backticks, double, or single quotes",
+            category: "Stylistic Issues",
+            recommended: false,
+            url: "https://eslint.org/docs/rules/quotes"
+        },
+
+        fixable: "code",
+
+        schema: [
+            {
+                enum: ["single", "double", "backtick"]
+            },
+            {
+                anyOf: [
+                    {
+                        enum: ["avoid-escape"]
+                    },
+                    {
+                        type: "object",
+                        properties: {
+                            avoidEscape: {
+                                type: "boolean"
+                            },
+                            allowTemplateLiterals: {
+                                type: "boolean"
+                            }
+                        },
+                        additionalProperties: false
+                    }
+                ]
+            }
+        ],
+
+        messages: {
+            wrongQuotes: "Strings must use {{description}}."
+        }
+    },
+
+    create(context) {
+
+        const quoteOption = context.options[0],
+            settings = QUOTE_SETTINGS[quoteOption || "double"],
+            options = context.options[1],
+            allowTemplateLiterals = options && options.allowTemplateLiterals === true,
+            sourceCode = context.getSourceCode();
+        let avoidEscape = options && options.avoidEscape === true;
+
+        // deprecated
+        if (options === AVOID_ESCAPE) {
+            avoidEscape = true;
+        }
+
+        /**
+         * Determines if a given node is part of JSX syntax.
+         *
+         * This function returns `true` in the following cases:
+         *
+         * - `<div className="foo"></div>` ... If the literal is an attribute value, the parent of the literal is `JSXAttribute`.
+         * - `<div>foo</div>` ... If the literal is a text content, the parent of the literal is `JSXElement`.
+         * - `<>foo</>` ... If the literal is a text content, the parent of the literal is `JSXFragment`.
+         *
+         * In particular, this function returns `false` in the following cases:
+         *
+         * - `<div className={"foo"}></div>`
+         * - `<div>{"foo"}</div>`
+         *
+         * In both cases, inside of the braces is handled as normal JavaScript.
+         * The braces are `JSXExpressionContainer` nodes.
+         * @param {ASTNode} node The Literal node to check.
+         * @returns {boolean} True if the node is a part of JSX, false if not.
+         * @private
+         */
+        function isJSXLiteral(node) {
+            return node.parent.type === "JSXAttribute" || node.parent.type === "JSXElement" || node.parent.type === "JSXFragment";
+        }
+
+        /**
+         * Checks whether or not a given node is a directive.
+         * The directive is a `ExpressionStatement` which has only a string literal.
+         * @param {ASTNode} node A node to check.
+         * @returns {boolean} Whether or not the node is a directive.
+         * @private
+         */
+        function isDirective(node) {
+            return (
+                node.type === "ExpressionStatement" &&
+                node.expression.type === "Literal" &&
+                typeof node.expression.value === "string"
+            );
+        }
+
+        /**
+         * Checks whether or not a given node is a part of directive prologues.
+         * See also: http://www.ecma-international.org/ecma-262/6.0/#sec-directive-prologues-and-the-use-strict-directive
+         * @param {ASTNode} node A node to check.
+         * @returns {boolean} Whether or not the node is a part of directive prologues.
+         * @private
+         */
+        function isPartOfDirectivePrologue(node) {
+            const block = node.parent.parent;
+
+            if (block.type !== "Program" && (block.type !== "BlockStatement" || !astUtils.isFunction(block.parent))) {
+                return false;
+            }
+
+            // Check the node is at a prologue.
+            for (let i = 0; i < block.body.length; ++i) {
+                const statement = block.body[i];
+
+                if (statement === node.parent) {
+                    return true;
+                }
+                if (!isDirective(statement)) {
+                    break;
+                }
+            }
+
+            return false;
+        }
+
+        /**
+         * Checks whether or not a given node is allowed as non backtick.
+         * @param {ASTNode} node A node to check.
+         * @returns {boolean} Whether or not the node is allowed as non backtick.
+         * @private
+         */
+        function isAllowedAsNonBacktick(node) {
+            const parent = node.parent;
+
+            switch (parent.type) {
+
+                // Directive Prologues.
+                case "ExpressionStatement":
+                    return isPartOfDirectivePrologue(node);
+
+                // LiteralPropertyName.
+                case "Property":
+                case "MethodDefinition":
+                    return parent.key === node && !parent.computed;
+
+                // ModuleSpecifier.
+                case "ImportDeclaration":
+                case "ExportNamedDeclaration":
+                case "ExportAllDeclaration":
+                    return parent.source === node;
+
+                // Others don't allow.
+                default:
+                    return false;
+            }
+        }
+
+        /**
+         * Checks whether or not a given TemplateLiteral node is actually using any of the special features provided by template literal strings.
+         * @param {ASTNode} node A TemplateLiteral node to check.
+         * @returns {boolean} Whether or not the TemplateLiteral node is using any of the special features provided by template literal strings.
+         * @private
+         */
+        function isUsingFeatureOfTemplateLiteral(node) {
+            const hasTag = node.parent.type === "TaggedTemplateExpression" && node === node.parent.quasi;
+
+            if (hasTag) {
+                return true;
+            }
+
+            const hasStringInterpolation = node.expressions.length > 0;
+
+            if (hasStringInterpolation) {
+                return true;
+            }
+
+            const isMultilineString = node.quasis.length >= 1 && UNESCAPED_LINEBREAK_PATTERN.test(node.quasis[0].value.raw);
+
+            if (isMultilineString) {
+                return true;
+            }
+
+            return false;
+        }
+
+        return {
+
+            Literal(node) {
+                const val = node.value,
+                    rawVal = node.raw;
+
+                if (settings && typeof val === "string") {
+                    let isValid = (quoteOption === "backtick" && isAllowedAsNonBacktick(node)) ||
+                        isJSXLiteral(node) ||
+                        astUtils.isSurroundedBy(rawVal, settings.quote);
+
+                    if (!isValid && avoidEscape) {
+                        isValid = astUtils.isSurroundedBy(rawVal, settings.alternateQuote) && rawVal.indexOf(settings.quote) >= 0;
+                    }
+
+                    if (!isValid) {
+                        context.report({
+                            node,
+                            messageId: "wrongQuotes",
+                            data: {
+                                description: settings.description
+                            },
+                            fix(fixer) {
+                                if (quoteOption === "backtick" && astUtils.hasOctalEscapeSequence(rawVal)) {
+
+                                    // An octal escape sequence in a template literal would produce syntax error, even in non-strict mode.
+                                    return null;
+                                }
+
+                                return fixer.replaceText(node, settings.convert(node.raw));
+                            }
+                        });
+                    }
+                }
+            },
+
+            TemplateLiteral(node) {
+                // Don't throw an error if backticks are expected or a template literal feature is in use.
+                if (
+                    allowTemplateLiterals ||
+                    quoteOption === "backtick" ||
+                    isUsingFeatureOfTemplateLiteral(node) ||
+                    settings && avoidEscape && node.quasis[0].value.raw.indexOf(settings.quote) >= 0
+                ) {
+                    return;
+                }
+
+                context.report({
+                    node,
+                    messageId: "wrongQuotes",
+                    data: {
+                        description: settings.description
+                    },
+                    fix(fixer) {
+                        if (isPartOfDirectivePrologue(node)) {
+
+                            /*
+                             * TemplateLiterals in a directive prologue aren't actually directives, but if they're
+                             * in the directive prologue, then fixing them might turn them into directives and change
+                             * the behavior of the code.
+                             */
+                            return null;
+                        }
+                        return fixer.replaceText(node, settings.convert(sourceCode.getText(node)));
+                    }
+                });
+            }
+        };
+
+    }
+};

@@ -0,0 +1,212 @@
+'use strict';
+
+/* eslint-env node */
+
+const Module = require('module');
+const path = require('path');
+
+const ModuleFindPath = Module._findPath;
+const hacks = [
+  'eslint-plugin-mscdex',
+];
+const eslintRulesPath =
+  path.join(path.dirname(process.mainModule.filename), '..', 'lib', 'rules');
+Module._findPath = (request, paths, isMain) => {
+  const r = ModuleFindPath(request, paths.concat(eslintRulesPath), isMain);
+  if (!r) {
+    if (hacks.includes(request))
+      return path.join(__dirname, '.eslint-plugins', request);
+  }
+  return r;
+};
+
+module.exports = {
+  root: true,
+  env: { node: true, es6: true },
+  plugins: ['mscdex'],
+  parserOptions: { sourceType: 'script', ecmaVersion: '2020' },
+  rules: {
+    // ESLint built-in rules
+    // https://eslint.org/docs/rules/
+    'accessor-pairs': 'error',
+    'array-callback-return': 'error',
+    'arrow-parens': ['error', 'always'],
+    'arrow-spacing': ['error', { before: true, after: true }],
+    'block-scoped-var': 'error',
+    'block-spacing': 'error',
+    'brace-style': ['error', '1tbs', { allowSingleLine: true }],
+    'capitalized-comments': ['error', 'always', {
+      line: {
+        // Ignore all lines that have less characters than 20 and all lines that
+        // start with something that looks like a variable name or code.
+        // eslint-disable-next-line max-len
+        ignorePattern: '.{0,20}$|[a-z]+ ?[0-9A-Z_.(/=:[#-]|std|http|ssh|ftp|(let|var|const) [a-z_A-Z0-9]+ =|[b-z] |[a-z]*[0-9].* ',
+        ignoreInlineComments: true,
+        ignoreConsecutiveComments: true,
+      },
+      block: {
+        ignorePattern: '.*',
+      },
+    }],
+    'comma-dangle': ['error', 'only-multiline'],
+    'comma-spacing': 'error',
+    'comma-style': 'error',
+    'computed-property-spacing': 'error',
+    'constructor-super': 'error',
+    'default-case-last': 'error',
+    'dot-location': ['error', 'property'],
+    'dot-notation': 'error',
+    'eol-last': 'error',
+    'eqeqeq': ['error', 'smart'],
+    'for-direction': 'error',
+    'func-call-spacing': 'error',
+    'func-name-matching': 'error',
+    'func-style': ['error', 'declaration', { allowArrowFunctions: true }],
+    'getter-return': 'error',
+    'key-spacing': ['error', { mode: 'strict' }],
+    'keyword-spacing': 'error',
+    'linebreak-style': ['error', 'unix'],
+    'max-len': ['error', {
+      code: 80,
+      ignorePattern: '^// Flags:',
+      ignoreRegExpLiterals: true,
+      ignoreUrls: true,
+      tabWidth: 2,
+    }],
+    'new-parens': 'error',
+    'no-async-promise-executor': 'error',
+    'no-class-assign': 'error',
+    'no-confusing-arrow': 'error',
+    'no-const-assign': 'error',
+    'no-constructor-return': 'error',
+    'no-control-regex': 'error',
+    'no-debugger': 'error',
+    'no-delete-var': 'error',
+    'no-dupe-args': 'error',
+    'no-dupe-class-members': 'error',
+    'no-dupe-keys': 'error',
+    'no-dupe-else-if': 'error',
+    'no-duplicate-case': 'error',
+    'no-duplicate-imports': 'error',
+    'no-else-return': ['error', { allowElseIf: true }],
+    'no-empty-character-class': 'error',
+    'no-ex-assign': 'error',
+    'no-extra-boolean-cast': 'error',
+    'no-extra-parens': ['error', 'functions'],
+    'no-extra-semi': 'error',
+    'no-fallthrough': 'error',
+    'no-func-assign': 'error',
+    'no-global-assign': 'error',
+    'no-invalid-regexp': 'error',
+    'no-irregular-whitespace': 'error',
+    'no-lonely-if': 'error',
+    'no-misleading-character-class': 'error',
+    'no-mixed-requires': 'error',
+    'no-mixed-spaces-and-tabs': 'error',
+    'no-multi-spaces': ['error', { ignoreEOLComments: true }],
+    'no-multiple-empty-lines': ['error', { max: 2, maxEOF: 0, maxBOF: 0 }],
+    'no-new-require': 'error',
+    'no-new-symbol': 'error',
+    'no-obj-calls': 'error',
+    'no-octal': 'error',
+    'no-path-concat': 'error',
+    'no-proto': 'error',
+    'no-redeclare': 'error',
+    /* eslint-disable max-len */
+    'no-restricted-syntax': [
+      'error',
+      {
+        selector: "CallExpression[callee.name='setTimeout'][arguments.length<2]",
+        message: '`setTimeout()` must be invoked with at least two arguments.',
+      },
+      {
+        selector: "CallExpression[callee.name='setInterval'][arguments.length<2]",
+        message: '`setInterval()` must be invoked with at least two arguments.',
+      },
+      {
+        selector: 'ThrowStatement > CallExpression[callee.name=/Error$/]',
+        message: 'Use `new` keyword when throwing an `Error`.',
+      }
+    ],
+    /* eslint-enable max-len */
+    'no-return-await': 'error',
+    'no-self-assign': 'error',
+    'no-self-compare': 'error',
+    'no-setter-return': 'error',
+    'no-shadow-restricted-names': 'error',
+    'no-tabs': 'error',
+    'no-template-curly-in-string': 'error',
+    'no-this-before-super': 'error',
+    'no-throw-literal': 'error',
+    'no-trailing-spaces': 'error',
+    'no-undef': ['error', { typeof: true }],
+    'no-undef-init': 'error',
+    'no-unexpected-multiline': 'error',
+    'no-unreachable': 'error',
+    'no-unsafe-finally': 'error',
+    'no-unsafe-negation': 'error',
+    'no-unused-labels': 'error',
+    'no-unused-vars': ['error', { args: 'none', caughtErrors: 'all' }],
+    'no-use-before-define': ['error', {
+      classes: true,
+      functions: false,
+      variables: false,
+    }],
+    'no-useless-backreference': 'error',
+    'no-useless-call': 'error',
+    'no-useless-catch': 'error',
+    'no-useless-concat': 'error',
+    'no-useless-constructor': 'error',
+    'no-useless-escape': 'error',
+    'no-useless-return': 'error',
+    'no-var': 'error',
+    'no-void': 'error',
+    'no-whitespace-before-property': 'error',
+    'no-with': 'error',
+    'object-curly-spacing': ['error', 'always'],
+    'one-var': ['error', { initialized: 'never' }],
+    'one-var-declaration-per-line': 'error',
+    'operator-linebreak': ['error', 'before', { overrides: { '=': 'after' } }],
+    'padding-line-between-statements': [
+      'error',
+      { blankLine: 'always', prev: 'function', next: 'function' },
+    ],
+    'prefer-const': ['error', { ignoreReadBeforeAssign: true }],
+    'quote-props': ['error', 'consistent'],
+    'rest-spread-spacing': 'error',
+    'semi': 'error',
+    'semi-spacing': 'error',
+    'space-before-blocks': ['error', 'always'],
+    'space-before-function-paren': ['error', {
+      anonymous: 'never',
+      named: 'never',
+      asyncArrow: 'always',
+    }],
+    'space-in-parens': ['error', 'never'],
+    'space-infix-ops': 'error',
+    'space-unary-ops': 'error',
+    'spaced-comment': ['error', 'always', {
+      'block': { 'balanced': true },
+      'exceptions': ['-'],
+    }],
+    'strict': ['error', 'global'],
+    'symbol-description': 'error',
+    'template-curly-spacing': 'error',
+    'unicode-bom': 'error',
+    'use-isnan': 'error',
+    'valid-typeof': 'error',
+
+    // Custom rules
+    'mscdex/curly': ['error', 'multi-or-nest', 'consistent'],
+    'mscdex/quotes': ['error', 'single', { avoidEscape: true }],
+  },
+  globals: {
+    Atomics: 'readable',
+    BigInt: 'readable',
+    BigInt64Array: 'readable',
+    BigUint64Array: 'readable',
+    TextEncoder: 'readable',
+    TextDecoder: 'readable',
+    globalThis: 'readable',
+  },
+};

@@ -4,34 +4,35 @@
 //      terminal types of client connections
 //   2. Install `blessed`: `npm install blessed`
 //   3. Create a server host key in this same directory and name it `host.key`
+'use strict';
 
-var fs = require('fs');
+const { readFileSync } = require('fs');
 
-var blessed = require('blessed');
-var Server = require('ssh2').Server;
+const blessed = require('blessed');
+const { Server } = require('ssh2');
 
-var RE_SPECIAL = /[\x00-\x1F\x7F]+|(?:\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K])/g;
-var MAX_MSG_LEN = 128;
-var MAX_NAME_LEN = 10;
-var PROMPT_NAME = 'Enter a nickname to use (max ' + MAX_NAME_LEN + ' chars): ';
+const RE_SPECIAL =
+// eslint-disable-next-line no-control-regex
+  /[\x00-\x1F\x7F]+|(?:\x1B\[([0-9]{1,2}(;[0-9]{1,2})?)?[m|K])/g;
+const MAX_MSG_LEN = 128;
+const MAX_NAME_LEN = 10;
+const PROMPT_NAME = `Enter a nickname to use (max ${MAX_NAME_LEN} chars): `;
 
-var users = [];
+const users = [];
 
 function formatMessage(msg, output) {
-  var output = output;
   output.parseTags = true;
   msg = output._parseTags(msg);
   output.parseTags = false;
   return msg;
 }
 
 function userBroadcast(msg, source) {
-  var sourceMsg = '> ' + msg;
-  var name = '{cyan-fg}{bold}' + source.name + '{/}';
-  msg = ': ' + msg;
-  for (var i = 0; i < users.length; ++i) {
-    var user = users[i];
-    var output = user.output;
+  const sourceMsg = `> ${msg}`;
+  const name = `{cyan-fg}{bold}${source.name}{/}`;
+  msg = `: ${msg}`;
+  for (const user of users) {
+    const output = user.output;
     if (source === user)
       output.add(sourceMsg);
     else
@@ -40,41 +41,43 @@ function userBroadcast(msg, source) {
 }
 
 function localMessage(msg, source) {
-  var output = source.output;
+  const output = source.output;
   output.add(formatMessage(msg, output));
 }
 
 function noop(v) {}
 
 new Server({
-  hostKeys: [fs.readFileSync('host.key')],
-}, function(client) {
-  var stream;
-  var name;
-
-  client.on('authentication', function(ctx) {
-    var nick = ctx.username;
-    var prompt = PROMPT_NAME;
-    var lowered;
+  hostKeys: [readFileSync('host.key')],
+}, (client) => {
+  let stream;
+  let name;
+
+  client.on('authentication', (ctx) => {
+    let nick = ctx.username;
+    let prompt = PROMPT_NAME;
+    let lowered;
+
     // Try to use username as nickname
     if (nick.length > 0 && nick.length <= MAX_NAME_LEN) {
       lowered = nick.toLowerCase();
-      var ok = true;
-      for (var i = 0; i < users.length; ++i) {
-        if (users[i].name.toLowerCase() === lowered) {
+      let ok = true;
+      for (const user of users) {
+        if (user.name.toLowerCase() === lowered) {
           ok = false;
-          prompt = 'That nickname is already in use.\n' + PROMPT_NAME;
+          prompt = `That nickname is already in use.\n${PROMPT_NAME}`;
           break;
         }
       }
       if (ok) {
         name = nick;
         return ctx.accept();
       }
-    } else if (nick.length === 0)
+    } else if (nick.length === 0) {
       prompt = 'A nickname is required.\n' + PROMPT_NAME;
-    else
+    } else {
       prompt = 'That nickname is too long.\n' + PROMPT_NAME;
+    }
 
     if (ctx.method !== 'keyboard-interactive')
       return ctx.reject(['keyboard-interactive']);
@@ -84,33 +87,33 @@ new Server({
         return ctx.reject(['keyboard-interactive']);
       nick = answers[0];
       if (nick.length > MAX_NAME_LEN) {
-        return ctx.prompt('That nickname is too long.\n' + PROMPT_NAME,
+        return ctx.prompt(`That nickname is too long.\n${PROMPT_NAME}`,
                           retryPrompt);
       } else if (nick.length === 0) {
-        return ctx.prompt('A nickname is required.\n' + PROMPT_NAME,
+        return ctx.prompt(`A nickname is required.\n${PROMPT_NAME}`,
                           retryPrompt);
       }
       lowered = nick.toLowerCase();
-      for (var i = 0; i < users.length; ++i) {
-        if (users[i].name.toLowerCase() === lowered) {
-          return ctx.prompt('That nickname is already in use.\n' + PROMPT_NAME,
+      for (const user of users) {
+        if (user.name.toLowerCase() === lowered) {
+          return ctx.prompt(`That nickname is already in use.\n${PROMPT_NAME}`,
                             retryPrompt);
         }
       }
       name = nick;
       ctx.accept();
     });
-  }).on('ready', function() {
-    var rows;
-    var cols;
-    var term;
-    client.once('session', function(accept, reject) {
-      accept().once('pty', function(accept, reject, info) {
+  }).on('ready', () => {
+    let rows;
+    let cols;
+    let term;
+    client.once('session', (accept, reject) => {
+      accept().once('pty', (accept, reject, info) => {
         rows = info.rows;
         cols = info.cols;
         term = info.term;
         accept && accept();
-      }).on('window-change', function(accept, reject, info) {
+      }).on('window-change', (accept, reject, info) => {
         rows = info.rows;
         cols = info.cols;
         if (stream) {
@@ -119,7 +122,7 @@ new Server({
           stream.emit('resize');
         }
         accept && accept();
-      }).once('shell', function(accept, reject) {
+      }).once('shell', (accept, reject) => {
         stream = accept();
         users.push(stream);
 
@@ -130,7 +133,7 @@ new Server({
         stream.setRawMode = noop;
         stream.on('error', noop);
 
-        var screen = new blessed.screen({
+        const screen = new blessed.screen({
           autoPadding: true,
           smartCSR: true,
           program: new blessed.program({
@@ -144,14 +147,14 @@ new Server({
         // Disable local echo
         screen.program.attr('invisible', true);
 
-        var output = stream.output = new blessed.log({
+        const output = stream.output = new blessed.log({
           screen: screen,
           top: 0,
           left: 0,
           width: '100%',
           bottom: 2,
           scrollOnInput: true
-        })
+        });
         screen.append(output);
 
         screen.append(new blessed.box({
@@ -164,7 +167,7 @@ new Server({
           ch: '='
         }));
 
-        var input = new blessed.textbox({
+        const input = new blessed.textbox({
           screen: screen,
           bottom: 0,
           height: 1,
@@ -184,9 +187,8 @@ new Server({
                      stream);
 
         // Let everyone else know that this user just joined
-        for (var i = 0; i < users.length; ++i) {
-          var user = users[i];
-          var output = user.output;
+        for (const user of users) {
+          const output = user.output;
           if (user === stream)
             continue;
           output.add(formatMessage('{green-fg}*** {bold}', output)
@@ -200,7 +202,7 @@ new Server({
         screen.program.emit('resize');
 
         // Read a line of input from the user
-        input.on('submit', function(line) {
+        input.on('submit', (line) => {
           input.clearValue();
           screen.render();
           if (!input.focused)
@@ -217,27 +219,20 @@ new Server({
         });
       });
     });
-  }).on('end', function() {
+  }).on('close', () => {
     if (stream !== undefined) {
-      spliceOne(users, users.indexOf(stream));
+      users.splice(users.indexOf(stream), 1);
       // Let everyone else know that this user just left
-      for (var i = 0; i < users.length; ++i) {
-        var user = users[i];
-        var output = user.output;
+      for (const user of users) {
+        const output = user.output;
         output.add(formatMessage('{magenta-fg}*** {bold}', output)
                    + name
                    + formatMessage('{/bold} has left the chat{/}', output));
       }
     }
-  }).on('error', function(err) {
+  }).on('error', (err) => {
     // Ignore errors
   });
 }).listen(0, function() {
   console.log('Listening on port ' + this.address().port);
 });
-
-function spliceOne(list, index) {
-  for (var i = index, k = i + 1, n = list.length; k < n; i += 1, k += 1)
-    list[i] = list[k];
-  list.pop();
-}

@@ -1,113 +1,134 @@
-var crypto = require('crypto');
-var constants = require('constants');
-var fs = require('fs');
+'use strict';
 
-var ssh2 = require('ssh2');
-var OPEN_MODE = ssh2.SFTP_OPEN_MODE;
-var STATUS_CODE = ssh2.SFTP_STATUS_CODE;
+const { timingSafeEqual } = require('crypto');
+const { constants, readFileSync } = require('fs');
 
-var allowedUser = Buffer.from('foo');
-var allowedPassword = Buffer.from('bar');
+const { Server, sftp: { OPEN_MODE, STATUS_CODE } } = require('ssh2');
 
-new ssh2.Server({
-  hostKeys: [fs.readFileSync('host.key')]
-}, function(client) {
+const allowedUser = Buffer.from('foo');
+const allowedPassword = Buffer.from('bar');
+
+function checkValue(input, allowed) {
+  const autoReject = (input.length !== allowed.length);
+  if (autoReject) {
+    // Prevent leaking length information by always making a comparison with the
+    // same input when lengths don't match what we expect ...
+    allowed = input;
+  }
+  const isMatch = timingSafeEqual(input, allowed);
+  return (!autoReject && isMatch);
+}
+
+new Server({
+  hostKeys: [readFileSync('host.key')]
+}, (client) => {
   console.log('Client connected!');
 
-  client.on('authentication', function(ctx) {
-    var user = Buffer.from(ctx.username);
-    if (user.length !== allowedUser.length
-        || !crypto.timingSafeEqual(user, allowedUser)) {
-      return ctx.reject(['password']);
-    }
+  client.on('authentication', (ctx) => {
+    let allowed = true;
+    if (!checkValue(Buffer.from(ctx.username), allowedUser))
+      allowed = false;
 
     switch (ctx.method) {
       case 'password':
-        var password = Buffer.from(ctx.password);
-        if (password.length !== allowedPassword.length
-            || !crypto.timingSafeEqual(password, allowedPassword)) {
-          return ctx.reject(['password']);
-        }
+        if (!checkValue(Buffer.from(ctx.password), allowedPassword))
+          return ctx.reject();
         break;
       default:
-        return ctx.reject(['password']);
+        return ctx.reject();
     }
 
-    ctx.accept();
-  }).on('ready', function() {
+    if (allowed)
+      ctx.accept();
+    else
+      ctx.reject();
+  }).on('ready', () => {
     console.log('Client authenticated!');
 
-    client.on('session', function(accept, reject) {
-      var session = accept();
-      session.on('sftp', function(accept, reject) {
+    client.on('session', (accept, reject) => {
+      const session = accept();
+      session.on('sftp', (accept, reject) => {
         console.log('Client SFTP session');
-        var openFiles = {};
-        var handleCount = 0;
-        // `sftpStream` is an `SFTPStream` instance in server mode
-        // see: https://github.com/mscdex/ssh2-streams/blob/master/SFTPStream.md
-        var sftpStream = accept();
-        sftpStream.on('OPEN', function(reqid, filename, flags, attrs) {
-          console.log('OPEN', filename);
-          // only allow opening /tmp/foo.txt for writing
+
+        const openFiles = new Map();
+        let handleCount = 0;
+        const sftp = accept();
+        sftp.on('OPEN', (reqid, filename, flags, attrs) => {
+          // Only allow opening /tmp/foo.txt for writing
           if (filename !== '/tmp/foo.txt' || !(flags & OPEN_MODE.READ))
-            return sftpStream.status(reqid, STATUS_CODE.FAILURE);
-          // create a fake handle to return to the client, this could easily
+            return sftp.status(reqid, STATUS_CODE.FAILURE);
+
+          // Create a fake handle to return to the client, this could easily
           // be a real file descriptor number for example if actually opening
           // the file on the disk
-          var handle = new Buffer(4);
-          openFiles[handleCount] = { read: false };
+          const handle = Buffer.alloc(4);
+          openFiles.set(handleCount, { read: false });
           handle.writeUInt32BE(handleCount++, 0, true);
-          sftpStream.handle(reqid, handle);
-          console.log('Opening file for read')
-        }).on('READ', function(reqid, handle, offset, length) {
-          if (handle.length !== 4 || !openFiles[handle.readUInt32BE(0, true)])
-            return sftpStream.status(reqid, STATUS_CODE.FAILURE);
-          // fake the read
-          var state = openFiles[handle.readUInt32BE(0, true)];
-          if (state.read)
-            sftpStream.status(reqid, STATUS_CODE.EOF);
-          else {
+
+          console.log('Opening file for read');
+          sftp.handle(reqid, handle);
+        }).on('READ', (reqid, handle, offset, length) => {
+          let fnum;
+          if (handle.length !== 4
+              || !openFiles.has(fnum = handle.readUInt32BE(0, true))) {
+            return sftp.status(reqid, STATUS_CODE.FAILURE);
+          }
+
+          // Fake the read
+          const state = openFiles.get(fnum);
+          if (state.read) {
+            sftp.status(reqid, STATUS_CODE.EOF);
+          } else {
             state.read = true;
-            sftpStream.data(reqid, 'bar');
-            console.log('Read from file at offset %d, length %d', offset, length);
+
+            console.log(
+              'Read from file at offset %d, length %d', offset, length
+            );
+            sftp.data(reqid, 'bar');
           }
-        }).on('CLOSE', function(reqid, handle) {
-          var fnum;
-          if (handle.length !== 4 || !openFiles[(fnum = handle.readUInt32BE(0, true))])
-            return sftpStream.status(reqid, STATUS_CODE.FAILURE);
-          delete openFiles[fnum];
-          sftpStream.status(reqid, STATUS_CODE.OK);
+        }).on('CLOSE', (reqid, handle) => {
+          let fnum;
+          if (handle.length !== 4
+              || !openFiles.has(fnum = handle.readUInt32BE(0))) {
+            return sftp.status(reqid, STATUS_CODE.FAILURE);
+          }
+
+          openFiles.delete(fnum);
+
           console.log('Closing file');
+          sftp.status(reqid, STATUS_CODE.OK);
         }).on('REALPATH', function(reqid, path) {
-          var name = [{
+          const name = [{
             filename: '/tmp/foo.txt',
             longname: '-rwxrwxrwx 1 foo foo 3 Dec 8 2009 foo.txt',
             attrs: {}
           }];
-          sftpStream.name(reqid, name);
+          sftp.name(reqid, name);
         }).on('STAT', onSTAT)
           .on('LSTAT', onSTAT);
+
         function onSTAT(reqid, path) {
           if (path !== '/tmp/foo.txt')
-            return sftpStream.status(reqid, STATUS_CODE.FAILURE);
-          var mode = constants.S_IFREG; // Regular file
-          mode |= constants.S_IRWXU; // read, write, execute for user
-          mode |= constants.S_IRWXG; // read, write, execute for group
-          mode |= constants.S_IRWXO; // read, write, execute for other
-          sftpStream.attrs(reqid, {
+            return sftp.status(reqid, STATUS_CODE.FAILURE);
+
+          let mode = constants.S_IFREG; // Regular file
+          mode |= constants.S_IRWXU; // Read, write, execute for user
+          mode |= constants.S_IRWXG; // Read, write, execute for group
+          mode |= constants.S_IRWXO; // Read, write, execute for other
+          sftp.attrs(reqid, {
             mode: mode,
             uid: 0,
             gid: 0,
             size: 3,
             atime: Date.now(),
-            mtime: Date.now()
+            mtime: Date.now(),
           });
         }
       });
     });
-  }).on('end', function() {
+  }).on('close', () => {
     console.log('Client disconnected');
   });
 }).listen(0, '127.0.0.1', function() {
-  console.log('Listening on port ' + this.address().port);
+  console.log(`Listening on port ${this.address().port}`);
 });

@@ -0,0 +1,17 @@
+'use strict';
+
+const { spawnSync } = require('child_process');
+
+// Attempt to build the bundled optional binding
+const result = spawnSync('node-gyp', ['rebuild'], {
+  cwd: 'lib/protocol/crypto',
+  encoding: 'utf8',
+  shell: true,
+  stdio: 'inherit',
+  windowsHide: true,
+});
+if (result.error || result.status !== 0)
+  console.log('Failed to build optional crypto binding');
+else
+  console.log('Succeeded in building optional crypto binding');
+process.exit(0);

@@ -1,44 +1,50 @@
-var Socket = require('net').Socket;
-var EventEmitter = require('events').EventEmitter;
-var inherits = require('util').inherits;
-var path = require('path');
-var fs = require('fs');
-var cp = require('child_process');
-
-var readUInt32BE = require('./buffer-helpers').readUInt32BE;
-var writeUInt32BE = require('./buffer-helpers').writeUInt32BE;
-var writeUInt32LE = require('./buffer-helpers').writeUInt32LE;
-
-var REQUEST_IDENTITIES = 11;
-var IDENTITIES_ANSWER = 12;
-var SIGN_REQUEST = 13;
-var SIGN_RESPONSE = 14;
-var FAILURE = 5;
-
-var RE_CYGWIN_SOCK = /^\!<socket >(\d+) s ([A-Z0-9]{8}\-[A-Z0-9]{8}\-[A-Z0-9]{8}\-[A-Z0-9]{8})/;
-
-// Format of `//./pipe/ANYTHING`, with forward slashes and backward slashes being interchangeable
-var WINDOWS_PIPE_REGEX = /^[/\\][/\\]\.[/\\]pipe[/\\].+/;
-
-module.exports = function(sockPath, key, keyType, data, cb) {
-  var sock;
-  var error;
-  var sig;
-  var datalen;
-  var keylen = 0;
-  var isSigning = Buffer.isBuffer(key);
-  var type;
-  var count = 0;
-  var siglen = 0;
-  var nkeys = 0;
-  var keys;
-  var comlen = 0;
-  var comment = false;
-  var accept;
-  var reject;
+'use strict';
+
+const { Socket } = require('net');
+const EventEmitter = require('events');
+const { resolve } = require('path');
+const { readFile } = require('fs');
+const { execFile, spawn } = require('child_process');
+
+const {
+  readUInt32BE,
+  writeUInt32BE,
+  writeUInt32LE,
+} = require('./protocol/utils.js');
+
+const REQUEST_IDENTITIES = 11;
+const IDENTITIES_ANSWER = 12;
+const SIGN_REQUEST = 13;
+const SIGN_RESPONSE = 14;
+const FAILURE = 5;
+
+let PageantSock;
+
+const RE_CYGWIN_SOCK = /^!<socket >(\d+) s ([A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8}-[A-Z0-9]{8})/;
+
+// Format of `//./pipe/ANYTHING`, with forward slashes and backward slashes
+// being interchangeable
+const WINDOWS_PIPE_REGEX = /^[/\\][/\\]\.[/\\]pipe[/\\].+/;
+
+module.exports = (sockPath, key, keyType, data, cb) => {
+  let sock;
+  let error;
+  let sig;
+  let datalen;
+  let keylen = 0;
+  const isSigning = Buffer.isBuffer(key);
+  let type;
+  let count = 0;
+  let siglen = 0;
+  let nkeys = 0;
+  let keys;
+  let comlen = 0;
+  let comment = false;
+  let accept;
+  let reject;
 
   if (typeof key === 'function' && typeof keyType === 'function') {
-    // agent forwarding
+    // Agent forwarding
     accept = key;
     reject = keyType;
   } else if (isSigning) {
@@ -50,15 +56,15 @@ module.exports = function(sockPath, key, keyType, data, cb) {
   }
 
   function onconnect() {
-    var buf;
+    let buf;
     if (isSigning) {
       /*
         byte        SSH2_AGENTC_SIGN_REQUEST
         string      key_blob
         string      data
         uint32      flags
       */
-      var p = 9;
+      let p = 9;
       buf = Buffer.allocUnsafe(4 + 1 + 4 + keylen + 4 + datalen + 4);
       writeUInt32BE(buf, buf.length - 4, 0);
       buf[4] = SIGN_REQUEST;
@@ -75,10 +81,11 @@ module.exports = function(sockPath, key, keyType, data, cb) {
       sock.write(Buffer.from([0, 0, 0, 1, REQUEST_IDENTITIES]));
     }
   }
+
   function ondata(chunk) {
-    for (var i = 0, len = chunk.length; i < len; ++i) {
+    for (let i = 0; i < chunk.length; ++i) {
       if (type === undefined) {
-        // skip over packet length
+        // Skip over packet length
         if (++count === 5) {
           type = chunk[i];
           count = 0;
@@ -99,7 +106,8 @@ module.exports = function(sockPath, key, keyType, data, cb) {
           sig[count] = chunk[i];
           if (++count === siglen) {
             sock.removeAllListeners('data');
-            return sock.destroy();
+            sock.destroy();
+            return;
           }
         }
       } else if (type === IDENTITIES_ANSWER) {
@@ -123,48 +131,43 @@ module.exports = function(sockPath, key, keyType, data, cb) {
               return sock.destroy();
             }
           }
-        } else {
-          if (!key) {
-            keylen <<= 8;
-            keylen += chunk[i];
-            if (++count === 4) {
-              key = Buffer.allocUnsafe(keylen);
-              count = 0;
-            }
-          } else if (comment === false) {
-            key[count] = chunk[i];
-            if (++count === keylen) {
-              keys[nkeys - 1] = key;
-              keylen = 0;
-              count = 0;
-              comment = true;
-              if (--nkeys === 0) {
-                key = undefined;
-                sock.removeAllListeners('data');
-                return sock.destroy();
-              }
-            }
-          } else if (comment === true) {
-            comlen <<= 8;
-            comlen += chunk[i];
-            if (++count === 4) {
-              count = 0;
-              if (comlen > 0)
-                comment = comlen;
-              else {
-                key = undefined;
-                comment = false;
-              }
-              comlen = 0;
+        } else if (!key) {
+          keylen <<= 8;
+          keylen += chunk[i];
+          if (++count === 4) {
+            key = Buffer.allocUnsafe(keylen);
+            count = 0;
+          }
+        } else if (comment === false) {
+          key[count] = chunk[i];
+          if (++count === keylen) {
+            keys[nkeys - 1] = key;
+            keylen = 0;
+            count = 0;
+            comment = true;
+            if (--nkeys === 0) {
+              key = undefined;
+              sock.removeAllListeners('data');
+              return sock.destroy();
             }
-          } else {
-            // skip comments
-            if (++count === comment) {
-              comment = false;
-              count = 0;
+          }
+        } else if (comment === true) {
+          comlen <<= 8;
+          comlen += chunk[i];
+          if (++count === 4) {
+            count = 0;
+            if (comlen > 0) {
+              comment = comlen;
+            } else {
               key = undefined;
+              comment = false;
             }
+            comlen = 0;
           }
+        } else if (++count === comment) { // Skip comments
+          comment = false;
+          count = 0;
+          key = undefined;
         }
       } else if (type === FAILURE) {
         if (isSigning)
@@ -176,9 +179,11 @@ module.exports = function(sockPath, key, keyType, data, cb) {
       }
     }
   }
+
   function onerror(err) {
     error = err;
   }
+
   function onclose() {
     if (error)
       cb(error);
@@ -195,71 +200,65 @@ module.exports = function(sockPath, key, keyType, data, cb) {
       // Pageant (PuTTY authentication agent)
       sock = new PageantSock();
     } else {
-      // cygwin ssh-agent instance
-      var triedCygpath = false;
-      fs.readFile(sockPath, function readCygsocket(err, data) {
+      // Cygwin ssh-agent instance
+      let triedCygpath = false;
+      readFile(sockPath, function readCygsocket(err, data) {
         if (err) {
           if (triedCygpath)
             return cb(new Error('Invalid cygwin unix socket path'));
-          // try using `cygpath` to convert a possible *nix-style path to the
+          // Try using `cygpath` to convert a possible *nix-style path to the
           // real Windows path before giving up ...
-          cp.exec('cygpath -w "' + sockPath + '"',
-                  function(err, stdout, stderr) {
+          execFile('cygpath', ['-w', sockPath], (err, stdout, stderr) => {
             if (err || stdout.length === 0)
               return cb(new Error('Invalid cygwin unix socket path'));
             triedCygpath = true;
             sockPath = stdout.toString().replace(/[\r\n]/g, '');
-            fs.readFile(sockPath, readCygsocket);
+            readFile(sockPath, readCygsocket);
           });
           return;
         }
 
-        var m;
+        let m;
         if (m = RE_CYGWIN_SOCK.exec(data.toString('ascii'))) {
-          var port;
-          var secret;
-          var secretbuf;
-          var state;
-          var bc = 0;
-          var isRetrying = false;
-          var inbuf = [];
-          var credsbuf = Buffer.allocUnsafe(12);
-          var i;
-          var j;
-
-          // use 0 for pid, uid, and gid to ensure we get an error and also
+          let state;
+          let bc = 0;
+          let isRetrying = false;
+          const inbuf = [];
+
+          // Use 0 for pid, uid, and gid to ensure we get an error and also
           // a valid uid and gid from cygwin so that we don't have to figure it
           // out ourselves
-          credsbuf.fill(0);
+          let credsbuf = Buffer.alloc(12);
 
-          // parse cygwin unix socket file contents
-          port = parseInt(m[1], 10);
-          secret = m[2].replace(/\-/g, '');
-          secretbuf = Buffer.allocUnsafe(16);
-          for (i = 0, j = 0; j < 32; ++i,j+=2)
+          // Parse cygwin unix socket file contents
+          const port = parseInt(m[1], 10);
+          const secret = m[2].replace(/-/g, '');
+          const secretbuf = Buffer.allocUnsafe(16);
+          for (let i = 0, j = 0; j < 32; ++i, j += 2)
             secretbuf[i] = parseInt(secret.substring(j, j + 2), 16);
 
-          // convert to host order (always LE for Windows)
-          for (i = 0; i < 16; i += 4)
+          // Convert to host order (always LE for Windows)
+          for (let i = 0; i < 16; i += 4)
             writeUInt32LE(secretbuf, readUInt32BE(secretbuf, i), i);
 
           function _onconnect() {
             bc = 0;
             state = 'secret';
             sock.write(secretbuf);
           }
+
           function _ondata(data) {
             bc += data.length;
             if (state === 'secret') {
-              // the secret we sent is echoed back to us by cygwin, not sure of
+              // The secret we sent is echoed back to us by cygwin, not sure of
               // the reason for that, but we ignore it nonetheless ...
               if (bc === 16) {
                 bc = 0;
                 state = 'creds';
                 sock.write(credsbuf);
               }
             } else if (state === 'creds') {
-              // if this is the first attempt, make sure to gather the valid
+              // If this is the first attempt, make sure to gather the valid
               // uid and gid for our next attempt
               if (!isRetrying)
                 inbuf.push(data);
@@ -281,24 +280,29 @@ module.exports = function(sockPath, key, keyType, data, cb) {
               }
             }
           }
+
           function _onclose() {
             cb(new Error('Problem negotiating cygwin unix socket security'));
           }
+
           function tryConnect() {
             sock = new Socket();
             sock.once('connect', _onconnect);
             sock.on('data', _ondata);
             sock.once('close', _onclose);
             sock.connect(port);
           }
+
           tryConnect();
-        } else
+        } else {
           cb(new Error('Malformed cygwin unix socket file'));
+        }
       });
       return;
     }
-  } else
+  } else {
     sock = new Socket();
+  }
 
   function addSockListeners() {
     if (!accept && !reject) {
@@ -307,10 +311,10 @@ module.exports = function(sockPath, key, keyType, data, cb) {
       sock.once('error', onerror);
       sock.once('close', onclose);
     } else {
-      var chan;
-      sock.once('connect', function() {
+      let chan;
+      sock.once('connect', () => {
         chan = accept();
-        var isDone = false;
+        let isDone = false;
         function onDone() {
           if (isDone)
             return;
@@ -319,14 +323,10 @@ module.exports = function(sockPath, key, keyType, data, cb) {
         }
         chan.once('end', onDone)
             .once('close', onDone)
-            .on('data', function(data) {
-          sock.write(data);
-        });
-        sock.on('data', function(data) {
-          chan.write(data);
-        });
+            .on('data', (data) => sock.write(data));
+        sock.on('data', (data) => chan.write(data));
       });
-      sock.once('close', function() {
+      sock.once('close', () => {
         if (!chan)
           reject();
       });
@@ -336,84 +336,91 @@ module.exports = function(sockPath, key, keyType, data, cb) {
   sock.connect(sockPath);
 };
 
-
-// win32 only ------------------------------------------------------------------
 if (process.platform === 'win32') {
-  var RET_ERR_BADARGS = 10;
-  var RET_ERR_UNAVAILABLE = 11;
-  var RET_ERR_NOMAP = 12;
-  var RET_ERR_BINSTDIN = 13;
-  var RET_ERR_BINSTDOUT = 14;
-  var RET_ERR_BADLEN = 15;
-
-  var ERROR = {};
-  var EXEPATH = path.resolve(__dirname, '..', 'util/pagent.exe');
-  ERROR[RET_ERR_BADARGS] = new Error('Invalid pagent.exe arguments');
-  ERROR[RET_ERR_UNAVAILABLE] = new Error('Pageant is not running');
-  ERROR[RET_ERR_NOMAP] = new Error('pagent.exe could not create an mmap');
-  ERROR[RET_ERR_BINSTDIN] = new Error('pagent.exe could not set mode for stdin');
-  ERROR[RET_ERR_BINSTDOUT] = new Error('pagent.exe could not set mode for stdout');
-  ERROR[RET_ERR_BADLEN] = new Error('pagent.exe did not get expected input payload');
-
-  function PageantSock() {
-    this.proc = undefined;
-    this.buffer = null;
-  }
-  inherits(PageantSock, EventEmitter);
-
-  PageantSock.prototype.write = function(buf) {
-    if (this.buffer === null)
-      this.buffer = buf;
-    else {
-      this.buffer = Buffer.concat([this.buffer, buf],
-                                  this.buffer.length + buf.length);
-    }
-    // Wait for at least all length bytes
-    if (this.buffer.length < 4)
-      return;
+  const RET_ERR_BADARGS = 10;
+  const RET_ERR_UNAVAILABLE = 11;
+  const RET_ERR_NOMAP = 12;
+  const RET_ERR_BINSTDIN = 13;
+  const RET_ERR_BINSTDOUT = 14;
+  const RET_ERR_BADLEN = 15;
 
-    var len = readUInt32BE(this.buffer, 0);
-    // Make sure we have a full message before querying pageant
-    if ((this.buffer.length - 4) < len)
-      return;
+  const EXEPATH = resolve(__dirname, '..', 'util/pagent.exe');
+  const ERROR = {
+    [RET_ERR_BADARGS]: new Error('Invalid pagent.exe arguments'),
+    [RET_ERR_UNAVAILABLE]: new Error('Pageant is not running'),
+    [RET_ERR_NOMAP]: new Error('pagent.exe could not create an mmap'),
+    [RET_ERR_BINSTDIN]: new Error('pagent.exe could not set mode for stdin'),
+    [RET_ERR_BINSTDOUT]: new Error('pagent.exe could not set mode for stdout'),
+    [RET_ERR_BADLEN]:
+      new Error('pagent.exe did not get expected input payload'),
+  };
 
-    buf = this.buffer.slice(0, 4 + len);
-    if (this.buffer.length > (4 + len))
-      this.buffer = this.buffer.slice(4 + len);
-    else
+  PageantSock = class PageantSock extends EventEmitter {
+    constructor() {
+      super();
+      this.proc = undefined;
       this.buffer = null;
+    }
 
-    var self = this;
-    var proc;
-    var hadError = false;
-    proc = this.proc = cp.spawn(EXEPATH, [ buf.length ]);
-    proc.stdout.on('data', function(data) {
-      self.emit('data', data);
-    });
-    proc.once('error', function(err) {
-      if (!hadError) {
-        hadError = true;
-        self.emit('error', err);
+    write(buf) {
+      if (this.buffer === null) {
+        this.buffer = buf;
+      } else {
+        this.buffer = Buffer.concat([this.buffer, buf],
+                                    this.buffer.length + buf.length);
       }
-    });
-    proc.once('close', function(code) {
-      self.proc = undefined;
-      if (ERROR[code] && !hadError) {
-        hadError = true;
-        self.emit('error', ERROR[code]);
+      // Wait for at least all length bytes
+      if (this.buffer.length < 4)
+        return;
+
+      const len = readUInt32BE(this.buffer, 0);
+      // Make sure we have a full message before querying pageant
+      if ((this.buffer.length - 4) < len)
+        return;
+
+      buf = this.buffer.slice(0, 4 + len);
+      if (this.buffer.length > (4 + len))
+        this.buffer = this.buffer.slice(4 + len);
+      else
+        this.buffer = null;
+
+      let hadError = false;
+      const proc = this.proc = spawn(EXEPATH, [ buf.length ]);
+      proc.stdout.on('data', (data) => {
+        this.emit('data', data);
+      });
+      proc.once('error', (err) => {
+        if (!hadError) {
+          hadError = true;
+          this.emit('error', err);
+        }
+      });
+      proc.once('close', (code) => {
+        this.proc = undefined;
+        let err;
+        if (!hadError && (err = ERROR[code])) {
+          hadError = true;
+          this.emit('error', err);
+        }
+        this.emit('close', hadError);
+      });
+      proc.stdin.end(buf);
+    }
+
+    end() {
+      this.buffer = null;
+      if (this.proc) {
+        this.proc.kill();
+        this.proc = undefined;
       }
-      self.emit('close', hadError);
-    });
-    proc.stdin.end(buf);
-  };
-  PageantSock.prototype.end = PageantSock.prototype.destroy = function() {
-    this.buffer = null;
-    if (this.proc) {
-      this.proc.kill();
-      this.proc = undefined;
     }
-  };
-  PageantSock.prototype.connect = function() {
-    this.emit('connect');
+
+    destroy() {
+      this.end();
+    }
+
+    connect() {
+      this.emit('connect');
+    }
   };
 }

@@ -1,22 +0,0 @@
-module.exports = {
-  readUInt32BE: function readUInt32BE(buf, offset) {
-    return buf[offset++] * 16777216
-           + buf[offset++] * 65536
-           + buf[offset++] * 256
-           + buf[offset];
-  },
-  writeUInt32BE: function writeUInt32BE(buf, value, offset) {
-    buf[offset++] = (value >>> 24);
-    buf[offset++] = (value >>> 16);
-    buf[offset++] = (value >>> 8);
-    buf[offset++] = value;
-    return offset;
-  },
-  writeUInt32LE: function writeUInt32LE(buf, value, offset) {
-    buf[offset++] = value;
-    buf[offset++] = (value >>> 8);
-    buf[offset++] = (value >>> 16);
-    buf[offset++] = (value >>> 24);
-    return offset;
-  }
-};

@@ -1,508 +1,292 @@
-var inherits = require('util').inherits;
-var DuplexStream = require('stream').Duplex;
-var ReadableStream = require('stream').Readable;
-var WritableStream = require('stream').Writable;
-
-var STDERR = require('ssh2-streams').constants.CHANNEL_EXTENDED_DATATYPE.STDERR;
-
-var PACKET_SIZE = 32 * 1024;
-var MAX_WINDOW = 2 * 1024 * 1024;
-var WINDOW_THRESHOLD = MAX_WINDOW / 2;
-var CUSTOM_EVENTS = [
-  'CHANNEL_EOF',
-  'CHANNEL_CLOSE',
-  'CHANNEL_DATA',
-  'CHANNEL_EXTENDED_DATA',
-  'CHANNEL_WINDOW_ADJUST',
-  'CHANNEL_SUCCESS',
-  'CHANNEL_FAILURE',
-  'CHANNEL_REQUEST'
-];
-var CUSTOM_EVENTS_LEN = CUSTOM_EVENTS.length;
-
-function Channel(info, client, opts) {
-  var streamOpts = {
-    highWaterMark: MAX_WINDOW,
-    allowHalfOpen: (!opts || (opts && opts.allowHalfOpen !== false))
-  };
-
-  this.allowHalfOpen = streamOpts.allowHalfOpen;
-
-  DuplexStream.call(this, streamOpts);
-
-  var self = this;
-  var server = opts && opts.server;
-
-  this.server = server;
-  this.type = info.type;
-  this.subtype = undefined;
-  /*
-    incoming and outgoing contain these properties:
-    {
-      id: undefined,
-      window: undefined,
-      packetSize: undefined,
-      state: 'closed'
-    }
-  */
-  var incoming = this.incoming = info.incoming;
-  var incomingId = incoming.id;
-  var outgoing = this.outgoing = info.outgoing;
-  var callbacks = this._callbacks = [];
-  var exitCode;
-  var exitSignal;
-  var exitDump;
-  var exitDesc;
-  var exitLang;
-
-  this._client = client;
-  this._hasX11 = false;
-
-  var channels = client._channels;
-  var sshstream = client._sshstream;
-
-  function ondrain() {
-    if (self._waitClientDrain) {
-      self._waitClientDrain = false;
-      if (!self._waitWindow) {
-        if (self._chunk)
-          self._write(self._chunk, null, self._chunkcb);
-        else if (self._chunkcb)
-          self._chunkcb();
-        else if (self._chunkErr)
-          self.stderr._write(self._chunkErr, null, self._chunkcbErr);
-        else if (self._chunkcbErr)
-          self._chunkcbErr();
-      }
+'use strict';
+
+const {
+  Duplex: DuplexStream,
+  Readable: ReadableStream,
+  Writable: WritableStream,
+} = require('stream');
+
+const {
+  CHANNEL_EXTENDED_DATATYPE: { STDERR },
+} = require('./protocol/constants.js');
+const { bufferSlice } = require('./protocol/utils.js');
+
+const PACKET_SIZE = 32 * 1024;
+const MAX_WINDOW = 2 * 1024 * 1024;
+const WINDOW_THRESHOLD = MAX_WINDOW / 2;
+
+class ClientStderr extends ReadableStream {
+  constructor(channel, streamOpts) {
+    super(streamOpts);
+
+    this._channel = channel;
+  }
+  _read(n) {
+    if (this._channel._waitChanDrain) {
+      this._channel._waitChanDrain = false;
+      if (this._channel.incoming.window <= WINDOW_THRESHOLD)
+        windowAdjust(this._channel);
     }
   }
-  client._sock.on('drain', ondrain);
+}
 
-  sshstream.once('CHANNEL_EOF:' + incomingId, function() {
-    if (incoming.state !== 'open')
-      return;
-    incoming.state = 'eof';
-
-    if (self.readable)
-      self.push(null);
-    if (!server && self.stderr.readable)
-      self.stderr.push(null);
-  }).once('CHANNEL_CLOSE:' + incomingId, function() {
-    if (incoming.state === 'closed')
-      return;
-    incoming.state = 'closed';
-
-    if (self.readable)
-      self.push(null);
-    if (server && self.stderr.writable)
-      self.stderr.end();
-    else if (!server && self.stderr.readable)
-      self.stderr.push(null);
-
-    if (outgoing.state === 'open' || outgoing.state === 'eof')
-      self.close();
-    if (outgoing.state === 'closing')
-      outgoing.state = 'closed';
-
-    delete channels[incomingId];
-
-    var state = self._writableState;
-    client._sock.removeListener('drain', ondrain);
-    if (!state.ending && !state.finished)
-      self.end();
-
-    // Take care of any outstanding channel requests
-    self._callbacks = [];
-    for (var i = 0; i < callbacks.length; ++i)
-      callbacks[i](true);
-    callbacks = self._callbacks;
-
-    if (!server) {
-      // align more with node child processes, where the close event gets the
-      // same arguments as the exit event
-      if (!self.readable) {
-        if (exitCode === null) {
-          self.emit('close', exitCode, exitSignal, exitDump, exitDesc,
-                    exitLang);
-        } else
-          self.emit('close', exitCode);
-      } else {
-        self.once('end', function() {
-          if (exitCode === null) {
-            self.emit('close', exitCode, exitSignal, exitDump, exitDesc,
-                      exitLang);
-          } else
-            self.emit('close', exitCode);
-        });
-      }
+class ServerStderr extends WritableStream {
+  constructor(channel) {
+    super({ highWaterMark: MAX_WINDOW });
 
-      if (!self.stderr.readable)
-        self.stderr.emit('close');
-      else {
-        self.stderr.once('end', function() {
-          self.stderr.emit('close');
-        });
-      }
-    } else { // Server mode
-      if (!self.readable)
-        self.emit('close');
-      else {
-        self.once('end', function() {
-          self.emit('close');
-        });
-      }
-    }
+    this._channel = channel;
+  }
 
-    for (var i = 0; i < CUSTOM_EVENTS_LEN; ++i)
-      sshstream.removeAllListeners(CUSTOM_EVENTS[i] + ':' + incomingId);
-  }).on('CHANNEL_DATA:' + incomingId, function(data) {
-    // the remote party should not be sending us data if there is no window
-    // space available ...
-    // TODO: raise error on data with not enough window
-    if (incoming.window === 0)
+  _write(data, encoding, cb) {
+    const channel = this._channel;
+    const protocol = channel._client._protocol;
+    const outgoing = channel.outgoing;
+    const packetSize = outgoing.packetSize;
+    const id = outgoing.id;
+    let window = outgoing.window;
+    const len = data.length;
+    let p = 0;
+
+    if (outgoing.state !== 'open')
       return;
 
-    incoming.window -= data.length;
+    while (len - p > 0 && window > 0) {
+      let sliceLen = len - p;
+      if (sliceLen > window)
+        sliceLen = window;
+      if (sliceLen > packetSize)
+        sliceLen = packetSize;
 
-    if (!self.push(data)) {
-      self._waitChanDrain = true;
-      return;
-    }
+      if (p === 0 && sliceLen === len)
+        protocol.channelExtData(id, data, STDERR);
+      else
+        protocol.channelExtData(id, bufferSlice(data, p, p + sliceLen), STDERR);
 
-    if (incoming.window <= WINDOW_THRESHOLD)
-      windowAdjust(self);
-  }).on('CHANNEL_WINDOW_ADJUST:' + incomingId, function(amt) {
-    // the server is allowing us to send `amt` more bytes of data
-    outgoing.window += amt;
-
-    if (self._waitWindow) {
-      self._waitWindow = false;
-      if (!self._waitClientDrain) {
-        if (self._chunk)
-          self._write(self._chunk, null, self._chunkcb);
-        else if (self._chunkcb)
-          self._chunkcb();
-        else if (self._chunkErr)
-          self.stderr._write(self._chunkErr, null, self._chunkcbErr);
-        else if (self._chunkcbErr)
-          self._chunkcbErr();
-      }
-    }
-  }).on('CHANNEL_SUCCESS:' + incomingId, function() {
-    if (server) {
-      sshstream._kalast = Date.now();
-      sshstream._kacnt = 0;
-    } else
-      client._resetKA();
-    if (callbacks.length)
-      callbacks.shift()(false);
-  }).on('CHANNEL_FAILURE:' + incomingId, function() {
-    if (server) {
-      sshstream._kalast = Date.now();
-      sshstream._kacnt = 0;
-    } else
-      client._resetKA();
-    if (callbacks.length)
-      callbacks.shift()(true);
-  }).on('CHANNEL_REQUEST:' + incomingId, function(info) {
-    if (!server) {
-      if (info.request === 'exit-status') {
-        self.emit('exit', exitCode = info.code);
-        return;
-      } else if (info.request === 'exit-signal') {
-        self.emit('exit',
-                  exitCode = null,
-                  exitSignal = 'SIG' + info.signal,
-                  exitDump = info.coredump,
-                  exitDesc = info.description,
-                  exitLang = info.lang);
-        return;
-      }
+      p += sliceLen;
+      window -= sliceLen;
     }
 
-    // keepalive request? OpenSSH will send one as a channel request if there
-    // is a channel open
+    outgoing.window = window;
 
-    if (info.wantReply)
-      sshstream.channelFailure(outgoing.id);
-  });
+    if (len - p > 0) {
+      if (window === 0)
+        channel._waitWindow = true;
+      if (p > 0)
+        channel._chunkErr = bufferSlice(data, p, len);
+      else
+        channel._chunkErr = data;
+      channel._chunkcbErr = cb;
+      return;
+    }
 
-  this.stdin = this.stdout = this;
+    cb();
+  }
+}
 
-  if (server)
-    this.stderr = new ServerStderr(this);
-  else {
-    this.stderr = new ReadableStream(streamOpts);
-    this.stderr._read = function(n) {
-      if (self._waitChanDrain) {
-        self._waitChanDrain = false;
-        if (incoming.window <= WINDOW_THRESHOLD)
-          windowAdjust(self);
+class Channel extends DuplexStream {
+  constructor(client, info, opts) {
+    const streamOpts = {
+      highWaterMark: MAX_WINDOW,
+      allowHalfOpen: (!opts || (opts && opts.allowHalfOpen !== false))
+    };
+    super(streamOpts);
+    this.allowHalfOpen = streamOpts.allowHalfOpen;
+
+    const server = !!(opts && opts.server);
+
+    this.server = server;
+    this.type = info.type;
+    this.subtype = undefined;
+
+    /*
+      incoming and outgoing contain these properties:
+      {
+        id: undefined,
+        window: undefined,
+        packetSize: undefined,
+        state: 'closed'
       }
+    */
+    this.incoming = info.incoming;
+    this.outgoing = info.outgoing;
+    this._callbacks = [];
+
+    this._client = client;
+    this._hasX11 = false;
+    this._exit = {
+      code: undefined,
+      signal: undefined,
+      dump: undefined,
+      desc: undefined,
     };
 
-    sshstream.on('CHANNEL_EXTENDED_DATA:' + incomingId,
-      function(type, data) {
-        // the remote party should not be sending us data if there is no window
-        // space available ...
-        // TODO: raise error on data with not enough window
-        if (incoming.window === 0)
-          return;
+    this.stdin = this.stdout = this;
 
-        incoming.window -= data.length;
+    if (server)
+      this.stderr = new ServerStderr(this);
+    else
+      this.stderr = new ClientStderr(this, streamOpts);
 
-        if (!self.stderr.push(data)) {
-          self._waitChanDrain = true;
-          return;
-        }
+    // Outgoing data
+    this._waitWindow = false; // SSH-level backpressure
 
-        if (incoming.window <= WINDOW_THRESHOLD)
-          windowAdjust(self);
-      }
-    );
-  }
+    // Incoming data
+    this._waitChanDrain = false; // Channel Readable side backpressure
 
-  // outgoing data
-  this._waitClientDrain = false; // Client stream-level backpressure
-  this._waitWindow = false; // SSH-level backpressure
+    this._chunk = undefined;
+    this._chunkcb = undefined;
+    this._chunkErr = undefined;
+    this._chunkcbErr = undefined;
 
-  // incoming data
-  this._waitChanDrain = false; // Channel Readable side backpressure
+    this.on('finish', onFinish)
+        .on('prefinish', onFinish); // For node v0.11+
 
-  this._chunk = undefined;
-  this._chunkcb = undefined;
-  this._chunkErr = undefined;
-  this._chunkcbErr = undefined;
-
-  function onFinish() {
-    self.eof();
-    if (server || (!server && !self.allowHalfOpen))
-      self.close();
-    self.writable = false;
-  }
-  this.on('finish', onFinish)
-      .on('prefinish', onFinish); // for node v0.11+
-  function onEnd() {
-    self.readable = false;
+    this.on('end', onEnd).on('close', onEnd);
   }
-  this.on('end', onEnd)
-      .on('close', onEnd);
-}
-inherits(Channel, DuplexStream);
-
-Channel.prototype.eof = function() {
-  var ret = true;
-  var outgoing = this.outgoing;
 
-  if (outgoing.state === 'open') {
-    outgoing.state = 'eof';
-    ret = this._client._sshstream.channelEOF(outgoing.id);
+  _read(n) {
+    if (this._waitChanDrain) {
+      this._waitChanDrain = false;
+      if (this.incoming.window <= WINDOW_THRESHOLD)
+        windowAdjust(this);
+    }
   }
 
-  return ret;
-};
+  _write(data, encoding, cb) {
+    const protocol = this._client._protocol;
+    const outgoing = this.outgoing;
+    const packetSize = outgoing.packetSize;
+    const id = outgoing.id;
+    let window = outgoing.window;
+    const len = data.length;
+    let p = 0;
 
-Channel.prototype.close = function() {
-  var ret = true;
-  var outgoing = this.outgoing;
+    if (outgoing.state !== 'open')
+      return;
 
-  if (outgoing.state === 'open' || outgoing.state === 'eof') {
-    outgoing.state = 'closing';
-    ret = this._client._sshstream.channelClose(outgoing.id);
-  }
+    while (len - p > 0 && window > 0) {
+      let sliceLen = len - p;
+      if (sliceLen > window)
+        sliceLen = window;
+      if (sliceLen > packetSize)
+        sliceLen = packetSize;
 
-  return ret;
-};
+      if (p === 0 && sliceLen === len)
+        protocol.channelData(id, data);
+      else
+        protocol.channelData(id, bufferSlice(data, p, p + sliceLen));
 
-Channel.prototype._read = function(n) {
-  if (this._waitChanDrain) {
-    this._waitChanDrain = false;
-    if (this.incoming.window <= WINDOW_THRESHOLD)
-      windowAdjust(this);
-  }
-};
+      p += sliceLen;
+      window -= sliceLen;
+    }
 
-Channel.prototype._write = function(data, encoding, cb) {
-  var sshstream = this._client._sshstream;
-  var outgoing = this.outgoing;
-  var packetSize = outgoing.packetSize;
-  var id = outgoing.id;
-  var window = outgoing.window;
-  var len = data.length;
-  var p = 0;
-  var ret;
-  var buf;
-  var sliceLen;
-
-  if (outgoing.state !== 'open')
-    return;
+    outgoing.window = window;
 
-  while (len - p > 0 && window > 0) {
-    sliceLen = len - p;
-    if (sliceLen > window)
-      sliceLen = window;
-    if (sliceLen > packetSize)
-      sliceLen = packetSize;
+    if (len - p > 0) {
+      if (window === 0)
+        this._waitWindow = true;
+      if (p > 0)
+        this._chunk = bufferSlice(data, p, len);
+      else
+        this._chunk = data;
+      this._chunkcb = cb;
+      return;
+    }
 
-    ret = sshstream.channelData(id, data.slice(p, p + sliceLen));
+    cb();
+  }
 
-    p += sliceLen;
-    window -= sliceLen;
+  eof() {
+    if (this.outgoing.state === 'open') {
+      this.outgoing.state = 'eof';
+      this._client._protocol.channelEOF(this.outgoing.id);
+    }
+  }
 
-    if (!ret) {
-      this._waitClientDrain = true;
-      this._chunk = undefined;
-      this._chunkcb = cb;
-      break;
+  close() {
+    if (this.outgoing.state === 'open' || this.outgoing.state === 'eof') {
+      this.outgoing.state = 'closing';
+      this._client._protocol.channelClose(this.outgoing.id);
     }
   }
 
-  outgoing.window = window;
-
-  if (len - p > 0) {
-    if (window === 0)
-      this._waitWindow = true;
-    if (p > 0) {
-      // partial
-      buf = Buffer.allocUnsafe(len - p);
-      data.copy(buf, 0, p);
-      this._chunk = buf;
-    } else
-      this._chunk = data;
-    this._chunkcb = cb;
-    return;
+  destroy() {
+    this.end();
   }
 
-  if (!this._waitClientDrain)
-    cb();
-};
+  // Session type-specific methods =============================================
+  setWindow(rows, cols, height, width) {
+    if (this.server)
+      throw new Error('Client-only method called in server mode');
+
+    if (this.type === 'session'
+        && (this.subtype === 'shell' || this.subtype === 'exec')
+        && this.writable
+        && this.outgoing.state === 'open') {
+      this._client._protocol.windowChange(this.outgoing.id,
+                                          rows,
+                                          cols,
+                                          height,
+                                          width);
+    }
+  }
 
-Channel.prototype.destroy = function() {
-  this.end();
-};
+  signal(signalName) {
+    if (this.server)
+      throw new Error('Client-only method called in server mode');
 
-// session type-specific methods
-Channel.prototype.setWindow = function(rows, cols, height, width) {
-  if (this.server)
-    throw new Error('Client-only method called in server mode');
-
-  if (this.type === 'session'
-      && (this.subtype === 'shell' || this.subtype === 'exec')
-      && this.writable
-      && this.outgoing.state === 'open') {
-    return this._client._sshstream.windowChange(this.outgoing.id,
-                                                rows,
-                                                cols,
-                                                height,
-                                                width);
+    if (this.type === 'session'
+        && this.writable
+        && this.outgoing.state === 'open') {
+      this._client._protocol.signal(this.outgoing.id, signalName);
+    }
   }
 
-  return true;
-};
-Channel.prototype.signal = function(signalName) {
-  if (this.server)
-    throw new Error('Client-only method called in server mode');
+  exit(statusOrSignal, coreDumped, msg) {
+    if (!this.server)
+      throw new Error('Server-only method called in client mode');
 
-  if (this.type === 'session'
-      && this.writable
-      && this.outgoing.state === 'open')
-    return this._client._sshstream.signal(this.outgoing.id, signalName);
-
-  return true;
-};
-Channel.prototype.exit = function(name, coreDumped, msg) {
-  if (!this.server)
-    throw new Error('Server-only method called in client mode');
-
-  if (this.type === 'session'
-      && this.writable
-      && this.outgoing.state === 'open') {
-    if (typeof name === 'number')
-      return this._client._sshstream.exitStatus(this.outgoing.id, name);
-    else {
-      return this._client._sshstream.exitSignal(this.outgoing.id,
-                                                name,
-                                                coreDumped,
-                                                msg);
+    if (this.type === 'session'
+        && this.writable
+        && this.outgoing.state === 'open') {
+      if (typeof statusOrSignal === 'number') {
+        this._client._protocol.exitStatus(this.outgoing.id, statusOrSignal);
+      } else {
+        this._client._protocol.exitSignal(this.outgoing.id,
+                                          statusOrSignal,
+                                          coreDumped,
+                                          msg);
+      }
     }
   }
 
-  return true;
-};
+}
+
+function onFinish() {
+  this.eof();
+  if (this.server || !this.allowHalfOpen)
+    this.close();
+  this.writable = false;
+}
 
-Channel.MAX_WINDOW = MAX_WINDOW;
-Channel.PACKET_SIZE = PACKET_SIZE;
+function onEnd() {
+  this.readable = false;
+}
 
 function windowAdjust(self) {
   if (self.outgoing.state === 'closed')
-    return true;
-  var amt = MAX_WINDOW - self.incoming.window;
+    return;
+  const amt = MAX_WINDOW - self.incoming.window;
   if (amt <= 0)
-    return true;
+    return;
   self.incoming.window += amt;
-  return self._client._sshstream.channelWindowAdjust(self.outgoing.id, amt);
+  self._client._protocol.channelWindowAdjust(self.outgoing.id, amt);
 }
 
-function ServerStderr(channel) {
-  WritableStream.call(this, { highWaterMark: MAX_WINDOW });
-  this._channel = channel;
-}
-inherits(ServerStderr, WritableStream);
-
-ServerStderr.prototype._write = function(data, encoding, cb) {
-  var channel = this._channel;
-  var sshstream = channel._client._sshstream;
-  var outgoing = channel.outgoing;
-  var packetSize = outgoing.packetSize;
-  var id = outgoing.id;
-  var window = outgoing.window;
-  var len = data.length;
-  var p = 0;
-  var ret;
-  var buf;
-  var sliceLen;
-
-  if (channel.outgoing.state !== 'open')
-    return;
-
-  while (len - p > 0 && window > 0) {
-    sliceLen = len - p;
-    if (sliceLen > window)
-      sliceLen = window;
-    if (sliceLen > packetSize)
-      sliceLen = packetSize;
-
-    ret = sshstream.channelExtData(id, data.slice(p, p + sliceLen), STDERR);
-
-    p += sliceLen;
-    window -= sliceLen;
-
-    if (!ret) {
-      channel._waitClientDrain = true;
-      channel._chunkErr = undefined;
-      channel._chunkcbErr = cb;
-      break;
-    }
-  }
-
-  outgoing.window = window;
-
-  if (len - p > 0) {
-    if (window === 0)
-      channel._waitWindow = true;
-    if (p > 0) {
-      // partial
-      buf = Buffer.allocUnsafe(len - p);
-      data.copy(buf, 0, p);
-      channel._chunkErr = buf;
-    } else
-      channel._chunkErr = data;
-    channel._chunkcbErr = cb;
-    return;
-  }
-
-  if (!channel._waitClientDrain)
-    cb();
+module.exports = {
+  Channel,
+  MAX_WINDOW,
+  PACKET_SIZE,
+  windowAdjust,
+  WINDOW_THRESHOLD,
 };
-
-module.exports = Channel;

@@ -1,1237 +1,1368 @@
-var crypto = require('crypto');
-var Socket = require('net').Socket;
-var dnsLookup = require('dns').lookup;
-var EventEmitter = require('events').EventEmitter;
-var inherits = require('util').inherits;
-var HASHES = crypto.getHashes();
-
-var ssh2_streams = require('ssh2-streams');
-var SSH2Stream = ssh2_streams.SSH2Stream;
-var SFTPStream = ssh2_streams.SFTPStream;
-var consts = ssh2_streams.constants;
-var BUGS = consts.BUGS;
-var ALGORITHMS = consts.ALGORITHMS;
-var EDDSA_SUPPORTED = consts.EDDSA_SUPPORTED;
-var parseKey = ssh2_streams.utils.parseKey;
-
-var HTTPAgents = require('./http-agents');
-var Channel = require('./Channel');
-var agentQuery = require('./agent');
-var SFTPWrapper = require('./SFTPWrapper');
-var readUInt32BE = require('./buffer-helpers').readUInt32BE;
-
-var MAX_CHANNEL = Math.pow(2, 32) - 1;
-var RE_OPENSSH = /^OpenSSH_(?:(?![0-4])\d)|(?:\d{2,})/;
-var DEBUG_NOOP = function(msg) {};
-
-function Client() {
-  if (!(this instanceof Client))
-    return new Client();
-
-  EventEmitter.call(this);
-
-  this.config = {
-    host: undefined,
-    port: undefined,
-    localAddress: undefined,
-    localPort: undefined,
-    forceIPv4: undefined,
-    forceIPv6: undefined,
-    keepaliveCountMax: undefined,
-    keepaliveInterval: undefined,
-    readyTimeout: undefined,
-
-    username: undefined,
-    password: undefined,
-    privateKey: undefined,
-    tryKeyboard: undefined,
-    agent: undefined,
-    allowAgentFwd: undefined,
-    authHandler: undefined,
-
-    hostHashAlgo: undefined,
-    hostHashCb: undefined,
-    strictVendor: undefined,
-    debug: undefined
-  };
-
-  this._readyTimeout = undefined;
-  this._channels = undefined;
-  this._callbacks = undefined;
-  this._forwarding = undefined;
-  this._forwardingUnix = undefined;
-  this._acceptX11 = undefined;
-  this._agentFwdEnabled = undefined;
-  this._curChan = undefined;
-  this._remoteVer = undefined;
-
-  this._sshstream = undefined;
-  this._sock = undefined;
-  this._resetKA = undefined;
-}
-inherits(Client, EventEmitter);
-
-Client.prototype.connect = function(cfg) {
-  var self = this;
+// TODO: emit error when connection severed early (e.g. before handshake)
+// TODO: add '.connected' or similar property to allow immediate connection
+//       status checking
+'use strict';
+
+const {
+  createHash,
+  getHashes,
+  randomFillSync,
+} = require('crypto');
+const { Socket } = require('net');
+const { lookup: dnsLookup } = require('dns');
+const EventEmitter = require('events');
+const HASHES = getHashes();
+
+const {
+  COMPAT,
+  CHANNEL_EXTENDED_DATATYPE: { STDERR },
+  CHANNEL_OPEN_FAILURE,
+  DEFAULT_CIPHER,
+  DEFAULT_COMPRESSION,
+  DEFAULT_KEX,
+  DEFAULT_MAC,
+  DEFAULT_SERVER_HOST_KEY,
+  DISCONNECT_REASON,
+  DISCONNECT_REASON_BY_VALUE,
+  EDDSA_SUPPORTED,
+  SUPPORTED_CIPHER,
+  SUPPORTED_COMPRESSION,
+  SUPPORTED_KEX,
+  SUPPORTED_MAC,
+  SUPPORTED_SERVER_HOST_KEY,
+} = require('./protocol/constants.js');
+const Protocol = require('./protocol/Protocol.js');
+const { parseKey } = require('./protocol/keyParser.js');
+const { SFTP } = require('./protocol/SFTP.js');
+const { readUInt32BE } = require('./protocol/utils.js');
+
+const agentQuery = require('./agent.js');
+const {
+  Channel,
+  MAX_WINDOW,
+  PACKET_SIZE,
+  windowAdjust,
+  WINDOW_THRESHOLD,
+} = require('./Channel.js');
+const {
+  ChannelManager,
+  generateAlgorithmList,
+  onChannelOpenFailure,
+  onCHANNEL_CLOSE,
+} = require('./utils.js');
+
+const RE_OPENSSH = /^OpenSSH_(?:(?![0-4])\d)|(?:\d{2,})/;
+const noop = (err) => {};
+
+class Client extends EventEmitter {
+  constructor() {
+    super();
+
+    this.config = {
+      host: undefined,
+      port: undefined,
+      localAddress: undefined,
+      localPort: undefined,
+      forceIPv4: undefined,
+      forceIPv6: undefined,
+      keepaliveCountMax: undefined,
+      keepaliveInterval: undefined,
+      readyTimeout: undefined,
+
+      username: undefined,
+      password: undefined,
+      privateKey: undefined,
+      tryKeyboard: undefined,
+      agent: undefined,
+      allowAgentFwd: undefined,
+      authHandler: undefined,
+
+      hostHashAlgo: undefined,
+      hostHashCb: undefined,
+      strictVendor: undefined,
+      debug: undefined
+    };
 
-  if (this._sock && this._sock.writable) {
-    this.once('close', function() {
-      self.connect(cfg);
-    });
-    this.end();
-    return;
+    this._readyTimeout = undefined;
+    this._chanMgr = undefined;
+    this._callbacks = undefined;
+    this._forwarding = undefined;
+    this._forwardingUnix = undefined;
+    this._acceptX11 = undefined;
+    this._agentFwdEnabled = undefined;
+    this._remoteVer = undefined;
+
+    this._protocol = undefined;
+    this._sock = undefined;
+    this._resetKA = undefined;
   }
 
-  this.config.host = cfg.hostname || cfg.host || 'localhost';
-  this.config.port = cfg.port || 22;
-  this.config.localAddress = (typeof cfg.localAddress === 'string'
-                              ? cfg.localAddress
-                              : undefined);
-  this.config.localPort = (typeof cfg.localPort === 'string'
-                           || typeof cfg.localPort === 'number'
-                           ? cfg.localPort
-                           : undefined);
-  this.config.forceIPv4 = cfg.forceIPv4 || false;
-  this.config.forceIPv6 = cfg.forceIPv6 || false;
-  this.config.keepaliveCountMax = (typeof cfg.keepaliveCountMax === 'number'
-                                   && cfg.keepaliveCountMax >= 0
-                                   ? cfg.keepaliveCountMax
-                                   : 3);
-  this.config.keepaliveInterval = (typeof cfg.keepaliveInterval === 'number'
-                                   && cfg.keepaliveInterval > 0
-                                   ? cfg.keepaliveInterval
-                                   : 0);
-  this.config.readyTimeout = (typeof cfg.readyTimeout === 'number'
-                              && cfg.readyTimeout >= 0
-                              ? cfg.readyTimeout
-                              : 20000);
-
-  var algorithms = {
-    kex: undefined,
-    kexBuf: undefined,
-    cipher: undefined,
-    cipherBuf: undefined,
-    serverHostKey: undefined,
-    serverHostKeyBuf: undefined,
-    hmac: undefined,
-    hmacBuf: undefined,
-    compress: undefined,
-    compressBuf: undefined
-  };
-  var i;
-  if (typeof cfg.algorithms === 'object' && cfg.algorithms !== null) {
-    var algosSupported;
-    var algoList;
-
-    algoList = cfg.algorithms.kex;
-    if (Array.isArray(algoList) && algoList.length > 0) {
-      algosSupported = ALGORITHMS.SUPPORTED_KEX;
-      for (i = 0; i < algoList.length; ++i) {
-        if (algosSupported.indexOf(algoList[i]) === -1)
-          throw new Error('Unsupported key exchange algorithm: ' + algoList[i]);
-      }
-      algorithms.kex = algoList;
+  connect(cfg) {
+    if (this._sock && this._sock.writable) {
+      this.once('close', () => {
+        this.connect(cfg);
+      });
+      this.end();
+      return this;
     }
 
-    algoList = cfg.algorithms.cipher;
-    if (Array.isArray(algoList) && algoList.length > 0) {
-      algosSupported = ALGORITHMS.SUPPORTED_CIPHER;
-      for (i = 0; i < algoList.length; ++i) {
-        if (algosSupported.indexOf(algoList[i]) === -1)
-          throw new Error('Unsupported cipher algorithm: ' + algoList[i]);
-      }
-      algorithms.cipher = algoList;
+    this.config.host = cfg.hostname || cfg.host || 'localhost';
+    this.config.port = cfg.port || 22;
+    this.config.localAddress = (typeof cfg.localAddress === 'string'
+                                ? cfg.localAddress
+                                : undefined);
+    this.config.localPort = (typeof cfg.localPort === 'string'
+                             || typeof cfg.localPort === 'number'
+                             ? cfg.localPort
+                             : undefined);
+    this.config.forceIPv4 = cfg.forceIPv4 || false;
+    this.config.forceIPv6 = cfg.forceIPv6 || false;
+    this.config.keepaliveCountMax = (typeof cfg.keepaliveCountMax === 'number'
+                                     && cfg.keepaliveCountMax >= 0
+                                     ? cfg.keepaliveCountMax
+                                     : 3);
+    this.config.keepaliveInterval = (typeof cfg.keepaliveInterval === 'number'
+                                     && cfg.keepaliveInterval > 0
+                                     ? cfg.keepaliveInterval
+                                     : 0);
+    this.config.readyTimeout = (typeof cfg.readyTimeout === 'number'
+                                && cfg.readyTimeout >= 0
+                                ? cfg.readyTimeout
+                                : 20000);
+
+    const algorithms = {
+      kex: undefined,
+      srvHostKey: undefined,
+      cs: {
+        cipher: undefined,
+        mac: undefined,
+        compress: undefined,
+        lang: [],
+      },
+      sc: undefined,
+    };
+    let allOfferDefaults = true;
+    if (typeof cfg.algorithms === 'object' && cfg.algorithms !== null) {
+
+      algorithms.kex = generateAlgorithmList(cfg.algorithms.kex,
+                                             DEFAULT_KEX,
+                                             SUPPORTED_KEX);
+      if (algorithms.kex !== DEFAULT_KEX)
+        allOfferDefaults = false;
+
+      algorithms.srvHostKey =
+        generateAlgorithmList(cfg.algorithms.serverHostKey,
+                              DEFAULT_SERVER_HOST_KEY,
+                              SUPPORTED_SERVER_HOST_KEY);
+      if (algorithms.srvHostKey !== DEFAULT_SERVER_HOST_KEY)
+        allOfferDefaults = false;
+
+      algorithms.cs.cipher = generateAlgorithmList(cfg.algorithms.cipher,
+                                                   DEFAULT_CIPHER,
+                                                   SUPPORTED_CIPHER);
+      if (algorithms.cs.cipher !== DEFAULT_CIPHER)
+        allOfferDefaults = false;
+
+      algorithms.cs.mac = generateAlgorithmList(cfg.algorithms.hmac,
+                                                DEFAULT_MAC,
+                                                SUPPORTED_MAC);
+      if (algorithms.cs.mac !== DEFAULT_MAC)
+        allOfferDefaults = false;
+
+      algorithms.cs.compress = generateAlgorithmList(cfg.algorithms.compress,
+                                                     DEFAULT_COMPRESSION,
+                                                     SUPPORTED_COMPRESSION);
+      if (algorithms.cs.compress !== DEFAULT_COMPRESSION)
+        allOfferDefaults = false;
+
+      if (!allOfferDefaults)
+        algorithms.sc = algorithms.cs;
     }
 
-    algoList = cfg.algorithms.serverHostKey;
-    if (Array.isArray(algoList) && algoList.length > 0) {
-      algosSupported = ALGORITHMS.SUPPORTED_SERVER_HOST_KEY;
-      for (i = 0; i < algoList.length; ++i) {
-        if (algosSupported.indexOf(algoList[i]) === -1) {
-          throw new Error('Unsupported server host key algorithm: '
-                           + algoList[i]);
-        }
-      }
-      algorithms.serverHostKey = algoList;
-    }
+    if (typeof cfg.username === 'string')
+      this.config.username = cfg.username;
+    else if (typeof cfg.user === 'string')
+      this.config.username = cfg.user;
+    else
+      throw new Error('Invalid username');
 
-    algoList = cfg.algorithms.hmac;
-    if (Array.isArray(algoList) && algoList.length > 0) {
-      algosSupported = ALGORITHMS.SUPPORTED_HMAC;
-      for (i = 0; i < algoList.length; ++i) {
-        if (algosSupported.indexOf(algoList[i]) === -1)
-          throw new Error('Unsupported HMAC algorithm: ' + algoList[i]);
-      }
-      algorithms.hmac = algoList;
-    }
+    this.config.password = (typeof cfg.password === 'string'
+                            ? cfg.password
+                            : undefined);
+    this.config.privateKey = (typeof cfg.privateKey === 'string'
+                              || Buffer.isBuffer(cfg.privateKey)
+                              ? cfg.privateKey
+                              : undefined);
+    this.config.localHostname = (typeof cfg.localHostname === 'string'
+                                 && cfg.localHostname.length
+                                 ? cfg.localHostname
+                                 : undefined);
+    this.config.localUsername = (typeof cfg.localUsername === 'string'
+                                 && cfg.localUsername.length
+                                 ? cfg.localUsername
+                                 : undefined);
+    this.config.tryKeyboard = (cfg.tryKeyboard === true);
+    this.config.agent = (typeof cfg.agent === 'string' && cfg.agent.length
+                         ? cfg.agent
+                         : undefined);
+    this.config.allowAgentFwd = (cfg.agentForward === true
+                                 && this.config.agent !== undefined);
+    let authHandler = this.config.authHandler = (
+      typeof cfg.authHandler === 'function' ? cfg.authHandler : undefined
+    );
 
-    algoList = cfg.algorithms.compress;
-    if (Array.isArray(algoList) && algoList.length > 0) {
-      algosSupported = ALGORITHMS.SUPPORTED_COMPRESS;
-      for (i = 0; i < algoList.length; ++i) {
-        if (algosSupported.indexOf(algoList[i]) === -1)
-          throw new Error('Unsupported compression algorithm: ' + algoList[i]);
-      }
-      algorithms.compress = algoList;
-    }
-  }
-  if (algorithms.compress === undefined) {
-    if (cfg.compress) {
-      algorithms.compress = ['zlib@openssh.com', 'zlib'];
-      if (cfg.compress !== 'force')
-        algorithms.compress.push('none');
-    } else if (cfg.compress === false)
-      algorithms.compress = ['none'];
-  }
+    this.config.strictVendor = (typeof cfg.strictVendor === 'boolean'
+                                ? cfg.strictVendor
+                                : true);
 
-  if (typeof cfg.username === 'string')
-    this.config.username = cfg.username;
-  else if (typeof cfg.user === 'string')
-    this.config.username = cfg.user;
-  else
-    throw new Error('Invalid username');
-
-  this.config.password = (typeof cfg.password === 'string'
-                          ? cfg.password
-                          : undefined);
-  this.config.privateKey = (typeof cfg.privateKey === 'string'
-                            || Buffer.isBuffer(cfg.privateKey)
-                            ? cfg.privateKey
-                            : undefined);
-  this.config.localHostname = (typeof cfg.localHostname === 'string'
-                               && cfg.localHostname.length
-                               ? cfg.localHostname
-                               : undefined);
-  this.config.localUsername = (typeof cfg.localUsername === 'string'
-                               && cfg.localUsername.length
-                               ? cfg.localUsername
-                               : undefined);
-  this.config.tryKeyboard = (cfg.tryKeyboard === true);
-  this.config.agent = (typeof cfg.agent === 'string' && cfg.agent.length
-                       ? cfg.agent
-                       : undefined);
-  this.config.allowAgentFwd = (cfg.agentForward === true
-                               && this.config.agent !== undefined);
-  var authHandler = this.config.authHandler = (
-    typeof cfg.authHandler === 'function' ? cfg.authHandler : undefined
-  );
-
-  this.config.strictVendor = (typeof cfg.strictVendor === 'boolean'
-                              ? cfg.strictVendor
-                              : true);
-
-  var debug = this.config.debug = (typeof cfg.debug === 'function'
-                                   ? cfg.debug
-                                   : DEBUG_NOOP);
-
-  if (cfg.agentForward === true && !this.config.allowAgentFwd)
-    throw new Error('You must set a valid agent path to allow agent forwarding');
-
-  var callbacks = this._callbacks = [];
-  this._channels = {};
-  this._forwarding = {};
-  this._forwardingUnix = {};
-  this._acceptX11 = 0;
-  this._agentFwdEnabled = false;
-  this._curChan = -1;
-  this._remoteVer = undefined;
-  var privateKey;
-
-  if (this.config.privateKey) {
-    privateKey = parseKey(this.config.privateKey, cfg.passphrase);
-    if (privateKey instanceof Error)
-      throw new Error('Cannot parse privateKey: ' + privateKey.message);
-    if (Array.isArray(privateKey))
-      privateKey = privateKey[0]; // OpenSSH's newer format only stores 1 key for now
-    if (privateKey.getPrivatePEM() === null)
-      throw new Error('privateKey value does not contain a (valid) private key');
-  }
+    const debug = this.config.debug = (typeof cfg.debug === 'function'
+                                       ? cfg.debug
+                                       : undefined);
 
-  var stream = this._sshstream = new SSH2Stream({
-    algorithms: algorithms,
-    debug: (debug === DEBUG_NOOP ? undefined : debug)
-  });
-  var sock = this._sock = (cfg.sock || new Socket());
-
-  // drain stderr if we are connection hopping using an exec stream
-  if (this._sock.stderr && typeof this._sock.stderr.resume === 'function')
-    this._sock.stderr.resume();
-
-  // keepalive-related
-  var kainterval = this.config.keepaliveInterval;
-  var kacountmax = this.config.keepaliveCountMax;
-  var kacount = 0;
-  var katimer;
-  function sendKA() {
-    if (++kacount > kacountmax) {
-      clearInterval(katimer);
-      if (sock.readable) {
-        var err = new Error('Keepalive timeout');
-        err.level = 'client-timeout';
-        self.emit('error', err);
-        sock.destroy();
-      }
-      return;
+    if (cfg.agentForward === true && !this.config.allowAgentFwd) {
+      throw new Error(
+        'You must set a valid agent path to allow agent forwarding'
+      );
     }
-    if (sock.writable) {
-      // append dummy callback to keep correct callback order
-      callbacks.push(resetKA);
-      stream.ping();
-    } else
-      clearInterval(katimer);
-  }
-  function resetKA() {
-    if (kainterval > 0) {
-      kacount = 0;
-      clearInterval(katimer);
-      if (sock.writable)
-        katimer = setInterval(sendKA, kainterval);
-    }
-  }
-  this._resetKA = resetKA;
 
-  stream.on('USERAUTH_BANNER', function(msg) {
-    self.emit('banner', msg);
-  });
+    let callbacks = this._callbacks = [];
+    this._chanMgr = new ChannelManager(this);
+    this._forwarding = {};
+    this._forwardingUnix = {};
+    this._acceptX11 = 0;
+    this._agentFwdEnabled = false;
+    this._remoteVer = undefined;
+    let privateKey;
+
+    if (this.config.privateKey) {
+      privateKey = parseKey(this.config.privateKey, cfg.passphrase);
+      if (privateKey instanceof Error)
+        throw new Error(`Cannot parse privateKey: ${privateKey.message}`);
+      if (Array.isArray(privateKey)) {
+        // OpenSSH's newer format only stores 1 key for now
+        privateKey = privateKey[0];
+      }
+      if (privateKey.getPrivatePEM() === null) {
+        throw new Error(
+          'privateKey value does not contain a (valid) private key'
+        );
+      }
+    }
 
-  sock.on('connect', function() {
-    debug('DEBUG: Client: Connected');
-    self.emit('connect');
-    if (!cfg.sock)
-      stream.pipe(sock).pipe(stream);
-  }).on('timeout', function() {
-    self.emit('timeout');
-  }).on('error', function(err) {
-    clearTimeout(self._readyTimeout);
-    err.level = 'client-socket';
-    self.emit('error', err);
-  }).on('end', function() {
-    stream.unpipe(sock);
-    clearTimeout(self._readyTimeout);
-    clearInterval(katimer);
-    self.emit('end');
-  }).on('close', function() {
-    stream.unpipe(sock);
-    clearTimeout(self._readyTimeout);
-    clearInterval(katimer);
-    self.emit('close');
-
-    // notify outstanding channel requests of disconnection ...
-    var callbacks_ = callbacks;
-    var err = new Error('No response from server');
-    callbacks = self._callbacks = [];
-    for (i = 0; i < callbacks_.length; ++i)
-      callbacks_[i](err);
-
-    // simulate error for any channels waiting to be opened. this is safe
-    // against successfully opened channels because the success and failure
-    // event handlers are automatically removed when a success/failure response
-    // is received
-    var channels = self._channels;
-    var chanNos = Object.keys(channels);
-    self._channels = {};
-    for (i = 0; i < chanNos.length; ++i) {
-      var ev1 = stream.emit('CHANNEL_OPEN_FAILURE:' + chanNos[i], err);
-      // emitting CHANNEL_CLOSE should be safe too and should help for any
-      // special channels which might otherwise keep the process alive, such
-      // as agent forwarding channels which have open unix sockets ...
-      var ev2 = stream.emit('CHANNEL_CLOSE:' + chanNos[i]);
-      var earlyCb;
-      if (!ev1 && !ev2 && (earlyCb = channels[chanNos[i]])
-          && typeof earlyCb === 'function') {
-        earlyCb(err);
+    let hostVerifier;
+    if (typeof cfg.hostVerifier === 'function') {
+      const hashCb = cfg.hostVerifier;
+      let hasher;
+      if (HASHES.indexOf(cfg.hostHash) !== -1) {
+        // Default to old behavior of hashing on user's behalf
+        hasher = createHash(cfg.hostHash);
       }
+      hostVerifier = (key, verify) => {
+        if (hasher) {
+          hasher.update(key);
+          key = hasher.digest('hex');
+        }
+        const ret = hashCb(key, verify);
+        if (ret !== undefined)
+          verify(ret);
+      };
     }
-  });
-  stream.on('drain', function() {
-    self.emit('drain');
-  }).once('header', function(header) {
-    self._remoteVer = header.versions.software;
-    if (header.greeting)
-      self.emit('greeting', header.greeting);
-  }).on('continue', function() {
-    self.emit('continue');
-  }).on('error', function(err) {
-    if (err.level === undefined)
-      err.level = 'protocol';
-    else if (err.level === 'handshake')
-      clearTimeout(self._readyTimeout);
-    self.emit('error', err);
-  }).on('end', function() {
-    sock.resume();
-  });
 
-  if (typeof cfg.hostVerifier === 'function') {
-    if (HASHES.indexOf(cfg.hostHash) === -1)
-      throw new Error('Invalid host hash algorithm: ' + cfg.hostHash);
-    var hashCb = cfg.hostVerifier;
-    var hasher = crypto.createHash(cfg.hostHash);
-    stream.once('fingerprint', function(key, verify) {
-      hasher.update(key);
-      var ret = hashCb(hasher.digest('hex'), verify);
-      if (ret !== undefined)
-        verify(ret);
+    const sock = this._sock = (cfg.sock || new Socket());
+    let ready = false;
+    if (this._protocol)
+      this._protocol.cleanup();
+    const DEBUG_HANDLER = (!debug ? undefined : (p, display, msg) => {
+      debug(`Debug output from server: ${JSON.stringify(msg)}`);
     });
-  }
+    const proto = this._protocol = new Protocol({
+      offer: (allOfferDefaults ? undefined : algorithms),
+      onWrite: (data) => {
+        if (sock.writable)
+          sock.write(data);
+      },
+      onError: (err) => {
+        if (err.level === 'handshake')
+          clearTimeout(this._readyTimeout);
+        if (!proto._destruct)
+          sock.removeAllListeners('data');
+        this.emit('error', err);
+        try {
+          sock.end();
+        } catch {}
+      },
+      onHeader: (header) => {
+        this._remoteVer = header.versions.software;
+        if (header.greeting)
+          this.emit('greeting', header.greeting);
+      },
+      onHandshakeComplete: (negotiated) => {
+        this.emit('handshake', negotiated);
+        if (!ready) {
+          ready = true;
+          proto.service('ssh-userauth');
+        }
+      },
+      debug,
+      hostVerifier,
+      messageHandlers: {
+        DEBUG: DEBUG_HANDLER,
+        DISCONNECT: (p, reason, desc) => {
+          if (reason !== DISCONNECT_REASON.BY_APPLICATION) {
+            if (!desc) {
+              desc = DISCONNECT_REASON_BY_VALUE[reason];
+              if (desc === undefined)
+                desc = `Unexpected disconnection reason: ${reason}`;
+            }
+            const err = new Error(desc);
+            err.code = reason;
+            this.emit('error', err);
+          }
+          sock.end();
+        },
+        SERVICE_ACCEPT: (p, name) => {
+          if (name === 'ssh-userauth')
+            tryNextAuth();
+        },
+        USERAUTH_BANNER: (p, msg) => {
+          this.emit('banner', msg);
+        },
+        USERAUTH_SUCCESS: (p) => {
+          // Start keepalive mechanism
+          resetKA();
+
+          clearTimeout(this._readyTimeout);
+
+          this.emit('ready');
+        },
+        USERAUTH_FAILURE: (p, authMethods, partialSuccess) => {
+          if (curAuth === 'agent') {
+            debug && debug(`Client: Agent key #${agentKeyPos + 1} failed`);
+            return tryNextAgentKey();
+          }
 
-  // begin authentication handling =============================================
-  var curAuth;
-  var curPartial = null;
-  var curAuthsLeft = null;
-  var agentKeys;
-  var agentKeyPos = 0;
-  var authsAllowed = ['none'];
-  if (this.config.password !== undefined)
-    authsAllowed.push('password');
-  if (privateKey !== undefined)
-    authsAllowed.push('publickey');
-  if (this.config.agent !== undefined)
-    authsAllowed.push('agent');
-  if (this.config.tryKeyboard)
-    authsAllowed.push('keyboard-interactive');
-  if (privateKey !== undefined
-      && this.config.localHostname !== undefined
-      && this.config.localUsername !== undefined) {
-    authsAllowed.push('hostbased');
-  }
+          debug && debug(`Client: ${curAuth} auth failed`);
+
+          curPartial = partialSuccess;
+          curAuthsLeft = authMethods;
+          tryNextAuth();
+        },
+        USERAUTH_PK_OK: (p) => {
+          if (curAuth === 'agent') {
+            const agentKey = agentKeys[agentKeyPos];
+            const keyLen = readUInt32BE(agentKey, 0);
+            const pubKeyFullType = agentKey.utf8Slice(4, 4 + keyLen);
+            const pubKeyType = pubKeyFullType.slice(4);
+            // Check that we support the key type first
+            // TODO: move key type checking logic to protocol implementation
+            switch (pubKeyFullType) {
+              case 'ssh-rsa':
+              case 'ssh-dss':
+              case 'ecdsa-sha2-nistp256':
+              case 'ecdsa-sha2-nistp384':
+              case 'ecdsa-sha2-nistp521':
+                break;
+              case 'ssh-ed25519':
+                if (EDDSA_SUPPORTED)
+                  break;
+              // FALLTHROUGH
+              default:
+                debug && debug(
+                  `Agent: Skipping unsupported key type: ${pubKeyFullType}`
+                );
+                return tryNextAgentKey();
+            }
+            proto.authPK(this.config.username, agentKey, (buf, cb) => {
+              agentQuery(this.config.agent,
+                         agentKey,
+                         pubKeyType,
+                         buf,
+                         (err, signed) => {
+                if (err) {
+                  err.level = 'agent';
+                  this.emit('error', err);
+                } else {
+                  const sigFullTypeLen = readUInt32BE(signed, 0);
+                  if (4 + sigFullTypeLen + 4 < signed.length) {
+                    const sigFullType = signed.utf8Slice(4, 4 + sigFullTypeLen);
+                    if (sigFullType !== pubKeyFullType) {
+                      err = new Error('Agent key/signature type mismatch');
+                      err.level = 'agent';
+                      this.emit('error', err);
+                    } else {
+                      // Skip algoLen + algo + sigLen
+                      return cb(signed.slice(4 + sigFullTypeLen + 4));
+                    }
+                  }
+                }
+
+                tryNextAgentKey();
+              });
+            });
+          } else if (curAuth === 'publickey') {
+            proto.authPK(this.config.username, privateKey, (buf, cb) => {
+              const signature = privateKey.sign(buf);
+              if (signature instanceof Error) {
+                signature.message =
+                  `Error signing data with privateKey: ${signature.message}`;
+                signature.level = 'client-authentication';
+                this.emit('error', signature);
+                return tryNextAuth();
+              }
+              cb(signature);
+            });
+          }
+        },
+        USERAUTH_INFO_REQUEST: (p, name, instructions, prompts) => {
+          const nprompts = (Array.isArray(prompts) ? prompts.length : 0);
+          if (nprompts === 0) {
+            debug && debug('Client: Sending automatic USERAUTH_INFO_RESPONSE');
+            proto.authInfoRes();
+            return;
+          }
+          // We sent a keyboard-interactive user authentication request and now
+          // the server is sending us the prompts we need to present to the user
+          this.emit('keyboard-interactive',
+                    name,
+                    instructions,
+                    '',
+                    prompts,
+                    (answers) => {
+                      proto.authInfoRes(answers);
+                    }
+          );
+        },
+        REQUEST_SUCCESS: (p, data) => {
+          if (callbacks.length)
+            callbacks.shift()(false, data);
+        },
+        REQUEST_FAILURE: (p) => {
+          if (callbacks.length)
+            callbacks.shift()(true);
+        },
+        GLOBAL_REQUEST: (name, wantReply, data) => {
+          // Auto-reject all global requests, this can be especially useful if
+          // the server is sending us dummy keepalive global requests
+          if (wantReply)
+            proto.requestFailure();
+        },
+        CHANNEL_OPEN: (p, info) => {
+          // Handle incoming requests from server, typically a forwarded TCP or
+          // X11 connection
+          onCHANNEL_OPEN(this, info);
+        },
+        CHANNEL_OPEN_CONFIRMATION: (p, info) => {
+          const channel = this._chanMgr.get(info.recipient);
+          if (typeof channel !== 'function')
+            return;
+
+          const isSFTP = (channel.type === 'sftp');
+          const type = (isSFTP ? 'session' : channel.type);
+          const chanInfo = {
+            type,
+            incoming: {
+              id: info.recipient,
+              window: MAX_WINDOW,
+              packetSize: PACKET_SIZE,
+              state: 'open'
+            },
+            outgoing: {
+              id: info.sender,
+              window: info.window,
+              packetSize: info.packetSize,
+              state: 'open'
+            }
+          };
+          const instance = (
+            isSFTP
+            ? new SFTP(this, chanInfo, { debug })
+            : new Channel(this, chanInfo)
+          );
+          this._chanMgr.update(info.recipient, instance);
+          channel(undefined, instance);
+        },
+        CHANNEL_OPEN_FAILURE: (p, recipient, reason, description) => {
+          const channel = this._chanMgr.get(recipient);
+          if (typeof channel !== 'function')
+            return;
+
+          const info = { reason, description };
+          onChannelOpenFailure(this, recipient, info, channel);
+        },
+        CHANNEL_DATA: (p, recipient, data) => {
+          const channel = this._chanMgr.get(recipient);
+          if (typeof channel !== 'object' || channel === null)
+            return;
+
+          // The remote party should not be sending us data if there is no
+          // window space available ...
+          // TODO: raise error on data with not enough window?
+          if (channel.incoming.window === 0)
+            return;
+
+          channel.incoming.window -= data.length;
+
+          if (channel.push(data) === false) {
+            channel._waitChanDrain = true;
+            return;
+          }
 
-  if (authHandler === undefined) {
-    var authPos = 0;
-    authHandler = function authHandler(authsLeft, partial, cb) {
-      if (authPos === authsAllowed.length)
-        return false;
-      return authsAllowed[authPos++];
-    };
-  }
+          if (channel.incoming.window <= WINDOW_THRESHOLD)
+            windowAdjust(channel);
+        },
+        CHANNEL_EXTENDED_DATA: (p, recipient, data, type) => {
+          if (type !== STDERR)
+            return;
 
-  var hasSentAuth = false;
-  function doNextAuth(authName) {
-    hasSentAuth = true;
-    if (authName === false) {
-      stream.removeListener('USERAUTH_FAILURE', onUSERAUTH_FAILURE);
-      stream.removeListener('USERAUTH_PK_OK', onUSERAUTH_PK_OK);
-      var err = new Error('All configured authentication methods failed');
-      err.level = 'client-authentication';
-      self.emit('error', err);
-      if (stream.writable)
-        self.end();
-      return;
-    }
-    if (authsAllowed.indexOf(authName) === -1)
-      throw new Error('Authentication method not allowed: ' + authName);
-    curAuth = authName;
-    switch (curAuth) {
-      case 'password':
-        stream.authPassword(self.config.username, self.config.password);
-      break;
-      case 'publickey':
-        stream.authPK(self.config.username, privateKey);
-        stream.once('USERAUTH_PK_OK', onUSERAUTH_PK_OK);
-      break;
-      case 'hostbased':
-        function hostbasedCb(buf, cb) {
-          var signature = privateKey.sign(buf);
-          if (signature instanceof Error) {
-            signature.message = 'Error while signing data with privateKey: '
-                                + signature.message;
-            signature.level = 'client-authentication';
-            self.emit('error', signature);
-            return tryNextAuth();
+          const channel = this._chanMgr.get(recipient);
+          if (typeof channel !== 'object' || channel === null)
+            return;
+
+          // The remote party should not be sending us data if there is no
+          // window space available ...
+          // TODO: raise error on data with not enough window?
+          if (channel.incoming.window === 0)
+            return;
+
+          channel.incoming.window -= data.length;
+
+          if (!channel.stderr.push(data)) {
+            channel._waitChanDrain = true;
+            return;
           }
 
-          cb(signature);
-        }
-        stream.authHostbased(self.config.username,
-                             privateKey,
-                             self.config.localHostname,
-                             self.config.localUsername,
-                             hostbasedCb);
-      break;
-      case 'agent':
-        agentQuery(self.config.agent, function(err, keys) {
-          if (err) {
-            err.level = 'agent';
-            self.emit('error', err);
-            agentKeys = undefined;
-            return tryNextAuth();
-          } else if (keys.length === 0) {
-            debug('DEBUG: Agent: No keys stored in agent');
-            agentKeys = undefined;
-            return tryNextAuth();
+          if (channel.incoming.window <= WINDOW_THRESHOLD)
+            windowAdjust(channel);
+        },
+        CHANNEL_WINDOW_ADJUST: (p, recipient, amount) => {
+          const channel = this._chanMgr.get(recipient);
+          if (typeof channel !== 'object' || channel === null)
+            return;
+
+          // The other side is allowing us to send `amount` more bytes of data
+          channel.outgoing.window += amount;
+
+          if (channel._waitWindow) {
+            channel._waitWindow = false;
+
+            if (channel._chunk) {
+              channel._write(channel._chunk, null, channel._chunkcb);
+            } else if (channel._chunkcb) {
+              channel._chunkcb();
+            } else if (channel._chunkErr) {
+              channel.stderr._write(channel._chunkErr,
+                                    null,
+                                    channel._chunkcbErr);
+            } else if (channel._chunkcbErr) {
+              channel._chunkcbErr();
+            }
+          }
+        },
+        CHANNEL_SUCCESS: (p, recipient) => {
+          const channel = this._chanMgr.get(recipient);
+          if (typeof channel !== 'object' || channel === null)
+            return;
+
+          this._resetKA();
+
+          if (channel._callbacks.length)
+            channel._callbacks.shift()(false);
+        },
+        CHANNEL_FAILURE: (p, recipient) => {
+          const channel = this._chanMgr.get(recipient);
+          if (typeof channel !== 'object' || channel === null)
+            return;
+
+          this._resetKA();
+
+          if (channel._callbacks.length)
+            channel._callbacks.shift()(true);
+        },
+        CHANNEL_REQUEST: (p, recipient, type, wantReply, data) => {
+          const channel = this._chanMgr.get(recipient);
+          if (typeof channel !== 'object' || channel === null)
+            return;
+
+          const exit = channel._exit;
+          if (exit.code !== undefined)
+            return;
+          switch (type) {
+            case 'exit-status':
+              channel.emit('exit', exit.code = data);
+              return;
+            case 'exit-signal':
+              channel.emit('exit',
+                           exit.code = null,
+                           exit.signal = `SIG${data.signal}`,
+                           exit.dump = data.coreDumped,
+                           exit.desc = data.errorMessage);
+              return;
           }
 
-          agentKeys = keys;
-          agentKeyPos = 0;
+          // Keepalive request? OpenSSH will send one as a channel request if
+          // there is a channel open
+
+          if (wantReply)
+            p.channelFailure(channel.outgoing.id);
+        },
+        CHANNEL_EOF: (p, recipient) => {
+          const channel = this._chanMgr.get(recipient);
+          if (typeof channel !== 'object' || channel === null)
+            return;
+
+          if (channel.incoming.state !== 'open')
+            return;
+          channel.incoming.state = 'eof';
+
+          if (channel.readable)
+            channel.push(null);
+          if (channel.stderr.readable)
+            channel.stderr.push(null);
+        },
+        CHANNEL_CLOSE: (p, recipient) => {
+          onCHANNEL_CLOSE(this, recipient, this._chanMgr.get(recipient));
+        },
+      },
+    });
+
+    sock.on('data', (data) => {
+      // TODO: wrap in try-catch and emit caught error(s)
+      proto.parse(data, 0, data.length);
+    });
 
-          stream.authPK(self.config.username, keys[0]);
-          stream.once('USERAUTH_PK_OK', onUSERAUTH_PK_OK);
-        });
-      break;
-      case 'keyboard-interactive':
-        stream.authKeyboard(self.config.username);
-        stream.on('USERAUTH_INFO_REQUEST', onUSERAUTH_INFO_REQUEST);
-      break;
-      case 'none':
-        stream.authNone(self.config.username);
-      break;
-    }
-  }
-  function tryNextAuth() {
-    hasSentAuth = false;
-    var auth = authHandler(curAuthsLeft, curPartial, doNextAuth);
-    if (hasSentAuth || auth === undefined)
-      return;
-    doNextAuth(auth);
-  }
-  function tryNextAgentKey() {
-    if (curAuth === 'agent') {
-      if (agentKeyPos >= agentKeys.length)
+    // Drain stderr if we are connection hopping using an exec stream
+    if (sock.stderr && typeof sock.stderr.resume === 'function')
+      sock.stderr.resume();
+
+    // TODO: check keepalive implementation
+    // Keepalive-related
+    const kainterval = this.config.keepaliveInterval;
+    const kacountmax = this.config.keepaliveCountMax;
+    let kacount = 0;
+    let katimer;
+    const sendKA = () => {
+      if (++kacount > kacountmax) {
+        clearInterval(katimer);
+        if (sock.readable) {
+          const err = new Error('Keepalive timeout');
+          err.level = 'client-timeout';
+          this.emit('error', err);
+          sock.destroy();
+        }
         return;
-      if (++agentKeyPos >= agentKeys.length) {
-        debug('DEBUG: Agent: No more keys left to try');
-        debug('DEBUG: Client: agent auth failed');
-        agentKeys = undefined;
-        tryNextAuth();
+      }
+      if (sock.writable) {
+        // Append dummy callback to keep correct callback order
+        callbacks.push(resetKA);
+        proto.ping();
       } else {
-        debug('DEBUG: Agent: Trying key #' + (agentKeyPos + 1));
-        stream.authPK(self.config.username, agentKeys[agentKeyPos]);
-        stream.once('USERAUTH_PK_OK', onUSERAUTH_PK_OK);
+        clearInterval(katimer);
       }
-    }
-  }
-  function onUSERAUTH_INFO_REQUEST(name, instructions, lang, prompts) {
-    var nprompts = (Array.isArray(prompts) ? prompts.length : 0);
-    if (nprompts === 0) {
-      debug('DEBUG: Client: Sending automatic USERAUTH_INFO_RESPONSE');
-      return stream.authInfoRes();
-    }
-    // we sent a keyboard-interactive user authentication request and now the
-    // server is sending us the prompts we need to present to the user
-    self.emit('keyboard-interactive',
-              name,
-              instructions,
-              lang,
-              prompts,
-              function(answers) {
-                stream.authInfoRes(answers);
-              }
-    );
-  }
-  function onUSERAUTH_PK_OK() {
-    if (curAuth === 'agent') {
-      var agentKey = agentKeys[agentKeyPos];
-      var keyLen = readUInt32BE(agentKey, 0);
-      var pubKeyFullType = agentKey.toString('ascii', 4, 4 + keyLen);
-      var pubKeyType = pubKeyFullType.slice(4);
-      // Check that we support the key type first
-      // TODO: move key type checking logic to ssh2-streams
-      switch (pubKeyFullType) {
-        case 'ssh-rsa':
-        case 'ssh-dss':
-        case 'ecdsa-sha2-nistp256':
-        case 'ecdsa-sha2-nistp384':
-        case 'ecdsa-sha2-nistp521':
-          break;
-        default:
-          if (EDDSA_SUPPORTED && pubKeyFullType === 'ssh-ed25519')
-            break;
-          debug('DEBUG: Agent: Skipping unsupported key type: '
-                + pubKeyFullType);
-          return tryNextAgentKey();
+    };
+    function resetKA() {
+      if (kainterval > 0) {
+        kacount = 0;
+        clearInterval(katimer);
+        if (sock.writable)
+          katimer = setInterval(sendKA, kainterval);
       }
-      stream.authPK(self.config.username, 
-                    agentKey,
-                    function(buf, cb) {
-        agentQuery(self.config.agent,
-                   agentKey,
-                   pubKeyType,
-                   buf,
-                   function(err, signed) {
-          if (err) {
-            err.level = 'agent';
-            self.emit('error', err);
-          } else {
-            var sigFullTypeLen = readUInt32BE(signed, 0);
-            if (4 + sigFullTypeLen + 4 < signed.length) {
-              var sigFullType = signed.toString('ascii', 4, 4 + sigFullTypeLen);
-              if (sigFullType !== pubKeyFullType) {
-                err = new Error('Agent key/signature type mismatch');
-                err.level = 'agent';
-                self.emit('error', err);
-              } else {
-                // skip algoLen + algo + sigLen
-                return cb(signed.slice(4 + sigFullTypeLen + 4));
-              }
-            }
-          }
-
-          tryNextAgentKey();
-        });
-      });
-    } else if (curAuth === 'publickey') {
-      stream.authPK(self.config.username, privateKey, function(buf, cb) {
-        var signature = privateKey.sign(buf);
-        if (signature instanceof Error) {
-          signature.message = 'Error while signing data with privateKey: '
-                              + signature.message;
-          signature.level = 'client-authentication';
-          self.emit('error', signature);
-          return tryNextAuth();
-        }
-        cb(signature);
-      });
     }
-  }
-  function onUSERAUTH_FAILURE(authsLeft, partial) {
-    stream.removeListener('USERAUTH_PK_OK', onUSERAUTH_PK_OK);
-    stream.removeListener('USERAUTH_INFO_REQUEST', onUSERAUTH_INFO_REQUEST);
-    if (curAuth === 'agent') {
-      debug('DEBUG: Client: Agent key #' + (agentKeyPos + 1) + ' failed');
-      return tryNextAgentKey();
-    } else {
-      debug('DEBUG: Client: ' + curAuth + ' auth failed');
-    }
-
-    curPartial = partial;
-    curAuthsLeft = authsLeft;
-    tryNextAuth();
-  }
-  stream.once('USERAUTH_SUCCESS', function() {
-    stream.removeListener('USERAUTH_FAILURE', onUSERAUTH_FAILURE);
-    stream.removeListener('USERAUTH_INFO_REQUEST', onUSERAUTH_INFO_REQUEST);
-
-    // start keepalive mechanism
-    resetKA();
-
-    clearTimeout(self._readyTimeout);
+    this._resetKA = resetKA;
+
+    sock.on('connect', () => {
+      debug && debug('Socket connected');
+      this.emit('connect');
+    }).on('timeout', () => {
+      this.emit('timeout');
+    }).on('error', (err) => {
+      debug && debug(`Socket error: ${err.message}`);
+      clearTimeout(this._readyTimeout);
+      err.level = 'client-socket';
+      this.emit('error', err);
+    }).on('end', () => {
+      debug && debug('Socket ended');
+      proto.cleanup();
+      clearTimeout(this._readyTimeout);
+      clearInterval(katimer);
+      this.emit('end');
+    }).on('close', () => {
+      debug && debug('Socket closed');
+      proto.cleanup();
+      clearTimeout(this._readyTimeout);
+      clearInterval(katimer);
+      this.emit('close');
 
-    self.emit('ready');
-  }).on('USERAUTH_FAILURE', onUSERAUTH_FAILURE);
-  // end authentication handling ===============================================
+      // Notify outstanding channel requests of disconnection ...
+      const callbacks_ = callbacks;
+      callbacks = this._callbacks = [];
+      const err = new Error('No response from server');
+      for (let i = 0; i < callbacks_.length; ++i)
+        callbacks_[i](err);
 
-  // handle initial handshake completion
-  stream.once('ready', function() {
-    stream.service('ssh-userauth');
-    stream.once('SERVICE_ACCEPT', function(svcName) {
-      if (svcName === 'ssh-userauth')
-        tryNextAuth();
+      // Simulate error for any channels waiting to be opened
+      this._chanMgr.cleanup(err);
     });
-  });
 
-  // handle incoming requests from server, typically a forwarded TCP or X11
-  // connection
-  stream.on('CHANNEL_OPEN', function(info) {
-    onCHANNEL_OPEN(self, info);
-  });
+    // Begin authentication handling ===========================================
+    let curAuth;
+    let curPartial = null;
+    let curAuthsLeft = null;
+    let agentKeys;
+    let agentKeyPos = 0;
+    const authsAllowed = ['none'];
+    if (this.config.password !== undefined)
+      authsAllowed.push('password');
+    if (privateKey !== undefined)
+      authsAllowed.push('publickey');
+    if (this.config.agent !== undefined)
+      authsAllowed.push('agent');
+    if (this.config.tryKeyboard)
+      authsAllowed.push('keyboard-interactive');
+    if (privateKey !== undefined
+        && this.config.localHostname !== undefined
+        && this.config.localUsername !== undefined) {
+      authsAllowed.push('hostbased');
+    }
 
-  // handle responses for tcpip-forward and other global requests
-  stream.on('REQUEST_SUCCESS', function(data) {
-    if (callbacks.length)
-      callbacks.shift()(false, data);
-  }).on('REQUEST_FAILURE', function() {
-    if (callbacks.length)
-      callbacks.shift()(true);
-  });
+    if (authHandler === undefined) {
+      let authPos = 0;
+      authHandler = (authsLeft, partial, cb) => {
+        if (authPos === authsAllowed.length)
+          return false;
+        return authsAllowed[authPos++];
+      };
+    }
 
-  stream.on('GLOBAL_REQUEST', function(name, wantReply, data) {
-    // auto-reject all global requests, this can be especially useful if the
-    // server is sending us dummy keepalive global requests
-    if (wantReply)
-      stream.requestFailure();
-  });
+    let hasSentAuth = false;
+    const doNextAuth = (authName) => {
+      hasSentAuth = true;
+      if (authName === false) {
+        const err = new Error('All configured authentication methods failed');
+        err.level = 'client-authentication';
+        this.emit('error', err);
+        this.end();
+        return;
+      }
+      if (authsAllowed.indexOf(authName) === -1)
+        throw new Error(`Authentication method not allowed: ${authName}`);
+      curAuth = authName;
+      switch (curAuth) {
+        case 'password':
+          proto.authPassword(this.config.username, this.config.password);
+          break;
+        case 'publickey':
+          proto.authPK(this.config.username, privateKey);
+          break;
+        case 'hostbased':
+          function hostbasedCb(buf, cb) {
+            const signature = privateKey.sign(buf);
+            if (signature instanceof Error) {
+              signature.message =
+                `Error while signing with privateKey: ${signature.message}`;
+              signature.level = 'client-authentication';
+              this.emit('error', signature);
+              return tryNextAuth();
+            }
 
-  if (!cfg.sock) {
-    var host = this.config.host;
-    var forceIPv4 = this.config.forceIPv4;
-    var forceIPv6 = this.config.forceIPv6;
+            cb(signature);
+          }
+          proto.authHostbased(this.config.username,
+                              privateKey,
+                              this.config.localHostname,
+                              this.config.localUsername,
+                              hostbasedCb);
+          break;
+        case 'agent':
+          agentQuery(this.config.agent, (err, keys) => {
+            if (err) {
+              err.level = 'agent';
+              this.emit('error', err);
+              agentKeys = undefined;
+              return tryNextAuth();
+            } else if (keys.length === 0) {
+              debug && debug('Agent: No keys stored in agent');
+              agentKeys = undefined;
+              return tryNextAuth();
+            }
 
-    debug('DEBUG: Client: Trying '
-          + host
-          + ' on port '
-          + this.config.port
-          + ' ...');
+            agentKeys = keys;
+            agentKeyPos = 0;
 
-    function doConnect() {
-      startTimeout();
-      self._sock.connect({
-        host: host,
-        port: self.config.port,
-        localAddress: self.config.localAddress,
-        localPort: self.config.localPort
-      });
-      self._sock.setNoDelay(true);
-      self._sock.setMaxListeners(0);
-      self._sock.setTimeout(typeof cfg.timeout === 'number' ? cfg.timeout : 0);
+            proto.authPK(this.config.username, keys[0]);
+          });
+          break;
+        case 'keyboard-interactive':
+          proto.authKeyboard(this.config.username);
+          break;
+        case 'none':
+          proto.authNone(this.config.username);
+          break;
+      }
+    };
+    function tryNextAuth() {
+      hasSentAuth = false;
+      const auth = authHandler(curAuthsLeft, curPartial, doNextAuth);
+      if (hasSentAuth || auth === undefined)
+        return;
+      doNextAuth(auth);
     }
-
-    if ((!forceIPv4 && !forceIPv6) || (forceIPv4 && forceIPv6))
-      doConnect();
-    else {
-      dnsLookup(host, (forceIPv4 ? 4 : 6), function(err, address, family) {
-        if (err) {
-          var error = new Error('Error while looking up '
-                                + (forceIPv4 ? 'IPv4' : 'IPv6')
-                                + ' address for host '
-                                + host
-                                + ': ' + err);
-          clearTimeout(self._readyTimeout);
-          error.level = 'client-dns';
-          self.emit('error', error);
-          self.emit('close');
+    const tryNextAgentKey = () => {
+      if (curAuth === 'agent') {
+        if (agentKeyPos >= agentKeys.length)
           return;
+        if (++agentKeyPos >= agentKeys.length) {
+          debug && debug('Agent: No more keys left to try');
+          debug && debug('Client: agent auth failed');
+          agentKeys = undefined;
+          tryNextAuth();
+        } else {
+          debug && debug(`Agent: Trying key #${agentKeyPos + 1}`);
+          proto.authPK(this.config.username, agentKeys[agentKeyPos]);
         }
-        host = address;
+      }
+    };
+
+    const startTimeout = () => {
+      if (this.config.readyTimeout > 0) {
+        this._readyTimeout = setTimeout(() => {
+          const err = new Error('Timed out while waiting for handshake');
+          err.level = 'client-timeout';
+          this.emit('error', err);
+          sock.destroy();
+        }, this.config.readyTimeout);
+      }
+    };
+
+    if (!cfg.sock) {
+      let host = this.config.host;
+      const forceIPv4 = this.config.forceIPv4;
+      const forceIPv6 = this.config.forceIPv6;
+
+      debug && debug(`Client: Trying ${host} on port ${this.config.port} ...`);
+
+      const doConnect = () => {
+        startTimeout();
+        sock.connect({
+          host,
+          port: this.config.port,
+          localAddress: this.config.localAddress,
+          localPort: this.config.localPort
+        });
+        sock.setNoDelay(true);
+        sock.setMaxListeners(0);
+        sock.setTimeout(typeof cfg.timeout === 'number' ? cfg.timeout : 0);
+      };
+
+      if ((!forceIPv4 && !forceIPv6) || (forceIPv4 && forceIPv6)) {
         doConnect();
-      });
+      } else {
+        dnsLookup(host, (forceIPv4 ? 4 : 6), (err, address, family) => {
+          if (err) {
+            const type = (forceIPv4 ? 'IPv4' : 'IPv6');
+            const error = new Error(
+              `Error while looking up ${type} address for '${host}': ${err}`
+            );
+            clearTimeout(this._readyTimeout);
+            error.level = 'client-dns';
+            this.emit('error', error);
+            this.emit('close');
+            return;
+          }
+          host = address;
+          doConnect();
+        });
+      }
+    } else {
+      // Custom socket passed in
+      startTimeout();
     }
-  } else {
-    startTimeout();
-    stream.pipe(sock).pipe(stream);
+
+    return this;
   }
 
-  function startTimeout() {
-    if (self.config.readyTimeout > 0) {
-      self._readyTimeout = setTimeout(function() {
-        var err = new Error('Timed out while waiting for handshake');
-        err.level = 'client-timeout';
-        self.emit('error', err);
-        sock.destroy();
-      }, self.config.readyTimeout);
+  end() {
+    if (this._sock && this._sock.writable) {
+      this._protocol.disconnect(DISCONNECT_REASON.BY_APPLICATION);
+      this._sock.end();
     }
+    return this;
   }
-};
-
-Client.prototype.end = function() {
-  if (this._sock
-      && this._sock.writable
-      && this._sshstream
-      && this._sshstream.writable)
-    return this._sshstream.disconnect();
-  return false;
-};
-
-Client.prototype.destroy = function() {
-  this._sock && this._sock.destroy();
-};
-
-Client.prototype.exec = function(cmd, opts, cb) {
-  if (!this._sock
-      || !this._sock.writable
-      || !this._sshstream
-      || !this._sshstream.writable)
-    throw new Error('Not connected');
 
-  if (typeof opts === 'function') {
-    cb = opts;
-    opts = {};
+  destroy() {
+    this._sock && this._sock.writable && this._sock.destroy();
+    return this;
   }
 
-  var self = this;
-  var extraOpts = { allowHalfOpen: (opts.allowHalfOpen !== false) };
+  exec(cmd, opts, cb) {
+    if (!this._sock || !this._sock.writable)
+      throw new Error('Not connected');
 
-  return openChannel(this, 'session', extraOpts, function(err, chan) {
-    if (err)
-      return cb(err);
+    if (typeof opts === 'function') {
+      cb = opts;
+      opts = {};
+    }
 
-    var todo = [];
+    const extraOpts = { allowHalfOpen: (opts.allowHalfOpen !== false) };
 
-    function reqCb(err) {
+    openChannel(this, 'session', extraOpts, (err, chan) => {
       if (err) {
-        chan.close();
-        return cb(err);
+        cb(err);
+        return;
       }
-      if (todo.length)
-        todo.shift()();
-    }
 
-    if (self.config.allowAgentFwd === true
-        || (opts
-            && opts.agentForward === true
-            && self.config.agent !== undefined)) {
-      todo.push(function() {
-        reqAgentFwd(chan, reqCb);
-      });
-    }
+      const todo = [];
 
-    if (typeof opts === 'object' && opts !== null) {
-      if (typeof opts.env === 'object' && opts.env !== null)
-        reqEnv(chan, opts.env);
-      if ((typeof opts.pty === 'object' && opts.pty !== null)
-          || opts.pty === true) {
-        todo.push(function() { reqPty(chan, opts.pty, reqCb); });
+      function reqCb(err) {
+        if (err) {
+          chan.close();
+          cb(err);
+          return;
+        }
+        if (todo.length)
+          todo.shift()();
       }
-      if ((typeof opts.x11 === 'object' && opts.x11 !== null)
-          || opts.x11 === 'number'
-          || opts.x11 === true) {
-        todo.push(function() { reqX11(chan, opts.x11, reqCb); });
+
+      if (this.config.allowAgentFwd === true
+          || (opts
+              && opts.agentForward === true
+              && this.config.agent !== undefined)) {
+        todo.push(() => reqAgentFwd(chan, reqCb));
       }
-    }
 
-    todo.push(function() { reqExec(chan, cmd, opts, cb); });
-    todo.shift()();
-  });
-};
-
-Client.prototype.shell = function(wndopts, opts, cb) {
-  if (!this._sock
-      || !this._sock.writable
-      || !this._sshstream
-      || !this._sshstream.writable)
-    throw new Error('Not connected');
-
-  // start an interactive terminal/shell session
-  var self = this;
-
-  if (typeof wndopts === 'function') {
-    cb = wndopts;
-    wndopts = opts = undefined;
-  } else if (typeof opts === 'function') {
-    cb = opts;
-    opts = undefined;
-  }
-  if (wndopts && (wndopts.x11 !== undefined || wndopts.env !== undefined)) {
-    opts = wndopts;
-    wndopts = undefined;
-  }
+      if (typeof opts === 'object' && opts !== null) {
+        if (typeof opts.env === 'object' && opts.env !== null)
+          reqEnv(chan, opts.env);
+        if ((typeof opts.pty === 'object' && opts.pty !== null)
+            || opts.pty === true) {
+          todo.push(() => reqPty(chan, opts.pty, reqCb));
+        }
+        if ((typeof opts.x11 === 'object' && opts.x11 !== null)
+            || opts.x11 === 'number'
+            || opts.x11 === true) {
+          todo.push(() => reqX11(chan, opts.x11, reqCb));
+        }
+      }
 
-  return openChannel(this, 'session', function(err, chan) {
-    if (err)
-      return cb(err);
+      todo.push(() => reqExec(chan, cmd, opts, cb));
+      todo.shift()();
+    });
 
-    var todo = [];
+    return this;
+  }
 
-    function reqCb(err) {
-      if (err) {
-        chan.close();
-        return cb(err);
-      }
-      if (todo.length)
-        todo.shift()();
-    }
+  shell(wndopts, opts, cb) {
+    if (!this._sock || !this._sock.writable)
+      throw new Error('Not connected');
 
-    if (self.config.allowAgentFwd === true
-        || (opts
-            && opts.agentForward === true
-            && self.config.agent !== undefined)) {
-      todo.push(function() { reqAgentFwd(chan, reqCb); });
+    if (typeof wndopts === 'function') {
+      cb = wndopts;
+      wndopts = opts = undefined;
+    } else if (typeof opts === 'function') {
+      cb = opts;
+      opts = undefined;
     }
-
-    if (wndopts !== false)
-      todo.push(function() { reqPty(chan, wndopts, reqCb); });
-
-    if (typeof opts === 'object' && opts !== null) {
-      if (typeof opts.env === 'object' && opts.env !== null)
-        reqEnv(chan, opts.env);
-      if ((typeof opts.x11 === 'object' && opts.x11 !== null)
-          || opts.x11 === 'number'
-          || opts.x11 === true) {
-        todo.push(function() { reqX11(chan, opts.x11, reqCb); });
-      }
+    if (wndopts && (wndopts.x11 !== undefined || wndopts.env !== undefined)) {
+      opts = wndopts;
+      wndopts = undefined;
     }
 
-    todo.push(function() { reqShell(chan, cb); });
-    todo.shift()();
-  });
-};
-
-Client.prototype.subsys = function(name, cb) {
-  if (!this._sock
-      || !this._sock.writable
-      || !this._sshstream
-      || !this._sshstream.writable)
-    throw new Error('Not connected');
-
-	return openChannel(this, 'session', function(err, chan) {
-		if (err)
-			return cb(err);
-
-		reqSubsystem(chan, name, function(err, stream) {
-			if (err)
-				return cb(err);
-
-			cb(undefined, stream);
-		});
-	});
-};
-
-Client.prototype.sftp = function(cb) {
-  if (!this._sock
-      || !this._sock.writable
-      || !this._sshstream
-      || !this._sshstream.writable)
-    throw new Error('Not connected');
-
-  var self = this;
-
-  // start an SFTP session
-  return openChannel(this, 'session', function(err, chan) {
-    if (err)
-      return cb(err);
-
-    reqSubsystem(chan, 'sftp', function(err, stream) {
-      if (err)
-        return cb(err);
-
-      var serverIdentRaw = self._sshstream._state.incoming.identRaw;
-      var cfg = { debug: self.config.debug };
-      var sftp = new SFTPStream(cfg, serverIdentRaw);
-
-      function onError(err) {
-        sftp.removeListener('ready', onReady);
-        stream.removeListener('exit', onExit);
+    openChannel(this, 'session', (err, chan) => {
+      if (err) {
         cb(err);
+        return;
       }
 
-      function onReady() {
-        sftp.removeListener('error', onError);
-        stream.removeListener('exit', onExit);
-        cb(undefined, new SFTPWrapper(sftp));
-      }
+      const todo = [];
 
-      function onExit(code, signal) {
-        sftp.removeListener('ready', onReady);
-        sftp.removeListener('error', onError);
-        var msg;
-        if (typeof code === 'number') {
-          msg = 'Received exit code '
-                + code
-                + ' while establishing SFTP session';
-        } else {
-          msg = 'Received signal '
-                + signal
-                + ' while establishing SFTP session';
+      function reqCb(err) {
+        if (err) {
+          chan.close();
+          cb(err);
+          return;
         }
-        var err = new Error(msg);
-        err.code = code;
-        err.signal = signal;
-        cb(err);
+        if (todo.length)
+          todo.shift()();
       }
 
-      sftp.once('error', onError)
-          .once('ready', onReady)
-          .once('close', function() {
-            stream.end();
-          });
-
-      // OpenSSH server sends an exit-status if there was a problem spinning up
-      // an sftp server child process, so we listen for that here in order to
-      // properly raise an error.
-      stream.once('exit', onExit);
+      if (this.config.allowAgentFwd === true
+          || (opts
+              && opts.agentForward === true
+              && this.config.agent !== undefined)) {
+        todo.push(() => reqAgentFwd(chan, reqCb));
+      }
 
-      sftp.pipe(stream).pipe(sftp);
-    });
-  });
-};
+      if (wndopts !== false)
+        todo.push(() => reqPty(chan, wndopts, reqCb));
 
-Client.prototype.forwardIn = function(bindAddr, bindPort, cb) {
-  if (!this._sock
-      || !this._sock.writable
-      || !this._sshstream
-      || !this._sshstream.writable)
-    throw new Error('Not connected');
+      if (typeof opts === 'object' && opts !== null) {
+        if (typeof opts.env === 'object' && opts.env !== null)
+          reqEnv(chan, opts.env);
+        if ((typeof opts.x11 === 'object' && opts.x11 !== null)
+            || opts.x11 === 'number'
+            || opts.x11 === true) {
+          todo.push(() => reqX11(chan, opts.x11, reqCb));
+        }
+      }
 
-  // send a request for the server to start forwarding TCP connections to us
-  // on a particular address and port
+      todo.push(() => reqShell(chan, cb));
+      todo.shift()();
+    });
 
-  var self = this;
-  var wantReply = (typeof cb === 'function');
+    return this;
+  }
 
-  if (wantReply) {
-    this._callbacks.push(function(had_err, data) {
-      if (had_err) {
-        return cb(had_err !== true
-                  ? had_err
-                  : new Error('Unable to bind to ' + bindAddr + ':' + bindPort));
-      }
+  subsys(name, cb) {
+    if (!this._sock || !this._sock.writable)
+      throw new Error('Not connected');
 
-      var realPort = bindPort;
-      if (bindPort === 0 && data && data.length >= 4) {
-        realPort = readUInt32BE(data, 0);
-        if (!(self._sshstream.remoteBugs & BUGS.DYN_RPORT_BUG))
-          bindPort = realPort;
+    openChannel(this, 'session', (err, chan) => {
+      if (err) {
+        cb(err);
+        return;
       }
 
-      self._forwarding[bindAddr + ':' + bindPort] = realPort;
+      reqSubsystem(chan, name, (err, stream) => {
+        if (err) {
+          cb(err);
+          return;
+        }
 
-      cb(undefined, realPort);
+        cb(undefined, stream);
+      });
     });
-  }
-
-  return this._sshstream.tcpipForward(bindAddr, bindPort, wantReply);
-};
 
-Client.prototype.unforwardIn = function(bindAddr, bindPort, cb) {
-  if (!this._sock
-      || !this._sock.writable
-      || !this._sshstream
-      || !this._sshstream.writable)
-    throw new Error('Not connected');
+    return this;
+  }
 
-  // send a request to stop forwarding us new connections for a particular
-
... [truncated]

@@ -1,63 +1,66 @@
-var HttpAgent = require('http').Agent;
-var HttpsAgent = require('https').Agent;
-var inherits = require('util').inherits;
+'use strict';
 
-var Client;
+const { Agent: HttpAgent } = require('http');
+const { Agent: HttpsAgent } = require('https');
+const { connect: tlsConnect } = require('tls');
 
-[HttpAgent, HttpsAgent].forEach((ctor) => {
-  function SSHAgent(connectCfg, agentOptions) {
-    if (!(this instanceof SSHAgent))
-      return new SSHAgent(connectCfg, agentOptions);
+let Client;
 
-    ctor.call(this, agentOptions);
+for (const ctor of [HttpAgent, HttpsAgent]) {
+  class SSHAgent extends ctor {
+    constructor(connectCfg, agentOptions) {
+      super(agentOptions);
 
-    this._connectCfg = connectCfg;
-    this._defaultSrcIP = (agentOptions && agentOptions.srcIP) || 'localhost';
-  }
-  inherits(SSHAgent, ctor);
+      this._connectCfg = connectCfg;
+      this._defaultSrcIP = (agentOptions && agentOptions.srcIP) || 'localhost';
+    }
+
+    createConnection(options, cb) {
+      const srcIP = (options && options.localAddress) || this._defaultSrcIP;
+      const srcPort = (options && options.localPort) || 0;
+      const dstIP = options.host;
+      const dstPort = options.port;
+
+      if (Client === undefined)
+        ({ Client } = require('./client.js'));
 
-  SSHAgent.prototype.createConnection = createConnection;
+      const client = new Client();
+      let triedForward = false;
+      client.on('ready', () => {
+        client.forwardOut(srcIP, srcPort, dstIP, dstPort, (err, stream) => {
+          triedForward = true;
+          if (err) {
+            client.end();
+            return cb(err);
+          }
+          stream.once('close', () => client.end());
+          cb(null, decorateStream(stream, ctor, options));
+        });
+      }).on('error', cb).on('close', () => {
+        if (!triedForward)
+          cb(new Error('Unexpected connection close'));
+      }).connect(this._connectCfg);
+    }
+  }
 
   exports[ctor === HttpAgent ? 'SSHTTPAgent' : 'SSHTTPSAgent'] = SSHAgent;
-});
-
-function createConnection(options, cb) {
-  var srcIP = (options && options.localAddress) || this._defaultSrcIP;
-  var srcPort = (options && options.localPort) || 0;
-  var dstIP = options.host;
-  var dstPort = options.port;
-
-  if (Client === undefined)
-    Client = require('./client').Client;
-
-  var client = new Client();
-  var triedForward = false;
-  client.on('ready', () => {
-    client.forwardOut(srcIP, srcPort, dstIP, dstPort, (err, stream) => {
-      triedForward = true;
-      if (err) {
-        client.end();
-        return cb(err);
-      }
-      stream.once('close', () => {
-        client.end();
-      });
-      cb(null, decorateStream(stream));
-    });
-  }).on('error', cb).on('close', () => {
-    if (!triedForward)
-      cb(new Error('Unexpected connection loss'));
-  }).connect(this._connectCfg);
 }
 
 function noop() {}
 
-function decorateStream(stream) {
-  stream.setKeepAlive = noop;
-  stream.setNoDelay = noop;
-  stream.setTimeout = noop;
-  stream.ref = noop;
-  stream.unref = noop;
-  stream.destroySoon = stream.destroy;
-  return stream;
+function decorateStream(stream, ctor, options) {
+  if (ctor === HttpAgent) {
+    // HTTP
+    stream.setKeepAlive = noop;
+    stream.setNoDelay = noop;
+    stream.setTimeout = noop;
+    stream.ref = noop;
+    stream.unref = noop;
+    stream.destroySoon = stream.destroy;
+    return stream;
+  }
+
+  // HTTPS
+  options.socket = stream;
+  return tlsConnect(options);
 }

@@ -0,0 +1,26 @@
+'use strict';
+
+const HTTPAgents = require('./http-agents.js');
+const { parseKey } = require('./protocol/keyParser.js');
+const {
+  flagsToString,
+  OPEN_MODE,
+  STATUS_CODE,
+  stringToFlags,
+} = require('./protocol/SFTP.js');
+
+module.exports = {
+  Client: require('./client.js'),
+  HTTPAgent: HTTPAgents.SSHTTPAgent,
+  HTTPSAgent: HTTPAgents.SSHTTPSAgent,
+  Server: require('./server.js'),
+  utils: {
+    parseKey,
+    sftp: {
+      flagsToString,
+      OPEN_MODE,
+      STATUS_CODE,
+      stringToFlags,
+    },
+  },
+};

@@ -1,80 +0,0 @@
-function spliceOne(list, index) {
-  for (var i = index, k = i + 1, n = list.length; k < n; i += 1, k += 1)
-    list[i] = list[k];
-  list.pop();
-}
-
-function Manager(interval, streamInterval, kaCountMax) {
-  var streams = this._streams = [];
-  this._timer = undefined;
-  this._timerInterval = interval;
-  this._timerfn = function() {
-    var now = Date.now();
-    for (var i = 0, len = streams.length, s, last; i < len; ++i) {
-      s = streams[i];
-      last = s._kalast;
-      if (last && (now - last) >= streamInterval) {
-        if (++s._kacnt > kaCountMax) {
-          var err = new Error('Keepalive timeout');
-          err.level = 'client-timeout';
-          s.emit('error', err);
-          s.disconnect();
-          spliceOne(streams, i);
-          --i;
-          len = streams.length;
-        } else {
-          s._kalast = now;
-          // XXX: if the server ever starts sending real global requests to the
-          //      client, we will need to add a dummy callback here to keep the
-          //      correct reply order
-          s.ping();
-        }
-      }
-    }
-  };
-}
-
-Manager.prototype.start = function() {
-  if (this._timer)
-    this.stop();
-  this._timer = setInterval(this._timerfn, this._timerInterval);
-};
-
-Manager.prototype.stop = function() {
-  if (this._timer) {
-    clearInterval(this._timer);
-    this._timer = undefined;
-  }
-};
-
-Manager.prototype.add = function(stream) {
-  var streams = this._streams,
-      self = this;
-
-  stream.once('end', function() {
-    self.remove(stream);
-  }).on('packet', resetKA);
-
-  streams[streams.length] = stream;
-
-  resetKA();
-
-  if (!this._timer)
-    this.start();
-
-  function resetKA() {
-    stream._kalast = Date.now();
-    stream._kacnt = 0;
-  }
-};
-
-Manager.prototype.remove = function(stream) {
-  var streams = this._streams,
-      index = streams.indexOf(stream);
-  if (index > -1)
-    spliceOne(streams, index);
-  if (!streams.length)
-    this.stop();
-};
-
-module.exports = Manager;

@@ -0,0 +1,345 @@
+// TODO: support server host key format: rsa-sha2-256/512
+'use strict';
+
+const crypto = require('crypto');
+
+let cpuInfo;
+try {
+  cpuInfo = require('cpu-features')();
+} catch {}
+
+const { bindingAvailable } = require('./crypto.js');
+
+const eddsaSupported = (() => {
+  if (typeof crypto.sign === 'function'
+      && typeof crypto.verify === 'function') {
+    const key =
+      '-----BEGIN PRIVATE KEY-----\r\nMC4CAQAwBQYDK2VwBCIEIHKj+sVa9WcD'
+      + '/q2DJUJaf43Kptc8xYuUQA4bOFj9vC8T\r\n-----END PRIVATE KEY-----';
+    const data = Buffer.from('a');
+    let sig;
+    let verified;
+    try {
+      sig = crypto.sign(null, data, key);
+      verified = crypto.verify(null, data, key, sig);
+    } catch {}
+    return (Buffer.isBuffer(sig) && sig.length === 64 && verified === true);
+  }
+
+  return false;
+})();
+
+const curve25519Supported = (typeof crypto.diffieHellman === 'function'
+                             && typeof crypto.generateKeyPairSync === 'function'
+                             && typeof crypto.createPublicKey === 'function');
+
+const DEFAULT_KEX = [
+  // https://tools.ietf.org/html/rfc5656#section-10.1
+  'ecdh-sha2-nistp256',
+  'ecdh-sha2-nistp384',
+  'ecdh-sha2-nistp521',
+
+  // https://tools.ietf.org/html/rfc4419#section-4
+  'diffie-hellman-group-exchange-sha256',
+
+  // https://tools.ietf.org/html/rfc8268
+  'diffie-hellman-group14-sha256',
+  'diffie-hellman-group15-sha512',
+  'diffie-hellman-group16-sha512',
+  'diffie-hellman-group17-sha512',
+  'diffie-hellman-group18-sha512',
+];
+if (curve25519Supported) {
+  DEFAULT_KEX.unshift('curve25519-sha256');
+  DEFAULT_KEX.unshift('curve25519-sha256@libssh.org');
+}
+const SUPPORTED_KEX = DEFAULT_KEX.concat([
+  // https://tools.ietf.org/html/rfc4419#section-4
+  'diffie-hellman-group-exchange-sha1',
+
+  'diffie-hellman-group14-sha1', // REQUIRED
+  'diffie-hellman-group1-sha1',  // REQUIRED
+]);
+
+
+const DEFAULT_SERVER_HOST_KEY = [
+  'ecdsa-sha2-nistp256',
+  'ecdsa-sha2-nistp384',
+  'ecdsa-sha2-nistp521',
+  'rsa-sha2-512', // RFC 8332
+  'rsa-sha2-256', // RFC 8332
+  'ssh-rsa',
+];
+if (eddsaSupported)
+  DEFAULT_SERVER_HOST_KEY.unshift('ssh-ed25519');
+const SUPPORTED_SERVER_HOST_KEY = DEFAULT_SERVER_HOST_KEY.concat([
+  'ssh-dss',
+]);
+
+
+const DEFAULT_CIPHER = [
+  // http://tools.ietf.org/html/rfc5647
+  'aes128-gcm',
+  'aes128-gcm@openssh.com',
+  'aes256-gcm',
+  'aes256-gcm@openssh.com',
+
+  // http://tools.ietf.org/html/rfc4344#section-4
+  'aes128-ctr',
+  'aes192-ctr',
+  'aes256-ctr',
+];
+if (cpuInfo && cpuInfo.flags && !cpuInfo.flags.aes) {
+  // We know for sure the CPU does not support AES acceleration
+  if (bindingAvailable)
+    DEFAULT_CIPHER.unshift('chacha20-poly1305@openssh.com');
+  else
+    DEFAULT_CIPHER.push('chacha20-poly1305@openssh.com');
+} else if (bindingAvailable && cpuInfo && cpuInfo.arch === 'x86') {
+  // Places chacha20-poly1305 immediately after GCM ciphers since GCM ciphers
+  // seem to outperform it on x86, but it seems to be faster than CTR ciphers
+  DEFAULT_CIPHER.splice(4, 0, 'chacha20-poly1305@openssh.com');
+} else {
+  DEFAULT_CIPHER.push('chacha20-poly1305@openssh.com');
+}
+const SUPPORTED_CIPHER = DEFAULT_CIPHER.concat([
+  'aes256-cbc',
+  'aes192-cbc',
+  'aes128-cbc',
+  'blowfish-cbc',
+  '3des-cbc',
+
+  // http://tools.ietf.org/html/rfc4345#section-4:
+  'arcfour256',
+  'arcfour128',
+
+  'cast128-cbc',
+  'arcfour',
+]);
+
+
+const DEFAULT_MAC = [
+  'hmac-sha2-256-etm@openssh.com',
+  'hmac-sha2-512-etm@openssh.com',
+  'hmac-sha1-etm@openssh.com',
+  'hmac-sha2-256',
+  'hmac-sha2-512',
+  'hmac-sha1',
+];
+const SUPPORTED_MAC = DEFAULT_MAC.concat([
+  'hmac-md5',
+  'hmac-sha2-256-96', // first 96 bits of HMAC-SHA256
+  'hmac-sha2-512-96', // first 96 bits of HMAC-SHA512
+  'hmac-ripemd160',
+  'hmac-sha1-96',     // first 96 bits of HMAC-SHA1
+  'hmac-md5-96',      // first 96 bits of HMAC-MD5
+]);
+
+const DEFAULT_COMPRESSION = [
+  'none',
+  'zlib@openssh.com', // ZLIB (LZ77) compression, except
+                      // compression/decompression does not start until after
+                      // successful user authentication
+  'zlib',             // ZLIB (LZ77) compression
+];
+const SUPPORTED_COMPRESSION = DEFAULT_COMPRESSION.concat([
+]);
+
+
+const COMPAT = {
+  BAD_DHGEX: 1 << 0,
+  OLD_EXIT: 1 << 1,
+  DYN_RPORT_BUG: 1 << 2,
+  BUG_DHGEX_LARGE: 1 << 3,
+};
+
+module.exports = {
+  MESSAGE: {
+    // Transport layer protocol -- generic (1-19)
+    DISCONNECT: 1,
+    IGNORE: 2,
+    UNIMPLEMENTED: 3,
+    DEBUG: 4,
+    SERVICE_REQUEST: 5,
+    SERVICE_ACCEPT: 6,
+
+    // Transport layer protocol -- algorithm negotiation (20-29)
+    KEXINIT: 20,
+    NEWKEYS: 21,
+
+    // Transport layer protocol -- key exchange method-specific (30-49)
+    KEXDH_INIT: 30,
+    KEXDH_REPLY: 31,
+
+    KEXDH_GEX_GROUP: 31,
+    KEXDH_GEX_INIT: 32,
+    KEXDH_GEX_REPLY: 33,
+    KEXDH_GEX_REQUEST: 34,
+
+    KEXECDH_INIT: 30,
+    KEXECDH_REPLY: 31,
+
+    // User auth protocol -- generic (50-59)
+    USERAUTH_REQUEST: 50,
+    USERAUTH_FAILURE: 51,
+    USERAUTH_SUCCESS: 52,
+    USERAUTH_BANNER: 53,
+
+    // User auth protocol -- user auth method-specific (60-79)
+    USERAUTH_PASSWD_CHANGEREQ: 60,
+
+    USERAUTH_PK_OK: 60,
+
+    USERAUTH_INFO_REQUEST: 60,
+    USERAUTH_INFO_RESPONSE: 61,
+
+    // Connection protocol -- generic (80-89)
+    GLOBAL_REQUEST: 80,
+    REQUEST_SUCCESS: 81,
+    REQUEST_FAILURE: 82,
+
+    // Connection protocol -- channel-related (90-127)
+    CHANNEL_OPEN: 90,
+    CHANNEL_OPEN_CONFIRMATION: 91,
+    CHANNEL_OPEN_FAILURE: 92,
+    CHANNEL_WINDOW_ADJUST: 93,
+    CHANNEL_DATA: 94,
+    CHANNEL_EXTENDED_DATA: 95,
+    CHANNEL_EOF: 96,
+    CHANNEL_CLOSE: 97,
+    CHANNEL_REQUEST: 98,
+    CHANNEL_SUCCESS: 99,
+    CHANNEL_FAILURE: 100
+
+    // Reserved for client protocols (128-191)
+
+    // Local extensions (192-155)
+  },
+  DISCONNECT_REASON: {
+    HOST_NOT_ALLOWED_TO_CONNECT: 1,
+    PROTOCOL_ERROR: 2,
+    KEY_EXCHANGE_FAILED: 3,
+    RESERVED: 4,
+    MAC_ERROR: 5,
+    COMPRESSION_ERROR: 6,
+    SERVICE_NOT_AVAILABLE: 7,
+    PROTOCOL_VERSION_NOT_SUPPORTED: 8,
+    HOST_KEY_NOT_VERIFIABLE: 9,
+    CONNECTION_LOST: 10,
+    BY_APPLICATION: 11,
+    TOO_MANY_CONNECTIONS: 12,
+    AUTH_CANCELED_BY_USER: 13,
+    NO_MORE_AUTH_METHODS_AVAILABLE: 14,
+    ILLEGAL_USER_NAME: 15,
+  },
+  DISCONNECT_REASON_STR: undefined,
+  CHANNEL_OPEN_FAILURE: {
+    ADMINISTRATIVELY_PROHIBITED: 1,
+    CONNECT_FAILED: 2,
+    UNKNOWN_CHANNEL_TYPE: 3,
+    RESOURCE_SHORTAGE: 4
+  },
+  TERMINAL_MODE: {
+    TTY_OP_END: 0,        // Indicates end of options.
+    VINTR: 1,             // Interrupt character; 255 if none. Similarly for the
+                          //  other characters.  Not all of these characters are
+                          //  supported on all systems.
+    VQUIT: 2,             // The quit character (sends SIGQUIT signal on POSIX
+                          //  systems).
+    VERASE: 3,            // Erase the character to left of the cursor.
+    VKILL: 4,             // Kill the current input line.
+    VEOF: 5,              // End-of-file character (sends EOF from the
+                          //  terminal).
+    VEOL: 6,              // End-of-line character in addition to carriage
+                          //  return and/or linefeed.
+    VEOL2: 7,             // Additional end-of-line character.
+    VSTART: 8,            // Continues paused output (normally control-Q).
+    VSTOP: 9,             // Pauses output (normally control-S).
+    VSUSP: 10,            // Suspends the current program.
+    VDSUSP: 11,           // Another suspend character.
+    VREPRINT: 12,         // Reprints the current input line.
+    VWERASE: 13,          // Erases a word left of cursor.
+    VLNEXT: 14,           // Enter the next character typed literally, even if
+                          //  it is a special character
+    VFLUSH: 15,           // Character to flush output.
+    VSWTCH: 16,           // Switch to a different shell layer.
+    VSTATUS: 17,          // Prints system status line (load, command, pid,
+                          //  etc).
+    VDISCARD: 18,         // Toggles the flushing of terminal output.
+    IGNPAR: 30,           // The ignore parity flag.  The parameter SHOULD be 0
+                          //  if this flag is FALSE, and 1 if it is TRUE.
+    PARMRK: 31,           // Mark parity and framing errors.
+    INPCK: 32,            // Enable checking of parity errors.
+    ISTRIP: 33,           // Strip 8th bit off characters.
+    INLCR: 34,            // Map NL into CR on input.
+    IGNCR: 35,            // Ignore CR on input.
+    ICRNL: 36,            // Map CR to NL on input.
+    IUCLC: 37,            // Translate uppercase characters to lowercase.
+    IXON: 38,             // Enable output flow control.
+    IXANY: 39,            // Any char will restart after stop.
+    IXOFF: 40,            // Enable input flow control.
+    IMAXBEL: 41,          // Ring bell on input queue full.
+    ISIG: 50,             // Enable signals INTR, QUIT, [D]SUSP.
+    ICANON: 51,           // Canonicalize input lines.
+    XCASE: 52,            // Enable input and output of uppercase characters by
+                          //  preceding their lowercase equivalents with "\".
+    ECHO: 53,             // Enable echoing.
+    ECHOE: 54,            // Visually erase chars.
+    ECHOK: 55,            // Kill character discards current line.
+    ECHONL: 56,           // Echo NL even if ECHO is off.
+    NOFLSH: 57,           // Don't flush after interrupt.
+    TOSTOP: 58,           // Stop background jobs from output.
+    IEXTEN: 59,           // Enable extensions.
+    ECHOCTL: 60,          // Echo control characters as ^(Char).
+    ECHOKE: 61,           // Visual erase for line kill.
+    PENDIN: 62,           // Retype pending input.
+    OPOST: 70,            // Enable output processing.
+    OLCUC: 71,            // Convert lowercase to uppercase.
+    ONLCR: 72,            // Map NL to CR-NL.
+    OCRNL: 73,            // Translate carriage return to newline (output).
+    ONOCR: 74,            // Translate newline to carriage return-newline
+                          //  (output).
+    ONLRET: 75,           // Newline performs a carriage return (output).
+    CS7: 90,              // 7 bit mode.
+    CS8: 91,              // 8 bit mode.
+    PARENB: 92,           // Parity enable.
+    PARODD: 93,           // Odd parity, else even.
+    TTY_OP_ISPEED: 128,   // Specifies the input baud rate in bits per second.
+    TTY_OP_OSPEED: 129,   // Specifies the output baud rate in bits per second.
+  },
+  CHANNEL_EXTENDED_DATATYPE: {
+    STDERR: 1,
+  },
+
+  SIGNALS: [
+    'ABRT', 'ALRM', 'FPE', 'HUP', 'ILL', 'INT', 'QUIT', 'SEGV', 'TERM', 'USR1',
+    'USR2', 'KILL', 'PIPE'
+  ].reduce((cur, val) => ({ ...cur, [val]: 1 }), {}),
+
+  COMPAT,
+  COMPAT_CHECKS: [
+    [ 'Cisco-1.25', COMPAT.BAD_DHGEX ],
+    [ /^Cisco-1\./, COMPAT.BUG_DHGEX_LARGE ],
+    [ /^[0-9.]+$/, COMPAT.OLD_EXIT ], // old SSH.com implementations
+    [ /^OpenSSH_5\.\d+/, COMPAT.DYN_RPORT_BUG ],
+  ],
+
+  // KEX proposal-related
+  DEFAULT_KEX,
+  SUPPORTED_KEX,
+  DEFAULT_SERVER_HOST_KEY,
+  SUPPORTED_SERVER_HOST_KEY,
+  DEFAULT_CIPHER,
+  SUPPORTED_CIPHER,
+  DEFAULT_MAC,
+  SUPPORTED_MAC,
+  DEFAULT_COMPRESSION,
+  SUPPORTED_COMPRESSION,
+
+  curve25519Supported,
+  eddsaSupported,
+};
+
+module.exports.DISCONNECT_REASON_BY_VALUE =
+  Array.from(Object.entries(module.exports.DISCONNECT_REASON))
+       .reduce((obj, [key, value]) => ({ ...obj, [value]: key }), {});

@@ -0,0 +1,14 @@
+{
+  'targets': [
+    {
+      'target_name': 'sshcrypto',
+      'include_dirs': [
+        "<!(node -e \"require('nan')\")",
+      ],
+      'sources': [
+        'src/binding.cc'
+      ],
+      'cflags': [ '-O3' ],
+    },
+  ],
+}

@@ -0,0 +1,1607 @@
+// TODO:
+//    * make max packet size configurable
+//    * if decompression is enabled, use `._packet` in decipher instances as
+//      input to (sync) zlib inflater with appropriate offset and length to
+//      avoid an additional copy of payload data before inflation
+//    * factor decompression status into packet length checks
+'use strict';
+
+const {
+  createCipheriv, createDecipheriv, createHmac, randomFillSync, timingSafeEqual
+} = require('crypto');
+
+const { readUInt32BE, writeUInt32BE } = require('./utils.js');
+
+const FastBuffer = Buffer[Symbol.species];
+const MAX_SEQNO = 2 ** 32 - 1;
+const EMPTY_BUFFER = Buffer.alloc(0);
+const BUF_INT = Buffer.alloc(4);
+const DISCARD_CACHE = new Map();
+const MAX_PACKET_SIZE = 35000;
+
+let binding;
+let AESGCMCipher;
+let ChaChaPolyCipher;
+let GenericCipher;
+let AESGCMDecipher;
+let ChaChaPolyDecipher;
+let GenericDecipher;
+try {
+  binding = require('./crypto/build/Release/sshcrypto.node');
+  ({ AESGCMCipher, ChaChaPolyCipher, GenericCipher,
+     AESGCMDecipher, ChaChaPolyDecipher, GenericDecipher } = binding);
+} catch {}
+
+const CIPHER_STREAM = 1 << 0;
+const CIPHER_INFO = (() => {
+  function info(sslName, blockLen, keyLen, ivLen, authLen, discardLen, flags) {
+    return {
+      sslName,
+      blockLen,
+      keyLen,
+      ivLen: (ivLen !== 0 || (flags & CIPHER_STREAM)
+              ? ivLen
+              : blockLen),
+      authLen,
+      discardLen,
+      stream: !!(flags & CIPHER_STREAM),
+    };
+  }
+
+  return {
+    'chacha20-poly1305@openssh.com':
+      info('chacha20', 8, 64, 0, 16, 0, CIPHER_STREAM),
+
+    'aes128-gcm': info('aes-128-gcm', 16, 16, 12, 16, 0, CIPHER_STREAM),
+    'aes256-gcm': info('aes-256-gcm', 16, 32, 12, 16, 0, CIPHER_STREAM),
+    'aes128-gcm@openssh.com':
+      info('aes-128-gcm', 16, 16, 12, 16, 0, CIPHER_STREAM),
+    'aes256-gcm@openssh.com':
+      info('aes-256-gcm', 16, 32, 12, 16, 0, CIPHER_STREAM),
+
+    'aes128-cbc': info('aes-128-cbc', 16, 16, 0, 0, 0, 0),
+    'aes192-cbc': info('aes-192-cbc', 16, 24, 0, 0, 0, 0),
+    'aes256-cbc': info('aes-256-cbc', 16, 32, 0, 0, 0, 0),
+    'rijndael-cbc@lysator.liu.se': info('aes-256-cbc', 16, 32, 0, 0, 0, 0),
+    '3des-cbc': info('des-ede3-cbc', 8, 24, 0, 0, 0, 0),
+    'blowfish-cbc': info('bf-cbc', 8, 16, 0, 0, 0, 0),
+    'idea-cbc': info('idea-cbc', 8, 16, 0, 0, 0, 0),
+    'cast128-cbc': info('cast-cbc', 8, 16, 0, 0, 0, 0),
+
+    'aes128-ctr': info('aes-128-ctr', 16, 16, 16, 0, 0, CIPHER_STREAM),
+    'aes192-ctr': info('aes-192-ctr', 16, 24, 16, 0, 0, CIPHER_STREAM),
+    'aes256-ctr': info('aes-256-ctr', 16, 32, 16, 0, 0, CIPHER_STREAM),
+    '3des-ctr': info('des-ede3', 8, 24, 8, 0, 0, CIPHER_STREAM),
+    'blowfish-ctr': info('bf-ecb', 8, 16, 8, 0, 0, CIPHER_STREAM),
+    'cast128-ctr': info('cast5-ecb', 8, 16, 8, 0, 0, CIPHER_STREAM),
+
+    /* The "arcfour128" algorithm is the RC4 cipher, as described in
+       [SCHNEIER], using a 128-bit key.  The first 1536 bytes of keystream
+       generated by the cipher MUST be discarded, and the first byte of the
+       first encrypted packet MUST be encrypted using the 1537th byte of
+       keystream.
+
+       -- http://tools.ietf.org/html/rfc4345#section-4 */
+    'arcfour': info('rc4', 8, 16, 0, 0, 1536, CIPHER_STREAM),
+    'arcfour128': info('rc4', 8, 16, 0, 0, 1536, CIPHER_STREAM),
+    'arcfour256': info('rc4', 8, 32, 0, 0, 1536, CIPHER_STREAM),
+    'arcfour512': info('rc4', 8, 64, 0, 0, 1536, CIPHER_STREAM),
+  };
+})();
+
+const MAC_INFO = (() => {
+  function info(sslName, len, actualLen, isETM) {
+    return {
+      sslName,
+      len,
+      actualLen,
+      isETM,
+    };
+  }
+
+  return {
+    'hmac-md5': info('md5', 16, 16, false),
+    'hmac-md5-96': info('md5', 16, 12, false),
+    'hmac-ripemd160': info('ripemd160', 20, 20, false),
+    'hmac-sha1': info('sha1', 20, 20, false),
+    'hmac-sha1-etm@openssh.com': info('sha1', 20, 20, true),
+    'hmac-sha1-96': info('sha1', 20, 12, false),
+    'hmac-sha2-256': info('sha256', 32, 32, false),
+    'hmac-sha2-256-etm@openssh.com': info('sha256', 32, 32, true),
+    'hmac-sha2-256-96': info('sha256', 32, 12, false),
+    'hmac-sha2-512': info('sha512', 64, 64, false),
+    'hmac-sha2-512-etm@openssh.com': info('sha512', 64, 64, true),
+    'hmac-sha2-512-96': info('sha512', 64, 12, false),
+  };
+})();
+
+
+// Should only_be used during the initial handshake
+class NullCipher {
+  constructor(seqno, onWrite) {
+    this.outSeqno = seqno;
+    this._onWrite = onWrite;
+    this._dead = false;
+  }
+  free() {
+    this._dead = true;
+  }
+  allocPacket(payloadLen) {
+    let pktLen = 4 + 1 + payloadLen;
+    let padLen = 8 - (pktLen & (8 - 1));
+    if (padLen < 4)
+      padLen += 8;
+    pktLen += padLen;
+
+    const packet = Buffer.allocUnsafe(pktLen);
+
+    writeUInt32BE(packet, pktLen - 4, 0);
+    packet[4] = padLen;
+
+    randomFillSync(packet, 5 + payloadLen, padLen);
+
+    return packet;
+  }
+  encrypt(packet) {
+    // `packet` === unencrypted packet
+
+    if (this._dead)
+      return;
+
+    this._onWrite(packet);
+
+    this.outSeqno = (this.outSeqno + 1) >>> 0;
+  }
+}
+
+
+const CCP_ZEROS = Buffer.alloc(32);
+const CCP_OUT_COMPUTE = Buffer.alloc(16);
+const CCP_WASM_MODULE = require('./crypto/poly1305.js');
+const CCP_RESULT_MALLOC = CCP_WASM_MODULE._malloc(16);
+const poly1305_auth = CCP_WASM_MODULE.cwrap(
+  'poly1305_auth',
+  null,
+  ['number', 'array', 'number', 'array', 'number', 'array']
+);
+class ChaChaPolyCipherNative {
+  constructor(config) {
+    const enc = config.outbound;
+    this.outSeqno = enc.seqno;
+    this._onWrite = enc.onWrite;
+    this._encKeyMain = enc.cipherKey.slice(0, 32);
+    this._encKeyPktLen = enc.cipherKey.slice(32);
+    this._dead = false;
+  }
+  free() {
+    this._dead = true;
+  }
+  allocPacket(payloadLen) {
+    let pktLen = 4 + 1 + payloadLen;
+    let padLen = 8 - ((pktLen - 4) & (8 - 1));
+    if (padLen < 4)
+      padLen += 8;
+    pktLen += padLen;
+
+    const packet = Buffer.allocUnsafe(pktLen);
+
+    writeUInt32BE(packet, pktLen - 4, 0);
+    packet[4] = padLen;
+
+    randomFillSync(packet, 5 + payloadLen, padLen);
+
+    return packet;
+  }
+  encrypt(packet) {
+    // `packet` === unencrypted packet
+
+    if (this._dead)
+      return;
+
+    // Generate Poly1305 key
+    CCP_OUT_COMPUTE[0] = 0; // Set counter to 0 (little endian)
+    writeUInt32BE(CCP_OUT_COMPUTE, this.outSeqno, 12);
+    const polyKey =
+      createCipheriv('chacha20', this._encKeyMain, CCP_OUT_COMPUTE)
+      .update(CCP_ZEROS);
+
+    // Encrypt packet length
+    const pktLenEnc =
+      createCipheriv('chacha20', this._encKeyPktLen, CCP_OUT_COMPUTE)
+      .update(packet.slice(0, 4));
+    this._onWrite(pktLenEnc);
+
+    // Encrypt rest of packet
+    CCP_OUT_COMPUTE[0] = 1; // Set counter to 1 (little endian)
+    const payloadEnc =
+      createCipheriv('chacha20', this._encKeyMain, CCP_OUT_COMPUTE)
+      .update(packet.slice(4));
+    this._onWrite(payloadEnc);
+
+    // Calculate Poly1305 MAC
+    poly1305_auth(CCP_RESULT_MALLOC,
+                  pktLenEnc,
+                  pktLenEnc.length,
+                  payloadEnc,
+                  payloadEnc.length,
+                  polyKey);
+    const mac = Buffer.allocUnsafe(16);
+    mac.set(
+      new Uint8Array(CCP_WASM_MODULE.HEAPU8.buffer, CCP_RESULT_MALLOC, 16),
+      0
+    );
+    this._onWrite(mac);
+
+    this.outSeqno = (this.outSeqno + 1) >>> 0;
+  }
+}
+
+class ChaChaPolyCipherBinding {
+  constructor(config) {
+    const enc = config.outbound;
+    this.outSeqno = enc.seqno;
+    this._onWrite = enc.onWrite;
+    this._instance = new ChaChaPolyCipher(enc.cipherKey);
+    this._dead = false;
+  }
+  free() {
+    this._dead = true;
+    this._instance.free();
+  }
+  allocPacket(payloadLen) {
+    let pktLen = 4 + 1 + payloadLen;
+    let padLen = 8 - ((pktLen - 4) & (8 - 1));
+    if (padLen < 4)
+      padLen += 8;
+    pktLen += padLen;
+
+    const packet = Buffer.allocUnsafe(pktLen + 16/* MAC */);
+
+    writeUInt32BE(packet, pktLen - 4, 0);
+    packet[4] = padLen;
+
+    randomFillSync(packet, 5 + payloadLen, padLen);
+
+    return packet;
+  }
+  encrypt(packet) {
+    // `packet` === unencrypted packet
+
+    if (this._dead)
+      return;
+
+    // Encrypts in-place
+    this._instance.encrypt(packet, this.outSeqno);
+
+    this._onWrite(packet);
+
+    this.outSeqno = (this.outSeqno + 1) >>> 0;
+  }
+}
+
+
+class AESGCMCipherNative {
+  constructor(config) {
+    const enc = config.outbound;
+    this.outSeqno = enc.seqno;
+    this._onWrite = enc.onWrite;
+    this._encSSLName = enc.cipherInfo.sslName;
+    this._encKey = enc.cipherKey;
+    this._encIV = enc.cipherIV;
+    this._dead = false;
+  }
+  free() {
+    this._dead = true;
+  }
+  allocPacket(payloadLen) {
+    let pktLen = 4 + 1 + payloadLen;
+    let padLen = 16 - ((pktLen - 4) & (16 - 1));
+    if (padLen < 4)
+      padLen += 16;
+    pktLen += padLen;
+
+    const packet = Buffer.allocUnsafe(pktLen);
+
+    writeUInt32BE(packet, pktLen - 4, 0);
+    packet[4] = padLen;
+
+    randomFillSync(packet, 5 + payloadLen, padLen);
+
+    return packet;
+  }
+  encrypt(packet) {
+    // `packet` === unencrypted packet
+
+    if (this._dead)
+      return;
+
+    const cipher = createCipheriv(this._encSSLName, this._encKey, this._encIV);
+    cipher.setAutoPadding(false);
+
+    const lenData = packet.slice(0, 4);
+    cipher.setAAD(lenData);
+    this._onWrite(lenData);
+
+    // Encrypt pad length, payload, and padding
+    const encrypted = cipher.update(packet.slice(4));
+    this._onWrite(encrypted);
+    const final = cipher.final();
+    // XXX: final.length === 0 always?
+    if (final.length)
+      this._onWrite(final);
+
+    // Generate MAC
+    const tag = cipher.getAuthTag();
+    this._onWrite(tag);
+
+    // Increment counter in IV by 1 for next packet
+    ivIncrement(this._encIV);
+
+    this.outSeqno = (this.outSeqno + 1) >>> 0;
+  }
+}
+
+class AESGCMCipherBinding {
+  constructor(config) {
+    const enc = config.outbound;
+    this.outSeqno = enc.seqno;
+    this._onWrite = enc.onWrite;
+    this._instance = new AESGCMCipher(enc.cipherInfo.sslName,
+                                      enc.cipherKey,
+                                      enc.cipherIV);
+    this._dead = false;
+  }
+  free() {
+    this._dead = true;
+    this._instance.free();
+  }
+  allocPacket(payloadLen) {
+    let pktLen = 4 + 1 + payloadLen;
+    let padLen = 16 - ((pktLen - 4) & (16 - 1));
+    if (padLen < 4)
+      padLen += 16;
+    pktLen += padLen;
+
+    const packet = Buffer.allocUnsafe(pktLen + 16/* authTag */);
+
+    writeUInt32BE(packet, pktLen - 4, 0);
+    packet[4] = padLen;
+
+    randomFillSync(packet, 5 + payloadLen, padLen);
+
+    return packet;
+  }
+  encrypt(packet) {
+    // `packet` === unencrypted packet
+
+    if (this._dead)
+      return;
+
+    // Encrypts in-place
+    this._instance.encrypt(packet);
+
+    this._onWrite(packet);
+
+    this.outSeqno = (this.outSeqno + 1) >>> 0;
+  }
+}
+
+
+class GenericCipherNative {
+  constructor(config) {
+    const enc = config.outbound;
+    this.outSeqno = enc.seqno;
+    this._onWrite = enc.onWrite;
+    this._encBlockLen = enc.cipherInfo.blockLen;
+    this._cipherInstance = createCipheriv(enc.cipherInfo.sslName,
+                                          enc.cipherKey,
+                                          enc.cipherIV);
+    this._macSSLName = enc.macInfo.sslName;
+    this._macKey = enc.macKey;
+    this._macActualLen = enc.macInfo.actualLen;
+    this._macETM = enc.macInfo.isETM;
+    this._aadLen = (this._macETM ? 4 : 0);
+    this._dead = false;
+
+    const discardLen = enc.cipherInfo.discardLen;
+    if (discardLen) {
+      let discard = DISCARD_CACHE.get(discardLen);
+      if (discard === undefined) {
+        discard = Buffer.alloc(discardLen);
+        DISCARD_CACHE.set(discardLen, discard);
+      }
+      this._cipherInstance.update(discard);
+    }
+  }
+  free() {
+    this._dead = true;
+  }
+  allocPacket(payloadLen) {
+    const blockLen = this._encBlockLen;
+
+    let pktLen = 4 + 1 + payloadLen;
+    let padLen = blockLen - ((pktLen - this._aadLen) & (blockLen - 1));
+    if (padLen < 4)
+      padLen += blockLen;
+    pktLen += padLen;
+
+    const packet = Buffer.allocUnsafe(pktLen);
+
+    writeUInt32BE(packet, pktLen - 4, 0);
+    packet[4] = padLen;
+
+    randomFillSync(packet, 5 + payloadLen, padLen);
+
+    return packet;
+  }
+  encrypt(packet) {
+    // `packet` === unencrypted packet
+
+    if (this._dead)
+      return;
+
+    let mac;
+    if (this._macETM) {
+      // Encrypt pad length, payload, and padding
+      const lenBytes = new Uint8Array(packet.buffer, packet.byteOffset, 4);
+      const encrypted = this._cipherInstance.update(
+        new Uint8Array(packet.buffer,
+                       packet.byteOffset + 4,
+                       packet.length - 4)
+      );
+
+      this._onWrite(lenBytes);
+      this._onWrite(encrypted);
+
+      // TODO: look into storing seqno as 4-byte buffer and incrementing like we
+      // do for AES-GCM IVs to avoid having to (re)write all 4 bytes every time
+      mac = createHmac(this._macSSLName, this._macKey);
+      writeUInt32BE(BUF_INT, this.outSeqno, 0);
+      mac.update(BUF_INT);
+      mac.update(lenBytes);
+      mac.update(encrypted);
+    } else {
+      // Encrypt length field, pad length, payload, and padding
+      const encrypted = this._cipherInstance.update(packet);
+      this._onWrite(encrypted);
+
+      // TODO: look into storing seqno as 4-byte buffer and incrementing like we
+      // do for AES-GCM IVs to avoid having to (re)write all 4 bytes every time
+      mac = createHmac(this._macSSLName, this._macKey);
+      writeUInt32BE(BUF_INT, this.outSeqno, 0);
+      mac.update(BUF_INT);
+      mac.update(packet);
+    }
+
+    let digest = mac.digest();
+    if (digest.length > this._macActualLen)
+      digest = digest.slice(0, this._macActualLen);
+    this._onWrite(digest);
+
+    this.outSeqno = (this.outSeqno + 1) >>> 0;
+  }
+}
+
+class GenericCipherBinding {
+  constructor(config) {
+    const enc = config.outbound;
+    this.outSeqno = enc.seqno;
+    this._onWrite = enc.onWrite;
+    this._encBlockLen = enc.cipherInfo.blockLen;
+    this._macLen = enc.macInfo.len;
+    this._macActualLen = enc.macInfo.actualLen;
+    this._aadLen = (enc.macInfo.isETM ? 4 : 0);
+    this._instance = new GenericCipher(enc.cipherInfo.sslName,
+                                       enc.cipherKey,
+                                       enc.cipherIV,
+                                       enc.macInfo.sslName,
+                                       enc.macKey,
+                                       enc.macInfo.isETM);
+    this._dead = false;
+  }
+  free() {
+    this._dead = true;
+    this._instance.free();
+  }
+  allocPacket(payloadLen) {
+    const blockLen = this._encBlockLen;
+
+    let pktLen = 4 + 1 + payloadLen;
+    let padLen = blockLen - ((pktLen - this._aadLen) & (blockLen - 1));
+    if (padLen < 4)
+      padLen += blockLen;
+    pktLen += padLen;
+
+    const packet = Buffer.allocUnsafe(pktLen + this._macLen);
+
+    writeUInt32BE(packet, pktLen - 4, 0);
+    packet[4] = padLen;
+
+    randomFillSync(packet, 5 + payloadLen, padLen);
+
+    return packet;
+  }
+  encrypt(packet) {
+    // `packet` === unencrypted packet
+
+    if (this._dead)
+      return;
+
+    // Encrypts in-place
+    this._instance.encrypt(packet, this.outSeqno);
+
+    if (this._macActualLen < this._macLen) {
+      packet = new FastBuffer(packet.buffer,
+                              packet.byteOffset,
+                              (packet.length
+                                - (this._macLen - this._macActualLen)));
+    }
+    this._onWrite(packet);
+
+    this.outSeqno = (this.outSeqno + 1) >>> 0;
+  }
+}
+
+
+class NullDecipher {
+  constructor(seqno, onPayload) {
+    this.inSeqno = seqno;
+    this._onPayload = onPayload;
+    this._len = 0;
+    this._lenBytes = 0;
+    this._packet = null;
+    this._packetPos = 0;
+  }
+  free() {}
+  decrypt(data, p, dataLen) {
+    while (p < dataLen) {
+      // Read packet length
+      if (this._lenBytes < 4) {
+        let nb = Math.min(4 - this._lenBytes, dataLen - p);
+
+        this._lenBytes += nb;
+        while (nb--)
+          this._len = (this._len << 8) + data[p++];
+
+        if (this._lenBytes < 4)
+          return;
+
+        if (this._len > MAX_PACKET_SIZE
+            || this._len < 8
+            || (4 + this._len & 7) !== 0) {
+          throw new Error('Bad packet length');
+        }
+        if (p >= dataLen)
+          return;
+      }
+
+      // Read padding length, payload, and padding
+      if (this._packetPos < this._len) {
+        const nb = Math.min(this._len - this._packetPos, dataLen - p);
+        if (p !== 0 || nb !== dataLen) {
+          if (nb === this._len) {
+            this._packet = new FastBuffer(data.buffer, data.byteOffset + p, nb);
+          } else {
+            this._packet = Buffer.allocUnsafe(this._len);
+            this._packet.set(
+              new Uint8Array(data.buffer, data.byteOffset + p, nb),
+              this._packetPos
+            );
+          }
+        } else if (nb === this._len) {
+          this._packet = data;
+        } else {
+          this._packet.set(data, this._packetPos);
+        }
+        p += nb;
+        this._packetPos += nb;
+        if (this._packetPos < this._len)
+          return;
+      }
+
+      const payload = (!this._packet
+                       ? EMPTY_BUFFER
+                       : new FastBuffer(this._packet.buffer,
+                                        this._packet.byteOffset + 1,
+                                        this._packet.length
+                                          - this._packet[0] - 1));
+
+      // Prepare for next packet
+      this.inSeqno = (this.inSeqno + 1) >>> 0;
+      this._len = 0;
+      this._lenBytes = 0;
+      this._packet = null;
+      this._packetPos = 0;
+
+      {
+        const ret = this._onPayload(payload);
+        if (ret !== undefined)
+          return (ret === false ? p : ret);
+      }
+    }
+  }
+}
+
+class ChaChaPolyDecipherNative {
+  constructor(config) {
+    const dec = config.inbound;
+    this.inSeqno = dec.seqno;
+    this._onPayload = dec.onPayload;
+    this._decKeyMain = dec.decipherKey.slice(0, 32);
+    this._decKeyPktLen = dec.decipherKey.slice(32);
+    this._len = 0;
+    this._lenBuf = Buffer.alloc(4);
+    this._lenPos = 0;
+    this._packet = null;
+    this._pktLen = 0;
+    this._mac = Buffer.allocUnsafe(16);
+    this._calcMac = Buffer.allocUnsafe(16);
+    this._macPos = 0;
+  }
+  free() {}
+  decrypt(data, p, dataLen) {
+    // `data` === encrypted data
+
+    while (p < dataLen) {
+      // Read packet length
+      if (this._lenPos < 4) {
+        let nb = Math.min(4 - this._lenPos, dataLen - p);
+        while (nb--)
+          this._lenBuf[this._lenPos++] = data[p++];
+        if (this._lenPos < 4)
+          return;
+
+        CCP_OUT_COMPUTE[0] = 0; // Set counter to 0 (little endian)
+        writeUInt32BE(CCP_OUT_COMPUTE, this.inSeqno, 12);
+
+        const decLenBytes =
+          createDecipheriv('chacha20', this._decKeyPktLen, CCP_OUT_COMPUTE)
+          .update(this._lenBuf);
+        this._len = readUInt32BE(decLenBytes, 0);
+
+        if (this._len > MAX_PACKET_SIZE
+            || this._len < 8
+            || (this._len & 7) !== 0) {
+          throw new Error('Bad packet length');
+        }
+      }
+
+      // Read padding length, payload, and padding
+      if (this._pktLen < this._len) {
+        if (p >= dataLen)
+          return;
+        const nb = Math.min(this._len - this._pktLen, dataLen - p);
+        let encrypted;
+        if (p !== 0 || nb !== dataLen)
+          encrypted = new Uint8Array(data.buffer, data.byteOffset + p, nb);
+        else
+          encrypted = data;
+        if (nb === this._len) {
+          this._packet = encrypted;
+        } else {
+          if (!this._packet)
+            this._packet = Buffer.allocUnsafe(this._len);
+          this._packet.set(encrypted, this._pktLen);
+        }
+        p += nb;
+        this._pktLen += nb;
+        if (this._pktLen < this._len || p >= dataLen)
+          return;
+      }
+
+      // Read Poly1305 MAC
+      {
+        const nb = Math.min(16 - this._macPos, dataLen - p);
+        // TODO: avoid copying if entire MAC is in current chunk
+        if (p !== 0 || nb !== dataLen) {
+          this._mac.set(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb),
+            this._macPos
+          );
+        } else {
+          this._mac.set(data, this._macPos);
+        }
+        p += nb;
+        this._macPos += nb;
+        if (this._macPos < 16)
+          return;
+      }
+
+      // Generate Poly1305 key
+      CCP_OUT_COMPUTE[0] = 0; // Set counter to 0 (little endian)
+      writeUInt32BE(CCP_OUT_COMPUTE, this.inSeqno, 12);
+      const polyKey =
+        createCipheriv('chacha20', this._decKeyMain, CCP_OUT_COMPUTE)
+        .update(CCP_ZEROS);
+
+      // Calculate and compare Poly1305 MACs
+      poly1305_auth(CCP_RESULT_MALLOC,
+                    this._lenBuf,
+                    4,
+                    this._packet,
+                    this._packet.length,
+                    polyKey);
+
+      this._calcMac.set(
+        new Uint8Array(CCP_WASM_MODULE.HEAPU8.buffer, CCP_RESULT_MALLOC, 16),
+        0
+      );
+      if (!timingSafeEqual(this._calcMac, this._mac))
+        throw new Error('Invalid MAC');
+
+      // Decrypt packet
+      CCP_OUT_COMPUTE[0] = 1; // Set counter to 1 (little endian)
+      const packet =
+        createDecipheriv('chacha20', this._decKeyMain, CCP_OUT_COMPUTE)
+        .update(this._packet);
+
+      const payload = new FastBuffer(packet.buffer,
+                                     packet.byteOffset + 1,
+                                     packet.length - packet[0] - 1);
+
+      // Prepare for next packet
+      this.inSeqno = (this.inSeqno + 1) >>> 0;
+      this._len = 0;
+      this._lenPos = 0;
+      this._packet = null;
+      this._pktLen = 0;
+      this._macPos = 0;
+
+      {
+        const ret = this._onPayload(payload);
+        if (ret !== undefined)
+          return (ret === false ? p : ret);
+      }
+    }
+  }
+}
+
+class ChaChaPolyDecipherBinding {
+  constructor(config) {
+    const dec = config.inbound;
+    this.inSeqno = dec.seqno;
+    this._onPayload = dec.onPayload;
+    this._instance = new ChaChaPolyDecipher(dec.decipherKey);
+    this._len = 0;
+    this._lenBuf = Buffer.alloc(4);
+    this._lenPos = 0;
+    this._packet = null;
+    this._pktLen = 0;
+    this._mac = Buffer.allocUnsafe(16);
+    this._macPos = 0;
+  }
+  free() {
+    this._instance.free();
+  }
+  decrypt(data, p, dataLen) {
+    // `data` === encrypted data
+
+    while (p < dataLen) {
+      // Read packet length
+      if (this._lenPos < 4) {
+        let nb = Math.min(4 - this._lenPos, dataLen - p);
+        while (nb--)
+          this._lenBuf[this._lenPos++] = data[p++];
+        if (this._lenPos < 4)
+          return;
+
+        this._len = this._instance.decryptLen(this._lenBuf, this.inSeqno);
+
+        if (this._len > MAX_PACKET_SIZE
+            || this._len < 8
+            || (this._len & 7) !== 0) {
+          throw new Error('Bad packet length');
+        }
+
+        if (p >= dataLen)
+          return;
+      }
+
+      // Read padding length, payload, and padding
+      if (this._pktLen < this._len) {
+        const nb = Math.min(this._len - this._pktLen, dataLen - p);
+        let encrypted;
+        if (p !== 0 || nb !== dataLen)
+          encrypted = new Uint8Array(data.buffer, data.byteOffset + p, nb);
+        else
+          encrypted = data;
+        if (nb === this._len) {
+          this._packet = encrypted;
+        } else {
+          if (!this._packet)
+            this._packet = Buffer.allocUnsafe(this._len);
+          this._packet.set(encrypted, this._pktLen);
+        }
+        p += nb;
+        this._pktLen += nb;
+        if (this._pktLen < this._len || p >= dataLen)
+          return;
+      }
+
+      // Read Poly1305 MAC
+      {
+        const nb = Math.min(16 - this._macPos, dataLen - p);
+        // TODO: avoid copying if entire MAC is in current chunk
+        if (p !== 0 || nb !== dataLen) {
+          this._mac.set(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb),
+            this._macPos
+          );
+        } else {
+          this._mac.set(data, this._macPos);
+        }
+        p += nb;
+        this._macPos += nb;
+        if (this._macPos < 16)
+          return;
+      }
+
+      this._instance.decrypt(this._packet, this._mac, this.inSeqno);
+
+      const payload = new FastBuffer(this._packet.buffer,
+                                     this._packet.byteOffset + 1,
+                                     this._packet.length - this._packet[0] - 1);
+
+      // Prepare for next packet
+      this.inSeqno = (this.inSeqno + 1) >>> 0;
+      this._len = 0;
+      this._lenPos = 0;
+      this._packet = null;
+      this._pktLen = 0;
+      this._macPos = 0;
+
+      {
+        const ret = this._onPayload(payload);
+        if (ret !== undefined)
+          return (ret === false ? p : ret);
+      }
+    }
+  }
+}
+
+class AESGCMDecipherNative {
+  constructor(config) {
+    const dec = config.inbound;
+    this.inSeqno = dec.seqno;
+    this._onPayload = dec.onPayload;
+    this._decipherInstance = null;
+    this._decipherSSLName = dec.decipherInfo.sslName;
+    this._decipherKey = dec.decipherKey;
+    this._decipherIV = dec.decipherIV;
+    this._len = 0;
+    this._lenBytes = 0;
+    this._packet = null;
+    this._packetPos = 0;
+    this._pktLen = 0;
+    this._tag = Buffer.allocUnsafe(16);
+    this._tagPos = 0;
+  }
+  free() {}
+  decrypt(data, p, dataLen) {
+    // `data` === encrypted data
+
+    while (p < dataLen) {
+      // Read packet length (unencrypted, but AAD)
+      if (this._lenBytes < 4) {
+        let nb = Math.min(4 - this._lenBytes, dataLen - p);
+        this._lenBytes += nb;
+        while (nb--)
+          this._len = (this._len << 8) + data[p++];
+        if (this._lenBytes < 4)
+          return;
+
+        if ((this._len + 20) > MAX_PACKET_SIZE
+            || this._len < 16
+            || (this._len & 15) !== 0) {
+          throw new Error('Bad packet length');
+        }
+
+        this._decipherInstance = createDecipheriv(
+          this._decipherSSLName,
+          this._decipherKey,
+          this._decipherIV
+        );
+        this._decipherInstance.setAutoPadding(false);
+        this._decipherInstance.setAAD(intToBytes(this._len));
+      }
+
+      // Read padding length, payload, and padding
+      if (this._pktLen < this._len) {
+        if (p >= dataLen)
+          return;
+        const nb = Math.min(this._len - this._pktLen, dataLen - p);
+        let decrypted;
+        if (p !== 0 || nb !== dataLen) {
+          decrypted = this._decipherInstance.update(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb)
+          );
+        } else {
+          decrypted = this._decipherInstance.update(data);
+        }
+        if (decrypted.length) {
+          if (nb === this._len) {
+            this._packet = decrypted;
+          } else {
+            if (!this._packet)
+              this._packet = Buffer.allocUnsafe(this._len);
+            this._packet.set(decrypted, this._packetPos);
+          }
+          this._packetPos += decrypted.length;
+        }
+        p += nb;
+        this._pktLen += nb;
+        if (this._pktLen < this._len || p >= dataLen)
+          return;
+      }
+
+      // Read authentication tag
+      {
+        const nb = Math.min(16 - this._tagPos, dataLen - p);
+        if (p !== 0 || nb !== dataLen) {
+          this._tag.set(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb),
+            this._tagPos
+          );
+        } else {
+          this._tag.set(data, this._tagPos);
+        }
+        p += nb;
+        this._tagPos += nb;
+        if (this._tagPos < 16)
+          return;
+      }
+
+      {
+        // Verify authentication tag
+        this._decipherInstance.setAuthTag(this._tag);
+
+        const decrypted = this._decipherInstance.final();
+
+        // XXX: this should never output any data since stream ciphers always
+        // return data from .update() and block ciphers must end on a multiple
+        // of the block length, which would have caused an exception to be
+        // thrown if the total input was not...
+        if (decrypted.length) {
+          if (this._packet)
+            this._packet.set(decrypted, this._packetPos);
+          else
+            this._packet = decrypted;
+        }
+      }
+
+      const payload = (!this._packet
+                       ? EMPTY_BUFFER
+                       : new FastBuffer(this._packet.buffer,
+                                        this._packet.byteOffset + 1,
+                                        this._packet.length
+                                          - this._packet[0] - 1));
+
+      // Prepare for next packet
+      this.inSeqno = (this.inSeqno + 1) >>> 0;
+      ivIncrement(this._decipherIV);
+      this._len = 0;
+      this._lenBytes = 0;
+      this._packet = null;
+      this._packetPos = 0;
+      this._pktLen = 0;
+      this._tagPos = 0;
+
+      {
+        const ret = this._onPayload(payload);
+        if (ret !== undefined)
+          return (ret === false ? p : ret);
+      }
+    }
+  }
+}
+
+class AESGCMDecipherBinding {
+  constructor(config) {
+    const dec = config.inbound;
+    this.inSeqno = dec.seqno;
+    this._onPayload = dec.onPayload;
+    this._instance = new AESGCMDecipher(dec.decipherInfo.sslName,
+                                        dec.decipherKey,
+                                        dec.decipherIV);
+    this._len = 0;
+    this._lenBytes = 0;
+    this._packet = null;
+    this._pktLen = 0;
+    this._tag = Buffer.allocUnsafe(16);
+    this._tagPos = 0;
+  }
+  free() {}
+  decrypt(data, p, dataLen) {
+    // `data` === encrypted data
+
+    while (p < dataLen) {
+      // Read packet length (unencrypted, but AAD)
+      if (this._lenBytes < 4) {
+        let nb = Math.min(4 - this._lenBytes, dataLen - p);
+        this._lenBytes += nb;
+        while (nb--)
+          this._len = (this._len << 8) + data[p++];
+        if (this._lenBytes < 4)
+          return;
+
+        if ((this._len + 20) > MAX_PACKET_SIZE
+            || this._len < 16
+            || (this._len & 15) !== 0) {
+          throw new Error(`Bad packet length: ${this._len}`);
+        }
+      }
+
+      // Read padding length, payload, and padding
+      if (this._pktLen < this._len) {
+        if (p >= dataLen)
+          return;
+        const nb = Math.min(this._len - this._pktLen, dataLen - p);
+        let encrypted;
+        if (p !== 0 || nb !== dataLen)
+          encrypted = new Uint8Array(data.buffer, data.byteOffset + p, nb);
+        else
+          encrypted = data;
+        if (nb === this._len) {
+          this._packet = encrypted;
+        } else {
+          if (!this._packet)
+            this._packet = Buffer.allocUnsafe(this._len);
+          this._packet.set(encrypted, this._pktLen);
+        }
+        p += nb;
+        this._pktLen += nb;
+        if (this._pktLen < this._len || p >= dataLen)
+          return;
+      }
+
+      // Read authentication tag
+      {
+        const nb = Math.min(16 - this._tagPos, dataLen - p);
+        if (p !== 0 || nb !== dataLen) {
+          this._tag.set(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb),
+            this._tagPos
+          );
+        } else {
+          this._tag.set(data, this._tagPos);
+        }
+        p += nb;
+        this._tagPos += nb;
+        if (this._tagPos < 16)
+          return;
+      }
+
+      this._instance.decrypt(this._packet, this._len, this._tag);
+
+      const payload = new FastBuffer(this._packet.buffer,
+                                     this._packet.byteOffset + 1,
+                                     this._packet.length - this._packet[0] - 1);
+
+      // Prepare for next packet
+      this.inSeqno = (this.inSeqno + 1) >>> 0;
+      this._len = 0;
+      this._lenBytes = 0;
+      this._packet = null;
+      this._pktLen = 0;
+      this._tagPos = 0;
+
+      {
+        const ret = this._onPayload(payload);
+        if (ret !== undefined)
+          return (ret === false ? p : ret);
+      }
+    }
+  }
+}
+
+// TODO: test incremental .update()s vs. copying to _packet and doing a single
+// .update() after entire packet read -- a single .update() would allow
+// verifying MAC before decrypting for ETM MACs
+class GenericDecipherNative {
+  constructor(config) {
+    const dec = config.inbound;
+    this.inSeqno = dec.seqno;
+    this._onPayload = dec.onPayload;
+    this._decipherInstance = createDecipheriv(dec.decipherInfo.sslName,
+                                              dec.decipherKey,
+                                              dec.decipherIV);
+    this._decipherInstance.setAutoPadding(false);
+    this._block = Buffer.allocUnsafe(
+      dec.macInfo.isETM ? 4 : dec.decipherInfo.blockLen
+    );
+    this._blockSize = dec.decipherInfo.blockLen;
+    this._blockPos = 0;
+    this._len = 0;
+    this._packet = null;
+    this._packetPos = 0;
+    this._pktLen = 0;
+    this._mac = Buffer.allocUnsafe(dec.macInfo.actualLen);
+    this._macPos = 0;
+    this._macSSLName = dec.macInfo.sslName;
+    this._macKey = dec.macKey;
+    this._macActualLen = dec.macInfo.actualLen;
+    this._macETM = dec.macInfo.isETM;
+    this._macInstance = null;
+
+    const discardLen = dec.decipherInfo.discardLen;
+    if (discardLen) {
+      let discard = DISCARD_CACHE.get(discardLen);
+      if (discard === undefined) {
+        discard = Buffer.alloc(discardLen);
+        DISCARD_CACHE.set(discardLen, discard);
+      }
+      this._decipherInstance.update(discard);
+    }
+  }
+  free() {}
+  decrypt(data, p, dataLen) {
+    // `data` === encrypted data
+
+    while (p < dataLen) {
+      // Read first encrypted block
+      if (this._blockPos < this._block.length) {
+        const nb = Math.min(this._block.length - this._blockPos, dataLen - p);
+        if (p !== 0 || nb !== dataLen || nb < data.length) {
+          this._block.set(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb),
+            this._blockPos
+          );
+        } else {
+          this._block.set(data, this._blockPos);
+        }
+
+        p += nb;
+        this._blockPos += nb;
+        if (this._blockPos < this._block.length)
+          return;
+
+        let decrypted;
+        let need;
+        if (this._macETM) {
+          this._len = need = readUInt32BE(this._block, 0);
+        } else {
+          // Decrypt first block to get packet length
+          decrypted = this._decipherInstance.update(this._block);
+          this._len = readUInt32BE(decrypted, 0);
+          need = 4 + this._len - this._blockSize;
+        }
+
+        if (this._len > MAX_PACKET_SIZE
+            || this._len < 5
+            || (need & (this._blockSize - 1)) !== 0) {
+          throw new Error('Bad packet length');
+        }
+
+        // Create MAC up front to calculate in parallel with decryption
+        this._macInstance = createHmac(this._macSSLName, this._macKey);
+
+        writeUInt32BE(BUF_INT, this.inSeqno, 0);
+        this._macInstance.update(BUF_INT);
+        if (this._macETM) {
+          this._macInstance.update(this._block);
+        } else {
+          this._macInstance.update(new Uint8Array(decrypted.buffer,
+                                                  decrypted.byteOffset,
+                                                  4));
+          this._pktLen = decrypted.length - 4;
+          this._packetPos = this._pktLen;
+          this._packet = Buffer.allocUnsafe(this._len);
+          this._packet.set(
+            new Uint8Array(decrypted.buffer,
+                           decrypted.byteOffset + 4,
+                           this._packetPos),
+            0
+          );
+        }
+
+        if (p >= dataLen)
+          return;
+      }
+
+      // Read padding length, payload, and padding
+      if (this._pktLen < this._len) {
+        const nb = Math.min(this._len - this._pktLen, dataLen - p);
+        let encrypted;
+        if (p !== 0 || nb !== dataLen)
+          encrypted = new Uint8Array(data.buffer, data.byteOffset + p, nb);
+        else
+          encrypted = data;
+        if (this._macETM)
+          this._macInstance.update(encrypted);
+        const decrypted = this._decipherInstance.update(encrypted);
+        if (decrypted.length) {
+          if (nb === this._len) {
+            this._packet = decrypted;
+          } else {
+            if (!this._packet)
+              this._packet = Buffer.allocUnsafe(this._len);
+            this._packet.set(decrypted, this._packetPos);
+          }
+          this._packetPos += decrypted.length;
+        }
+        p += nb;
+        this._pktLen += nb;
+        if (this._pktLen < this._len || p >= dataLen)
+          return;
+      }
+
+      // Read MAC
+      {
+        const nb = Math.min(this._macActualLen - this._macPos, dataLen - p);
+        if (p !== 0 || nb !== dataLen) {
+          this._mac.set(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb),
+            this._macPos
+          );
+        } else {
+          this._mac.set(data, this._macPos);
+        }
+        p += nb;
+        this._macPos += nb;
+        if (this._macPos < this._macActualLen)
+          return;
+      }
+
+      // Verify MAC
+      if (!this._macETM)
+        this._macInstance.update(this._packet);
+      let calculated = this._macInstance.digest();
+      if (this._macActualLen < calculated.length) {
+        calculated = new Uint8Array(calculated.buffer,
+                                    calculated.byteOffset,
+                                    this._macActualLen);
+      }
+      if (!timingSafeEquals(calculated, this._mac))
+        throw new Error('Invalid MAC');
+
+      const payload = new FastBuffer(this._packet.buffer,
+                                     this._packet.byteOffset + 1,
+                                     this._packet.length - this._packet[0] - 1);
+
+      // Prepare for next packet
+      this.inSeqno = (this.inSeqno + 1) >>> 0;
+      this._blockPos = 0;
+      this._len = 0;
+      this._packet = null;
+      this._packetPos = 0;
+      this._pktLen = 0;
+      this._macPos = 0;
+      this._macInstance = null;
+
+      {
+        const ret = this._onPayload(payload);
+        if (ret !== undefined)
+          return (ret === false ? p : ret);
+      }
+    }
+  }
+}
+
+class GenericDecipherBinding {
+  constructor(config) {
+    const dec = config.inbound;
+    this.inSeqno = dec.seqno;
+    this._onPayload = dec.onPayload;
+    this._instance = new GenericDecipher(dec.decipherInfo.sslName,
+                                         dec.decipherKey,
+                                         dec.decipherIV,
+                                         dec.macInfo.sslName,
+                                         dec.macKey,
+                                         dec.macInfo.isETM,
+                                         dec.macInfo.actualLen);
+    this._block = Buffer.allocUnsafe(
+      dec.macInfo.isETM || dec.decipherInfo.stream
+      ? 4
+      : dec.decipherInfo.blockLen
+    );
+    this._blockPos = 0;
+    this._len = 0;
+    this._packet = null;
+    this._pktLen = 0;
+    this._mac = Buffer.allocUnsafe(dec.macInfo.actualLen);
+    this._macPos = 0;
+    this._macActualLen = dec.macInfo.actualLen;
+    this._macETM = dec.macInfo.isETM;
+  }
+  free() {
+    this._instance.free();
+  }
+  decrypt(data, p, dataLen) {
+    // `data` === encrypted data
+
+    while (p < dataLen) {
+      // Read first encrypted block
+      if (this._blockPos < this._block.length) {
+        const nb = Math.min(this._block.length - this._blockPos, dataLen - p);
+        if (p !== 0 || nb !== dataLen || nb < data.length) {
+          this._block.set(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb),
+            this._blockPos
+          );
+        } else {
+          this._block.set(data, this._blockPos);
+        }
+
+        p += nb;
+        this._blockPos += nb;
+        if (this._blockPos < this._block.length)
+          return;
+
+        let need;
+        if (this._macETM) {
+          this._len = need = readUInt32BE(this._block, 0);
+        } else {
+          // Decrypt first block to get packet length
+          this._instance.decryptBlock(this._block, this.inSeqno);
+          this._len = readUInt32BE(this._block, 0);
+          need = 4 + this._len - this._block.length;
+        }
+
+        if (this._len > MAX_PACKET_SIZE
+            || this._len < 5
+            || (need & (this._block.length - 1)) !== 0) {
+          throw new Error('Bad packet length');
+        }
+
+        if (!this._macETM) {
+          const pktStart = (this._block.length - 4);
+          const startP = p - pktStart;
+          let endP;
+          if (p >= pktStart && (endP = startP + this._len) <= dataLen) {
+            // The entire packet exists within the current chunk, with the
+            // first block already decrypted
+            if (startP === 0 && endP === dataLen) {
+              this._packet = data;
+              this._pktLen = this._len;
+            } else {
+              this._packet = new FastBuffer(
+                data.buffer,
+                data.byteOffset + startP,
+                this._len
+              );
+              this._pktLen = this._len;
+            }
+            p = endP;
+          } else {
+            this._pktLen = pktStart;
+            if (this._pktLen) {
+              this._packet = Buffer.allocUnsafe(this._len);
+              this._packet.set(
+                new Uint8Array(this._block.buffer,
+                               this._block.byteOffset + 4,
+                               this._pktLen),
+                0
+              );
+            }
+          }
+        }
+
+        if (p >= dataLen)
+          return;
+      }
+
+      // Read padding length, payload, and padding
+      if (this._pktLen < this._len) {
+        const nb = Math.min(this._len - this._pktLen, dataLen - p);
+        let encrypted;
+        if (p !== 0 || nb !== dataLen)
+          encrypted = new Uint8Array(data.buffer, data.byteOffset + p, nb);
+        else
+          encrypted = data;
+        if (nb === this._len) {
+          this._packet = encrypted;
+        } else {
+          if (!this._packet)
+            this._packet = Buffer.allocUnsafe(this._len);
+          this._packet.set(encrypted, this._pktLen);
+        }
+        p += nb;
+        this._pktLen += nb;
+        if (this._pktLen < this._len || p >= dataLen)
+          return;
+      }
+
+      // Read MAC
+      {
+        const nb = Math.min(this._macActualLen - this._macPos, dataLen - p);
+        if (p !== 0 || nb !== dataLen) {
+          this._mac.set(
+            new Uint8Array(data.buffer, data.byteOffset + p, nb),
+            this._macPos
+          );
+        } else {
+          this._mac.set(data, this._macPos);
+        }
+        p += nb;
+        this._macPos += nb;
+        if (this._macPos < this._macActualLen)
+          return;
+      }
+
+      // Decrypt and verify MAC
+      this._instance.decrypt(this._packet,
+                             this.inSeqno,
+                             this._block,
+                             this._mac);
+
+      const payload = new FastBuffer(this._packet.buffer,
+                                     this._packet.byteOffset + 1,
+                                     this._packet.length - this._packet[0] - 1);
+
+      // Prepare for next packet
+      this.inSeqno = (this.inSeqno + 1) >>> 0;
+      this._blockPos = 0;
+      this._len = 0;
+      this._packet = null;
+      this._pktLen = 0;
+      this._macPos = 0;
+      this._macInstance = null;
+
+      {
+        const ret = this._onPayload(payload);
+        if (ret !== undefined)
+          return (ret === false ? p : ret);
+      }
+    }
+  }
+}
+
+// Increments unsigned, big endian counter (last 8 bytes) of AES-GCM IV
+function ivIncrement(iv) {
+  ++iv[11] >>> 8
+  && ++iv[10] >>> 8
+  && ++iv[9] >>> 8
+  && ++iv[8] >>> 8
+  && ++iv[7] >>> 8
+  && ++iv[6] >>> 8
+  && ++iv[5] >>> 8
+  && ++iv[4] >>> 8;
+}
+
+const intToBytes = (() => {
+  const ret = Buffer.alloc(4);
+  return (n) => {
+    ret[0] = (n >>> 24);
+    ret[1] = (n >>> 16);
+    ret[2] = (n >>> 8);
+    ret[3] = n;
+    return ret;
+  };
+})();
+
+function timingSafeEquals(a, b) {
+  if (a.length !== b.length) {
+    timingSafeEqual(a, a);
+    return false;
+  }
+  return timingSafeEqual(a, b);
+}
+
+function createCipher(config) {
+  if (typeof config !== 'object' || config === null)
+    throw new Error('Invalid config');
+
+  if (typeof config.outbound !== 'object' || config.outbound === null)
+    throw new Error('Invalid outbound');
+
+  const outbound = config.outbound;
+
+  if (typeof outbound.onWrite !== 'function')
+    throw new Error('Invalid outbound.onWrite');
+
+  if (typeof outbound.cipherInfo !== 'object' || outbound.cipherInfo === null)
+    throw new Error('Invalid outbound.cipherInfo');
+
+  if (!Buffer.isBuffer(outbound.cipherKey)
+      || outbound.cipherKey.length !== outbound.cipherInfo.keyLen) {
+    throw new Error('Invalid outbound.cipherKey');
+  }
+
+  if (outbound.cipherInfo.ivLen
+      && (!Buffer.isBuffer(outbound.cipherIV)
+          || outbound.cipherIV.length !== outbound.cipherInfo.ivLen)) {
+    throw new Error('Invalid outbound.cipherIV');
+  }
+
+  if (typeof outbound.seqno !== 'number'
+      || outbound.seqno < 0
+      || outbound.seqno > MAX_SEQNO) {
+    throw new Error('Invalid outbound.seqno');
+  }
+
+  const forceNative = !!outbound.forceNative;
+
+  switch (outbound.cipherInfo.sslName) {
+    case 'aes-128-gcm':
+    case 'aes-256-gcm':
+      return (AESGCMCipher && !forceNative
+              ? new AESGCMCipherBinding(config)
+              : new AESGCMCipherNative(config));
+    case 'chacha20':
+      return (ChaChaPolyCipher && !forceNative
+              ? new ChaChaPolyCipherBinding(config)
+              : new ChaChaPolyCipherNative(config));
+    default: {
+      if (typeof outbound.macInfo !== 'object' || outbound.macInfo === null)
+        throw new Error('Invalid outbound.macInfo');
+      if (!Buffer.isBuffer(outbound.macKey)
+          || outbound.macKey.length !== outbound.macInfo.len) {
+        throw new Error('Invalid outbound.macKey');
+      }
+      return (GenericCipher && !forceNative
+              ? new GenericCipherBinding(config)
+              : new GenericCipherNative(config));
+    }
+  }
+}
+
+function createDecipher(config) {
+  if (typeof config !== 'object' || config === null)
+    throw new Error('Invalid config');
+
+  if (typeof config.inbound !== 'object' || config.inbound === null)
+    throw new Error('Invalid inbound');
+
+  const inbound = config.inbound;
+
+  if (typeof inbound.onPayload !== 'function')
+    throw new Error('Invalid inbound.onPayload');
+
+  if (typeof inbound.decipherInfo !== 'object'
+      || inbound.decipherInfo === null) {
+    throw new Error('Invalid inbound.decipherInfo');
+  }
+
+  if (!Buffer.isBuffer(inbound.decipherKey)
+      || inbound.decipherKey.length !== inbound.decipherInfo.keyLen) {
+    throw new Error('Invalid inbound.decipherKey');
+  }
+
+  if (inbound.decipherInfo.ivLen
+      && (!Buffer.isBuffer(inbound.decipherIV)
+          || inbound.decipherIV.length !== inbound.decipherInfo.ivLen)) {
+    throw new Error('Invalid inbound.decipherIV');
+  }
+
+  if (typeof inbound.seqno !== 'number'
+      || inbound.seqno < 0
+      || inbound.seqno > MAX_SEQNO) {
+    throw new Error('Invalid inbound.seqno');
+  }
+
+  const forceNative = !!inbound.forceNative;
+
+  switch (inbound.decipherInfo.sslName) {
+    case 'aes-128-gcm':
+    case 'aes-256-gcm':
+      return (AESGCMDecipher && !forceNative
+              ? new AESGCMDecipherBinding(config)
+              : new AESGCMDecipherNative(config));
+    case 'chacha20':
+      return (ChaChaPolyDecipher && !forceNative
+              ? new ChaChaPolyDecipherBinding(config)
+              : new ChaChaPolyDecipherNative(config));
+    default: {
+      if (typeof inbound.macInfo !== 'object' || inbound.macInfo === null)
+        throw new Error('Invalid inbound.macInfo');
+      if (!Buffer.isBuffer(inbound.macKey)
+          || inbound.macKey.length !== inbound.macInfo.len) {
+        throw new Error('Invalid inbound.macKey');
+      }
+      return (GenericDecipher && !forceNative
+              ? new GenericDecipherBinding(config)
+              : new GenericDecipherNative(config));
+    }
+  }
+}
+
+module.exports = {
+  CIPHER_INFO,
+  MAC_INFO,
+  bindingAvailable: !!binding,
+
+  NullCipher,
+  createCipher,
+  NullDecipher,
+  createDecipher,
+};

@@ -0,0 +1,21 @@
+
+var b;b||(b=typeof Module !== 'undefined' ? Module : {});var q={},t;for(t in b)b.hasOwnProperty(t)&&(q[t]=b[t]);var v=!1,w=!1,x=!1,y=!1;v="object"===typeof window;w="function"===typeof importScripts;x="object"===typeof process&&"object"===typeof process.versions&&"string"===typeof process.versions.node;y=!v&&!x&&!w;var z="",B,C,D,E;
+if(x)z=w?require("path").dirname(z)+"/":__dirname+"/",B=function(a,c){var d=F(a);if(d)return c?d:d.toString();D||(D=require("fs"));E||(E=require("path"));a=E.normalize(a);return D.readFileSync(a,c?null:"utf8")},C=function(a){a=B(a,!0);a.buffer||(a=new Uint8Array(a));assert(a.buffer);return a},1<process.argv.length&&process.argv[1].replace(/\\/g,"/"),process.argv.slice(2),"undefined"!==typeof module&&(module.exports=b),process.on("unhandledRejection",G),b.inspect=function(){return"[Emscripten Module object]"};
+else if(y)"undefined"!=typeof read&&(B=function(a){var c=F(a);return c?H(c):read(a)}),C=function(a){var c;if(c=F(a))return c;if("function"===typeof readbuffer)return new Uint8Array(readbuffer(a));c=read(a,"binary");assert("object"===typeof c);return c},"undefined"!==typeof print&&("undefined"===typeof console&&(console={}),console.log=print,console.warn=console.error="undefined"!==typeof printErr?printErr:print);else if(v||w)w?z=self.location.href:document.currentScript&&(z=document.currentScript.src),
+z=0!==z.indexOf("blob:")?z.substr(0,z.lastIndexOf("/")+1):"",B=function(a){try{var c=new XMLHttpRequest;c.open("GET",a,!1);c.send(null);return c.responseText}catch(d){if(a=F(a))return H(a);throw d;}},w&&(C=function(a){try{var c=new XMLHttpRequest;c.open("GET",a,!1);c.responseType="arraybuffer";c.send(null);return new Uint8Array(c.response)}catch(d){if(a=F(a))return a;throw d;}});var ba=b.print||console.log.bind(console),I=b.printErr||console.warn.bind(console);
+for(t in q)q.hasOwnProperty(t)&&(b[t]=q[t]);q=null;var J;b.wasmBinary&&(J=b.wasmBinary);var noExitRuntime;b.noExitRuntime&&(noExitRuntime=b.noExitRuntime);"object"!==typeof WebAssembly&&I("no native wasm support detected");var K,ca=new WebAssembly.Table({initial:1,maximum:1,element:"anyfunc"}),L=!1;function assert(a,c){a||G("Assertion failed: "+c)}function M(a){var c=b["_"+a];assert(c,"Cannot call unknown function "+a+", make sure it is exported");return c}
+function da(a,c,d,e){var k={string:function(f){var n=0;if(null!==f&&void 0!==f&&0!==f){var m=(f.length<<2)+1;n=N(m);var h=n,g=O;if(0<m){m=h+m-1;for(var u=0;u<f.length;++u){var l=f.charCodeAt(u);if(55296<=l&&57343>=l){var na=f.charCodeAt(++u);l=65536+((l&1023)<<10)|na&1023}if(127>=l){if(h>=m)break;g[h++]=l}else{if(2047>=l){if(h+1>=m)break;g[h++]=192|l>>6}else{if(65535>=l){if(h+2>=m)break;g[h++]=224|l>>12}else{if(h+3>=m)break;g[h++]=240|l>>18;g[h++]=128|l>>12&63}g[h++]=128|l>>6&63}g[h++]=128|l&63}}g[h]=
+0}}return n},array:function(f){var n=N(f.length);P.set(f,n);return n}},p=M(a),A=[];a=0;if(e)for(var r=0;r<e.length;r++){var aa=k[d[r]];aa?(0===a&&(a=ea()),A[r]=aa(e[r])):A[r]=e[r]}d=p.apply(null,A);d=function(f){if("string"===c)if(f){for(var n=O,m=f+NaN,h=f;n[h]&&!(h>=m);)++h;if(16<h-f&&n.subarray&&fa)f=fa.decode(n.subarray(f,h));else{for(m="";f<h;){var g=n[f++];if(g&128){var u=n[f++]&63;if(192==(g&224))m+=String.fromCharCode((g&31)<<6|u);else{var l=n[f++]&63;g=224==(g&240)?(g&15)<<12|u<<6|l:(g&7)<<
+18|u<<12|l<<6|n[f++]&63;65536>g?m+=String.fromCharCode(g):(g-=65536,m+=String.fromCharCode(55296|g>>10,56320|g&1023))}}else m+=String.fromCharCode(g)}f=m}}else f="";else f="boolean"===c?!!f:f;return f}(d);0!==a&&ha(a);return d}var fa="undefined"!==typeof TextDecoder?new TextDecoder("utf8"):void 0;"undefined"!==typeof TextDecoder&&new TextDecoder("utf-16le");var Q,P,O,ia;
+function ja(a){Q=a;b.HEAP8=P=new Int8Array(a);b.HEAP16=new Int16Array(a);b.HEAP32=ia=new Int32Array(a);b.HEAPU8=O=new Uint8Array(a);b.HEAPU16=new Uint16Array(a);b.HEAPU32=new Uint32Array(a);b.HEAPF32=new Float32Array(a);b.HEAPF64=new Float64Array(a)}var ka=b.INITIAL_MEMORY||16777216;b.wasmMemory?K=b.wasmMemory:K=new WebAssembly.Memory({initial:ka/65536,maximum:32768});K&&(Q=K.buffer);ka=Q.byteLength;ja(Q);ia[384]=5244576;
+function R(a){for(;0<a.length;){var c=a.shift();if("function"==typeof c)c(b);else{var d=c.j;"number"===typeof d?void 0===c.i?b.dynCall_v(d):b.dynCall_vi(d,c.i):d(void 0===c.i?null:c.i)}}}var la=[],ma=[],oa=[],pa=[];function qa(){var a=b.preRun.shift();la.unshift(a)}var S=0,T=null,U=null;b.preloadedImages={};b.preloadedAudios={};function G(a){if(b.onAbort)b.onAbort(a);ba(a);I(a);L=!0;throw new WebAssembly.RuntimeError("abort("+a+"). Build with -s ASSERTIONS=1 for more info.");}
+var V="data:application/octet-stream;base64,",W="data:application/octet-stream;base64,AGFzbQEAAAABJQdgAX8Bf2ACf38AYAF/AGADf39/AGAAAGAGf39/f39/AGAAAX8CFwIBYQFhAAABYQZtZW1vcnkCAYACgIACAw4NAAMDAgABBQECAAYBBAYJAX8BQYCMwAILBx0HAWIADQFjAAcBZAAFAWUABAFmAAsBZwAKAWgACQrkSw1BAQJ/PwAhAQJAQYAMKAIAIgIgAEEDakF8cWoiACABQRB0TQ0AIAAQAA0AQYAIQTA2AgBBfw8LQYAMIAA2AgAgAguVBQIKfw5+IAAoAiQhBiAAKAIgIQcgACgCHCEDIAAoAhghBCAAKAIUIQUgAkEQTwRAIAAtAExFQRh0IQkgACgCBCIIQQVsrSEZIAAoAggiCkEFbK0hFyAAKAIMIgtBBWytIRUgACgCECIMQQVsrSETIAytIRogC60hGCAKrSEWIAitIRQgADUCACESA0AgBCABLQADIgQgAS0ABEEIdHIgAS0ABUEQdHIgAS0ABiIIQRh0ckECdkH///8fcWqtIg0gGH4gBEEYdEGAgIAYcSABLwAAIAEtAAJBEHRyciAFaq0iDiAafnwgAyABLQAHQQh0IAhyIAEtAAhBEHRyIAEtAAkiA0EYdHJBBHZB////H3FqrSIPIBZ+fCABLQAKQQh0IANyIAEtAAtBEHRyIAEtAAxBGHRyQQZ2IAdqrSIQIBR+fCAJIAEtAA1yIAEtAA5BCHRyIAEtAA9BEHRyIAZqrSIRIBJ+fCANIBZ+IA4gGH58IA8gFH58IBAgEn58IBEgE358IA0gFH4gDiAWfnwgDyASfnwgECATfnwgESAVfnwgDSASfiAOIBR+fCAPIBN+fCAQIBV+fCARIBd+fCANIBN+IA4gEn58IA8gFX58IBAgF358IBEgGX58Ig1CGohC/////w+DfCIOQhqIQv////8Pg3wiD0IaiEL/////D4N8IhBCGohC/////w+DfCIRQhqIp0EFbCANp0H///8fcWoiBUEadiAOp0H///8fcWohBCAPp0H///8fcSEDIBCnQf///x9xIQcgEadB////H3EhBiAFQf///x9xIQUgAUEQaiEBIAJBcGoiAkEPSw0ACwsgACAGNgIkIAAgBzYCICAAIAM2AhwgACAENgIYIAAgBTYCFAvxAQEEfwJAIAAoAjgiBARAIAJBECAEayIDIAMgAksbIgUEQCAAQTxqIQZBACEDA0AgBiADIARqaiABIANqLQAAOgAAIAAoAjghBCADQQFqIgMgBUcNAAsLIAAgBCAFaiIDNgI4IANBEEkNASAAIABBPGpBEBACIABBADYCOCACIAVrIQIgASAFaiEBCyACQRBPBEAgACABIAJBcHEiAxACIAJBD3EhAiABIANqIQELIAJFDQAgAEE8aiEEQQAhAwNAIAQgACgCOCADamogASADai0AADoAACADQQFqIgMgAkcNAAsgACAAKAI4IAJqNgI4CwuBDQEHfwJAIABFDQAgAEF4aiIDIABBfGooAgAiAUF4cSIAaiEFAkAgAUEBcQ0AIAFBA3FFDQEgAyADKAIAIgJrIgNBlAgoAgAiBEkNASAAIAJqIQAgA0GYCCgCAEcEQCACQf8BTQRAIAMoAggiBCACQQN2IgJBA3RBrAhqRxogBCADKAIMIgFGBEBBhAhBhAgoAgBBfiACd3E2AgAMAwsgBCABNgIMIAEgBDYCCAwCCyADKAIYIQYCQCADIAMoAgwiAUcEQCAEIAMoAggiAk0EQCACKAIMGgsgAiABNgIMIAEgAjYCCAwBCwJAIANBFGoiAigCACIEDQAgA0EQaiICKAIAIgQNAEEAIQEMAQsDQCACIQcgBCIBQRRqIgIoAgAiBA0AIAFBEGohAiABKAIQIgQNAAsgB0EANgIACyAGRQ0BAkAgAyADKAIcIgJBAnRBtApqIgQoAgBGBEAgBCABNgIAIAENAUGICEGICCgCAEF+IAJ3cTYCAAwDCyAGQRBBFCAGKAIQIANGG2ogATYCACABRQ0CCyABIAY2AhggAygCECICBEAgASACNgIQIAIgATYCGAsgAygCFCICRQ0BIAEgAjYCFCACIAE2AhgMAQsgBSgCBCIBQQNxQQNHDQBBjAggADYCACAFIAFBfnE2AgQgAyAAQQFyNgIEIAAgA2ogADYCAA8LIAUgA00NACAFKAIEIgFBAXFFDQACQCABQQJxRQRAIAVBnAgoAgBGBEBBnAggAzYCAEGQCEGQCCgCACAAaiIANgIAIAMgAEEBcjYCBCADQZgIKAIARw0DQYwIQQA2AgBBmAhBADYCAA8LIAVBmAgoAgBGBEBBmAggAzYCAEGMCEGMCCgCACAAaiIANgIAIAMgAEEBcjYCBCAAIANqIAA2AgAPCyABQXhxIABqIQACQCABQf8BTQRAIAUoAgwhAiAFKAIIIgQgAUEDdiIBQQN0QawIaiIHRwRAQZQIKAIAGgsgAiAERgRAQYQIQYQIKAIAQX4gAXdxNgIADAILIAIgB0cEQEGUCCgCABoLIAQgAjYCDCACIAQ2AggMAQsgBSgCGCEGAkAgBSAFKAIMIgFHBEBBlAgoAgAgBSgCCCICTQRAIAIoAgwaCyACIAE2AgwgASACNgIIDAELAkAgBUEUaiICKAIAIgQNACAFQRBqIgIoAgAiBA0AQQAhAQwBCwNAIAIhByAEIgFBFGoiAigCACIEDQAgAUEQaiECIAEoAhAiBA0ACyAHQQA2AgALIAZFDQACQCAFIAUoAhwiAkECdEG0CmoiBCgCAEYEQCAEIAE2AgAgAQ0BQYgIQYgIKAIAQX4gAndxNgIADAILIAZBEEEUIAYoAhAgBUYbaiABNgIAIAFFDQELIAEgBjYCGCAFKAIQIgIEQCABIAI2AhAgAiABNgIYCyAFKAIUIgJFDQAgASACNgIUIAIgATYCGAsgAyAAQQFyNgIEIAAgA2ogADYCACADQZgIKAIARw0BQYwIIAA2AgAPCyAFIAFBfnE2AgQgAyAAQQFyNgIEIAAgA2ogADYCAAsgAEH/AU0EQCAAQQN2IgFBA3RBrAhqIQACf0GECCgCACICQQEgAXQiAXFFBEBBhAggASACcjYCACAADAELIAAoAggLIQIgACADNgIIIAIgAzYCDCADIAA2AgwgAyACNgIIDwsgA0IANwIQIAMCf0EAIABBCHYiAUUNABpBHyAAQf///wdLDQAaIAEgAUGA/j9qQRB2QQhxIgF0IgIgAkGA4B9qQRB2QQRxIgJ0IgQgBEGAgA9qQRB2QQJxIgR0QQ92IAEgAnIgBHJrIgFBAXQgACABQRVqdkEBcXJBHGoLIgI2AhwgAkECdEG0CmohAQJAAkACQEGICCgCACIEQQEgAnQiB3FFBEBBiAggBCAHcjYCACABIAM2AgAgAyABNgIYDAELIABBAEEZIAJBAXZrIAJBH0YbdCECIAEoAgAhAQNAIAEiBCgCBEF4cSAARg0CIAJBHXYhASACQQF0IQIgBCABQQRxaiIHQRBqKAIAIgENAAsgByADNgIQIAMgBDYCGAsgAyADNgIMIAMgAzYCCAwBCyAEKAIIIgAgAzYCDCAEIAM2AgggA0EANgIYIAMgBDYCDCADIAA2AggLQaQIQaQIKAIAQX9qIgA2AgAgAA0AQcwLIQMDQCADKAIAIgBBCGohAyAADQALQaQIQX82AgALC8YtAQt/IwBBEGsiCyQAAkACQAJAAkACQAJAAkACQAJAAkACQCAAQfQBTQRAQYQIKAIAIgZBECAAQQtqQXhxIABBC0kbIgVBA3YiAHYiAUEDcQRAIAFBf3NBAXEgAGoiAkEDdCIEQbQIaigCACIBQQhqIQACQCABKAIIIgMgBEGsCGoiBEYEQEGECCAGQX4gAndxNgIADAELQZQIKAIAGiADIAQ2AgwgBCADNgIICyABIAJBA3QiAkEDcjYCBCABIAJqIgEgASgCBEEBcjYCBAwMCyAFQYwIKAIAIghNDQEgAQRAAkBBAiAAdCICQQAgAmtyIAEgAHRxIgBBACAAa3FBf2oiACAAQQx2QRBxIgB2IgFBBXZBCHEiAiAAciABIAJ2IgBBAnZBBHEiAXIgACABdiIAQQF2QQJxIgFyIAAgAXYiAEEBdkEBcSIBciAAIAF2aiICQQN0IgNBtAhqKAIAIgEoAggiACADQawIaiIDRgRAQYQIIAZBfiACd3EiBjYCAAwBC0GUCCgCABogACADNgIMIAMgADYCCAsgAUEIaiEAIAEgBUEDcjYCBCABIAVqIgcgAkEDdCICIAVrIgNBAXI2AgQgASACaiADNgIAIAgEQCAIQQN2IgRBA3RBrAhqIQFBmAgoAgAhAgJ/IAZBASAEdCIEcUUEQEGECCAEIAZyNgIAIAEMAQsgASgCCAshBCABIAI2AgggBCACNgIMIAIgATYCDCACIAQ2AggLQZgIIAc2AgBBjAggAzYCAAwMC0GICCgCACIKRQ0BIApBACAKa3FBf2oiACAAQQx2QRBxIgB2IgFBBXZBCHEiAiAAciABIAJ2IgBBAnZBBHEiAXIgACABdiIAQQF2QQJxIgFyIAAgAXYiAEEBdkEBcSIBciAAIAF2akECdEG0CmooAgAiASgCBEF4cSAFayEDIAEhAgNAAkAgAigCECIARQRAIAIoAhQiAEUNAQsgACgCBEF4cSAFayICIAMgAiADSSICGyEDIAAgASACGyEBIAAhAgwBCwsgASgCGCEJIAEgASgCDCIERwRAQZQIKAIAIAEoAggiAE0EQCAAKAIMGgsgACAENgIMIAQgADYCCAwLCyABQRRqIgIoAgAiAEUEQCABKAIQIgBFDQMgAUEQaiECCwNAIAIhByAAIgRBFGoiAigCACIADQAgBEEQaiECIAQoAhAiAA0ACyAHQQA2AgAMCgtBfyEFIABBv39LDQAgAEELaiIAQXhxIQVBiAgoAgAiB0UNAEEAIAVrIQICQAJAAkACf0EAIABBCHYiAEUNABpBHyAFQf///wdLDQAaIAAgAEGA/j9qQRB2QQhxIgB0IgEgAUGA4B9qQRB2QQRxIgF0IgMgA0GAgA9qQRB2QQJxIgN0QQ92IAAgAXIgA3JrIgBBAXQgBSAAQRVqdkEBcXJBHGoLIghBAnRBtApqKAIAIgNFBEBBACEADAELIAVBAEEZIAhBAXZrIAhBH0YbdCEBQQAhAANAAkAgAygCBEF4cSAFayIGIAJPDQAgAyEEIAYiAg0AQQAhAiADIQAMAwsgACADKAIUIgYgBiADIAFBHXZBBHFqKAIQIgNGGyAAIAYbIQAgASADQQBHdCEBIAMNAAsLIAAgBHJFBEBBAiAIdCIAQQAgAGtyIAdxIgBFDQMgAEEAIABrcUF/aiIAIABBDHZBEHEiAHYiAUEFdkEIcSIDIAByIAEgA3YiAEECdkEEcSIBciAAIAF2IgBBAXZBAnEiAXIgACABdiIAQQF2QQFxIgFyIAAgAXZqQQJ0QbQKaigCACEACyAARQ0BCwNAIAAoAgRBeHEgBWsiAyACSSEBIAMgAiABGyECIAAgBCABGyEEIAAoAhAiAQR/IAEFIAAoAhQLIgANAAsLIARFDQAgAkGMCCgCACAFa08NACAEKAIYIQggBCAEKAIMIgFHBEBBlAgoAgAgBCgCCCIATQRAIAAoAgwaCyAAIAE2AgwgASAANgIIDAkLIARBFGoiAygCACIARQRAIAQoAhAiAEUNAyAEQRBqIQMLA0AgAyEGIAAiAUEUaiIDKAIAIgANACABQRBqIQMgASgCECIADQALIAZBADYCAAwIC0GMCCgCACIBIAVPBEBBmAgoAgAhAAJAIAEgBWsiAkEQTwRAQYwIIAI2AgBBmAggACAFaiIDNgIAIAMgAkEBcjYCBCAAIAFqIAI2AgAgACAFQQNyNgIEDAELQZgIQQA2AgBBjAhBADYCACAAIAFBA3I2AgQgACABaiIBIAEoAgRBAXI2AgQLIABBCGohAAwKC0GQCCgCACIBIAVLBEBBkAggASAFayIBNgIAQZwIQZwIKAIAIgAgBWoiAjYCACACIAFBAXI2AgQgACAFQQNyNgIEIABBCGohAAwKC0EAIQAgBUEvaiIEAn9B3AsoAgAEQEHkCygCAAwBC0HoC0J/NwIAQeALQoCggICAgAQ3AgBB3AsgC0EMakFwcUHYqtWqBXM2AgBB8AtBADYCAEHAC0EANgIAQYAgCyICaiIGQQAgAmsiB3EiAiAFTQ0JQbwLKAIAIgMEQEG0CygCACIIIAJqIgkgCE0NCiAJIANLDQoLQcALLQAAQQRxDQQCQAJAQZwIKAIAIgMEQEHECyEAA0AgACgCACIIIANNBEAgCCAAKAIEaiADSw0DCyAAKAIIIgANAAsLQQAQASIBQX9GDQUgAiEGQeALKAIAIgBBf2oiAyABcQRAIAIgAWsgASADakEAIABrcWohBgsgBiAFTQ0FIAZB/v///wdLDQVBvAsoAgAiAARAQbQLKAIAIgMgBmoiByADTQ0GIAcgAEsNBgsgBhABIgAgAUcNAQwHCyAGIAFrIAdxIgZB/v///wdLDQQgBhABIgEgACgCACAAKAIEakYNAyABIQALAkAgBUEwaiAGTQ0AIABBf0YNAEHkCygCACIBIAQgBmtqQQAgAWtxIgFB/v///wdLBEAgACEBDAcLIAEQAUF/RwRAIAEgBmohBiAAIQEMBwtBACAGaxABGgwECyAAIgFBf0cNBQwDC0EAIQQMBwtBACEBDAULIAFBf0cNAgtBwAtBwAsoAgBBBHI2AgALIAJB/v///wdLDQEgAhABIgFBABABIgBPDQEgAUF/Rg0BIABBf0YNASAAIAFrIgYgBUEoak0NAQtBtAtBtAsoAgAgBmoiADYCACAAQbgLKAIASwRAQbgLIAA2AgALAkACQAJAQZwIKAIAIgMEQEHECyEAA0AgASAAKAIAIgIgACgCBCIEakYNAiAAKAIIIgANAAsMAgtBlAgoAgAiAEEAIAEgAE8bRQRAQZQIIAE2AgALQQAhAEHICyAGNgIAQcQLIAE2AgBBpAhBfzYCAEGoCEHcCygCADYCAEHQC0EANgIAA0AgAEEDdCICQbQIaiACQawIaiIDNgIAIAJBuAhqIAM2AgAgAEEBaiIAQSBHDQALQZAIIAZBWGoiAEF4IAFrQQdxQQAgAUEIakEHcRsiAmsiAzYCAEGcCCABIAJqIgI2AgAgAiADQQFyNgIEIAAgAWpBKDYCBEGgCEHsCygCADYCAAwCCyAALQAMQQhxDQAgASADTQ0AIAIgA0sNACAAIAQgBmo2AgRBnAggA0F4IANrQQdxQQAgA0EIakEHcRsiAGoiATYCAEGQCEGQCCgCACAGaiICIABrIgA2AgAgASAAQQFyNgIEIAIgA2pBKDYCBEGgCEHsCygCADYCAAwBCyABQZQIKAIAIgRJBEBBlAggATYCACABIQQLIAEgBmohAkHECyEAAkACQAJAAkACQAJAA0AgAiAAKAIARwRAIAAoAggiAA0BDAILCyAALQAMQQhxRQ0BC0HECyEAA0AgACgCACICIANNBEAgAiAAKAIEaiIEIANLDQMLIAAoAgghAAwAAAsACyAAIAE2AgAgACAAKAIEIAZqNgIEIAFBeCABa0EHcUEAIAFBCGpBB3EbaiIJIAVBA3I2AgQgAkF4IAJrQQdxQQAgAkEIakEHcRtqIgEgCWsgBWshACAFIAlqIQcgASADRgRAQZwIIAc2AgBBkAhBkAgoAgAgAGoiADYCACAHIABBAXI2AgQMAwsgAUGYCCgCAEYEQEGYCCAHNgIAQYwIQYwIKAIAIABqIgA2AgAgByAAQQFyNgIEIAAgB2ogADYCAAwDCyABKAIEIgJBA3FBAUYEQCACQXhxIQoCQCACQf8BTQRAIAEoAggiAyACQQN2IgRBA3RBrAhqRxogAyABKAIMIgJGBEBBhAhBhAgoAgBBfiAEd3E2AgAMAgsgAyACNgIMIAIgAzYCCAwBCyABKAIYIQgCQCABIAEoAgwiBkcEQCAEIAEoAggiAk0EQCACKAIMGgsgAiAGNgIMIAYgAjYCCAwBCwJAIAFBFGoiAygCACIFDQAgAUEQaiIDKAIAIgUNAEEAIQYMAQsDQCADIQIgBSIGQRRqIgMoAgAiBQ0AIAZBEGohAyAGKAIQIgUNAAsgAkEANgIACyAIRQ0AAkAgASABKAIcIgJBAnRBtApqIgMoAgBGBEAgAyAGNgIAIAYNAUGICEGICCgCAEF+IAJ3cTYCAAwCCyAIQRBBFCAIKAIQIAFGG2ogBjYCACAGRQ0BCyAGIAg2AhggASgCECICBEAgBiACNgIQIAIgBjYCGAsgASgCFCICRQ0AIAYgAjYCFCACIAY2AhgLIAEgCmohASAAIApqIQALIAEgASgCBEF+cTYCBCAHIABBAXI2AgQgACAHaiAANgIAIABB/wFNBEAgAEEDdiIBQQN0QawIaiEAAn9BhAgoAgAiAkEBIAF0IgFxRQRAQYQIIAEgAnI2AgAgAAwBCyAAKAIICyEBIAAgBzYCCCABIAc2AgwgByAANgIMIAcgATYCCAwDCyAHAn9BACAAQQh2IgFFDQAaQR8gAEH///8HSw0AGiABIAFBgP4/akEQdkEIcSIBdCICIAJBgOAfakEQdkEEcSICdCIDIANBgIAPakEQdkECcSIDdEEPdiABIAJyIANyayIBQQF0IAAgAUEVanZBAXFyQRxqCyIBNgIcIAdCADcCECABQQJ0QbQKaiECAkBBiAgoAgAiA0EBIAF0IgRxRQRAQYgIIAMgBHI2AgAgAiAHNgIADAELIABBAEEZIAFBAXZrIAFBH0YbdCEDIAIoAgAhAQNAIAEiAigCBEF4cSAARg0DIANBHXYhASADQQF0IQMgAiABQQRxaiIEKAIQIgENAAsgBCAHNgIQCyAHIAI2AhggByAHNgIMIAcgBzYCCAwCC0GQCCAGQVhqIgBBeCABa0EHcUEAIAFBCGpBB3EbIgJrIgc2AgBBnAggASACaiICNgIAIAIgB0EBcjYCBCAAIAFqQSg2AgRBoAhB7AsoAgA2AgAgAyAEQScgBGtBB3FBACAEQVlqQQdxG2pBUWoiACAAIANBEGpJGyICQRs2AgQgAkHMCykCADcCECACQcQLKQIANwIIQcwLIAJBCGo2AgBByAsgBjYCAEHECyABNgIAQdALQQA2AgAgAkEYaiEAA0AgAEEHNgIEIABBCGohASAAQQRqIQAgBCABSw0ACyACIANGDQMgAiACKAIEQX5xNgIEIAMgAiADayIEQQFyNgIEIAIgBDYCACAEQf8BTQRAIARBA3YiAUEDdEGsCGohAAJ/QYQIKAIAIgJBASABdCIBcUUEQEGECCABIAJyNgIAIAAMAQsgACgCCAshASAAIAM2AgggASADNgIMIAMgADYCDCADIAE2AggMBAsgA0IANwIQIAMCf0EAIARBCHYiAEUNABpBHyAEQf///wdLDQAaIAAgAEGA/j9qQRB2QQhxIgB0IgEgAUGA4B9qQRB2QQRxIgF0IgIgAkGAgA9qQRB2QQJxIgJ0QQ92IAAgAXIgAnJrIgBBAXQgBCAAQRVqdkEBcXJBHGoLIgA2AhwgAEECdEG0CmohAQJAQYgIKAIAIgJBASAAdCIGcUUEQEGICCACIAZyNgIAIAEgAzYCACADIAE2AhgMAQsgBEEAQRkgAEEBdmsgAEEfRht0IQAgASgCACEBA0AgASICKAIEQXhxIARGDQQgAEEddiEBIABBAXQhACACIAFBBHFqIgYoAhAiAQ0ACyAGIAM2AhAgAyACNgIYCyADIAM2AgwgAyADNgIIDAMLIAIoAggiACAHNgIMIAIgBzYCCCAHQQA2AhggByACNgIMIAcgADYCCAsgCUEIaiEADAULIAIoAggiACADNgIMIAIgAzYCCCADQQA2AhggAyACNgIMIAMgADYCCAtBkAgoAgAiACAFTQ0AQZAIIAAgBWsiATYCAEGcCEGcCCgCACIAIAVqIgI2AgAgAiABQQFyNgIEIAAgBUEDcjYCBCAAQQhqIQAMAwtBgAhBMDYCAEEAIQAMAgsCQCAIRQ0AAkAgBCgCHCIAQQJ0QbQKaiIDKAIAIARGBEAgAyABNgIAIAENAUGICCAHQX4gAHdxIgc2AgAMAgsgCEEQQRQgCCgCECAERhtqIAE2AgAgAUUNAQsgASAINgIYIAQoAhAiAARAIAEgADYCECAAIAE2AhgLIAQoAhQiAEUNACABIAA2AhQgACABNgIYCwJAIAJBD00EQCAEIAIgBWoiAEEDcjYCBCAAIARqIgAgACgCBEEBcjYCBAwBCyAEIAVBA3I2AgQgBCAFaiIDIAJBAXI2AgQgAiADaiACNgIAIAJB/wFNBEAgAkEDdiIBQQN0QawIaiEAAn9BhAgoAgAiAkEBIAF0IgFxRQRAQYQIIAEgAnI2AgAgAAwBCyAAKAIICyEBIAAgAzYCCCABIAM2AgwgAyAANgIMIAMgATYCCAwBCyADAn9BACACQQh2IgBFDQAaQR8gAkH///8HSw0AGiAAIABBgP4/akEQdkEIcSIAdCIBIAFBgOAfakEQdkEEcSIBdCIFIAVBgIAPakEQdkECcSIFdEEPdiAAIAFyIAVyayIAQQF0IAIgAEEVanZBAXFyQRxqCyIANgIcIANCADcCECAAQQJ0QbQKaiEBAkACQCAHQQEgAHQiBXFFBEBBiAggBSAHcjYCACABIAM2AgAMAQsgAkEAQRkgAEEBdmsgAEEfRht0IQAgASgCACEFA0AgBSIBKAIEQXhxIAJGDQIgAEEddiEFIABBAXQhACABIAVBBHFqIgYoAhAiBQ0ACyAGIAM2AhALIAMgATYCGCADIAM2AgwgAyADNgIIDAELIAEoAggiACADNgIMIAEgAzYCCCADQQA2AhggAyABNgIMIAMgADYCCAsgBEEIaiEADAELAkAgCUUNAAJAIAEoAhwiAEECdEG0CmoiAigCACABRgRAIAIgBDYCACAEDQFBiAggCkF+IAB3cTYCAAwCCyAJQRBBFCAJKAIQIAFGG2ogBDYCACAERQ0BCyAEIAk2AhggASgCECIABEAgBCAANgIQIAAgBDYCGAsgASgCFCIARQ0AIAQgADYCFCAAIAQ2AhgLAkAgA0EPTQRAIAEgAyAFaiIAQQNyNgIEIAAgAWoiACAAKAIEQQFyNgIEDAELIAEgBUEDcjYCBCABIAVqIgQgA0EBcjYCBCADIARqIAM2AgAgCARAIAhBA3YiBUEDdEGsCGohAEGYCCgCACECAn9BASAFdCIFIAZxRQRAQYQIIAUgBnI2AgAgAAwBCyAAKAIICyEFIAAgAjYCCCAFIAI2AgwgAiAANgIMIAIgBTYCCAtBmAggBDYCAEGMCCADNgIACyABQQhqIQALIAtBEGokACAAC9YCAQF/AkAgAUUNACAAIAFqIgJBf2pBADoAACAAQQA6AAAgAUEDSQ0AIAJBfmpBADoAACAAQQA6AAEgAkF9akEAOgAAIABBADoAAiABQQdJDQAgAkF8akEAOgAAIABBADoAAyABQQlJDQAgAEEAIABrQQNxIgJqIgBBADYCACAAIAEgAmtBfHEiAmoiAUF8akEANgIAIAJBCUkNACAAQQA2AgggAEEANgIEIAFBeGpBADYCACABQXRqQQA2AgAgAkEZSQ0AIABBADYCGCAAQQA2AhQgAEEANgIQIABBADYCDCABQXBqQQA2AgAgAUFsakEANgIAIAFBaGpBADYCACABQWRqQQA2AgAgAiAAQQRxQRhyIgJrIgFBIEkNACAAIAJqIQADQCAAQgA3AxggAEIANwMQIABCADcDCCAAQgA3AwAgAEEgaiEAIAFBYGoiAUEfSw0ACwsLNwEBfyMAQZABayIGJAAgBiAFEAwgBiABIAIQAyAEBEAgBiADIAQQAwsgBiAAEAggBkGQAWokAAvJBAILfwR+IAAoAjgiAwRAIABBPGoiAiADakEBOgAAIANBAWpBD00EQCAAIANqQT1qQQ8gA2sQBgsgAEEBOgBMIAAgAkEQEAILIAA1AjQhECAANQIwIQ4gADUCLCENIAEgADUCKCAAKAIkIAAoAiAgACgCHCAAKAIYIgZBGnZqIgNBGnZqIgJBGnZqIghBgICAYHIgAkH///8fcSIKIANB////H3EiCyAAKAIUIAhBGnZBBWxqIgJB////H3EiBEEFaiIHQRp2IAZB////H3EgAkEadmoiDGoiAkEadmoiA0EadmoiBkEadmoiCUEfdSIFIARxIAcgCUEfdkF/aiIHQf///x9xIgRxciAFIAxxIAIgBHFyIgJBGnRyrXwiDzwAACABIA0gBSALcSADIARxciIDQRR0IAJBBnZyrXwgD0IgiHwiDTwABCABIA+nIgJBGHY6AAMgASACQRB2OgACIAEgAkEIdjoAASABIA4gBSAKcSAEIAZxciICQQ50IANBDHZyrXwgDUIgiHwiDjwACCABIA2nIgNBGHY6AAcgASADQRB2OgAGIAEgA0EIdjoABSABIBAgByAJcSAFIAhxckEIdCACQRJ2cq18IA5CIIh8Ig08AAwgASAOpyICQRh2OgALIAEgAkEQdjoACiABIAJBCHY6AAkgASANpyICQRh2OgAPIAEgAkEQdjoADiABIAJBCHY6AA0gAEIANwIwIABCADcCKCAAQgA3AiAgAEIANwIYIABCADcCECAAQgA3AgggAEIANwIACwYAIAAkAAsQACMAIABrQXBxIgAkACAACwQAIwALzgEBAn8gACABLQADQRh0QYCAgBhxIAEvAAAgAS0AAkEQdHJyNgIAIAAgASgAA0ECdkGD/v8fcTYCBCAAIAEoAAZBBHZB/4H/H3E2AgggACABKAAJQQZ2Qf//wB9xNgIMIAEvAA0hAiABLQAPIQMgAEIANwIUIABCADcCHCAAQQA2AiQgACACIANBEHRBgIA8cXI2AhAgACABKAAQNgIoIAAgASgAFDYCLCAAIAEoABg2AjAgASgAHCEBIABBADoATCAAQQA2AjggACABNgI0CwMAAQs=";if(String.prototype.startsWith?!W.startsWith(V):0!==W.indexOf(V)){var ra=W;W=b.locateFile?b.locateFile(ra,z):z+ra}function sa(){try{if(J)return new Uint8Array(J);var a=F(W);if(a)return a;if(C)return C(W);throw"sync fetching of the wasm failed: you can preload it to Module['wasmBinary'] manually, or emcc.py will do that for you when generating HTML (but not JS)";}catch(c){G(c)}}ma.push({j:function(){ta()}});
+var ua=!1;function H(a){for(var c=[],d=0;d<a.length;d++){var e=a[d];255<e&&(ua&&assert(!1,"Character code "+e+" ("+String.fromCharCode(e)+")  at offset "+d+" not in 0x00-0xFF."),e&=255);c.push(String.fromCharCode(e))}return c.join("")}
+var va="function"===typeof atob?atob:function(a){var c="",d=0;a=a.replace(/[^A-Za-z0-9\+\/=]/g,"");do{var e="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(a.charAt(d++));var k="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(a.charAt(d++));var p="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(a.charAt(d++));var A="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(a.charAt(d++));e=e<<2|k>>4;
+k=(k&15)<<4|p>>2;var r=(p&3)<<6|A;c+=String.fromCharCode(e);64!==p&&(c+=String.fromCharCode(k));64!==A&&(c+=String.fromCharCode(r))}while(d<a.length);return c};
+function F(a){if(String.prototype.startsWith?a.startsWith(V):0===a.indexOf(V)){a=a.slice(V.length);if("boolean"===typeof x&&x){try{var c=Buffer.from(a,"base64")}catch(p){c=new Buffer(a,"base64")}var d=new Uint8Array(c.buffer,c.byteOffset,c.byteLength)}else try{var e=va(a),k=new Uint8Array(e.length);for(c=0;c<e.length;++c)k[c]=e.charCodeAt(c);d=k}catch(p){throw Error("Converting base64 string to bytes failed.");}return d}}
+var wa={a:function(a){var c=O.length;if(2147483648<a)return!1;for(var d=1;4>=d;d*=2){var e=c*(1+.2/d);e=Math.min(e,a+100663296);e=Math.max(16777216,a,e);0<e%65536&&(e+=65536-e%65536);a:{try{K.grow(Math.min(2147483648,e)-Q.byteLength+65535>>>16);ja(K.buffer);var k=1;break a}catch(p){}k=void 0}if(k)return!0}return!1},memory:K,table:ca},X=function(){function a(d){b.asm=d.exports;S--;b.monitorRunDependencies&&b.monitorRunDependencies(S);0==S&&(null!==T&&(clearInterval(T),T=null),U&&(d=U,U=null,d()))}
+var c={a:wa};S++;b.monitorRunDependencies&&b.monitorRunDependencies(S);if(b.instantiateWasm)try{return b.instantiateWasm(c,a)}catch(d){return I("Module.instantiateWasm callback failed with error: "+d),!1}(function(){try{var d=sa();var e=new WebAssembly.Module(d);var k=new WebAssembly.Instance(e,c)}catch(p){throw k=p.toString(),I("failed to compile wasm module: "+k),(0<=k.indexOf("imported Memory")||0<=k.indexOf("memory import"))&&I("Memory size incompatibility issues may be due to changing INITIAL_MEMORY at runtime to something too large. Use ALLOW_MEMORY_GROWTH to allow any size memory (and also make sure not to set INITIAL_MEMORY at runtime to something smaller than it was at compile time)."),
+p;}a(k,e)})();return b.asm}(),ta=b.___wasm_call_ctors=X.b;b._poly1305_auth=X.c;b._malloc=X.d;b._free=X.e;var ea=b.stackSave=X.f,N=b.stackAlloc=X.g,ha=b.stackRestore=X.h;b.asm=X;b.cwrap=function(a,c,d,e){d=d||[];var k=d.every(function(p){return"number"===p});return"string"!==c&&k&&!e?M(a):function(){return da(a,c,d,arguments)}};var Y;U=function xa(){Y||Z();Y||(U=xa)};
+function Z(){function a(){if(!Y&&(Y=!0,b.calledRun=!0,!L)){R(ma);R(oa);if(b.onRuntimeInitialized)b.onRuntimeInitialized();if(b.postRun)for("function"==typeof b.postRun&&(b.postRun=[b.postRun]);b.postRun.length;){var c=b.postRun.shift();pa.unshift(c)}R(pa)}}if(!(0<S)){if(b.preRun)for("function"==typeof b.preRun&&(b.preRun=[b.preRun]);b.preRun.length;)qa();R(la);0<S||(b.setStatus?(b.setStatus("Running..."),setTimeout(function(){setTimeout(function(){b.setStatus("")},1);a()},1)):a())}}b.run=Z;
+if(b.preInit)for("function"==typeof b.preInit&&(b.preInit=[b.preInit]);0<b.preInit.length;)b.preInit.pop()();noExitRuntime=!0;Z();

@@ -0,0 +1,2081 @@
+// TODO: switch from obsolete EVP_* APIs in CCP
+#include <stdio.h>
+#include <string.h>
+#include <assert.h>
+
+#include <node.h>
+#include <node_buffer.h>
+#include <nan.h>
+
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/hmac.h>
+
+using namespace node;
+using namespace v8;
+using namespace std;
+
+//~ int hexdump(FILE *fd, void const *data, size_t length, int linelen, int split)
+//~ {
+	//~ char buffer[512];
+	//~ char *ptr;
+	//~ const void *inptr;
+	//~ int pos;
+	//~ int remaining = length;
+
+	//~ inptr = data;
+
+	//~ /*
+	 //~ *	Assert that the buffer is large enough. This should pretty much
+	 //~ *	always be the case...
+	 //~ *
+	 //~ *	hex/ascii gap (2 chars) + closing \0 (1 char)
+	 //~ *	split = 4 chars (2 each for hex/ascii) * number of splits
+	 //~ *
+	 //~ *	(hex = 3 chars, ascii = 1 char) * linelen number of chars
+	 //~ */
+	//~ assert(sizeof(buffer) >= (3 + (4 * (linelen / split)) + (linelen * 4)));
+
+	//~ /*
+	 //~ *	Loop through each line remaining
+	 //~ */
+	//~ while (remaining > 0) {
+		//~ int lrem;
+		//~ int splitcount;
+		//~ ptr = buffer;
+
+		//~ /*
+		 //~ *	Loop through the hex chars of this line
+		 //~ */
+		//~ lrem = remaining;
+		//~ splitcount = 0;
+		//~ for (pos = 0; pos < linelen; pos++) {
+
+			//~ /* Split hex section if required */
+			//~ if (split == splitcount++) {
+				//~ sprintf(ptr, "  ");
+				//~ ptr += 2;
+				//~ splitcount = 1;
+			//~ }
+
+			//~ /* If still remaining chars, output, else leave a space */
+			//~ if (lrem) {
+				//~ sprintf(ptr, "%0.2x ", *((unsigned char *) inptr + pos));
+				//~ lrem--;
+			//~ } else {
+				//~ sprintf(ptr, "   ");
+			//~ }
+			//~ ptr += 3;
+		//~ }
+
+		//~ *ptr++ = ' ';
+		//~ *ptr++ = ' ';
+
+		//~ /*
+		 //~ *	Loop through the ASCII chars of this line
+		 //~ */
+		//~ lrem = remaining;
+		//~ splitcount = 0;
+		//~ for (pos = 0; pos < linelen; pos++) {
+			//~ unsigned char c;
+
+			//~ /* Split ASCII section if required */
+			//~ if (split == splitcount++) {
+				//~ sprintf(ptr, "  ");
+				//~ ptr += 2;
+				//~ splitcount = 1;
+			//~ }
+
+			//~ if (lrem) {
+				//~ c = *((unsigned char *) inptr + pos);
+				//~ if (c > 31 && c < 127) {
+					//~ sprintf(ptr, "%c", c);
+				//~ } else {
+					//~ sprintf(ptr, ".");
+				//~ }
+				//~ lrem--;
+		//~ /*
+		 //~ *	These two lines would pad out the last line with spaces
+		 //~ *	which seems a bit pointless generally.
+		 //~ */
+		//~ /*
+			//~ } else {
+				//~ sprintf(ptr, " ");
+		//~ */
+
+			//~ }
+			//~ ptr++;
+		//~ }
+
+		//~ *ptr = '\0';
+		//~ fprintf(fd, "%s\n", buffer);
+
+		//~ inptr += linelen;
+		//~ remaining -= linelen;
+	//~ }
+
+	//~ return 0;
+//~ }
+
+struct MarkPopErrorOnReturn {
+  MarkPopErrorOnReturn() { ERR_set_mark(); }
+  ~MarkPopErrorOnReturn() { ERR_pop_to_mark(); }
+};
+
+enum ErrorType {
+  kErrNone,
+  kErrOpenSSL,
+  kErrBadIVLen,
+  kErrBadKeyLen,
+  kErrAADFailure,
+  kErrTagFailure,
+  kErrPartialEncrypt,
+  kErrBadCipherName,
+  kErrBadHMACName,
+  kErrBadHMACLen,
+  kErrBadInit,
+  kErrPartialDecrypt,
+  kErrInvalidMAC,
+  kErrBadBlockLen
+};
+
+#define POLY1305_KEYLEN   32
+#define POLY1305_TAGLEN   16
+class ChaChaPolyCipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("ChaChaPolyCipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "encrypt", Encrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("ChaChaPolyCipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit ChaChaPolyCipher()
+    : ctx_main_(nullptr),
+      ctx_pktlen_(nullptr),
+      md_ctx_(nullptr),
+      polykey_(nullptr) {}
+
+  ~ChaChaPolyCipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_pktlen_) {
+      EVP_CIPHER_CTX_cleanup(ctx_pktlen_);
+      EVP_CIPHER_CTX_free(ctx_pktlen_);
+      ctx_pktlen_ = nullptr;
+    }
+    if (ctx_main_) {
+      EVP_CIPHER_CTX_cleanup(ctx_main_);
+      EVP_CIPHER_CTX_free(ctx_main_);
+      ctx_main_ = nullptr;
+    }
+    if (polykey_) {
+      EVP_PKEY_free(polykey_);
+      polykey_ = nullptr;
+    }
+    if (md_ctx_) {
+      EVP_MD_CTX_free(md_ctx_);
+      md_ctx_ = nullptr;
+    }
+    // `polykey_ctx_` is not explicitly freed as it is freed implicitly when
+    // `md_ctx_` is freed
+  }
+
+  ErrorType init(unsigned char* keys, size_t keys_len) {
+    ErrorType r = kErrNone;
+
+    if (keys_len != 64) {
+      r = kErrBadKeyLen;
+      goto out;
+    }
+
+    if ((ctx_pktlen_ = EVP_CIPHER_CTX_new()) == nullptr
+        || (ctx_main_ = EVP_CIPHER_CTX_new()) == nullptr
+        || (md_ctx_ = EVP_MD_CTX_new()) == nullptr
+        || EVP_EncryptInit_ex(ctx_pktlen_,
+                              EVP_chacha20(),
+                              nullptr,
+                              keys + 32,
+                              nullptr) != 1
+        || EVP_EncryptInit_ex(ctx_main_,
+                              EVP_chacha20(),
+                              nullptr,
+                              keys,
+                              nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_CIPHER_CTX_iv_length(ctx_pktlen_) != 16) {
+      r = kErrBadIVLen;
+      goto out;
+    }
+
+out:
+    if (r != kErrNone)
+      clear();
+    return r;
+  }
+
+  ErrorType encrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    uint32_t seqno) {
+    ErrorType r = kErrNone;
+    size_t sig_len = 16;
+    int outlen = 0;
+
+    // `packet` layout:
+    //   <packet length> <padding length> <payload> <padding> <poly1305 mac>
+    uint32_t data_len = packet_len - POLY1305_TAGLEN;
+
+    unsigned char polykey[POLY1305_KEYLEN] = {0};
+
+    uint8_t seqbuf[16] = {0};
+    ((uint8_t*)(seqbuf))[12] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[13] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[14] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[15] = seqno & 0xff;
+
+    // Generate Poly1305 key
+    if (EVP_EncryptInit_ex(ctx_main_, nullptr, nullptr, nullptr, seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_EncryptUpdate(ctx_main_,
+                          polykey,
+                          &outlen,
+                          polykey,
+                          sizeof(polykey)) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != sizeof(polykey)) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Encrypt packet length
+    if (EVP_EncryptInit_ex(ctx_pktlen_,
+                           nullptr,
+                           nullptr,
+                           nullptr,
+                           seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_EncryptUpdate(ctx_pktlen_, packet, &outlen, packet, 4) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != 4) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Encrypt rest of packet
+    seqbuf[0] = 1;
+    if (EVP_EncryptInit_ex(ctx_main_, nullptr, nullptr, nullptr, seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_EncryptUpdate(ctx_main_,
+                          packet + 4,
+                          &outlen,
+                          packet + 4,
+                          data_len - 4) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != data_len - 4) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Poly1305 over ciphertext
+    if (polykey_) {
+      if (EVP_PKEY_CTX_ctrl(polykey_ctx_,
+                            -1,
+                            EVP_PKEY_OP_SIGNCTX,
+                            EVP_PKEY_CTRL_SET_MAC_KEY,
+                            sizeof(polykey),
+                            (void*)polykey) <= 0) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+    } else {
+      polykey_ = EVP_PKEY_new_raw_private_key(EVP_PKEY_POLY1305,
+                                              nullptr,
+                                              polykey,
+                                              sizeof(polykey));
+      if (polykey_ == nullptr) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+
+      if (!EVP_DigestSignInit(md_ctx_,
+                              &polykey_ctx_,
+                              nullptr,
+                              nullptr,
+                              polykey_)) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+    }
+
+    // Generate and write Poly1305 tag
+    if (EVP_DigestSign(md_ctx_,
+                       packet + data_len,
+                       &sig_len,
+                       packet,
+                       data_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+  out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid keys");
+
+    ChaChaPolyCipher* obj = new ChaChaPolyCipher();
+    ErrorType r = obj->init(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0])
+    );
+    if (r != kErrNone) {
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        case kErrOpenSSL: {
+          char msg_buf[128] = {0};
+          ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+          return Nan::ThrowError(msg_buf);
+        }
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(Encrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    ChaChaPolyCipher* obj = ObjectWrap::Unwrap<ChaChaPolyCipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    ErrorType r = obj->encrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust()
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown encrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    ChaChaPolyCipher* obj = ObjectWrap::Unwrap<ChaChaPolyCipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_main_;
+  EVP_CIPHER_CTX* ctx_pktlen_;
+  EVP_MD_CTX* md_ctx_;
+  EVP_PKEY* polykey_;
+  EVP_PKEY_CTX* polykey_ctx_;
+};
+
+class AESGCMCipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("AESGCMCipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "encrypt", Encrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("AESGCMCipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit AESGCMCipher() : ctx_(nullptr) {}
+
+  ~AESGCMCipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_) {
+      EVP_CIPHER_CTX_cleanup(ctx_);
+      EVP_CIPHER_CTX_free(ctx_);
+      ctx_ = nullptr;
+    }
+  }
+
+  ErrorType init(const char* name,
+                 unsigned char* key,
+                 size_t key_len,
+                 unsigned char* iv,
+                 size_t iv_len) {
+    ErrorType r = kErrNone;
+
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname(name);
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (cipher != EVP_aes_128_gcm() && cipher != EVP_aes_256_gcm()) {
+      r = kErrBadCipherName;
+      goto out;
+    }
+
+    if ((ctx_ = EVP_CIPHER_CTX_new()) == nullptr
+        || EVP_EncryptInit_ex(ctx_, cipher, nullptr, nullptr, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_AEAD_SET_IVLEN, iv_len, nullptr)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    //~ if (iv_len != static_cast<size_t>(EVP_CIPHER_CTX_iv_length(ctx_))) {
+      //~ r = kErrBadIVLen;
+      //~ goto out;
+    //~ }
+
+    if (key_len != static_cast<size_t>(EVP_CIPHER_CTX_key_length(ctx_))) {
+      if (!EVP_CIPHER_CTX_set_key_length(ctx_, key_len)) {
+        r = kErrBadKeyLen;
+        goto out;
+      }
+    }
+
+    // Set key and IV
+    if (EVP_EncryptInit_ex(ctx_, nullptr, nullptr, key, iv) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_GCM_SET_IV_FIXED, -1, iv)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Disable padding
+    EVP_CIPHER_CTX_set_padding(ctx_, 0);
+
+out:
+    if (r != kErrNone)
+      clear();
+    return r;
+  }
+
+  ErrorType encrypt(unsigned char* packet, uint32_t packet_len) {
+    ErrorType r = kErrNone;
+
+    // `packet` layout:
+    //   <packet length> <padding length> <payload> <padding> <mac>
+    uint32_t data_len = packet_len - 16;
+
+    int outlen = 0;
+
+    // Increment IV
+    unsigned char lastiv[1];
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_GCM_IV_GEN, 1, lastiv)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Set AAD (the packet length)
+    if (!EVP_EncryptUpdate(ctx_, nullptr, &outlen, packet, 4)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (outlen != 4) {
+      r = kErrAADFailure;
+      goto out;
+    }
+
+    // Encrypt everything but the packet length
+    if (EVP_EncryptUpdate(ctx_,
+                          packet + 4,
+                          &outlen,
+                          packet + 4,
+                          data_len - 4) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != data_len - 4) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Generate authentication tag
+    if (!EVP_EncryptFinal_ex(ctx_, nullptr, &outlen)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Write authentication tag
+    if (EVP_CIPHER_CTX_ctrl(ctx_,
+                            EVP_CTRL_AEAD_GET_TAG,
+                            16,
+                            packet + data_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!info[0]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid OpenSSL cipher name");
+
+    if (!Buffer::HasInstance(info[1]))
+      return Nan::ThrowTypeError("Missing/Invalid key");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid iv");
+
+    const Nan::Utf8String cipher_name(info[0]);
+
+    AESGCMCipher* obj = new AESGCMCipher();
+    ErrorType r = obj->init(
+      *cipher_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Buffer::Length(info[1]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2])
+    );
+    if (r != kErrNone) {
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        case kErrBadCipherName:
+          return Nan::ThrowError("Invalid AES GCM cipher name");
+        case kErrOpenSSL: {
+          char msg_buf[128] = {0};
+          ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+          return Nan::ThrowError(msg_buf);
+        }
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(Encrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    AESGCMCipher* obj = ObjectWrap::Unwrap<AESGCMCipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    ErrorType r = obj->encrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0])
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrAADFailure:
+        return Nan::ThrowError("Error setting AAD");
+      case kErrPartialEncrypt:
+        return Nan::ThrowError("Failed to completely encrypt packet");
+      case kErrTagFailure:
+        return Nan::ThrowError("Error generating authentication tag");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown encrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    AESGCMCipher* obj = ObjectWrap::Unwrap<AESGCMCipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_;
+};
+
+class GenericCipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("GenericCipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "encrypt", Encrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("GenericCipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit GenericCipher()
+    : ctx_(nullptr),
+      ctx_hmac_(nullptr),
+      hmac_len_(0),
+      is_etm_(0) {}
+
+  ~GenericCipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_) {
+      EVP_CIPHER_CTX_cleanup(ctx_);
+      EVP_CIPHER_CTX_free(ctx_);
+      ctx_ = nullptr;
+    }
+    if (ctx_hmac_) {
+      HMAC_CTX_free(ctx_hmac_);
+      ctx_hmac_ = nullptr;
+    }
+  }
+
+  ErrorType init(const char* name,
+                 unsigned char* key,
+                 size_t key_len,
+                 unsigned char* iv,
+                 size_t iv_len,
+                 const char* hmac_name,
+                 unsigned char* hmac_key,
+                 size_t hmac_key_len,
+                 int is_etm) {
+    ErrorType r = kErrNone;
+
+    const EVP_MD* md;
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname(name);
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if ((ctx_ = EVP_CIPHER_CTX_new()) == nullptr
+        || EVP_EncryptInit_ex(ctx_, cipher, nullptr, nullptr, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (iv_len != static_cast<size_t>(EVP_CIPHER_CTX_iv_length(ctx_))) {
+      r = kErrBadIVLen;
+      goto out;
+    }
+
+    if (key_len != static_cast<size_t>(EVP_CIPHER_CTX_key_length(ctx_))) {
+      if (!EVP_CIPHER_CTX_set_key_length(ctx_, key_len)) {
+        r = kErrBadKeyLen;
+        goto out;
+      }
+    }
+
+    // Set key and IV
+    if (EVP_EncryptInit_ex(ctx_, nullptr, nullptr, key, iv) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Disable padding
+    EVP_CIPHER_CTX_set_padding(ctx_, 0);
+
+    if (cipher == EVP_rc4()) {
+      /* The "arcfour128" algorithm is the RC4 cipher, as described in
+         [SCHNEIER], using a 128-bit key.  The first 1536 bytes of keystream
+         generated by the cipher MUST be discarded, and the first byte of the
+         first encrypted packet MUST be encrypted using the 1537th byte of
+         keystream.
+
+         -- http://tools.ietf.org/html/rfc4345#section-4 */
+      unsigned char zeros[1536] = {0};
+      int outlen = sizeof(zeros);
+      if (EVP_EncryptUpdate(ctx_,
+                            zeros,
+                            &outlen,
+                            zeros,
+                            sizeof(zeros)) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != sizeof(zeros)) {
+        r = kErrBadInit;
+        goto out;
+      }
+    }
+
+    md = EVP_get_digestbyname(hmac_name);
+    if (md == nullptr) {
+      r = kErrBadHMACName;
+      goto out;
+    }
+
+    if ((ctx_hmac_ = HMAC_CTX_new()) == nullptr
+        || HMAC_Init_ex(ctx_hmac_, hmac_key, hmac_key_len, md, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    hmac_len_ = HMAC_size(ctx_hmac_);
+    is_etm_ = is_etm;
+
+out:
+    if (r != kErrNone)
+      clear();
+    return r;
+  }
+
+  ErrorType encrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    uint32_t seqno) {
+    ErrorType r = kErrNone;
+
+    // `packet` layout:
+    //   <packet length> <padding length> <payload> <padding> <mac>
+    uint32_t data_len = packet_len - hmac_len_;
+
+    int outlen;
+
+    uint8_t seqbuf[4] = {0};
+    ((uint8_t*)(seqbuf))[0] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[1] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[2] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[3] = seqno & 0xff;
+
+    if (is_etm_) {
+      // Encrypt everything but packet length
+      if (EVP_EncryptUpdate(ctx_,
+                            packet + 4,
+                            &outlen,
+                            packet + 4,
+                            data_len - 4) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != data_len - 4) {
+        r = kErrPartialEncrypt;
+        goto out;
+      }
+
+      // HMAC over unencrypted packet length and ciphertext
+      {
+        unsigned int outlen = hmac_len_;
+        if (HMAC_Init_ex(ctx_hmac_, nullptr, 0, nullptr, nullptr) != 1
+            || HMAC_Update(ctx_hmac_, seqbuf, sizeof(seqbuf)) != 1
+            || HMAC_Update(ctx_hmac_, packet, data_len) != 1
+            || HMAC_Final(ctx_hmac_, packet + data_len, &outlen) != 1) {
+          r = kErrOpenSSL;
+          goto out;
+        }
+        if (outlen != hmac_len_) {
+          r = kErrBadHMACLen;
+          goto out;
+        }
+      }
+    } else {
+      // HMAC over plaintext
+      {
+        unsigned int outlen = hmac_len_;
+        if (HMAC_Init_ex(ctx_hmac_, nullptr, 0, nullptr, nullptr) != 1
+            || HMAC_Update(ctx_hmac_, seqbuf, sizeof(seqbuf)) != 1
+            || HMAC_Update(ctx_hmac_, packet, data_len) != 1
+            || HMAC_Final(ctx_hmac_, packet + data_len, &outlen) != 1) {
+          r = kErrOpenSSL;
+          goto out;
+        }
+        if (outlen != hmac_len_) {
+          r = kErrBadHMACLen;
+          goto out;
+        }
+      }
+
+      // Encrypt packet
+      if (EVP_EncryptUpdate(ctx_,
+                            packet,
+                            &outlen,
+                            packet,
+                            data_len) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != data_len) {
+        
+        r = kErrPartialEncrypt;
+        goto out;
+      }
+    }
+
+out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!info[0]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid cipher name");
+
+    if (!Buffer::HasInstance(info[1]))
+      return Nan::ThrowTypeError("Missing/Invalid cipher key");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid cipher IV");
+
+    if (!info[3]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC name");
+
+    if (!Buffer::HasInstance(info[4]))
+      return Nan::ThrowTypeError("Missing/Invalid HMAC key");
+
+    if (!info[5]->IsBoolean())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC ETM flag");
+
+    const Nan::Utf8String cipher_name(info[0]);
+    const Nan::Utf8String mac_name(info[3]);
+    int is_etm = (Nan::To<bool>(info[5]).FromJust() ? 1 : 0);
+
+    GenericCipher* obj = new GenericCipher();
+    ErrorType r = obj->init(
+      *cipher_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Buffer::Length(info[1]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2]),
+      *mac_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[4])),
+      Buffer::Length(info[4]),
+      is_etm
+    );
+    if (r != kErrNone) {
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        case kErrBadCipherName:
+          return Nan::ThrowError("Invalid cipher name");
+        case kErrBadHMACName:
+          return Nan::ThrowError("Invalid MAC name");
+        case kErrBadInit:
+          return Nan::ThrowError("Failed to properly initialize cipher");
+        case kErrOpenSSL: {
+          char msg_buf[128] = {0};
+          ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+          return Nan::ThrowError(msg_buf);
+        }
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(Encrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    GenericCipher* obj = ObjectWrap::Unwrap<GenericCipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    ErrorType r = obj->encrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust()
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrPartialEncrypt:
+        return Nan::ThrowError("Failed to completely encrypt packet");
+      case kErrBadHMACLen:
+        return Nan::ThrowError("Unexpected HMAC length");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown encrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    GenericCipher* obj = ObjectWrap::Unwrap<GenericCipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_;
+  HMAC_CTX* ctx_hmac_;
+  unsigned int hmac_len_;
+  int is_etm_;
+};
+
+// =============================================================================
+
+class ChaChaPolyDecipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("ChaChaPolyDecipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "decrypt", Decrypt);
+    SetPrototypeMethod(tpl, "decryptLen", DecryptLen);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("ChaChaPolyDecipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit ChaChaPolyDecipher()
+    : ctx_main_(nullptr),
+      ctx_pktlen_(nullptr),
+      md_ctx_(nullptr),
+      polykey_(nullptr) {}
+
+  ~ChaChaPolyDecipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_pktlen_) {
+      EVP_CIPHER_CTX_cleanup(ctx_pktlen_);
+      EVP_CIPHER_CTX_free(ctx_pktlen_);
+      ctx_pktlen_ = nullptr;
+    }
+    if (ctx_main_) {
+      EVP_CIPHER_CTX_cleanup(ctx_main_);
+      EVP_CIPHER_CTX_free(ctx_main_);
+      ctx_main_ = nullptr;
+    }
+    if (polykey_) {
+      EVP_PKEY_free(polykey_);
+      polykey_ = nullptr;
+    }
+    if (md_ctx_) {
+      EVP_MD_CTX_free(md_ctx_);
+      md_ctx_ = nullptr;
+    }
+    // `polykey_ctx_` is not explicitly freed as it is freed implicitly when
+    // `md_ctx_` is freed
+  }
+
+  ErrorType init(unsigned char* keys, size_t keys_len) {
+    ErrorType r = kErrNone;
+
+    if (keys_len != 64) {
+      r = kErrBadKeyLen;
+      goto out;
+    }
+
+    if ((ctx_pktlen_ = EVP_CIPHER_CTX_new()) == nullptr
+        || (ctx_main_ = EVP_CIPHER_CTX_new()) == nullptr
+        || (md_ctx_ = EVP_MD_CTX_new()) == nullptr
+        || EVP_DecryptInit_ex(ctx_pktlen_,
+                              EVP_chacha20(),
+                              nullptr,
+                              keys + 32,
+                              nullptr) != 1
+        || EVP_DecryptInit_ex(ctx_main_,
+                              EVP_chacha20(),
+                              nullptr,
+                              keys,
+                              nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_CIPHER_CTX_iv_length(ctx_pktlen_) != 16) {
+      r = kErrBadIVLen;
+      goto out;
+    }
+
+out:
+    if (r != kErrNone)
+      clear();
+    return r;
+  }
+
+  ErrorType decrypt_length(unsigned char* data,
+                           size_t data_len,
+                           uint32_t seqno,
+                           uint32_t* packet_length) {
+    ErrorType r = kErrNone;
+    int outlen;
+
+    unsigned char dec_length_bytes[4];
+
+    uint8_t seqbuf[16] = {0};
+    ((uint8_t*)(seqbuf))[12] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[13] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[14] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[15] = seqno & 0xff;
+
+    if (EVP_DecryptInit_ex(ctx_pktlen_,
+                           nullptr,
+                           nullptr,
+                           nullptr,
+                           seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_DecryptUpdate(ctx_pktlen_,
+                          dec_length_bytes,
+                          &outlen,
+                          data,
+                          data_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != 4) {
+      r = kErrPartialDecrypt;
+      goto out;
+    }
+
+    *packet_length = (uint32_t)dec_length_bytes[0] << 24
+                     | (uint32_t)dec_length_bytes[1] << 16
+                     | (uint32_t)dec_length_bytes[2] << 8
+                     | (uint32_t)dec_length_bytes[3];
+    memcpy(length_bytes, data, data_len);
+out:
+    return r;
+  }
+
+  ErrorType decrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    unsigned char* mac,
+                    uint32_t seqno) {
+    ErrorType r = kErrNone;
+    size_t sig_len = 16;
+    int outlen = 0;
+
+    // `packet` layout:
+    //   <padding length> <payload> <padding>
+
+    unsigned char polykey[POLY1305_KEYLEN] = {0};
+    unsigned char calc_mac[POLY1305_TAGLEN] = {0};
+
+    uint8_t seqbuf[16] = {0};
+    ((uint8_t*)(seqbuf))[12] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[13] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[14] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[15] = seqno & 0xff;
+
+    // Generate Poly1305 key
+    if (EVP_EncryptInit_ex(ctx_main_, nullptr, nullptr, nullptr, seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_EncryptUpdate(ctx_main_,
+                          polykey,
+                          &outlen,
+                          polykey,
+                          sizeof(polykey)) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != sizeof(polykey)) {
+      r = kErrPartialEncrypt;
+      goto out;
+    }
+
+    // Poly1305 over ciphertext
+    if (polykey_) {
+      if (EVP_PKEY_CTX_ctrl(polykey_ctx_,
+                            -1,
+                            EVP_PKEY_OP_SIGNCTX,
+                            EVP_PKEY_CTRL_SET_MAC_KEY,
+                            sizeof(polykey),
+                            (void*)polykey) <= 0) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+    } else {
+      polykey_ = EVP_PKEY_new_raw_private_key(EVP_PKEY_POLY1305,
+                                              nullptr,
+                                              polykey,
+                                              sizeof(polykey));
+      if (polykey_ == nullptr) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+
+      if (!EVP_DigestSignInit(md_ctx_,
+                              &polykey_ctx_,
+                              nullptr,
+                              nullptr,
+                              polykey_)) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+    }
+    if (EVP_DigestSignUpdate(md_ctx_,
+                             length_bytes,
+                             sizeof(length_bytes)) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_DigestSignUpdate(md_ctx_, packet, packet_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Generate Poly1305 MAC
+    if (EVP_DigestSignFinal(md_ctx_, calc_mac, &sig_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Compare MACs
+    if (CRYPTO_memcmp(mac, calc_mac, sizeof(calc_mac))) {
+      r = kErrInvalidMAC;
+      goto out;
+    }
+
+    // Decrypt packet
+    seqbuf[0] = 1;
+    if (EVP_DecryptInit_ex(ctx_main_, nullptr, nullptr, nullptr, seqbuf) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (EVP_DecryptUpdate(ctx_main_,
+                          packet,
+                          &outlen,
+                          packet,
+                          packet_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != packet_len) {
+      r = kErrPartialDecrypt;
+      goto out;
+    }
+
+  out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid keys");
+
+    ChaChaPolyDecipher* obj = new ChaChaPolyDecipher();
+    ErrorType r = obj->init(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0])
+    );
+    if (r != kErrNone) {
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        case kErrOpenSSL: {
+          char msg_buf[128] = {0};
+          ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+          return Nan::ThrowError(msg_buf);
+        }
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(DecryptLen) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    ChaChaPolyDecipher* obj =
+      ObjectWrap::Unwrap<ChaChaPolyDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]) || Buffer::Length(info[0]) != 4)
+      return Nan::ThrowTypeError("Missing/Invalid length bytes");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    unsigned char* length_bytes =
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0]));
+
+    uint32_t dec_packet_length;
+    ErrorType r = obj->decrypt_length(
+      length_bytes,
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust(),
+      &dec_packet_length
+    );
+
+    switch (r) {
+      case kErrNone:
+        return info.GetReturnValue().Set(dec_packet_length);
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet length");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Decrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    ChaChaPolyDecipher* obj =
+      ObjectWrap::Unwrap<ChaChaPolyDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!Buffer::HasInstance(info[1])
+        || Buffer::Length(info[1]) != POLY1305_TAGLEN) {
+      return Nan::ThrowTypeError("Missing/Invalid mac");
+    }
+
+    if (!info[2]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    ErrorType r = obj->decrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Nan::To<uint32_t>(info[2]).FromJust()
+    );
+
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrInvalidMAC:
+        return Nan::ThrowError("Invalid MAC");
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet length");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    ChaChaPolyDecipher* obj =
+      ObjectWrap::Unwrap<ChaChaPolyDecipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  unsigned char length_bytes[4];
+  EVP_CIPHER_CTX* ctx_main_;
+  EVP_CIPHER_CTX* ctx_pktlen_;
+  EVP_MD_CTX* md_ctx_;
+  EVP_PKEY* polykey_;
+  EVP_PKEY_CTX* polykey_ctx_;
+};
+
+class AESGCMDecipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("AESGCMDecipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "decrypt", Decrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("AESGCMDecipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit AESGCMDecipher() : ctx_(nullptr) {}
+
+  ~AESGCMDecipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_) {
+      EVP_CIPHER_CTX_cleanup(ctx_);
+      EVP_CIPHER_CTX_free(ctx_);
+      ctx_ = nullptr;
+    }
+  }
+
+  ErrorType init(const char* name,
+                 unsigned char* key,
+                 size_t key_len,
+                 unsigned char* iv,
+                 size_t iv_len) {
+    ErrorType r = kErrNone;
+
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname(name);
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (cipher != EVP_aes_128_gcm() && cipher != EVP_aes_256_gcm()) {
+      r = kErrBadCipherName;
+      goto out;
+    }
+
+    if ((ctx_ = EVP_CIPHER_CTX_new()) == nullptr
+        || EVP_DecryptInit_ex(ctx_, cipher, nullptr, nullptr, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_AEAD_SET_IVLEN, iv_len, nullptr)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    //~ if (iv_len != static_cast<size_t>(EVP_CIPHER_CTX_iv_length(ctx_))) {
+      //~ r = kErrBadIVLen;
+      //~ goto out;
+    //~ }
+
+    if (key_len != static_cast<size_t>(EVP_CIPHER_CTX_key_length(ctx_))) {
+      if (!EVP_CIPHER_CTX_set_key_length(ctx_, key_len)) {
+        r = kErrBadKeyLen;
+        goto out;
+      }
+    }
+
+    // Set key and IV
+    if (EVP_DecryptInit_ex(ctx_, nullptr, nullptr, key, iv) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_GCM_SET_IV_FIXED, -1, iv)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Disable padding
+    EVP_CIPHER_CTX_set_padding(ctx_, 0);
+
+out:
+    if (r != kErrNone)
+      clear();
+    return r;
+  }
+
+  ErrorType decrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    unsigned char* length_bytes,
+                    unsigned char* tag) {
+    ErrorType r = kErrNone;
+
+    // `packet` layout:
+    //   <padding length> <payload> <padding>
+
+    int outlen;
+
+    // Increment IV
+    unsigned char lastiv[1];
+    if (!EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_GCM_IV_GEN, 1, lastiv)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Set AAD (the packet length)
+    if (!EVP_DecryptUpdate(ctx_, nullptr, &outlen, length_bytes, 4)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (outlen != 4) {
+      r = kErrAADFailure;
+      goto out;
+    }
+
+    // Decrypt everything but the packet length
+    if (EVP_DecryptUpdate(ctx_, packet, &outlen, packet, packet_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != packet_len) {
+      r = kErrPartialDecrypt;
+      goto out;
+    }
+
+    // Set authentication tag
+    if (EVP_CIPHER_CTX_ctrl(ctx_, EVP_CTRL_AEAD_SET_TAG, 16, tag) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Verify authentication tag
+    if (!EVP_DecryptFinal_ex(ctx_, nullptr, &outlen)) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!info[0]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid OpenSSL cipher name");
+
+    if (!Buffer::HasInstance(info[1]))
+      return Nan::ThrowTypeError("Missing/Invalid key");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid iv");
+
+    const Nan::Utf8String cipher_name(info[0]);
+
+    AESGCMDecipher* obj = new AESGCMDecipher();
+    ErrorType r = obj->init(
+      *cipher_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Buffer::Length(info[1]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2])
+    );
+    if (r != kErrNone) {
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid keys length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid IV length");
+        case kErrBadCipherName:
+          return Nan::ThrowError("Invalid AES GCM cipher name");
+        case kErrOpenSSL: {
+          char msg_buf[128] = {0};
+          ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+          return Nan::ThrowError(msg_buf);
+        }
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(Decrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    AESGCMDecipher* obj = ObjectWrap::Unwrap<AESGCMDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid length");
+
+    if (!Buffer::HasInstance(info[2]) || Buffer::Length(info[2]) != 16)
+      return Nan::ThrowTypeError("Missing/Invalid tag");
+
+    uint32_t length = Nan::To<uint32_t>(info[1]).FromJust();
+    unsigned char length_bytes[4];
+    length_bytes[0] = (length >> 24) & 0xFF;
+    length_bytes[1] = (length >> 16) & 0xFF;
+    length_bytes[2] = (length >> 8) & 0xFF;
+    length_bytes[3] = length & 0xFF;
+
+    ErrorType r = obj->decrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      length_bytes,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2]))
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrAADFailure:
+        return Nan::ThrowError("Error setting AAD");
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet");
+      case kErrTagFailure:
+        return Nan::ThrowError("Error generating authentication tag");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    AESGCMDecipher* obj = ObjectWrap::Unwrap<AESGCMDecipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_;
+};
+
+class GenericDecipher : public ObjectWrap {
+ public:
+  static NAN_MODULE_INIT(Init) {
+    Local<FunctionTemplate> tpl = Nan::New<FunctionTemplate>(New);
+    tpl->SetClassName(Nan::New("GenericDecipher").ToLocalChecked());
+    tpl->InstanceTemplate()->SetInternalFieldCount(1);
+
+    SetPrototypeMethod(tpl, "decryptBlock", DecryptBlock);
+    SetPrototypeMethod(tpl, "decrypt", Decrypt);
+    SetPrototypeMethod(tpl, "free", Free);
+
+    constructor().Reset(Nan::GetFunction(tpl).ToLocalChecked());
+
+    Nan::Set(target,
+             Nan::New("GenericDecipher").ToLocalChecked(),
+             Nan::GetFunction(tpl).ToLocalChecked());
+  }
+
+ private:
+  explicit GenericDecipher()
+    : ctx_(nullptr),
+      ctx_hmac_(nullptr),
+      hmac_len_(0),
+      is_etm_(0) {}
+
+  ~GenericDecipher() {
+    clear();
+  }
+
+  void clear() {
+    if (ctx_) {
+      EVP_CIPHER_CTX_cleanup(ctx_);
+      EVP_CIPHER_CTX_free(ctx_);
+      ctx_ = nullptr;
+    }
+    if (ctx_hmac_) {
+      HMAC_CTX_free(ctx_hmac_);
+      ctx_hmac_ = nullptr;
+    }
+  }
+
+  ErrorType init(const char* name,
+                 unsigned char* key,
+                 size_t key_len,
+                 unsigned char* iv,
+                 size_t iv_len,
+                 const char* hmac_name,
+                 unsigned char* hmac_key,
+                 size_t hmac_key_len,
+                 int is_etm,
+                 size_t hmac_actual_len) {
+    ErrorType r = kErrNone;
+
+    const EVP_MD* md;
+    const EVP_CIPHER* const cipher = EVP_get_cipherbyname(name);
+    if (cipher == nullptr) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if ((ctx_ = EVP_CIPHER_CTX_new()) == nullptr
+        || EVP_DecryptInit_ex(ctx_, cipher, nullptr, nullptr, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    if (iv_len != static_cast<size_t>(EVP_CIPHER_CTX_iv_length(ctx_))) {
+      r = kErrBadIVLen;
+      goto out;
+    }
+
+    if (key_len != static_cast<size_t>(EVP_CIPHER_CTX_key_length(ctx_))) {
+      if (!EVP_CIPHER_CTX_set_key_length(ctx_, key_len)) {
+        r = kErrBadKeyLen;
+        goto out;
+      }
+    }
+
+    // Set key and IV
+    if (EVP_DecryptInit_ex(ctx_, nullptr, nullptr, key, iv) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    // Disable padding
+    EVP_CIPHER_CTX_set_padding(ctx_, 0);
+
+    if (cipher == EVP_rc4()) {
+      /* The "arcfour128" algorithm is the RC4 cipher, as described in
+         [SCHNEIER], using a 128-bit key.  The first 1536 bytes of keystream
+         generated by the cipher MUST be discarded, and the first byte of the
+         first encrypted packet MUST be encrypted using the 1537th byte of
+         keystream.
+
+         -- http://tools.ietf.org/html/rfc4345#section-4 */
+      unsigned char zeros[1536] = {0};
+      int outlen = sizeof(zeros);
+      if (EVP_DecryptUpdate(ctx_,
+                            zeros,
+                            &outlen,
+                            zeros,
+                            sizeof(zeros)) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != sizeof(zeros)) {
+        r = kErrBadInit;
+        goto out;
+      }
+    }
+
+    md = EVP_get_digestbyname(hmac_name);
+    if (md == nullptr) {
+      r = kErrBadHMACName;
+      goto out;
+    }
+
+    if ((ctx_hmac_ = HMAC_CTX_new()) == nullptr
+        || HMAC_Init_ex(ctx_hmac_, hmac_key, hmac_key_len, md, nullptr) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+
+    hmac_len_ = HMAC_size(ctx_hmac_);
+    hmac_actual_len_ = hmac_actual_len;
+    is_etm_ = is_etm;
+    switch (EVP_CIPHER_CTX_mode(ctx_)) {
+      case EVP_CIPH_STREAM_CIPHER:
+      case EVP_CIPH_CTR_MODE:
+        is_stream_ = 1;
+        break;
+      default:
+        is_stream_ = 0;
+    }
+    block_size_ = EVP_CIPHER_CTX_block_size(ctx_);
+
+out:
+    if (r != kErrNone)
+      clear();
+    return r;
+  }
+
+  ErrorType decrypt_block(unsigned char* data,
+                          uint32_t data_len,
+                          uint32_t seqno) {
+    ErrorType r = kErrNone;
+
+    int outlen;
+
+    uint8_t seqbuf[4] = {0};
+    ((uint8_t*)(seqbuf))[0] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[1] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[2] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[3] = seqno & 0xff;
+
+    if (!is_stream_ && data_len != block_size_) {
+      r = kErrBadBlockLen;
+      goto out;
+    }
+
+    // Decrypt block
+    if (EVP_DecryptUpdate(ctx_, data, &outlen, data, data_len) != 1) {
+      r = kErrOpenSSL;
+      goto out;
+    }
+    if (static_cast<size_t>(outlen) != data_len) {
+      r = kErrPartialDecrypt;
+      goto out;
+    }
+
+out:
+    return r;
+  }
+
+  ErrorType decrypt(unsigned char* packet,
+                    uint32_t packet_len,
+                    uint32_t seqno,
+                    unsigned char* first_block,
+                    uint32_t first_block_len,
+                    unsigned char* mac,
+                    uint32_t mac_len) {
+    ErrorType r = kErrNone;
+
+    int outlen;
+    unsigned char calc_mac[hmac_len_] = {0};
+
+    uint8_t seqbuf[4] = {0};
+    ((uint8_t*)(seqbuf))[0] = (seqno >> 24) & 0xff;
+    ((uint8_t*)(seqbuf))[1] = (seqno >> 16) & 0xff;
+    ((uint8_t*)(seqbuf))[2] = (seqno >> 8) & 0xff;
+    ((uint8_t*)(seqbuf))[3] = seqno & 0xff;
+
+    if (is_etm_) {
+      // `first_block` for ETM should just be the unencrypted packet length
+      if (first_block_len != 4) {
+        r = kErrBadBlockLen;
+        goto out;
+      }
+
+      // HMAC over unencrypted packet length and ciphertext
+      {
+        unsigned int outlen = hmac_len_;
+        if (HMAC_Init_ex(ctx_hmac_, nullptr, 0, nullptr, nullptr) != 1
+            || HMAC_Update(ctx_hmac_, seqbuf, sizeof(seqbuf)) != 1
+            || HMAC_Update(ctx_hmac_, first_block, first_block_len) != 1
+            || HMAC_Update(ctx_hmac_, packet, packet_len) != 1
+            || HMAC_Final(ctx_hmac_, calc_mac, &outlen) != 1) {
+          r = kErrOpenSSL;
+          goto out;
+        }
+
+        if (outlen != hmac_len_ || mac_len != hmac_len_) {
+          r = kErrBadHMACLen;
+          goto out;
+        }
+
+        // Compare MACs
+        if (CRYPTO_memcmp(mac, calc_mac, sizeof(calc_mac))) {
+          r = kErrInvalidMAC;
+          goto out;
+        }
+      }
+
+      // Decrypt packet
+      if (EVP_DecryptUpdate(ctx_, packet, &outlen, packet, packet_len) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != packet_len) {
+        r = kErrPartialDecrypt;
+        goto out;
+      }
+    } else {
+      // `first_block` for non-ETM should be a completely decrypted first block
+      if (!is_stream_ && first_block_len != block_size_) {
+        r = kErrBadBlockLen;
+        goto out;
+      }
+
+      const int offset = (is_stream_ ? 0 : block_size_ - 4);
+      // Decrypt the rest of the packet
+      if (EVP_DecryptUpdate(ctx_,
+                            packet + offset,
+                            &outlen,
+                            packet + offset,
+                            packet_len - offset) != 1) {
+        r = kErrOpenSSL;
+        goto out;
+      }
+      if (static_cast<size_t>(outlen) != packet_len - offset) {
+        r = kErrPartialDecrypt;
+        goto out;
+      }
+
+      // HMAC over plaintext
+      {
+        unsigned int outlen = hmac_len_;
+        if (HMAC_Init_ex(ctx_hmac_, nullptr, 0, nullptr, nullptr) != 1
+            || HMAC_Update(ctx_hmac_, seqbuf, sizeof(seqbuf)) != 1
+            || HMAC_Update(ctx_hmac_, first_block, first_block_len) != 1
+            || HMAC_Update(ctx_hmac_, packet, packet_len) != 1
+            || HMAC_Final(ctx_hmac_, calc_mac, &outlen) != 1) {
+          r = kErrOpenSSL;
+          goto out;
+        }
+
+        if (outlen != hmac_len_ || mac_len != hmac_actual_len_) {
+          r = kErrBadHMACLen;
+          goto out;
+        }
+
+        // Compare MACs
+        if (CRYPTO_memcmp(mac, calc_mac, hmac_actual_len_)) {
+          r = kErrInvalidMAC;
+          goto out;
+        }
+      }
+    }
+
+out:
+    return r;
+  }
+
+  static NAN_METHOD(New) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    if (!info[0]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid decipher name");
+
+    if (!Buffer::HasInstance(info[1]))
+      return Nan::ThrowTypeError("Missing/Invalid decipher key");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid decipher IV");
+
+    if (!info[3]->IsString())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC name");
+
+    if (!Buffer::HasInstance(info[4]))
+      return Nan::ThrowTypeError("Missing/Invalid HMAC key");
+
+    if (!info[5]->IsBoolean())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC ETM flag");
+
+    if (!info[6]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid HMAC ETM flag");
+
+    const Nan::Utf8String cipher_name(info[0]);
+    const Nan::Utf8String mac_name(info[3]);
+    int is_etm = (Nan::To<bool>(info[5]).FromJust() ? 1 : 0);
+
+    GenericDecipher* obj = new GenericDecipher();
+    ErrorType r = obj->init(
+      *cipher_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[1])),
+      Buffer::Length(info[1]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2]),
+      *mac_name,
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[4])),
+      Buffer::Length(info[4]),
+      is_etm,
+      Nan::To<uint32_t>(info[6]).FromJust()
+    );
+    if (r != kErrNone) {
+      delete obj;
+      switch (r) {
+        case kErrBadKeyLen:
+          return Nan::ThrowError("Invalid decipher key length");
+        case kErrBadIVLen:
+          return Nan::ThrowError("Invalid decipher IV length");
+        case kErrBadCipherName:
+          return Nan::ThrowError("Invalid decipher name");
+        case kErrBadHMACName:
+          return Nan::ThrowError("Invalid MAC name");
+        case kErrBadInit:
+          return Nan::ThrowError("Failed to properly initialize decipher");
+        case kErrOpenSSL: {
+          char msg_buf[128] = {0};
+          ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+          return Nan::ThrowError(msg_buf);
+        }
+        default:
+          return Nan::ThrowError("Unknown init failure");
+      }
+    }
+
+    obj->Wrap(info.This());
+    info.GetReturnValue().Set(info.This());
+  }
+
+  static NAN_METHOD(DecryptBlock) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    GenericDecipher* obj = ObjectWrap::Unwrap<GenericDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid block");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    ErrorType r = obj->decrypt_block(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust()
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrBadBlockLen:
+        return Nan::ThrowError("Invalid block length");
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Decrypt) {
+    MarkPopErrorOnReturn mark_pop_error_on_return;
+
+    GenericDecipher* obj = ObjectWrap::Unwrap<GenericDecipher>(info.Holder());
+
+    if (!Buffer::HasInstance(info[0]))
+      return Nan::ThrowTypeError("Missing/Invalid packet");
+
+    if (!info[1]->IsUint32())
+      return Nan::ThrowTypeError("Missing/Invalid sequence number");
+
+    if (!Buffer::HasInstance(info[2]))
+      return Nan::ThrowTypeError("Missing/Invalid first block");
+
+    if (!Buffer::HasInstance(info[3]))
+      return Nan::ThrowTypeError("Missing/Invalid MAC");
+
+    ErrorType r = obj->decrypt(
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[0])),
+      Buffer::Length(info[0]),
+      Nan::To<uint32_t>(info[1]).FromJust(),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[2])),
+      Buffer::Length(info[2]),
+      reinterpret_cast<unsigned char*>(Buffer::Data(info[3])),
+      Buffer::Length(info[3])
+    );
+    switch (r) {
+      case kErrNone:
+        return;
+      case kErrBadBlockLen:
+        return Nan::ThrowError("Invalid block length");
+      case kErrPartialDecrypt:
+        return Nan::ThrowError("Failed to completely decrypt packet");
+      case kErrBadHMACLen:
+        return Nan::ThrowError("Unexpected HMAC length");
+      case kErrOpenSSL: {
+        char msg_buf[128] = {0};
+        ERR_error_string_n(ERR_get_error(), msg_buf, sizeof(msg_buf));
+        return Nan::ThrowError(msg_buf);
+      }
+      default:
+        return Nan::ThrowError("Unknown decrypt failure");
+    }
+  }
+
+  static NAN_METHOD(Free) {
+    GenericDecipher* obj = ObjectWrap::Unwrap<GenericDecipher>(info.Holder());
+    obj->clear();
+  }
+
+  static inline Nan::Persistent<Function> & constructor() {
+    static Nan::Persistent<Function> my_constructor;
+    return my_constructor;
+  }
+
+  EVP_CIPHER_CTX* ctx_;
+  HMAC_CTX* ctx_hmac_;
+  unsigned int hmac_len_;
+  unsigned int hmac_actual_len_;
+  uint8_t is_etm_;
+  uint8_t is_stream_;
+  uint32_t block_size_;
+};
+
+
+NAN_MODULE_INIT(init) {
+  ChaChaPolyCipher::Init(target);
+  AESGCMCipher::Init(target);
+  GenericCipher::Init(target);
+
+  ChaChaPolyDecipher::Init(target);
+  AESGCMDecipher::Init(target);
+  GenericDecipher::Init(target);
+}
+
+NODE_MODULE(sshcrypto, init)