Index: clientloop.c
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/clientloop.c,v
retrieving revision 1.101
diff -u -p -r1.101 clientloop.c
--- clientloop.c	17 Dec 2003 05:33:11 -0000	1.101
+++ clientloop.c	7 Apr 2004 04:57:59 -0000
@@ -128,6 +128,7 @@ static int connection_out;	/* Connection
 static int need_rekeying;	/* Set to non-zero if rekeying is requested. */
 static int session_closed = 0;	/* In SSH2: login session closed. */
 static int server_alive_timeouts = 0;
+static int agent_disabled = 0; /* Agent forwarding disabled during session */
 
 static void client_init_dispatch(void);
 int	session_ident = -1;
@@ -603,6 +604,24 @@ process_escapes(Buffer *bin, Buffer *bou
 				/* We have been continued. */
 				continue;
 
+			case 'A':
+				if (!options.forward_agent) {
+					snprintf(string, sizeof(string),
+					    "%cA [agent forwarding not enabled for session]\r\n",
+					    escape_char);
+					buffer_append(berr, string,
+					    strlen(string));
+					continue;
+				}
+
+				agent_disabled ^= 1; /* toggle */
+				snprintf(string, sizeof(string),
+				    "%cA [agent forwarding %s]\r\n",
+				    escape_char, agent_disabled ? "disabled" :
+				    "enabled");
+				buffer_append(berr, string, strlen(string));
+				continue;
+
 			case 'B':
 				if (compat20) {
 					snprintf(string, sizeof string,
@@ -678,6 +697,7 @@ process_escapes(Buffer *bin, Buffer *bou
 "%c?\r\n\
 Supported escape sequences:\r\n\
 %c.  - terminate connection\r\n\
+%cA  - toggle agent forwarding\r\n\
 %cB  - send a BREAK to the remote system\r\n\
 %cC  - open a command line\r\n\
 %cR  - Request rekey (SSH protocol 2 only)\r\n\
@@ -689,7 +709,7 @@ Supported escape sequences:\r\n\
 (Note that escapes are only recognized immediately after newline.)\r\n",
 				    escape_char, escape_char, escape_char, escape_char,
 				    escape_char, escape_char, escape_char, escape_char,
-				    escape_char, escape_char, escape_char);
+				    escape_char, escape_char, escape_char, escape_char);
 				buffer_append(berr, string, strlen(string));
 				continue;
 
@@ -1170,7 +1190,7 @@ static void
 client_input_agent_open(int type, u_int32_t seq, void *ctxt)
 {
 	Channel *c = NULL;
-	int remote_id, sock;
+	int remote_id, sock = -1;
 
 	/* Read the remote channel number from the message. */
 	remote_id = packet_get_int();
@@ -1180,7 +1200,10 @@ client_input_agent_open(int type, u_int3
 	 * Get a connection to the local authentication agent (this may again
 	 * get forwarded).
 	 */
-	sock = ssh_get_authentication_socket();
+	if (agent_disabled)
+		debug("Agent forwarding requested but currently disabled");
+	else
+		sock = ssh_get_authentication_socket();
 
 	/*
 	 * If we could not connect the agent, send an error message back to
@@ -1280,6 +1303,11 @@ client_request_agent(const char *request
 {
 	Channel *c = NULL;
 	int sock;
+
+	if (agent_disabled) {
+		debug("Agent forwarding requested but currently disabled");
+		return NULL;
+	}
 
 	if (!options.forward_agent) {
 		error("Warning: ssh server tried agent forwarding.");
Index: ssh.1
===================================================================
RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/ssh.1,v
retrieving revision 1.141
diff -u -p -r1.141 ssh.1
--- ssh.1	8 Mar 2004 12:12:36 -0000	1.141
+++ ssh.1	7 Apr 2004 04:29:10 -0000
@@ -298,6 +298,9 @@ Background
 at logout when waiting for forwarded connection / X11 sessions to terminate.
 .It Cm ~?
 Display a list of escape characters.
+.It Cm ~A
+Enable/disable agent forwarding within the session, if the session was
+started with it enabled.
 .It Cm ~B
 Send a BREAK to the remote system
 (only useful for SSH protocol version 2 and if the peer supports it).
