annotate release.sh @ 1788:1fc0012b9c38

Fix handling of replies to global requests (#112) The current code assumes that all global requests want / need a reply. This isn't always true and the request itself indicates if it wants a reply or not. It causes a specific problem with [email protected] messages. These are sent by OpenSSH after authentication to inform the client of potential other host keys for the host. This can be used to add a new type of host key or to rotate host keys. The initial information message from the server is sent as a global request, but with want_reply set to false. This means that the server doesn't expect an answer to this message. Instead the client needs to send a prove request as a reply if it wants to receive proof of ownership for the host keys. The bug doesn't cause any current problems with due to how OpenSSH treats receiving the failure message. It instead treats it as a keepalive message and further ignores it. Arguably this is a protocol violation though of Dropbear and it is only accidental that it doesn't cause a problem with OpenSSH. The bug was found when adding host keys support to libssh, which is more strict protocol wise and treats the unexpected failure message an error, also see https://gitlab.com/libssh/libssh-mirror/-/merge_requests/145 for more information. The fix here is to honor the want_reply flag in the global request and to only send a reply if the other side expects a reply.
author Dirkjan Bussink <d.bussink@gmail.com>
date Thu, 10 Dec 2020 16:13:13 +0100
parents e2e4929d057b
children 552bb9b4f16a
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
948
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
1 #!/bin/sh
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 VERSION=$(echo '#include "sysoptions.h"\necho DROPBEAR_VERSION' | cpp - | sh)
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3 echo Releasing version "$VERSION" ...
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4 if ! head -n1 CHANGES | grep -q $VERSION ; then
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5 echo "CHANGES needs updating"
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 exit 1
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
7 fi
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
8
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
9 if ! head -n1 debian/changelog | grep -q $VERSION ; then
1007
cbd674d63cd4 changelog for 2015.67
Matt Johnston <matt@ucc.asn.au>
parents: 949
diff changeset
10 echo "debian/changelog needs updating"
948
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11 exit 1
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12 fi
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
14 head -n1 CHANGES
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
15
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16 #sleep 3
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
17
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
18 RELDIR=$PWD/../dropbear-$VERSION
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
19 ARCHIVE=${RELDIR}.tar.bz2
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
20 if test -e $RELDIR; then
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
21 echo "$RELDIR exists"
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
22 exit 1
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
23 fi
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
24
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
25 if test -e $ARCHIVE; then
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
26 echo "$ARCHIVE exists"
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
27 exit 1
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
28 fi
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
29
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
30 hg archive "$RELDIR" || exit 2
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
31
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
32 (cd "$RELDIR" && autoconf && autoheader) || exit 2
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
33
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
34 rm -r "$RELDIR/autom4te.cache" || exit 2
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
35
1137
40434003bd96 remove .hgtags from release
Matt Johnston <matt@ucc.asn.au>
parents: 1010
diff changeset
36 rm "$RELDIR/.hgtags"
40434003bd96 remove .hgtags from release
Matt Johnston <matt@ucc.asn.au>
parents: 1010
diff changeset
37
40434003bd96 remove .hgtags from release
Matt Johnston <matt@ucc.asn.au>
parents: 1010
diff changeset
38 (cd "$RELDIR/.." && tar cjf $ARCHIVE `basename "$RELDIR"`) || exit 2
948
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
39
f92eb625c48d - Don't use multichar constants since recent gcc complains
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
40 ls -l $ARCHIVE
1645
0276c0f8c2b8 use "openssl sha256"
Matt Johnston <matt@ucc.asn.au>
parents: 1183
diff changeset
41 openssl sha256 $ARCHIVE
1183
d10468395a49 release.sh reminds how to sign
Matt Johnston <matt@ucc.asn.au>
parents: 1137
diff changeset
42 echo Done to
d10468395a49 release.sh reminds how to sign
Matt Johnston <matt@ucc.asn.au>
parents: 1137
diff changeset
43 echo "$ARCHIVE"
d10468395a49 release.sh reminds how to sign
Matt Johnston <matt@ucc.asn.au>
parents: 1137
diff changeset
44 echo Sign it with
d10468395a49 release.sh reminds how to sign
Matt Johnston <matt@ucc.asn.au>
parents: 1137
diff changeset
45 echo gpg2 --detach-sign -a -u F29C6773 "$ARCHIVE"