Re: exit-signal vs openssh

[nisse%lysator.liu.se@localhost (Niels Möller)]

der Mouse <mouse%Rodents.Montreal.QC.CA@localhost> writes:

> I'm seeing packets with payload (after the want-reply boolean) of 
> 	00 00 00 01 00 00 00 00 00 00 00 00 00
> which makes sense only if I read the signal as uint32 instead of
> string.

[...]

> Is there a recommended heuristic for detecting this?

I'm not sure I can make sense of your example, but if I recall this
issue correctly, an old format exit-signal message will end with

  uint32   signal number
  END-OF-MESSAGE

while a new format message will end with

  uint32   string length n
  byte[n]  string data 
  END-OF-MESSAGE

(I've substituted the internal representation of the string type).

So these two cases should be easy to distinguish by looking at the end
of the message (determined by the message length you get from the
transport layer).

The only ambiguous case is the signal number 0 that is represented in
the same way as the signal name "", and that's pretty bogus no matter
which way you choose to interpret it.

I'm pretty sure backwards compatibility tricks was discussed on this
list when the exit-signal message was changed a few years ago.

Best regards,
/Niels