Subject: What's "maximum packet size"?

From: der Mouse <[email-masked]>
Date: Fri, 15 Sep 2006 18:01:42 -0400 (EDT)

There's a "maximum packet size" in CHANNEL_OPEN and
CHANNEL_OPEN_CONFIRMATION messages.  4254 says that this is "the
maximum size of an individual data packet that can be sent to the
sender".  I've interpreted this to mean that I should send, there, the
maximum payload length I support, where "paylaod" is as in section 6 of
4253 - the part of a binary-protocol packet after MAC and padding are
stripped and decryption and uncompression are done.  My value for this
is 35000.  But when talking to other implementations, I not uncommonly
get crashes where my code complains about a payload overflow, getting a
35009-byte payload from the peer.

Have I misinterpreted 4254?  If so, what *is* that the maximum size of?
The only other thing that makes any sense to me is that it's the "data"
field of CHANNEL_DATA packets (see 4254 5.2); is that what it's
supposed to be?

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B

---

From: Jacob Nevins <[email-masked]>
Date: Sat, 16 Sep 2006 12:21:18 +0100

der Mouse writes:
> CHANNEL_OPEN_CONFIRMATION messages. [...]

I believe that this (maximum length of channel data) is the correct
interpretation. (FWIW, it's what both PuTTY and OpenSSH used, last time
I looked.)

This was discussed at least once before, in Oct-Nov 2005 (subject
'Definition of "packet"'), and that seemed to be the consensus. Language
was added to what became section 5.2 of 4254 in an attempt to clarify
this.
However, perhaps unfortunately, it still does not spell out the precise
relationship between the "maximum packet size" and the number of bytes
of channel data; it just says that "The maximum amount of data allowed
is *determined* by the maximum packet size for the channel [...]" (my
emphasis).
The relationship with the transport layer is discussed in the next
paragraphs, but again it's not entirely unambiguous.

---

From: [email-masked] (Niels Möller)
Date: 16 Sep 2006 15:39:42 +0200

> interpretation. (FWIW, it's what both PuTTY and OpenSSH used, last time

That's my recollection too (I haven't checked the archives, though).

> paragraphs, but again it's not entirely unambiguous.

If we accept that "maximum packet size" in the connection layer should
be interpreted in the context of that layer (i.e. it's the size of the
payload in CHANNEL_DATA / CHANNEL_EXTENDED_DATA), I don't think the
relationship is terribly difficult.

For receiving:

  When you advertise a maximum packet size for a new channel, that means
  you are prepared to receive channel packets up to that size. And it's
  your responsibility to ensure that your transport layer implementation
  is comfortable with the corresponding transport-layer packets, which
  may well be larger than the 32768/35000 limits.

For sending:

  When the other side has advertized a large maximum packet size for a
  channel, feel free to generate packets of that size, even if it
  makes the transport packets larger than the 32768/35000 limit. And
  if your transport implementation is unwilling to generate packets of
  that size, just clamp down the advertised value you receive from the
  other end.

If you want to honor the 32768 octet limit on the transport layer, to
get the largest possible "maximum packet size" for a channel, you have
to subtract the CHANNEL_EXTENDED_DATA overhead, which is 13 octets
IIRC.

For simplicity, and to have a little margin, my implementation
restricts the maximum packet size in the connection layer to 32768 -
100.

Regards,
/Niels