Subject: Re: maximum size of packets from client to server

From: Thomas Anderson <[email-masked]>
Date: Sun, 13 Sep 2009 18:20:06 -0700 (PDT)

der Mouse wrote:
><snip>
> 
> Agreed.  When (if) 4254 is updated, that's a change I'd like to see; as
> it stands, it is entirely silent on the purpose of those fields, which
> strikes me as a bad idea for a formal spec.

On this same subject, here's something else I think could use clarification.  RFC4254#section-5.1 states that the "maximum packet size" refers to the "maximum size of an individual data packet".  This raises the question...  what qualifies as a data packet.  Does SSH_MSG_CHANNEL_REQUEST qualify as a data packet, for example?  Often, they wouldn't, but if the request type is "exec", a SSH_MSG_CHANNEL_REQUEST could easily exceed "maximum packet size".

The fact that RFC4254#section-5.2 (Data Transfer) repeats the bit about the "maximum packet size" while RFC4254#section-6.5 (Starting a Shell or a Command) doesn't suggests to me that SSH_MSG_CHANNEL_REQUEST is not a data packet, but it seems like it should be discussed in #section-5.1's discussion of the "maximum packet size", none-the-less.

Also, it's not clear to me what the maximum packet size is referring to.  If it's 16,384 bytes, does that mean that the largest binary packet that you can have, if you hav a block size of 24 bytes (eg. aes192-cbc), is 16,368 bytes, or does it mean that the largest data string you can have is 16,384 bytes?  I would assume that it's the largest data string since the binary packets can be compressed and since it'd be hard to know if the string to be compressed was small enough until after you compressed it.

Also, if the maximum maximum packet size of 32,768 bytes referred to the maximum size of the binary packet, then it seems like the whole "total packet length of 35,000 bytes" of RFC4253#section-6.1 would be somewhat unnecessary as the practical limit would be 32,768 bytes - not 35,000.

Either way, it seems like this should be elaborated upon in RFC4254 as well.

---

From: [email-masked] (Niels Möller)
Date: Mon, 14 Sep 2009 10:10:27 +0200

Thomas Anderson <[email-masked]> writes:

> On this same subject, here's something else I think could use
> clarification. RFC4254#section-5.1 states that the "maximum packet
> size" refers to the "maximum size of an individual data packet".
> This raises the question... what qualifies as a data packet. Does
> SSH_MSG_CHANNEL_REQUEST qualify as a data packet, for example?

I'd say it doesn't qualify. Both window size and channel max packet
size apply to the data flow (CHANNEL_DATA, CHANNEL_EXTENDED_DATA) of a
channel, in one direction.

> Also, it's not clear to me what the maximum packet size is referring
> to.

I agree this is unclear. It makes the most sense to me to apply it to
the data payload only. The following comment explains how I apply the
various limits when reading data from some source, to be transmitted
over an ssh channel as CHANNEL_DATA or CHANNEL_EXTENDED_DATA:

  /* There are three numbers that limit the amount of data we can read:
   *
   *   1 The current send_window_size.
   *   2 The send_max_packet size for the channel.
   *   3 (The maximum size for a complete packet SSH_MAX_PACKET)
   *
   * We don't enforce (3) here, but assume that if the remote end has
   * given us a huge send_max_packet, it will also handle huge ssh
   * packets.
   */

Regards,
/Niels