DefaultSftpClient : add a property to allow to change the predefined maxLength of packet in method received
- Dominant language
- Java
- Stars
- 1.1k
- Forks
- 400
- Avg merge
- 5d 1h
- Merged PRs (30d)
- 1
Description
### Description
in DefaultSftpClient, the method received test the maximum size of the packet just received with this :
`if (length > (8 * SshConstants.SSH_REQUIRED_PAYLOAD_PACKET_LENGTH_SUPPORT)) {
throw new StreamCorruptedException("Illogical sftp packet length: " + length);
}`
Unfortunately, this default 8 times is a bit low and cannot be modified.
When retrieving a directory listing from a server, i got the exception "illogical sftp packet length", and after investigating, the server contains about 6500 directories to retrieve info about.
Changing this value to a bigger one solved the issue for my cases, but i'm wondering if we can parametrised this value and not hard coding it in the futur.
### Motivation
From https://www.rfc-editor.org/rfc/rfc4253#section-6.1
All implementations MUST be able to process packets with anuncompressed payload length of 32768 bytes or less and a total packet size of 35000 bytes or less (including 'packet_length', 'padding_length', 'payload', 'random padding', and 'mac'). The maximum of 35000 bytes is an arbitrarily chosen value that is largerthan the uncompressed length noted above. Implementations SHOULDsupport longer packets, where they might be needed. For example, if an implementation wants to send a very large number of certificates, the larger packets MAY be sent if the identification string indicatesthat the other party is able to process them. However, implementations SHOULD check that the packet length is reasonable in order for the implementation to avoid denial of service and/or buffer overflow attacks.
### Alternatives considered
_No response_
### Additional context
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue points to DefaultSftpClient.received and its SSH_REQUIRED_PAYLOAD_PACKET_LENGTH_SUPPORT check; start there and trace how the packet-length limit is defined and used. Make that limit configurable without losing the existing sanity check, then verify that a large SFTP directory listing succeeds and oversized packets remain rejected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- networking
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100