apache / apache/mina-sshd

FS Does not support secure directory streams & NOFOLLOW_LINKS on IBM i

Open
#742 5 comments 0 reactions 0 assignees View on GitHub
sftp_3.0
Dominant language
Java
Stars
1.1k
Forks
400
Avg merge
5d 1h
Merged PRs (30d)
1

Description

### Version

2.12.1

### Bug description

The new WinSCP client version 6.5 sends the FileAttribute "size" when opening a file. This leads to following Exception:
```
java.lang.UnsupportedOperationException: FS Does not support secure directory streams.
at org.apache.sshd.sftp.server.SftpFileSystemAccessor.secure(SftpFileSystemAccessor.java:593)
at org.apache.sshd.sftp.server.SftpFileSystemAccessor.secureResolveDirectoryStream(SftpFileSystemAccessor.java:585)
at org.apache.sshd.sftp.server.SftpFileSystemAccessor.seekableByteChannelNoLinkFollow(SftpFileSystemAccessor.java:565)
at org.apache.sshd.sftp.server.SftpFileSystemAccessor.openFile(SftpFileSystemAccessor.java:217)
at org.apache.sshd.sftp.server.AbstractSftpSubsystemHelper.setFileAttributes(AbstractSftpSubsystemHelper.java:2707)
at org.apache.sshd.sftp.server.AbstractSftpSubsystemHelper.doSetAttributes(AbstractSftpSubsystemHelper.java:2671)
at org.apache.sshd.sftp.server.FileHandle.(FileHandle.java:94)
at org.apache.sshd.sftp.server.SftpSubsystem.doOpen(SftpSubsystem.java:968)
at org.apache.sshd.sftp.server.AbstractSftpSubsystemHelper.doOpen(AbstractSftpSubsystemHelper.java:496)
at org.apache.sshd.sftp.server.AbstractSftpSubsystemHelper.doProcess(AbstractSftpSubsystemHelper.java:353)
at org.apache.sshd.sftp.server.SftpSubsystem.doProcess(SftpSubsystem.java:355)
at org.apache.sshd.sftp.server.AbstractSftpSubsystemHelper.process(AbstractSftpSubsystemHelper.java:344)
at org.apache.sshd.sftp.server.SftpSubsystem.run(SftpSubsystem.java:331)
```

I identified the problem in org.apache.sshd.sftp.server.FileHandle.java
```
SftpFileSystemAccessor accessor = subsystem.getFileSystemAccessor();
SeekableByteChannel channel;
try {
channel = accessor.openFile(
subsystem, this, file, handle, openOptions, fileAttrs);
} catch (UnsupportedOperationException e) {
channel = accessor.openFile(
subsystem, this, file, handle, openOptions, IoUtils.EMPTY_FILE_ATTRIBUTES);
subsystem.doSetAttributes(SftpConstants.SSH_FXP_OPEN, "", file, attrs, false);
}
```

### Actual behavior

1. The first accessor.openFile(...) throws an exception that is not shown in log
2. Second accessor.openFile(...) creates file, but subsystem.doSetAttributes(...) throws Exception "FS Does not support secure directory streams", because followLinks is hard-coded to false and not supported on IBM i.

### Expected behavior

1. Show the exception on debug/trace log
2. Do not use followLinks=false if it can lead to problems. A fallback as it is mentioned before the exception. Or maybe some way to configure it?

### Relevant log output

```Shell

```

### Other information

_No response_

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with org.apache.sshd.sftp.server.FileHandle.java and the secureResolveDirectoryStream/openFile paths in SftpFileSystemAccessor.java. Reproduce the WinSCP 6.5 attribute update on IBM i, then verify that the original failure is logged at debug or trace and that attribute handling does not unconditionally use unsupported followLinks=false behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.