paramiko/paramiko — pull request #455 by jquast (2014-12-14 08:13:55+00:00)
Title: Honor openssh out max packet size

OpenSSH client requests a value of 16384 for value of ``Channel.out_max_packet_size``,
when opening a session channel, but method ``_set_remote_channel`` “clamps” this value by ``Transport._sanitize_packet_size``, which coerces the value to 32768.

Because paramiko server is not honoring the client's requested value, and there is no protocol negotiation to notify the client as such, when a packet larger than 16384 is received by the OpenSSH client, it will write to stderr: ``channel 0: rcvd big packet 32704, maxpack 16384``.

This is especially difficult for interactive programs that use cursor addressing, as the position of the client cursor then becomes indeterminate. A large-windowed terminal (size ~170x100) using a curses application is very likely to receive this message, which will cause corruption in the output display.

This value is specified in common.py:
```
# lower bound on the max packet size we'll accept from the remote host
# Minimum packet size is 32768 bytes according to
# http://www.ietf.org/rfc/rfc4254.txt
MIN_PACKET_SIZE = 2 ** 15
```

If you follow rfc4254 for this declaration,

> Implementations are expected to have some limit on the SSH transport
> layer packet size (any limit for received packets MUST be 32768 bytes
> or larger, as described in [SSH-TRANS]).

Then, following SSH-TRANS, which is http://www.ietf.org/rfc/rfc4253.txt for section 6.1, it reads:

> 6.1. Maximum Packet Length
>
> All implementations MUST be able to process packets with an
> uncompressed payload length of 32768 bytes **or less** and ...

We read that it is perfectly legal to request a maximum packet size of 16384 as OpenSSH client does (“or less”).

If we modify ``demos/demo_server.py``,
```
--- a/demos/demo_server.py
+++ b/demos/demo_server.py
@@ -164,6 +164,7 @@ try:
sys.exit(1)

chan.send('\r\n\r\nWelcome to my dorky little BBS!\r\n\r\n')
+ chan.send('X'*32705)
```

We can see the client emit this message: ``channel 0: rcvd big packet 32704, maxpack 16384``. Furthermore, the demo_server.log writes a misleading message, ``[chan 1] Max packet out: 16384 bytes`` — that was the value received, but not the value set and later honored.

This patch suggests separating ``MIN_PACKET_SIZE`` to ``MIN_WINDOW_SIZE``, and lowering the value of ``MIN_PACKET_SIZE`` to 4096.