5. Command line length restriction

RFC1123 states that an implementation should not place any limits on command line length. This requirement does not have any practical meaning now because current file systems have certain limits for maximum path name length.

Implementation of unlimited command buffer has two drawbacks:

1. This is not efficient. Processing a request that is longer then a longest path name plus some space for command and arguments has no sense because an OS will later decline this path name.
2. This is not secure. Having an unlimited command line buffer makes the server DOS-able.

We restrict the command length with the following value: longest command + one space + longest argument + one space + longest path name + CRLF.

Here you can see how its is defined in the code:

/* For PATH_MAX */
#include <limits.h> 
/* SITE MINFO or SITE NEWER */
#define MAXCMDVERB   10
/* <date> + space + <path> in SITE NEWER */
#define MAXARG       16 + 1 + PATH_MAX
/* 1 for space between command verb and argument; 2 for end of line */
#define MAXCMDLEN    MAXCMDVERB + MAXARG + 1 + 2

The server reads incoming data until it encounters the CRLF sequence. If the received data stream is longer then the command line limit the program enters a special mode. In this mode it merely reads data from control connection without buffering it. This process continues until CRLF sequence is received or control connection is closed. In first case the program discards all buffered input (starting portion of a command). Then it sends a reply message "501 Command line too long" to the peer and returns back into normal operating mode.