From d2c53e0b9d041fae320ea18353987bfc7dbf29cf Mon Sep 17 00:00:00 2001 From: job Date: Wed, 4 Apr 2018 15:12:18 +0000 Subject: Update default IPQoS in ssh(1), sshd(8) to DSCP AF21 for interactive and CS1 for bulk AF21 was selected as this is the highest priority within the low-latency service class (and it is higher than what we have today). SSH is elastic and time-sensitive data, where a user is waiting for a response via the network in order to continue with a task at hand. As such, these flows should be considered foreground traffic, with delays or drops to such traffic directly impacting user-productivity. For bulk SSH traffic, the CS1 "Lower Effort" marker was chosen to enable networks implementing a scavanger/lower-than-best effort class to discriminate scp(1) below normal activities, such as web surfing. In general this type of bulk SSH traffic is a background activity. An advantage of using "AF21" for interactive SSH and "CS1" for bulk SSH is that they are recognisable values on all common platforms (IANA https://www.iana.org/assignments/dscp-registry/dscp-registry.xml), and for AF21 specifically a definition of the intended behavior exists https://tools.ietf.org/html/rfc4594#section-4.7 in addition to the definition of the Assured Forwarding PHB group https://tools.ietf.org/html/rfc2597, and for CS1 (Lower Effort) there is https://tools.ietf.org/html/rfc3662 The first three bits of "AF21" map to the equivalent IEEEE 802.1D PCP, IEEE 802.11e, MPLS EXP/CoS and IP Precedence value of 2 (also known as "Immediate", or "AC_BE"), and CS1's first 3 bits map to IEEEE 802.1D PCP, IEEE 802.11e, MPLS/CoS and IP Precedence value 1 ("Background" or "AC_BK"). OK deraadt@, "no objection" djm@ --- usr.bin/ssh/readconf.c | 6 +++--- usr.bin/ssh/servconf.c | 6 +++--- usr.bin/ssh/ssh_config.5 | 10 ++++++---- usr.bin/ssh/sshd_config.5 | 10 ++++++---- 4 files changed, 18 insertions(+), 14 deletions(-) (limited to 'usr.bin') diff --git a/usr.bin/ssh/readconf.c b/usr.bin/ssh/readconf.c index 5d17b725600..ab6342dbc9b 100644 --- a/usr.bin/ssh/readconf.c +++ b/usr.bin/ssh/readconf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: readconf.c,v 1.283 2018/02/23 15:58:37 markus Exp $ */ +/* $OpenBSD: readconf.c,v 1.284 2018/04/04 15:12:17 job Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1981,9 +1981,9 @@ fill_default_options(Options * options) if (options->visual_host_key == -1) options->visual_host_key = 0; if (options->ip_qos_interactive == -1) - options->ip_qos_interactive = IPTOS_LOWDELAY; + options->ip_qos_interactive = IPTOS_DSCP_AF21; if (options->ip_qos_bulk == -1) - options->ip_qos_bulk = IPTOS_THROUGHPUT; + options->ip_qos_bulk = IPTOS_DSCP_CS1; if (options->request_tty == -1) options->request_tty = REQUEST_TTY_AUTO; if (options->proxy_use_fdpass == -1) diff --git a/usr.bin/ssh/servconf.c b/usr.bin/ssh/servconf.c index 69c17907317..e1c97c49650 100644 --- a/usr.bin/ssh/servconf.c +++ b/usr.bin/ssh/servconf.c @@ -1,5 +1,5 @@ -/* $OpenBSD: servconf.c,v 1.326 2018/03/01 20:32:16 markus Exp $ */ +/* $OpenBSD: servconf.c,v 1.327 2018/04/04 15:12:17 job Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -351,9 +351,9 @@ fill_default_server_options(ServerOptions *options) if (options->permit_tun == -1) options->permit_tun = SSH_TUNMODE_NO; if (options->ip_qos_interactive == -1) - options->ip_qos_interactive = IPTOS_LOWDELAY; + options->ip_qos_interactive = IPTOS_DSCP_AF21; if (options->ip_qos_bulk == -1) - options->ip_qos_bulk = IPTOS_THROUGHPUT; + options->ip_qos_bulk = IPTOS_DSCP_CS1; if (options->version_addendum == NULL) options->version_addendum = xstrdup(""); if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1) diff --git a/usr.bin/ssh/ssh_config.5 b/usr.bin/ssh/ssh_config.5 index 71705cabdda..010bca4798e 100644 --- a/usr.bin/ssh/ssh_config.5 +++ b/usr.bin/ssh/ssh_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: ssh_config.5,v 1.268 2018/02/23 07:38:09 jmc Exp $ -.Dd $Mdocdate: February 23 2018 $ +.\" $OpenBSD: ssh_config.5,v 1.269 2018/04/04 15:12:17 job Exp $ +.Dd $Mdocdate: April 4 2018 $ .Dt SSH_CONFIG 5 .Os .Sh NAME @@ -984,9 +984,11 @@ If one argument is specified, it is used as the packet class unconditionally. If two values are specified, the first is automatically selected for interactive sessions and the second for non-interactive sessions. The default is -.Cm lowdelay +.Cm af21 +.Ar (Low-Latency Data) for interactive sessions and -.Cm throughput +.Cm cs1 +.Ar (Lower Effort) for non-interactive sessions. .It Cm KbdInteractiveAuthentication Specifies whether to use keyboard-interactive authentication. diff --git a/usr.bin/ssh/sshd_config.5 b/usr.bin/ssh/sshd_config.5 index e051df91254..b93ad91e482 100644 --- a/usr.bin/ssh/sshd_config.5 +++ b/usr.bin/ssh/sshd_config.5 @@ -33,8 +33,8 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.\" $OpenBSD: sshd_config.5,v 1.263 2018/02/16 02:40:45 djm Exp $ -.Dd $Mdocdate: February 16 2018 $ +.\" $OpenBSD: sshd_config.5,v 1.264 2018/04/04 15:12:17 job Exp $ +.Dd $Mdocdate: April 4 2018 $ .Dt SSHD_CONFIG 5 .Os .Sh NAME @@ -817,9 +817,11 @@ If one argument is specified, it is used as the packet class unconditionally. If two values are specified, the first is automatically selected for interactive sessions and the second for non-interactive sessions. The default is -.Cm lowdelay +.Cm af21 +.Ar (Low-Latency Data) for interactive sessions and -.Cm throughput +.Cm cs1 +.Ar (Lower Effort) for non-interactive sessions. .It Cm KbdInteractiveAuthentication Specifies whether to allow keyboard-interactive authentication. -- cgit v1.2.3