Bug 1963

Summary:

IPQoS not honoured

Product:

Portable OpenSSH

Reporter:

martin ➬ <bugzilla.mindrot.org>

Component:

ssh

Assignee:

Assigned to nobody <unassigned-bugs>

Status:

CLOSED WORKSFORME

Severity:

normal

CC:

djm, ggiesen+mindrot.org, sean

Priority:

Version:

5.8p1

Hardware:

amd64

OS:

Linux

URL:

http://bugs.debian.org/650512

Bug Depends on:

Bug Blocks:

1930

Attachments:

Description	Flags
bad-af.diff	dtucker: ok+

Description martin ➬ 2011-12-18 22:07:09 AEDT

While openssh-client seems to properly switch between the
lowdelay/throughput QoS classes depending on whether the session is
interactive or not, the new IPQoS option seems to have absolutely no
effect:

  % ssh -vvvo 'IPQoS ef' -4 -Snone vera 2>&1 >/dev/null | egrep tos || echo no match
  debug3: packet_set_tos: set IP_TOS 0x10
  ^D
  % ssh -vvvo 'IPQoS ef' -4 -Snone vera true 2>&1 >/dev/null | egrep tos || echo no match
  debug3: packet_set_tos: set IP_TOS 0x08

In both cases, the TOS value should be 0x2e (class ef). Using the
hex number does not work either:

  % ssh -vvvo 'IPQoS 0x2e' -4 -Snone vera 2>&1 >/dev/null | egrep tos || echo no match
  debug3: packet_set_tos: set IP_TOS 0x10
  ^D
  % ssh -vvvo 'IPQoS 0x2e' -4 -Snone vera true 2>&1 >/dev/null | egrep tos || echo no match
  debug3: packet_set_tos: set IP_TOS 0x08

I have also verified the actual packets emitted using tcpdump on the
next hop.

Exactly the same behaviour can be observed with IPv6 after upgrading to
1:5.9p1-7 (see http://bugs.debian.org/643312).

Comment 1 Damien Miller 2012-02-24 10:52:02 AEDT

Replicated, patch coming. This only affects portable OpenSSH, so we should be able to get a fix in 6.0.

Comment 2 Damien Miller 2012-02-24 10:55:19 AEDT

Created attachment 2130 [details]
bad-af.diff

Fix IPQoS in portable OpenSSH

Comment 3 Damien Miller 2012-02-24 11:25:22 AEDT

*** Bug 1965 has been marked as a duplicate of this bug. ***

Comment 4 Damien Miller 2012-03-09 10:28:30 AEDT

Fix applied - this will be in openssh-6.0, due real soon. Thanks!

Comment 5 martin ➬ 2012-10-14 17:01:40 AEDT

With reference to http://bugs.debian.org/650512, which I just reopened, I am sorry to say that the bug persists in OpenSSH 6.0.

Comment 6 Damien Miller 2012-10-15 12:07:55 AEDT

Debian OpenSSH 6.0 does indeed seem broken: attempting a connection with IPQoS=EF yields "tos 0x0" in tcpdumps.

However, stock OpenSSH 6.0 compiled from source works just fine. I see "tos 0xb8" as expected in my tcpdumps.

I suggest you search the patches applied downstream to see what broke it.

Comment 7 martin ➬ 2012-10-15 18:31:36 AEDT

I will of course take this up with the Debian maintainer, but from a cursory
look, I cannot find anything in the downstream patches:

    % grep -ri qos openssh-6.0p1/debian/patches                                   #10018
    openssh-6.0p1/debian/patches/keepalive-extensions.patch:        oKexAlgorithms, oIPQoS, oRequestTTY,
    openssh-6.0p1/debian/patches/keepalive-extensions.patch:        { "ipqos", oIPQoS },
    openssh-6.0p1/debian/patches/debian-banner.patch:       options->ip_qos_interactive = -1;
    openssh-6.0p1/debian/patches/debian-banner.patch:       options->ip_qos_bulk = -1;
    openssh-6.0p1/debian/patches/debian-banner.patch:               options->ip_qos_interactive = IPTOS_LOWDELAY;
    openssh-6.0p1/debian/patches/debian-banner.patch:       if (options->ip_qos_bulk == -1)
    openssh-6.0p1/debian/patches/debian-banner.patch:               options->ip_qos_bulk = IPTOS_THROUGHPUT;
    openssh-6.0p1/debian/patches/debian-banner.patch:       sKexAlgorithms, sIPQoS,
    openssh-6.0p1/debian/patches/debian-banner.patch:       { "ipqos", sIPQoS, SSHCFG_ALL },

(note that these are all context lines of the diffs, so no changes are being
made…)

Comment 8 Gary T. Giesen 2012-11-13 18:50:03 AEDT

I also see that a ~/.ssh/config file overrides any options specified on the command line. I would suspect that this should be the opposite (command-line always overrides config file)

Comment 9 Gary T. Giesen 2012-11-13 18:51:11 AEDT

Forgot to include that my platform is OpenSSH_6.1p1, OpenSSL 1.0.1c 10 May 2012, MacPorts version of openssh on Mac OS X 10.7 Lion.

Comment 10 Damien Miller 2012-11-13 19:33:00 AEDT

(In reply to comment #8)
> I also see that a ~/.ssh/config file overrides any options specified
> on the command line. 

No, it doesn't.

Comment 11 sean 2013-09-14 04:25:20 AEST

This doesn't appear to be Debian specific, or a problem with how patches were applied to the Debian version. I'm seeing the problem with the latest upstream version: openssh-6.3p1. I'm also seeing it with the version that ships with Debian 7.0 (Wheezy): openssh-6.0p1. I built these on a Debian Wheezy box. Just let me know if there are any other details I can provide.

I've updated the Debian bug that tracks this, here:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=650512#45

Comment 12 Damien Miller 2013-09-14 09:17:51 AEST

I just rechecked. openssh-6.3p1 does set tos on Ubuntu Precise.

Note that it isn't set before the user authenticates, so you need to look a fair way into the connection to see it.

Comment 13 Damien Miller 2015-08-11 23:05:04 AEST

Set all RESOLVED bugs to CLOSED with release of OpenSSH 7.1