upstream: Use the operating system default DSCP marking for

non-interactive traffic

It seems the CS1 traffic class mark is considered ambiguous and therefore
somewhat unhelpful (see RFC 8622 for more considerations). But, the new
'LE' scavenger class (also proposed in RFC 8622) offers high probability
of excessive delays & high packet loss, which would be inappropriate
for use with, for example, X11 forwardings. In fact, it is not known to
SSH what's appropriate because SSH is not aware of the content of what
passing through session forwardings. Therefore, no marking is appropriate.
Non-interactive traffic simply is best effort.

OK djm@ deraadt@

OpenBSD-Commit-ID: db1da1a432ecd53fc28feb84287aedb6bec80b01

diff --git a/readconf.c b/readconf.c
index 02452edbf1d2068dfa9be0ab7cbf487e97eef297..781e5b004068d9800173a0c290da894c51338fd4 100644 (file)
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.403 2025/07/31 11:23:39 job Exp $ */
+/* $OpenBSD: readconf.c,v 1.404 2025/08/05 09:08:16 job Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2961,7 +2961,7 @@ fill_default_options(Options * options)
        if (options->ip_qos_interactive == -1)
                options->ip_qos_interactive = IPTOS_DSCP_EF;
        if (options->ip_qos_bulk == -1)
-               options->ip_qos_bulk = IPTOS_DSCP_CS1;
+               options->ip_qos_bulk = IPTOS_DSCP_CS0;
        if (options->request_tty == -1)
                options->request_tty = REQUEST_TTY_AUTO;
        if (options->session_type == -1)

diff --git a/servconf.c b/servconf.c
index 2bd9d11916ad60a7ffc46e0ba040fb2803f88025..92f924e6015cef033f28a951929a7faf47fc2186 100644 (file)
--- a/servconf.c
+++ b/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.429 2025/07/31 11:23:39 job Exp $ */
+/* $OpenBSD: servconf.c,v 1.430 2025/08/05 09:08:16 job Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -474,7 +474,7 @@ fill_default_server_options(ServerOptions *options)
        if (options->ip_qos_interactive == -1)
                options->ip_qos_interactive = IPTOS_DSCP_EF;
        if (options->ip_qos_bulk == -1)
-               options->ip_qos_bulk = IPTOS_DSCP_CS1;
+               options->ip_qos_bulk = IPTOS_DSCP_CS0;
        if (options->version_addendum == NULL)
                options->version_addendum = xstrdup("");
        if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)

diff --git a/ssh_config.5 b/ssh_config.5
index 390bc44aba8efe2d7a1f67ad0b01f6eb35e9ed62..f1673e0149105bc88cf18419f0939705104f9718 100644 (file)
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.416 2025/07/31 11:23:39 job Exp $
-.Dd $Mdocdate: July 31 2025 $
+.\" $OpenBSD: ssh_config.5,v 1.417 2025/08/05 09:08:16 job Exp $
+.Dd $Mdocdate: August 5 2025 $
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -1279,8 +1279,8 @@ The default is
 .Cm ef
 (Expedited Forwarding)
 for interactive sessions and
-.Cm cs1
-(Lower Effort)
+.Cm none
+(the operating system default)
 for non-interactive sessions.
 .It Cm KbdInteractiveAuthentication
 Specifies whether to use keyboard-interactive authentication.

diff --git a/sshd_config.5 b/sshd_config.5
index ee1b2934138d1b86d91a0bfbfc6e512b8a1b4d01..4536286b750d177f0c84de0e657936062ab2f07a 100644 (file)
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.383 2025/07/31 11:23:39 job Exp $
-.Dd $Mdocdate: July 31 2025 $
+.\" $OpenBSD: sshd_config.5,v 1.384 2025/08/05 09:08:16 job Exp $
+.Dd $Mdocdate: August 5 2025 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -960,8 +960,8 @@ The default is
 .Cm ef
 (Expedited Forwarding)
 for interactive sessions and
-.Cm cs1
-(Lower Effort)
+.Cm none
+(the operating system default)
 for non-interactive sessions.
 .It Cm KbdInteractiveAuthentication
 Specifies whether to allow keyboard-interactive authentication.