Merge ~paelzer/ubuntu/+source/openssh:disco-lp-1822370-revert-QoS-defaults into ubuntu/+source/openssh:ubuntu/disco-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

FYI - if possible we'd like to fix this in Buster and do a very late sync.
But if not we want to have the Ubuntu solution at least ready and discussable - that is what this MP represents.

PPA at https://launchpad.net/~paelzer/+archive/ubuntu/bug-1822370-openssh-qos-defaults

[Andreas Hasenack (ahasenack)]

This looks fix released in debian and ubuntu (in disco even) already:
openssh (1:7.9p1-10) unstable; urgency=medium

  * Temporarily revert IPQoS defaults to pre-7.8 values until issues with
    "iptables -m tos" and VMware have been fixed (closes: #923879, #926229;
    LP: #1822370).

 -- Colin Watson <email address hidden> Mon, 08 Apr 2019 11:13:04 +0100

1:7.9p1-10 is in disco. Can we close this MP?

review: Needs Information

[Christian Ehrhardt  (paelzer)]

Yes this is done by the work of cjwatson (which was the preferred way anyway).
Closing the MP

Unmerged commits

a3132ad... by Christian Ehrhardt  on 2019-04-02

changelog: revert QoS defaults (LP: #1822370)

Signed-off-by: Christian Ehrhardt <email address hidden>

d498f85... by Christian Ehrhardt  on 2019-04-02

d/p/lp-1822370-revert-IPQos-defaults.patch: revert QoS defaults (LP: #1822370)

revert QoS defaults as the new defaults trigger issues with
'iptables -m tos' and target systems running under VMWare

Signed-off-by: Christian Ehrhardt <email address hidden>

diff --git a/debian/changelog b/debian/changelog
index cc103b7..69c51d6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+openssh (1:7.9p1-9ubuntu1) disco; urgency=medium
+
+  * d/p/lp-1822370-revert-IPQos-defaults.patch: revert QoS defaults
+    as the new defaults trigger issues with 'iptables -m tos' and
+    target systems running under VMWare (LP: #1822370).
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 02 Apr 2019 13:01:35 +0200
+
 openssh (1:7.9p1-9) unstable; urgency=medium
 
   * Apply upstream patch to make scp handle shell-style brace expansions
diff --git a/debian/patches/lp-1822370-revert-IPQos-defaults.patch b/debian/patches/lp-1822370-revert-IPQos-defaults.patch
new file mode 100644
index 0000000..bd5db93
--- /dev/null
+++ b/debian/patches/lp-1822370-revert-IPQos-defaults.patch
@@ -0,0 +1,112 @@
+From 5ee8448ad7c306f05a9f56769f95336a8269f379 Mon Sep 17 00:00:00 2001
+From: "[e-mail]" <[e-mail]>
+Date: Wed, 4 Apr 2018 15:12:17 +0000
+Subject: [PATCH] upstream: Update default IPQoS in ssh(1), sshd(8) to DSCP
+ AF21 for
+
+interactive and CS1 for bulk
+
+AF21 was selected as this is the highest priority within the low-latency
+service class (and it is higher than what we have today). SSH is elastic
+and time-sensitive data, where a user is waiting for a response via the
+network in order to continue with a task at hand. As such, these flows
+should be considered foreground traffic, with delays or drops to such
+traffic directly impacting user-productivity.
+
+For bulk SSH traffic, the CS1 "Lower Effort" marker was chosen to enable
+networks implementing a scavanger/lower-than-best effort class to
+discriminate scp(1) below normal activities, such as web surfing. In
+general this type of bulk SSH traffic is a background activity.
+
+An advantage of using "AF21" for interactive SSH and "CS1" for bulk SSH
+is that they are recognisable values on all common platforms (IANA
+https://www.iana.org/assignments/dscp-registry/dscp-registry.xml), and
+for AF21 specifically a definition of the intended behavior exists
+https://tools.ietf.org/html/rfc4594#section-4.7 in addition to the definition
+of the Assured Forwarding PHB group https://tools.ietf.org/html/rfc2597, and
+for CS1 (Lower Effort) there is https://tools.ietf.org/html/rfc3662
+
+The first three bits of "AF21" map to the equivalent IEEEE 802.1D PCP, IEEE
+802.11e, MPLS EXP/CoS and IP Precedence value of 2 (also known as "Immediate",
+or "AC_BE"), and CS1's first 3 bits map to IEEEE 802.1D PCP, IEEE 802.11e,
+MPLS/CoS and IP Precedence value 1 ("Background" or "AC_BK").
+
+OK deraadt@, "no objection" djm@
+
+OpenBSD-Commit-ID: d11d2a4484f461524ef0c20870523dfcdeb52181
+
+# IF MODIFIED
+Author: Christian Ehrhardt <[e-mail]>
+Original-Author: "[e-mail]" <[e-mail]>
+Origin: backport (revert), https://anongit.mindrot.org/openssh.git/commit/?id=5ee8448ad7c306f05a9f56769f95336a8269f379
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1822370
+Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=926229
+Last-Update: 2019-04-02
+
+---
+ readconf.c    |  6 +++---
+ servconf.c    |  6 +++---
+ ssh_config.5  | 10 ++++++----
+ sshd_config.5 | 10 ++++++----
+ 4 files changed, 18 insertions(+), 14 deletions(-)
+
+--- a/readconf.c
++++ b/readconf.c
+@@ -2133,9 +2133,9 @@ fill_default_options(Options * options)
+ 	if (options->visual_host_key == -1)
+ 		options->visual_host_key = 0;
+ 	if (options->ip_qos_interactive == -1)
+-		options->ip_qos_interactive = IPTOS_DSCP_AF21;
++		options->ip_qos_interactive = IPTOS_LOWDELAY;
+ 	if (options->ip_qos_bulk == -1)
+-		options->ip_qos_bulk = IPTOS_DSCP_CS1;
++		options->ip_qos_bulk = IPTOS_THROUGHPUT;
+ 	if (options->request_tty == -1)
+ 		options->request_tty = REQUEST_TTY_AUTO;
+ 	if (options->proxy_use_fdpass == -1)
+--- a/servconf.c
++++ b/servconf.c
+@@ -403,9 +403,9 @@ fill_default_server_options(ServerOption
+ 	if (options->permit_tun == -1)
+ 		options->permit_tun = SSH_TUNMODE_NO;
+ 	if (options->ip_qos_interactive == -1)
+-		options->ip_qos_interactive = IPTOS_DSCP_AF21;
++		options->ip_qos_interactive = IPTOS_LOWDELAY;
+ 	if (options->ip_qos_bulk == -1)
+-		options->ip_qos_bulk = IPTOS_DSCP_CS1;
++		options->ip_qos_bulk = IPTOS_THROUGHPUT;
+ 	if (options->version_addendum == NULL)
+ 		options->version_addendum = xstrdup("");
+ 	if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -1055,11 +1055,9 @@ If one argument is specified, it is used
+ If two values are specified, the first is automatically selected for
+ interactive sessions and the second for non-interactive sessions.
+ The default is
+-.Cm af21
+-(Low-Latency Data)
++.Cm lowdelay
+ for interactive sessions and
+-.Cm cs1
+-(Lower Effort)
++.Cm throughput
+ for non-interactive sessions.
+ .It Cm KbdInteractiveAuthentication
+ Specifies whether to use keyboard-interactive authentication.
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -866,11 +866,9 @@ If one argument is specified, it is used
+ If two values are specified, the first is automatically selected for
+ interactive sessions and the second for non-interactive sessions.
+ The default is
+-.Cm af21
+-(Low-Latency Data)
++.Cm lowdelay
+ for interactive sessions and
+-.Cm cs1
+-(Lower Effort)
++.Cm throughput
+ for non-interactive sessions.
+ .It Cm KbdInteractiveAuthentication
+ Specifies whether to allow keyboard-interactive authentication.
diff --git a/debian/patches/series b/debian/patches/series
index ff60114..f2b71a9 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -31,3 +31,4 @@ check-filenames-in-scp-client.patch
 fix-key-type-check.patch
 request-rsa-sha2-cert-signatures.patch
 scp-handle-braces.patch
+lp-1822370-revert-IPQos-defaults.patch