IPQoS

[Chris Wilson]

Hi Saku,

On Thu, 13 Feb 2014, Saku Ytti wrote:

> Real networks use either PREC (as it maps 1:1 to 802.1p and MPLS TC) or 
> DSCP. Interactive SSH uses PREC 0x0, which is just best-effort and DSCP 
> 0x4 which has no standard meaning (found network where DSCP 0x4 was 
> dropped, completely, as it didn't hit any defined/allowed QoS class, 
> obviously misconfig, BE class should eat anything not already defined)
>
> Should interactive use TOS value which has highest chance for priority 
> behaviour? If so, then PREC 5 == DSCP CS5 is best bet.

To my knowledge, DSCP code points have no predefined global 
interpretation. Their actual interpretation depends on network policy of 
the network where they are found. The only way to set a sensible DSCP on 
SSH packets is to make the actual code point configurable, so that admins 
can configure it according to their site policy.

Because of that, there is no universal agreement (and can never be) on the 
meanings of TOS flags or DSCP code points when packets move between 
networks. One must understand the DSCP/TOS assignment of each network that 
one connects to, and remap inbound packets to conform to one's own policy.

Since this is a complete and utter nightmare of impossibility, virtually 
nobody has actually done it. I've never seen a packet tagged with a DSCP 
code point inbound to my networks. Admittedly I haven't been looking very 
hard, but I do use TOS bits extensively.

Because, since DSCP is useless between networks, an informal ad-hoc 
"standard" based on the old TOS values has evolved and is in widespread 
use (but certainly not universal), despite the IETF's best (not very good) 
effort to "kill it off" by redefining the bits with incompatible meanings 
in DSCP and ECN.

OpenSSH is conforming to this "informal standard", and with its huge 
installed user base, helping to define it as well. It already does set a 
high-priority TOS flag on interactive sessions, and low-priority on 
non-interactive ones:

* https://bugs.launchpad.net/ubuntu/+source/openssh/+bug/1067522
* http://www.gossamer-threads.com/lists/openssh/dev/48410

Until the ability to set a user-defined DSCP is implemented, you would 
need to remap outgoing packets on your SSH clients and servers to change 
the TOS flags into DSCP code points according to your site policies.

Cheers, Chris.
-- 
_____ __     _
\  __/ / ,__(_)_  | Chris Wilson <chris+sig at qwirx.com> Cambs UK |
/ (_/ ,\/ _/ /_ \ | Security/C/C++/Java/Ruby/Perl/SQL Developer |
\__/_/_/_//_/___/ | We are GNU : free your mind & your software |