From owner-freebsd-current@freebsd.org Fri Nov 13 02:30:20 2015 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 53648A2DF63; Fri, 13 Nov 2015 02:30:20 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 132C613A6; Fri, 13 Nov 2015 02:30:19 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from Julian-MBP3.local (ppp121-45-243-9.lns20.per4.internode.on.net [121.45.243.9]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id tAD2U3fB000611 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Thu, 12 Nov 2015 18:30:06 -0800 (PST) (envelope-from julian@freebsd.org) Subject: Re: OpenSSH HPN To: Brooks Davis , Bryan Drewery References: <86io5a9ome.fsf@desk.des.no> <56428E8A.3090201@FreeBSD.org> <20151111192806.GB44561@spindle.one-eyed-alien.net> Cc: Dag-Erling Sm??rgrav , freebsd-current@freebsd.org, freebsd-security@freebsd.org From: Julian Elischer Message-ID: <56454B26.7050300@freebsd.org> Date: Fri, 13 Nov 2015 10:29:58 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <20151111192806.GB44561@spindle.one-eyed-alien.net> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 13 Nov 2015 02:30:20 -0000 On 11/12/15 3:28 AM, Brooks Davis wrote: > On Tue, Nov 10, 2015 at 04:40:42PM -0800, Bryan Drewery wrote: >> On 11/10/15 1:42 AM, Dag-Erling Sm??rgrav wrote: >>> Some of you may have noticed that OpenSSH in base is lagging far behind >>> the upstream code. >>> >>> The main reason for this is the burden of maintaining the HPN patches. >>> They are extensive, very intrusive, and touch parts of the OpenSSH code >>> that change significantly in every release. Since they are not >>> regularly updated, I have to choose between trying to resolve the >>> conflicts myself (hoping I don't break anything) or waiting for them to >>> catch up and then figuring out how to apply the new version. >>> >>> Therefore, I would like to remove the HPN patches from base and refer >>> anyone who really needs them to the openssh-portable port, which has >>> them as a default option. I would also like to remove the NONE cipher >>> patch, which is also available in the port (off by default, just like in >>> base). >> I had this same problem as well, but have since reworked the HPN patch >> for ports to be more easily maintained. I've considered offering or >> just updating the base SSH, but have not since we have random changes in >> the HPN functionality in base that would be lost. We for some reason >> decided we were going to maintain our own version and not even upstream >> the changes to the HPN authors which has contributed to this situation. > We had ever intention of upstreaming our cleaned up HPN patches and some > interest from OpenSSH devs to take the window scaling portion of the > patch upstream, but other things intruded and we never found time to > complete that work. I think both the window scaling and NONE cipher > changes are useful, but do not have time to do anything with them. I'm > fine with them being removed from base and replaced or just dropped if > they are in the way of progress. it would be nice if the outcome of this thread was that HPN patches (or something equivalent) were available by default in OpenSSH. WE also have our own patch we add to give a NODELAY option. It made a huge difference with tunnels where lots of small RPC packets were being sent. I'll look at getting it into upstream. > > -- Brooks