From: David Hill <dhill@mindcry.org>
Subject: ntpd - use dscp (diff)
To: tech@openbsd.org
Date: Tue, 21 Oct 2025 20:44:57 +0000

Hello,

This diff adds DSCP EF for ipv6 ntp packets, and switches ipv4 to it as 
well.  This also matches 
https://github.com/ntp-project/ntp/blob/8a37f9b66d374b164531f0189caba4cbfd68bb61/ntpd/ntp_io.c#L79

Thoughts?

Index: usr.sbin/ntpd/client.c
===================================================================
RCS file: /cvs/src/usr.sbin/ntpd/client.c,v
diff -u -p -r1.118 client.c
--- usr.sbin/ntpd/client.c	20 Dec 2023 15:36:36 -0000	1.118
+++ usr.sbin/ntpd/client.c	21 Oct 2025 20:09:55 -0000
@@ -181,10 +181,17 @@ client_query(struct ntp_peer *p)
  			} else
  				fatal("client_query connect");
  		}
-		val = IPTOS_LOWDELAY;
-		if (p->addr->ss.ss_family == AF_INET && setsockopt(p->query.fd,
-		    IPPROTO_IP, IP_TOS, &val, sizeof(val)) == -1)
-			log_warn("setsockopt IPTOS_LOWDELAY");
+		val = IPTOS_DSCP_EF;
+		switch (p->addr->ss.ss_family) {
+		case AF_INET:
+			if (setsockopt(p->query.fd, IPPROTO_IP, IP_TOS,
+			    &val, sizeof(val)) == -1)
+				log_warn("setsockopt IPTOS_DSCP_EF");
+		case AF_INET6:
+			if (setsockopt(p->query.fd, IPPROTO_IPV6, IPV6_TCLASS,
+			    &val, sizeof(val)) == -1)
+				log_warn("setsockopt IPTOS_DSCP_EF");
+		}
  		val = 1;
  		if (setsockopt(p->query.fd, SOL_SOCKET, SO_TIMESTAMP,
  		    &val, sizeof(val)) == -1)
Index: usr.sbin/ntpd/server.c
===================================================================
RCS file: /cvs/src/usr.sbin/ntpd/server.c,v
diff -u -p -r1.44 server.c
--- usr.sbin/ntpd/server.c	3 Sep 2016 11:52:06 -0000	1.44
+++ usr.sbin/ntpd/server.c	21 Oct 2025 20:09:55 -0000
@@ -39,7 +39,7 @@ setup_listeners(struct servent *se, stru
  	u_int8_t		*a6;
  	size_t			 sa6len = sizeof(struct in6_addr);
  	u_int			 new_cnt = 0;
-	int			 tos = IPTOS_LOWDELAY, rdomain = 0;
+	int			 tos = IPTOS_DSCP_EF, rdomain = 0;

  	TAILQ_FOREACH(lap, &lconf->listen_addrs, entry) {
  		switch (lap->sa.ss_family) {
@@ -119,10 +119,16 @@ setup_listeners(struct servent *se, stru
  		if ((la->fd = socket(la->sa.ss_family, SOCK_DGRAM, 0)) == -1)
  			fatal("socket");

-		if (la->sa.ss_family == AF_INET && setsockopt(la->fd,
-		    IPPROTO_IP, IP_TOS, &tos, sizeof(tos)) == -1)
-			log_warn("setsockopt IPTOS_LOWDELAY");
-
+		switch (la->sa.ss_family) {
+		case AF_INET:
+			if (setsockopt(la->fd, IPPROTO_IP, IP_TOS,
+			    &tos, sizeof(tos)) == -1)
+				log_warn("setsockopt IPTOS_DSCP_EF");
+		case AF_INET6:
+			if (setsockopt(la->fd, IPPROTO_IPV6, IPV6_TCLASS,
+			    &tos, sizeof(tos)) == -1)
+				log_warn("setsockopt IPTOS_DSCP_EF");
+		}
  		if (la->rtable != -1 &&
  		    setsockopt(la->fd, SOL_SOCKET, SO_RTABLE, &la->rtable,
  		    sizeof(la->rtable)) == -1)