microsoft / microsoft/WSL

[Pre-release 2.7.10] Non-interactive `ssh host <command>` hangs under mirrored networking (OpenSSH IPQoS mid-session retag)

Open
#41,101 17 comments 0 reactions 0 assignees View on GitHub
emailed-logs network
Dominant language
C++
Stars
33.7k
Forks
1.8k
Avg merge
3d 17h
Merged PRs (30d)
116

Description

### Windows Version
Microsoft Windows [Version 10.0.26200.8655]

### WSL Version
2.7.10.0 (pre-release)

```
WSL version: 2.7.10.0
Kernel version: 6.18.33.2-2
WSLg version: 1.0.73.2
MSRDC version: 1.2.6676
Direct3D version: 1.611.1-81528511
DXCore version: 10.0.26100.1-240331-1435.ge-release
Windows version: 10.0.26200.8655
```

### Are you using WSL 1 or WSL 2?
- [x] WSL 2
- [ ] WSL 1

### Kernel Version
6.18.33.2-2 (`6.18.33.2-microsoft-standard-WSL2`)

### Distro Version
Debian GNU/Linux 13 (trixie)

### Other Software
- OpenSSH_10.0p2 Debian-7+deb13u4 (client inside WSL)
- `.wslconfig` uses mirrored networking:

```ini
[wsl2]
networkingMode=mirrored
firewall=false
dnsTunneling=false
autoProxy=false
```

- Active NIC at time of repro: Intel Wi-Fi 6 AX201 (also reproduced to LAN host)
- No HP “LiveQoS” NDIS filter present; Microsoft QoS Packet Scheduler (`ms_pacer`) is enabled

### Repro Steps
1. Install **WSL pre-release 2.7.10.0** with `networkingMode=mirrored`.
2. From WSL, use stock OpenSSH defaults (`ssh -G ` reports `ipqos ef cs1`).
3. Interactive login works:

```bash
ssh
```

4. Any non-interactive remote command hangs after authentication:

```bash
ssh true
ssh 'echo ok'
ssh -T true
```

5. Same hang occurs to LAN hosts and to hosts reached via public DNS/WAN.
6. Workaround restores remote commands:

```bash
ssh -o IPQoS=none true
# or in ~/.ssh/config:
# Host *
# IPQoS none
```

7. **Does not reproduce** in either of these controls (same hosts / same style of non-interactive command):
- **Non-WSL** (native Windows / non-WSL SSH): `ssh ` works.
- **Non-pre-release / stable WSL** (same distro/OpenSSH settings/hosts): `ssh ` works.

Failure is specific to **WSL pre-release 2.7.10.0** in this environment.

### Expected Behavior
`ssh ` should complete normally (auth, exec, exit), same as interactive `ssh `.

### Actual Behavior
- Interactive `ssh ` succeeds.
- Non-interactive `ssh ` authenticates, then hangs indefinitely (no command output, no exit).
- `ssh -vvv` shows the session stalls after sending the exec request with channel receive window stuck at 0, e.g. `open confirm rwindow 0`, and never receives a window adjust / exit-status.
- Immediately after the command channel is set up, the client switches QoS (`set_sock_tos` / non-interactive path). OpenSSH default is interactive **EF**, bulk/non-interactive **CS1** (`IP_TOS 0x20`), with a **mid-session retag** when the session becomes non-interactive (OpenSSH/Debian IPQoS updates in 1:10.0p1-7+deb13u3+).

### Diagnostic Logs
**Theory:** WSL pre-release mirrored networking mishandles OpenSSH’s mid-connection DSCP/TOS change (EF → CS1). Interactive sessions never take the bulk retag path, so they keep working. Stable WSL does not show this failure.

**Workaround:** `IPQoS none` (or a single fixed class such as `IPQoS ef` / `IPQoS af21`) so OpenSSH does not retag mid-session.

Happy to gather Feedback Hub / networking logs if useful.

Contributor guide

Open the contributing guide

Research direction

Reproduce the hang with mirrored networking using `ssh -vvv` and compare the pre-release behavior with stable WSL, focusing on the EF-to-CS1 IPQoS transition described in the report. The fix is complete when non-interactive SSH commands finish with default IPQoS while interactive sessions and the listed controls continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.