Re: Alias config

-----BEGIN PGP SIGNED MESSAGE-----

Christian is getting route errors when using 2.04 atop the 2.6 native IPsec=
=20
backport on Debian. For more information, see the original thread:

https://lists.freeswan.org/pipermail/users/2004-January/msg00883.html

Using the 2.6 backport, the PLUTO_INTERFACE variable passed to the _updown=
=20
script during a route-host/client will always be the physical interface. If=
=20
you're using an aliased/labelled interface - eg, eth0:1 - iproute2 will err=
or=20
out, as it doesn't accept interface labels as "dev" when issuing ip route=
=20
commands, eg:

Cannot find device "eth0:1"

... it wants the underlying, physical interface. Thus, the route command=20
fails, but statically defining PLUTO_INTERFACE=3Deth0 (as Christian did)=20
succeeds.

This error is specific to the 2.6 backport + iproute2-based _updown script.=
=20
When using KLIPS, the ipsecN device is always passed as PLUTO_INTERFACE, an=
d=20
so will not produce iproute2 errors (even if it is bound to an aliased=20
interface). When using the "route"-based _updown script, supplying aliased=
=20
interfaces is acceptable.

This needs to be addressed. Pluto might refuse to pass aliased interfaces=
=20
(unlikely), the iproute2 _updown could parse PLUTO_INTERFACE to provide an=
=20
appropriate dev parameter for ip route, or...

- --=20
Sam Sgro
[email protected]

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
Comment: For the matching public key, finger the Reply-To: address.

iQCVAwUBQBLpu0OSC4btEQUtAQF+1wQAhoZYgogBvr0VItFZI4vaDa+UfBHl62im
1OakG9Q9GLbXJTOzQubCQbZLYUjoOmTIVRXNpUPlKND9sTtWrqnLyACXGWbDlLBp
GTQGAyAdYVdvTQg1U8afBVa+VF4ACor74B1EDR+pMysTYQ0iZ38Po7GhDomz5nEu
kUwdur2d4eE=3D
=3DeZIF
-----END PGP SIGNATURE-----