[Openswan dev] iproute2, 26sec

Hans Fugal fugalh at gmail.com
Wed Oct 6 13:27:04 CEST 2004

Pardon my bluntness, but this is absolutely broken. I didn't find any
discussions about it through google, but I'm open to reading what has
been said/done before.

I have a pretty simple setup.

  - eth0:
  - eth1:

  - eth0:
  - eth0, after NAT:

On falcon,
default via dev ppp0

I set up ipsec.conf like so:

conn falcon-wencor

This works fine, but routing isn't configured properly. _updown tries
to set up a bogus route (from falcon's perspective):
... _updown: doroute `ip route add via dev eth0
 ' failed (RTNETLINK answers: Network is unreachable)

The simplest correct route to create would be:
  ip route add dev ppp0
Notice no via, and ppp0 which is the device of the default route.  In
addition, I would like to add "src". To do so would require
knowing which local IP is wanted, and there's no good way of doing
this that I know of in the config file (but I would like to see one).
There's the possibility of a parameter to leftupdown, and that works
if you're doing your own updown script.

If I change {left,right}nexthop I get strange behavior that I still
don't understand. It causes error messages like this:
cannot respond to IPsec SA request because no connection is known for[C=US, O=fugal.net, CN=falcon.fugal.net,
E=hans at fugal.net]...[C=US, ST=Utah, L=Provo,
O=fugal.net, CN=Hans Fugal, E=hans at fugal.net]===

>From the source of _updown I think setting nexthop would help the
routing situation, but I can't get that to work.

I'm not just complaining; I have suggestions and even some code. My
first suggestion is a way to specify in the config file that I don't
want to do routing. I can set up my routes once and not have to worry
about it. As it is, even when I do manually set the routes they get
deleted. (even though I have short-circuited doroute() in _updown,
apparently something else deletes the routes on restart?)

My second suggestion is to not try so hard and use a simpler route
command. I think this boils down to PLUTO_NEXT_HOP is always set now,
even though in the code it looks like it expects it not to be set
sometimes. So maybe some smarts to see if PLUTO_NEXT_HOP is a local
network that we can reach directly, or maybe just leaving out any via
clause altogether.

My third suggestion is some way in the config file to set
PLUTO_MY_SOURCEIP per connection. /etc/sysconfig/defaultsource, apart
from being in a distro-specific location, is pretty global.

This patch summarizes the latter two:

--- programs/_updown/_updown.ip2.in     2004-06-01 07:30:57.000000000 -0600
+++ /usr/lib/ipsec/_updown      2004-10-06 12:11:29.000000000 -0600
@@ -286,11 +286,21 @@
 doroute() {
-       if [ -n "$PLUTO_NEXT_HOP" ]
+#      if [ -n "$PLUTO_NEXT_HOP" ]
+#      then
+#         parms2="via $PLUTO_NEXT_HOP"
+#      fi
+       nexthop_dev=`ip route get $PLUTO_NEXT_HOP|head -1|egrep -o "dev [^ ]+"`
+       if [ "dev $PLUTO_INTERFACE" != "$nexthop_dev" ]; 
-          parms2="via $PLUTO_NEXT_HOP"
+          echo "doroute WARNING: \
+          PLUTO_INTERFACE doesn't match kernel's idea of how to get to \
        parms2="$parms2 dev $PLUTO_INTERFACE"
        if [ -n "$PLUTO_IPROUTETABLE" ] && [ "$PLUTO_IPROUTETABLE" != "main" ]
@@ -298,6 +308,8 @@
            parms3="table $PLUTO_IPROUTETABLE"
+       # Gee it would be nice to get this from the config file somehow, on a
+       # per-connection basis.
        if [ -z "$PLUTO_MY_SOURCEIP" ]
            if [ -f /etc/sysconfig/defaultsource ]

PS I didn't submit this as a bug because it deserves discussion and to
be seen by the users (because they can use my patch immediately in
their own leftupdown script).

De gustibus non disputandum est.

More information about the Dev mailing list