On 23 Nov 2015, at 23:59, David Ahern <dsa@xxxxxxxxxxxxxxxxxxx> wrote: >> What's wrong with the existing BindAddress option? >> > > For my use case the problem is that it is an address, not a device. > > The VRF implementation with Linux expects tasks to use the SO_BINDTODEVICE option to bind to the VRF-device. That triggers the use of a route table associated with the VRF domain which can encapsulate one or more network interfaces. Addresses are local to a VRF domain (e.g., 2 interfaces in 2 different VRFs can have the same IP address). > > i.e., to run ssh/scp/sftp/sshd in a VRF context requires the bind to device option. Just to add a little more colour to this, I believe the reason that SO_BINDTODEVICE is necessary rather than binding to the address is that in a VRF environment the same address may be present on multiple interfaces. Therefore, address cannot be used in order to select the VRF. However, the VRF can be uniquely determined from the interface. -- Alex Bligh _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
