linux-kernel - Source address selection for ICMP error message

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 6 Aug 2019 05:32:57 +0000
From:   Chun Wang <Chun.Wang@...iedtelesis.co.nz>
To:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Source address selection for ICMP error message

Hi all

I've got 2 units network:

+----------------------+
|                      |
|vlan23:172.16.23.2/24 |
+----------------------+
           |
           |
           |
+----------------------+
|VRF lo1               |
|vlan20: 172.16.20.1/24|
|vlan21: 172.16.21.1/24|
|vlan22: 172.16.22.1/24|
|vlan23: 172.16.23.1/24|
|vlan24: 172.16.24.1/24|
|                      |
|                      |
+----------------------+

Interface vlan20,vlan21,vlan22,vlan23 and vlan24 are enslaved in VRF on
one of the unit.

#ip route show vrf lo1
172.16.20.0/24 dev vlan20 proto kernel scope link src 172.16.20.1 
172.16.21.0/24 dev vlan21 proto kernel scope link src 172.16.21.1 
172.16.22.0/24 dev vlan22 proto kernel scope link src 172.16.22.1 
172.16.23.0/24 dev vlan23 proto kernel scope link src 172.16.23.1 
172.16.24.0/24 dev vlan24 proto kernel scope link src 172.16.24.1 

When I ping 172.16.22.4 and 2.2.2.2 from 172.16.23.2. The source
address of the icmp error is 172.16.20.1, not 172.16.23.1 which I
expected. 

#ping 172.16.24.5     
PING 172.16.24.5 (172.16.24.5) 56(84) bytes of data.
From 172.16.20.1 icmp_seq=1 Destination Host Unreachable   
From 172.16.20.1 icmp_seq=2 Destination Host Unreachable
From 172.16.20.1 icmp_seq=3 Destination Host Unreachable
From 172.16.20.1 icmp_seq=4 Destination Host Unreachable
From 172.16.20.1 icmp_seq=5 Destination Host Unreachable

#ping 2.2.2.2         
PING 2.2.2.2 (2.2.2.2) 56(84) bytes of data.
From 172.16.20.1 icmp_seq=1 Destination Net Unreachable
From 172.16.20.1 icmp_seq=2 Destination Net Unreachable
From 172.16.20.1 icmp_seq=3 Destination Net Unreachable
From 172.16.20.1 icmp_seq=4 Destination Net Unreachable

The units have linux version 4.4.6 and
"sysctl_icmp_errors_use_inbound_ifaddr" is set to 1(this is required
and I have no intention to change this). 

Is the source address selection in this case correct? Will the latest
inux version return 172.16.23.1 instead of 172.16.20.1 in this case? If
not, what's the best way to solve this?

I haven't subscribed to this list yet, please CC me the
answers/comments. 

Thanks for your help,
Chun