Source address selection for ICMP error message

Source address selection for ICMP error message

[Chun Wang]

Hi all

I've got 2 units network:

+----------------------+
|                      |
|vlan23:172.16.23.2/24 |
+----------------------+
           |
           |
           |
+----------------------+
|VRF lo1               |
|vlan20: 172.16.20.1/24|
|vlan21: 172.16.21.1/24|
|vlan22: 172.16.22.1/24|
|vlan23: 172.16.23.1/24|
|vlan24: 172.16.24.1/24|
|                      |
|                      |
+----------------------+

Interface vlan20,vlan21,vlan22,vlan23 and vlan24 are enslaved in VRF on
one of the unit.

#ip route show vrf lo1
172.16.20.0/24 dev vlan20 proto kernel scope link src 172.16.20.1 
172.16.21.0/24 dev vlan21 proto kernel scope link src 172.16.21.1 
172.16.22.0/24 dev vlan22 proto kernel scope link src 172.16.22.1 
172.16.23.0/24 dev vlan23 proto kernel scope link src 172.16.23.1 
172.16.24.0/24 dev vlan24 proto kernel scope link src 172.16.24.1 

When I ping 172.16.22.4 and 2.2.2.2 from 172.16.23.2. The source
address of the icmp error is 172.16.20.1, not 172.16.23.1 which I
expected. 

#ping 172.16.24.5     
PING 172.16.24.5 (172.16.24.5) 56(84) bytes of data.
From 172.16.20.1 icmp_seq=1 Destination Host Unreachable   
From 172.16.20.1 icmp_seq=2 Destination Host Unreachable
From 172.16.20.1 icmp_seq=3 Destination Host Unreachable
From 172.16.20.1 icmp_seq=4 Destination Host Unreachable
From 172.16.20.1 icmp_seq=5 Destination Host Unreachable

#ping 2.2.2.2         
PING 2.2.2.2 (2.2.2.2) 56(84) bytes of data.
From 172.16.20.1 icmp_seq=1 Destination Net Unreachable
From 172.16.20.1 icmp_seq=2 Destination Net Unreachable
From 172.16.20.1 icmp_seq=3 Destination Net Unreachable
From 172.16.20.1 icmp_seq=4 Destination Net Unreachable

The units have linux version 4.4.6 and
"sysctl_icmp_errors_use_inbound_ifaddr" is set to 1(this is required
and I have no intention to change this). 

Is the source address selection in this case correct? Will the latest
inux version return 172.16.23.1 instead of 172.16.20.1 in this case? If
not, what's the best way to solve this?

I haven't subscribed to this list yet, please CC me the
answers/comments. 

Thanks for your help,
Chun