K 10
svn:author
V 5
eugen
K 8
svn:date
V 27
2018-11-20T10:43:18.521173Z
K 7
svn:log
V 750
MFC r339558: New sysctl: net.inet.icmp.error_keeptags

  Currently, icmp_error() function copies FIB number from original packet
  into generated ICMP response but not mbuf_tags(9) chain.
  This prevents us from easily matching ICMP responses corresponding
  to tagged original packets by means of packet filter such as ipfw(8).
  For example, ICMP "time-exceeded in-transit" packets usually generated
  in response to traceroute probes lose tags attached to original packets.

  This change adds new sysctl net.inet.icmp.error_keeptags
  that defaults to 0 to avoid extra overhead when this feature not needed.

  Set net.inet.icmp.error_keeptags=1 to make icmp_error() copy mbuf_tags
  from original packet to generated ICMP response.

PR:		215874

END