Background
In the LB frontend path, we intentionally ignore ICMP traffic (as services can only be defined for TCP/UDP/SCTP).

But we currently also ignore ICMP traffic in the RevDNAT code path for replies by service backends (eg. the local backend path). This prevents ICMP error messages by the backend from being RevDNATed, and thus from reaching the client with the expected Source IP / Port.

This affects all backend types:

• DSR (where the outbound NAT path would need to look at the ICMP packet's payload, and derive the DSR-SNAT entry from it)
• remote backend (where the LB's inbound RevNAT path would need to look at the ICMP packet's payload, do a CT lookup and obtain the RevNAT-Index from it),
• local backend (same as remote backend)

One special case for "local backend" is that the ICMP packet is currently handled via tail-call from bpf_lxc - and the missing RevDNAT action is unexpected, and thus the packet is dropped.

Proposal
Implement ICMP support in the RevDNAT path for service replies.