IPv4 has the "net.inet.icmp.reply_from_interface" and "net.inet.icmp.reply_src" sysctls to influence source address selection for generated ICMP error responses (most typically, "administratively prohibited" or "ttl expired"). By default, these packets are sent with the source address of the interface where the generated ICMP packet is leaving out. In a router/firewall context, "many network devices" use the source address of the interface where the original packet (that triggered the ICMP reply) came *in* on - which makes, for example "traceroute" show up the ingress interface into the router. This is a very valuable tool. If you want FreeBSD to do the same thing, you set "net.inet.icmp.reply_from_interface=1" - which works very nicely. Here comes the feature request: IPv6 support does not have either sysctl today (at least up to 12.1). Building a dual-stack setup with "I can do this in IPv4 but not in IPv6" is not good. Can such functionality be added to the IPv6 ICMP generation as well? The IPv4 code path looks fairly simple (~30 lines of code), but I most certainly do not understand the networking code myself to contribute an IPv6 equivalent. Thanks :-)
Our IPv6 implementation uses source address selection algorithm defined in RFC3484. You have some abilities to modify default source address selection by using policies or prefer_source flag. Is it not enough for what you want?
No, as RFC3484 / RFC6724 do not take context into account ("packet comes in on em0, so use em0 source for the ICMP error packet, even if we intend to send the packet via em3"). I do not want *all* packets generated from this machine to use the "em0" source (so, not for outgoing TCP, for example), just generated ICMPs in reply to packets coming in on "em0". Like, exactly what the v4 stack can be told to do :-)
I'm interested on working on this feature.
If you want this feature, I have a Phabricator review here: https://reviews.freebsd.org/D25181
Can I test this with a 12.1-RELEASE source tree, or do I need CURRENT?
I wrote this patch on CURRENT. You might be able to backport this to 12.1 if you wanted. Try applying the patch to 12.1 if you prefer, and if it fails, then try CURRENT.
Compiled a CURRENT world + kernel (this VM is not exactly fast,so it took all night). Tested on the router VM it is for, and found that it works "mostly", but all ICMP packets are created with hlim=0. Commented in more detail in the Phabricator.