Can be reused in other locations.

This is a prerequisite for letting host to handle TTL exceeded.

Sets up endpoints, routes etc, but does not run

to complement the fact that we can create an inactive workload

Check that the ports are fixed up after NATing the ICMP related back

Needs to update csum in the inner IP header instead of the outer.

When icmp generated by the next hop node, it needs to be placed in the
tunnel.

This is triggered by missing tcpdump or bad filter

only felix-test image has tcpdump installed, extrnal client has not

if SNAT, we also need to fix up the source in the outer IP

FV tests when ICMP is returned from host and from the backing workload

When we generate an ICMP in a workload or at a host in response to
traffic that originated through a NP tunnel ammend the outer source IP
as if the reponse was from the original node as all the rest is internal
to the cluster.

We need to treat related ICMP from tunnel the same way as we do the
original traffic, otherwise it would go through the conntrack on the way
out and would create ICMP tracking record.