BUG 1340528

- For ICMP error packets, the flow key has to be the same as that of the
original payload. This is because, in a floating IP case, default security
group rules allow only outgoing packets originated by the VM and incoming
packets to VM that belong to the same security group. Packets originated
from the destination floating ip network does not belong to the same security
group and hence will be dropped if we use the outer IP header for forming the
flow key.

Another issue is with the NAT-ing. The ip header source ip and destination ip
+ transport header ports in the icmp error payload have to be NAT-ed back.

Change-Id: If5082cc5fb9d20175a71abac42d09ac27100bf55
Initial support for FreeBSD platform

Change-Id: Ie4fc9b5e264c5ebd2374be2fa4967e9eefa15ef4
Author: Grzegorz Bernacki
Contributions: Dominik Ermel and Michal Dubiel