vici: Make ICMP forwarding configurable

src/swanctl/swanctl.opt

@@ -1182,6 +1182,18 @@ connections.<conn>.children.<child>.copy_dscp = out
 	receiver, which is why the default is _out_. Controlling this behavior is
 	not supported by all kernel interfaces.
 
+connections.<conn>.children.<child>.icmp = no
+	Whether to forward certain ICMP error messages even if their source IP
+	doesn't match the negotiated IPsec policies.
+
+	ICMP error messages, such as Destination Unreachable, Time Exceeded or
+	Fragmentation Needed, may be generated by a host whose IP address isn't
+	included in the negotiated traffic selectors and therefore doesn't match the
+	IPsec policies. If this option is enabled and the kernel supports it, such
+	packets may still be forwarded. As ICMP errors contain parts of the IP
+	packet that triggered them, the kernel will base its decision on a reverse
+	policy lookup using that IP header.
+
 connections.<conn>.children.<child>.start_action = none
 	Action to perform after loading the configuration (_none_, _trap_, _start_).