divert: end-to-end working (network-order port, direct IN-verdict handoff, L2-synth reinjection, skip-mark anti-loop, pdivert ICMP checksum fix)

module/pfsrc/pfk_hooks.c

@@ -23,6 +23,7 @@
 
 extern int pf_test(sa_family_t, int, struct pfk_ifnet *, struct mbuf **);
 extern void divert_packet(struct mbuf *, int, u_int16_t);
+extern struct pf_divert *pf_find_divert(struct mbuf *);
 extern struct workqueue_struct *pfk_netisr_wq;
 
 /* PFLINUX: netisr work item — carries ownership of one sk_buff */
@@ -92,16 +93,6 @@ pfk_pkt_work(struct work_struct *w)
 	 * and packet walk run concurrently from here on — documented. */
 	action = pf_test(pk->af, pk->dir, pk->ifp, &m);
 
-	/* PF_IN rules with `divert-to` only TAG the packet (BSD
-	 * netinet/ip_input.c delivers tagged packets to the divert socket);
-	 * do that here.  divert_packet() consumes the mbuf wrapper and holds
-	 * its own skb reference, so our wrapper pointer becomes invalid. */
-	if (action == PF_PASS && m != NULL &&
-	    (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED)) {
-		m->m_pkthdr.pf.flags &= ~PF_TAG_DIVERTED;
-		divert_packet(m, pk->dir, 0);
-		m = NULL;
-	}
 
 	if (m == m0) {
 		/* same buffer, possibly rewritten in place: our wrapper
@@ -156,6 +147,10 @@ pfk_enqueue_verdict(int af, struct sk_buff *skb,
 	default:
 		return NF_ACCEPT;	/* LOCAL_IN/FORWARD */
 	}
+	    af, skb->len, ntohs(skb->protocol), skb->dev ? skb->dev->name : "?",
+	    skb->mark);
+	if (skb->mark & PFK_SKIP_PF)
+		return NF_ACCEPT;	/* reinjected by divert: don't re-filter */
 	if (skb->mark & (dir == PF_IN ? PFK_DONE_IN : PFK_DONE_OUT))
 		return NF_ACCEPT;