divert: consume PF_TAG_DIVERTED after passthrough (BSD ip_input role); divert layer owns its own skb ref; gate uses pfput path

module/pfsrc/divert_sock.c

@@ -166,13 +166,19 @@ divert_packet(struct mbuf *m, int dir, u_int16_t divert_port)
 	{
 		struct pf_divert *dv = pf_find_divert(m);
 
-		if (dv)
+		if (dv) {
 			type = dv->type;
+			if (divert_port == 0)
+				divert_port = dv->port;
+		}
 	}
 	skb = m_to_skb(m);
-	m->skb = NULL;		/* ownership moves into the divert layer */
+	if (skb)
+		skb_get(skb);	/* divert layer's own reference */
+	m->skb = NULL;
 	m_freem(m);
-	pfk_divert_queue(skb, dir, type, divert_port);
+	if (skb)
+		pfk_divert_queue(skb, dir, type, divert_port);
 }
 
 void

module/pfsrc/pfk_hooks.c

@@ -22,6 +22,7 @@
 #include <net/pfvar_priv.h>
 
 extern int pf_test(sa_family_t, int, struct pfk_ifnet *, struct mbuf **);
+extern void divert_packet(struct mbuf *, int, u_int16_t);
 extern struct workqueue_struct *pfk_netisr_wq;
 
 /* PFLINUX: netisr work item — carries ownership of one sk_buff */
@@ -91,6 +92,17 @@ pfk_pkt_work(struct work_struct *w)
 	 * and packet walk run concurrently from here on — documented. */
 	action = pf_test(pk->af, pk->dir, pk->ifp, &m);
 
+	/* PF_IN rules with `divert-to` only TAG the packet (BSD
+	 * netinet/ip_input.c delivers tagged packets to the divert socket);
+	 * do that here.  divert_packet() consumes the mbuf wrapper and holds
+	 * its own skb reference, so our wrapper pointer becomes invalid. */
+	if (action == PF_PASS && m != NULL &&
+	    (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED)) {
+		m->m_pkthdr.pf.flags &= ~PF_TAG_DIVERTED;
+		divert_packet(m, pk->dir, 0);
+		m = NULL;
+	}
+
 	if (m == m0) {
 		/* same buffer, possibly rewritten in place: our wrapper
 		 * held one extra skb reference — release it */