Reset ip_divert_ignore to zero immediately after use - also,

set it in the first place, independent of whether sin->sin_port
is set.

The result is that diverted packets that are being forwarded
will be diverted once and only once on the way in (ip_input())
and again, once and only once on the way out (ip_output()) -
twice in total.  ICMP packets that don't contain a port will
now also be diverted.

sys/netinet/ip_divert.c

@@ -206,8 +206,7 @@ div_output(so, m, addr, control)
 		sin = mtod(addr, struct sockaddr_in *);
 
 	/* Loopback avoidance option */
-	if (sin && sin->sin_port)
-		ip_divert_ignore = ntohs(inp->inp_lport);
+	ip_divert_ignore = ntohs(inp->inp_lport);
 
 	/* Reinject packet into the system as incoming or outgoing */
 	if (!sin || sin->sin_addr.s_addr == 0) {

sys/netinet/ip_input.c

@@ -320,6 +320,7 @@ ip_input(struct mbuf *m)
 #ifdef IPDIVERT
 		action = (*ip_fw_chk_ptr)(&ip, hlen,
 				m->m_pkthdr.rcvif, ip_divert_ignore, &m);
+		ip_divert_ignore = 0;
 #else
 		action = (*ip_fw_chk_ptr)(&ip, hlen, m->m_pkthdr.rcvif, 0, &m);
 #endif

sys/netinet/ip_output.c

@@ -355,6 +355,7 @@ ip_output(m0, opt, ro, flags, imo)
 #ifdef IPDIVERT
 		action = (*ip_fw_chk_ptr)(&ip,
 				hlen, ifp, (~0 << 16) | ip_divert_ignore, &m);
+		ip_divert_ignore = 0;
 #else
 		action = (*ip_fw_chk_ptr)(&ip, hlen, ifp, (~0 << 16), &m);
 #endif