pf: tag dummynet'd route-to packets with their real destination

[kp]

Summary

If we delay route-to/dup-to/reply-to through dummynet we are eventually
returned to pf_test(). At that point we no longer have the context for
the route-to destination. We'd just skip the pf_test() and continue
processing. This means that route-to did not work as expected.

Extend pf_mtag to carry the route-to destination so we can apply it when
we re-enter pf_test().

Sponsored by: Rubicon Communications, LLC ("Netgate")

[glebius]

sys/netpfil/pf/pf.c

6871

Can we assert network epoch here?

7427

What do you think about changing ifnet_byindexgen() to never return IFF_DYING interfaces?

P.S. I desire the need for this flag to be eliminated.

[kp]

sys/netpfil/pf/pf.c

6871

Yeah, that makes sense.

Pretty much all of pf runs under net_epoch, but an assert will make it more obvious that it's safe to access these fields here.

7427

That would make sense to me, yes.

[kp]

• add NET_EPOCH_ASSERT
• return 'int' for errors rather than 'bool'