Subject: Re: NAT before IPsec with 2.6

From: "David S. Miller" <[email-masked]>
Date: Wed, 28 Jan 2004 11:38:25 -0800

On Wed, 28 Jan 2004 09:58:31 +0100
Harald Welte <[email-masked]> wrote:

> No, we don't achieve this by manipulating the routing code, but by
> placing the respective hooks in ah{4,6}.c and esp{4,6}.c
> {ah,esp}_output() function respectively. We also need to (again) reset
> the skb->nfct and drop the conntrack reference again.

Why not just do this right when we pop into the dst_output() call
in ip_output.c  This way we don't have to add all of this stuff
for every new encapsulator we ever implement.

Maybe not like this precisely, but something like it.