PFIL for IPsec tunneled packets (was: reverse processing order: NAT, IPsec?)

[Edgar Fuß <ef%math.uni-bonn.de@localhost>]

> After seeing the ultimately simple fix Hubert posted to re-enable PFIL
> hooks for IPsec de-encapsulated packets I had a deja vu moment and I
> think I can say this silliness has caused problems in other contexts as
> well.
Applying this "fix"  would break my installation. At least as long as those 
packets are indistinguishable from non-IPsec traffic arriving on the same 
interface.
Currently, packets arriving on the gateway's external interface but appearing 
to come from an internal network are dropped by anti-spoofing filter rules. ESP 
traffic passes, and the de-encapsulated packets are never seen again by the 
packet filter. If they were, they should be somehow marked as being 
de-encapsulated---otherwise they would be dropped by the anti-spoof rules.