On Tue, 31 Jan 2012, Darren Reed wrote:
I think that this requires something different as a requirement here is to play with packets when they're passed to IPsec but before they're encrypted. At present, IPFilter sees packets only on input and output and at both points in the stack, the inner packet will be encrypted, correct?
IIRC not - on sending, ip_output(?) is called once for the actual packet to send, and then it's handed - still unencrypted - to IPsec, which then calls ip_output(?) again. Similar on input.
- Hubert