Re: NAT before IPsec with 2.6

["David S. Miller" <davem@xxxxxxxxxx>]

On Wed, 28 Jan 2004 09:58:31 +0100
Harald Welte <laforge@xxxxxxxxxxxxx> wrote:

> No, we don't achieve this by manipulating the routing code, but by
> placing the respective hooks in ah{4,6}.c and esp{4,6}.c
> {ah,esp}_output() function respectively. We also need to (again) reset
> the skb->nfct and drop the conntrack reference again.

Why not just do this right when we pop into the dst_output() call
in ip_output.c  This way we don't have to add all of this stuff
for every new encapsulator we ever implement.

Maybe not like this precisely, but something like it.