(review request) ipfw and ipsec processing order for outgoingpackets

[Jeremie Le Hen]

> > > > I have some stuff wrt [Fast]IPSEC and your problem in the works and
> > > > it should become ready around christmas time (loadable [Fast]IPSEC, at
> > > > least for IPv4).
> > >
> > > While this way of 'fixing' the IPSEC problem works it is rather gross
> > > and not very stylish.  I prefer not to have this in the tree as makes
> > > maintainance a lot harder.
> > 
> > I totaly agree that it is not pretty. I was trying to avoid duplicating
> > the code (so every change would have to be made twice) and making it a
> > function didn't sit right for some reason. Hints/tips for dealing with
> > this kind of situation are welcome, but maybe better off-list.
> 
> As things currently are with IPSEC code weaved directly into ip_input()
> and ip_output() there is no better way than what you have proposed.
> 
> It will solve it much more nicely. :)

If I understand correctly, either Joost's patch or your nice changes
that-should-appear-before-christmas will achieve what the OpenBSD enc(4)
interface provides [1].  It would be really wonderful.  But I may be
missing something because I can see no way in firewall rules to
distinguish between the before IPSec processing hook and the after IPSec
processing one.  Could you clarify this for me please ?

Thanks in advance.
Best regards,
-- 
Jeremie Le Hen
jeremie at le-hen.org