Herbert Xu wrote:

On Mon, Nov 28, 2005 at 02:07:03AM +0100, Patrick McHardy wrote:

quoted

Thanks, this looks great. I've changed it to only call the hooks

Glad you liked it :)

quoted

before tunnel mode transforms and added a missing dst_output call
for the final packet.

This shouldn't be necessary if you apply it on top of my previous
patch which made xfrm[46]_output process the first SA and all subsequent
transport mode SAs.  I've included that patch here again.

I think it still makes sense to do that because this corresponds
with the usual representation of an IPsec connection and it
simplifies the handling of netfilter hooks.

I agree, I missed that your patch based on that one. Let me have
another look :)