Netfilter and IPSec

["Fábio Souto" <fsouto@lasige.di.fc.ul.pt>]

Hello,

First place, let me congratulate all of this community, whose 
contribution is of utmost importance.
Hopefully, I will integrate it with pride.

So, what brings me here...

I'm trying to find out some alternatives for a task I have been assigned.
Basically, I want to sign IPSec packets on another machine. The idea is 
when I receive an IPSec packet, I delegate the cryptographic signature 
generation to another machine, and I receive the signed packet.
I'm currently studying several alternatives for doing this, and even 
tried a socket-based approach, by changing some kernel modules, which 
has failed. It would require a huge remake of kernel code; this task is 
made even harder due to lack of documentation.

So I was wondering if anyone knew if with netfilter is possible to 
achieve this. Any other suggestions/hints would be extremely valued.

Thanks in advance!

-- 
------------------------------------------------------------------------------------------
Fábio Souto
LaSIGE , Navigators Group
Departamento de Informática, FC/UL
Block C6, room 6.3.32, Campo Grande
1749-016 Lisboa, Portugal