Hi Steffen, I am working on a ticket complaining about netfilter policy match missing packets in OUTPUT chain if XFRM interface is being used. I don't fully overlook the relevant code path, but it seems like skb_dest(skb)->xfrm is not yet assigned when the skb is routed towards XFRM interface and already cleared again (by xfrm_output_one?) before it makes its way towards the real output interface. NF_INET_POST_ROUTING hook works though. Is this a bug or an expected quirk when using XFRM interface? Cheers, Phil
