linux-ipsec: IPSec Masquerade

Hi, everyone.

I've recently been asked to look into support for IP Masquerade for the IPSec protocols. From my reading of IPSec books, IETF drafts and the freeswan materials it only looks like this is possible for the ESP protocol, as there's a cryptographic checksum across the IP addresses in AH packets.

Can anyone answer the following questions:

Am I correct in thinking that it is technically possible to masquerade the ESP protocol without a great deal of difficulty?

Has this (IPSec masquerade) already been done? If so, where is the code available? If not, I will be developing this.

And the important question if nobody has done this yet: for a given session, is the same SPI used in ESP packets in both directions? If yes then I think masquerading will be trivial. If no then it'll be rather complicated.

Thanks for your answers!

--
 John Hardin KA7OHZ                               jhardin@wolfenet.com
 pgpk -a finger://gonzo.wolfenet.com/jhardin    PGP key ID: 0x41EA94F5
 PGP key fingerprint: A3 0C 5B C2 EF 0D 2C E5  E9 BF C8 33 A7 A9 CE 76 

-----------------------------------------------------------------------

  Nurse! Gastric lavage! Put Mr. Lightbody on the enema machine until
  further notice!
			-- Dr. Kellogg, "The Road to Wellville"

-----------------------------------------------------------------------

   126 days until Star Wars episode I