 Ipsec arcitecture of Linux kernel 2.6.xx
I am looking for a flow of the most important function calls when IPsec is active, I am talking about net/ipv4/ip_input.c and net/ipv4/ip_output.c files mainly. I believe that dst_input(skb) and dst_output(skb) functions activate net/ipv4/ah4.c/ah_input() and ah_output functions? is that right?
Besides to the best of my knowledge this flow should be like the following:
OUTput case
ip_queue_xmit---> ip_output &&
ip_route_output_flow(net/ipv4/route.c)--->__xfrm_lookup
ip_output--->ip_finish_output--->dst_output------>dev_queue_xmit(net/core/dev.c)
ip_finish_output--->ip_finish_output2------>dev_queue_xmit(net/core/dev.c)
INput case
net_rx_action(net/core/dev.c)------>ip_rcv--->ip_rcv_finish--->ip_route_input(net/ipv4/route.c) && dst_input------>
ip_local_deliver--->ip_local_deliver_finish--->
xfrm4_policy_check(include/net/xfrm.h) && protocol handler | 
Linear Mode
