I wrote an email to Patrick McHardy hopping to get a newer patch and some clarification about what his patch is trying to achieve. Apparently there is a policy helper module in the patch-o-matic ng tree which you can use to apply special filtering rules to encrypted packets. Spent half of the day reading old netfilter+ipsec threads on mailinglists. If you are curious, read here, here and there!