Rewrite ipsec-wrapper into a functionality transformation