Only build ipsec modules if the kernel includes IPSEC_SUPPORT.

Honoring the kernel-supplied opt_ipsec.h in r361632 causes builds of
ipsec modules to fail if the kernel doesn't include IPSEC_SUPPORT.
However, the module can never be loaded into such a kernel, so only
build the modules if the kernel includes IPSEC_SUPPORT.

Reviewed by:	imp
Differential Revision:	https://reviews.freebsd.org/D25059

sys/conf/config.mk

@@ -30,8 +30,10 @@ opt_inet.h:
 opt_inet6.h:
 	@echo "#define INET6 1" > ${.TARGET}
 .endif
+.if ${MK_IPSEC_SUPPORT} != "no"
 opt_ipsec.h:
 	@echo "#define IPSEC_SUPPORT 1" > ${.TARGET}
+.endif
 .if ${MK_RATELIMIT} != "no"
 opt_ratelimit.h:
 	@echo "#define RATELIMIT 1" > ${.TARGET}
@@ -60,6 +62,9 @@ KERN_OPTS+= INET TCP_OFFLOAD
 .if ${MK_INET6_SUPPORT} != "no"
 KERN_OPTS+= INET6
 .endif
+.if ${MK_IPSEC_SUPPORT} != "no"
+KERN_OPTS+= IPSEC_SUPPORT
+.endif
 .elif !defined(KERN_OPTS)
 # Add all the options that are mentioned in any opt_*.h file when we
 # have a kernel build directory to pull them from.

sys/modules/Makefile

@@ -427,7 +427,7 @@ _if_enc=	if_enc
 _if_gif=	if_gif
 _if_gre=	if_gre
 _ipfw_pmod=	ipfw_pmod
-.if ${MK_IPSEC_SUPPORT} != "no"
+.if ${KERN_OPTS:MIPSEC_SUPPORT}
 _ipsec=		ipsec
 .endif
 .endif

sys/modules/tcp/Makefile

@@ -2,8 +2,7 @@
 # $FreeBSD$
 #
 
-SYSDIR?=${SRCTOP}/sys
-.include "${SYSDIR}/conf/kern.opts.mk"
+.include <kmod.opts.mk>
 
 SUBDIR=	\
         ${_tcp_bbr} \
@@ -17,7 +16,7 @@ _tcp_rack= 	rack
 
 .if (${MK_INET_SUPPORT} != "no" || ${MK_INET6_SUPPORT} != "no") || \
 	defined(ALL_MODULES)
-.if ${MK_IPSEC_SUPPORT} != "no"
+.if ${KERN_OPTS:MIPSEC_SUPPORT}
 _tcpmd5=	tcpmd5
 .endif
 .endif