From 22346921011541b7de0c82cfae961980afb887a3 Mon Sep 17 00:00:00 2001 From: ae Date: Fri, 17 Nov 2017 22:40:02 +0000 Subject: [PATCH] Unconditionally enable support for O_IPSEC opcode. IPsec support can be loaded as kernel module, thus do not depend from kernel option IPSEC and always build O_IPSEC opcode implementation as enabled. Obtained from: Yandex LLC MFC after: 1 week Sponsored by: Yandex LLC --- sys/modules/ipfw/Makefile | 2 +- sys/netpfil/ipfw/ip_fw2.c | 5 +---- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/sys/modules/ipfw/Makefile b/sys/modules/ipfw/Makefile index 1b0e79a4c3fd..06a95ecba502 100644 --- a/sys/modules/ipfw/Makefile +++ b/sys/modules/ipfw/Makefile @@ -7,7 +7,7 @@ SRCS= ip_fw2.c ip_fw_pfil.c ip_fw_bpf.c SRCS+= ip_fw_dynamic.c ip_fw_log.c ip_fw_eaction.c SRCS+= ip_fw_sockopt.c ip_fw_table.c ip_fw_table_algo.c ip_fw_iface.c SRCS+= ip_fw_table_value.c -SRCS+= opt_inet.h opt_inet6.h opt_ipdivert.h opt_ipfw.h opt_ipsec.h +SRCS+= opt_inet.h opt_inet6.h opt_ipdivert.h opt_ipfw.h CFLAGS+= -DIPFIREWALL # diff --git a/sys/netpfil/ipfw/ip_fw2.c b/sys/netpfil/ipfw/ip_fw2.c index 46c58bed5821..1d3ef52343d0 100644 --- a/sys/netpfil/ipfw/ip_fw2.c +++ b/sys/netpfil/ipfw/ip_fw2.c @@ -37,7 +37,6 @@ __FBSDID("$FreeBSD$"); #error "IPFIREWALL requires INET" #endif /* INET */ #include "opt_inet6.h" -#include "opt_ipsec.h" #include #include @@ -1945,10 +1944,8 @@ do { \ break; case O_IPSEC: -#ifdef IPSEC match = (m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL); -#endif /* otherwise no match */ break; @@ -2563,7 +2560,7 @@ do { \ case O_NAT: l = 0; /* exit inner loop */ done = 1; /* exit outer loop */ - if (!IPFW_NAT_LOADED) { + if (!is_ipv4 || !IPFW_NAT_LOADED) { retval = IP_FW_DENY; break; }