svn commit: r361633 - in head/sys: net netipsec

[John Baldwin]

On 6/1/20 8:02 AM, Kyle Evans wrote:
> On Mon, Jun 1, 2020 at 1:18 AM Hartmann, O. <ohartmann at walstatt.org> wrote:
>>
>> On Sun, 31 May 2020 11:43:18 +0200
>> "Hartmann, O." <ohartmann at walstatt.org> wrote:
>>
>>> On Fri, 29 May 2020 19:22:40 +0000 (UTC)
>>> John Baldwin <jhb at FreeBSD.org> wrote:
>>>
>>>> Author: jhb
>>>> Date: Fri May 29 19:22:40 2020
>>>> New Revision: 361633
>>>> URL: https://svnweb.freebsd.org/changeset/base/361633
>>>>
>>>> Log:
>>>>   Consistently include opt_ipsec.h for consumers of
>>>> <netipsec/ipsec.h>.
>>>>   This fixes ipsec.ko to include all of IPSEC_DEBUG.
>>>>
>>> [... snip ...]
>>>
>>> [...]
>>> --- all_subdir_ipsec ---
>>> --- ipsec_mod.o ---
>>> /usr/src/sys/netipsec/ipsec_mod.c:114:3: error: implicit declaration
>>> of function 'ipsec_support_enable' is invalid in C99
>>> [-Werror,-Wimplicit-function-declaration]
>>> ipsec_support_enable(ipv4_ipsec_support, &ipv4_methods); ^
>>> /usr/src/sys/netipsec/ipsec_mod.c:125:3: error: implicit declaration
>>> of function 'ipsec_support_disable' is invalid in C99
>>> [-Werror,-Wimplicit-function-declaration]
>>> ipsec_support_disable(ipv4_ipsec_support); ^ --- all_subdir_ipwfw ---
>>> Building
>>> /usr/obj/usr/src/amd64.amd64/sys/WALHALL/modules/usr/src/sys/modules/ipwfw/ipw_bss/ipw_bss.ko
>>> --- all_subdir_ipsec --- /usr/src/sys/netipsec/ipsec_mod.c:125:3:
>>> note: did you mean 'ipsec_support_enable'?
>>> /usr/src/sys/netipsec/ipsec_mod.c:114:3: note: 'ipsec_support_enable'
>>> declared here ipsec_support_enable(ipv4_ipsec_support, &ipv4_methods);
>>> ^ 2 errors generated. *** [ipsec_mod.o] Error code 1
>>>
>>> make[4]: stopped in /usr/src/sys/modules/ipsec
>>
>> FYI: IPSEC is statically built into the kernel via "options IPSEC"
> 
> This is the same failure as we're seeing on LINT kernels, which also
> have both. I've got a tentative diff at [0] that teaches the modules
> to cope with the possibility, but I haven't thought too much on how
> useful the result is. IIRC we're building the modules into the kernel
> anyways in this scenario, so the result probably just won't load
> because it's already loaded.
> 
> [0] https://people.freebsd.org/~kevans.ipsec.diff

I think we should just not build ipsec.ko and tcp_md5.ko if the kernel already
includes the support instead.  I started testing this yesterday but got side
tracked.  I will try to get this fixed today.

-- 
John Baldwin