Hi, Bruce (and all)-- [ ... ] cc -c -O -pipe -march=pentiumpro -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Winline -Wcast-qual -fformat-extensions -ansi -g -nostdinc -I- -I. -I/usr/src/sys -I/usr/src/sys/../include -I/usr/src/sys/contrib/dev/acpica -I/usr/src/sys/contrib/ipfilter -D_KERNEL -include opt_global.h -mpreferred-stack-boundary=2 /usr/src/sys/netipsec/xform_ipip.c cc -c -O -pipe -march=pentiumpro -Wall -Wredundant-decls -Wnested-externs -Wstrict-prototypes -Wmissing-prototypes -Wpointer-arith -Winline -Wcast-qual -fformat-extensions -ansi -g -nostdinc -I- -I. -I/usr/src/sys -I/usr/src/sys/../include -I/usr/src/sys/contrib/dev/acpica -I/usr/src/sys/contrib/ipfilter -D_KERNEL -include opt_global.h -mpreferred-stack-boundary=2 /usr/src/sys/netipsec/xform_tcp.c /usr/src/sys/netipsec/xform_tcp.c: In function `tcpsignature_init': /usr/src/sys/netipsec/xform_tcp.c:87: `TCP_SIG_SPI' undeclared (first use in this function) /usr/src/sys/netipsec/xform_tcp.c:87: (Each undeclared identifier is reported only once /usr/src/sys/netipsec/xform_tcp.c:87: for each function it appears in.) /usr/src/sys/netipsec/xform_tcp.c:102: `TCP_KEYLEN_MIN' undeclared (first use in this function) /usr/src/sys/netipsec/xform_tcp.c:102: `TCP_KEYLEN_MAX' undeclared (first use in this function) *** Error code 1 Stop in /usr/obj/usr/src/sys/NORMAL. *** Error code 1 Stop in /usr/src. *** Error code 1 Stop in /usr/src. ----- Non-standard bits of my kernel config are: options IPFIREWALL #firewall options IPFW2 #firewall options IPFIREWALL_VERBOSE #enable logging to syslogd(8) options IPFIREWALL_FORWARD #enable transparent proxy support options IPFIREWALL_VERBOSE_LIMIT=100 #limit verbosity options IPFIREWALL_DEFAULT_TO_ACCEPT options IPDIVERT #divert sockets #options TCPDEBUG options RANDOM_IP_ID options DUMMYNET options BRIDGE options DEVICE_POLLING options HZ=1000 options SC_PIXEL_MODE options NMBCLUSTERS=8192 options SEMMNI=256 options SEMMNS=256 #options IPSEC #options IPSEC_ESP #options IPSEC_DEBUG # options FAST_IPSEC pseudo-device crypto # core crypto support pseudo-device cryptodev # /dev/crypto for access to h/w device rndtest # FIPS 140-2 entropy tester device hifn # Hifn 7951, 7781, etc. options HIFN_DEBUG # enable debugging support: hw.hifn.debug options HIFN_RNDTEST # enable rndtest support ...but it's otherwise closely derived from GENERIC. -- -Chuck