- Fix #1487: regression in 1.26.0, ipsecmod is now always

  partly enabled.

diff --git a/doc/Changelog b/doc/Changelog
index b5c243274f7492d8d3fafe9e2556d3702f518244..383992393e7d7a24cb4f7696b26890f6c92717ea 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,6 +2,8 @@
        - Fix #1485: the list_forwards command omits port numbers.
          The list_forwards and list_stubs commands for
          unbound-control print port and tls auth name.
+       - Fix #1487: regression in 1.26.0, ipsecmod is now always
+         partly enabled.
 
 4 August 2026: Wouter
        - Fix to set makedist.sh to not wget config.sub and

diff --git a/ipsecmod/ipsecmod.c b/ipsecmod/ipsecmod.c
index d1c0d442fe009568f295a5875f9122e9990c7e4d..71b42f18098ff5f5985e9bc538f63044a8e11a11 100644 (file)
--- a/ipsecmod/ipsecmod.c
+++ b/ipsecmod/ipsecmod.c
@@ -59,6 +59,11 @@
 static int
 ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
 {
+       if(cfg->ipsecmod_whitelist &&
+               !ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
+               return 0;
+       if(!cfg->ipsecmod_enabled)
+               return 1;
        if(!cfg->ipsecmod_hook || (cfg->ipsecmod_hook && !cfg->ipsecmod_hook[0])) {
                log_err("ipsecmod: missing ipsecmod-hook.");
                return 0;
@@ -68,9 +73,6 @@ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
                        cfg->ipsecmod_hook, strerror(errno));
                return 0;
        }
-       if(cfg->ipsecmod_whitelist &&
-               !ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
-               return 0;
        return 1;
 }
 
@@ -626,6 +628,8 @@ ipsecmod_inform_super(struct module_qstate* qstate, int id,
                verbose(VERB_ALGO, "super has no ipsecmod state");
                return;
        }
+       if(!siq->enabled)
+               return;
 
        if(qstate->return_msg) {
                struct ub_packed_rrset_key* rrset_key = reply_find_answer_rrset(