put pf before ipsec processing.  return error code and free mbuf chain
put pf before ipsec processing.  return error code and free mbuf chain

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars