  <varlistentry>
  <term><emphasis remap='B'>tfc</emphasis></term>
  <listitem>
<para>
Enable Traffic Flow Confidentiality ("TFC") (RFC-4303) for outgoing ESP
packets in Tunnel Mode.  When enabled, ESP packets are padded to the
specified size (up to the PMTU size) to prevent leaking information based
on ESP packet size. This option is ignored for AH and for ESP in Transport
Mode as those always leak traffic characteristics and applying TFC will
not do anything. Acceptable values are positive numbers. The value 0 means
TFC padding is not performed. Currently this feature is only implemented
for the Linux XFRM/NETKEY stack. In IKEv2, when the notify payload
ESP_TFC_PADDING_NOT_SUPPORTED is received, TFC padding is disabled. The
default is not to do any TFC padding, but this might change in the near
future.
</para>
  </listitem>
  </varlistentry>
  <varlistentry>
  <term><emphasis remap='B'>send-no-esp-tfc</emphasis></term>
  <listitem>
<para>
Whether or not to tell the remote peer that we do not support Traffic Flow Confidentiality ("TFC")
(RFC-4303). Possible values are <emphasis remap='B'>no</emphasis> (the default) which allows the
peer to use TFC or <emphasis remap='B'>yes</emphasis> which prevents to peer from using TFC.
This does not affect whether this endpoint uses TFC, which only depends on the
local <emphasis remap='B'>tfc</emphasis> setting. This option is only valid for IKEv2.
</para>
  </listitem>
  </varlistentry>
