vici: Make hardware offload configurable

diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
index 02fb9e2..46eaf5c 100644 (file)
--- a/src/libcharon/plugins/vici/vici_config.c
+++ b/src/libcharon/plugins/vici/vici_config.c
@@ -524,6 +524,7 @@ static void log_child_data(child_data_t *data, char *name)
        DBG2(DBG_CFG, "   proposals = %#P", data->proposals);
        DBG2(DBG_CFG, "   local_ts = %#R", data->local_ts);
        DBG2(DBG_CFG, "   remote_ts = %#R", data->remote_ts);
+       DBG2(DBG_CFG, "   hw_offload = %u", cfg->options & OPT_HW_OFFLOAD);
 }
 
 /**
@@ -882,6 +883,15 @@ CALLBACK(parse_opt_ipcomp, bool,
 }
 
 /**
+ * Parse OPT_HW_OFFLOAD option
+ */
+CALLBACK(parse_opt_hw_offl, bool,
+       child_cfg_option_t *out, chunk_t v)
+{
+       return parse_option(out, OPT_HW_OFFLOAD, v);
+}
+
+/**
  * Parse an action_t
  */
 CALLBACK(parse_action, bool,
@@ -1539,6 +1549,7 @@ CALLBACK(child_kv, bool,
                { "tfc_padding",                parse_tfc,                      &child->cfg.tfc                                         },
                { "priority",                   parse_uint32,           &child->cfg.priority                            },
                { "interface",                  parse_string,           &child->cfg.interface                           },
+               { "hw_offload",                 parse_opt_hw_offl,      &child->cfg.options                                     },
        };
 
        return parse_rules(rules, countof(rules), name, value,

diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index 96dfd3a..496dbf3 100644 (file)
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -888,6 +888,10 @@ connections.<conn>.children.<child>.replay_window = 32
        default of 32 are supported using the Netlink backend only, a value of 0
        disables IPsec replay protection.
 
+connections.<conn>.children.<child>.hw_offload = no
+       Enable hardware offload for this CHILD_SA, if supported by the IPsec
+       implementation.
+
 connections.<conn>.children.<child>.start_action = none
        Action to perform after loading the configuration (_none_, _trap_, _start_).