tfc testing - requires xfrm

Both sides are willing to do TFC and enable it. Both IPsec SA's
should do TFC.
