I'd be okay with removing the condition entirely. It is useful to have core data structures be a fixed size independent of configuration.

In D46045#1049664, @kib wrote:

In D46045#1049663, @np wrote:

Does ipsec offload need a debug knob of its own? Can't we use any of the existing stuff for debug (from netipsec/ipsec.h):

#define ipseclog(x) do { if (V_ipsec_debug) log x; } while (0)
/* for openbsd compatibility */
#ifdef IPSEC_DEBUG
#define IPSEC_DEBUG_DECLARE(x) x
#define DPRINTF(x) do { if (V_ipsec_debug) printf x; } while (0)
#else
#define IPSEC_DEBUG_DECLARE(x)
#define DPRINTF(x)
#endif

I would say yes. I remember trying to use existing debug, but it did not mixed well: it was too verbose in parts we do not needed.

Does ipsec offload need a debug knob of its own? Can't we use any of the existing stuff for debug (from netipsec/ipsec.h):