The options control whether the DF and ECN header bits/fields are copied from the unencrypted packets to the encrypted packets in tunnel mode (DF only for IPv4), and for ECN whether the same is done for inbound packets. Note: This implementation only works with Linux/Netlink/XFRM. Based on a patch by Markus Sattler.