Re: [Buildroot] [PATCH 1/3] package/strongswan: enable kernel-libipsec

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello,

On Sun, Sep 20, 2026 at 03:40:54PM +0800, Wei Dai wrote:
> The kernel-libipsec plugin for libcharon provides an IPsec
> backend that runs entirely in userland, using TUN devices and
> strongSwan's own libipsec implementation.
> 
> Unlike the default kernel-netlink and kernel-pfkey backends,
> which install SAs into the OS IPsec stack, this plugin is a
> useful alternative when the kernel IPsec stack does not support
> a required algorithm (e.g. AES-GCM on platforms lacking it).
> It generally performs worse than the kernel stack, so it is
> not recommended for high-throughput security gateways.
> 
> Enable it with --enable-kernel-libipsec. A network kernel
> backend (kernel-netlink or kernel-pfroute) is still required.
> 
> Signed-off-by: Wei Dai <daiwei@sunkaisens.com>

Thanks for your patch. I'm curious to understand why you enable this
new feature unconditionally, while in PATCH 2/3 you propose to enable
another feature by way of an option. Note that I'm not very familiar
with Strongswan/IPsec, so maybe the answer is obvious, but your commit
message doesn't really clarify why we would want this enabled
unconditionally, even though it was not enabled since
package/strongswan was added in Buildroot.

It might also be relevant to comment about the additional footprint
added by this option enable unconditionally.

Thanks for your feedback!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot