From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: "Wei Dai" <daiwei@sunkaisens.com>,
buildroot@buildroot.org, "Jérôme Pouiller" <jezz@sysmic.org>
Subject: Re: [Buildroot] [PATCH 1/3] package/strongswan: enable kernel-libipsec
Date: Tue, 29 Sep 2026 09:21:37 +0200 [thread overview]
Message-ID: <artm6-0i7bQ4gJSM@windsurf> (raw)
In-Reply-To: <aq_Qf67Tgr75QV-B@windsurf>
Hello Wei,
Gentle ping on the question below regarding your patch. Thanks for
your feedback!
Thomas
On Sun, Sep 20, 2026 at 02:26:33PM +0200, Thomas Petazzoni via buildroot wrote:
> Hello,
>
> On Sun, Sep 20, 2026 at 03:40:54PM +0800, Wei Dai wrote:
> > The kernel-libipsec plugin for libcharon provides an IPsec
> > backend that runs entirely in userland, using TUN devices and
> > strongSwan's own libipsec implementation.
> >
> > Unlike the default kernel-netlink and kernel-pfkey backends,
> > which install SAs into the OS IPsec stack, this plugin is a
> > useful alternative when the kernel IPsec stack does not support
> > a required algorithm (e.g. AES-GCM on platforms lacking it).
> > It generally performs worse than the kernel stack, so it is
> > not recommended for high-throughput security gateways.
> >
> > Enable it with --enable-kernel-libipsec. A network kernel
> > backend (kernel-netlink or kernel-pfroute) is still required.
> >
> > Signed-off-by: Wei Dai <daiwei@sunkaisens.com>
>
> Thanks for your patch. I'm curious to understand why you enable this
> new feature unconditionally, while in PATCH 2/3 you propose to enable
> another feature by way of an option. Note that I'm not very familiar
> with Strongswan/IPsec, so maybe the answer is obvious, but your commit
> message doesn't really clarify why we would want this enabled
> unconditionally, even though it was not enabled since
> package/strongswan was added in Buildroot.
>
> It might also be relevant to comment about the additional footprint
> added by this option enable unconditionally.
>
> Thanks for your feedback!
>
> Thomas
> --
> Thomas Petazzoni, co-owner and CEO, Bootlin
> Embedded Linux and Kernel engineering and training
> https://bootlin.com
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
--
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
next prev parent reply other threads:[~2026-09-29 7:21 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-20 7:40 [Buildroot] [PATCH 1/3] package/strongswan: enable kernel-libipsec Wei Dai
2026-09-20 7:40 ` [Buildroot] [PATCH 2/3] package/strongswan: add eap-aka-3gpp support Wei Dai
2026-09-20 12:24 ` Thomas Petazzoni via buildroot
2026-09-20 7:40 ` [Buildroot] [PATCH 3/3] package/strongswan: add systemd support Wei Dai
2026-09-20 12:24 ` Thomas Petazzoni via buildroot
2026-09-20 12:26 ` [Buildroot] [PATCH 1/3] package/strongswan: enable kernel-libipsec Thomas Petazzoni via buildroot
2026-09-29 7:21 ` Thomas Petazzoni via buildroot [this message]
2026-09-29 9:01 ` [Buildroot] 回复： " 戴维
2026-10-11 7:25 ` Thomas Petazzoni via buildroot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=artm6-0i7bQ4gJSM@windsurf \
--to=buildroot@buildroot.org \
--cc=daiwei@sunkaisens.com \
--cc=jezz@sysmic.org \
--cc=thomas.petazzoni@bootlin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).