Re: [Buildroot] 回复： [PATCH 1/3] package/strongswan: enable kernel-libipsec

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello!

On Tue, Sep 29, 2026 at 05:01:29PM +0800, 戴维 wrote:
> Sorry for the late reply over the holiday. After checking the official docs, I
> believe Patch 1 should be reverted and kept out of master for now. StrongSwan
> explicitly notes:
> 
> libipsec is not intended for scenarios with high amounts of traffic or high
> burst traffic. It is not optimized for performance and buffers each packet in
> memory. 
> In combination with insufficient processor power this will lead to a out of
> memory condition and a crash of charon or the whole device. 
> SA and policy lookups are also not particularly optimized.  
> 
> I primarily use this plugin to prevent installing SAs into the kernel IPsec
> stack. In standard XFRM, 
> sensitive state materials like K and XRES stored in the kernel SPD/SAD can be
> read in real time (e.g., via ip xfrm),
> introducing major security risks for traffic decryption. Still, given official
> warnings about OOM risks and poor performance, 
> we should wait for this feature to stabilize before adding it to master.

Thanks for the feedback. Based on this feedback, I've marked the patch
as Rejected in our patch tracking system.

Thanks a lot!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot