pfSense

disabling all logging, with the following in strongswan.conf:

    daemon {
        ike_name = yes
        default = -1
    }
    # disable logging under auth so logs aren't duplicated 
    auth {
        default = -1
    }

appears to stop the memory leak. Memory RRDs from two endpoints with the same config, only diff being one with default logging and one with no logging, attached. Before disabling logging, they leaked equally. The one without logging isn't leaking at all thus far. Logging was disabled at around 16:30. Through 5 rekeying cycles now, leaving it running.

the next snapshot build run should have strongswan compiled with --with-printf-hooks=vstr, which is the best option we've found to significantly reduce memory leaks. Disabling logging completely gets rid of much of the issue, disabling only IKE logging gets rid of quite a bit of it but not as much as disabling all logging. vstr looks to have only very minimal leaks, with 400 tunnels rekeying hourly, it's only grown several MB in 3+ days where without vstr the same circumstance has leaked >200 MB.

Switching to with-printf-hooks=vstr resolved the most significant memory leaks.