strongswan: rename and migrate missleading options - #30105
Open
feckert wants to merge 10 commits into
Open
Conversation
feckert
requested review from
Copilot and
pprindeville
and removed request for
pprindeville
July 27, 2026 09:10
There was a problem hiding this comment.
Pull request overview
This PR updates the OpenWrt strongswan package to remove/rename UCI options to better align with strongSwan’s swanctl naming, and adds an upgrade migration to move existing configurations to the new option names.
Changes:
- Bump
PKG_RELEASEto reflect the configuration/migration update. - Update
swanctl.initto uselocal_addrs/remote_addrslists and removelocal_nathandling. - Add a uci-defaults migration script to convert legacy options (
local_nat,gateway,local_ip) to the newer equivalents.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| net/strongswan/Makefile | Bumps package release for the configuration migration change. |
| net/strongswan/files/swanctl.init | Switches connection address handling to local_addrs/remote_addrs and removes local_nat usage. |
| net/strongswan/files/etc/uci-defaults/strongswan | Adds on-upgrade UCI migrations for removed/renamed options. |
Comments suppressed due to low confidence (1)
net/strongswan/files/swanctl.init:472
config_remote()still reads the deprecatedlocal_ipoption but no longer declareslocal_ipas a local variable and does not use it anywhere. This creates a globallocal_ipshell variable (scope leak) and keeps relying on an option that the uci-defaults migration deletes (ipsec.<remote>.local_ip). Remove this read to avoid unintended side effects.
config_get local_identifier "$conf" local_identifier ""
config_get remote_identifier "$conf" remote_identifier ""
config_get local_ip "$conf" local_ip "%any"
config_get keyingtries "$conf" keyingtries "3"
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
feckert
force-pushed
the
pr/20260727-strongswan
branch
from
July 27, 2026 09:35
71538ca to
d0c1682
Compare
Member
Author
|
@pprindeville Hint for the backward compatibility. |
feckert
force-pushed
the
pr/20260727-strongswan
branch
3 times, most recently
from
July 27, 2026 13:54
e420259 to
220e15c
Compare
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
The local variables were completely jumbled. To keep track of them, they have been sorted to the order in which the following 'config_get' calls are made. No functional change. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The local variables were completely jumbled. To keep track of them, they have been sorted in the order in which the following 'config_get' calls are made. No functional change. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
For consistency, the remaining spaces used for indentation have been replaced with tabs. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The UCI option 'local_nat' was a misleading legacy name for the option that actually specifies the local traffic selector(s) used by strongSwan/swanctl for a connection, i.e. the local subnet(s) matched by the IPsec SA. It has nothing to do with NAT-T or NAT detection, and the name repeatedly caused confusion when writing or reviewing configs. Merge it to 'local_subnet' to match its actual purpose and to align with the naming already used for the corresponding 'local_subnet' option and with swanctl.conf's own 'local_ts/remote_ts' terminology. Add a uci-defaults migration script so existing installations are upgraded automatically. It reads any existing 'local_nat' values (whether stored as a plain option or as a list) and rewrites them as a 'local_subnet' list. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The UCI option 'gateway' in the ipsec config (consumed by /etc/init.d/swanctl) is ambiguous. It is not clear from the name alone whether it refers to the local or the remote IKE/IPsec peer address, which has repeatedly led to misconfiguration. Rename it to "remote_gateway" to make the direction explicit and to match the existing "remote_subnet" naming. If the option is unset, the init script now falls back to the strongSwan default of '%any', so connections that accept any remote peer no longer require an explicit placeholder value. Add a uci-defaults migration script to rename existing 'gateway' entries to 'remote_gateway' and remove the value 'any' on upgrade. This is new default if 'remote_gateway' is not set. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'remote_gateway' UCI option to 'remote_addrs' to match the 'swanctl.conf' 'remote_addrs' directive, which accepts one or more peer addresses rather than a single gateway. The previous name implied a single value and did not reflect that multiple remote addresses can be configured for a connection. Store the option as a UCI list to allow specifying multiple remote addresses, consistent with how 'local_subnet' and 'remote_subnet' are already handled. Add a uci-defaults migration script to convert existing 'remote_gateway' entries (whether stored as a plain option or as a list) to a 'remote_addrs' list on upgrade. If the 'remote_addrs' option is empty, strongswan implicitly uses the value '%any'. In the `swanctl.conf` documentation, '%any' is already the default value for 'remote_addrs' if the directive is not specified at all. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'local_ip' UCI option to 'local_addrs' to match the 'swanctl.conf' 'local_addrs' directive, which accepts one or more local addresses rather than implying a single fixed IP. The previous name suggested only one address could be configured. Store the option as a UCI list to allow specifying multiple local addresses, consistent with how 'remote_addrs' is already handled. If left empty, no 'local_addrs' line is written to 'swanctl.conf', so strongswan falls back to its own default of '%any'. Add a uci-defaults migration script to convert existing 'local_ip' entries (whether stored as a plain option or as a list) to a 'local_addrs' list on upgrade. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The name 'local_sourceip' was misleading, since the option actually refers to virtual IP addresses (VIPs) used for routing/binding, not just a single local source IP. Renaming it to 'vips' better reflects its purpose and makes the configuration more intuitive for users, especially in setups with multiple virtual IPs. Add a uci-defaults migration script to convert existing 'local_sourceip' entries (whether stored as a plain option or as a list) to a 'vips' list on upgrade. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The 'local_key' UCI option was validated (checked for existence
under /etc/swanctl/private/) but never written to the generated
'swanctl.conf'. As a result, setting 'local_key' had no actual effect
on which private key was used for local authentication.
Add the corresponding "privkeys" line to the local{} section,
mirroring how local_cert is already written as "certs", so that
swanctl explicitly uses the configured private key.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Update 'PKG_RELEASE'. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
feckert
force-pushed
the
pr/20260727-strongswan
branch
from
July 28, 2026 08:56
220e15c to
d9e1e99
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📦 Package Details
Maintainer: @pprindeville
Description:
local_natoption, is no longer applicable in this form.gatewayandlocal_iptoremote_addrsandlocal_addrsto match the naming used in swanctl configurationLuCI changes openwrt/luci#8881
🧪 Run Testing Details
✅ Formalities