Skip to content

strongswan: rename and migrate missleading options #30105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
feckert wants to merge 10 commits into
base: master
Choose a base branch
from
+148 −35
Open

strongswan: rename and migrate missleading options #30105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
fc16000
strongswan: reorder local var in config_child function
feckert Jul 23, 2026
53ce496
strongswan: reorder local var in config_remote function
feckert Jul 23, 2026
b3ab171
strongswan: replace indentation spaces with tabs in swanctl.init
feckert Jul 23, 2026
93ed5e1
strongswan: migration and merge local_nat into local_subnet
feckert Jul 23, 2026
d1054cc
strongswan: rename 'gateway' to 'remote_gateway'
feckert Jul 23, 2026
bd73a66
strongswan: rename 'remote_gateway' to 'remote_addrs'
feckert Jul 23, 2026
016a37b
strongswan: rename 'local_ip' to 'local_addrs'
feckert Jul 23, 2026
ee2373a
strongswan: rename 'local_sourceip' to 'vips'
feckert Jul 27, 2026
32207e7
strongswan: write local_key to swanctl.conf
feckert Jul 27, 2026
d9e1e99
strongswan: bump PKG_RELEASE by one
feckert Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion net/strongswan/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk

PKG_NAME:=strongswan
PKG_VERSION:=6.0.7
PKG_RELEASE:=4
PKG_RELEASE:=5

PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
PKG_SOURCE_URL:=https://download.strongswan.org/ https://download2.strongswan.org/
Expand Down
118 changes: 118 additions & 0 deletions net/strongswan/files/etc/uci-defaults/strongswan
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
#!/bin/sh

. /lib/functions.sh
migrate_ipsec() {
# Skip migration if the 'globals' section already exists
uci show ipsec.globals 1>/dev/null 2>/dev/null
Expand All @@ -26,9 +27,126 @@ migrate_ignore_routing_tables() {
uci commit ipsec
}

migrate_local_nat_child() {
local cfg="$1"

local local_nat value

config_get local_nat "$cfg" local_nat ""
[ -z "$local_nat" ] && return

uci -q delete "ipsec.${cfg}.local_nat"

# Replace 'local_subnet' with 'local_nat' and do not append.
# That's how it was previously done in the swanctl start script.
uci -q delete "ipsec.${cfg}.local_subnet"

for value in $local_nat; do
uci add_list "ipsec.${cfg}.local_subnet=${value}"
done
}

migrate_local_nat() {
config_load ipsec
config_foreach migrate_local_nat_child tunnel
config_foreach migrate_local_nat_child transport
uci commit ipsec
}

migrate_gateway_remote() {
local cfg="$1"

local gateway

config_get gateway "$cfg" gateway ""
[ -z "$gateway" ] && return

# The option 'any' is default for the 'remote_gateway' option if not set
# and does not need to be saved.
[ "$gateway" = "any" ] || {
uci -q set "ipsec.${cfg}.remote_gateway=${gateway}"
}

uci -q delete "ipsec.${cfg}.gateway"
uci commit ipsec
Comment thread
feckert marked this conversation as resolved.
}

migrate_gateway() {
config_load ipsec
config_foreach migrate_gateway_remote remote
}

migrate_remote_gateway_remote() {
local cfg="$1"

local remote_gateway value

config_get remote_gateway "$cfg" remote_gateway ""
[ -z "$remote_gateway" ] && return

for value in $remote_gateway; do
uci add_list "ipsec.${cfg}.remote_addrs=${value}"
done

uci -q delete "ipsec.${cfg}.remote_gateway"
uci commit ipsec
}

migrate_remote_gateway() {
config_load ipsec
config_foreach migrate_remote_gateway_remote remote
}
Comment thread
feckert marked this conversation as resolved.

migrate_local_ip_local() {
local cfg="$1"

local local_ip value

config_get local_ip "$cfg" local_ip ""
[ -z "$local_ip" ] && return

for value in $local_ip; do
uci add_list "ipsec.${cfg}.local_addrs=${value}"
done

uci -q delete "ipsec.${cfg}.local_ip"
uci commit ipsec
Comment thread
feckert marked this conversation as resolved.
}

migrate_local_ip() {
config_load ipsec
config_foreach migrate_local_ip_local remote
}

migrate_local_sourceip_vips() {
local cfg="$1"

local local_sourceip value

config_get local_sourceip "$cfg" local_sourceip ""
[ -z "$local_sourceip" ] && return

for value in $local_sourceip; do
uci add_list "ipsec.${cfg}.vips=${value}"
done

uci -q delete "ipsec.${cfg}.local_sourceip"
uci commit ipsec
}

migrate_local_sourceip() {
config_load ipsec
config_foreach migrate_local_sourceip_vips remote
}

main() {
migrate_ipsec
migrate_ignore_routing_tables
migrate_local_nat
migrate_gateway
migrate_remote_gateway
migrate_local_ip
migrate_local_sourceip
Comment thread
feckert marked this conversation as resolved.
}

main
Expand Down
63 changes: 29 additions & 34 deletions net/strongswan/files/swanctl.init
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,29 +225,27 @@ config_child() {
local conf="$1"
local mode="$2"

local hw_offload
local interface
local ipcomp
local priority
local local_subnet
local local_nat
local startaction
local updown
local firewall
local remote_subnet
local lifetime
local dpdaction
local closeaction
local startaction
local if_id
local rekeytime
local ipcomp
local interface
local hw_offload
local priority
local rekeybytes
local lifebytes
local rekeypackets
local lifepackets
local replay_window
local local_subnet
local remote_subnet

config_get startaction "$conf" startaction "route"
config_get local_nat "$conf" local_nat ""
config_get updown "$conf" updown ""
config_get firewall "$conf" firewall ""
config_get lifetime "$conf" lifetime ""
Expand Down Expand Up @@ -333,8 +331,6 @@ config_child() {
;;
esac

[ -n "$local_nat" ] && local_subnet="$local_nat"

swanctl_xappend3 "$conf {"

[ -n "$local_subnet" ] && swanctl_xappend4 "local_ts = $local_subnet"
Expand Down Expand Up @@ -374,7 +370,7 @@ config_child() {
[ -n "$dpdaction" ] && swanctl_xappend4 "dpd_action = $dpdaction"
[ -n "$replay_window" ] && swanctl_xappend4 "replay_window = $replay_window"

swanctl_xappend3 "}"
swanctl_xappend3 "}"
}

config_tunnel() {
Expand Down Expand Up @@ -440,14 +436,10 @@ config_remote() {
local conf="$1"

local enabled
local gateway
local local_sourceip
local local_ip
local local_identifier
local remote_gateway
local remote_identifier
local pre_shared_key
local auth_method
local local_identifier
local remote_identifier
local keyingtries
local dpddelay
local encap
Expand All @@ -462,19 +454,20 @@ config_remote() {
local overtime
local send_cert
local send_certreq
local eap_id
local local_addrs
local remote_addrs
local vips
local remote_ca_certs
local pools
local eap_id

config_get_bool enabled "$conf" enabled 0
[ $enabled -eq 0 ] && return

config_get gateway "$conf" gateway
config_get pre_shared_key "$conf" pre_shared_key
config_get auth_method "$conf" authentication_method
config_get local_identifier "$conf" local_identifier ""
config_get remote_identifier "$conf" remote_identifier ""
config_get local_ip "$conf" local_ip "%any"
config_get keyingtries "$conf" keyingtries "3"
config_get dpddelay "$conf" dpddelay "30s"
config_get_bool encap "$conf" encap 0
Expand All @@ -491,7 +484,9 @@ config_remote() {
config_get_bool send_certreq "$conf" send_certreq 1
config_get eap_id "$conf" eap_id "%any"

config_list_foreach "$conf" local_sourceip append_var local_sourceip ","
config_list_foreach "$conf" local_addrs append_var local_addrs ","
Comment thread
feckert marked this conversation as resolved.
config_list_foreach "$conf" remote_addrs append_var remote_addrs ","
config_list_foreach "$conf" vips append_var vips ","
Comment thread
feckert marked this conversation as resolved.
config_list_foreach "$conf" remote_ca_certs append_var remote_ca_certs ","
config_list_foreach "$conf" pools append_var pools ","

Expand All @@ -509,13 +504,12 @@ config_remote() {
;;
esac

[ "$gateway" = "any" ] && remote_gateway="%any" || remote_gateway="$gateway"

Comment thread
feckert marked this conversation as resolved.
if [ -n "$local_key" ]; then
[ "$(dirname "$local_key")" != "." ] && \
fatal "local_key $local_key can't be pathname"
fatal "local_key $local_key can't be pathname"
[ -f "/etc/swanctl/private/$local_key" ] || \
fatal "local_key $local_key not found"
fatal "local_key $local_key not found"
fi

local ike_proposal
Expand All @@ -526,26 +520,25 @@ config_remote() {
if [ "$auth_method" = pubkey ]; then
if [ -n "$ca_cert" ]; then
[ "$(dirname "$ca_cert")" != "." ] && \
fatal "ca_cert $ca_cert can't be pathname"
fatal "ca_cert $ca_cert can't be pathname"
[ -f "/etc/swanctl/x509ca/$ca_cert" ] || \
fatal "ca_cert $ca_cert not found"
fatal "ca_cert $ca_cert not found"
fi

if [ -n "$local_cert" ]; then
[ "$(dirname "$local_cert")" != "." ] && \
fatal "local_cert $local_cert can't be pathname"
fatal "local_cert $local_cert can't be pathname"
[ -f "/etc/swanctl/x509/$local_cert" ] || \
fatal "local_cert $local_cert not found"
fatal "local_cert $local_cert not found"
fi
fi

swanctl_xappend0 "# config for $conf"
swanctl_xappend0 "connections {"
swanctl_xappend1 "$conf {"
swanctl_xappend2 "local_addrs = $local_ip"
swanctl_xappend2 "remote_addrs = $remote_gateway"

[ -n "$local_sourceip" ] && swanctl_xappend2 "vips = $local_sourceip"
[ -n "$local_addrs" ] && swanctl_xappend2 "local_addrs = $local_addrs"
[ -n "$remote_addrs" ] && swanctl_xappend2 "remote_addrs = $remote_addrs"
[ -n "$vips" ] && swanctl_xappend2 "vips = $vips"
[ -n "$fragmentation" ] && swanctl_xappend2 "fragmentation = $fragmentation"
[ -n "$pools" ] && swanctl_xappend2 "pools = $pools"

Expand All @@ -559,7 +552,9 @@ config_remote() {

[ -n "$local_identifier" ] && swanctl_xappend3 "id = \"$local_identifier\""
[ "$local_auth_method" = pubkey ] && [ -n "$local_cert" ] && \
swanctl_xappend3 "certs = $local_cert"
swanctl_xappend3 "certs = $local_cert"
[ "$local_auth_method" = pubkey ] && [ -n "$local_key" ] && \
swanctl_xappend3 "privkeys = $local_key"
swanctl_xappend2 "}"

swanctl_xappend2 "remote {"
Expand Down