packages/net/strongswan/Makefile, branch master

strongswan: bump PKG_RELEASE by one

2026-10-14T12:14:27Z

Update 'PKG_RELEASE'. Signed-off-by: Florian Eckert

strongswan: stage the migration in the LuCI session through ubus

2026-10-06T07:53:01Z

When LuCI passes a session id, migrate-ipsec-to-swanctl moves its uci delta into /tmp/run/rpcd/uci-, rpcd's private save directory of that session. rpcd stops naming this directory after the session id, as the id is a bearer credential that leaked through directory listings, so the migrated configuration would no longer show up as pending changes in LuCI. Stage the migration through rpcd's uci ubus API instead: revert the session's ipsec changes, delete all sections and add the sections of the migrated configuration. Then revert the changes of the uci command line tool, which the old code moved away. This works with old and new rpcd versions. If staging fails, both are reverted and the script exits with an error. Fixes: d5f33e6410cf ("strongswan: support optional UCI session staging in migrate-ipsec-to-swanctl") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Hauke Mehrtens

strongswan: bump PKG_RELEASE by one

2026-09-30T09:58:51Z

Update 'PKG_RELEASE'. Signed-off-by: Florian Eckert

strongswan: stop automatic migration via uci-defaults

2026-09-30T09:58:51Z

The migration of the legacy '/etc/config/ipsec' UCI configuration to the new '/etc/config/swanctl' format cannot be performed fully automatically: it rewrites the user's configuration and must be triggered and acknowledged by the user. Remove the automatic migration hook that was installed as an uci-defaults script (executed once on first boot or installation) and instead ship the migration utility as a regular binary at '/usr/libexec/strongswan/migrate-ipsec-to-swanctl'. From now on the migration is only run on demand. Signed-off-by: Florian Eckert

strongswan: enable plugins-packaged-separately option

2026-09-30T09:58:51Z

OpenWrt ships the plugins in multiple packages that are not all installed by default. When running tools like 'pki' or 'swanctl', this currently produces error-level log output for plugins that are simply not installed, which can alarm users unnecessarily. Enable the new configure option 'plugins-packaged-separately' (default: no), added in strongSwan 6.0.5, which sets it to 'yes'. This lowers the log level of the corresponding messages and adds a note that the missing plugins may be available in other packages. Signed-off-by: Florian Eckert

strongswan: fix build with wolfSSL 5.9.2

2026-08-19T05:56:36Z

wolfSSL 5.9.2 removed mlkem.h. Backport the upstream change to use wc_mlkem.h directly. Fixes: #30291 Signed-off-by: Dharmik Parmar

strongswan: swanctl.init: remove invalid privkeys option

2026-08-04T13:09:47Z

The 'swanctl.conf' has no 'privkeys' option in 'connections..local'. The only local-round keys documented for authentication are 'certs', 'cert' and 'pubkeys'. Strongswan does not let a connection reference a private key by name at all - swanctl auto-selects the matching private key from '/etc/swanctl/private' (or rsa/ecdsa/pkcs8) by comparing it against the certificate configured via 'certs' when credentials are loaded. Writing 'privkeys = $local_key' into the generated swanctl.conf is therefore a no-op at best: the option is unknown to the parser and gets silently dropped, so it never had any effect on which key was used. Drop the bogus assignment. The existing local_key validation making sure the referenced file exists under '/etc/swanctl/private'. Since that's still useful to catch misconfiguration early, and add a comment explaining why nothing is written to swanctl.conf for it. Signed-off-by: Florian Eckert

strongswan: bump PKG_RELEASE by one

2026-08-03T09:07:41Z

Update 'PKG_RELEASE'. Signed-off-by: Florian Eckert

strongswan: bump PKG_RELEASE

2026-07-16T20:27:36Z

Update PKG_RELEASE to '4'. Signed-off-by: Florian Eckert

strongswan: bump PKG_RELEASE

2026-07-09T08:51:13Z

Update PKG_RELEASE. Signed-off-by: Florian Eckert