packages/net/strongswan/files/etc/uci-defaults, branch master

strongswan: rename 'local_sourceip' to 'vips'

2026-08-03T09:07:41Z

The name 'local_sourceip' was misleading, since the option actually refers to virtual IP addresses (VIPs) used for routing/binding, not just a single local source IP. Renaming it to 'vips' better reflects its purpose and makes the configuration more intuitive for users, especially in setups with multiple virtual IPs. Add a uci-defaults migration script to convert existing 'local_sourceip' entries (whether stored as a plain option or as a list) to a 'vips' list on upgrade. Signed-off-by: Florian Eckert

strongswan: rename 'local_ip' to 'local_addrs'

2026-08-03T09:07:41Z

Rename the 'local_ip' UCI option to 'local_addrs' to match the 'swanctl.conf' 'local_addrs' directive, which accepts one or more local addresses rather than implying a single fixed IP. The previous name suggested only one address could be configured. Store the option as a UCI list to allow specifying multiple local addresses, consistent with how 'remote_addrs' is already handled. If left empty, no 'local_addrs' line is written to 'swanctl.conf', so strongswan falls back to its own default of '%any'. Add a uci-defaults migration script to convert existing 'local_ip' entries (whether stored as a plain option or as a list) to a 'local_addrs' list on upgrade. Signed-off-by: Florian Eckert

strongswan: rename 'remote_gateway' to 'remote_addrs'

2026-08-03T09:07:41Z

Rename the 'remote_gateway' UCI option to 'remote_addrs' to match the 'swanctl.conf' 'remote_addrs' directive, which accepts one or more peer addresses rather than a single gateway. The previous name implied a single value and did not reflect that multiple remote addresses can be configured for a connection. Store the option as a UCI list to allow specifying multiple remote addresses, consistent with how 'local_subnet' and 'remote_subnet' are already handled. Add a uci-defaults migration script to convert existing 'remote_gateway' entries (whether stored as a plain option or as a list) to a 'remote_addrs' list on upgrade. If the 'remote_addrs' option is empty, strongswan implicitly uses the value '%any'. In the `swanctl.conf` documentation, '%any' is already the default value for 'remote_addrs' if the directive is not specified at all. Signed-off-by: Florian Eckert

strongswan: rename 'gateway' to 'remote_gateway'

2026-08-03T09:07:41Z

The UCI option 'gateway' in the ipsec config (consumed by /etc/init.d/swanctl) is ambiguous. It is not clear from the name alone whether it refers to the local or the remote IKE/IPsec peer address, which has repeatedly led to misconfiguration. Rename it to "remote_gateway" to make the direction explicit and to match the existing "remote_subnet" naming. If the option is unset, the init script now falls back to the strongSwan default of '%any', so connections that accept any remote peer no longer require an explicit placeholder value. Add a uci-defaults migration script to rename existing 'gateway' entries to 'remote_gateway' and remove the value 'any' on upgrade. This is new default if 'remote_gateway' is not set. Signed-off-by: Florian Eckert

strongswan: migration and merge local_nat into local_subnet

2026-08-03T09:07:41Z

The UCI option 'local_nat' was a misleading legacy name for the option that actually specifies the local traffic selector(s) used by strongSwan/swanctl for a connection, i.e. the local subnet(s) matched by the IPsec SA. It has nothing to do with NAT-T or NAT detection, and the name repeatedly caused confusion when writing or reviewing configs. Merge it to 'local_subnet' to match its actual purpose and to align with the naming already used for the corresponding 'local_subnet' option and with swanctl.conf's own 'local_ts/remote_ts' terminology. Add a uci-defaults migration script so existing installations are upgraded automatically. It reads any existing 'local_nat' values (whether stored as a plain option or as a list) and rewrites them as a 'local_subnet' list. Signed-off-by: Florian Eckert

strongswan: move strongswan ignore_routing_tables check into subfunction

2026-07-16T20:27:36Z

This makes the generation process clearer and more extensible. While we're at it, the option 'ignore_routing_tables' is changed to a list of elements. For the migration, the '/etc/uci-defaults/strongswan' migration script is be extended with the new function 'migrate_ignore_routing_tables', which handles the migration from an 'option' element to a 'list' elements. Signed-off-by: Florian Eckert

strongswan: move uci-defaults migration into subfunction

2026-07-16T20:27:36Z

To make the migration script more organized, the migration for the 'ipsec' unamed section to 'ipsec' named section 'globals' has been moved to a subfunction. The change prepares the new migration script to migrate other areas. Signed-off-by: Florian Eckert

strongswan: add one default named ipsec uci section 'globals'

2026-07-09T08:51:13Z

The UCI section 'ipsec' should only be available once, as these are general settings for 'strongswan.conf'. It makes no sense to configure them more than once. To ensure that the general settings can also be configured via LuCI, this section must be present at least once. For configurations already in the field, a uci-default script is added that assigns the name 'globals' to the last ipsec section type. Signed-off-by: Florian Eckert