packages/net/strongswan/files/usr/libexec, branch master

strongswan: rename child local/remote_subnet to local/remote_ts

2026-09-30T09:58:51Z

The swanctl.conf child options are called local_ts and remote_ts (traffic selectors), but the UCI config used local_subnet and remote_subnet for them. Rename the UCI options in the swanctl init script to match the swanctl.conf naming, so the config maps 1:1 to what strongSwan actually expects. Since this changes the UCI option names, existing configurations would silently lose their traffic selectors after an upgrade. Add migrate_child_subnet_to_ts() to the ipsec-to-swanctl migration script. For each child section it moves the values of local_subnet and remote_subnet into the local_ts and remote_ts lists and removes the old options. Signed-off-by: Florian Eckert

strongswan: move local and remote into own uci sections

2026-09-30T09:58:51Z

The local and remote authentication configuration was stored as flat options on the connection section. This cannot represent IKEv2 multiple authentication rounds, where more than one local/remote pair is needed. Move the options into dedicated 'local' and 'remote' uci sections which are referenced from the connection via the 'list local' and 'list remote' options. Multiple sections per connection are now possible and each pair is emitted as one authentication round. The generated swanctl.conf names the rounds positionally: the first local/remote section is emitted as 'local'/'remote', the following ones as 'local2'/'remote2' and so on. The 'authentication_method' option moves to the new sections as 'auth'. The local side of an EAP connection still defaults to pubkey. The migration script converts an existing connection into one local and one remote section: - 'local_identifier' -> local 'id' - 'local_cert' -> local 'certs' - 'local_key' -> local 'key' - 'remote_identifier' -> remote 'id' - 'remote_ca_certs' -> remote 'cacerts' (list) - 'eap_id' -> remote 'eap_id' Signed-off-by: Florian Eckert

strongswan: use global secret/authority uci sections

2026-09-30T09:58:51Z

Remove the per-connection 'authorities' and 'secrets' blocks generated inline in config_connection. Pre-shared keys and CA certificates are now provided via the global 'secret' and 'authority' uci sections, which prepare_env renders into their own swanctl.conf entries. The migrate script converts the old per-connection settings into these new global sections: - psk connections: 'pre_shared_key' is moved into a 'secret' section with type='ike', keeping the local/remote identifiers as an 'id' list - pubkey connections: 'ca_cert' is moved into an 'authority' section with the matching 'cacert' option Both options are removed from the connection section afterwards. Signed-off-by: Florian Eckert

strongswan: replace mschapv2_secrets with generic secret type

2026-09-30T09:58:51Z

Add a generic uci 'secret' section type to swanctl handling, replacing the dedicated 'mschapv2_secrets' section in prepare_env. The secret kind is selected via a new 'type' uci option and maps to the matching swanctl secrets subsection (the section prefix equals the type value): - eap, xauth, ntlm, ike, ppk: - { id ...; secret } - private, rsa, ecdsa, pkcs8, pkcs12: - { file ...; secret } - token: token- { handle, slot, module, pin } The 'id' option is a uci list element for the eap/xauth/ntlm/ike/ppk types and emits one 'id' line per entry, matching swanctl's support for multiple identities per secret. The legacy path stays unchanged and keeps generating EAP secrets from the 'mschapv2_secrets' section via legacy_config_mschapv2_secret. The migrate script now converts 'mschapv2_secrets' sections into generic 'secret' sections setting type='eap' and turning 'id' into a list element. Signed-off-by: Florian Eckert

strongswan: rename uci remote section type to connection

2026-09-30T09:58:51Z

The 'remote' section type in '/etc/config/ipsec' is a misnomer, since it defines the whole IPsec connection (IKE peer and children), not just the remote end. Rename it to 'connection' to align with the swanctl 'connections' terminology. Rename config_remote() to config_connection() and iterate the 'connection' type in swanctl.init. Add a migrate_remote_to_connection migration step that renames existing 'remote' sections to 'connection'. Signed-off-by: Florian Eckert

strongswan: support optional UCI session staging in migrate-ipsec-to-swanctl

2026-09-30T09:58:51Z

Let the caller pass an optional session ID as the first argument to main(). If one is given, the migration is performed inside a LuCI transaction session: the resulting /tmp/.uci/ipsec delta is moved to /tmp/run/rpcd/uci-${session} at the end instead of being applied to the running config directly. This allows LuCI to preview and apply the ipsec-to-swanctl migration through its normal session workflow, rather than forcing an immediate, uncoordinated commit of /etc/config/ipsec. Drop the 'uci commit ipsec' calls scattered through the individual migration functions, since committing is now the caller's responsibility. Also add -q to the uci calls that were missing it, so errors are suppressed consistently. Signed-off-by: Florian Eckert

strongswan: add migrate command to swanctl.init

2026-09-30T09:58:51Z

Now that the ipsec-to-swanctl migration is no longer executed automatically on boot, expose it through the init script so it can be invoked on demand via '/etc/init.d/swanctl migrate'. Also harden the migration script: abort with an error if '/etc/config/ipsec' does not exist. Keep a copy of the original configuration in '/etc/config/ipsec_bak' before starting. Signed-off-by: Florian Eckert

strongswan: stop automatic migration via uci-defaults

2026-09-30T09:58:51Z

The migration of the legacy '/etc/config/ipsec' UCI configuration to the new '/etc/config/swanctl' format cannot be performed fully automatically: it rewrites the user's configuration and must be triggered and acknowledged by the user. Remove the automatic migration hook that was installed as an uci-defaults script (executed once on first boot or installation) and instead ship the migration utility as a regular binary at '/usr/libexec/strongswan/migrate-ipsec-to-swanctl'. From now on the migration is only run on demand. Signed-off-by: Florian Eckert