packages/net/strongswan/files/usr, branch master

strongswan: use swanctl default for dpd_delay

2026-10-30T07:07:18Z

Do not set a default value for dpd_delay in the swanctl config, so strongSwan's own default (0s, DPD disabled) is used. The option is only written to swanctl.conf if it is set. The legacy config keeps its default of 30s. migrate-ipsec-to-swanctl now migrates dpddelay together with dpdaction to keep the previous behavior of migrated configs: - The legacy config disabled DPD with dpddelay=0s if a child had dpdaction 'none', which was also the default. In this case dpd_delay is set to 0s. - Otherwise dpddelay is renamed to dpd_delay. If it was not set, the old default of 30s is set explicitly. This has to happen before dpdaction of the children is migrated, so it is done in the new function migrate_dpd_delay_remote. Signed-off-by: Florian Eckert

strongswan: use swanctl default for keyingtries

2026-10-30T07:07:18Z

Do not set a default value for keyingtries in the swanctl config, so strongSwan's own default (1) is used. The option is only written to swanctl.conf if it is set. The legacy config keeps its default of 3. In swanctl.conf, keyingtries is a plain number and 0 means unlimited. The '%forever' value of the old ipsec.conf syntax is therefore no longer translated for the swanctl config. migrate-ipsec-to-swanctl converts keyingtries '%forever' to 0. If keyingtries is not set, it sets the old default of 3 explicitly to keep the previous behavior of migrated configs. Signed-off-by: Florian Eckert

strongswan: move inactivity from connection to child

2026-10-30T07:07:18Z

The 'swanctl.conf' only knows inactivity per child. The init script read it on the connection and only passed it on via shell dynamic scoping. Which is fragile and hides the real option level. Users could not set it per child, and a connection-level value was silently shared by all children Read child..inactivity in config_child and drop it from config_connection. In migrate-ipsec-to-swanctl, move inactivity from the connection section to all of its child sections, so existing configurations keep their setting. Signed-off-by: Florian Eckert

strongswan: stage the migration in the LuCI session through ubus

2026-10-06T07:53:01Z

When LuCI passes a session id, migrate-ipsec-to-swanctl moves its uci delta into /tmp/run/rpcd/uci-, rpcd's private save directory of that session. rpcd stops naming this directory after the session id, as the id is a bearer credential that leaked through directory listings, so the migrated configuration would no longer show up as pending changes in LuCI. Stage the migration through rpcd's uci ubus API instead: revert the session's ipsec changes, delete all sections and add the sections of the migrated configuration. Then revert the changes of the uci command line tool, which the old code moved away. This works with old and new rpcd versions. If staging fails, both are reverted and the script exits with an error. Fixes: d5f33e6410cf ("strongswan: support optional UCI session staging in migrate-ipsec-to-swanctl") Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Hauke Mehrtens

strongswan: rename child local/remote_subnet to local/remote_ts

2026-09-30T09:58:51Z

The swanctl.conf child options are called local_ts and remote_ts (traffic selectors), but the UCI config used local_subnet and remote_subnet for them. Rename the UCI options in the swanctl init script to match the swanctl.conf naming, so the config maps 1:1 to what strongSwan actually expects. Since this changes the UCI option names, existing configurations would silently lose their traffic selectors after an upgrade. Add migrate_child_subnet_to_ts() to the ipsec-to-swanctl migration script. For each child section it moves the values of local_subnet and remote_subnet into the local_ts and remote_ts lists and removes the old options. Signed-off-by: Florian Eckert

strongswan: move local and remote into own uci sections

2026-09-30T09:58:51Z

The local and remote authentication configuration was stored as flat options on the connection section. This cannot represent IKEv2 multiple authentication rounds, where more than one local/remote pair is needed. Move the options into dedicated 'local' and 'remote' uci sections which are referenced from the connection via the 'list local' and 'list remote' options. Multiple sections per connection are now possible and each pair is emitted as one authentication round. The generated swanctl.conf names the rounds positionally: the first local/remote section is emitted as 'local'/'remote', the following ones as 'local2'/'remote2' and so on. The 'authentication_method' option moves to the new sections as 'auth'. The local side of an EAP connection still defaults to pubkey. The migration script converts an existing connection into one local and one remote section: - 'local_identifier' -> local 'id' - 'local_cert' -> local 'certs' - 'local_key' -> local 'key' - 'remote_identifier' -> remote 'id' - 'remote_ca_certs' -> remote 'cacerts' (list) - 'eap_id' -> remote 'eap_id' Signed-off-by: Florian Eckert

strongswan: use global secret/authority uci sections

2026-09-30T09:58:51Z

Remove the per-connection 'authorities' and 'secrets' blocks generated inline in config_connection. Pre-shared keys and CA certificates are now provided via the global 'secret' and 'authority' uci sections, which prepare_env renders into their own swanctl.conf entries. The migrate script converts the old per-connection settings into these new global sections: - psk connections: 'pre_shared_key' is moved into a 'secret' section with type='ike', keeping the local/remote identifiers as an 'id' list - pubkey connections: 'ca_cert' is moved into an 'authority' section with the matching 'cacert' option Both options are removed from the connection section afterwards. Signed-off-by: Florian Eckert

strongswan: replace mschapv2_secrets with generic secret type

2026-09-30T09:58:51Z

Add a generic uci 'secret' section type to swanctl handling, replacing the dedicated 'mschapv2_secrets' section in prepare_env. The secret kind is selected via a new 'type' uci option and maps to the matching swanctl secrets subsection (the section prefix equals the type value): - eap, xauth, ntlm, ike, ppk: - { id ...; secret } - private, rsa, ecdsa, pkcs8, pkcs12: - { file ...; secret } - token: token- { handle, slot, module, pin } The 'id' option is a uci list element for the eap/xauth/ntlm/ike/ppk types and emits one 'id' line per entry, matching swanctl's support for multiple identities per secret. The legacy path stays unchanged and keeps generating EAP secrets from the 'mschapv2_secrets' section via legacy_config_mschapv2_secret. The migrate script now converts 'mschapv2_secrets' sections into generic 'secret' sections setting type='eap' and turning 'id' into a list element. Signed-off-by: Florian Eckert

strongswan: rename uci remote section type to connection

2026-09-30T09:58:51Z

The 'remote' section type in '/etc/config/ipsec' is a misnomer, since it defines the whole IPsec connection (IKE peer and children), not just the remote end. Rename it to 'connection' to align with the swanctl 'connections' terminology. Rename config_remote() to config_connection() and iterate the 'connection' type in swanctl.init. Add a migrate_remote_to_connection migration step that renames existing 'remote' sections to 'connection'. Signed-off-by: Florian Eckert

strongswan: support optional UCI session staging in migrate-ipsec-to-swanctl

2026-09-30T09:58:51Z

Let the caller pass an optional session ID as the first argument to main(). If one is given, the migration is performed inside a LuCI transaction session: the resulting /tmp/.uci/ipsec delta is moved to /tmp/run/rpcd/uci-${session} at the end instead of being applied to the running config directly. This allows LuCI to preview and apply the ipsec-to-swanctl migration through its normal session workflow, rather than forcing an immediate, uncoordinated commit of /etc/config/ipsec. Drop the 'uci commit ipsec' calls scattered through the individual migration functions, since committing is now the caller's responsibility. Also add -q to the uci calls that were missing it, so errors are suppressed consistently. Signed-off-by: Florian Eckert