packages/net/strongswan, branch masterMirror of packages feedhttps://git.openwrt.org/feed/packages/atom?h=master2026-10-30T07:07:18Zstrongswan: bump PKG_RELEASE by one2026-10-30T07:07:18ZFlorian Eckert2026-10-27T08:34:01Zurn:sha1:4cc338143c547d663ac9d431a8a2121a0a639e1f
Update 'PKG_RELEASE'.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: pass local certs for eap-tls authentication2026-10-30T07:07:18ZFlorian Eckert2026-10-27T14:55:13Zurn:sha1:776efff4c4103d0fef88b29974cedcb62800dbff
Local certs were only written to swanctl.conf when auth was set to
pubkey. EAP-TLS also needs the local certificate, so with auth set to
eap-tls no certificate was configured and the authentication failed.
Keep the certs for pubkey and eap-tls, and drop them for all other
authentication methods.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: add xauth_id option to local section2026-10-30T07:07:18ZFlorian Eckert2026-10-27T12:12:37Zurn:sha1:494c53240fdb0be5c4aeb9d3b3f8d282c717dd34
Add the uci option "xauth_id" to the local section. It is only written
if auth is "xauth" or "xauth-<backend>".
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: add eap_id option to local section2026-10-30T07:07:18ZFlorian Eckert2026-10-27T12:11:32Zurn:sha1:97373e54162acd69b77e400d5f50021f240fa398
Add the uci option "eap_id" to the local section. Like "aaa_id", it is
only written if auth is "eap-mschapv2" or "eap-tls".
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: add aaa_id option to local section2026-10-30T07:07:18ZFlorian Eckert2026-10-27T12:09:21Zurn:sha1:6c0b97290b8a7a0a24eba1db9fccc075d01b6a53
Add the uci option "aaa_id" to the local section. It is only written
if auth is "eap-mschapv2" or "eap-tls".
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: allow certs in local section as option or list2026-10-30T07:07:18ZFlorian Eckert2026-10-27T11:50:57Zurn:sha1:bb98cd7fe52d999ddda856eddc98d6759e2662f0
Read "certs" in the local section as uci list, falling back to the
option for existing configs. Each entry is checked and written as a
comma separated "certs" value.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: add pubkeys list option to local section2026-10-30T07:07:18ZFlorian Eckert2026-10-27T11:46:43Zurn:sha1:ff652e08dae5279371f916dd4bb0a4950ac67132
Add the uci list "pubkeys" to the local section. Its entries are
written as a comma separated "pubkeys" value when auth is "pubkey".
Each entry must be a file name in /etc/swanctl/pubkey.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: add pubkeys list option to remote section2026-10-30T07:07:18ZFlorian Eckert2026-10-27T11:59:24Zurn:sha1:0daf8a83fbe01bd3583a79611614809d9ddee79e
Add the uci list "pubkeys" to the remote section, like in the local
section. The migration already writes it from rightrsasigkey and
rightsigkey, but it was not used so far.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: add reauth_time option to swanctl connections2026-10-30T07:07:18ZFlorian Eckert2026-10-26T13:17:26Zurn:sha1:6248289cc38c215bf097ccf8df5ef414161e3f38
Add the uci option "reauth_time" to the connection section. When set,
it is written as "reauth_time = <value>" to the connection in
swanctl.conf to enable periodic IKE_SA reauthentication.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
strongswan: add rand_time option to swanctl children2026-10-30T07:07:18ZFlorian Eckert2026-10-26T13:14:00Zurn:sha1:f93d66c1036389096510b5b2f0c6a8b158b3d37f
Add the uci option "rand_time" to the child sections. When set,
it is written as "rand_time = <value>" to the child in swanctl.conf
to randomize the CHILD_SA rekey time.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>