packages/net/strongswan, branch master

strongswan: fix build with wolfSSL 5.9.2

2026-08-19T05:56:36Z

wolfSSL 5.9.2 removed mlkem.h. Backport the upstream change to use wc_mlkem.h directly. Fixes: #30291 Signed-off-by: Dharmik Parmar

strongswan: swanctl.init: remove invalid privkeys option

2026-08-04T13:09:47Z

The 'swanctl.conf' has no 'privkeys' option in 'connections..local'. The only local-round keys documented for authentication are 'certs', 'cert' and 'pubkeys'. Strongswan does not let a connection reference a private key by name at all - swanctl auto-selects the matching private key from '/etc/swanctl/private' (or rsa/ecdsa/pkcs8) by comparing it against the certificate configured via 'certs' when credentials are loaded. Writing 'privkeys = $local_key' into the generated swanctl.conf is therefore a no-op at best: the option is unknown to the parser and gets silently dropped, so it never had any effect on which key was used. Drop the bogus assignment. The existing local_key validation making sure the referenced file exists under '/etc/swanctl/private'. Since that's still useful to catch misconfiguration early, and add a comment explaining why nothing is written to swanctl.conf for it. Signed-off-by: Florian Eckert

strongswan: bump PKG_RELEASE by one

2026-08-03T09:07:41Z

Update 'PKG_RELEASE'. Signed-off-by: Florian Eckert

strongswan: write local_key to swanctl.conf

2026-08-03T09:07:41Z

The 'local_key' UCI option was validated (checked for existence under /etc/swanctl/private/) but never written to the generated 'swanctl.conf'. As a result, setting 'local_key' had no actual effect on which private key was used for local authentication. Add the corresponding "privkeys" line to the local{} section, mirroring how local_cert is already written as "certs", so that swanctl explicitly uses the configured private key. Signed-off-by: Florian Eckert

strongswan: rename 'local_sourceip' to 'vips'

2026-08-03T09:07:41Z

The name 'local_sourceip' was misleading, since the option actually refers to virtual IP addresses (VIPs) used for routing/binding, not just a single local source IP. Renaming it to 'vips' better reflects its purpose and makes the configuration more intuitive for users, especially in setups with multiple virtual IPs. Add a uci-defaults migration script to convert existing 'local_sourceip' entries (whether stored as a plain option or as a list) to a 'vips' list on upgrade. Signed-off-by: Florian Eckert

strongswan: rename 'local_ip' to 'local_addrs'

2026-08-03T09:07:41Z

Rename the 'local_ip' UCI option to 'local_addrs' to match the 'swanctl.conf' 'local_addrs' directive, which accepts one or more local addresses rather than implying a single fixed IP. The previous name suggested only one address could be configured. Store the option as a UCI list to allow specifying multiple local addresses, consistent with how 'remote_addrs' is already handled. If left empty, no 'local_addrs' line is written to 'swanctl.conf', so strongswan falls back to its own default of '%any'. Add a uci-defaults migration script to convert existing 'local_ip' entries (whether stored as a plain option or as a list) to a 'local_addrs' list on upgrade. Signed-off-by: Florian Eckert

strongswan: rename 'remote_gateway' to 'remote_addrs'

2026-08-03T09:07:41Z

Rename the 'remote_gateway' UCI option to 'remote_addrs' to match the 'swanctl.conf' 'remote_addrs' directive, which accepts one or more peer addresses rather than a single gateway. The previous name implied a single value and did not reflect that multiple remote addresses can be configured for a connection. Store the option as a UCI list to allow specifying multiple remote addresses, consistent with how 'local_subnet' and 'remote_subnet' are already handled. Add a uci-defaults migration script to convert existing 'remote_gateway' entries (whether stored as a plain option or as a list) to a 'remote_addrs' list on upgrade. If the 'remote_addrs' option is empty, strongswan implicitly uses the value '%any'. In the `swanctl.conf` documentation, '%any' is already the default value for 'remote_addrs' if the directive is not specified at all. Signed-off-by: Florian Eckert

strongswan: rename 'gateway' to 'remote_gateway'

2026-08-03T09:07:41Z

The UCI option 'gateway' in the ipsec config (consumed by /etc/init.d/swanctl) is ambiguous. It is not clear from the name alone whether it refers to the local or the remote IKE/IPsec peer address, which has repeatedly led to misconfiguration. Rename it to "remote_gateway" to make the direction explicit and to match the existing "remote_subnet" naming. If the option is unset, the init script now falls back to the strongSwan default of '%any', so connections that accept any remote peer no longer require an explicit placeholder value. Add a uci-defaults migration script to rename existing 'gateway' entries to 'remote_gateway' and remove the value 'any' on upgrade. This is new default if 'remote_gateway' is not set. Signed-off-by: Florian Eckert

strongswan: migration and merge local_nat into local_subnet

2026-08-03T09:07:41Z

The UCI option 'local_nat' was a misleading legacy name for the option that actually specifies the local traffic selector(s) used by strongSwan/swanctl for a connection, i.e. the local subnet(s) matched by the IPsec SA. It has nothing to do with NAT-T or NAT detection, and the name repeatedly caused confusion when writing or reviewing configs. Merge it to 'local_subnet' to match its actual purpose and to align with the naming already used for the corresponding 'local_subnet' option and with swanctl.conf's own 'local_ts/remote_ts' terminology. Add a uci-defaults migration script so existing installations are upgraded automatically. It reads any existing 'local_nat' values (whether stored as a plain option or as a list) and rewrites them as a 'local_subnet' list. Signed-off-by: Florian Eckert

strongswan: replace indentation spaces with tabs in swanctl.init

2026-08-03T09:07:41Z

For consistency, the remaining spaces used for indentation have been replaced with tabs. Signed-off-by: Florian Eckert