strongswan: migration and merge local_nat into local_subnet

The UCI option 'local_nat' was a misleading legacy name for the
option that actually specifies the local traffic selector(s) used
by strongSwan/swanctl for a connection, i.e. the local subnet(s)
matched by the IPsec SA. It has nothing to do with NAT-T or NAT
detection, and the name repeatedly caused confusion when writing
or reviewing configs.

Merge it to 'local_subnet' to match its actual purpose and to
align with the naming already used for the corresponding
'local_subnet' option and with swanctl.conf's own 'local_ts/remote_ts'
terminology.

Add a uci-defaults migration script so existing installations are
upgraded automatically. It reads any existing 'local_nat' values
(whether stored as a plain option or as a list) and rewrites them
as a 'local_subnet' list.

Signed-off-by: Florian Eckert <redacted>

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index b2e2d6f9ac1370d721d4f1b296075d034e3137fb..e83669be7d8fbb0256ba60b382fa161eb3a15973 100644 (file)
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -26,9 +26,36 @@ migrate_ignore_routing_tables() {
        uci commit ipsec
 }
 
+migrate_local_nat_child() {
+       local cfg="$1"
+
+       local local_nat value
+
+       config_get local_nat "$cfg" local_nat ""
+       [ -z "$local_nat" ] && return
+
+       uci -q delete "ipsec.${cfg}.local_nat"
+
+       # Replace 'local_subnet' with 'local_nat' and do not append.
+       # That's how it was previously done in the swanctl start script.
+       uci -q delete "ipsec.${cfg}.local_subnet"
+
+       for value in $local_nat; do
+               uci add_list "ipsec.${cfg}.local_subnet=${value}"
+       done
+}
+
+migrate_local_nat() {
+       config_load ipsec
+       config_foreach migrate_local_nat_child tunnel
+       config_foreach migrate_local_nat_child transport
+       uci commit ipsec
+}
+
 main() {
        migrate_ipsec
        migrate_ignore_routing_tables
+       migrate_local_nat
 }
 
 main

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index bca799103c7c880ed79f0b13eb086b4b374ce006..3aa63a645addacce303e762344c2c7eae7495824 100644 (file)
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -226,7 +226,6 @@ config_child() {
        local mode="$2"
 
        local startaction
-       local local_nat
        local updown
        local firewall
        local lifetime
@@ -247,7 +246,6 @@ config_child() {
        local remote_subnet
 
        config_get startaction "$conf" startaction "route"
-       config_get local_nat "$conf" local_nat ""
        config_get updown "$conf" updown ""
        config_get firewall "$conf" firewall ""
        config_get lifetime "$conf" lifetime ""
@@ -333,8 +331,6 @@ config_child() {
                ;;
        esac
 
-       [ -n "$local_nat" ] && local_subnet="$local_nat"
-
        swanctl_xappend3 "$conf {"
 
        [ -n "$local_subnet" ] && swanctl_xappend4 "local_ts = $local_subnet"