strongswan: rename 'remote_gateway' to 'remote_addrs'

Rename the 'remote_gateway' UCI option to 'remote_addrs' to match
the 'swanctl.conf' 'remote_addrs' directive, which accepts one or
more peer addresses rather than a single gateway. The previous
name implied a single value and did not reflect that multiple
remote addresses can be configured for a connection.

Store the option as a UCI list to allow specifying multiple
remote addresses, consistent with how 'local_subnet' and
'remote_subnet' are already handled.

Add a uci-defaults migration script to convert existing
'remote_gateway' entries (whether stored as a plain option or as
a list) to a 'remote_addrs' list on upgrade.

If the 'remote_addrs' option is empty, strongswan implicitly uses the value
'%any'. In the `swanctl.conf` documentation, '%any' is already the default
value for 'remote_addrs' if the directive is not specified at all.

Signed-off-by: Florian Eckert <redacted>

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 44adcf906b2ad6f255a10b32d739573fe99136aa..625ca8fd99208854cb8a07bed59aa48ed10e3fe9 100644 (file)
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -75,11 +75,33 @@ migrate_gateway() {
        config_foreach migrate_gateway_remote remote
 }
 
+migrate_remote_gateway_remote() {
+       local cfg="$1"
+
+       local remote_gateway value
+
+       config_get remote_gateway "$cfg" remote_gateway ""
+       [ -z "$remote_gateway" ] && return
+
+       for value in $remote_gateway; do
+               uci add_list "ipsec.${cfg}.remote_addrs=${value}"
+       done
+
+       uci -q delete "ipsec.${cfg}.remote_gateway"
+       uci commit ipsec
+}
+
+migrate_remote_gateway() {
+       config_load ipsec
+       config_foreach migrate_remote_gateway_remote remote
+}
+
 main() {
        migrate_ipsec
        migrate_ignore_routing_tables
        migrate_local_nat
        migrate_gateway
+       migrate_remote_gateway
 }
 
 main

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 5a67eca8ea30c6e495f6ec27206e0407809c4afa..4ffbea57539519e80cb05685bc0ca304db6bcffc 100644 (file)
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -436,7 +436,6 @@ config_remote() {
        local conf="$1"
 
        local enabled
-       local remote_gateway
        local pre_shared_key
        local auth_method
        local local_identifier
@@ -457,6 +456,7 @@ config_remote() {
        local send_cert
        local send_certreq
        local eap_id
+       local remote_addrs
        local local_sourceip
        local remote_ca_certs
        local pools
@@ -464,7 +464,6 @@ config_remote() {
        config_get_bool enabled "$conf" enabled 0
        [ $enabled -eq 0 ] && return
 
-       config_get remote_gateway "$conf" remote_gateway '%any'
        config_get pre_shared_key "$conf" pre_shared_key
        config_get auth_method "$conf" authentication_method
        config_get local_identifier "$conf" local_identifier ""
@@ -486,6 +485,7 @@ config_remote() {
        config_get_bool send_certreq "$conf" send_certreq 1
        config_get eap_id "$conf" eap_id "%any"
 
+       config_list_foreach "$conf" remote_addrs append_var remote_addrs ","
        config_list_foreach "$conf" local_sourceip append_var local_sourceip ","
        config_list_foreach "$conf" remote_ca_certs append_var remote_ca_certs ","
        config_list_foreach "$conf" pools append_var pools ","
@@ -537,8 +537,7 @@ config_remote() {
        swanctl_xappend0 "connections {"
        swanctl_xappend1 "$conf {"
        swanctl_xappend2 "local_addrs = $local_ip"
-       swanctl_xappend2 "remote_addrs = $remote_gateway"
-
+       [ -n "$remote_addrs" ] && swanctl_xappend2 "remote_addrs = $remote_addrs"
        [ -n "$local_sourceip" ] && swanctl_xappend2 "vips = $local_sourceip"
        [ -n "$fragmentation" ] && swanctl_xappend2 "fragmentation = $fragmentation"
        [ -n "$pools" ] && swanctl_xappend2 "pools = $pools"