strongswan: rename 'gateway' to 'remote_gateway'

The UCI option 'gateway' in the ipsec config (consumed by
/etc/init.d/swanctl) is ambiguous. It is not clear from the name
alone whether it refers to the local or the remote IKE/IPsec
peer address, which has repeatedly led to misconfiguration.

Rename it to "remote_gateway" to make the direction explicit and
to match the existing "remote_subnet" naming. If the option is
unset, the init script now falls back to the strongSwan default
of '%any', so connections that accept any remote peer no longer
require an explicit placeholder value.

Add a uci-defaults migration script to rename existing 'gateway'
entries to 'remote_gateway' and remove the value 'any' on upgrade. This
is new default if 'remote_gateway' is not set.

Signed-off-by: Florian Eckert <redacted>

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index e83669be7d8fbb0256ba60b382fa161eb3a15973..44adcf906b2ad6f255a10b32d739573fe99136aa 100644 (file)
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -52,10 +52,34 @@ migrate_local_nat() {
        uci commit ipsec
 }
 
+migrate_gateway_remote() {
+       local cfg="$1"
+
+       local gateway
+
+       config_get gateway "$cfg" gateway ""
+       [ -z "$gateway" ] && return
+
+       # The option 'any' is default for the 'remote_gateway' option if not set
+       # and does not need to be saved.
+       [ "$gateway" = "any" ] || {
+               uci -q set "ipsec.${cfg}.remote_gateway=${gateway}"
+       }
+
+       uci -q delete "ipsec.${cfg}.gateway"
+       uci commit ipsec
+}
+
+migrate_gateway() {
+       config_load ipsec
+       config_foreach migrate_gateway_remote remote
+}
+
 main() {
        migrate_ipsec
        migrate_ignore_routing_tables
        migrate_local_nat
+       migrate_gateway
 }
 
 main

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 3aa63a645addacce303e762344c2c7eae7495824..5a67eca8ea30c6e495f6ec27206e0407809c4afa 100644 (file)
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -436,7 +436,7 @@ config_remote() {
        local conf="$1"
 
        local enabled
-       local gateway
+       local remote_gateway
        local pre_shared_key
        local auth_method
        local local_identifier
@@ -464,7 +464,7 @@ config_remote() {
        config_get_bool enabled "$conf" enabled 0
        [ $enabled -eq 0 ] && return
 
-       config_get gateway "$conf" gateway
+       config_get remote_gateway "$conf" remote_gateway '%any'
        config_get pre_shared_key "$conf" pre_shared_key
        config_get auth_method "$conf" authentication_method
        config_get local_identifier "$conf" local_identifier ""
@@ -504,8 +504,6 @@ config_remote() {
                ;;
        esac
 
-       local remote_gateway
-       [ "$gateway" = "any" ] && remote_gateway="%any" || remote_gateway="$gateway"
 
        if [ -n "$local_key" ]; then
                [ "$(dirname "$local_key")" != "." ] && \