From: Florian Eckert <redacted>
Date: Thu, 23 Jul 2026 14:18:18 +0000 (+0200)
Subject: strongswan: rename 'local_ip' to 'local_addrs'
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=07450023bca29dec13b3ddeb349af1fb8eb62fbe;p=openwrt-packages.git

strongswan: rename 'local_ip' to 'local_addrs'

Rename the 'local_ip' UCI option to 'local_addrs' to match the
'swanctl.conf' 'local_addrs' directive, which accepts one or more
local addresses rather than implying a single fixed IP. The
previous name suggested only one address could be configured.

Store the option as a UCI list to allow specifying multiple local
addresses, consistent with how 'remote_addrs' is already handled.
If left empty, no 'local_addrs' line is written to 'swanctl.conf',
so strongswan falls back to its own default of '%any'.

Add a uci-defaults migration script to convert existing 'local_ip'
entries (whether stored as a plain option or as a list) to a
'local_addrs' list on upgrade.

Signed-off-by: Florian Eckert <redacted>
---

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 625ca8fd9..9e5628acb 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+. /lib/functions.sh
 migrate_ipsec() {
 	# Skip migration if the 'globals' section already exists
 	uci show ipsec.globals 1>/dev/null 2>/dev/null
@@ -96,12 +97,34 @@ migrate_remote_gateway() {
 	config_foreach migrate_remote_gateway_remote remote
 }
 
+migrate_local_ip_local() {
+	local cfg="$1"
+
+	local local_ip value
+
+	config_get local_ip "$cfg" local_ip ""
+	[ -z "$local_ip" ] && return
+
+	for value in $local_ip; do
+		uci add_list "ipsec.${cfg}.local_addrs=${value}"
+	done
+
+	uci -q delete "ipsec.${cfg}.local_ip"
+	uci commit ipsec
+}
+
+migrate_local_ip() {
+	config_load ipsec
+	config_foreach migrate_local_ip_local remote
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
 	migrate_local_nat
 	migrate_gateway
 	migrate_remote_gateway
+	migrate_local_ip
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 4ffbea575..1673c5a1f 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -440,7 +440,6 @@ config_remote() {
 	local auth_method
 	local local_identifier
 	local remote_identifier
-	local local_ip
 	local keyingtries
 	local dpddelay
 	local encap
@@ -456,6 +455,7 @@ config_remote() {
 	local send_cert
 	local send_certreq
 	local eap_id
+	local local_addrs
 	local remote_addrs
 	local local_sourceip
 	local remote_ca_certs
@@ -468,7 +468,6 @@ config_remote() {
 	config_get auth_method "$conf" authentication_method
 	config_get local_identifier "$conf" local_identifier ""
 	config_get remote_identifier "$conf" remote_identifier ""
-	config_get local_ip "$conf" local_ip "%any"
 	config_get keyingtries "$conf" keyingtries "3"
 	config_get dpddelay "$conf" dpddelay "30s"
 	config_get_bool encap "$conf" encap 0
@@ -485,6 +484,7 @@ config_remote() {
 	config_get_bool send_certreq "$conf" send_certreq 1
 	config_get eap_id "$conf" eap_id "%any"
 
+	config_list_foreach "$conf" local_addrs append_var local_addrs ","
 	config_list_foreach "$conf" remote_addrs append_var remote_addrs ","
 	config_list_foreach "$conf" local_sourceip append_var local_sourceip ","
 	config_list_foreach "$conf" remote_ca_certs append_var remote_ca_certs ","
@@ -536,7 +536,7 @@ config_remote() {
 	swanctl_xappend0 "# config for $conf"
 	swanctl_xappend0 "connections {"
 	swanctl_xappend1 "$conf {"
-	swanctl_xappend2 "local_addrs = $local_ip"
+	[ -n "$local_addrs" ] && swanctl_xappend2 "local_addrs = $local_addrs"
 	[ -n "$remote_addrs" ] && swanctl_xappend2 "remote_addrs = $remote_addrs"
 	[ -n "$local_sourceip" ] && swanctl_xappend2 "vips = $local_sourceip"
 	[ -n "$fragmentation" ] && swanctl_xappend2 "fragmentation = $fragmentation"