From: Florian Eckert <redacted>
Date: Tue, 4 Aug 2026 11:47:33 +0000 (+0200)
Subject: strongswan: swanctl.init: remove invalid privkeys option
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=5c6578a8b37a68263aafa600a9d193d9ac8f27cc;p=openwrt-packages.git

strongswan: swanctl.init: remove invalid privkeys option

The 'swanctl.conf' has no 'privkeys' option in
'connections.<conn>.local<suffix>'. The only local-round keys documented
for authentication are 'certs', 'cert<suffix>' and 'pubkeys'. Strongswan
does not let a connection reference a private key by name at all - swanctl
auto-selects the matching private key from '/etc/swanctl/private'
(or rsa/ecdsa/pkcs8) by comparing it against the certificate configured
via 'certs' when credentials are loaded.

Writing 'privkeys = $local_key' into the generated swanctl.conf is
therefore a no-op at best: the option is unknown to the parser and
gets silently dropped, so it never had any effect on which key was
used.

Drop the bogus assignment. The existing local_key validation making
sure the referenced file exists under '/etc/swanctl/private'. Since that's
still useful to catch misconfiguration early, and add a comment explaining
why nothing is written to swanctl.conf for it.

Signed-off-by: Florian Eckert <redacted>
---

diff --git a/net/strongswan/Makefile b/net/strongswan/Makefile
index a40d2decb..9b970ff97 100644
--- a/net/strongswan/Makefile
+++ b/net/strongswan/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=strongswan
 PKG_VERSION:=6.0.7
-PKG_RELEASE:=5
+PKG_RELEASE:=6
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://download.strongswan.org/ https://download2.strongswan.org/
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index a7b1e11d8..53d3100b8 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -505,6 +505,10 @@ config_remote() {
 	esac
 
 
+	# swanctl.conf has no "privkeys" option in connections.<conn>.local<suffix>;
+	# strongSwan auto-selects the private key from /etc/swanctl/private by
+	# matching it against the certificate configured via "certs". We only
+	# need to make sure the referenced key file actually exists there.
 	if [ -n "$local_key" ]; then
 		[ "$(dirname "$local_key")" != "." ] && \
 			fatal "local_key $local_key can't be pathname"
@@ -553,8 +557,6 @@ config_remote() {
 	[ -n "$local_identifier" ] && swanctl_xappend3 "id = \"$local_identifier\""
 	[ "$local_auth_method" = pubkey ] && [ -n "$local_cert" ] && \
 		swanctl_xappend3 "certs = $local_cert"
-	[ "$local_auth_method" = pubkey ] && [ -n "$local_key" ] && \
-		swanctl_xappend3 "privkeys = $local_key"
 	swanctl_xappend2 "}"
 
 	swanctl_xappend2 "remote {"