From: Florian Eckert <redacted>
Date: Thu, 23 Jul 2026 11:02:19 +0000 (+0200)
Subject: strongswan: migration and merge local_nat into local_subnet
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=9cea816088af618c372512847d7055eba7e71210;p=openwrt-packages.git

strongswan: migration and merge local_nat into local_subnet

The UCI option 'local_nat' was a misleading legacy name for the
option that actually specifies the local traffic selector(s) used
by strongSwan/swanctl for a connection, i.e. the local subnet(s)
matched by the IPsec SA. It has nothing to do with NAT-T or NAT
detection, and the name repeatedly caused confusion when writing
or reviewing configs.

Merge it to 'local_subnet' to match its actual purpose and to
align with the naming already used for the corresponding
'local_subnet' option and with swanctl.conf's own 'local_ts/remote_ts'
terminology.

Add a uci-defaults migration script so existing installations are
upgraded automatically. It reads any existing 'local_nat' values
(whether stored as a plain option or as a list) and rewrites them
as a 'local_subnet' list.

Signed-off-by: Florian Eckert <redacted>
---

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index b2e2d6f9a..e83669be7 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -26,9 +26,36 @@ migrate_ignore_routing_tables() {
 	uci commit ipsec
 }
 
+migrate_local_nat_child() {
+	local cfg="$1"
+
+	local local_nat value
+
+	config_get local_nat "$cfg" local_nat ""
+	[ -z "$local_nat" ] && return
+
+	uci -q delete "ipsec.${cfg}.local_nat"
+
+	# Replace 'local_subnet' with 'local_nat' and do not append.
+	# That's how it was previously done in the swanctl start script.
+	uci -q delete "ipsec.${cfg}.local_subnet"
+
+	for value in $local_nat; do
+		uci add_list "ipsec.${cfg}.local_subnet=${value}"
+	done
+}
+
+migrate_local_nat() {
+	config_load ipsec
+	config_foreach migrate_local_nat_child tunnel
+	config_foreach migrate_local_nat_child transport
+	uci commit ipsec
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
+	migrate_local_nat
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index bca799103..3aa63a645 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -226,7 +226,6 @@ config_child() {
 	local mode="$2"
 
 	local startaction
-	local local_nat
 	local updown
 	local firewall
 	local lifetime
@@ -247,7 +246,6 @@ config_child() {
 	local remote_subnet
 
 	config_get startaction "$conf" startaction "route"
-	config_get local_nat "$conf" local_nat ""
 	config_get updown "$conf" updown ""
 	config_get firewall "$conf" firewall ""
 	config_get lifetime "$conf" lifetime ""
@@ -333,8 +331,6 @@ config_child() {
 		;;
 	esac
 
-	[ -n "$local_nat" ] && local_subnet="$local_nat"
-
 	swanctl_xappend3 "$conf {"
 
 	[ -n "$local_subnet" ] && swanctl_xappend4 "local_ts = $local_subnet"