From: Florian Eckert <redacted>
Date: Thu, 23 Jul 2026 13:30:23 +0000 (+0200)
Subject: strongswan: rename 'remote_gateway' to 'remote_addrs'
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=b0c5835445ff3cf471179f2bf4df1e6ab1ce8932;p=openwrt-packages.git

strongswan: rename 'remote_gateway' to 'remote_addrs'

Rename the 'remote_gateway' UCI option to 'remote_addrs' to match
the 'swanctl.conf' 'remote_addrs' directive, which accepts one or
more peer addresses rather than a single gateway. The previous
name implied a single value and did not reflect that multiple
remote addresses can be configured for a connection.

Store the option as a UCI list to allow specifying multiple
remote addresses, consistent with how 'local_subnet' and
'remote_subnet' are already handled.

Add a uci-defaults migration script to convert existing
'remote_gateway' entries (whether stored as a plain option or as
a list) to a 'remote_addrs' list on upgrade.

If the 'remote_addrs' option is empty, strongswan implicitly uses the value
'%any'. In the `swanctl.conf` documentation, '%any' is already the default
value for 'remote_addrs' if the directive is not specified at all.

Signed-off-by: Florian Eckert <redacted>
---

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 44adcf906..625ca8fd9 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -75,11 +75,33 @@ migrate_gateway() {
 	config_foreach migrate_gateway_remote remote
 }
 
+migrate_remote_gateway_remote() {
+	local cfg="$1"
+
+	local remote_gateway value
+
+	config_get remote_gateway "$cfg" remote_gateway ""
+	[ -z "$remote_gateway" ] && return
+
+	for value in $remote_gateway; do
+		uci add_list "ipsec.${cfg}.remote_addrs=${value}"
+	done
+
+	uci -q delete "ipsec.${cfg}.remote_gateway"
+	uci commit ipsec
+}
+
+migrate_remote_gateway() {
+	config_load ipsec
+	config_foreach migrate_remote_gateway_remote remote
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
 	migrate_local_nat
 	migrate_gateway
+	migrate_remote_gateway
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 5a67eca8e..4ffbea575 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -436,7 +436,6 @@ config_remote() {
 	local conf="$1"
 
 	local enabled
-	local remote_gateway
 	local pre_shared_key
 	local auth_method
 	local local_identifier
@@ -457,6 +456,7 @@ config_remote() {
 	local send_cert
 	local send_certreq
 	local eap_id
+	local remote_addrs
 	local local_sourceip
 	local remote_ca_certs
 	local pools
@@ -464,7 +464,6 @@ config_remote() {
 	config_get_bool enabled "$conf" enabled 0
 	[ $enabled -eq 0 ] && return
 
-	config_get remote_gateway "$conf" remote_gateway '%any'
 	config_get pre_shared_key "$conf" pre_shared_key
 	config_get auth_method "$conf" authentication_method
 	config_get local_identifier "$conf" local_identifier ""
@@ -486,6 +485,7 @@ config_remote() {
 	config_get_bool send_certreq "$conf" send_certreq 1
 	config_get eap_id "$conf" eap_id "%any"
 
+	config_list_foreach "$conf" remote_addrs append_var remote_addrs ","
 	config_list_foreach "$conf" local_sourceip append_var local_sourceip ","
 	config_list_foreach "$conf" remote_ca_certs append_var remote_ca_certs ","
 	config_list_foreach "$conf" pools append_var pools ","
@@ -537,8 +537,7 @@ config_remote() {
 	swanctl_xappend0 "connections {"
 	swanctl_xappend1 "$conf {"
 	swanctl_xappend2 "local_addrs = $local_ip"
-	swanctl_xappend2 "remote_addrs = $remote_gateway"
-
+	[ -n "$remote_addrs" ] && swanctl_xappend2 "remote_addrs = $remote_addrs"
 	[ -n "$local_sourceip" ] && swanctl_xappend2 "vips = $local_sourceip"
 	[ -n "$fragmentation" ] && swanctl_xappend2 "fragmentation = $fragmentation"
 	[ -n "$pools" ] && swanctl_xappend2 "pools = $pools"