From: Florian Eckert <redacted>
Date: Thu, 23 Jul 2026 12:25:53 +0000 (+0200)
Subject: strongswan: rename 'gateway' to 'remote_gateway'
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=d43fa0cbd49796ecc53fd7f606ba3bf84dc39164;p=openwrt-packages.git

strongswan: rename 'gateway' to 'remote_gateway'

The UCI option 'gateway' in the ipsec config (consumed by
/etc/init.d/swanctl) is ambiguous. It is not clear from the name
alone whether it refers to the local or the remote IKE/IPsec
peer address, which has repeatedly led to misconfiguration.

Rename it to "remote_gateway" to make the direction explicit and
to match the existing "remote_subnet" naming. If the option is
unset, the init script now falls back to the strongSwan default
of '%any', so connections that accept any remote peer no longer
require an explicit placeholder value.

Add a uci-defaults migration script to rename existing 'gateway'
entries to 'remote_gateway' and remove the value 'any' on upgrade. This
is new default if 'remote_gateway' is not set.

Signed-off-by: Florian Eckert <redacted>
---

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index e83669be7..44adcf906 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -52,10 +52,34 @@ migrate_local_nat() {
 	uci commit ipsec
 }
 
+migrate_gateway_remote() {
+	local cfg="$1"
+
+	local gateway
+
+	config_get gateway "$cfg" gateway ""
+	[ -z "$gateway" ] && return
+
+	# The option 'any' is default for the 'remote_gateway' option if not set
+	# and does not need to be saved.
+	[ "$gateway" = "any" ] || {
+		uci -q set "ipsec.${cfg}.remote_gateway=${gateway}"
+	}
+
+	uci -q delete "ipsec.${cfg}.gateway"
+	uci commit ipsec
+}
+
+migrate_gateway() {
+	config_load ipsec
+	config_foreach migrate_gateway_remote remote
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
 	migrate_local_nat
+	migrate_gateway
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 3aa63a645..5a67eca8e 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -436,7 +436,7 @@ config_remote() {
 	local conf="$1"
 
 	local enabled
-	local gateway
+	local remote_gateway
 	local pre_shared_key
 	local auth_method
 	local local_identifier
@@ -464,7 +464,7 @@ config_remote() {
 	config_get_bool enabled "$conf" enabled 0
 	[ $enabled -eq 0 ] && return
 
-	config_get gateway "$conf" gateway
+	config_get remote_gateway "$conf" remote_gateway '%any'
 	config_get pre_shared_key "$conf" pre_shared_key
 	config_get auth_method "$conf" authentication_method
 	config_get local_identifier "$conf" local_identifier ""
@@ -504,8 +504,6 @@ config_remote() {
 		;;
 	esac
 
-	local remote_gateway
-	[ "$gateway" = "any" ] && remote_gateway="%any" || remote_gateway="$gateway"
 
 	if [ -n "$local_key" ]; then
 		[ "$(dirname "$local_key")" != "." ] && \