From: Florian Eckert <redacted>
Date: Thu, 2 Jul 2026 06:28:58 +0000 (+0200)
Subject: strongswan: add one default named ipsec uci section 'globals'
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=e77b22fb2af71552342883f6a1ae4b970cb4c05c;p=openwrt-packages.git

strongswan: add one default named ipsec uci section 'globals'

The UCI section 'ipsec' should only be available once, as these are
general settings for 'strongswan.conf'. It makes no sense to configure them
more than once. To ensure that the general settings can also be configured
via LuCI, this section must be present at least once.

For configurations already in the field, a uci-default script is added
that assigns the name 'globals' to the last ipsec section type.

Signed-off-by: Florian Eckert <redacted>
---

diff --git a/net/strongswan/Makefile b/net/strongswan/Makefile
index ee5d013a9..d9095506f 100644
--- a/net/strongswan/Makefile
+++ b/net/strongswan/Makefile
@@ -566,6 +566,11 @@ define Package/strongswan-swanctl/install
 	$(INSTALL_BIN) ./files/swanctl.init $(1)/etc/init.d/swanctl
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_CONF) ./files/ipsec.config $(1)/etc/config/ipsec
+
+	# Install migration from 'ipsec@ipsec[-1]' to 'ipsec.globals'
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_DATA) ./files/etc/uci-defaults/strongswan \
+		$(1)/etc/uci-defaults/strongswan
 endef
 
 define Package/strongswan-gencerts/install
diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
new file mode 100644
index 000000000..b11bd69da
--- /dev/null
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+main() {
+	# Skip migration if the 'globals' section already exists
+	uci show ipsec.globals 1>/dev/null 2>/dev/null
+	[ "$?" = "0" ] && return
+
+	# Rename last ipsec section to 'globals'
+	uci -q rename ipsec.@ipsec[-1]=globals
+	uci -q commit ipsec
+}
+
+main
+
+exit 0
diff --git a/net/strongswan/files/ipsec.config b/net/strongswan/files/ipsec.config
index 4e976063f..f4d1baa40 100644
--- a/net/strongswan/files/ipsec.config
+++ b/net/strongswan/files/ipsec.config
@@ -1,2 +1,7 @@
 # For strongSwan ipsec config documentation see
 # https://openwrt.org/docs/guide-user/services/vpn/strongswan/start
+
+# This is the 'globals' config section for the 'strongswan.conf' file.
+# For LuCI the section type ipsec should only appear once. It must therefore
+# always be present and should not be added or removed manually.
+config ipsec 'globals'