strongswan: update init script - #30504
Open
feckert wants to merge 17 commits into
Open
Conversation
OpenWrt ships the plugins in multiple packages that are not all installed by default. When running tools like 'pki' or 'swanctl', this currently produces error-level log output for plugins that are simply not installed, which can alarm users unnecessarily. Enable the new configure option 'plugins-packaged-separately' (default: no), added in strongSwan 6.0.5, which sets it to 'yes'. This lowers the log level of the corresponding messages and adds a note that the missing plugins may be available in other packages. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
…d modes
Migrate the uci section types 'tunnel' and 'transport' in
'/etc/config/ipsec' into a single 'child' section type, distinguished
by a new 'mode' option ('tunnel' or 'transport') for now. Existing 'mode'
values are preserved.
The 'remote' sections keep their type, but their 'list tunnel' and
'list transport' references (which point to the renamed child
sections by name) are merged into a single 'list child'.
Rationale:
* 'tunnel' and 'transport' sections already share the same set of
options (local_subnet, remote_subnet, crypto_proposal, etc.) and
only ever differed by IPsec mode. Modeling that as data (a 'mode'
option) instead of as two separate section types removes
duplicated schema/parsing logic and mirrors how 'swanctl.conf' itself
expresses mode on a single 'children' entry.
* Adding further modes (e.g. 'beet') in the future only requires
extending the allowed values of 'mode', not introducing another
section type and duplicating its option set.
The existing configuration is also migrated to the new uci layout using a
uci-defaults script.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Previously, the debug option for strongswan logging was configured directly in the globals section of the ipsec. So every subsystem does have the same log level. To improve modularity and maintainability, this change relocates the debug configuration to a dedicated named 'ipsec plugin' section 'syslog'. Rationale: * Clearer separation of concerns (logging vs. core srongswan settings) * Better alignment with strongswan plugin-based architecture Key improvements: * Enables separate log level configuration for individual strongswan subsystems (dmn, mgr, job ... ), allowing finer control over debug verbosity. * Split logging facilities into 'daemon' and 'auth' for more granular log filtering and debugging. The subsystems ike, chd, enc and esp moved to the 'auth' faciltiy all other subsystems are moved to the daemon facility. * The default logging level for the 'auth' and 'daemon' facility is set to '-1', which means ‘absolutely silent’. The existing configuration is also migrated to the new uci layout using a uci-defaults script. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
This introduces the 'use_custom_proposal' flag, allowing users to manually define their own IKE/IPsec proposals in 'custom_proposal' instead of relying on uci config options 'encryption_alorithm', 'hash_alorithm', 'dh_group' and for ike also on 'prf_algorithem'. This is particularly useful for: * Advanced users who need specific algorithm combinations * Compatibility with non-standard or legacy peers * Fine-tuning security parameters for specialized use cases Note: Enabling this option requires careful configuration, as incorrect proposals may break compatibility or cause connection failures. Upgrades with custom proposals are not officially supported. Since we don't know what the user has configured. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The swanctl only supports clear(default),trap and restart, with no equivalent for the legacy 'none' value. Don't migrate 'none' configs automatically, since silently mapping it to another value would change behavior. They must be reconfigured manually. The upgrade script is reenameing the uci option 'dpdaction' to 'dpd_action' to match the 'swanctl.conf' '<child>.dpd_action' key. Only the following values will be remapped: * hold -> trap * restart -> start This was previously done in the swanctl init script. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'closeaction' to 'close_action' via upgrade script to match the 'swanctl.conf' '<child>.close_action' key. Unlike 'dpd_action', 'close_action' has a direct 'none' equivalent, so all legacy values are migrated: * clear -> none * hold -> trap * restart -> start * none -> none Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'startaction' to 'start_action' via upgrade script to match the 'swanctl.conf' '<child>.start_action' key. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeytime' to 'rekey_time' in child via upgrade script to match the 'swanctl.conf' '<child>.rekey_time' key. The migration function 'migrate_option' in 'uci-defaults' is designed to be generic, since 'rekeytime' is not the only option that does not conform to the swanctl naming scheme and should also be migrated. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifetime' to 'life_time' in child via upgrade script to match the 'swanctl.conf' '<child>.life_time' key. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeybytes' to 'rekey_bytes' in child via upgrade script to match the 'swanctl.conf' '<child>.rekey_bytes' key. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifebytes' to 'life_bytes' in child via upgrade script to match the 'swanctl.conf' '<child>.life_bytes' key. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeypackets' to 'rekey_packets' in child via upgrade script to match the 'swanctl.conf' '<child>.rekey_packets' key. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'lifepackets' to 'life_packets' in child via upgrade script to match the 'swanctl.conf' '<child>.life_packets' key. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'rekeytime' to 'rekey_time' in remote via upgrade script to match the 'swanctl.conf' '<conn>.rekey_time' key. The new migration function 'migrate_option_remote_values' in 'uci-defaults' is designed to be generic, since 'rekeytime' is not the only option that does not conform to the swanctl naming scheme for conn and should also be migrated. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'overtime' to 'over_times' in child via upgrade script to match the 'swanctl.conf' '<con>.over_time' key. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename uci option 'dpddelay' to 'dpd_delay' in remote via upgrade script to match the 'swanctl.conf' '<conn>.dpd_delay' key. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Update PKG_RELEASE to '8'. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
openwrt-ai
reviewed
Sep 11, 2026
openwrt-ai
left a comment
openwrt-ai
left a comment
Collaborator
There was a problem hiding this comment.
Commit checks
4a991b3"strongswan: enable plugins-packaged-separately option" — message names the optionplugins-packaged-separately, the diff passes--with-plugins-packaged-seperately.77e250d"strongswan: migrate legacy dpdaction option to dpd_action" — body says swanctl supportsrestart, but the script mapsrestart→startand the new init-scriptcaserejectsrestart. Pick one and make message and code agree.25e7209"strongswan: rename overtime to over_time in remote" — body says "rename 'overtime' to 'over_times' in child"; should beover_time, inremote, and<conn>.over_time(not<con>).3d8b59b"strongswan: rename rekeytime to rekey_time in child" — body names the new helpermigrate_option; the function actually added ismigrate_option_child_values.1280cbc/d27bfd3— subjects read "... to rekey_bytes child" / "... to rekey_packets child", missing the "in" their sibling commits use.
Generated by Claude Code
| --enable-mgf1 \ | ||
| --enable-mediation \ | ||
| --with-systemdsystemunitdir=no \ | ||
| --with-plugins-packaged-seperately=yes \ |
Collaborator
There was a problem hiding this comment.
Typo: the strongSwan option is plugins-packaged-separately (ARG_WITH_SET([plugins-packaged-separately], [no], ...) in configure.ac). Autoconf silently ignores unrecognized --with-* arguments, so as spelled the feature is never enabled.
Suggested change
| --with-plugins-packaged-seperately=yes \ | |
| --with-plugins-packaged-separately=yes \ |
Generated by Claude Code
|
|
||
| config_get startaction "$conf" startaction "route" | ||
| config_get mode "$conf" mode | ||
| config_get start_action "$conf" start_action "route" |
Collaborator
There was a problem hiding this comment.
The default route is no longer accepted by the case below (none|trap|start), so every child section without an explicit start_action now hits fatal and fails config generation — including all sections migrated by migrate_start_action_value, which returns early when startaction was unset. The swanctl equivalent of the old route default is trap.
Suggested change
| config_get start_action "$conf" start_action "route" | |
| config_get start_action "$conf" start_action "trap" |
Generated by Claude Code
| config_get dpdaction "$conf" dpdaction "none" | ||
| config_get closeaction "$conf" closeaction "none" | ||
| config_get life_time "$conf" life_time "" | ||
| config_get dpd_action "$conf" dpd_action "clear" |
Collaborator
There was a problem hiding this comment.
The previous default dpdaction=none forced dpddelay="0s" onto the enclosing conn, i.e. DPD was off unless explicitly configured. Defaulting to clear turns DPD on with the 30s dpd_delay default for every existing config that never set dpdaction, and migrate_dpd_action_value drops a stored none without substituting anything. Is the flipped default intentional?
Generated by Claude Code
| config_charon_plugin_syslog() { | ||
| # daemon syslog facility | ||
| local dmn mgr job cfg knl net asn lib tls tnc imc imv pts app wch | ||
| config_get dmn "syslog" dmn "1" |
Collaborator
There was a problem hiding this comment.
Every subsystem falls back to 1, so the default = -1 emitted below is always overridden and the commit message's "absolutely silent" default never applies; it also raises verbosity over the old default = 0 fallback on a stock config, since ipsec.config ships no syslog section. Same on lines 655-675 and in migrate_debug (uci-defaults/strongswan:203), whose config_get debug "globals" debug "1" also makes the [ -z "$debug" ] && return guard dead. Should these default to -1?
Generated by Claude Code
Comment on lines
+165
to
+166
| cfg="$1" | ||
| mode="$2" |
Collaborator
There was a problem hiding this comment.
nit: missing local, unlike every other helper in this file; these leak into the enclosing shell.
Suggested change
| cfg="$1" | |
| mode="$2" | |
| local cfg="$1" | |
| local mode="$2" |
Generated by Claude Code
| # is no longer available in the new 'dpd_action'. It should be | ||
| # converted to 'dpd_delay=0' to restore the old behavior. | ||
| # However, this is not supported by the upgrade script. | ||
| uci -q delete ipsec.${cfg}.dpdaction |
Collaborator
There was a problem hiding this comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📦 Package Details
Maintainer: @pprindeville ?
Summary:
<child>.rekey_time<child>.life_time<child>.rekey_bytes<child>.life_bytes<child>.rekey_packets<child>.life_packets<child>.start_action<child>.close_action<child>.dpd_action<conn>.rekey_time<conn>.over_time<conn>.dpd_delayUnified child sections: tunnel/transport section types merged into a single child type distinguished by a new mode option; remote
list tunnelandlist transportreferences merged intolist child. Future modes (e.g. beet) only require extending allowed mode values.custom_proposal option: new
use_custom_proposalflag andcustom_proposalvalue to define raw IKE/IPsec proposals instead of the individual encryption/hash/dh_group/prf options.Separate syslog plugin section:
globalsdebug option moved to a dedicated ipsec pluginsyslogsection, enabling per-subsystem log levels and split into daemon/auth logging facilities (default -1, silent).plugins-packaged-separately: enable the strongSwan 6.0.5 configure option so missing optional plugins only emit a note instead of error-level output when building/running pki or swanctl.
🧪 Run Testing Details
✅ Formalities