Conversation
openwrt
Bot
added
the
not following guidelines
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 11, 2026 12:36
28c9563 to
2459a3d
Compare
openwrt
Bot
removed
the
not following guidelines
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 14, 2026 06:36
2459a3d to
6e4a245
Compare
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 14, 2026 10:13
6e4a245 to
14528e1
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 15, 2026 07:40
14528e1 to
ddc7813
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
The function parameters are incorrect. The second argument is the type of the section. It is not 'ipsec' but 'globals'. While we're at it, the section has been expanded with a general help text. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
…child This change aligns LuCI ipsec strongswan configuration with the current swanctl initscript implementation by migrating the section type 'tunnel' and 'transport to section type 'child'. To allow the mode used by the ‘child’ to be specified, the new ucioption ‘mode’ has also been added for the uci section type ‘child’. Currently, only the ‘transport’ and 'tunnel' modes are supported. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add the 'syslog' option to bring the LuCI configuration model back in sync with 'swanctl.init', which already supports configuring syslog output. Remove the 'debug' option from the 'globals' section, as it no longer has any effect and is not evaluated by 'swanctl.init' anymore. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
…ation This commit adds a new checkbox and input field in the LuCI interface, allowing users to enable and define a custom IKE/IPsec proposal. - Added a toggle for `custom_proposal` in the 'crypto_proposal' section. - Added a text input field for the proposal string (visible only when enabled) - Included a warning in the help text about potential risks and lack of upgrade support This enables advanced users to manually configure proposals directly from the LuCI web interface, improving flexibility for specialized setups. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Update form field to match the renamed 'dpd_action' uci option. Remove the 'none' choice from the dropdown, since it has no swanctl equivalent and is no longer accepted by the backend. If nothing is specified, 'clear' is used by default in strongswan. Therefore, this is not included in the configuration. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Update form field to match the renamed 'close_action' uci option. An empty field now defaults to 'none', matching the 'swanctl.conf'. An empty value is also not stored in the uci. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Update form field to match the renamed 'start_action' uci option. An empty field now defaults to 'none', matching the 'swanctl.conf'. An empty value is also not stored in the uci. While we are at it also make this vaule optional. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 18, 2026 13:16
ddc7813 to
0813871
Compare
openwrt
Bot
added
the
not following guidelines
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 18, 2026 13:21
0813871 to
c5e8de3
Compare
Rename the 'rekeytime' option to 'rekey_time' in the uci section type 'child' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'lifetime' option to 'life_time' in the uci section type 'child' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'rekeybytes' option to 'rekey_bytes' in the uci section type 'child' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'lifebytes' option to 'life_bytes' in the uci section type 'child' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
…child Rename the 'rekeypackets' option to 'rekey_packets' in the uci section type 'child' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'lifepackets' option to 'life_packets' in the uci section type 'child' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'rekeytime' option to 'rekey_time' in the uci section type 'remote' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'overtime' option to 'over_time' in the uci section type 'remote' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the 'dpddelay' option to 'dpd_delay' in the uci section type 'remote' to follow the naming convention and improve consistency with 'swanctl.conf' terminology. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 18, 2026 13:45
c5e8de3 to
8552828
Compare
openwrt
Bot
removed
the
not following guidelines
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Contributor
|
Looks like those eslint errors can be disregarded. |
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 21, 2026 08:24
8552828 to
b9b9330
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Add a new uci shunt section type for pass | drop policies, independent of remote connections. The uci support for this feature has already been added to the strongswan package, this change adds the matching configuration to LuCI. New supported options: * mode (pass/drop) * local_ts * remote_ts * priority * interface This change also include shunt sections in the section name uniqueness check. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add support for the 'kernel-netlink' plugin option 'install_routes_xfrmi' to 'luci-app-strongswan-swanctl'. When enabled, charon installs routes for all XFRM interfaces based on the traffic selectors of installed IPsec SAs, which is required for route-based VPN setups using XFRM interfaces. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The 'swanctl.conf' does not impose any length restriction on connection and children (section) names. They are plain strings parsed by strongswan config parser without a fixed-size buffer. Likewise, uci does not enforce a maximum length for named sections. libuci's uci_validate_str() only restricts the allowed character set (alphanumeric and underscore, for shell compatibility) and allocates section names dynamically via strdup(), so there is no built-in buffer size that would truncate or reject longer names. The previous 15-character cap therefore had no basis in either 'swanctl.conf' or uci itself and can be dropped without risking truncation, parsing errors, or incompatibility. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
This updates luci-app-strongswan-swanctl to use the '/etc/config/swanctl' configuration instead of the legacy ipsec configuration. The change is required to align with the '/etc/init.d/swanctl' script. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The strongswan-swanctl view now checks on load whether a legacy ipsec configuration exists in '/etc/config/ipsec'. If the file is present, a blocking overlay is shown on the connection page which offers to run the command '/etc/init.d/swanctl migrate'. While the migration is pending, the page action footer (Save & Apply, Apply and Revert buttons) is disabled and the main content area is not clickable, so that no changes can be made to the empty swanctl configuration before the migration has finished. A successful migration reloads the page, while a failed migration is reported with the option to retry. To allow the view to detect the legacy configuration and trigger the migration, the rpc ACLs are extended with a list permission on '/etc/config/ipsec' and the exec permission for the migration command. Signed-off-by: Florian Eckert <fe@dev.tdt.de>
feckert
force-pushed
the
pr/20260911-luci-app-strongswan-swanctl
branch
from
September 22, 2026 09:02
b9b9330 to
d5d9a4e
Compare
openwrt-ai
reviewed
Sep 22, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This set of changes modernizes the luci-app-strongswan-swanctl configuration interface to match the current openwrt swanctl.init script (Depends on openwrt/packages#30504). It includes section restructuring, feature additions, and systematic option renaming for consistency.
Structural Changes:
Fix globals NamedSection arguments (strongswan.js). Fix the section type from
ipsectoglobalsand added a help text description.Migrate tunnel/transport sections to child (swanctl.js). Unified the two separate uci section types into a single child type with a new mode option (tunnel/transport). Updated all references in the remote configuration dropdown and name collision validation accordingly.
Rename dpdaction -> dpd_action -- Removed the none choice (not accepted by swanctl backend). Empty/default now maps to clear.
Rename closeaction -> close_action -- Empty value defaults to none and is not stored in uci (default).
Rename startaction -> start_action -- Empty value defaults to none and is not stored in uci (default) and make this optional.
All renamed to match swanctl.conf underscore convention:
uci option rename (child section):
uci option rename (remote section):
Feature Addition
Sync debug option with swanctl init (strongswan.js), Replaced the single numeric debug level field with a full Syslog Settings section exposing per-subsystem debug levels (app, asn, cfg, chd, dmn, enc, esp, ike, imc, imv, job, wch, knl, lib, mgr, net, pts, tls, tnc).
Add custom_proposal support (swanctl.js). New
use_custom_proposaltoggle andcustom_proposaltext input in the crypto_proposal section. Standard algorithm dropdowns are hidden when the custom mode is enabled. Experienced users can then submit their own proposals without having to create a separate uci section for each one.Maintainer (preferred)
me ?