From b62d06381a7b21b39362100fb7a091cd0749306f Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 12 Jun 2026 16:55:03 +0200
Subject: [PATCH 01/25] strongswan: enable plugins-packaged-separately option

OpenWrt ships the plugins in multiple packages that are not all
installed by default. When running tools like 'pki' or 'swanctl',
this currently produces error-level log output for plugins that
are simply not installed, which can alarm users unnecessarily.

Enable the new configure option 'plugins-packaged-separately'
(default: no), added in strongSwan 6.0.5, which sets it to 'yes'.
This lowers the log level of the corresponding messages and adds
a note that the missing plugins may be available in other
packages.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/Makefile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/strongswan/Makefile b/net/strongswan/Makefile
index 43ba6c7775481c..951b51a905e982 100644
--- a/net/strongswan/Makefile
+++ b/net/strongswan/Makefile
@@ -450,6 +450,7 @@ CONFIGURE_ARGS+= \
 	--enable-mgf1 \
 	--enable-mediation \
 	--with-systemdsystemunitdir=no \
+	--with-plugins-packaged-separately=yes \
 	PYTHON="python3" \
 	$(if $(CONFIG_PACKAGE_strongswan-charon-cmd),--enable-cmd,--disable-cmd) \
 	$(if $(CONFIG_PACKAGE_strongswan-mod-gmpdh),--enable-gmpdh,) \

From e638332e8374cc4d8b36c4238188c2efc5150652 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Tue, 8 Sep 2026 13:17:51 +0200
Subject: [PATCH 02/25] strongswan: unify tunnel/transport child sections to
 add further child modes

Migrate the uci section types 'tunnel' and 'transport' in
'/etc/config/ipsec' into a single 'child' section type, distinguished
by a new 'mode' option ('tunnel' or 'transport') for now. Existing 'mode'
values are preserved.

The 'remote' sections keep their type, but their 'list tunnel' and
'list transport' references (which point to the renamed child
sections by name) are merged into a single 'list child'.

Rationale:
* 'tunnel' and 'transport' sections already share the same set of
  options (local_subnet, remote_subnet, crypto_proposal, etc.) and
  only ever differed by IPsec mode. Modeling that as data (a 'mode'
  option) instead of as two separate section types removes
  duplicated schema/parsing logic and mirrors how 'swanctl.conf' itself
  expresses mode on a single 'children' entry.
* Adding further modes (e.g. 'beet') in the future only requires
  extending the allowed values of 'mode', not introducing another
  section type and duplicating its option set.

The existing configuration is also migrated to the new uci layout using a
uci-defaults script.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 58 +++++++++++++++++++
 net/strongswan/files/swanctl.init             | 24 ++++----
 2 files changed, 69 insertions(+), 13 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 894806daee3deb..bfe4df543155f5 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -139,6 +139,63 @@ migrate_local_sourceip() {
 	config_foreach migrate_local_sourceip_vips remote
 }
 
+migrate_to_child() {
+	local tunnel_sections=""
+	local transport_sections=""
+	local remote_sections=""
+
+	local section
+
+	collect_tunnel() {
+		tunnel_sections="${tunnel_sections} $1"
+	}
+	collect_transport() {
+		transport_sections="${transport_sections} $1"
+	}
+	collect_remote() {
+		remote_sections="${remote_sections} $1"
+	}
+
+	config_load "ipsec"
+	config_foreach collect_tunnel "tunnel"
+	config_foreach collect_transport "transport"
+	config_foreach collect_remote "remote"
+
+	migrate_simple() {
+		local cfg="$1"
+		local mode="$2"
+
+		uci set ipsec.${cfg}=child
+		uci -q set ipsec.${cfg}.mode="$mode"
+	}
+
+	for section in $tunnel_sections; do
+		migrate_simple "$section" "tunnel"
+	done
+
+	for section in $transport_sections; do
+		migrate_simple "$section" "transport"
+	done
+
+	for section in $remote_sections; do
+		local tunnel_refs=""
+		local transport_refs=""
+
+		config_get tunnel_refs "$section" tunnel ""
+		config_get transport_refs "$section" transport ""
+
+		if [ -n "$tunnel_refs" ] || [ -n "$transport_refs" ]; then
+			uci -q delete ipsec.${section}.tunnel
+			uci -q delete ipsec.${section}.transport
+			for ref in $tunnel_refs $transport_refs; do
+				uci add_list ipsec.${section}.child="$ref"
+			done
+		fi
+	done
+
+	uci commit ipsec
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -147,6 +204,7 @@ main() {
 	migrate_remote_gateway
 	migrate_local_ip
 	migrate_local_sourceip
+	migrate_to_child
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 53d3100b8001c2..7e6cae21524580 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -221,10 +221,9 @@ iter_ike_proposal() {
 }
 
 config_child() {
-	# Generic ipsec conn section shared by tunnel and transport
 	local conf="$1"
-	local mode="$2"
 
+	local mode
 	local startaction
 	local updown
 	local firewall
@@ -245,6 +244,7 @@ config_child() {
 	local local_subnet
 	local remote_subnet
 
+	config_get mode "$conf" mode
 	config_get startaction "$conf" startaction "route"
 	config_get updown "$conf" updown ""
 	config_get firewall "$conf" firewall ""
@@ -266,6 +266,14 @@ config_child() {
 	config_list_foreach "$conf" local_subnet append_var local_subnet ","
 	config_list_foreach "$conf" remote_subnet append_var remote_subnet ","
 
+	case "$mode" in
+		tunnel|transport)
+			;;
+		*)
+			fatal "mode value '$mode' invalid"
+		;;
+	esac
+
 	local esp_proposal
 	iter_esp_proposal "$conf" esp_proposal
 
@@ -373,14 +381,6 @@ config_child() {
 	swanctl_xappend3 "}"
 }
 
-config_tunnel() {
-	config_child "$1" "tunnel"
-}
-
-config_transport() {
-	config_child "$1" "transport"
-}
-
 config_pool() {
 	local conf="$1"
 
@@ -570,9 +570,7 @@ config_remote() {
 
 	swanctl_xappend2 "children {"
 
-	config_list_foreach "$conf" tunnel config_tunnel
-
-	config_list_foreach "$conf" transport config_transport
+	config_list_foreach "$conf" child config_child
 
 	swanctl_xappend2 "}"
 

From adfaca92c3d8babbc707249e37662b6432c18c35 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Tue, 8 Sep 2026 14:43:51 +0200
Subject: [PATCH 03/25] strongswan: move globals debug option to dedicated
 syslog plugin section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, the debug option for strongswan logging was configured directly
in the globals section of the ipsec. So every subsystem does have the same
log level. To improve modularity and maintainability, this change relocates
the debug configuration to a dedicated named 'ipsec plugin' section 'syslog'.

Rationale:
* Clearer separation of concerns (logging vs. core srongswan settings)
* Better alignment with strongswan plugin-based architecture

Key improvements:
* Enables separate log level configuration for individual strongswan
  subsystems  (dmn, mgr, job ... ), allowing finer control over debug
  verbosity.
* Split logging facilities into 'daemon' and 'auth' for more granular
  log filtering and debugging. The subsystems ike, chd, enc and esp
  moved to the 'auth' faciltiy all other subsystems are moved to the daemon
  facility.
* The default logging level for the 'auth' and 'daemon' facility is set to
  '-1', which means ‘absolutely silent’.

The existing configuration is also migrated to the new uci layout using a
uci-defaults script.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 38 ++++++++++++
 net/strongswan/files/ipsec.config             |  2 +
 net/strongswan/files/swanctl.init             | 59 ++++++++++++++++---
 3 files changed, 91 insertions(+), 8 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index bfe4df543155f5..1e873a60f16b89 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -196,6 +196,43 @@ migrate_to_child() {
 	uci commit ipsec
 }
 
+migrate_debug() {
+	local debug
+
+	config_load "ipsec"
+	config_get debug "globals" debug ""
+
+	[ -z "$debug" ] && return
+
+	# create syslog section if not exist
+	if [ -z "$(uci -q get ipsec.syslog)" ]; then
+		uci -q set ipsec.syslog="syslog"
+	fi
+
+	uci -q set ipsec.syslog.dmn="$debug"
+	uci -q set ipsec.syslog.mgr="$debug"
+	uci -q set ipsec.syslog.job="$debug"
+	uci -q set ipsec.syslog.cfg="$debug"
+	uci -q set ipsec.syslog.knl="$debug"
+	uci -q set ipsec.syslog.net="$debug"
+	uci -q set ipsec.syslog.asn="$debug"
+	uci -q set ipsec.syslog.lib="$debug"
+	uci -q set ipsec.syslog.tls="$debug"
+	uci -q set ipsec.syslog.tnc="$debug"
+	uci -q set ipsec.syslog.imc="$debug"
+	uci -q set ipsec.syslog.imv="$debug"
+	uci -q set ipsec.syslog.pts="$debug"
+	uci -q set ipsec.syslog.app="$debug"
+	uci -q set ipsec.syslog.wch="$debug"
+	uci -q set ipsec.syslog.ike="$debug"
+	uci -q set ipsec.syslog.chd="$debug"
+	uci -q set ipsec.syslog.enc="$debug"
+	uci -q set ipsec.syslog.esp="$debug"
+
+	uci -q delete ipsec.globals.debug
+	uci commit ipsec
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -205,6 +242,7 @@ main() {
 	migrate_local_ip
 	migrate_local_sourceip
 	migrate_to_child
+	migrate_debug
 }
 
 main
diff --git a/net/strongswan/files/ipsec.config b/net/strongswan/files/ipsec.config
index f4d1baa4066918..97b9c0c73b3365 100644
--- a/net/strongswan/files/ipsec.config
+++ b/net/strongswan/files/ipsec.config
@@ -5,3 +5,5 @@
 # For LuCI the section type ipsec should only appear once. It must therefore
 # always be present and should not be added or removed manually.
 config ipsec 'globals'
+
+config syslog 'syslog'
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 7e6cae21524580..80a3efdf0db5af 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -647,17 +647,60 @@ config_remote() {
 	swanctl_xappend0 ""
 }
 
-config_charon_syslog() {
-	local conf="$1"
-	local plugin="$2"
-
-	local debug
+config_charon_plugin_syslog() {
+	# daemon syslog facility
+	local dmn mgr job cfg knl net asn lib tls tnc imc imv pts app wch
+	config_get dmn "syslog" dmn ""
+	config_get mgr "syslog" mgr ""
+	config_get job "syslog" job ""
+	config_get cfg "syslog" cfg ""
+	config_get knl "syslog" knl ""
+	config_get net "syslog" net ""
+	config_get asn "syslog" asn ""
+	config_get lib "syslog" lib ""
+	config_get tls "syslog" tls ""
+	config_get tnc "syslog" tnc ""
+	config_get imc "syslog" imc ""
+	config_get imv "syslog" imv ""
+	config_get pts "syslog" pts ""
+	config_get app "syslog" app ""
+	config_get wch "syslog" wch ""
+
+	# auth syslog facility
+	local ike chd enc esp
+	config_get ike "syslog" ike ""
+	config_get chd "syslog" chd ""
+	config_get enc "syslog" enc ""
+	config_get esp "syslog" esp ""
 
-	config_get debug "$conf" debug 0
 	swan_xappend1 "syslog {"
 	swan_xappend2 "identifier = ipsec"
 	swan_xappend2 "daemon {"
-	swan_xappend3 "default = $debug"
+	swan_xappend3 "default = 0"
+	swan_xappend3 "ike_name = yes"
+	[ "$dmn" = "" ] || swan_xappend3 "dmn = $dmn"
+	[ "$mgr" = "" ] || swan_xappend3 "mgr = $mgr"
+	[ "$job" = "" ] || swan_xappend3 "job = $job"
+	[ "$cfg" = "" ] || swan_xappend3 "cfg = $cfg"
+	[ "$knl" = "" ] || swan_xappend3 "knl = $knl"
+	[ "$net" = "" ] || swan_xappend3 "net = $net"
+	[ "$asn" = "" ] || swan_xappend3 "asn = $asn"
+	[ "$lib" = "" ] || swan_xappend3 "lib = $lib"
+	[ "$tls" = "" ] || swan_xappend3 "tls = $tls"
+	[ "$tnc" = "" ] || swan_xappend3 "tnc = $tnc"
+	[ "$imc" = "" ] || swan_xappend3 "imc = $imc"
+	[ "$imv" = "" ] || swan_xappend3 "imv = $imv"
+	[ "$pts" = "" ] || swan_xappend3 "pts = $pts"
+	[ "$app" = "" ] || swan_xappend3 "app = $app"
+	[ "$wch" = "" ] || swan_xappend3 "wch = $wch"
+	swan_xappend2 "}"
+	swan_xappend2 "auth {"
+	swan_xappend3 "default = 0"
+	swan_xappend3 "ike_name = yes"
+	[ "$ike" = "" ] || swan_xappend3 "ike = $ike"
+	[ "$chd" = "" ] || swan_xappend3 "chd = $chd"
+	[ "$enc" = "" ] || swan_xappend3 "enc = $enc"
+	[ "$esp" = "" ] || swan_xappend3 "esp = $esp"
 	swan_xappend2 "}"
 	swan_xappend1 "}"
 }
@@ -728,7 +771,7 @@ config_strongswan_generate() {
 	config_charon_ignore_routing_tables "$conf"
 	config_charon_interfaces_use "$conf"
 	config_charon_scripts "$conf"
-	config_charon_syslog "$conf" "syslog"
+	config_charon_plugin_syslog
 	swan_xappend0 "}"
 }
 

From 4b746db93ec3e7c085e1c38246fb7f6899029862 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Wed, 9 Sep 2026 12:21:45 +0200
Subject: [PATCH 04/25] strongswan: add support for custom_proposal option

This introduces the 'use_custom_proposal' flag, allowing users to manually
define their own IKE/IPsec proposals in 'custom_proposal' instead of relying
on uci config options 'encryption_alorithm', 'hash_alorithm',
'dh_group' and for ike also on 'prf_algorithem'.

This is particularly useful for:
* Advanced users who need specific algorithm combinations
* Compatibility with non-standard or legacy peers
* Fine-tuning security parameters for specialized use cases

Note: Enabling this option requires careful configuration, as incorrect
proposals may break compatibility or cause connection failures. Upgrades
with custom proposals are not officially supported. Since we don't know
what the user has configured.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 80a3efdf0db5af..dd7390cebab8a1 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -157,10 +157,22 @@ is_aead() {
 config_esp_proposal() {
 	local conf="$1"
 
+	local use_custom_proposal custom_proposal
 	local encryption_algorithm
 	local hash_algorithm
 	local dh_group
 
+	config_get_bool use_custom_proposal "$conf" use_custom_proposal 0
+	[ "$use_custom_proposal" = "1" ] && {
+		config_get custom_proposal "$conf" custom_proposal ""
+		if [ -z "$custom_proposal" ]; then
+			warning "Custom ESP proposal in '$conf' is not defined"
+		else
+			crypto="${crypto:+${crypto},}${custom_proposal}"
+		fi
+		return
+	}
+
 	config_get encryption_algorithm "$conf" encryption_algorithm
 	config_get hash_algorithm "$conf" hash_algorithm
 	config_get dh_group "$conf" dh_group
@@ -189,11 +201,23 @@ iter_esp_proposal() {
 config_ike_proposal() {
 	local conf="$1"
 
+	local use_custom_proposal custom_proposal
 	local encryption_algorithm
 	local hash_algorithm
 	local dh_group
 	local prf_algorithm
 
+	config_get_bool use_custom_proposal "$conf" use_custom_proposal 0
+	[ "$use_custom_proposal" = "1" ] && {
+		config_get custom_proposal "$conf" custom_proposal ""
+		if [ -z "$custom_proposal" ]; then
+			warning "Custom IKE proposal in '$conf' is not defined"
+		else
+			crypto="${crypto:+${crypto},}${custom_proposal}"
+		fi
+		return
+	}
+
 	config_get encryption_algorithm "$conf" encryption_algorithm
 	config_get hash_algorithm "$conf" hash_algorithm
 	config_get dh_group "$conf" dh_group

From f0f4060a2411b7bbb539edb20ad9940ec94542ff Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 10 Sep 2026 11:31:58 +0200
Subject: [PATCH 05/25] strongswan: migrate legacy dpdaction option to
 dpd_action

The swanctl only supports clear(default), trap and restart, with no
equivalent for the legacy 'none' and 'start' value.

The upgrade script is reenameing the uci option 'dpdaction' to 'dpd_action'
to match the 'swanctl.conf' '<child>.dpd_action' key.

The value 'hold' is remapped to 'trap'. This was previously done in
the swanctl init script.

Not setting 'dpd_action' means 'clear'. Therefore, setting 'dpd_action=clear'
(default) and setting 'dpddelay=0' is equivalent to the old 'dpdaction=none'.
This is not automatically upgraded.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 34 +++++++++++++++++++
 net/strongswan/files/swanctl.init             | 25 ++++----------
 2 files changed, 41 insertions(+), 18 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 1e873a60f16b89..e97aee9a5072e4 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -233,6 +233,39 @@ migrate_debug() {
 	uci commit ipsec
 }
 
+migrate_dpd_action_value() {
+	local cfg="$1"
+
+	local dpdaction
+
+	config_get dpdaction "$cfg" dpdaction ""
+	[ -z "$dpdaction" ] && return
+
+	[ "$dpdaction" = "hold" ] && {
+		uci -q set ipsec.${cfg}.dpd_action="trap"
+	}
+
+	[ "$dpdaction" = "restart" ] && {
+		uci -q set ipsec.${cfg}.dpd_action="restart"
+	}
+
+	# * 'none' is the default value for the *old* dpdaction. This value
+	#   is no longer available in the new 'dpd_action'. It should be
+	#   converted to 'dpd_delay=0' and 'dpd_action=clear' to restore the
+	#   old behavior.
+	# * 'clear' is default value if 'dpd_action' is not specified
+	#   This option does not need to be migrated, as it is the default
+	#   for the *new* option.
+
+	uci -q delete ipsec.${cfg}.dpdaction
+	uci commit ipsec
+}
+
+migrate_dpd_action() {
+	config_load ipsec
+	config_foreach migrate_dpd_action_value child
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -243,6 +276,7 @@ main() {
 	migrate_local_sourceip
 	migrate_to_child
 	migrate_debug
+	migrate_dpd_action
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index dd7390cebab8a1..9217ed07283f67 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -252,7 +252,7 @@ config_child() {
 	local updown
 	local firewall
 	local lifetime
-	local dpdaction
+	local dpd_action
 	local closeaction
 	local if_id
 	local rekeytime
@@ -273,7 +273,7 @@ config_child() {
 	config_get updown "$conf" updown ""
 	config_get firewall "$conf" firewall ""
 	config_get lifetime "$conf" lifetime ""
-	config_get dpdaction "$conf" dpdaction "none"
+	config_get dpd_action "$conf" dpd_action "clear"
 	config_get closeaction "$conf" closeaction "none"
 	config_get if_id "$conf" if_id ""
 	config_get rekeytime "$conf" rekeytime ""
@@ -334,23 +334,12 @@ config_child() {
 
 	[ -n "$closeaction" -a "$closeaction" != "none" ] && warning "Closeaction $closeaction can cause instability"
 
-	case "$dpdaction" in
-	none)
-		dpddelay="0s"
-		dpdaction=
-		;;
-	clear)
-		;;
-	hold)
-		dpdaction="trap" ;;
-	restart)
-		dpdaction="restart" ;;
-	trap|start)
-		# already using new syntax
+	case "$dpd_action" in
+	clear|trap|restart)
 		;;
 	*)
-		fatal "Dpdaction $dpdaction unknown"
-		dpdaction=
+		fatal "dpd_action '$dpd_action' unknown"
+		dpd_action=
 		;;
 	esac
 
@@ -399,7 +388,7 @@ config_child() {
 	[ -n "$inactivity" ] && swanctl_xappend4 "inactivity = $inactivity"
 
 	[ -n "$updown" ] && swanctl_xappend4 "updown = $updown"
-	[ -n "$dpdaction" ] && swanctl_xappend4 "dpd_action = $dpdaction"
+	[ -n "$dpd_action" ] && swanctl_xappend4 "dpd_action = $dpd_action"
 	[ -n "$replay_window" ] && swanctl_xappend4 "replay_window = $replay_window"
 
 	swanctl_xappend3 "}"

From 4d0067e9b010736a9ccb511ce3d377cfa22e7ae3 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 10 Sep 2026 12:02:49 +0200
Subject: [PATCH 06/25] strongswan: rename closeaction to close_action

Rename uci option 'closeaction' to 'close_action' via upgrade script to
match the 'swanctl.conf' '<child>.close_action' key.

Unlike 'dpd_action', 'close_action' has a direct 'none' equivalent, so
all legacy values are migrated:
* clear   -> none
* hold    -> trap
* restart -> start
* none    -> none

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 31 +++++++++++++++++++
 net/strongswan/files/swanctl.init             | 26 ++++++----------
 2 files changed, 41 insertions(+), 16 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index e97aee9a5072e4..e459e2b35eb282 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -266,6 +266,36 @@ migrate_dpd_action() {
 	config_foreach migrate_dpd_action_value child
 }
 
+migrate_close_action_value() {
+	local cfg="$1"
+
+	local closeaction
+
+	# Check whether we need to migrate at all.
+	config_get closeaction "$cfg" closeaction ""
+	[ -z "$closeaction" ] && return
+
+	uci -q delete ipsec.${cfg}.closeaction
+	[ "$closeaction" = "none" ] || [ "$closeaction" = "clear" ] && {
+		uci -q set ipsec.${cfg}.close_action="none"
+	}
+
+	[ "$closeaction" = "hold" ] && {
+		uci -q set ipsec.${cfg}.close_action="trap"
+	}
+
+	[ "$closeaction" = "restart" ] && {
+		uci -q set ipsec.${cfg}.close_action="start"
+	}
+
+	uci commit ipsec
+}
+
+migrate_close_action() {
+	config_load ipsec
+	config_foreach migrate_close_action_value child
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -277,6 +307,7 @@ main() {
 	migrate_to_child
 	migrate_debug
 	migrate_dpd_action
+	migrate_close_action
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 9217ed07283f67..e73fafa4f9d65f 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -253,7 +253,7 @@ config_child() {
 	local firewall
 	local lifetime
 	local dpd_action
-	local closeaction
+	local close_action
 	local if_id
 	local rekeytime
 	local ipcomp
@@ -274,7 +274,7 @@ config_child() {
 	config_get firewall "$conf" firewall ""
 	config_get lifetime "$conf" lifetime ""
 	config_get dpd_action "$conf" dpd_action "clear"
-	config_get closeaction "$conf" closeaction "none"
+	config_get close_action "$conf" close_action "none"
 	config_get if_id "$conf" if_id ""
 	config_get rekeytime "$conf" rekeytime ""
 	config_get_bool ipcomp "$conf" ipcomp 0
@@ -316,23 +316,17 @@ config_child() {
 		;;
 	esac
 
-	case "$closeaction" in
-	none|clear)
-		closeaction="none" ;;
-	hold)
-		closeaction="trap" ;;
-	restart)
-		closeaction="start" ;;
-	trap|start)
-		# already using new syntax
+	case "$close_action" in
+	none|trap|start)
 		;;
 	*)
-		fatal "Closeaction $closeaction unknown"
-		closeaction=
+		fatal "close_action '$close_action' unknown"
+		close_action=
 		;;
 	esac
-
-	[ -n "$closeaction" -a "$closeaction" != "none" ] && warning "Closeaction $closeaction can cause instability"
+	[ -n "$close_action" ] && [ "$close_action" != "none" ] && {
+		warning "close_action '$close_action' can cause instability"
+	}
 
 	case "$dpd_action" in
 	clear|trap|restart)
@@ -363,7 +357,7 @@ config_child() {
 	[ -n "$priority" ] && swanctl_xappend4 "priority = $priority"
 	[ -n "$if_id" ] && swanctl_xappend4 "if_id_in = $if_id" "if_id_out = $if_id"
 	[ -n "$startaction" -a "$startaction" != "none" ] && swanctl_xappend4 "start_action = $startaction"
-	[ -n "$closeaction" -a "$closeaction" != "none" ] && swanctl_xappend4 "close_action = $closeaction"
+	[ -n "$close_action" -a "$close_action" != "none" ] && swanctl_xappend4 "close_action = $close_action"
 	swanctl_xappend4 "esp_proposals = $esp_proposal"
 	swanctl_xappend4 "mode = $mode"
 

From 4263ea84c9fcdf415eacf4765e985f0e9efc0a14 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Tue, 15 Sep 2026 09:13:00 +0200
Subject: [PATCH 07/25] strongswan: rename startaction to start_action

Rename uci option 'startaction' to 'start_action' via upgrade script to
match the 'swanctl.conf' '<child>.start_action' key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 35 +++++++++++++++++++
 net/strongswan/files/swanctl.init             | 20 ++++-------
 2 files changed, 42 insertions(+), 13 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index e459e2b35eb282..b5da37badef656 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -296,6 +296,40 @@ migrate_close_action() {
 	config_foreach migrate_close_action_value child
 }
 
+migrate_start_action_value() {
+	local cfg="$1"
+
+	local startaction
+
+	# Check whether we need to migrate at all.
+	config_get startaction "$cfg" startaction ""
+	[ -z "$startaction" ] && return
+
+	uci -q delete ipsec.${cfg}.startaction
+	[ "$startaction" = "add" ] && {
+		uci -q set ipsec.${cfg}.start_action="none"
+	}
+
+	[ "$startaction" = "route" ] && {
+		uci -q set ipsec.${cfg}.start_action="trap"
+	}
+
+	[ "$startaction" = "start" ] && {
+		uci -q set ipsec.${cfg}.start_action="start"
+	}
+	# * 'none' is default value if 'start_action' is not specified
+	# * 'ignore' is the default value for the old startaction. This value
+	#   is no longer available in the new 'start_action'. There is not
+	#   equivalent for this option!
+
+	uci commit ipsec
+}
+
+migrate_start_action() {
+	config_load ipsec
+	config_foreach migrate_start_action_value child
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -308,6 +342,7 @@ main() {
 	migrate_debug
 	migrate_dpd_action
 	migrate_close_action
+	migrate_start_action
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index e73fafa4f9d65f..2702df7795c29c 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -248,7 +248,7 @@ config_child() {
 	local conf="$1"
 
 	local mode
-	local startaction
+	local start_action
 	local updown
 	local firewall
 	local lifetime
@@ -269,7 +269,7 @@ config_child() {
 	local remote_subnet
 
 	config_get mode "$conf" mode
-	config_get startaction "$conf" startaction "route"
+	config_get start_action "$conf" start_action "none"
 	config_get updown "$conf" updown ""
 	config_get firewall "$conf" firewall ""
 	config_get lifetime "$conf" lifetime ""
@@ -301,18 +301,12 @@ config_child() {
 	local esp_proposal
 	iter_esp_proposal "$conf" esp_proposal
 
-	# translate from ipsec to swanctl
-	case "$startaction" in
-	add)
-		startaction="none" ;;
-	route)
-		startaction="trap" ;;
-	start|none|trap)
-		# already using new syntax
+	case "$start_action" in
+	none|trap|start)
 		;;
 	*)
-		fatal "Startaction $startaction unknown"
-		startaction=
+		fatal "start_action '$start_action' unknown"
+		start_action=
 		;;
 	esac
 
@@ -356,7 +350,7 @@ config_child() {
 	[ -n "$interface" ] && swanctl_xappend4 "interface = $interface"
 	[ -n "$priority" ] && swanctl_xappend4 "priority = $priority"
 	[ -n "$if_id" ] && swanctl_xappend4 "if_id_in = $if_id" "if_id_out = $if_id"
-	[ -n "$startaction" -a "$startaction" != "none" ] && swanctl_xappend4 "start_action = $startaction"
+	[ -n "$start_action" -a "$start_action" != "none" ] && swanctl_xappend4 "start_action = $start_action"
 	[ -n "$close_action" -a "$close_action" != "none" ] && swanctl_xappend4 "close_action = $close_action"
 	swanctl_xappend4 "esp_proposals = $esp_proposal"
 	swanctl_xappend4 "mode = $mode"

From 698b603b50463c59b5ee693e3cbefc0acb0b6b2a Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 11:08:49 +0200
Subject: [PATCH 08/25] strongswan: rename rekeytime to rekey_time in child

Rename uci option 'rekeytime' to 'rekey_time' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_time' key.

The migration function 'migrate_option' in 'uci-defaults' is designed to
be generic, since 'rekeytime' is not the only option that does not conform
to the swanctl naming scheme and should also be migrated.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan          | 18 ++++++++++++++++++
 net/strongswan/files/swanctl.init              | 10 +++++-----
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index b5da37badef656..b6e06b8c13ef31 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -330,6 +330,23 @@ migrate_start_action() {
 	config_foreach migrate_start_action_value child
 }
 
+migrate_option_child_values() {
+	local cfg="$1"
+
+	local value
+
+	config_get value "$cfg" rekeytime ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.rekeytime=rekey_time"
+	}
+}
+
+migrate_options() {
+	config_load ipsec
+	config_foreach migrate_option_child_values child
+	uci commit ipsec
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -343,6 +360,7 @@ main() {
 	migrate_dpd_action
 	migrate_close_action
 	migrate_start_action
+	migrate_options
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 2702df7795c29c..a9812c00b7226b 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -255,7 +255,7 @@ config_child() {
 	local dpd_action
 	local close_action
 	local if_id
-	local rekeytime
+	local rekey_time
 	local ipcomp
 	local interface
 	local hw_offload
@@ -276,7 +276,7 @@ config_child() {
 	config_get dpd_action "$conf" dpd_action "clear"
 	config_get close_action "$conf" close_action "none"
 	config_get if_id "$conf" if_id ""
-	config_get rekeytime "$conf" rekeytime ""
+	config_get rekey_time "$conf" rekey_time ""
 	config_get_bool ipcomp "$conf" ipcomp 0
 	config_get interface "$conf" interface ""
 	config_get hw_offload "$conf" hw_offload ""
@@ -357,10 +357,10 @@ config_child() {
 
 	if [ -n "$lifetime" ]; then
 		swanctl_xappend4 "life_time = $lifetime"
-	elif [ -n "$rekeytime" ]; then
-		swanctl_xappend4 "life_time = $(seconds2time $(((110 * $(time2seconds $rekeytime)) / 100)))"
+	elif [ -n "$rekey_time" ]; then
+		swanctl_xappend4 "life_time = $(seconds2time $(((110 * $(time2seconds $rekey_time)) / 100)))"
 	fi
-	[ -n "$rekeytime" ] && swanctl_xappend4 "rekey_time = $rekeytime"
+	[ -n "$rekey_time" ] && swanctl_xappend4 "rekey_time = $rekey_time"
 	if [ -n "$lifebytes" ]; then
 		swanctl_xappend4 "life_bytes = $lifebytes"
 	elif [ -n "$rekeybytes" ]; then

From 95b26904e2645756e5b9e07ff203843228df356d Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 10:43:26 +0200
Subject: [PATCH 09/25] strongswan: rename lifetime to life_time in child

Rename uci option 'lifetime' to 'life_time' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_time' key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/etc/uci-defaults/strongswan | 5 +++++
 net/strongswan/files/swanctl.init                | 8 ++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index b6e06b8c13ef31..ee1ddd38df2060 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -339,6 +339,11 @@ migrate_option_child_values() {
 	[ -z "$value" ] || {
 		uci -q rename "ipsec.${cfg}.rekeytime=rekey_time"
 	}
+
+	config_get value "$cfg" lifetime ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.lifetime=life_time"
+	}
 }
 
 migrate_options() {
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index a9812c00b7226b..4a1d76474af8f4 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -251,7 +251,7 @@ config_child() {
 	local start_action
 	local updown
 	local firewall
-	local lifetime
+	local life_time
 	local dpd_action
 	local close_action
 	local if_id
@@ -272,7 +272,7 @@ config_child() {
 	config_get start_action "$conf" start_action "none"
 	config_get updown "$conf" updown ""
 	config_get firewall "$conf" firewall ""
-	config_get lifetime "$conf" lifetime ""
+	config_get life_time "$conf" life_time ""
 	config_get dpd_action "$conf" dpd_action "clear"
 	config_get close_action "$conf" close_action "none"
 	config_get if_id "$conf" if_id ""
@@ -355,8 +355,8 @@ config_child() {
 	swanctl_xappend4 "esp_proposals = $esp_proposal"
 	swanctl_xappend4 "mode = $mode"
 
-	if [ -n "$lifetime" ]; then
-		swanctl_xappend4 "life_time = $lifetime"
+	if [ -n "$life_time" ]; then
+		swanctl_xappend4 "life_time = $life_time"
 	elif [ -n "$rekey_time" ]; then
 		swanctl_xappend4 "life_time = $(seconds2time $(((110 * $(time2seconds $rekey_time)) / 100)))"
 	fi

From 0984371f2ee0cdcc1fbc23a3448f3d999e185372 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 10:49:36 +0200
Subject: [PATCH 10/25] strongswan: rename rekeybytes to rekey_bytes child

Rename uci option 'rekeybytes' to 'rekey_bytes' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_bytes' key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/etc/uci-defaults/strongswan |  5 +++++
 net/strongswan/files/swanctl.init                | 10 +++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index ee1ddd38df2060..00722f40c4616c 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -344,6 +344,11 @@ migrate_option_child_values() {
 	[ -z "$value" ] || {
 		uci -q rename "ipsec.${cfg}.lifetime=life_time"
 	}
+
+	config_get value "$cfg" rekeybytes ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.rekeybytes=rekey_bytes"
+	}
 }
 
 migrate_options() {
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 4a1d76474af8f4..314ba299e66c6e 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -260,7 +260,7 @@ config_child() {
 	local interface
 	local hw_offload
 	local priority
-	local rekeybytes
+	local rekey_bytes
 	local lifebytes
 	local rekeypackets
 	local lifepackets
@@ -281,7 +281,7 @@ config_child() {
 	config_get interface "$conf" interface ""
 	config_get hw_offload "$conf" hw_offload ""
 	config_get priority "$conf" priority ""
-	config_get rekeybytes "$conf" rekeybytes ""
+	config_get rekey_bytes "$conf" rekey_bytes ""
 	config_get lifebytes "$conf" lifebytes ""
 	config_get rekeypackets "$conf" rekeypackets ""
 	config_get lifepackets "$conf" lifepackets ""
@@ -363,10 +363,10 @@ config_child() {
 	[ -n "$rekey_time" ] && swanctl_xappend4 "rekey_time = $rekey_time"
 	if [ -n "$lifebytes" ]; then
 		swanctl_xappend4 "life_bytes = $lifebytes"
-	elif [ -n "$rekeybytes" ]; then
-		swanctl_xappend4 "life_bytes = $(((110 * rekeybytes) / 100))"
+	elif [ -n "$rekey_bytes" ]; then
+		swanctl_xappend4 "life_bytes = $(((110 * rekey_bytes) / 100))"
 	fi
-	[ -n "$rekeybytes" ] && swanctl_xappend4 "rekey_bytes = $rekeybytes"
+	[ -n "$rekey_bytes" ] && swanctl_xappend4 "rekey_bytes = $rekey_bytes"
 	if [ -n "$lifepackets" ]; then
 		swanctl_xappend4 "life_packets = $lifepackets"
 	elif [ -n "$rekeypackets" ]; then

From 4b22eead5caf0e90a4ddd455bc543345b6df288b Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 10:55:19 +0200
Subject: [PATCH 11/25] strongswan: rename lifebytes to life_bytes in child

Rename uci option 'lifebytes' to 'life_bytes' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_bytes' key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/etc/uci-defaults/strongswan | 5 +++++
 net/strongswan/files/swanctl.init                | 8 ++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 00722f40c4616c..c738a66f7793a6 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -349,6 +349,11 @@ migrate_option_child_values() {
 	[ -z "$value" ] || {
 		uci -q rename "ipsec.${cfg}.rekeybytes=rekey_bytes"
 	}
+
+	config_get value "$cfg" lifebytes ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.lifebytes=life_bytes"
+	}
 }
 
 migrate_options() {
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 314ba299e66c6e..bbde2ffbfd0f22 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -261,7 +261,7 @@ config_child() {
 	local hw_offload
 	local priority
 	local rekey_bytes
-	local lifebytes
+	local life_bytes
 	local rekeypackets
 	local lifepackets
 	local replay_window
@@ -282,7 +282,7 @@ config_child() {
 	config_get hw_offload "$conf" hw_offload ""
 	config_get priority "$conf" priority ""
 	config_get rekey_bytes "$conf" rekey_bytes ""
-	config_get lifebytes "$conf" lifebytes ""
+	config_get life_bytes "$conf" life_bytes ""
 	config_get rekeypackets "$conf" rekeypackets ""
 	config_get lifepackets "$conf" lifepackets ""
 	config_get replay_window "$conf" replay_window ""
@@ -361,8 +361,8 @@ config_child() {
 		swanctl_xappend4 "life_time = $(seconds2time $(((110 * $(time2seconds $rekey_time)) / 100)))"
 	fi
 	[ -n "$rekey_time" ] && swanctl_xappend4 "rekey_time = $rekey_time"
-	if [ -n "$lifebytes" ]; then
-		swanctl_xappend4 "life_bytes = $lifebytes"
+	if [ -n "$life_bytes" ]; then
+		swanctl_xappend4 "life_bytes = $life_bytes"
 	elif [ -n "$rekey_bytes" ]; then
 		swanctl_xappend4 "life_bytes = $(((110 * rekey_bytes) / 100))"
 	fi

From 500941392c891a675b7cd3261337c7bcce6d4baa Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 10:57:37 +0200
Subject: [PATCH 12/25] strongswan: rename rekeypackets to rekey_packets child

Rename uci option 'rekeypackets' to 'rekey_packets' in child via upgrade script to
match the 'swanctl.conf' '<child>.rekey_packets' key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/etc/uci-defaults/strongswan |  5 +++++
 net/strongswan/files/swanctl.init                | 10 +++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index c738a66f7793a6..a2fb0d95d2c4b4 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -354,6 +354,11 @@ migrate_option_child_values() {
 	[ -z "$value" ] || {
 		uci -q rename "ipsec.${cfg}.lifebytes=life_bytes"
 	}
+
+	config_get value "$cfg" rekeypackets ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.rekeypackets=rekey_packets"
+	}
 }
 
 migrate_options() {
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index bbde2ffbfd0f22..39a255f2fc07fb 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -262,7 +262,7 @@ config_child() {
 	local priority
 	local rekey_bytes
 	local life_bytes
-	local rekeypackets
+	local rekey_packets
 	local lifepackets
 	local replay_window
 	local local_subnet
@@ -283,7 +283,7 @@ config_child() {
 	config_get priority "$conf" priority ""
 	config_get rekey_bytes "$conf" rekey_bytes ""
 	config_get life_bytes "$conf" life_bytes ""
-	config_get rekeypackets "$conf" rekeypackets ""
+	config_get rekey_packets "$conf" rekey_packets ""
 	config_get lifepackets "$conf" lifepackets ""
 	config_get replay_window "$conf" replay_window ""
 
@@ -369,10 +369,10 @@ config_child() {
 	[ -n "$rekey_bytes" ] && swanctl_xappend4 "rekey_bytes = $rekey_bytes"
 	if [ -n "$lifepackets" ]; then
 		swanctl_xappend4 "life_packets = $lifepackets"
-	elif [ -n "$rekeypackets" ]; then
-		swanctl_xappend4 "life_packets = $(((110 * rekeypackets) / 100))"
+	elif [ -n "$rekey_packets" ]; then
+		swanctl_xappend4 "life_packets = $(((110 * rekey_packets) / 100))"
 	fi
-	[ -n "$rekeypackets" ] && swanctl_xappend4 "rekey_packets = $rekeypackets"
+	[ -n "$rekey_packets" ] && swanctl_xappend4 "rekey_packets = $rekey_packets"
 	[ -n "$inactivity" ] && swanctl_xappend4 "inactivity = $inactivity"
 
 	[ -n "$updown" ] && swanctl_xappend4 "updown = $updown"

From a18d5d65f50f92f474b54aa0ab4ef03b3481881e Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 11:00:21 +0200
Subject: [PATCH 13/25] strongswan: rename lifepackets to life_packets in child

Rename uci option 'lifepackets' to 'life_packets' in child via upgrade script to
match the 'swanctl.conf' '<child>.life_packets' key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/etc/uci-defaults/strongswan | 5 +++++
 net/strongswan/files/swanctl.init                | 8 ++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index a2fb0d95d2c4b4..b75ff73093e5d3 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -359,6 +359,11 @@ migrate_option_child_values() {
 	[ -z "$value" ] || {
 		uci -q rename "ipsec.${cfg}.rekeypackets=rekey_packets"
 	}
+
+	config_get value "$cfg" lifepackets ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.lifepackets=life_packets"
+	}
 }
 
 migrate_options() {
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 39a255f2fc07fb..3fe0d549da41a3 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -263,7 +263,7 @@ config_child() {
 	local rekey_bytes
 	local life_bytes
 	local rekey_packets
-	local lifepackets
+	local life_packets
 	local replay_window
 	local local_subnet
 	local remote_subnet
@@ -284,7 +284,7 @@ config_child() {
 	config_get rekey_bytes "$conf" rekey_bytes ""
 	config_get life_bytes "$conf" life_bytes ""
 	config_get rekey_packets "$conf" rekey_packets ""
-	config_get lifepackets "$conf" lifepackets ""
+	config_get life_packets "$conf" life_packets ""
 	config_get replay_window "$conf" replay_window ""
 
 	config_list_foreach "$conf" local_subnet append_var local_subnet ","
@@ -367,8 +367,8 @@ config_child() {
 		swanctl_xappend4 "life_bytes = $(((110 * rekey_bytes) / 100))"
 	fi
 	[ -n "$rekey_bytes" ] && swanctl_xappend4 "rekey_bytes = $rekey_bytes"
-	if [ -n "$lifepackets" ]; then
-		swanctl_xappend4 "life_packets = $lifepackets"
+	if [ -n "$life_packets" ]; then
+		swanctl_xappend4 "life_packets = $life_packets"
 	elif [ -n "$rekey_packets" ]; then
 		swanctl_xappend4 "life_packets = $(((110 * rekey_packets) / 100))"
 	fi

From 1e2654478561400b6678dbb8c168f2ce904652a3 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 11:36:26 +0200
Subject: [PATCH 14/25] strongswan: rename rekeytime to rekey_time in remote

Rename uci option 'rekeytime' to 'rekey_time' in remote via upgrade script to
match the 'swanctl.conf' '<conn>.rekey_time' key.

The new migration function 'migrate_option_remote_values' in 'uci-defaults'
is designed to be generic, since 'rekeytime' is not the only option that
does not conform to the swanctl naming scheme for conn and should also be
migrated.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/etc/uci-defaults/strongswan | 12 ++++++++++++
 net/strongswan/files/swanctl.init                | 10 +++++-----
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index b75ff73093e5d3..2b3457374995a8 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -366,9 +366,21 @@ migrate_option_child_values() {
 	}
 }
 
+migrate_option_remote_values() {
+	local cfg="$1"
+
+	local value
+
+	config_get value "$cfg" rekeytime ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.rekeytime=rekey_time"
+	}
+}
+
 migrate_options() {
 	config_load ipsec
 	config_foreach migrate_option_child_values child
+	config_foreach migrate_option_remote_values remote
 	uci commit ipsec
 }
 
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 3fe0d549da41a3..5d76e168b66551 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -451,7 +451,7 @@ config_remote() {
 	local local_cert
 	local local_key
 	local ca_cert
-	local rekeytime
+	local rekey_time
 	local overtime
 	local send_cert
 	local send_certreq
@@ -479,7 +479,7 @@ config_remote() {
 	config_get local_cert "$conf" local_cert ""
 	config_get local_key "$conf" local_key ""
 	config_get ca_cert "$conf" ca_cert ""
-	config_get rekeytime "$conf" rekeytime
+	config_get rekey_time "$conf" rekey_time
 	config_get overtime "$conf" overtime
 	config_get send_cert "$conf" send_cert
 	config_get_bool send_certreq "$conf" send_certreq 1
@@ -593,11 +593,11 @@ config_remote() {
 
 	[ $mobike -eq 1 ] && swanctl_xappend2 "mobike = yes" || swanctl_xappend2 "mobike = no"
 
-	if [ -n "$rekeytime" ]; then
-		swanctl_xappend2 "rekey_time = $rekeytime"
+	if [ -n "$rekey_time" ]; then
+		swanctl_xappend2 "rekey_time = $rekey_time"
 
 		if [ -z "$overtime" ]; then
-			overtime=$(seconds2time $(($(time2seconds $rekeytime) / 10)))
+			overtime=$(seconds2time $(($(time2seconds $rekey_time) / 10)))
 		fi
 	fi
 	[ -n "$overtime" ] && swanctl_xappend2 "over_time = $overtime"

From 4559f193a61beaed1761be3166d6f6876445854e Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 11:41:34 +0200
Subject: [PATCH 15/25] strongswan: rename overtime to over_time in remote

Rename uci option 'overtime' to 'over_time' in child via upgrade script to
match the 'swanctl.conf' '<con>.over_time' key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/etc/uci-defaults/strongswan |  5 +++++
 net/strongswan/files/swanctl.init                | 10 +++++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 2b3457374995a8..8a491b4d84b502 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -375,6 +375,11 @@ migrate_option_remote_values() {
 	[ -z "$value" ] || {
 		uci -q rename "ipsec.${cfg}.rekeytime=rekey_time"
 	}
+
+	config_get value "$cfg" overtime ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.overtime=over_time"
+	}
 }
 
 migrate_options() {
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 5d76e168b66551..8ba45b5983ec8a 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -452,7 +452,7 @@ config_remote() {
 	local local_key
 	local ca_cert
 	local rekey_time
-	local overtime
+	local over_time
 	local send_cert
 	local send_certreq
 	local eap_id
@@ -480,7 +480,7 @@ config_remote() {
 	config_get local_key "$conf" local_key ""
 	config_get ca_cert "$conf" ca_cert ""
 	config_get rekey_time "$conf" rekey_time
-	config_get overtime "$conf" overtime
+	config_get over_time "$conf" over_time
 	config_get send_cert "$conf" send_cert
 	config_get_bool send_certreq "$conf" send_certreq 1
 	config_get eap_id "$conf" eap_id "%any"
@@ -596,11 +596,11 @@ config_remote() {
 	if [ -n "$rekey_time" ]; then
 		swanctl_xappend2 "rekey_time = $rekey_time"
 
-		if [ -z "$overtime" ]; then
-			overtime=$(seconds2time $(($(time2seconds $rekey_time) / 10)))
+		if [ -z "$over_time" ]; then
+			over_time=$(seconds2time $(($(time2seconds $rekey_time) / 10)))
 		fi
 	fi
-	[ -n "$overtime" ] && swanctl_xappend2 "over_time = $overtime"
+	[ -n "$over_time" ] && swanctl_xappend2 "over_time = $over_time"
 
 	swanctl_xappend2 "proposals = $ike_proposal"
 	[ -n "$dpddelay" ] && swanctl_xappend2 "dpd_delay = $dpddelay"

From 1ad1bac4a88720aac661eba4b4f7aedd96109554 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 11 Sep 2026 11:45:48 +0200
Subject: [PATCH 16/25] strongswan: rename dpddelay to dpd_delay in remote

Rename uci option 'dpddelay' to 'dpd_delay' in remote via upgrade script to
match the 'swanctl.conf' '<conn>.dpd_delay' key.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/etc/uci-defaults/strongswan | 5 +++++
 net/strongswan/files/swanctl.init                | 6 +++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 8a491b4d84b502..e71363134748f4 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -380,6 +380,11 @@ migrate_option_remote_values() {
 	[ -z "$value" ] || {
 		uci -q rename "ipsec.${cfg}.overtime=over_time"
 	}
+
+	config_get value "$cfg" dpddelay ""
+	[ -z "$value" ] || {
+		uci -q rename "ipsec.${cfg}.dpddelay=dpd_delay"
+	}
 }
 
 migrate_options() {
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 8ba45b5983ec8a..676209e01b35e7 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -442,7 +442,7 @@ config_remote() {
 	local local_identifier
 	local remote_identifier
 	local keyingtries
-	local dpddelay
+	local dpd_delay
 	local encap
 	local inactivity
 	local keyexchange
@@ -470,7 +470,7 @@ config_remote() {
 	config_get local_identifier "$conf" local_identifier ""
 	config_get remote_identifier "$conf" remote_identifier ""
 	config_get keyingtries "$conf" keyingtries "3"
-	config_get dpddelay "$conf" dpddelay "30s"
+	config_get dpd_delay "$conf" dpd_delay "30s"
 	config_get_bool encap "$conf" encap 0
 	config_get inactivity "$conf" inactivity
 	config_get keyexchange "$conf" keyexchange "ikev2"
@@ -603,7 +603,7 @@ config_remote() {
 	[ -n "$over_time" ] && swanctl_xappend2 "over_time = $over_time"
 
 	swanctl_xappend2 "proposals = $ike_proposal"
-	[ -n "$dpddelay" ] && swanctl_xappend2 "dpd_delay = $dpddelay"
+	[ -n "$dpd_delay" ] && swanctl_xappend2 "dpd_delay = $dpd_delay"
 	[ $encap -eq 1 ] && swanctl_xappend2 "encap = yes" || swanctl_xappend2 "encap = no"
 	[ "$keyingtries" = "%forever" ] && swanctl_xappend2 "keyingtries = 0" || swanctl_xappend2 "keyingtries = $keyingtries"
 

From 1b56538259b431f149655f4d118f6008a6b040bb Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Mon, 14 Sep 2026 11:45:02 +0200
Subject: [PATCH 17/25] strongswan: fix ipsec globals section type

The section type in the config and in 'swanctl.init' was overlooked, when
migrating the IPsec type to globals.

Fixes: e5c5a23a8 ("strongswan: do not use config_foreach named section globals")

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/ipsec.config | 2 +-
 net/strongswan/files/swanctl.init | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/strongswan/files/ipsec.config b/net/strongswan/files/ipsec.config
index 97b9c0c73b3365..dc114e977949e2 100644
--- a/net/strongswan/files/ipsec.config
+++ b/net/strongswan/files/ipsec.config
@@ -4,6 +4,6 @@
 # This is the 'globals' config section for the 'strongswan.conf' file.
 # For LuCI the section type ipsec should only appear once. It must therefore
 # always be present and should not be added or removed manually.
-config ipsec 'globals'
+config globals 'globals'
 
 config syslog 'syslog'
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 676209e01b35e7..703d36c382a871 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -825,7 +825,7 @@ service_triggers() {
 	procd_add_reload_trigger "ipsec"
 	config load "ipsec"
 
-	config_foreach service_trigger_ipsec ipsec
+	config_foreach service_trigger_ipsec globals
 }
 
 service_trigger_ipsec() {

From 7068d6d98b56275540233c07e11b96ab0f4d58e0 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Thu, 10 Sep 2026 16:28:20 +0200
Subject: [PATCH 18/25] strongswan: add uci shunt configuration

Add a new uci 'shunt' section type for pass/drop policies, independent
of 'remote' connections since shunts have no peer, auth, or
proposals. Renders each into its own 'connections{}' entry in
swanctl.conf.

Supports mode (pass/drop), local_ts/remote_ts (list), priority,
interface.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 51 +++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 703d36c382a871..8252cd1173d77e 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -648,6 +648,56 @@ config_remote() {
 	swanctl_xappend0 ""
 }
 
+config_shunt() {
+	local conf="$1"
+
+	local enabled
+	local mode
+	local local_ts
+	local remote_ts
+	local priority
+	local interface
+
+	config_get_bool enabled "$conf" enabled 0
+	[ $enabled -eq 0 ] && return
+
+	config_get mode "$conf" mode ""
+	case "$mode" in
+	pass|drop)
+		;;
+	*)
+		warning "mode '$mode' unknown"
+		return;
+		;;
+	esac
+
+	config_list_foreach "$conf" local_ts append_var local_ts ","
+	config_list_foreach "$conf" remote_ts append_var remote_ts ","
+	config_get priority "$conf" priority ""
+	config_get interface "$conf" interface ""
+
+	swanctl_xappend0 "# shunt config for $conf"
+	swanctl_xappend0 "connections {"
+	swanctl_xappend1 "$conf {"
+	swanctl_xappend2 "children {"
+	swanctl_xappend3 "$conf {"
+	swanctl_xappend4 "mode = $mode"
+	[ -n "$local_ts" ] && swanctl_xappend4 "local_ts = $local_ts"
+	[ -n "$remote_ts" ] && swanctl_xappend4 "remote_ts = $remote_ts"
+	[ -n "$interface" ] && swanctl_xappend4 "interface = $interface"
+	# Priority becomes relevant when traffic selectors from different
+	# policies overlap. A *lower* number means *higher* priority, so the
+	# kernel knows which rule takes precedence in the event of an overlap.
+	[ -n "$priority" ] && swanctl_xappend4 "priority = $priority"
+	# Setting 'start_action' to 'trap' is essential here. The policy
+	# is installed immediately as soon as the configuration is loaded.
+	swanctl_xappend4 "start_action = trap"
+	swanctl_xappend3 "}"
+	swanctl_xappend2 "}"
+	swanctl_xappend1 "}"
+	swanctl_xappend0 "}"
+}
+
 config_charon_plugin_syslog() {
 	# daemon syslog facility
 	local dmn mgr job cfg knl net asn lib tls tnc imc imv pts app wch
@@ -790,6 +840,7 @@ prepare_env() {
 	swanctl_reset
 	swanctl_xappend0 "# generated by /etc/init.d/swanctl"
 	config_foreach config_remote remote
+	config_foreach config_shunt shunt
 	
 	swanctl_xappend0 "# Global config"
 	swanctl_xappend0 ""

From f50f5b99f29cbf2fc6575f6b73c3fb68d57598a5 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 10 Jul 2026 13:11:37 +0200
Subject: [PATCH 19/25] strongswan: add kernel-netlink plugin config generation
 for install_routes_xfrmi

Strongswan can optionally install routes via XFRM interfaces if the
'charon.plugins.kernel-netlink.install_routes_xfrmi' option is enabled.

This change makes this configurable via uci.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 8252cd1173d77e..052e249b36c247 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -756,6 +756,20 @@ config_charon_plugin_syslog() {
 	swan_xappend1 "}"
 }
 
+config_charon_plugin_netlink () {
+
+	local install_routes_xfrmi
+
+	config_get_bool install_routes_xfrmi netlink install_routes_xfrmi 0
+	[ "$install_routes_xfrmi" = "1" ] || return
+
+	swan_xappend1 "plugins {"
+	swan_xappend2 "kernel-netlink {"
+	swan_xappend3 "install_routes_xfrmi = yes"
+	swan_xappend2 "}"
+	swan_xappend1 "}"
+}
+
 config_charon_scripts() {
 	local conf="$1"
 
@@ -823,6 +837,7 @@ config_strongswan_generate() {
 	config_charon_interfaces_use "$conf"
 	config_charon_scripts "$conf"
 	config_charon_plugin_syslog
+	config_charon_plugin_netlink
 	swan_xappend0 "}"
 }
 

From 03f916d92381955e4866426515979b9f21d88719 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Tue, 15 Sep 2026 14:08:56 +0200
Subject: [PATCH 20/25] strongswan: also reload strongswan.conf on service
 reload

Previously a service reload only reloaded the IPsec connection
definitions from '/var/swanctl/swanctl.conf', leaving changes to
'/var/ipsec/strongswan.conf' to require a full restart.

Extend the reload action to also pick up changes to strongswan.conf
for a running service by executing 'swanctl --reload-settings' on
reload as well.

Note that 'swanctl --reload-settings' reloads '/var/ipsec/strongswan.conf'
at runtime, but not all settings (esp. plugin load directives, kernel/socket
options) are picked up by charon. A full daemon restart is still required
for such changes to apply. A note about this was added as well at this
point.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 052e249b36c247..175b619b41305b 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -874,7 +874,18 @@ reload_service() {
 	running && {
 		prepare_env
 		[ $WAIT_FOR_INTF -eq 0 ] && {
+			# Load '/var/swanctl/swanctl.conf'
+			# NOTE: The command 'swanctl --load-all --noprompt'
+			# reloads '/var/swanctl/swanctl.conf' at runtime.
 			swanctl --load-all --noprompt
+
+			# Load '/var/ipsec/strongswan.conf'
+			# NOTE: The command 'swanctl --reload-settings' reloads
+			# '/var/ipsec/strongswan.conf' at runtime, but not *all*
+			# settings (esp. plugin load directives, kernel/socket
+			# options) are picked up by charon. A full daemon
+			# restart is required for such changes to apply.
+			swanctl --reload-settings
 			return
 		}
 	}

From 38d380513f82c4d8df4b99469adaa9a640ac5e0a Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 18 Sep 2026 07:22:30 +0200
Subject: [PATCH 21/25] strongswan: stop automatic migration via uci-defaults

The migration of the legacy '/etc/config/ipsec' UCI configuration to
the new '/etc/config/swanctl' format cannot be performed fully
automatically: it rewrites the user's configuration and must be
triggered and acknowledged by the user.

Remove the automatic migration hook that was installed as an
uci-defaults script (executed once on first boot or installation) and
instead ship the migration utility as a regular binary at
'/usr/libexec/strongswan/migrate-ipsec-to-swanctl'. From now on the
migration is only run on demand.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/Makefile                                    | 7 +++----
 .../libexec/strongswan/migrate-ipsec-to-swanctl}           | 0
 2 files changed, 3 insertions(+), 4 deletions(-)
 rename net/strongswan/files/{etc/uci-defaults/strongswan => usr/libexec/strongswan/migrate-ipsec-to-swanctl} (100%)

diff --git a/net/strongswan/Makefile b/net/strongswan/Makefile
index 951b51a905e982..b2b602e7b5e8c0 100644
--- a/net/strongswan/Makefile
+++ b/net/strongswan/Makefile
@@ -568,10 +568,9 @@ define Package/strongswan-swanctl/install
 	$(INSTALL_DIR) $(1)/etc/config
 	$(INSTALL_CONF) ./files/ipsec.config $(1)/etc/config/ipsec
 
-	# Install migration from 'ipsec@ipsec[-1]' to 'ipsec.globals'
-	$(INSTALL_DIR) $(1)/etc/uci-defaults
-	$(INSTALL_DATA) ./files/etc/uci-defaults/strongswan \
-		$(1)/etc/uci-defaults/strongswan
+	$(INSTALL_DIR) $(1)/usr/libexec/strongswan/
+	$(INSTALL_BIN) ./files/usr/libexec/strongswan/migrate-ipsec-to-swanctl \
+		$(1)/usr/libexec/strongswan/
 endef
 
 define Package/strongswan-gencerts/install
diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/usr/libexec/strongswan/migrate-ipsec-to-swanctl
similarity index 100%
rename from net/strongswan/files/etc/uci-defaults/strongswan
rename to net/strongswan/files/usr/libexec/strongswan/migrate-ipsec-to-swanctl

From d7d2667821a23c789eeeb868e48f301c8420fd8a Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 18 Sep 2026 07:38:38 +0200
Subject: [PATCH 22/25] strongswan: switch to the swanctl uci config file

strongSwan's native configuration format is 'swanctl.conf', which the
swanctl init script already generates from UCI. The old 'ipsec' UCI
configuration is being phased out, so switch the shipped UCI default
to the new config file.

Rename the default UCI config file from '/etc/config/ipsec' to
'/etc/config/swanctl' and adapt the swanctl init script accordingly:
- load the 'swanctl' config instead of 'ipsec'
- use 'swanctl' as the procd reload trigger
- rename the service trigger callback 'service_trigger_ipsec' to
  'service_trigger_swanctl'

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/Makefile                               |  4 ++--
 net/strongswan/files/{ipsec.config => swanctl.config} |  0
 net/strongswan/files/swanctl.init                     | 10 +++++-----
 3 files changed, 7 insertions(+), 7 deletions(-)
 rename net/strongswan/files/{ipsec.config => swanctl.config} (100%)

diff --git a/net/strongswan/Makefile b/net/strongswan/Makefile
index b2b602e7b5e8c0..b3eb026d157468 100644
--- a/net/strongswan/Makefile
+++ b/net/strongswan/Makefile
@@ -552,7 +552,7 @@ define Package/strongswan-pki/install
 endef
 
 define Package/strongswan-swanctl/conffiles
-/etc/config/ipsec
+/etc/config/swanctl
 /etc/swanctl/
 endef
 
@@ -566,7 +566,7 @@ define Package/strongswan-swanctl/install
 	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/swanctl $(1)/usr/sbin/
 	$(INSTALL_BIN) ./files/swanctl.init $(1)/etc/init.d/swanctl
 	$(INSTALL_DIR) $(1)/etc/config
-	$(INSTALL_CONF) ./files/ipsec.config $(1)/etc/config/ipsec
+	$(INSTALL_CONF) ./files/swanctl.config $(1)/etc/config/swanctl
 
 	$(INSTALL_DIR) $(1)/usr/libexec/strongswan/
 	$(INSTALL_BIN) ./files/usr/libexec/strongswan/migrate-ipsec-to-swanctl \
diff --git a/net/strongswan/files/ipsec.config b/net/strongswan/files/swanctl.config
similarity index 100%
rename from net/strongswan/files/ipsec.config
rename to net/strongswan/files/swanctl.config
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 175b619b41305b..462a86dc71439f 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -844,7 +844,7 @@ config_strongswan_generate() {
 prepare_env() {
 	mkdir -p /var/ipsec /var/swanctl
 
-	config_load ipsec
+	config_load swanctl
 
 	# Generate /var/ipsec/strongswan.conf
 	swan_reset
@@ -899,13 +899,13 @@ stop_service() {
 }
 
 service_triggers() {
-	procd_add_reload_trigger "ipsec"
-	config load "ipsec"
+	procd_add_reload_trigger "swanctl"
+	config load "swanctl"
 
-	config_foreach service_trigger_ipsec globals
+	config_foreach service_trigger_swanctl globals
 }
 
-service_trigger_ipsec() {
+service_trigger_swanctl() {
 	local interface interface_list
 	config_list_foreach "$1" interface append_var interface_list
 	for interface in $interface_list; do

From e9e110560aa6ef7c2f86b29a2caacc40c8589832 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 18 Sep 2026 07:42:06 +0200
Subject: [PATCH 23/25] strongswan: add migrate command to swanctl.init

Now that the ipsec-to-swanctl migration is no longer executed
automatically on boot, expose it through the init script so it can be
invoked on demand via '/etc/init.d/swanctl migrate'.

Also harden the migration script:
- abort with an error if '/etc/config/ipsec' does not exist, i.e. the
  migration has already been carried out
- make a copy of '/etc/config/swanctl' to '/etc/config/swanctl.bak' if
  the file already exists
- create a backup of the original configuration file '/etc/config/ipsec'
  to '/etc/config/ipsec.bak' before starting
- move the migrated file '/etc/config/ipsec' to its final location
  '/etc/config/swanctl'.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init             |  6 +++++
 .../strongswan/migrate-ipsec-to-swanctl       | 23 ++++++++++++++++---
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 462a86dc71439f..c768a7c0acfc6e 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -19,6 +19,12 @@ WAIT_FOR_INTF=0
 
 CONFIG_FAIL=0
 
+extra_command "migrate" "Migrate old /etc/config/ipsec to /etc/config/swanctl"
+
+migrate() {
+	/usr/libexec/strongswan/migrate-ipsec-to-swanctl
+}
+
 time2seconds() {
 	local timestring="$1"
 	local multiplier number suffix
diff --git a/net/strongswan/files/usr/libexec/strongswan/migrate-ipsec-to-swanctl b/net/strongswan/files/usr/libexec/strongswan/migrate-ipsec-to-swanctl
index e71363134748f4..95d596d5bd82c6 100644
--- a/net/strongswan/files/usr/libexec/strongswan/migrate-ipsec-to-swanctl
+++ b/net/strongswan/files/usr/libexec/strongswan/migrate-ipsec-to-swanctl
@@ -395,6 +395,21 @@ migrate_options() {
 }
 
 main() {
+
+	[ -f /etc/config/ipsec ] || {
+		echo "File '/etc/config/ipsec' ipsec does not exists."
+		exit 1
+	}
+
+	[ -f /etc/config/swanctl ] && {
+		echo "File '/etc/config/swanctl' already exists."
+		echo "Copy to '/etc/config/swanctl.bak'"
+		cp /etc/config/swanctl /etc/config/swanctl.bak
+	}
+
+	# Make a backup copy of the old file.
+	cp /etc/config/ipsec /etc/config/ipsec.bak
+
 	migrate_ipsec
 	migrate_ignore_routing_tables
 	migrate_local_nat
@@ -408,8 +423,10 @@ main() {
 	migrate_close_action
 	migrate_start_action
 	migrate_options
-}
 
-main
+	# Move the migrated ipsec config to the new swanctl config
+	mv /etc/config/ipsec /etc/config/swanctl
+	exit 0
+}
 
-exit 0
+main "$@"

From 7f8ad2acc38041ce9438cebd49a2276f24cac983 Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Fri, 18 Sep 2026 08:17:07 +0200
Subject: [PATCH 24/25] strongswan: add back legacy config generation for old
 uci ipsec

Until the user runs the migration, the legacy '/etc/config/ipsec'
configuration must keep working. Restore support for the old UCI
format in the swanctl init script by adding a parallel legacy
rendering path:

- add 'legacy_config_*' helpers that translate the legacy ipsec
  sections ('ipsec'/'globals', 'remote', 'tunnel', 'transport',
  'pools', 'mschapv2_secrets') into swanctl.conf syntax, including the
  existing start/close/dpd action and lifetime translations
- as long as '/etc/config/ipsec' exists, prepare_env() and
  service_triggers() use the legacy generation path and keep reloading
  on 'ipsec' changes; once the migration has moved the file away, the
  new swanctl path is used

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/files/swanctl.init | 483 ++++++++++++++++++++++++++++++
 1 file changed, 483 insertions(+)

diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index c768a7c0acfc6e..751871294ecfc2 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -847,9 +847,486 @@ config_strongswan_generate() {
 	swan_xappend0 "}"
 }
 
+legacy_config_child() {
+	# Generic ipsec conn section shared by tunnel and transport
+	local conf="$1"
+	local mode="$2"
+
+	local hw_offload
+	local interface
+	local ipcomp
+	local priority
+	local local_subnet
+	local local_nat
+	local updown
+	local firewall
+	local remote_subnet
+	local lifetime
+	local dpdaction
+	local closeaction
+	local startaction
+	local if_id
+	local rekeytime
+	local rekeybytes
+	local lifebytes
+	local rekeypackets
+	local lifepackets
+	local replay_window
+
+	config_get startaction "$conf" startaction "route"
+	config_get local_nat "$conf" local_nat ""
+	config_get updown "$conf" updown ""
+	config_get firewall "$conf" firewall ""
+	config_get lifetime "$conf" lifetime ""
+	config_get dpdaction "$conf" dpdaction "none"
+	config_get closeaction "$conf" closeaction "none"
+	config_get if_id "$conf" if_id ""
+	config_get rekeytime "$conf" rekeytime ""
+	config_get_bool ipcomp "$conf" ipcomp 0
+	config_get interface "$conf" interface ""
+	config_get hw_offload "$conf" hw_offload ""
+	config_get priority "$conf" priority ""
+	config_get rekeybytes "$conf" rekeybytes ""
+	config_get lifebytes "$conf" lifebytes ""
+	config_get rekeypackets "$conf" rekeypackets ""
+	config_get lifepackets "$conf" lifepackets ""
+	config_get replay_window "$conf" replay_window ""
+
+	config_list_foreach "$conf" local_subnet append_var local_subnet ","
+	config_list_foreach "$conf" remote_subnet append_var remote_subnet ","
+
+	local esp_proposal
+	iter_esp_proposal "$conf" esp_proposal
+
+	# translate from ipsec to swanctl
+	case "$startaction" in
+	add)
+		startaction="none" ;;
+	route)
+		startaction="trap" ;;
+	start|none|trap)
+		# already using new syntax
+		;;
+	*)
+		fatal "Startaction $startaction unknown"
+		startaction=
+		;;
+	esac
+
+	case "$closeaction" in
+	none|clear)
+		closeaction="none" ;;
+	hold)
+		closeaction="trap" ;;
+	restart)
+		closeaction="start" ;;
+	trap|start)
+		# already using new syntax
+		;;
+	*)
+		fatal "Closeaction $closeaction unknown"
+		closeaction=
+		;;
+	esac
+
+	[ -n "$closeaction" -a "$closeaction" != "none" ] && warning "Closeaction $closeaction can cause instability"
+
+	case "$dpdaction" in
+	none)
+		dpddelay="0s"
+		dpdaction=
+		;;
+	hold)
+		dpdaction="trap" ;;
+	restart)
+		dpdaction="restart" ;;
+	trap|restart|clear)
+		# already using new syntax
+		;;
+	*)
+		fatal "Dpdaction $dpdaction unknown"
+		dpdaction=
+		;;
+	esac
+
+	case "$hw_offload" in
+	yes|no|auto|"")
+		;;
+	*)
+		fatal "hw_offload value $hw_offload invalid"
+		hw_offload=""
+		;;
+	esac
+
+	[ -n "$local_nat" ] && local_subnet="$local_nat"
+
+	swanctl_xappend3 "$conf {"
+
+	[ -n "$local_subnet" ] && swanctl_xappend4 "local_ts = $local_subnet"
+	[ -n "$remote_subnet" ] && swanctl_xappend4 "remote_ts = $remote_subnet"
+
+	[ -n "$hw_offload" ] && swanctl_xappend4 "hw_offload = $hw_offload"
+	[ $ipcomp -eq 1 ] && swanctl_xappend4 "ipcomp = 1"
+	[ -n "$interface" ] && swanctl_xappend4 "interface = $interface"
+	[ -n "$priority" ] && swanctl_xappend4 "priority = $priority"
+	[ -n "$if_id" ] && swanctl_xappend4 "if_id_in = $if_id" "if_id_out = $if_id"
+	[ -n "$startaction" -a "$startaction" != "none" ] && swanctl_xappend4 "start_action = $startaction"
+	[ -n "$closeaction" -a "$closeaction" != "none" ] && swanctl_xappend4 "close_action = $closeaction"
+	swanctl_xappend4 "esp_proposals = $esp_proposal"
+	swanctl_xappend4 "mode = $mode"
+
+	if [ -n "$lifetime" ]; then
+		swanctl_xappend4 "life_time = $lifetime"
+	elif [ -n "$rekeytime" ]; then
+		swanctl_xappend4 "life_time = $(seconds2time $(((110 * $(time2seconds $rekeytime)) / 100)))"
+	fi
+	[ -n "$rekeytime" ] && swanctl_xappend4 "rekey_time = $rekeytime"
+	if [ -n "$lifebytes" ]; then
+		swanctl_xappend4 "life_bytes = $lifebytes"
+	elif [ -n "$rekeybytes" ]; then
+		swanctl_xappend4 "life_bytes = $(((110 * rekeybytes) / 100))"
+	fi
+	[ -n "$rekeybytes" ] && swanctl_xappend4 "rekey_bytes = $rekeybytes"
+	if [ -n "$lifepackets" ]; then
+		swanctl_xappend4 "life_packets = $lifepackets"
+	elif [ -n "$rekeypackets" ]; then
+		swanctl_xappend4 "life_packets = $(((110 * rekeypackets) / 100))"
+	fi
+	[ -n "$rekeypackets" ] && swanctl_xappend4 "rekey_packets = $rekeypackets"
+	[ -n "$inactivity" ] && swanctl_xappend4 "inactivity = $inactivity"
+
+	[ -n "$updown" ] && swanctl_xappend4 "updown = $updown"
+	[ -n "$dpdaction" ] && swanctl_xappend4 "dpd_action = $dpdaction"
+	[ -n "$replay_window" ] && swanctl_xappend4 "replay_window = $replay_window"
+
+	swanctl_xappend3 "}"
+}
+
+legacy_config_tunnel() {
+	legacy_config_child "$1" "tunnel"
+}
+
+legacy_config_transport() {
+	legacy_config_child "$1" "transport"
+}
+
+legacy_config_remote() {
+	local conf="$1"
+
+	local enabled
+	local gateway
+	local local_sourceip
+	local local_ip
+	local local_identifier
+	local remote_gateway
+	local remote_identifier
+	local pre_shared_key
+	local auth_method
+	local keyingtries
+	local dpddelay
+	local encap
+	local inactivity
+	local keyexchange
+	local fragmentation
+	local mobike
+	local local_cert
+	local local_key
+	local ca_cert
+	local rekeytime
+	local overtime
+	local send_cert
+	local send_certreq
+	local remote_ca_certs
+	local pools
+	local eap_id
+
+	config_get_bool enabled "$conf" enabled 0
+	[ $enabled -eq 0 ] && return
+
+	config_get gateway "$conf" gateway
+	config_get pre_shared_key "$conf" pre_shared_key
+	config_get auth_method "$conf" authentication_method
+	config_get local_identifier "$conf" local_identifier ""
+	config_get remote_identifier "$conf" remote_identifier ""
+	config_get local_ip "$conf" local_ip "%any"
+	config_get keyingtries "$conf" keyingtries "3"
+	config_get dpddelay "$conf" dpddelay "30s"
+	config_get_bool encap "$conf" encap 0
+	config_get inactivity "$conf" inactivity
+	config_get keyexchange "$conf" keyexchange "ikev2"
+	config_get fragmentation "$conf" fragmentation "yes"
+	config_get_bool mobike "$conf" mobike 1
+	config_get local_cert "$conf" local_cert ""
+	config_get local_key "$conf" local_key ""
+	config_get ca_cert "$conf" ca_cert ""
+	config_get rekeytime "$conf" rekeytime
+	config_get overtime "$conf" overtime
+	config_get send_cert "$conf" send_cert
+	config_get_bool send_certreq "$conf" send_certreq 1
+	config_get eap_id "$conf" eap_id "%any"
+
+	config_list_foreach "$conf" local_sourceip append_var local_sourceip ","
+	config_list_foreach "$conf" remote_ca_certs append_var remote_ca_certs ","
+	config_list_foreach "$conf" pools append_var pools ","
+
+	case "$fragmentation" in
+	0)
+		fragmentation="no" ;;
+	1)
+		fragmentation="yes" ;;
+	yes|accept|force|no)
+		# already using new syntax
+		;;
+	*)
+		fatal "Fragmentation $fragmentation not supported"
+		fragmentation=
+		;;
+	esac
+
+	[ "$gateway" = "any" ] && remote_gateway="%any" || remote_gateway="$gateway"
+
+	if [ -n "$local_key" ]; then
+		[ "$(dirname "$local_key")" != "." ] && \
+		   fatal "local_key $local_key can't be pathname"
+		[ -f "/etc/swanctl/private/$local_key" ] || \
+		   fatal "local_key $local_key not found"
+	fi
+
+	local ike_proposal
+	iter_ike_proposal "$conf" ike_proposal
+
+	[ -n "$firewall" ] && fatal "Firewall not supported"
+
+	if [ "$auth_method" = pubkey ]; then
+		if [ -n "$ca_cert" ]; then
+			[ "$(dirname "$ca_cert")" != "." ] && \
+			    fatal "ca_cert $ca_cert can't be pathname"
+			[ -f "/etc/swanctl/x509ca/$ca_cert" ] || \
+			    fatal "ca_cert $ca_cert not found"
+		fi
+
+		if [ -n "$local_cert" ]; then
+			[ "$(dirname "$local_cert")" != "." ] && \
+			    fatal "local_cert $local_cert can't be pathname"
+			[ -f "/etc/swanctl/x509/$local_cert" ] || \
+			    fatal "local_cert $local_cert not found"
+		fi
+	fi
+
+	swanctl_xappend0 "# config for $conf"
+	swanctl_xappend0 "connections {"
+	swanctl_xappend1 "$conf {"
+	swanctl_xappend2 "local_addrs = $local_ip"
+	swanctl_xappend2 "remote_addrs = $remote_gateway"
+
+	[ -n "$local_sourceip" ] && swanctl_xappend2 "vips = $local_sourceip"
+	[ -n "$fragmentation" ] && swanctl_xappend2 "fragmentation = $fragmentation"
+	[ -n "$pools" ] && swanctl_xappend2 "pools = $pools"
+
+	local local_auth_method="$auth_method"
+	[ "$auth_method" = "eap-mschapv2" ] && local_auth_method="pubkey"
+
+	swanctl_xappend2 "local {"
+	swanctl_xappend3 "auth = $local_auth_method"
+
+	[ -n "$local_identifier" ] && swanctl_xappend3 "id = \"$local_identifier\""
+	[ "$local_auth_method" = pubkey ] && [ -n "$local_cert" ] && \
+	    swanctl_xappend3 "certs = $local_cert"
+	swanctl_xappend2 "}"
+
+	swanctl_xappend2 "remote {"
+	swanctl_xappend3 "auth = $auth_method"
+	[ -n "$remote_identifier" ] && swanctl_xappend3 "id = \"$remote_identifier\""
+	[ -n "$remote_ca_certs" ] && swanctl_xappend3 "cacerts = \"$remote_ca_certs\""
+	[ "$auth_method" = eap-mschapv2 ] && swanctl_xappend3 "eap_id = $eap_id"
+	swanctl_xappend2 "}"
+
+	swanctl_xappend2 "children {"
+
+	config_list_foreach "$conf" tunnel legacy_config_tunnel
+
+	config_list_foreach "$conf" transport legacy_config_transport
+
+	swanctl_xappend2 "}"
+
+	case "$keyexchange" in
+	ike)
+		;;
+	ikev1)
+		swanctl_xappend2 "version = 1" ;;
+	ikev2)
+		swanctl_xappend2 "version = 2" ;;
+	*)
+		fatal "Keyexchange $keyexchange not supported"
+		keyexchange=
+		;;
+	esac
+
+	[ -n "$send_cert" ] && swanctl_xappend2 "send_cert = $send_cert"
+	[ $send_certreq -eq 1 ] && swanctl_xappend2 "send_certreq = yes" || swanctl_xappend2 "send_certreq = no"
+
+	[ $mobike -eq 1 ] && swanctl_xappend2 "mobike = yes" || swanctl_xappend2 "mobike = no"
+
+	if [ -n "$rekeytime" ]; then
+		swanctl_xappend2 "rekey_time = $rekeytime"
+
+		if [ -z "$overtime" ]; then
+			overtime=$(seconds2time $(($(time2seconds $rekeytime) / 10)))
+		fi
+	fi
+	[ -n "$overtime" ] && swanctl_xappend2 "over_time = $overtime"
+
+	swanctl_xappend2 "proposals = $ike_proposal"
+	[ -n "$dpddelay" ] && swanctl_xappend2 "dpd_delay = $dpddelay"
+	[ $encap -eq 1 ] && swanctl_xappend2 "encap = yes" || swanctl_xappend2 "encap = no"
+	[ "$keyingtries" = "%forever" ] && swanctl_xappend2 "keyingtries = 0" || swanctl_xappend2 "keyingtries = $keyingtries"
+
+	swanctl_xappend1 "}"
+	swanctl_xappend0 "}"
+
+	if [ "$auth_method" = pubkey ]; then
+		swanctl_xappend0 ""
+
+		if [ -n "$ca_cert" ]; then
+			swanctl_xappend0 "authorities {"
+			swanctl_xappend1 "$conf {"
+			swanctl_xappend2 "cacert = $ca_cert"
+			swanctl_xappend1 "}"
+			swanctl_xappend0 "}"
+		fi
+
+	elif [ "$auth_method" = psk ]; then
+		swanctl_xappend0 ""
+
+		swanctl_xappend0 "secrets {"
+		swanctl_xappend1 "ike-$conf {"
+		swanctl_xappend2 "secret = $pre_shared_key"
+		if [ -n "$local_identifier" ]; then
+			swanctl_xappend2 "id1 = $local_identifier"
+			if [ -n "$remote_identifier" ]; then
+				swanctl_xappend2 "id2 = $remote_identifier"
+			fi
+		fi
+		swanctl_xappend1 "}"
+		swanctl_xappend0 "}"
+	elif [ "$auth_method" = eap-mschapv2 ]; then
+		# EAP-MSCHAPv2 secrets are handled in config_mschapv2_secrets globally
+		:  # empty command
+	else
+		fatal "AuthenticationMode $auth_mode not supported"
+	fi
+
+	swanctl_xappend0 ""
+}
+
+legacy_config_ipsec() {
+	local conf="$1"
+
+	local rtinstall_enabled
+	local routing_table
+	local routing_table_id
+	local interface
+	local interface_list
+
+	config_get debug "$conf" debug 0
+	config_get_bool rtinstall_enabled "$conf" rtinstall_enabled 1
+	[ $rtinstall_enabled -eq 1 ] && install_routes=yes || install_routes=no
+
+	# prepare extra charon config option ignore_routing_tables
+	for routing_table in $(config_get "$conf" "ignore_routing_tables"); do
+		if [ "$routing_table" -ge 0 ] 2>/dev/null; then
+			routing_table_id=$routing_table
+		else
+			routing_table_id=$(sed -n '/[ \t]*[0-9]\+[ \t]\+'$routing_table'[ \t]*$/s/[ \t]*\([0-9]\+\).*/\1/p' /etc/iproute2/rt_tables)
+		fi
+
+		[ -n "$routing_table_id" ] && append routing_tables_ignored "$routing_table_id"
+	done
+
+	config_list_foreach "$conf" interface append_var interface_list
+
+	if [ -z "$interface_list" ]; then
+		WAIT_FOR_INTF=0
+	else
+		for interface in $interface_list; do
+			network_get_device device $interface
+			[ -n "$device" ] && append device_list "$device" ","
+		done
+		[ -n "$device_list" ] && WAIT_FOR_INTF=0 || WAIT_FOR_INTF=1
+	fi
+}
+
+legacy_do_postamble() {
+	swan_xappend0 "# generated by /etc/init.d/swanctl"
+	swan_xappend0 "charon {"
+	swan_xappend1 "install_routes = $install_routes"
+	[ -n "$routing_tables_ignored" ] && swan_xappend1 "ignore_routing_tables = $routing_tables_ignored"
+	[ -n "$device_list" ] && swan_xappend1 "interfaces_use = $device_list"
+	swan_xappend1 "start-scripts {"
+	swan_xappend2 "load-all = /usr/sbin/swanctl --load-all --noprompt"
+	swan_xappend1 "}"
+	swan_xappend1 "syslog {"
+	swan_xappend2 "identifier = ipsec"
+	swan_xappend2 "daemon {"
+	swan_xappend3 "default = $debug"
+	swan_xappend2 "}"
+	swan_xappend1 "}"
+	swan_xappend0 "}"
+}
+
+legacy_prepare_env() {
+	mkdir -p /var/ipsec /var/swanctl
+
+	swan_reset
+	swanctl_reset
+
+	# needed by do_postamble
+	local debug install_routes routing_tables_ignored device_list
+
+	swanctl_xappend0 "# generated by /etc/init.d/swanctl"
+
+	config_load ipsec
+	config_foreach legacy_config_ipsec ipsec
+	config_foreach legacy_config_remote remote
+
+	swanctl_xappend0 "# Global config"
+	swanctl_xappend0 ""
+
+	swanctl_xappend0 "pools {"
+	config_foreach config_pool pools
+	swanctl_xappend0 "}"
+
+	swanctl_xappend0 "secrets {"
+	config_foreach config_mschapv2_secret mschapv2_secrets
+	swanctl_xappend0 "}"
+
+	legacy_do_postamble
+}
+
+legacy_service_triggers() {
+	procd_add_reload_trigger "ipsec"
+	config load "ipsec"
+
+	config_foreach legacy_service_trigger_ipsec ipsec
+}
+
+legacy_service_trigger_ipsec() {
+	local interface interface_list
+	config_list_foreach "$1" interface append_var interface_list
+	for interface in $interface_list; do
+		procd_add_reload_interface_trigger $interface
+	done
+}
+
 prepare_env() {
 	mkdir -p /var/ipsec /var/swanctl
 
+	# Use legacy swanctl config generation via /etc/config/ipsec
+	[ -f /etc/config/ipsec ] && {
+		legacy_prepare_env
+		return
+	}
+
 	config_load swanctl
 
 	# Generate /var/ipsec/strongswan.conf
@@ -905,6 +1382,12 @@ stop_service() {
 }
 
 service_triggers() {
+	# Use legacy service_trigger for /etc/config/ipsec
+	[ -f /etc/config/ipsec ] && {
+		legacy_service_triggers
+		return
+	}
+
 	procd_add_reload_trigger "swanctl"
 	config load "swanctl"
 

From 5a6ec39da9c83cce7451b65728805c341cfc6d7a Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Mon, 21 Sep 2026 11:03:09 +0200
Subject: [PATCH 25/25] strongswan: bump PKG_RELEASE to 8

Update 'PKG_RELEASE' to '8'.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 net/strongswan/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/strongswan/Makefile b/net/strongswan/Makefile
index b3eb026d157468..8eb150b3673663 100644
--- a/net/strongswan/Makefile
+++ b/net/strongswan/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=strongswan
 PKG_VERSION:=6.0.7
-PKG_RELEASE:=7
+PKG_RELEASE:=8
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://download.strongswan.org/ https://download2.strongswan.org/