From 527c1f1183c9522b58d892989406a0c75f6105ca Mon Sep 17 00:00:00 2001 From: Dharmik Parmar Date: Fri, 19 Jun 2026 19:20:32 +0530 Subject: [PATCH] libreswan: fix default subnet matching Match only explicit default-route subnet tokens when normalizing leftsubnets and rightsubnets. The previous regex treated dots as wildcards. Values such as 10.250.0.0/16 and 10.0.0.0/8 were rewritten to 0.0.0.0/0. Fixes: https://github.com/openwrt/openwrt/issues/23795 Signed-off-by: Dharmik Parmar --- net/libreswan/Makefile | 2 +- net/libreswan/files/etc/init.d/ipsec | 20 ++++++++++++++------ 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/net/libreswan/Makefile b/net/libreswan/Makefile index 0a5de5aaef..30cd3003de 100644 --- a/net/libreswan/Makefile +++ b/net/libreswan/Makefile @@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=libreswan PKG_VERSION:=4.12 -PKG_RELEASE:=4 +PKG_RELEASE:=5 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz PKG_SOURCE_URL:=https://download.libreswan.org/ diff --git a/net/libreswan/files/etc/init.d/ipsec b/net/libreswan/files/etc/init.d/ipsec index 8a94785283..8025388c0a 100644 --- a/net/libreswan/files/etc/init.d/ipsec +++ b/net/libreswan/files/etc/init.d/ipsec @@ -78,6 +78,14 @@ expand_phase2alg() { phase2alg_proposal="${encryption_algorithm:+${encryption_algorithm// /+}${hash_algorithm:+-${hash_algorithm// /+}${dh_group:+-${dh_group// /+}}}}" } +append_subnet() { + local subnet="$1" + local var="$2" + + [ "$subnet" = "0.0.0.0" ] && subnet="0.0.0.0/0" + append "$var" "$subnet" "," +} + generate_tunnel_config() { local id=$1 local config_file="$IPSEC_CONF_DIR/$id.conf" @@ -95,8 +103,6 @@ generate_tunnel_config() { config_get rightid "$id" rightid "$right" config_get leftsourceip "$id" leftsourceip config_get rightsourceip "$id" rightsourceip - config_get leftsubnets "$id" leftsubnets - config_get rightsubnets "$id" rightsubnets config_get_bool ikev2 "$id" ikev2 [ "$ikev2" = "1" ] && ikev2=yes || ikev2=no config_get_bool rekey "$id" rekey @@ -111,20 +117,22 @@ generate_tunnel_config() { config_get nflog "$id" nflog 0 [ "$nflog" = "0" ] && unset nflog + leftsubnets="" + rightsubnets="" config_list_foreach "$id" ike expand_ike config_list_foreach "$id" phase2alg expand_phase2alg + config_list_foreach "$id" leftsubnets append_subnet leftsubnets + config_list_foreach "$id" rightsubnets append_subnet rightsubnets config_get authby "$id" authby config_get psk "$id" psk if [ -n "$leftsubnets" ]; then - [[ "$leftsubnets" =~ 0.0.0.0* ]] && leftsubnets="0.0.0.0/0" - leftsubnets="{${leftsubnets// /,}}" + leftsubnets="{${leftsubnets}}" fi if [ -n "$rightsubnets" ]; then - [[ "$rightsubnets" =~ 0.0.0.0* ]] && rightsubnets="0.0.0.0/0" - rightsubnets="{${rightsubnets// /,}}" + rightsubnets="{${rightsubnets}}" fi config_get interface "$id" interface