From 9fce366fe5171b076fef9dc18a44408e6d2a26af Mon Sep 17 00:00:00 2001
From: Florian Eckert <fe@dev.tdt.de>
Date: Tue, 8 Sep 2026 13:17:51 +0200
Subject: [PATCH] strongswan: unify tunnel/transport child sections to add
 further child modes

Migrate the uci section types 'tunnel' and 'transport' in
'/etc/config/ipsec' into a single 'child' section type, distinguished
by a new 'mode' option ('tunnel' or 'transport') for now. Existing 'mode'
values are preserved.

The 'remote' sections keep their type, but their 'list tunnel' and
'list transport' references (which point to the renamed child
sections by name) are merged into a single 'list child'.

Rationale:
* 'tunnel' and 'transport' sections already share the same set of
  options (local_subnet, remote_subnet, crypto_proposal, etc.) and
  only ever differed by IPsec mode. Modeling that as data (a 'mode'
  option) instead of as two separate section types removes
  duplicated schema/parsing logic and mirrors how 'swanctl.conf' itself
  expresses mode on a single 'children' entry.
* Adding further modes (e.g. 'beet') in the future only requires
  extending the allowed values of 'mode', not introducing another
  section type and duplicating its option set.

The existing configuration is also migrated to the new uci layout using a
uci-defaults script.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
---
 .../files/etc/uci-defaults/strongswan         | 58 +++++++++++++++++++
 net/strongswan/files/swanctl.init             | 24 ++++----
 2 files changed, 69 insertions(+), 13 deletions(-)

diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 894806daee..bfe4df5431 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -139,6 +139,63 @@ migrate_local_sourceip() {
 	config_foreach migrate_local_sourceip_vips remote
 }
 
+migrate_to_child() {
+	local tunnel_sections=""
+	local transport_sections=""
+	local remote_sections=""
+
+	local section
+
+	collect_tunnel() {
+		tunnel_sections="${tunnel_sections} $1"
+	}
+	collect_transport() {
+		transport_sections="${transport_sections} $1"
+	}
+	collect_remote() {
+		remote_sections="${remote_sections} $1"
+	}
+
+	config_load "ipsec"
+	config_foreach collect_tunnel "tunnel"
+	config_foreach collect_transport "transport"
+	config_foreach collect_remote "remote"
+
+	migrate_simple() {
+		local cfg="$1"
+		local mode="$2"
+
+		uci set ipsec.${cfg}=child
+		uci -q set ipsec.${cfg}.mode="$mode"
+	}
+
+	for section in $tunnel_sections; do
+		migrate_simple "$section" "tunnel"
+	done
+
+	for section in $transport_sections; do
+		migrate_simple "$section" "transport"
+	done
+
+	for section in $remote_sections; do
+		local tunnel_refs=""
+		local transport_refs=""
+
+		config_get tunnel_refs "$section" tunnel ""
+		config_get transport_refs "$section" transport ""
+
+		if [ -n "$tunnel_refs" ] || [ -n "$transport_refs" ]; then
+			uci -q delete ipsec.${section}.tunnel
+			uci -q delete ipsec.${section}.transport
+			for ref in $tunnel_refs $transport_refs; do
+				uci add_list ipsec.${section}.child="$ref"
+			done
+		fi
+	done
+
+	uci commit ipsec
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -147,6 +204,7 @@ main() {
 	migrate_remote_gateway
 	migrate_local_ip
 	migrate_local_sourceip
+	migrate_to_child
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 53d3100b80..7e6cae2152 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -221,10 +221,9 @@ iter_ike_proposal() {
 }
 
 config_child() {
-	# Generic ipsec conn section shared by tunnel and transport
 	local conf="$1"
-	local mode="$2"
 
+	local mode
 	local startaction
 	local updown
 	local firewall
@@ -245,6 +244,7 @@ config_child() {
 	local local_subnet
 	local remote_subnet
 
+	config_get mode "$conf" mode
 	config_get startaction "$conf" startaction "route"
 	config_get updown "$conf" updown ""
 	config_get firewall "$conf" firewall ""
@@ -266,6 +266,14 @@ config_child() {
 	config_list_foreach "$conf" local_subnet append_var local_subnet ","
 	config_list_foreach "$conf" remote_subnet append_var remote_subnet ","
 
+	case "$mode" in
+		tunnel|transport)
+			;;
+		*)
+			fatal "mode value '$mode' invalid"
+		;;
+	esac
+
 	local esp_proposal
 	iter_esp_proposal "$conf" esp_proposal
 
@@ -373,14 +381,6 @@ config_child() {
 	swanctl_xappend3 "}"
 }
 
-config_tunnel() {
-	config_child "$1" "tunnel"
-}
-
-config_transport() {
-	config_child "$1" "transport"
-}
-
 config_pool() {
 	local conf="$1"
 
@@ -570,9 +570,7 @@ config_remote() {
 
 	swanctl_xappend2 "children {"
 
-	config_list_foreach "$conf" tunnel config_tunnel
-
-	config_list_foreach "$conf" transport config_transport
+	config_list_foreach "$conf" child config_child
 
 	swanctl_xappend2 "}"