libreswan: fix default subnet matching

[dhrm1k]

Match only explicit default-route subnet tokens when normalizing leftsubnets
and rightsubnets.

The previous regex treated dots as wildcards, so values such as
10.250.0.0/16 and 10.0.0.0/8 could be rewritten to 0.0.0.0/0.

Fixes: openwrt/openwrt#23795

📦 Package Details

Maintainer: Lucian Cristian lucian.cristian@gmail.com (@lucize)

Description:
Fix the libreswan UCI init script so it only normalizes an explicit default
route subnet token, 0.0.0.0 or 0.0.0.0/0, instead of matching unrelated
private subnets that happen to contain 0.0.0.0 in the string.

---

🧪 Run Testing Details

• OpenWrt Version: 25.12.2
• OpenWrt Target/Subtarget: x86/64
• OpenWrt Device: libvirt OpenWrt VM

Reproduced the issue on the VM with a temporary /etc/config/libreswan tunnel
containing:

list leftsubnets '10.250.0.0/16'
list rightsubnets '10.0.0.0/8'

Before this change, /etc/init.d/ipsec start generated:

leftsubnets={0.0.0.0/0}
rightsubnets={0.0.0.0/0}

Also tested the new subnet matching helper in the VM shell:

FIX_NO:10.250.0.0/16
FIX_NO:10.0.0.0/8
FIX_NO:192.168.0.0/16
FIX_MATCH:0.0.0.0/0
FIX_MATCH:0.0.0.0
FIX_MATCH:10.0.0.0/8 0.0.0.0/0

Local checks:

git diff --check
sh -n feeds/packages/net/libreswan/files/etc/init.d/ipsec
make package/feeds/packages/libreswan/download V=s
make package/feeds/packages/libreswan/check V=s

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

• Not applicable, this PR does not add or modify an upstream source patch.

[pprindeville]

Not sure I understand why a loop is used for a single argument...

[pprindeville]

Why a for loop if it's only $1 and not $@? Also there's no shift... Have a look at what net/strongswan/files/swanctl.init does with the same argument...

[dhrm1k]

Not sure I understand why a loop is used for a single argument...

Ah yes. I was treating the value from config_get as a spaceseparated subnet
list and then looping over the words in $1.

Would you prefer that I change this so the helper iterates over "$@", with the
call sites passing the subnet list as normal positional arguments?

That would make the intent clearer, and there would be no shift needed since
there is no leading argument to consume.

[pprindeville]

@dhrm1k: Since it's a list shouldn't we use config_list_foreach in that case?

[alvinstarr]

The left and right subnets are lists and I am not completely sure of the value searching for 0.0.0.0{/0}.
It seems to me just taking the value passed and using that would be the best.
Otherwise you should also check for an error like 10.250.0.0/16,10.250.1.0/24. or things like overlapping networks.
converting 0.0.0.0 to 0.0.0.0/0 may be a reasonable solution to people missing the /0.
Possibly a better check would be to disallow anything that does not have x.x.x.x/y.

[pprindeville]

Possibly a better check would be to disallow anything that does not have x.x.x.x/y.

I could live with that.

[dhrm1k]

I changed this and pushed it again.

It now uses config_list_foreach for both leftsubnets and rightsubnets, so
each UCI list item is handled directly.

I kept the actual behavior change small. 0.0.0.0 is normalized to
0.0.0.0/0, 0.0.0.0/0 is left as-is, and other subnet values are passed
through unchanged.

[lucize]

LGTM, will see what will be pushed first #29806

[dhrm1k]

LGTM, will see what will be pushed first #29806

sure. thanks for looking into it!

[pprindeville]

LGTM