ipsec: T7562: Add support for `disable-uniqreqids` option in IPsec configs

This commit makes `set vpn ipsec disable-uniqreqids` work with the modern
StrongSwan backend by setting `unique=never` in swanctl.conf for connections.
This restores legacy behavior about multiple connections with the same identity.

2 files changed, 32 insertions, 2 deletions

diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py
index 5437711ce..8206218b1 100755
--- a/smoketest/scripts/cli/test_vpn_ipsec.py
+++ b/smoketest/scripts/cli/test_vpn_ipsec.py
@@ -233,6 +233,9 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         self.cli_set(peer_base_path + ['tunnel', '2', 'remote', 'prefix', '10.2.0.0/16'])
         self.cli_set(peer_base_path + ['tunnel', '2', 'priority', priority])
 
+        # Passing the 'unique = never' for StrongSwan's `connections.<conn>.unique` parameter
+        self.cli_set(base_path + ['disable-uniqreqids'])
+
         self.cli_commit()
 
         # Verify strongSwan configuration
@@ -259,6 +262,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
             f'priority = {priority}',
             f'mode = tunnel',
             f'replay_window = 32',
+            'unique = never',
         ]
         for line in swanctl_conf_lines:
             self.assertIn(line, swanctl_conf)
@@ -634,6 +638,9 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         self.cli_set(base_path + ['profile', 'NHRPVPN', 'esp-group', esp_group])
         self.cli_set(base_path + ['profile', 'NHRPVPN', 'ike-group', ike_group])
 
+        # Passing the 'unique = never' for StrongSwan's `connections.<conn>.unique` parameter
+        self.cli_set(base_path + ['disable-uniqreqids'])
+
         self.cli_commit()
 
         swanctl_conf = read_file(swanctl_file)
@@ -646,7 +653,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
             f'local_ts = dynamic[gre]',
             f'remote_ts = dynamic[gre]',
             f'mode = transport',
-            f'secret = {nhrp_secret}'
+            f'secret = {nhrp_secret}',
+            'unique = never',
         ]
         for line in swanctl_lines:
             self.assertIn(line, swanctl_conf)
diff --git a/smoketest/scripts/cli/test_vpn_l2tp.py b/smoketest/scripts/cli/test_vpn_l2tp.py
index 581ebd35d..98f04c088 100755
--- a/smoketest/scripts/cli/test_vpn_l2tp.py
+++ b/smoketest/scripts/cli/test_vpn_l2tp.py
@@ -19,6 +19,10 @@ import unittest
 from base_accel_ppp_test import BasicAccelPPPTest
 from configparser import ConfigParser
 from vyos.utils.process import cmd
+from vyos.utils.file import read_file
+
+
+swanctl_file = '/etc/swanctl/swanctl.conf'
 
 
 class TestVPNL2TPServer(BasicAccelPPPTest.TestCase):
@@ -57,11 +61,16 @@ class TestVPNL2TPServer(BasicAccelPPPTest.TestCase):
     def test_vpn_l2tp_dependence_ipsec_swanctl(self):
         # Test config vpn for tasks T3843 and T5926
 
+        outside_address = '203.0.113.1'
+
         base_path = ['vpn', 'l2tp', 'remote-access']
         # make precondition
         self.cli_set(['interfaces', 'dummy', 'dum0', 'address', '203.0.113.1/32'])
         self.cli_set(['vpn', 'ipsec', 'interface', 'dum0'])
 
+        # Passing the 'unique = never' for StrongSwan's `connections.<conn>.unique` parameter
+        self.cli_set(['vpn', 'ipsec', 'disable-uniqreqids'])
+
         self.cli_commit()
         # check ipsec apply to swanctl
         self.assertEqual('', cmd('echo vyos | sudo -S swanctl -L '))
@@ -76,7 +85,7 @@ class TestVPNL2TPServer(BasicAccelPPPTest.TestCase):
         self.cli_set(base_path + ['ipsec-settings', 'authentication', 'pre-shared-secret', 'SeCret'])
         self.cli_set(base_path + ['ipsec-settings', 'ike-lifetime', '8600'])
         self.cli_set(base_path + ['ipsec-settings', 'lifetime', '3600'])
-        self.cli_set(base_path + ['outside-address', '203.0.113.1'])
+        self.cli_set(base_path + ['outside-address', outside_address])
         self.cli_set(base_path + ['gateway-address', '203.0.113.1'])
 
         self.cli_commit()
@@ -84,6 +93,19 @@ class TestVPNL2TPServer(BasicAccelPPPTest.TestCase):
         # check l2tp apply to swanctl
         self.assertTrue('l2tp_remote_access:' in cmd('echo vyos | sudo -S swanctl -L '))
 
+        swanctl_conf = read_file(swanctl_file)
+        swanctl_lines = [
+            f'local_addrs = {outside_address}',
+            'proposals = aes256-sha1-modp1024,3des-sha1-modp1024',
+            'dpd_delay = 15s',
+            'dpd_timeout = 45s',
+            'rekey_time = 8600s',
+            'reauth_time = 0',
+            'unique = never',
+        ]
+        for line in swanctl_lines:
+            self.assertIn(line, swanctl_conf)
+
         self.cli_delete(['vpn', 'l2tp'])
         self.cli_commit()