ipsec: T8912: Fix log level not respected in system journal

When setting 'vpn ipsec logging log-level 0', DPD informational
messages (log level 1) were still appearing in the system journal.

The root cause is that charon-systemd reads both `charon-systemd.conf`
and `charon-logging.conf` and applies the higher of the two log levels
to the journal. The VyOS only managed `charon-systemd.conf`, leaving
`charon-logging.conf` at its default level of 1, which silently overrode
the user-configured level.

Fix this by rendering `charon-logging.conf` on every commit with
syslog backend set to -1 (silent), making `charon-systemd.conf`
the sole authoritative source for journal log verbosity.

This also eliminates duplicate log entries in the journal that occurred
when both backends were active and writing to the same destination.

1 files changed, 11 insertions, 1 deletions

diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index 35b00dada..f268f0861 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -66,6 +66,7 @@ charon_conf        = '/etc/strongswan.d/charon.conf'
 charon_dhcp_conf   = '/etc/strongswan.d/charon/dhcp.conf'
 charon_radius_conf = '/etc/strongswan.d/charon/eap-radius.conf'
 charon_systemd_conf = '/etc/strongswan.d/charon-systemd.conf'
+charon_logging_conf = '/etc/strongswan.d/charon-logging.conf'
 interface_conf     = '/etc/strongswan.d/interfaces_use.conf'
 swanctl_conf       = f'{swanctl_dir}/swanctl.conf'
 
@@ -783,7 +784,15 @@ def generate(ipsec):
     cleanup_pki_files()
 
     if not ipsec or 'deleted' in ipsec:
-        for config_file in [charon_dhcp_conf, charon_radius_conf, interface_conf, swanctl_conf]:
+        delete_files = (
+            charon_dhcp_conf,
+            charon_radius_conf,
+            charon_systemd_conf,
+            charon_logging_conf,
+            interface_conf,
+            swanctl_conf,
+        )
+        for config_file in delete_files:
             if os.path.isfile(config_file):
                 os.unlink(config_file)
         render(charon_conf, 'ipsec/charon.j2', {'install_routes': default_install_routes})
@@ -882,6 +891,7 @@ def generate(ipsec):
     render(charon_dhcp_conf, 'ipsec/charon/dhcp.conf.j2', ipsec)
     render(charon_radius_conf, 'ipsec/charon/eap-radius.conf.j2', ipsec)
     render(charon_systemd_conf, 'ipsec/charon_systemd.conf.j2', ipsec)
+    render(charon_logging_conf, 'ipsec/charon_logging.conf.j2', ipsec)
     render(interface_conf, 'ipsec/interfaces_use.conf.j2', ipsec)
     render(swanctl_conf, 'ipsec/swanctl.conf.j2', ipsec)