From d1cc3ed65eb1f00409d0b91fc8149431fb614e89 Mon Sep 17 00:00:00 2001
From: Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io>
Date: Tue, 15 Sep 2026 12:10:16 +0300
Subject: ipsec: T8952: Allow per-peer strongSwan `unique` override for
 site-to-site peers

VyOS does not expose the strongSwan `connections.<conn>.unique`
parameter for site-to-site peers. The swanctl default is
`unique = no`, which only replaces existing SAs
if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`,
charon initiates new IKE_SAs without `INITIAL_CONTACT`,
so duplicates accumulate on every DPD timeout.

Previously the strongSwan `unique` connection policy could only be
driven by the global "disable-uniqreqids" option, which set it to
"never" for every connection. Site-to-site peers had no way to opt
into stricter enforcement on their own.
---
 .../include/vpn-ipsec-unique.xml.i                 | 25 ++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 interface-definitions/include/vpn-ipsec-unique.xml.i

(limited to 'interface-definitions/include')

diff --git a/interface-definitions/include/vpn-ipsec-unique.xml.i b/interface-definitions/include/vpn-ipsec-unique.xml.i
new file mode 100644
index 000000000..bff64fee3
--- /dev/null
+++ b/interface-definitions/include/vpn-ipsec-unique.xml.i
@@ -0,0 +1,25 @@
+<!-- include start from vpn-ipsec-unique.xml.i -->
+<leafNode name="unique">
+  <properties>
+    <help>Connection uniqueness enforcement policy</help>
+    <completionHelp>
+      <list>never keep replace</list>
+    </completionHelp>
+    <valueHelp>
+      <format>never</format>
+      <description>Never enforce connection uniqueness</description>
+    </valueHelp>
+    <valueHelp>
+      <format>keep</format>
+      <description>Reject new connection attempts if the same peer has an active connection</description>
+    </valueHelp>
+    <valueHelp>
+      <format>replace</format>
+      <description>Delete existing connections when a new connection is established for the same peer</description>
+    </valueHelp>
+    <constraint>
+      <regex>(never|keep|replace)</regex>
+    </constraint>
+  </properties>
+</leafNode>
+<!-- include end -->
-- 
cgit v1.2.3