implemented IKE_SA uniqueness using ipsec.conf uniqueids paramater

additionally supports a "keep" value to keep the old IKE_SA

src/starter/args.c

@@ -62,6 +62,14 @@ static const char *LST_sendcert[] = {
      NULL
 };
 
+static const char *LST_unique[] = {
+    "no",
+    "yes",
+    "replace",
+    "keep",
+     NULL
+};
+
 static const char *LST_strict[] = {
     "no",
     "yes",
@@ -163,7 +171,7 @@ static const token_info_t token_info[] =
     { ARG_STR,  offsetof(starter_config_t, setup.charondebug),  NULL               },
     { ARG_STR,  offsetof(starter_config_t, setup.prepluto), NULL                   },
     { ARG_STR,  offsetof(starter_config_t, setup.postpluto), NULL                  },
-    { ARG_ENUM, offsetof(starter_config_t, setup.uniqueids), LST_bool              },
+    { ARG_ENUM, offsetof(starter_config_t, setup.uniqueids), LST_unique            },
     { ARG_UINT, offsetof(starter_config_t, setup.overridemtu), NULL                },
     { ARG_TIME, offsetof(starter_config_t, setup.crlcheckinterval), NULL           },
     { ARG_ENUM, offsetof(starter_config_t, setup.cachecrls), LST_bool              },

src/starter/ipsec.conf.5

@@ -1049,6 +1049,13 @@ and
 Participant IDs normally \fIare\fR unique,
 so a new (automatically-keyed) connection using the same ID is
 almost invariably intended to replace an old one.
+The IKEv2 daemon also accepts the value
+.B replace
+wich is identical to
+.B yes
+and the value
+.B keep
+to reject new IKE_SA setups and keep the duplicate established earlier.
 .PP
 The following
 .B config section

src/starter/starterstroke.c

@@ -257,6 +257,7 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn)
 	msg.add_conn.mobike = conn->policy & POLICY_MOBIKE;
 	msg.add_conn.force_encap = conn->policy & POLICY_FORCE_ENCAP;
 	msg.add_conn.crl_policy = cfg->setup.strictcrlpolicy;
+	msg.add_conn.unique = cfg->setup.uniqueids;
 	msg.add_conn.algorithms.ike = push_string(&msg, conn->ike);
 	msg.add_conn.algorithms.esp = push_string(&msg, conn->esp);
 	msg.add_conn.dpd.delay = conn->dpd_delay;