Add uniqueids=never to ignore INITIAL_CONTACT notifies

With uniqueids=no the daemon still deletes any existing IKE_SA with the
same peer if an INITIAL_CONTACT notify is received.  With this new option
it also ignores these notifies.

man/ipsec.conf.5.in

@@ -1035,19 +1035,26 @@ if at least one CRL URI is defined and to
 .B no
 if no URI is known.
 .TP
-.BR uniqueids " = " yes " | no | replace | keep"
+.BR uniqueids " = " yes " | no | never | replace | keep"
 whether a particular participant ID should be kept unique,
-with any new (automatically keyed)
+with any new IKE_SA using an ID deemed to replace all old ones using that ID;
-connection using an ID from a different IP address
-deemed to replace all old ones using that ID;
 acceptable values are
-.B yes
+.BR yes ,
 (the default)
+.B no
 and
-.BR no .
+.BR never .
-Participant IDs normally \fIare\fR unique,
+Participant IDs normally \fIare\fR unique, so a new IKE_SA using the same ID is
-so a new (automatically-keyed) connection using the same ID is
+almost invariably intended to replace an old one. The difference between
-almost invariably intended to replace an old one.
+.B no
+and
+.B never
+is that the daemon will replace old IKE_SAs when receving an INITIAL_CONTACT
+notify when the option is
+.B no
+but will ignore these notifies if
+.B never
+is configured.
 The daemon also accepts the value
 .B replace
 which is identical to

src/libcharon/config/peer_cfg.h

@@ -81,11 +81,13 @@ extern enum_name_t *cert_policy_names;
  * Uniqueness of an IKE_SA, used to drop multiple connections with one peer.
  */
 enum unique_policy_t {
-	/** do not check for client uniqueness */
+	/** never check for client uniqueness */
+	UNIQUE_NEVER,
+	/** only check for client uniqueness when receiving an INITIAL_CONTACT */
 	UNIQUE_NO,
-	/** replace unique IKE_SAs if new ones get established */
+	/** replace existing IKE_SAs when new ones get established by a client */
 	UNIQUE_REPLACE,
-	/** keep existing IKE_SAs, close the new ones on connection attept */
+	/** keep existing IKE_SAs, close the new ones on connection attempt */
 	UNIQUE_KEEP,
 };
 

src/libcharon/plugins/stroke/stroke_config.c

@@ -690,6 +690,9 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 		case 3: /* keep */
 			unique = UNIQUE_KEEP;
 			break;
+		case 4: /* never */
+			unique = UNIQUE_NEVER;
+			break;
 		default: /* no */
 			unique = UNIQUE_NO;
 			break;

src/libcharon/sa/ike_sa_manager.c

@@ -1711,7 +1711,7 @@ METHOD(ike_sa_manager_t, check_uniqueness, bool,
 
 	peer_cfg = ike_sa->get_peer_cfg(ike_sa);
 	policy = peer_cfg->get_unique_policy(peer_cfg);
-	if (policy == UNIQUE_NO && !force_replace)
+	if (policy == UNIQUE_NEVER || (policy == UNIQUE_NO && !force_replace))
 	{
 		return FALSE;
 	}

src/libcharon/sa/ikev2/tasks/ike_auth.c

@@ -435,7 +435,8 @@ METHOD(task_t, build_i, status_t,
 		message->add_payload(message, (payload_t*)id_payload);
 
 		if (idr && message->get_message_id(message) == 1 &&
-			this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO)
+			this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NO &&
+			this->peer_cfg->get_unique_policy(this->peer_cfg) != UNIQUE_NEVER)
 		{
 			host_t *host;
 

src/starter/args.c

@@ -61,6 +61,7 @@ static const char *LST_unique[] = {
 	"yes",
 	"replace",
 	"keep",
+	"never",
 	 NULL
 };