@marcquark
Hi
I also struggled with SA duplicates for a long time , and as a result I wrote my own small program ( С ) that interacts with FreeBSD kernel ( PF_KEY Key Management API ) and Strongswan ( Vici and Stroke Protocol ) .
This program receives messages from the kernel when a new SA is installed and checks how many are currently in the system . If it finds a duplicate, it sends a Strongswan message to delete the duplicate
Here's what it looks like
Jun 16 10:05:43 daemon sa_checker started
Jun 16 10:05:43 [KNL] successfully connected to PF_KEY_V2 socket
Jun 16 10:05:54 [KNL] received message from kernel,type of message SADB_DELETE,errno = 0 ,seq number = 53850
Jun 16 10:05:54 [KNL] parsed data : SPI = 0xcecde75d , SRC ADDRESS = 10.3.100.100 , DST ADDRESS = 10.3.100.1
Jun 16 10:05:54 [KNL] received message from kernel,type of message SADB_ADD,errno = 0 ,seq number = 53851
Jun 16 10:05:54 [KNL] parsed data : REQID = 0x3e8, SPI = 0xcecde75d , SRC ADDRESS = 10.3.100.100 , DST ADDRESS = 10.3.100.1, SA TYPE = IPsec ESP
Jun 16 10:05:54 [KNL] received message from kernel,type of message SADB_ADD,errno = 0 ,seq number = 53852
Jun 16 10:05:54 [KNL] parsed data : REQID = 0x3e8, SPI = 0xc459c817 , SRC ADDRESS = 10.3.100.1 , DST ADDRESS = 10.3.100.100, SA TYPE = IPsec ESP
Jun 16 10:05:55 [KNL] successfully connected to stroke socket
Jun 16 10:05:55 [KNL] stroke message successfully sended,waiting for reply ....
Jun 16 10:05:55 [KNL] server reply is ' con1000{243}: INSTALLED, TUNNEL, reqid 1000, ESP SPIs: cb0c99c0_i c0d72295_o '
Jun 16 10:05:55 [KNL] server reply is ' con1000{244}: INSTALLED, TUNNEL, reqid 1000, ESP SPIs: cecde75d_i c459c817_o '
Jun 16 10:05:55 [IKE] total child's SA for deleting 1
Jun 16 10:05:55 [IKE] CHILD SA for deleting 243
Jun 16 10:05:55 [IKE] closing CHILD_SA con1000{243} with SPIs cb0c99c0_i (172 bytes) c0d72295_o (71116 bytes) and TS 0.0.0.0/0|/0 === 0.0.0.0/0|/0
Jun 16 10:05:55 [IKE] sending DELETE for ESP CHILD_SA with SPI cb0c99c0
Jun 16 10:05:55 [ENC] generating INFORMATIONAL request 1535 [ D ]
Jun 16 10:05:55 [NET] sending packet: from 10.3.100.1[500] to 10.3.100.100[500] (80 bytes)
Jun 16 10:05:55 [NET] received packet: from 10.3.100.100[500] to 10.3.100.1[500] (80 bytes)
Jun 16 10:05:55 [ENC] parsed INFORMATIONAL response 1535 [ D ]
Jun 16 10:05:55 [IKE] received DELETE for ESP CHILD_SA with SPI c0d72295
Jun 16 10:05:55 [IKE] CHILD_SA closed
Jun 16 10:05:55 [IKE] CHILD SA with uniqueid 243 has deleted successfully
Jun 16 10:05:55 [KNL] received message from kernel,type of message SADB_DELETE,errno = 0 ,seq number = 53853
Jun 16 10:05:55 [KNL] parsed data : SPI = 0xc5cdc8dd , SRC ADDRESS = 10.3.100.102 , DST ADDRESS = 10.3.100.1
Jun 16 10:05:55 [KNL] received message from kernel,type of message SADB_ADD,errno = 0 ,seq number = 53854
Jun 16 10:05:55 [KNL] parsed data : REQID = 0x7d0, SPI = 0xc5cdc8dd , SRC ADDRESS = 10.3.100.102 , DST ADDRESS = 10.3.100.1, SA TYPE = IPsec ESP
Jun 16 10:05:55 [KNL] received message from kernel,type of message SADB_ADD,errno = 0 ,seq number = 53855
Jun 16 10:05:55 [KNL] parsed data : REQID = 0x7d0, SPI = 0xcd2b03b8 , SRC ADDRESS = 10.3.100.1 , DST ADDRESS = 10.3.100.102, SA TYPE = IPsec ESP
Jun 16 10:05:56 [KNL] successfully connected to stroke socket
Jun 16 10:05:56 [KNL] stroke message successfully sended,waiting for reply ....
Jun 16 10:05:56 [KNL] server reply is ' con2000{242}: INSTALLED, TUNNEL, reqid 2000, ESP SPIs: ca05bb45_i c4a73853_o '
Jun 16 10:05:56 [KNL] server reply is ' con2000{245}: INSTALLED, TUNNEL, reqid 2000, ESP SPIs: c5cdc8dd_i cd2b03b8_o '
Jun 16 10:05:56 [IKE] total child's SA for deleting 1
Jun 16 10:05:56 [IKE] CHILD SA for deleting 242
Jun 16 10:05:56 [IKE] closing CHILD_SA con2000{242} with SPIs ca05bb45_i (0 bytes) c4a73853_o (216292 bytes) and TS 0.0.0.0/0|/0 === 0.0.0.0/0|/0
Jun 16 10:05:56 [IKE] sending DELETE for ESP CHILD_SA with SPI ca05bb45
Jun 16 10:05:56 [ENC] generating INFORMATIONAL request 127 [ D ]
Jun 16 10:05:56 [NET] sending packet: from 10.3.100.1[500] to 10.3.100.102[500] (80 bytes)
Jun 16 10:05:56 [NET] received packet: from 10.3.100.102[500] to 10.3.100.1[500] (80 bytes)
Jun 16 10:05:56 [ENC] parsed INFORMATIONAL response 127 [ D ]
Jun 16 10:05:56 [IKE] received DELETE for ESP CHILD_SA with SPI c4a73853
Jun 16 10:05:56 [IKE] CHILD_SA closed
Jun 16 10:05:56 [IKE] CHILD SA with uniqueid 242 has deleted successfully
If you are interested, I can give you a program for the test