FIPS Product: YES
FIPS Kernel: NO
FIPS Mode: NO
NSS DB directory: sql:/etc/ipsec.d
Initializing NSS
Opening NSS database "sql:/etc/ipsec.d" read-only
NSS initialized
NSS crypto library initialized
FIPS HMAC integrity support [enabled]
FIPS mode disabled for pluto daemon
FIPS HMAC integrity verification self-test FAILED
libcap-ng support [enabled]
Linux audit support [enabled]
Linux audit activated
Starting Pluto (Libreswan Version v3.28-685-gbfd5aef521-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:14467
core dump dir: /tmp
secrets file: /etc/ipsec.secrets
leak-detective enabled
NSS crypto [enabled]
XAUTH PAM support [enabled]
| libevent is using pluto's memory allocator
Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800)
| libevent_malloc: new ptr-libevent@0x556f68304768 size 40
| libevent_malloc: new ptr-libevent@0x556f683046e8 size 40
| libevent_malloc: new ptr-libevent@0x556f68304668 size 40
| creating event base
| libevent_malloc: new ptr-libevent@0x556f682f6298 size 56
| libevent_malloc: new ptr-libevent@0x556f6827fda8 size 664
| libevent_malloc: new ptr-libevent@0x556f6833ed88 size 24
| libevent_malloc: new ptr-libevent@0x556f6833edd8 size 384
| libevent_malloc: new ptr-libevent@0x556f6833ed48 size 16
| libevent_malloc: new ptr-libevent@0x556f683045e8 size 40
| libevent_malloc: new ptr-libevent@0x556f68304568 size 48
| libevent_realloc: new ptr-libevent@0x556f6827fa38 size 256
| libevent_malloc: new ptr-libevent@0x556f6833ef88 size 16
| libevent_free: release ptr-libevent@0x556f682f6298
| libevent initialized
| libevent_realloc: new ptr-libevent@0x556f682f6298 size 64
| global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds
| init_nat_traversal() initialized with keep_alive=0s
NAT-Traversal support  [enabled]
| global one-shot timer EVENT_NAT_T_KEEPALIVE initialized
| global one-shot timer EVENT_FREE_ROOT_CERTS initialized
| global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds
| global one-shot timer EVENT_REVIVE_CONNS initialized
| global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds
| global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds
Encryption algorithms:
  AES_CCM_16              IKEv1:     ESP     IKEv2:     ESP     FIPS  {256,192,*128}  aes_ccm, aes_ccm_c
  AES_CCM_12              IKEv1:     ESP     IKEv2:     ESP     FIPS  {256,192,*128}  aes_ccm_b
  AES_CCM_8               IKEv1:     ESP     IKEv2:     ESP     FIPS  {256,192,*128}  aes_ccm_a
  3DES_CBC                IKEv1: IKE ESP     IKEv2: IKE ESP     FIPS  [*192]  3des
  CAMELLIA_CTR            IKEv1:     ESP     IKEv2:     ESP           {256,192,*128}
  CAMELLIA_CBC            IKEv1: IKE ESP     IKEv2: IKE ESP           {256,192,*128}  camellia
  AES_GCM_16              IKEv1:     ESP     IKEv2: IKE ESP     FIPS  {256,192,*128}  aes_gcm, aes_gcm_c
  AES_GCM_12              IKEv1:     ESP     IKEv2: IKE ESP     FIPS  {256,192,*128}  aes_gcm_b
  AES_GCM_8               IKEv1:     ESP     IKEv2: IKE ESP     FIPS  {256,192,*128}  aes_gcm_a
  AES_CTR                 IKEv1: IKE ESP     IKEv2: IKE ESP     FIPS  {256,192,*128}  aesctr
  AES_CBC                 IKEv1: IKE ESP     IKEv2: IKE ESP     FIPS  {256,192,*128}  aes
  SERPENT_CBC             IKEv1: IKE ESP     IKEv2: IKE ESP           {256,192,*128}  serpent
  TWOFISH_CBC             IKEv1: IKE ESP     IKEv2: IKE ESP           {256,192,*128}  twofish
  TWOFISH_SSH             IKEv1: IKE         IKEv2: IKE ESP           {256,192,*128}  twofish_cbc_ssh
  NULL_AUTH_AES_GMAC      IKEv1:     ESP     IKEv2:     ESP     FIPS  {256,192,*128}  aes_gmac
  NULL                    IKEv1:     ESP     IKEv2:     ESP           []
  CHACHA20_POLY1305       IKEv1:             IKEv2: IKE ESP           [*256]  chacha20poly1305
Hash algorithms:
  MD5                     IKEv1: IKE         IKEv2:                 
  SHA1                    IKEv1: IKE         IKEv2:             FIPS  sha
  SHA2_256                IKEv1: IKE         IKEv2:             FIPS  sha2, sha256
  SHA2_384                IKEv1: IKE         IKEv2:             FIPS  sha384
  SHA2_512                IKEv1: IKE         IKEv2:             FIPS  sha512
PRF algorithms:
  HMAC_MD5                IKEv1: IKE         IKEv2: IKE               md5
  HMAC_SHA1               IKEv1: IKE         IKEv2: IKE         FIPS  sha, sha1
  HMAC_SHA2_256           IKEv1: IKE         IKEv2: IKE         FIPS  sha2, sha256, sha2_256
  HMAC_SHA2_384           IKEv1: IKE         IKEv2: IKE         FIPS  sha384, sha2_384
  HMAC_SHA2_512           IKEv1: IKE         IKEv2: IKE         FIPS  sha512, sha2_512
  AES_XCBC                IKEv1:             IKEv2: IKE               aes128_xcbc
Integrity algorithms:
  HMAC_MD5_96             IKEv1: IKE ESP AH  IKEv2: IKE ESP AH        md5, hmac_md5
  HMAC_SHA1_96            IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  sha, sha1, sha1_96, hmac_sha1
  HMAC_SHA2_512_256       IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  sha512, sha2_512, sha2_512_256, hmac_sha2_512
  HMAC_SHA2_384_192       IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  sha384, sha2_384, sha2_384_192, hmac_sha2_384
  HMAC_SHA2_256_128       IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256
  HMAC_SHA2_256_TRUNCBUG  IKEv1:     ESP AH  IKEv2:         AH      
  AES_XCBC_96             IKEv1:     ESP AH  IKEv2: IKE ESP AH        aes_xcbc, aes128_xcbc, aes128_xcbc_96
  AES_CMAC_96             IKEv1:     ESP AH  IKEv2:     ESP AH  FIPS  aes_cmac
  NONE                    IKEv1:     ESP     IKEv2: IKE ESP     FIPS  null
DH algorithms:
  NONE                    IKEv1:             IKEv2: IKE ESP AH  FIPS  null, dh0
  MODP1536                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH        dh5
  MODP2048                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh14
  MODP3072                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh15
  MODP4096                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh16
  MODP6144                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh17
  MODP8192                IKEv1: IKE ESP AH  IKEv2: IKE ESP AH  FIPS  dh18
  DH19                    IKEv1: IKE         IKEv2: IKE ESP AH  FIPS  ecp_256, ecp256
  DH20                    IKEv1: IKE         IKEv2: IKE ESP AH  FIPS  ecp_384, ecp384
  DH21                    IKEv1: IKE         IKEv2: IKE ESP AH  FIPS  ecp_521, ecp521
  DH31                    IKEv1: IKE         IKEv2: IKE ESP AH        curve25519
testing CAMELLIA_CBC:
  Camellia: 16 bytes with 128-bit key
  Camellia: 16 bytes with 128-bit key
  Camellia: 16 bytes with 256-bit key
  Camellia: 16 bytes with 256-bit key
testing AES_GCM_16:
  empty string
  one block
  two blocks
  two blocks with associated data
testing AES_CTR:
  Encrypting 16 octets using AES-CTR with 128-bit key
  Encrypting 32 octets using AES-CTR with 128-bit key
  Encrypting 36 octets using AES-CTR with 128-bit key
  Encrypting 16 octets using AES-CTR with 192-bit key
  Encrypting 32 octets using AES-CTR with 192-bit key
  Encrypting 36 octets using AES-CTR with 192-bit key
  Encrypting 16 octets using AES-CTR with 256-bit key
  Encrypting 32 octets using AES-CTR with 256-bit key
  Encrypting 36 octets using AES-CTR with 256-bit key
testing AES_CBC:
  Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key
  Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key
  Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key
  Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key
testing AES_XCBC:
  RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input
  RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input
  RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input
  RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input
  RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input
  RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input
  RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input
  RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16)
  RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10)
  RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18)
testing HMAC_MD5:
  RFC 2104: MD5_HMAC test 1
  RFC 2104: MD5_HMAC test 2
  RFC 2104: MD5_HMAC test 3
8 CPU cores online
starting up 7 crypto helpers
started thread for crypto helper 0
| starting up helper thread 0
| status value returned by setting the priority of this thread (crypto helper 0) 22
| crypto helper 0 waiting (nothing to do)
started thread for crypto helper 1
started thread for crypto helper 2
| starting up helper thread 2
| status value returned by setting the priority of this thread (crypto helper 2) 22
| crypto helper 2 waiting (nothing to do)
started thread for crypto helper 3
| starting up helper thread 3
| status value returned by setting the priority of this thread (crypto helper 3) 22
| crypto helper 3 waiting (nothing to do)
started thread for crypto helper 4
| starting up helper thread 4
| status value returned by setting the priority of this thread (crypto helper 4) 22
| crypto helper 4 waiting (nothing to do)
started thread for crypto helper 5
| starting up helper thread 5
| status value returned by setting the priority of this thread (crypto helper 5) 22
| crypto helper 5 waiting (nothing to do)
started thread for crypto helper 6
| starting up helper thread 6
| checking IKEv1 state table
| status value returned by setting the priority of this thread (crypto helper 6) 22
| crypto helper 6 waiting (nothing to do)
|   MAIN_R0: category: half-open IKE SA flags: 0:
|     -> MAIN_R1 EVENT_SO_DISCARD
|   MAIN_I1: category: half-open IKE SA flags: 0:
|     -> MAIN_I2 EVENT_RETRANSMIT
|   MAIN_R1: category: open IKE SA flags: 200:
|     -> MAIN_R2 EVENT_RETRANSMIT
|     -> UNDEFINED EVENT_RETRANSMIT
|     -> UNDEFINED EVENT_RETRANSMIT
|   MAIN_I2: category: open IKE SA flags: 0:
|     -> MAIN_I3 EVENT_RETRANSMIT
|     -> UNDEFINED EVENT_RETRANSMIT
|     -> UNDEFINED EVENT_RETRANSMIT
|   MAIN_R2: category: open IKE SA flags: 0:
|     -> MAIN_R3 EVENT_SA_REPLACE
|     -> MAIN_R3 EVENT_SA_REPLACE
|     -> UNDEFINED EVENT_SA_REPLACE
|   MAIN_I3: category: open IKE SA flags: 0:
|     -> MAIN_I4 EVENT_SA_REPLACE
|     -> MAIN_I4 EVENT_SA_REPLACE
|     -> UNDEFINED EVENT_SA_REPLACE
|   MAIN_R3: category: established IKE SA flags: 200:
|     -> UNDEFINED EVENT_NULL
|   MAIN_I4: category: established IKE SA flags: 0:
|     -> UNDEFINED EVENT_NULL
|   AGGR_R0: category: half-open IKE SA flags: 0:
|     -> AGGR_R1 EVENT_SO_DISCARD
|   AGGR_I1: category: half-open IKE SA flags: 0:
|     -> AGGR_I2 EVENT_SA_REPLACE
|     -> AGGR_I2 EVENT_SA_REPLACE
|   AGGR_R1: category: open IKE SA flags: 200:
|     -> AGGR_R2 EVENT_SA_REPLACE
|     -> AGGR_R2 EVENT_SA_REPLACE
|   AGGR_I2: category: established IKE SA flags: 200:
|     -> UNDEFINED EVENT_NULL
|   AGGR_R2: category: established IKE SA flags: 0:
|     -> UNDEFINED EVENT_NULL
|   QUICK_R0: category: established CHILD SA flags: 0:
|     -> QUICK_R1 EVENT_RETRANSMIT
|   QUICK_I1: category: established CHILD SA flags: 0:
|     -> QUICK_I2 EVENT_SA_REPLACE
|   QUICK_R1: category: established CHILD SA flags: 0:
|     -> QUICK_R2 EVENT_SA_REPLACE
|   QUICK_I2: category: established CHILD SA flags: 200:
|     -> UNDEFINED EVENT_NULL
|   QUICK_R2: category: established CHILD SA flags: 0:
|     -> UNDEFINED EVENT_NULL
|   INFO: category: informational flags: 0:
|     -> UNDEFINED EVENT_NULL
|   INFO_PROTECTED: category: informational flags: 0:
|     -> UNDEFINED EVENT_NULL
|   XAUTH_R0: category: established IKE SA flags: 0:
|     -> XAUTH_R1 EVENT_NULL
|   XAUTH_R1: category: established IKE SA flags: 0:
|     -> MAIN_R3 EVENT_SA_REPLACE
|   MODE_CFG_R0: category: informational flags: 0:
|     -> MODE_CFG_R1 EVENT_SA_REPLACE
|   MODE_CFG_R1: category: established IKE SA flags: 0:
|     -> MODE_CFG_R2 EVENT_SA_REPLACE
|   MODE_CFG_R2: category: established IKE SA flags: 0:
|     -> UNDEFINED EVENT_NULL
|   MODE_CFG_I1: category: established IKE SA flags: 0:
|     -> MAIN_I4 EVENT_SA_REPLACE
|   XAUTH_I0: category: established IKE SA flags: 0:
|     -> XAUTH_I1 EVENT_RETRANSMIT
|   XAUTH_I1: category: established IKE SA flags: 0:
|     -> MAIN_I4 EVENT_RETRANSMIT
| checking IKEv2 state table
|   PARENT_I0: category: ignore flags: 0:
|     -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT)
|   PARENT_I1: category: half-open IKE SA flags: 0:
|     -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification)
|     -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH)
|   PARENT_I2: category: open IKE SA flags: 0:
|     -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification)
|     -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification)
|     -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification)
|     -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response)
|     -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification)
|   PARENT_I3: category: established IKE SA flags: 0:
|     -> PARENT_I3 EVENT_RETAIN (I3: Informational Request)
|     -> PARENT_I3 EVENT_RETAIN (I3: Informational Response)
|     -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request)
|     -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response)
|   PARENT_R0: category: half-open IKE SA flags: 0:
|     -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT)
|   PARENT_R1: category: half-open IKE SA flags: 0:
|     -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED))
|     -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request)
|   PARENT_R2: category: established IKE SA flags: 0:
|     -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request)
|     -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response)
|     -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request)
|     -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response)
|   V2_CREATE_I0: category: established IKE SA flags: 0:
|     -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA)
| starting up helper thread 1
|   V2_CREATE_I: category: established IKE SA flags: 0:
|     -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response)
|   V2_REKEY_IKE_I0: category: established IKE SA flags: 0:
|     -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey)
|   V2_REKEY_IKE_I: category: established IKE SA flags: 0:
|     -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response)
|   V2_REKEY_CHILD_I0: category: established IKE SA flags: 0:
|     -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA)
|   V2_REKEY_CHILD_I: category: established IKE SA flags: 0: <none>
|   V2_CREATE_R: category: established IKE SA flags: 0:
|     -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request)
|   V2_REKEY_IKE_R: category: established IKE SA flags: 0:
|     -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey)
|   V2_REKEY_CHILD_R: category: established IKE SA flags: 0: <none>
|   V2_IPSEC_I: category: established CHILD SA flags: 0: <none>
|   V2_IPSEC_R: category: established CHILD SA flags: 0: <none>
|   IKESA_DEL: category: established IKE SA flags: 0:
|     -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL)
|   CHILDSA_DEL: category: informational flags: 0: <none>
Using Linux XFRM/NETKEY IPsec interface code on 5.1.18-200.fc29.x86_64
| Hard-wiring algorithms
| adding AES_CCM_16 to kernel algorithm db
| adding AES_CCM_12 to kernel algorithm db
| adding AES_CCM_8 to kernel algorithm db
| adding 3DES_CBC to kernel algorithm db
| adding CAMELLIA_CBC to kernel algorithm db
| adding AES_GCM_16 to kernel algorithm db
| adding AES_GCM_12 to kernel algorithm db
| adding AES_GCM_8 to kernel algorithm db
| adding AES_CTR to kernel algorithm db
| adding AES_CBC to kernel algorithm db
| adding SERPENT_CBC to kernel algorithm db
| adding TWOFISH_CBC to kernel algorithm db
| adding NULL_AUTH_AES_GMAC to kernel algorithm db
| adding NULL to kernel algorithm db
| adding CHACHA20_POLY1305 to kernel algorithm db
| adding HMAC_MD5_96 to kernel algorithm db
| adding HMAC_SHA1_96 to kernel algorithm db
| adding HMAC_SHA2_512_256 to kernel algorithm db
| adding HMAC_SHA2_384_192 to kernel algorithm db
| adding HMAC_SHA2_256_128 to kernel algorithm db
| adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db
| adding AES_XCBC_96 to kernel algorithm db
| adding AES_CMAC_96 to kernel algorithm db
| adding NONE to kernel algorithm db
| net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes
| global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds
| setup kernel fd callback
| add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x556f68343af8
| libevent_malloc: new ptr-libevent@0x556f6833d4f8 size 128
| libevent_malloc: new ptr-libevent@0x556f68344688 size 16
| add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x556f68344618
| libevent_malloc: new ptr-libevent@0x556f682f6f48 size 128
| libevent_malloc: new ptr-libevent@0x556f683442e8 size 16
| global one-shot timer EVENT_CHECK_CRLS initialized
selinux support is enabled.
| unbound context created - setting debug level to 5
| /etc/hosts lookups activated
| /etc/resolv.conf usage activated
| outgoing-port-avoid set 0-65535
| outgoing-port-permit set 32768-60999
| Loading dnssec root key from:/var/lib/unbound/root.key
| No additional dnssec trust anchors defined via dnssec-trusted= option
| Setting up events, loop start
| add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x556f68344ab8
| libevent_malloc: new ptr-libevent@0x556f68350998 size 128
| libevent_malloc: new ptr-libevent@0x556f6835bc88 size 16
| libevent_realloc: new ptr-libevent@0x556f6835bcc8 size 256
| libevent_malloc: new ptr-libevent@0x556f6835bdf8 size 8
| libevent_realloc: new ptr-libevent@0x556f6835be38 size 144
| libevent_malloc: new ptr-libevent@0x556f68302a58 size 152
| libevent_malloc: new ptr-libevent@0x556f6835bef8 size 16
| signal event handler PLUTO_SIGCHLD installed
| libevent_malloc: new ptr-libevent@0x556f6835bf38 size 8
| libevent_malloc: new ptr-libevent@0x556f68280718 size 152
| signal event handler PLUTO_SIGTERM installed
| libevent_malloc: new ptr-libevent@0x556f6835bf78 size 8
| libevent_malloc: new ptr-libevent@0x556f6835bfb8 size 152
| signal event handler PLUTO_SIGHUP installed
| libevent_malloc: new ptr-libevent@0x556f6835c088 size 8
| libevent_realloc: release ptr-libevent@0x556f6835be38
| libevent_realloc: new ptr-libevent@0x556f6835c0c8 size 256
| libevent_malloc: new ptr-libevent@0x556f6835c1f8 size 152
| signal event handler PLUTO_SIGSYS installed
| status value returned by setting the priority of this thread (crypto helper 1) 22
| crypto helper 1 waiting (nothing to do)
| created addconn helper (pid:14599) using fork+execve
| forked child 14599
| accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722)
listening for IKE messages
| Inspecting interface lo 
| found lo with address 127.0.0.1
| Inspecting interface eth0 
| found eth0 with address 192.0.2.254
| Inspecting interface eth1 
| found eth1 with address 192.1.2.23
Kernel supports NIC esp-hw-offload
adding interface eth1/eth1 (esp-hw-offload not supported by kernel) 192.1.2.23:500
| NAT-Traversal: Trying sockopt style NAT-T
| NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4
adding interface eth1/eth1 192.1.2.23:4500
adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.0.2.254:500
| NAT-Traversal: Trying sockopt style NAT-T
| NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4
adding interface eth0/eth0 192.0.2.254:4500
adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500
| NAT-Traversal: Trying sockopt style NAT-T
| NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4
adding interface lo/lo 127.0.0.1:4500
| no interfaces to sort
| FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations
| add_fd_read_event_handler: new ethX-pe@0x556f6835c7d8
| libevent_malloc: new ptr-libevent@0x556f683508e8 size 128
| libevent_malloc: new ptr-libevent@0x556f6835c848 size 16
| setup callback for interface lo 127.0.0.1:4500 fd 22
| add_fd_read_event_handler: new ethX-pe@0x556f6835c888
| libevent_malloc: new ptr-libevent@0x556f682f6ff8 size 128
| libevent_malloc: new ptr-libevent@0x556f6835c8f8 size 16
| setup callback for interface lo 127.0.0.1:500 fd 21
| add_fd_read_event_handler: new ethX-pe@0x556f6835c938
| libevent_malloc: new ptr-libevent@0x556f682f6918 size 128
| libevent_malloc: new ptr-libevent@0x556f6835c9a8 size 16
| setup callback for interface eth0 192.0.2.254:4500 fd 20
| add_fd_read_event_handler: new ethX-pe@0x556f6835c9e8
| libevent_malloc: new ptr-libevent@0x556f682fe1d8 size 128
| libevent_malloc: new ptr-libevent@0x556f6835ca58 size 16
| setup callback for interface eth0 192.0.2.254:500 fd 19
| add_fd_read_event_handler: new ethX-pe@0x556f6835ca98
| libevent_malloc: new ptr-libevent@0x556f682fe2d8 size 128
| libevent_malloc: new ptr-libevent@0x556f6835cb08 size 16
| setup callback for interface eth1 192.1.2.23:4500 fd 18
| add_fd_read_event_handler: new ethX-pe@0x556f6835cb48
| libevent_malloc: new ptr-libevent@0x556f682fe3d8 size 128
| libevent_malloc: new ptr-libevent@0x556f6835cbb8 size 16
| setup callback for interface eth1 192.1.2.23:500 fd 17
| certs and keys locked by 'free_preshared_secrets'
| certs and keys unlocked by 'free_preshared_secrets'
loading secrets from "/etc/ipsec.secrets"
| saving Modulus
| saving PublicExponent
| ignoring PrivateExponent
| ignoring Prime1
| ignoring Prime2
| ignoring Exponent1
| ignoring Exponent2
| ignoring Coefficient
| ignoring CKAIDNSS
| computed rsa CKAID  61 55 99 73  d3 ac ef 7d  3a 37 0e 3e  82 ad 92 c1
| computed rsa CKAID  8a 82 25 f1
loaded private key for keyid: PKK_RSA:AQO9bJbr3
| certs and keys locked by 'process_secret'
| certs and keys unlocked by 'process_secret'
| close_any(fd@16) (in whack_process() at rcv_whack.c:700)
| spent 1.09 milliseconds in whack
| accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722)
listening for IKE messages
| Inspecting interface lo 
| found lo with address 127.0.0.1
| Inspecting interface eth0 
| found eth0 with address 192.0.2.254
| Inspecting interface eth1 
| found eth1 with address 192.1.2.23
| no interfaces to sort
| libevent_free: release ptr-libevent@0x556f683508e8
| free_event_entry: release EVENT_NULL-pe@0x556f6835c7d8
| add_fd_read_event_handler: new ethX-pe@0x556f6835c7d8
| libevent_malloc: new ptr-libevent@0x556f683508e8 size 128
| setup callback for interface lo 127.0.0.1:4500 fd 22
| libevent_free: release ptr-libevent@0x556f682f6ff8
| free_event_entry: release EVENT_NULL-pe@0x556f6835c888
| add_fd_read_event_handler: new ethX-pe@0x556f6835c888
| libevent_malloc: new ptr-libevent@0x556f682f6ff8 size 128
| setup callback for interface lo 127.0.0.1:500 fd 21
| libevent_free: release ptr-libevent@0x556f682f6918
| free_event_entry: release EVENT_NULL-pe@0x556f6835c938
| add_fd_read_event_handler: new ethX-pe@0x556f6835c938
| libevent_malloc: new ptr-libevent@0x556f682f6918 size 128
| setup callback for interface eth0 192.0.2.254:4500 fd 20
| libevent_free: release ptr-libevent@0x556f682fe1d8
| free_event_entry: release EVENT_NULL-pe@0x556f6835c9e8
| add_fd_read_event_handler: new ethX-pe@0x556f6835c9e8
| libevent_malloc: new ptr-libevent@0x556f682fe1d8 size 128
| setup callback for interface eth0 192.0.2.254:500 fd 19
| libevent_free: release ptr-libevent@0x556f682fe2d8
| free_event_entry: release EVENT_NULL-pe@0x556f6835ca98
| add_fd_read_event_handler: new ethX-pe@0x556f6835ca98
| libevent_malloc: new ptr-libevent@0x556f682fe2d8 size 128
| setup callback for interface eth1 192.1.2.23:4500 fd 18
| libevent_free: release ptr-libevent@0x556f682fe3d8
| free_event_entry: release EVENT_NULL-pe@0x556f6835cb48
| add_fd_read_event_handler: new ethX-pe@0x556f6835cb48
| libevent_malloc: new ptr-libevent@0x556f682fe3d8 size 128
| setup callback for interface eth1 192.1.2.23:500 fd 17
| certs and keys locked by 'free_preshared_secrets'
forgetting secrets
| certs and keys unlocked by 'free_preshared_secrets'
loading secrets from "/etc/ipsec.secrets"
| saving Modulus
| saving PublicExponent
| ignoring PrivateExponent
| ignoring Prime1
| ignoring Prime2
| ignoring Exponent1
| ignoring Exponent2
| ignoring Coefficient
| ignoring CKAIDNSS
| computed rsa CKAID  61 55 99 73  d3 ac ef 7d  3a 37 0e 3e  82 ad 92 c1
| computed rsa CKAID  8a 82 25 f1
loaded private key for keyid: PKK_RSA:AQO9bJbr3
| certs and keys locked by 'process_secret'
| certs and keys unlocked by 'process_secret'
| close_any(fd@16) (in whack_process() at rcv_whack.c:700)
| spent 0.411 milliseconds in whack
| processing signal PLUTO_SIGCHLD
| waitpid returned pid 14599 (exited with status 0)
| reaped addconn helper child (status 0)
| waitpid returned ECHILD (no child processes left)
| spent 0.0195 milliseconds in signal handler PLUTO_SIGCHLD
| accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722)
| FOR_EACH_CONNECTION_... in conn_by_name
| FOR_EACH_CONNECTION_... in foreach_connection_by_alias
| FOR_EACH_CONNECTION_... in conn_by_name
| FOR_EACH_CONNECTION_... in foreach_connection_by_alias
| FOR_EACH_CONNECTION_... in conn_by_name
| Added new connection westnet-eastnet-ikev2 with policy ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO
| ike (phase1) algorithm values: AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_CBC_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31
| from whack: got --esp=
| ESP/AH string values: AES_GCM_16_256-NONE, AES_GCM_16_128-NONE, AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128, AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128
| setting ID to ID_DER_ASN1_DN: 'E=user-west@testing.libreswan.org,CN=west.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA'
| loading left certificate 'west' pubkey
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f68363998
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f68363a98
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f683644a8
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f683643a8
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f6835fe28
| unreference key: 0x556f68360138 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org cnt 1--
| certs and keys locked by 'lsw_add_rsa_secret'
| certs and keys unlocked by 'lsw_add_rsa_secret'
| counting wild cards for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org is 0
| counting wild cards for ID_NULL is 0
| connect_to_host_pair: 192.1.2.23:500 192.1.2.45:500 -> hp@(nil): none
| new hp@0x556f68365eb8
added connection description "westnet-eastnet-ikev2"
| ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO
| 192.0.2.0/24===192.1.2.23<192.1.2.23>[ID_NULL]...192.1.2.45<192.1.2.45>[C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org]===192.0.1.0/24
| close_any(fd@16) (in whack_process() at rcv_whack.c:700)
| spent 1.58 milliseconds in whack
| accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722)
| FOR_EACH_CONNECTION_... in show_connections_status
| FOR_EACH_CONNECTION_... in show_connections_status
| FOR_EACH_STATE_... in show_states_status (sort_states)
| close_any(fd@16) (in whack_process() at rcv_whack.c:700)
| spent 0.817 milliseconds in whack
| spent 0.00273 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue()
| *received 828 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500)
|   1a 17 bf 9e  53 2f a9 69  00 00 00 00  00 00 00 00
|   21 20 22 08  00 00 00 00  00 00 03 3c  22 00 01 b4
|   02 00 00 64  01 01 00 0b  03 00 00 0c  01 00 00 14
|   80 0e 01 00  03 00 00 08  02 00 00 07  03 00 00 08
|   02 00 00 05  03 00 00 08  04 00 00 0e  03 00 00 08
|   04 00 00 0f  03 00 00 08  04 00 00 10  03 00 00 08
|   04 00 00 12  03 00 00 08  04 00 00 13  03 00 00 08
|   04 00 00 14  03 00 00 08  04 00 00 15  00 00 00 08
|   04 00 00 1f  02 00 00 64  02 01 00 0b  03 00 00 0c
|   01 00 00 14  80 0e 00 80  03 00 00 08  02 00 00 07
|   03 00 00 08  02 00 00 05  03 00 00 08  04 00 00 0e
|   03 00 00 08  04 00 00 0f  03 00 00 08  04 00 00 10
|   03 00 00 08  04 00 00 12  03 00 00 08  04 00 00 13
|   03 00 00 08  04 00 00 14  03 00 00 08  04 00 00 15
|   00 00 00 08  04 00 00 1f  02 00 00 74  03 01 00 0d
|   03 00 00 0c  01 00 00 0c  80 0e 01 00  03 00 00 08
|   02 00 00 07  03 00 00 08  02 00 00 05  03 00 00 08
|   03 00 00 0e  03 00 00 08  03 00 00 0c  03 00 00 08
|   04 00 00 0e  03 00 00 08  04 00 00 0f  03 00 00 08
|   04 00 00 10  03 00 00 08  04 00 00 12  03 00 00 08
|   04 00 00 13  03 00 00 08  04 00 00 14  03 00 00 08
|   04 00 00 15  00 00 00 08  04 00 00 1f  00 00 00 74
|   04 01 00 0d  03 00 00 0c  01 00 00 0c  80 0e 00 80
|   03 00 00 08  02 00 00 07  03 00 00 08  02 00 00 05
|   03 00 00 08  03 00 00 0e  03 00 00 08  03 00 00 0c
|   03 00 00 08  04 00 00 0e  03 00 00 08  04 00 00 0f
|   03 00 00 08  04 00 00 10  03 00 00 08  04 00 00 12
|   03 00 00 08  04 00 00 13  03 00 00 08  04 00 00 14
|   03 00 00 08  04 00 00 15  00 00 00 08  04 00 00 1f
|   28 00 01 08  00 0e 00 00  18 23 d9 ab  7d 3f 46 32
|   b3 fb 5e e3  66 2c 62 15  36 04 33 39  ab c3 4c 98
|   5b e7 b9 59  4e 22 93 04  4f c0 f5 16  2c 08 49 b0
|   f7 cc 17 63  98 91 94 15  2e 16 f9 ba  57 90 8d 2d
|   50 06 9a f1  94 99 b6 bb  68 78 8b 1d  c5 64 90 57
|   2d d9 7c 84  4a 4d 4b fa  06 1b 8f c8  c8 60 03 18
|   e4 68 10 48  f2 ab fa 60  20 17 74 d5  d6 39 6d 7f
|   b7 18 0f 81  17 a1 48 e6  8d 7d 41 ee  7b ee 43 2c
|   00 91 ac db  cb bd ea 47  2e 29 25 d3  f7 ff 30 2e
|   eb 76 d2 b5  4a 5d 30 ba  b8 ba 4c f1  e2 9a e7 d1
|   15 77 2c 40  25 9a ba 9c  9f 3b 44 77  db 15 b3 1d
|   f6 94 70 1a  eb e4 b8 9d  7c 6c c9 af  d6 95 e7 bb
|   74 e6 9f cd  7b a8 bd 66  c4 6b 09 35  cb f2 41 58
|   fd 0e f1 7d  1e 59 ab 93  f1 34 a2 cf  c2 89 93 59
|   33 c6 55 3d  b3 8c e9 30  9c b9 1b d9  d2 83 63 8f
|   90 01 e3 a7  e5 16 46 da  1c 17 0c e9  8f e0 c9 8e
|   7c 04 c1 44  e0 28 49 b4  29 00 00 24  ca 0e ef 73
|   ea 82 04 e7  b0 da b3 c3  1a 53 77 e2  2b c5 d0 b8
|   c9 4d b7 fc  f9 07 a5 98  69 a1 d8 51  29 00 00 08
|   00 00 40 2e  29 00 00 1c  00 00 40 04  3d f3 00 6a
|   b1 01 8c da  7c 3e 91 a4  dd 9a d0 eb  7d 2f 2e b9
|   00 00 00 1c  00 00 40 05  d6 17 86 28  aa 31 cf 39
|   63 e8 41 ed  94 a3 dd a1  32 41 7b 54
| start processing: from 192.1.2.45:500 (in process_md() at demux.c:378)
| **parse ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   00 00 00 00  00 00 00 00
|    next payload type: ISAKMP_NEXT_v2SA (0x21)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_IKE_SA_INIT (0x22)
|    flags: ISAKMP_FLAG_v2_IKE_INIT (0x8)
|    Message ID: 0 (0x0)
|    length: 828 (0x33c)
|  processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34)
| I am the IKE SA Original Responder receiving an IKEv2 IKE_SA_INIT request 
| State DB: IKEv2 state not found (find_v2_ike_sa_by_initiator_spi)
| Now let's proceed with payload (ISAKMP_NEXT_v2SA)
| ***parse IKEv2 Security Association Payload:
|    next payload type: ISAKMP_NEXT_v2KE (0x22)
|    flags: none (0x0)
|    length: 436 (0x1b4)
| processing payload: ISAKMP_NEXT_v2SA (len=432)
| Now let's proceed with payload (ISAKMP_NEXT_v2KE)
| ***parse IKEv2 Key Exchange Payload:
|    next payload type: ISAKMP_NEXT_v2Ni (0x28)
|    flags: none (0x0)
|    length: 264 (0x108)
|    DH group: OAKLEY_GROUP_MODP2048 (0xe)
| processing payload: ISAKMP_NEXT_v2KE (len=256)
| Now let's proceed with payload (ISAKMP_NEXT_v2Ni)
| ***parse IKEv2 Nonce Payload:
|    next payload type: ISAKMP_NEXT_v2N (0x29)
|    flags: none (0x0)
|    length: 36 (0x24)
| processing payload: ISAKMP_NEXT_v2Ni (len=32)
| Now let's proceed with payload (ISAKMP_NEXT_v2N)
| ***parse IKEv2 Notify Payload:
|    next payload type: ISAKMP_NEXT_v2N (0x29)
|    flags: none (0x0)
|    length: 8 (0x8)
|    Protocol ID: PROTO_v2_RESERVED (0x0)
|    SPI size: 0 (0x0)
|    Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e)
| processing payload: ISAKMP_NEXT_v2N (len=0)
| Now let's proceed with payload (ISAKMP_NEXT_v2N)
| ***parse IKEv2 Notify Payload:
|    next payload type: ISAKMP_NEXT_v2N (0x29)
|    flags: none (0x0)
|    length: 28 (0x1c)
|    Protocol ID: PROTO_v2_RESERVED (0x0)
|    SPI size: 0 (0x0)
|    Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004)
| processing payload: ISAKMP_NEXT_v2N (len=20)
| Now let's proceed with payload (ISAKMP_NEXT_v2N)
| ***parse IKEv2 Notify Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    length: 28 (0x1c)
|    Protocol ID: PROTO_v2_RESERVED (0x0)
|    SPI size: 0 (0x0)
|    Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005)
| processing payload: ISAKMP_NEXT_v2N (len=20)
| DDOS disabled and no cookie sent, continuing
| find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=ECDSA+IKEV2_ALLOW but ignoring ports
| find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports
| find_next_host_connection policy=ECDSA+IKEV2_ALLOW
| found policy = AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO (westnet-eastnet-ikev2)
| find_next_host_connection returns empty
| find_host_connection local=192.1.2.23:500 remote=<none:> policy=ECDSA+IKEV2_ALLOW but ignoring ports
| find_next_host_connection policy=ECDSA+IKEV2_ALLOW
| find_next_host_connection returns empty
| initial parent SA message received on 192.1.2.23:500 but no connection has been authorized with policy ECDSA+IKEV2_ALLOW
| find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=RSASIG+IKEV2_ALLOW but ignoring ports
| find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports
| find_next_host_connection policy=RSASIG+IKEV2_ALLOW
| found policy = AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO (westnet-eastnet-ikev2)
| find_next_host_connection returns empty
| find_host_connection local=192.1.2.23:500 remote=<none:> policy=RSASIG+IKEV2_ALLOW but ignoring ports
| find_next_host_connection policy=RSASIG+IKEV2_ALLOW
| find_next_host_connection returns empty
| initial parent SA message received on 192.1.2.23:500 but no connection has been authorized with policy RSASIG+IKEV2_ALLOW
| find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=PSK+IKEV2_ALLOW but ignoring ports
| find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports
| find_next_host_connection policy=PSK+IKEV2_ALLOW
| found policy = AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO (westnet-eastnet-ikev2)
| find_next_host_connection returns empty
| find_host_connection local=192.1.2.23:500 remote=<none:> policy=PSK+IKEV2_ALLOW but ignoring ports
| find_next_host_connection policy=PSK+IKEV2_ALLOW
| find_next_host_connection returns empty
| initial parent SA message received on 192.1.2.23:500 but no connection has been authorized with policy PSK+IKEV2_ALLOW
| find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=AUTHNULL+IKEV2_ALLOW but ignoring ports
| find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports
| find_next_host_connection policy=AUTHNULL+IKEV2_ALLOW
| found policy = AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO (westnet-eastnet-ikev2)
| find_next_host_connection returns westnet-eastnet-ikev2
| find_next_host_connection policy=AUTHNULL+IKEV2_ALLOW
| find_next_host_connection returns empty
| found connection: westnet-eastnet-ikev2 with policy AUTHNULL+IKEV2_ALLOW
| creating state object #1 at 0x556f683676e8
| State DB: adding IKEv2 state #1 in UNDEFINED
| pstats #1 ikev2.ike started
| Message ID: init #1: msgid=0 lastack=4294967295 nextuse=0 lastrecv=4294967295 lastreplied=0
| parent state #1: UNDEFINED(ignore) => PARENT_R0(half-open IKE SA)
| Message ID: init_ike #1; ike: initiator.sent=0->-1 initiator.recv=0->-1 responder.sent=0->-1 responder.recv=0->-1 wip.initiator=0->-1 wip.responder=0->-1
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45 (in ikev2_process_packet() at ikev2.c:2016)
| State DB: IKEv2 state not found (find_v2_sa_by_responder_wip)
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45 (in ike_process_packet() at ikev2.c:2064)
| #1 st.st_msgid_lastrecv -1 md.hdr.isa_msgid 00000000
| Message ID: #1 not a duplicate - message is new; initiator.sent=-1 initiator.recv=-1 responder.sent=-1 responder.recv=-1
| Message ID: start-responder #1 request 0; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=-1 responder.recv=-1 wip.initiator=-1 wip.responder=-1->0
| #1 in state PARENT_R0: processing SA_INIT request
| selected state microcode Respond to IKE_SA_INIT
| Now let's proceed with state specific processing
| calling processor Respond to IKE_SA_INIT
| #1 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2669)
| constructing local IKE proposals for westnet-eastnet-ikev2 (IKE SA responder matching remote proposals)
| converting ike_info AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ...
| ...  ikev2_proposal: 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
| converting ike_info AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ...
| ...  ikev2_proposal: 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
| converting ike_info AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ...
| ...  ikev2_proposal: 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
| converting ike_info AES_CBC_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ...
| ...  ikev2_proposal: 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
"westnet-eastnet-ikev2": constructed local IKE proposals for westnet-eastnet-ikev2 (IKE SA responder matching remote proposals): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519
| Comparing remote proposals against IKE responder 4 local proposals
| local proposal 1 type ENCR has 1 transforms
| local proposal 1 type PRF has 2 transforms
| local proposal 1 type INTEG has 1 transforms
| local proposal 1 type DH has 8 transforms
| local proposal 1 type ESN has 0 transforms
| local proposal 1 transforms: required: ENCR+PRF+DH; optional: INTEG
| local proposal 2 type ENCR has 1 transforms
| local proposal 2 type PRF has 2 transforms
| local proposal 2 type INTEG has 1 transforms
| local proposal 2 type DH has 8 transforms
| local proposal 2 type ESN has 0 transforms
| local proposal 2 transforms: required: ENCR+PRF+DH; optional: INTEG
| local proposal 3 type ENCR has 1 transforms
| local proposal 3 type PRF has 2 transforms
| local proposal 3 type INTEG has 2 transforms
| local proposal 3 type DH has 8 transforms
| local proposal 3 type ESN has 0 transforms
| local proposal 3 transforms: required: ENCR+PRF+INTEG+DH; optional: none
| local proposal 4 type ENCR has 1 transforms
| local proposal 4 type PRF has 2 transforms
| local proposal 4 type INTEG has 2 transforms
| local proposal 4 type DH has 8 transforms
| local proposal 4 type ESN has 0 transforms
| local proposal 4 transforms: required: ENCR+PRF+INTEG+DH; optional: none
| ****parse IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_NON_LAST (0x2)
|    length: 100 (0x64)
|    prop #: 1 (0x1)
|    proto ID: IKEv2_SEC_PROTO_IKE (0x1)
|    spi size: 0 (0x0)
|    # transforms: 11 (0xb)
| Comparing remote proposal 1 containing 11 transforms against local proposal [1..4] of 4 local proposals
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 12 (0xc)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_GCM_C (0x14)
| ******parse IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 256 (0x100)
| remote proposal 1 transform 0 (ENCR=AES_GCM_C_256) matches local proposal 1 type 1 (ENCR) transform 0
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7)
| remote proposal 1 transform 1 (PRF=HMAC_SHA2_512) matches local proposal 1 type 2 (PRF) transform 0
| remote proposal 1 transform 1 (PRF=HMAC_SHA2_512) matches local proposal 2 type 2 (PRF) transform 0
| remote proposal 1 transform 1 (PRF=HMAC_SHA2_512) matches local proposal 3 type 2 (PRF) transform 0
| remote proposal 1 transform 1 (PRF=HMAC_SHA2_512) matches local proposal 4 type 2 (PRF) transform 0
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe)
| remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0
| remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 2 type 4 (DH) transform 0
| remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 3 type 4 (DH) transform 0
| remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 4 type 4 (DH) transform 0
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f)
| remote proposal 1 proposed transforms: ENCR+PRF+DH; matched: ENCR+PRF+DH; unmatched: none
| comparing remote proposal 1 containing ENCR+PRF+DH transforms to local proposal 1; required: ENCR+PRF+DH; optional: INTEG; matched: ENCR+PRF+DH
| remote proposal 1 matches local proposal 1
| ****parse IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_NON_LAST (0x2)
|    length: 100 (0x64)
|    prop #: 2 (0x2)
|    proto ID: IKEv2_SEC_PROTO_IKE (0x1)
|    spi size: 0 (0x0)
|    # transforms: 11 (0xb)
| Comparing remote proposal 2 containing 11 transforms against local proposal [1..0] of 4 local proposals
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 12 (0xc)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_GCM_C (0x14)
| ******parse IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 128 (0x80)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f)
| remote proposal 2 proposed transforms: ENCR+PRF+DH; matched: none; unmatched: ENCR+PRF+DH
| remote proposal 2 does not match; unmatched remote transforms: ENCR+PRF+DH
| ****parse IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_NON_LAST (0x2)
|    length: 116 (0x74)
|    prop #: 3 (0x3)
|    proto ID: IKEv2_SEC_PROTO_IKE (0x1)
|    spi size: 0 (0x0)
|    # transforms: 13 (0xd)
| Comparing remote proposal 3 containing 13 transforms against local proposal [1..0] of 4 local proposals
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 12 (0xc)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_CBC (0xc)
| ******parse IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 256 (0x100)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_INTEG (0x3)
|    IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_INTEG (0x3)
|    IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f)
| remote proposal 3 proposed transforms: ENCR+PRF+INTEG+DH; matched: none; unmatched: ENCR+PRF+INTEG+DH
| remote proposal 3 does not match; unmatched remote transforms: ENCR+PRF+INTEG+DH
| ****parse IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_LAST (0x0)
|    length: 116 (0x74)
|    prop #: 4 (0x4)
|    proto ID: IKEv2_SEC_PROTO_IKE (0x1)
|    spi size: 0 (0x0)
|    # transforms: 13 (0xd)
| Comparing remote proposal 4 containing 13 transforms against local proposal [1..0] of 4 local proposals
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 12 (0xc)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_CBC (0xc)
| ******parse IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 128 (0x80)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_INTEG (0x3)
|    IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_INTEG (0x3)
|    IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15)
| *****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f)
| remote proposal 4 proposed transforms: ENCR+PRF+INTEG+DH; matched: none; unmatched: ENCR+PRF+INTEG+DH
| remote proposal 4 does not match; unmatched remote transforms: ENCR+PRF+INTEG+DH
"westnet-eastnet-ikev2" #1: proposal 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512;DH=MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512;PRF=HMAC_SHA2_256;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519[first-match] 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512;PRF=HMAC_SHA2_256;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512;PRF=HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256;INTEG=HMAC_SHA2_256_128;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512;PRF=HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256;INTEG=HMAC_SHA2_256_128;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519
| accepted IKE proposal ikev2_proposal: 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512;DH=MODP2048
| converting proposal to internal trans attrs
| natd_hash: rcookie is zero
| natd_hash: hasher=0x556f66790800(20)
| natd_hash: icookie=  1a 17 bf 9e  53 2f a9 69
| natd_hash: rcookie=  00 00 00 00  00 00 00 00
| natd_hash: ip=  c0 01 02 17
| natd_hash: port=500
| natd_hash: hash=  d6 17 86 28  aa 31 cf 39  63 e8 41 ed  94 a3 dd a1
| natd_hash: hash=  32 41 7b 54
| natd_hash: rcookie is zero
| natd_hash: hasher=0x556f66790800(20)
| natd_hash: icookie=  1a 17 bf 9e  53 2f a9 69
| natd_hash: rcookie=  00 00 00 00  00 00 00 00
| natd_hash: ip=  c0 01 02 2d
| natd_hash: port=500
| natd_hash: hash=  3d f3 00 6a  b1 01 8c da  7c 3e 91 a4  dd 9a d0 eb
| natd_hash: hash=  7d 2f 2e b9
| NAT_TRAVERSAL encaps using auto-detect
| NAT_TRAVERSAL this end is NOT behind NAT
| NAT_TRAVERSAL that end is NOT behind NAT
| NAT_TRAVERSAL nat-keepalive enabled 192.1.2.45
| adding ikev2_inI1outR1 KE work-order 1 for state #1
| event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x556f68365a88
| inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1
| libevent_malloc: new ptr-libevent@0x556f683643f8 size 128
|   #1 spent 0.493 milliseconds in processing: Respond to IKE_SA_INIT in ikev2_process_state_packet()
| crypto helper 0 resuming
| crypto helper 0 starting work-order 1 for state #1
| crypto helper 0 doing build KE and nonce (ikev2_inI1outR1 KE); request ID 1
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3379)
| #1 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_SUSPEND
| suspending state #1 and saving MD
| #1 is busy; has a suspended MD
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in log_stf_suspend() at ikev2.c:3269)
| "westnet-eastnet-ikev2" #1 complete v2 state STATE_PARENT_R0 transition with STF_SUSPEND suspended from complete_v2_state_transition:3451
| stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2018)
| #1 spent 0.844 milliseconds in ikev2_process_packet()
| stop processing: from 192.1.2.45:500 (in process_md() at demux.c:380)
| processing: STOP state #0 (in process_md() at demux.c:382)
| processing: STOP connection NULL (in process_md() at demux.c:383)
| spent 0.858 milliseconds in comm_handle_cb() reading and processing packet
| crypto helper 0 finished build KE and nonce (ikev2_inI1outR1 KE); request ID 1 time elapsed 0.00074 seconds
| (#1) spent 0.735 milliseconds in crypto helper computing work-order 1: ikev2_inI1outR1 KE (pcr)
| crypto helper 0 sending results from work-order 1 for state #1 to event queue
| scheduling resume sending helper answer for #1
| libevent_malloc: new ptr-libevent@0x7f113c002888 size 128
| crypto helper 0 waiting (nothing to do)
| processing resume sending helper answer for #1
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in resume_handler() at server.c:797)
| crypto helper 0 replies to request ID 1
| calling continuation function 0x556f666bbb50
| ikev2_parent_inI1outR1_continue for #1: calculated ke+nonce, sending R1
| **emit ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_NONE (0x0)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_IKE_SA_INIT (0x22)
|    flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20)
|    Message ID: 0 (0x0)
| next payload chain: saving message location 'ISAKMP Message'.'next payload type'
| Emitting ikev2_proposal ...
| ***emit IKEv2 Security Association Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
| next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA)
| next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet'
| ****emit IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_LAST (0x0)
|    prop #: 1 (0x1)
|    proto ID: IKEv2_SEC_PROTO_IKE (0x1)
|    spi size: 0 (0x0)
|    # transforms: 3 (0x3)
| last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal'
| *****emit IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_GCM_C (0x14)
| last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform'
| ******emit IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 256 (0x100)
| emitting length of IKEv2 Transform Substructure Payload: 12
| *****emit IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    IKEv2 transform type: TRANS_TYPE_PRF (0x2)
|    IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7)
| last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3)
| last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform'
| emitting length of IKEv2 Transform Substructure Payload: 8
| *****emit IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    IKEv2 transform type: TRANS_TYPE_DH (0x4)
|    IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe)
| last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3)
| last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform'
| emitting length of IKEv2 Transform Substructure Payload: 8
| emitting length of IKEv2 Proposal Substructure Payload: 36
| last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0
| emitting length of IKEv2 Security Association Payload: 40
| last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0
| ***emit IKEv2 Key Exchange Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    DH group: OAKLEY_GROUP_MODP2048 (0xe)
| next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE)
| next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet'
| emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload
| ikev2 g^x  1b ee f1 d8  e1 2c 8a d5  32 95 80 66  5f ad d9 07
| ikev2 g^x  69 5f 34 ba  ce 1b 4d 9e  7a 83 ac 26  b8 07 fe 1f
| ikev2 g^x  61 3e 91 89  5d 3b 27 56  84 a4 1e ec  29 a9 cc 88
| ikev2 g^x  55 f1 9e 52  c7 2b 7c a7  a0 8f 4b 0d  f8 5d 2f 7f
| ikev2 g^x  4b 6f c3 0b  0c 41 9d 3d  f5 8c 30 f6  49 ac 80 d3
| ikev2 g^x  87 19 66 62  df a1 86 62  31 3f 60 8b  ce 12 f1 d9
| ikev2 g^x  0e df f5 9b  82 41 08 bd  d7 18 22 6c  e9 cc aa 90
| ikev2 g^x  50 b6 03 41  79 99 29 02  cd 03 0c 23  c8 44 16 62
| ikev2 g^x  b8 bc 6d 6d  9d 7a a6 14  78 fe a7 15  28 bf bc 80
| ikev2 g^x  e6 0e 6e dd  07 21 35 78  99 61 79 40  05 4a b0 14
| ikev2 g^x  c7 9a 81 c2  08 88 06 8f  b2 32 cc 60  b1 cc 1c 4f
| ikev2 g^x  4a 05 73 c4  83 7d 6d bf  cb 89 f5 4d  32 e1 80 d6
| ikev2 g^x  17 1b 18 db  db 85 ab 48  04 eb 78 ef  4e 0d cb e9
| ikev2 g^x  4f 03 02 0c  ac 73 ff 51  cc 5f 93 22  23 c2 c9 99
| ikev2 g^x  7b 29 82 d6  39 76 98 8c  cb c9 51 b4  55 c3 8f 23
| ikev2 g^x  e1 79 c8 73  c2 eb eb bc  94 c1 7c 9e  14 47 19 29
| emitting length of IKEv2 Key Exchange Payload: 264
| ***emit IKEv2 Nonce Payload:
|    next payload type: ISAKMP_NEXT_v2N (0x29)
|    flags: none (0x0)
| next payload chain: ignoring supplied 'IKEv2 Nonce Payload'.'next payload type' value 41:ISAKMP_NEXT_v2N
| next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni)
| next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet'
| emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload
| IKEv2 nonce  2d 3f 27 24  b9 dd 9b 45  84 3e dc b3  60 92 97 51
| IKEv2 nonce  18 60 67 ea  76 46 21 30  76 31 36 23  64 f4 ef 69
| emitting length of IKEv2 Nonce Payload: 36
| Adding a v2N Payload
| ***emit IKEv2 Notify Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    Protocol ID: PROTO_v2_RESERVED (0x0)
|    SPI size: 0 (0x0)
|    Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e)
| next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N)
| next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet'
| emitting length of IKEv2 Notify Payload: 8
|  NAT-Traversal support  [enabled] add v2N payloads.
| natd_hash: hasher=0x556f66790800(20)
| natd_hash: icookie=  1a 17 bf 9e  53 2f a9 69
| natd_hash: rcookie=  b4 b4 69 40  ef b8 67 79
| natd_hash: ip=  c0 01 02 17
| natd_hash: port=500
| natd_hash: hash=  b7 fc 34 56  d9 76 29 55  b4 c7 e3 54  0b be ed f4
| natd_hash: hash=  77 46 67 5a
| Adding a v2N Payload
| ***emit IKEv2 Notify Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    Protocol ID: PROTO_v2_RESERVED (0x0)
|    SPI size: 0 (0x0)
|    Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004)
| next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N)
| next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet'
| emitting 20 raw bytes of Notify data into IKEv2 Notify Payload
| Notify data  b7 fc 34 56  d9 76 29 55  b4 c7 e3 54  0b be ed f4
| Notify data  77 46 67 5a
| emitting length of IKEv2 Notify Payload: 28
| natd_hash: hasher=0x556f66790800(20)
| natd_hash: icookie=  1a 17 bf 9e  53 2f a9 69
| natd_hash: rcookie=  b4 b4 69 40  ef b8 67 79
| natd_hash: ip=  c0 01 02 2d
| natd_hash: port=500
| natd_hash: hash=  b8 c5 53 aa  52 28 4e 42  77 05 02 c5  78 3d eb e5
| natd_hash: hash=  0f 3e 59 63
| Adding a v2N Payload
| ***emit IKEv2 Notify Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    Protocol ID: PROTO_v2_RESERVED (0x0)
|    SPI size: 0 (0x0)
|    Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005)
| next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N)
| next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet'
| emitting 20 raw bytes of Notify data into IKEv2 Notify Payload
| Notify data  b8 c5 53 aa  52 28 4e 42  77 05 02 c5  78 3d eb e5
| Notify data  0f 3e 59 63
| emitting length of IKEv2 Notify Payload: 28
| ***emit IKEv2 Vendor ID Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
| next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Vendor ID Payload (43:ISAKMP_NEXT_v2V)
| next payload chain: saving location 'IKEv2 Vendor ID Payload'.'next payload type' in 'reply packet'
| emitting 19 raw bytes of Opportunistic IPsec into IKEv2 Vendor ID Payload
| Opportunistic IPsec  4f 70 70 6f  72 74 75 6e  69 73 74 69  63 20 49 50
| Opportunistic IPsec  73 65 63
| emitting length of IKEv2 Vendor ID Payload: 23
| emitting length of ISAKMP Message: 455
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3379)
| #1 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_OK
| IKEv2: transition from state STATE_PARENT_R0 to state STATE_PARENT_R1
| parent state #1: PARENT_R0(half-open IKE SA) => PARENT_R1(half-open IKE SA)
| Message ID: updating counters for #1 to 0 after switching state
| Message ID: recv #1 request 0; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=-1 responder.recv=-1->0 wip.initiator=-1 wip.responder=0->-1
| Message ID: sent #1 response 0; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=-1->0 responder.recv=0 wip.initiator=-1 wip.responder=-1
"westnet-eastnet-ikev2" #1: STATE_PARENT_R1: received v2I1, sent v2R1 {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048}
| sending V2 new request packet to 192.1.2.45:500 (from 192.1.2.23:500)
| sending 455 bytes for STATE_PARENT_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   21 20 22 20  00 00 00 00  00 00 01 c7  22 00 00 28
|   00 00 00 24  01 01 00 03  03 00 00 0c  01 00 00 14
|   80 0e 01 00  03 00 00 08  02 00 00 07  00 00 00 08
|   04 00 00 0e  28 00 01 08  00 0e 00 00  1b ee f1 d8
|   e1 2c 8a d5  32 95 80 66  5f ad d9 07  69 5f 34 ba
|   ce 1b 4d 9e  7a 83 ac 26  b8 07 fe 1f  61 3e 91 89
|   5d 3b 27 56  84 a4 1e ec  29 a9 cc 88  55 f1 9e 52
|   c7 2b 7c a7  a0 8f 4b 0d  f8 5d 2f 7f  4b 6f c3 0b
|   0c 41 9d 3d  f5 8c 30 f6  49 ac 80 d3  87 19 66 62
|   df a1 86 62  31 3f 60 8b  ce 12 f1 d9  0e df f5 9b
|   82 41 08 bd  d7 18 22 6c  e9 cc aa 90  50 b6 03 41
|   79 99 29 02  cd 03 0c 23  c8 44 16 62  b8 bc 6d 6d
|   9d 7a a6 14  78 fe a7 15  28 bf bc 80  e6 0e 6e dd
|   07 21 35 78  99 61 79 40  05 4a b0 14  c7 9a 81 c2
|   08 88 06 8f  b2 32 cc 60  b1 cc 1c 4f  4a 05 73 c4
|   83 7d 6d bf  cb 89 f5 4d  32 e1 80 d6  17 1b 18 db
|   db 85 ab 48  04 eb 78 ef  4e 0d cb e9  4f 03 02 0c
|   ac 73 ff 51  cc 5f 93 22  23 c2 c9 99  7b 29 82 d6
|   39 76 98 8c  cb c9 51 b4  55 c3 8f 23  e1 79 c8 73
|   c2 eb eb bc  94 c1 7c 9e  14 47 19 29  29 00 00 24
|   2d 3f 27 24  b9 dd 9b 45  84 3e dc b3  60 92 97 51
|   18 60 67 ea  76 46 21 30  76 31 36 23  64 f4 ef 69
|   29 00 00 08  00 00 40 2e  29 00 00 1c  00 00 40 04
|   b7 fc 34 56  d9 76 29 55  b4 c7 e3 54  0b be ed f4
|   77 46 67 5a  2b 00 00 1c  00 00 40 05  b8 c5 53 aa
|   52 28 4e 42  77 05 02 c5  78 3d eb e5  0f 3e 59 63
|   00 00 00 17  4f 70 70 6f  72 74 75 6e  69 73 74 69
|   63 20 49 50  73 65 63
| state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted
| libevent_free: release ptr-libevent@0x556f683643f8
| free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x556f68365a88
| event_schedule: new EVENT_SO_DISCARD-pe@0x556f68365a88
| inserting event EVENT_SO_DISCARD, timeout in 200 seconds for #1
| libevent_malloc: new ptr-libevent@0x556f683637f8 size 128
| resume sending helper answer for #1 suppresed complete_v2_state_transition()
| #1 spent 0.462 milliseconds in resume sending helper answer
| stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in resume_handler() at server.c:833)
| libevent_free: release ptr-libevent@0x7f113c002888
| spent 0.00284 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue()
| *received 539 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   35 20 23 08  00 00 00 01  00 00 02 1b  23 00 01 ff
|   00 01 00 05  bd 03 b3 ad  45 94 2b d6  0b 5f 6a a1
|   47 6d d1 62  06 7a ec 48  7c 75 6a 48  ea 6a 03 fb
|   dc 57 5d 22  d3 3d ee c1  71 61 9b 47  64 94 fe 88
|   d2 f2 63 e0  d7 5f 24 f5  c9 a8 4d 19  bb db 3b 07
|   4e 35 b0 39  55 c1 71 29  54 18 ae a3  d2 f7 22 f3
|   31 07 93 93  23 05 f5 c7  94 2d aa 9d  3c 24 b5 75
|   f6 a7 36 9f  45 f3 fb 61  63 67 54 85  98 fa fa 8e
|   f2 c8 b5 8b  0b c7 5d b7  17 1d 2b 71  08 f5 bd 08
|   1b de a2 67  a8 c3 b1 f9  03 65 62 7c  50 6b 0d be
|   f6 73 13 7e  48 71 7a cb  ec b6 fb fd  1f a6 20 c0
|   6e 2e 6c da  06 e1 3d 32  0b 73 4f 61  26 74 88 f0
|   12 3f b8 3b  e2 23 0f 3f  69 5f 97 19  be 67 79 c6
|   ef 28 1d 73  eb b1 3a 24  af 1c 0f ce  1b d6 11 5b
|   a7 0c dd 71  0f 95 9c b8  9a d4 c6 bb  c0 93 eb d0
|   03 bd d8 e9  34 cf 0c 20  53 e5 81 c3  11 24 16 48
|   3c f7 f7 dd  6b 50 96 05  6f ed 3c 29  d4 22 21 cb
|   3f 6a 52 41  9d e7 4e 01  31 f5 4b 91  0e c8 73 d7
|   c7 8e fc 56  5f d0 66 ae  9a f8 58 ca  5f d0 4e 57
|   f6 fa 48 28  21 0a cc 8c  db aa e9 6d  2d b6 20 fc
|   3a b1 d2 37  35 b1 90 a7  0a b7 91 79  d6 ce d5 df
|   e5 54 12 e2  26 89 19 28  29 a5 88 7f  b5 c0 e5 54
|   0d 40 e3 29  13 32 4e b2  af 27 df 0d  db b4 11 10
|   05 e1 ad 39  c3 28 75 3f  28 64 97 1f  b7 46 b8 32
|   c0 f3 19 6a  62 c6 8f e9  a1 62 d1 85  54 a4 c5 78
|   f4 bd 12 39  ae d7 d6 3a  2e 07 7f 03  24 6c 13 50
|   1b 26 35 5f  64 59 a4 bf  d5 1a 81 25  ad 0a 37 e8
|   2b 35 96 4e  df b0 13 62  9b 9f b4 ae  f6 ec a8 02
|   24 ae 83 e3  ec b4 79 17  6f 93 fe 94  5b 6a a5 c0
|   6f e3 90 a7  b4 cf a9 eb  bf 7b c5 6b  6b 5e fa 04
|   71 49 1e 66  f3 13 e2 e2  71 66 3f ef  3a 2e a6 f1
|   ba 6e 2c 33  bb e6 c4 79  60 88 20 d7  30 3e 0a 93
|   2f 9b 07 87  5c 3a 7a aa  e1 af f7
| start processing: from 192.1.2.45:500 (in process_md() at demux.c:378)
| **parse ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_v2SKF (0x35)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_IKE_AUTH (0x23)
|    flags: ISAKMP_FLAG_v2_IKE_INIT (0x8)
|    Message ID: 1 (0x1)
|    length: 539 (0x21b)
|  processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35)
| I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request 
| State DB: found IKEv2 state #1 in PARENT_R1 (find_v2_ike_sa)
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2016)
| State DB: IKEv2 state not found (find_v2_sa_by_responder_wip)
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:2064)
| #1 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001
| Message ID: #1 not a duplicate - message is new; initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0
| unpacking clear payload
| Now let's proceed with payload (ISAKMP_NEXT_v2SKF)
| ***parse IKEv2 Encrypted Fragment:
|    next payload type: ISAKMP_NEXT_v2IDi (0x23)
|    flags: none (0x0)
|    length: 511 (0x1ff)
|    fragment number: 1 (0x1)
|    total fragments: 5 (0x5)
| processing payload: ISAKMP_NEXT_v2SKF (len=503)
| Message ID: start-responder #1 request 1; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=-1->1
| #1 in state PARENT_R1: received v2I1, sent v2R1
| received IKE encrypted fragment number '1', total number '5', next payload '35'
|  updated IKE fragment state to respond using fragments without waiting for re-transmits
| stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2018)
| #1 spent 0.121 milliseconds in ikev2_process_packet()
| stop processing: from 192.1.2.45:500 (in process_md() at demux.c:380)
| processing: STOP state #0 (in process_md() at demux.c:382)
| processing: STOP connection NULL (in process_md() at demux.c:383)
| spent 0.13 milliseconds in comm_handle_cb() reading and processing packet
| spent 0.00124 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue()
| *received 539 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   35 20 23 08  00 00 00 01  00 00 02 1b  00 00 01 ff
|   00 02 00 05  5d 3c d3 ab  a9 9e 22 39  32 06 ff 85
|   3d 22 4a 18  93 d4 ff cf  cc 0d d7 77  02 7f 12 4b
|   85 74 89 8b  36 35 02 b7  ba eb 38 6c  12 45 e1 55
|   ab a5 53 ed  0a f0 e5 b5  b2 2b 0a 80  9e c4 32 4e
|   e6 fb 76 9f  82 10 dd 2a  bd fd 98 bd  e7 4b 3d bb
|   a6 f9 f4 44  8c 4f bb a7  ed b4 8d e1  43 22 dc c7
|   ab 01 d6 a5  63 f6 72 f2  cc 9d ca 1b  17 1c 2b c9
|   79 b4 50 f8  bf 4f 3c dd  55 ff e3 f4  5c 84 fb ee
|   e7 ce 49 10  ce b0 6d 0f  09 b7 e6 41  17 09 89 ea
|   dc b0 db 3a  dc ae 15 0b  73 9f 67 fe  8a d7 7b 03
|   96 fa af 08  29 71 8c 08  ba a6 2c 38  3e 39 c7 36
|   a6 6b 12 82  78 e3 9c e3  b8 48 34 dd  ab ee 72 7a
|   23 43 e8 91  9d 4a ad 19  0b 8b 83 49  3e ff ed 21
|   cf 7a 19 8d  ed 95 53 ab  30 5c b4 42  0f d0 46 df
|   92 86 59 3d  71 27 df e5  e9 ef fb 92  2b 31 32 f3
|   70 ad ee aa  26 f8 a5 98  44 41 01 65  82 0b c8 29
|   8b 0a 8d ca  d2 b4 ad 49  7f c0 9d a5  e2 5e 09 f9
|   f1 6c 43 b9  5f 3d 20 d2  55 c9 dc ce  de 74 6c 09
|   3c 6f 56 6c  4b 80 a9 7e  9b 2a 93 ff  98 74 cc 30
|   18 e1 5b 62  6a 37 44 aa  d7 65 2d c8  a1 1d 75 78
|   4a 24 e7 87  ec 25 cd 80  0f 06 fa 4c  a4 8b d5 89
|   c0 2f 0a fc  df 3a 44 d5  72 7e ab 1b  73 b5 84 c2
|   7d 55 ad f7  a3 cf 7e 29  95 62 51 19  62 d8 95 3b
|   5b 2b d2 dd  cf 7b 37 3f  75 1e 27 49  72 e5 51 f3
|   ef 0f 2f 4f  3e d2 b0 08  58 8b 59 3f  b4 79 17 61
|   1a 13 28 d7  4d fd cd 4c  cd d3 a6 37  a1 dc ac 44
|   12 3c ef 67  1a cf 50 28  9c e5 94 17  04 2a d5 93
|   b3 41 c2 fc  3f e7 02 5e  ee 07 a3 3a  03 93 2f ac
|   eb 6c 3d 16  ee 95 e3 57  b7 21 2d 4e  82 b6 97 b2
|   88 7a 15 9b  61 d2 31 ee  6f 53 5a c9  a9 df 0d aa
|   2f c6 63 11  91 69 b5 73  9f 29 f3 23  06 12 98 a5
|   b6 b4 4c 29  d7 c3 60 30  4a b6 16
| start processing: from 192.1.2.45:500 (in process_md() at demux.c:378)
| **parse ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_v2SKF (0x35)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_IKE_AUTH (0x23)
|    flags: ISAKMP_FLAG_v2_IKE_INIT (0x8)
|    Message ID: 1 (0x1)
|    length: 539 (0x21b)
|  processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35)
| I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request 
| State DB: found IKEv2 state #1 in PARENT_R1 (find_v2_ike_sa)
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2016)
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:2062)
| #1 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001
| #1 is idle
| #1 idle
| Message ID: #1 not a duplicate - responder is accumulating fragments; initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=1
| unpacking clear payload
| Now let's proceed with payload (ISAKMP_NEXT_v2SKF)
| ***parse IKEv2 Encrypted Fragment:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    length: 511 (0x1ff)
|    fragment number: 2 (0x2)
|    total fragments: 5 (0x5)
| processing payload: ISAKMP_NEXT_v2SKF (len=503)
| #1 in state PARENT_R1: received v2I1, sent v2R1
| received IKE encrypted fragment number '2', total number '5', next payload '0'
| stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2018)
| #1 spent 0.0934 milliseconds in ikev2_process_packet()
| stop processing: from 192.1.2.45:500 (in process_md() at demux.c:380)
| processing: STOP state #0 (in process_md() at demux.c:382)
| processing: STOP connection NULL (in process_md() at demux.c:383)
| spent 0.1 milliseconds in comm_handle_cb() reading and processing packet
| spent 0.0011 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue()
| *received 539 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   35 20 23 08  00 00 00 01  00 00 02 1b  00 00 01 ff
|   00 03 00 05  29 95 b3 2a  92 7e eb 44  dd 16 fb 40
|   47 72 86 a5  57 1a 2b c3  f8 69 14 a2  72 97 90 35
|   47 4a 2a c3  f8 a3 08 c4  62 ed 49 73  ae 93 24 c1
|   f5 ea b7 e0  44 95 a3 46  56 99 ba e0  b8 e9 b1 92
|   4e 52 37 36  42 e6 8c a2  ff d0 0d db  cd 8e 13 bd
|   a6 b7 12 b6  c7 8b 71 3b  01 37 e5 22  37 2e 16 2b
|   26 8d e4 bf  b0 97 6d 3e  1f bf d6 46  45 e2 f1 b2
|   da 18 2a e7  67 c2 79 7d  14 fb cf 7a  00 6f 5f 57
|   36 9f 9f f8  9e 23 1a ae  57 56 eb cc  66 e2 0c 27
|   2e d1 37 72  40 ec d5 31  bf fe ad 05  e7 ee 3a 9b
|   da 03 12 7b  95 f3 e6 76  9a 37 47 43  1b c7 e8 fd
|   f4 db 8b ef  00 24 66 2d  00 46 45 01  7b 86 a1 31
|   0d 8c 7a 72  a2 08 a3 fa  06 89 1b a1  78 8c f3 58
|   0f 28 af 87  92 9a fd 8b  b4 10 65 73  8e 57 d7 cd
|   9b dd 9a dc  d9 6e 7b 5b  61 0b 11 d9  81 ba 46 6d
|   45 d2 24 14  39 74 b2 1a  10 03 50 e6  a7 74 a5 40
|   00 5a b6 27  12 7a 61 b3  94 9b 31 1a  49 f8 f6 0d
|   cc 34 58 a9  f8 99 b2 d0  54 96 b7 a5  52 92 3b e1
|   17 2b de 3a  8b a5 77 9b  48 21 b5 83  ae 56 56 0d
|   08 8b 2c 16  3d 9d 03 b4  7d dd b9 d9  e7 c7 6f 2c
|   45 7a 6e d3  47 c1 23 fa  28 b0 dd 9d  93 4d 62 97
|   5e 5a 6b 24  96 0f af 5f  bf 9c 9d 10  8c 8f 38 58
|   08 ed 60 1d  15 e5 da 6e  a1 b3 28 44  c2 21 56 25
|   8e fc 81 38  64 9f 64 23  72 c4 bf a2  0a fe 57 c7
|   d7 2f 0f 8f  4d ba ea da  67 f1 0c 7b  b2 5d 07 40
|   52 60 db 0e  45 d9 24 37  25 f8 e4 fd  1f 7f 94 06
|   f5 c9 63 38  81 50 bf 98  81 65 2a ac  59 93 0c ae
|   2f e3 fb 49  7e ce 1e db  16 79 c8 d3  f9 77 7c bf
|   02 44 72 b2  fe 30 ad 55  28 8e 85 e8  82 70 c5 2a
|   6e 8f 7e 74  02 91 60 3f  9e a4 9b fe  5b 5f f1 cc
|   72 5b 1d 3f  4e 60 fa 2f  5e f8 c4 ae  c3 0c b4 b7
|   5d 1b 76 d2  ac 64 a1 c6  47 ba 5d
| start processing: from 192.1.2.45:500 (in process_md() at demux.c:378)
| **parse ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_v2SKF (0x35)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_IKE_AUTH (0x23)
|    flags: ISAKMP_FLAG_v2_IKE_INIT (0x8)
|    Message ID: 1 (0x1)
|    length: 539 (0x21b)
|  processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35)
| I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request 
| State DB: found IKEv2 state #1 in PARENT_R1 (find_v2_ike_sa)
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2016)
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:2062)
| #1 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001
| #1 is idle
| #1 idle
| Message ID: #1 not a duplicate - responder is accumulating fragments; initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=1
| unpacking clear payload
| Now let's proceed with payload (ISAKMP_NEXT_v2SKF)
| ***parse IKEv2 Encrypted Fragment:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    length: 511 (0x1ff)
|    fragment number: 3 (0x3)
|    total fragments: 5 (0x5)
| processing payload: ISAKMP_NEXT_v2SKF (len=503)
| #1 in state PARENT_R1: received v2I1, sent v2R1
| received IKE encrypted fragment number '3', total number '5', next payload '0'
| stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2018)
| #1 spent 0.0876 milliseconds in ikev2_process_packet()
| stop processing: from 192.1.2.45:500 (in process_md() at demux.c:380)
| processing: STOP state #0 (in process_md() at demux.c:382)
| processing: STOP connection NULL (in process_md() at demux.c:383)
| spent 0.0943 milliseconds in comm_handle_cb() reading and processing packet
| spent 0.00104 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue()
| *received 539 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   35 20 23 08  00 00 00 01  00 00 02 1b  00 00 01 ff
|   00 04 00 05  ed ee ac 9a  a8 04 f8 9a  c7 fd 65 c4
|   0d 93 b9 d1  55 1b c6 4b  20 98 da f7  41 2f ec c0
|   5b 6a 5f c3  70 d0 61 56  7e f2 4d be  17 78 7e 87
|   90 20 e0 e0  f8 12 39 30  e4 b0 69 54  6d 0a e6 23
|   ad ad 5d 89  7c 44 23 c8  41 48 f7 19  77 b6 67 20
|   49 03 8d 38  5a 7c 3a cf  89 03 4b 3a  78 35 90 7c
|   9c 71 b6 8c  d7 cc 9f 60  cb fb eb 85  40 97 b9 7b
|   ba 45 86 05  ed 09 1c d0  a4 e1 1d 97  bd 2f a7 1d
|   32 ae c9 fe  c7 ab e0 35  13 5e ab 09  df d9 eb 23
|   a5 e9 8b 28  c2 b9 02 ed  07 02 4e 30  29 af 5d c4
|   f3 c1 a1 c3  31 86 45 c7  77 70 1b f7  21 a6 dc 21
|   ae 7b 33 5a  4c b4 04 57  f5 81 75 bd  ed 50 6c 78
|   e4 8d 60 65  1a 5c af c0  c5 fc 21 68  0a fa a4 8b
|   42 64 88 4f  6e ec 3b 43  4a 54 0b 25  49 6a dd 98
|   68 82 8c 1b  05 3a 4c e9  e2 00 62 48  7c 5f 4d 6f
|   b1 1d df 20  b2 08 93 28  74 84 25 24  4c 17 98 46
|   80 d6 96 54  21 b3 b2 c4  11 29 0b 6d  14 f2 02 3b
|   98 4c 38 99  3b d0 91 55  48 52 b5 e6  48 be cf 80
|   a7 4e 8d 32  05 29 12 a6  56 c7 03 cf  65 3e c9 d8
|   4a 4b 8a 23  ed 95 8d a1  79 88 5d b6  07 9b 03 45
|   23 55 61 95  5a 02 c0 7c  71 b8 c6 f6  50 96 f2 aa
|   f5 6a 39 d5  cf c1 c1 c6  7e 57 55 42  99 9e 4f f9
|   aa 9b eb 30  7b 7c 03 b1  a1 e3 bb fc  5c e7 f9 17
|   a5 b2 fa ed  bb bc 39 6f  19 c0 88 22  d2 71 98 9c
|   81 13 38 86  9f b0 ce d3  87 f5 7a 37  6d 6c fd 17
|   6b 8d 43 dd  49 6e 81 eb  57 4b 2c d9  20 42 7a 31
|   0f 14 70 5a  9f f9 6a b8  c6 3c 82 d1  d9 ac 02 4d
|   12 04 e4 6e  26 e4 ca d0  1a b0 43 c1  ce 4e 90 2a
|   58 e7 2d 87  51 bb 46 03  3d 51 51 53  c0 80 70 c9
|   ff 12 07 1a  09 db 9f ca  fb dc 67 99  d1 18 c1 96
|   19 40 e1 a2  e7 a8 ea 66  9c f0 0f 58  d6 14 c1 be
|   91 85 32 af  24 62 91 e9  ff f2 87
| start processing: from 192.1.2.45:500 (in process_md() at demux.c:378)
| **parse ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_v2SKF (0x35)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_IKE_AUTH (0x23)
|    flags: ISAKMP_FLAG_v2_IKE_INIT (0x8)
|    Message ID: 1 (0x1)
|    length: 539 (0x21b)
|  processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35)
| I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request 
| State DB: found IKEv2 state #1 in PARENT_R1 (find_v2_ike_sa)
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2016)
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:2062)
| #1 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001
| #1 is idle
| #1 idle
| Message ID: #1 not a duplicate - responder is accumulating fragments; initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=1
| unpacking clear payload
| Now let's proceed with payload (ISAKMP_NEXT_v2SKF)
| ***parse IKEv2 Encrypted Fragment:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    length: 511 (0x1ff)
|    fragment number: 4 (0x4)
|    total fragments: 5 (0x5)
| processing payload: ISAKMP_NEXT_v2SKF (len=503)
| #1 in state PARENT_R1: received v2I1, sent v2R1
| received IKE encrypted fragment number '4', total number '5', next payload '0'
| stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2018)
| #1 spent 0.0872 milliseconds in ikev2_process_packet()
| stop processing: from 192.1.2.45:500 (in process_md() at demux.c:380)
| processing: STOP state #0 (in process_md() at demux.c:382)
| processing: STOP connection NULL (in process_md() at demux.c:383)
| spent 0.0938 milliseconds in comm_handle_cb() reading and processing packet
| spent 0.00102 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue()
| *received 217 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   35 20 23 08  00 00 00 01  00 00 00 d9  00 00 00 bd
|   00 05 00 05  ba d7 37 b3  51 42 3d 5e  c4 e7 58 68
|   33 62 eb ad  92 04 b7 21  1d d7 14 14  b4 3b 86 bd
|   ea 11 1d f0  41 7a a8 75  4d 6c 1a 27  4c 24 6d 09
|   02 68 8a 27  b9 20 17 f4  fb 57 0f 8f  e4 e0 a9 78
|   3d d6 44 b8  23 ee 26 f6  f0 b4 00 a4  42 ad 0a a2
|   a7 fb b6 d7  52 50 a8 c3  5a 36 7e a1  3a f7 76 54
|   ad ea 85 1e  9f 3c ea 03  44 28 68 91  c2 e6 f2 b7
|   48 0e cc 90  fb ab 31 47  4d 36 27 f7  2c ce ed c2
|   aa 6d c6 64  7b 29 60 b5  6d 0f 42 af  c0 41 3e 6e
|   8e d6 31 ae  17 9b 11 34  30 78 6b 1a  ed fe 45 82
|   34 71 81 c2  28 5e f3 22  c6 66 4e e4  bc 6b 02 62
|   49 89 02 07  95 a9 42 f3  4b
| start processing: from 192.1.2.45:500 (in process_md() at demux.c:378)
| **parse ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_v2SKF (0x35)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_IKE_AUTH (0x23)
|    flags: ISAKMP_FLAG_v2_IKE_INIT (0x8)
|    Message ID: 1 (0x1)
|    length: 217 (0xd9)
|  processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35)
| I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request 
| State DB: found IKEv2 state #1 in PARENT_R1 (find_v2_ike_sa)
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2016)
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:2062)
| #1 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001
| #1 is idle
| #1 idle
| Message ID: #1 not a duplicate - responder is accumulating fragments; initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=1
| unpacking clear payload
| Now let's proceed with payload (ISAKMP_NEXT_v2SKF)
| ***parse IKEv2 Encrypted Fragment:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    length: 189 (0xbd)
|    fragment number: 5 (0x5)
|    total fragments: 5 (0x5)
| processing payload: ISAKMP_NEXT_v2SKF (len=181)
| #1 in state PARENT_R1: received v2I1, sent v2R1
| received IKE encrypted fragment number '5', total number '5', next payload '0'
| selected state microcode Responder: process IKE_AUTH request (no SKEYSEED)
| Now let's proceed with state specific processing
| calling processor Responder: process IKE_AUTH request (no SKEYSEED)
| ikev2 parent inI2outR2: calculating g^{xy} in order to decrypt I2
| offloading IKEv2 SKEYSEED using prf=HMAC_SHA2_512 integ=NONE cipherkey=AES_GCM_16
| adding ikev2_inI2outR2 KE work-order 2 for state #1
| state #1 requesting EVENT_SO_DISCARD to be deleted
| libevent_free: release ptr-libevent@0x556f683637f8
| free_event_entry: release EVENT_SO_DISCARD-pe@0x556f68365a88
| event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x556f68365a88
| inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1
| libevent_malloc: new ptr-libevent@0x7f113c002888 size 128
|   #1 spent 0.0214 milliseconds in processing: Responder: process IKE_AUTH request (no SKEYSEED) in ikev2_process_state_packet()
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3379)
| #1 complete_v2_state_transition() PARENT_R1->PARENT_R1 with status STF_SUSPEND
| suspending state #1 and saving MD
| #1 is busy; has a suspended MD
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in log_stf_suspend() at ikev2.c:3269)
| "westnet-eastnet-ikev2" #1 complete v2 state STATE_PARENT_R1 transition with STF_SUSPEND suspended from complete_v2_state_transition:3451
| stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:2018)
| #1 spent 0.112 milliseconds in ikev2_process_packet()
| stop processing: from 192.1.2.45:500 (in process_md() at demux.c:380)
| processing: STOP state #0 (in process_md() at demux.c:382)
| processing: STOP connection NULL (in process_md() at demux.c:383)
| spent 0.119 milliseconds in comm_handle_cb() reading and processing packet
| crypto helper 2 resuming
| crypto helper 2 starting work-order 2 for state #1
| crypto helper 2 doing compute dh (V2) (ikev2_inI2outR2 KE); request ID 2
| calculating skeyseed using prf=sha2_512 integ=none cipherkey-size=32 salt-size=4
| crypto helper 2 finished compute dh (V2) (ikev2_inI2outR2 KE); request ID 2 time elapsed 0.000813 seconds
| (#1) spent 0.816 milliseconds in crypto helper computing work-order 2: ikev2_inI2outR2 KE (pcr)
| crypto helper 2 sending results from work-order 2 for state #1 to event queue
| scheduling resume sending helper answer for #1
| libevent_malloc: new ptr-libevent@0x7f1134000f48 size 128
| crypto helper 2 waiting (nothing to do)
| processing resume sending helper answer for #1
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in resume_handler() at server.c:797)
| crypto helper 2 replies to request ID 2
| calling continuation function 0x556f666bbb50
| ikev2_parent_inI2outR2_continue for #1: calculating g^{xy}, sending R2
| #1 in state PARENT_R1: received v2I1, sent v2R1
| already have all fragments, skipping fragment collection
| already have all fragments, skipping fragment collection
| #1 ikev2 ISAKMP_v2_IKE_AUTH decrypt success
| Now let's proceed with payload (ISAKMP_NEXT_v2IDi)
| **parse IKEv2 Identification - Initiator - Payload:
|    next payload type: ISAKMP_NEXT_v2CERT (0x25)
|    flags: none (0x0)
|    length: 191 (0xbf)
|    ID type: ID_DER_ASN1_DN (0x9)
| processing payload: ISAKMP_NEXT_v2IDi (len=183)
| Now let's proceed with payload (ISAKMP_NEXT_v2CERT)
| **parse IKEv2 Certificate Payload:
|    next payload type: ISAKMP_NEXT_v2IDr (0x24)
|    flags: none (0x0)
|    length: 1265 (0x4f1)
|    ikev2 cert encoding: CERT_X509_SIGNATURE (0x4)
| processing payload: ISAKMP_NEXT_v2CERT (len=1260)
| Now let's proceed with payload (ISAKMP_NEXT_v2IDr)
| **parse IKEv2 Identification - Responder - Payload:
|    next payload type: ISAKMP_NEXT_v2AUTH (0x27)
|    flags: none (0x0)
|    length: 8 (0x8)
|    ID type: ID_NULL (0xd)
| processing payload: ISAKMP_NEXT_v2IDr (len=0)
| Now let's proceed with payload (ISAKMP_NEXT_v2AUTH)
| **parse IKEv2 Authentication Payload:
|    next payload type: ISAKMP_NEXT_v2SA (0x21)
|    flags: none (0x0)
|    length: 392 (0x188)
|    auth method: IKEv2_AUTH_RSA (0x1)
| processing payload: ISAKMP_NEXT_v2AUTH (len=384)
| Now let's proceed with payload (ISAKMP_NEXT_v2SA)
| **parse IKEv2 Security Association Payload:
|    next payload type: ISAKMP_NEXT_v2TSi (0x2c)
|    flags: none (0x0)
|    length: 164 (0xa4)
| processing payload: ISAKMP_NEXT_v2SA (len=160)
| Now let's proceed with payload (ISAKMP_NEXT_v2TSi)
| **parse IKEv2 Traffic Selector - Initiator - Payload:
|    next payload type: ISAKMP_NEXT_v2TSr (0x2d)
|    flags: none (0x0)
|    length: 24 (0x18)
|    number of TS: 1 (0x1)
| processing payload: ISAKMP_NEXT_v2TSi (len=16)
| Now let's proceed with payload (ISAKMP_NEXT_v2TSr)
| **parse IKEv2 Traffic Selector - Responder - Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    length: 24 (0x18)
|    number of TS: 1 (0x1)
| processing payload: ISAKMP_NEXT_v2TSr (len=16)
| selected state microcode Responder: process IKE_AUTH request
| Now let's proceed with state specific processing
| calling processor Responder: process IKE_AUTH request
"westnet-eastnet-ikev2" #1: processing decrypted IKE_AUTH request: SK{IDi,CERT,IDr,AUTH,SA,TSi,TSr}
| #1 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2669)
| global one-shot timer EVENT_FREE_ROOT_CERTS scheduled in 300 seconds
loading root certificate cache
| spent 2.64 milliseconds in get_root_certs() calling PK11_ListCertsInSlot()
| spent 0.0175 milliseconds in get_root_certs() filtering CAs
|       #1 spent 2.69 milliseconds in find_and_verify_certs() calling get_root_certs()
| checking for known CERT payloads
| saving certificate of type 'X509_SIGNATURE'
| decoded cert: E=user-west@testing.libreswan.org,CN=west.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA
|       #1 spent 0.0319 milliseconds in find_and_verify_certs() calling decode_cert_payloads()
| cert_issuer_has_current_crl: looking for a CRL issued by E=testing@libreswan.org,CN=Libreswan test CA for mainca,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA
|       #1 spent 0.0316 milliseconds in find_and_verify_certs() calling crl_update_check()
| missing or expired CRL
| crl_strict: 0, ocsp: 0, ocsp_strict: 0, ocsp_post: 0
| verify_end_cert trying profile IPsec
| certificate is valid (profile IPsec)
|       #1 spent 0.0883 milliseconds in find_and_verify_certs() calling verify_end_cert()
"westnet-eastnet-ikev2" #1: certificate verified OK: E=user-west@testing.libreswan.org,CN=west.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f683801c8
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f68380018
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f6837fe68
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f6837fcb8
| get_pluto_gn_from_nss_cert: allocated pluto_gn 0x556f6837fb08
| unreference key: 0x556f68380478 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org cnt 1--
|       #1 spent 0.21 milliseconds in decode_certs() calling add_pubkey_from_nss_cert()
|     #1 spent 3.07 milliseconds in decode_certs()
| DER ASN1 DN:  30 81 b4 31  0b 30 09 06  03 55 04 06  13 02 43 41
| DER ASN1 DN:  31 10 30 0e  06 03 55 04  08 0c 07 4f  6e 74 61 72
| DER ASN1 DN:  69 6f 31 10  30 0e 06 03  55 04 07 0c  07 54 6f 72
| DER ASN1 DN:  6f 6e 74 6f  31 12 30 10  06 03 55 04  0a 0c 09 4c
| DER ASN1 DN:  69 62 72 65  73 77 61 6e  31 18 30 16  06 03 55 04
| DER ASN1 DN:  0b 0c 0f 54  65 73 74 20  44 65 70 61  72 74 6d 65
| DER ASN1 DN:  6e 74 31 23  30 21 06 03  55 04 03 0c  1a 77 65 73
| DER ASN1 DN:  74 2e 74 65  73 74 69 6e  67 2e 6c 69  62 72 65 73
| DER ASN1 DN:  77 61 6e 2e  6f 72 67 31  2e 30 2c 06  09 2a 86 48
| DER ASN1 DN:  86 f7 0d 01  09 01 16 1f  75 73 65 72  2d 77 65 73
| DER ASN1 DN:  74 40 74 65  73 74 69 6e  67 2e 6c 69  62 72 65 73
| DER ASN1 DN:  77 61 6e 2e  6f 72 67
| received IDr payload - extracting our alleged ID
| ID_DER_ASN1_DN 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' needs further ID comparison against 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org'
| ID_DER_ASN1_DN 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' matched our ID
| X509: CERT and ID matches current connection
| refine_host_connection for IKEv2: starting with "westnet-eastnet-ikev2"
| trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| refine_host_connection: happy with starting point: "westnet-eastnet-ikev2"
| ID_NULL: id kind matches
| The remote specified our ID in its IDr payload
| offered CA: '%none'
"westnet-eastnet-ikev2" #1: IKEv2 mode peer ID is ID_DER_ASN1_DN: 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org'
| verifying AUTH payload
| required RSA CA is 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| checking RSA keyid 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' for match with 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org'
| trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| key issuer CA is 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| an RSA Sig check passed with *AwEAAZd0v [remote certificates]
|       #1 spent 0.104 milliseconds in try_all_RSA_keys() trying a pubkey
"westnet-eastnet-ikev2" #1: Authenticated using RSA
|     #1 spent 0.132 milliseconds in ikev2_verify_rsa_hash()
| parent state #1: PARENT_R1(half-open IKE SA) => PARENT_R2(established IKE SA)
| #1 will start re-keying in 3330 seconds with margin of 270 seconds (attempting re-key)
| state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted
| libevent_free: release ptr-libevent@0x7f113c002888
| free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x556f68365a88
| event_schedule: new EVENT_SA_REKEY-pe@0x556f68365a88
| inserting event EVENT_SA_REKEY, timeout in 3330 seconds for #1
| libevent_malloc: new ptr-libevent@0x556f68380e78 size 128
| pstats #1 ikev2.ike established
| **emit ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_NONE (0x0)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_IKE_AUTH (0x23)
|    flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20)
|    Message ID: 1 (0x1)
| next payload chain: saving message location 'ISAKMP Message'.'next payload type'
| IKEv2 CERT: send a certificate?
| IKEv2 CERT: policy does not have RSASIG or ECDSA: AUTHNULL
| ***emit IKEv2 Encryption Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
| next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK)
| next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet'
| emitting 8 zero bytes of IV into IKEv2 Encryption Payload
| Initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED
| ****emit IKEv2 Identification - Responder - Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    ID type: ID_NULL (0xd)
| next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr)
| next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet'
| emitting 0 raw bytes of my identity into IKEv2 Identification - Responder - Payload
| my identity
| emitting length of IKEv2 Identification - Responder - Payload: 8
| assembled IDr payload
| CHILD SA proposals received
| going to assemble AUTH payload
| ****emit IKEv2 Authentication Payload:
|    next payload type: ISAKMP_NEXT_v2SA (0x21)
|    flags: none (0x0)
|    auth method: IKEv2_AUTH_NULL (0xd)
| next payload chain: ignoring supplied 'IKEv2 Authentication Payload'.'next payload type' value 33:ISAKMP_NEXT_v2SA
| next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH)
| next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet'
| ikev2_calculate_psk_sighash() called from STATE_PARENT_R2 to create PSK with authby=null
| emitting 64 raw bytes of PSK auth into IKEv2 Authentication Payload
| PSK auth  4d 79 cb 6a  aa 89 fc 37  5d 4d 5d 5f  17 01 65 d9
| PSK auth  1c 46 91 d3  43 a0 f5 16  13 e3 10 30  93 a5 8a 20
| PSK auth  a2 c6 a0 b4  3e 49 60 b0  e2 fa ca f7  b4 4d d8 32
| PSK auth  ca 6d d3 db  39 65 be c7  63 3e f3 90  bb a7 0e 31
| emitting length of IKEv2 Authentication Payload: 72
| creating state object #2 at 0x556f68370808
| State DB: adding IKEv2 state #2 in UNDEFINED
| pstats #2 ikev2.child started
| duplicating state object #1 "westnet-eastnet-ikev2" as #2 for IPSEC SA
| #2 setting local endpoint to 192.1.2.23:500 from #1.st_localport (in duplicate_state() at state.c:1484)
| Message ID: init_child #1.#2; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0; child: wip.initiator=0->-1 wip.responder=0->-1
| Message ID: switch-from #1 request 1; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=1->-1
| Message ID: switch-to #1.#2 request 1; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0; child: wip.initiator=-1 wip.responder=-1->1
| Child SA TS Request has ike->sa == md->st; so using parent connection
| TSi: parsing 1 traffic selectors
| ***parse IKEv2 Traffic Selector:
|    TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7)
|    IP Protocol ID: 0 (0x0)
|    length: 16 (0x10)
|    start port: 0 (0x0)
|    end port: 65535 (0xffff)
| parsing 4 raw bytes of IKEv2 Traffic Selector into TS low
| TS low  c0 00 01 00
| parsing 4 raw bytes of IKEv2 Traffic Selector into TS high
| TS high  c0 00 01 ff
| TSi: parsed 1 traffic selectors
| TSr: parsing 1 traffic selectors
| ***parse IKEv2 Traffic Selector:
|    TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7)
|    IP Protocol ID: 0 (0x0)
|    length: 16 (0x10)
|    start port: 0 (0x0)
|    end port: 65535 (0xffff)
| parsing 4 raw bytes of IKEv2 Traffic Selector into TS low
| TS low  c0 00 02 00
| parsing 4 raw bytes of IKEv2 Traffic Selector into TS high
| TS high  c0 00 02 ff
| TSr: parsed 1 traffic selectors
| looking for best SPD in current connection
| evaluating our conn="westnet-eastnet-ikev2" I=192.0.1.0/24:0/0 R=192.0.2.0/24:0/0 to their:
|     TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535
|         match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32
|         narrow port end=0..65535 == TSi[0]=0..65535: 0
|           TSi[0] port match: YES fitness 65536
|         narrow protocol end=*0 == TSi[0]=*0: 0
|         match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255
|     TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535
|         match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32
|         narrow port end=0..65535 == TSr[0]=0..65535: 0
|           TSr[0] port match: YES fitness 65536
|         narrow protocol end=*0 == TSr[0]=*0: 0
|         match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255
| best fit so far: TSi[0] TSr[0]
|     found better spd route for TSi[0],TSr[0]
| looking for better host pair
| find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports
|   checking hostpair 192.0.2.0/24 -> 192.0.1.0/24 is found
|   investigating connection "westnet-eastnet-ikev2" as a better match
| ID_NULL: id kind matches
|    match_id a=C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org
|             b=C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org
|    results  matched
| trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| evaluating our conn="westnet-eastnet-ikev2" I=192.0.1.0/24:0/0 R=192.0.2.0/24:0/0 to their:
|     TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535
|         match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32
|         narrow port end=0..65535 == TSi[0]=0..65535: 0
|           TSi[0] port match: YES fitness 65536
|         narrow protocol end=*0 == TSi[0]=*0: 0
|         match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255
|     TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535
|         match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32
|         narrow port end=0..65535 == TSr[0]=0..65535: 0
|           TSr[0] port match: YES fitness 65536
|         narrow protocol end=*0 == TSr[0]=*0: 0
|         match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255
| best fit so far: TSi[0] TSr[0]
|   did not find a better connection using host pair
| printing contents struct traffic_selector
|   ts_type: IKEv2_TS_IPV4_ADDR_RANGE
|   ipprotoid: 0
|   port range: 0-65535
|   ip range: 192.0.2.0-192.0.2.255
| printing contents struct traffic_selector
|   ts_type: IKEv2_TS_IPV4_ADDR_RANGE
|   ipprotoid: 0
|   port range: 0-65535
|   ip range: 192.0.1.0-192.0.1.255
| constructing ESP/AH proposals with all DH removed  for westnet-eastnet-ikev2 (IKE_AUTH responder matching remote ESP/AH proposals)
| converting proposal AES_GCM_16_256-NONE to ikev2 ...
| ...  ikev2_proposal: 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED
| converting proposal AES_GCM_16_128-NONE to ikev2 ...
| ...  ikev2_proposal: 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED
| converting proposal AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ...
| ...  ikev2_proposal: 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED
| converting proposal AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ...
| ...  ikev2_proposal: 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED
"westnet-eastnet-ikev2": constructed local ESP/AH proposals for westnet-eastnet-ikev2 (IKE_AUTH responder matching remote ESP/AH proposals): 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED
| Comparing remote proposals against IKE_AUTH responder matching remote ESP/AH proposals 4 local proposals
| local proposal 1 type ENCR has 1 transforms
| local proposal 1 type PRF has 0 transforms
| local proposal 1 type INTEG has 1 transforms
| local proposal 1 type DH has 1 transforms
| local proposal 1 type ESN has 1 transforms
| local proposal 1 transforms: required: ENCR+ESN; optional: INTEG+DH
| local proposal 2 type ENCR has 1 transforms
| local proposal 2 type PRF has 0 transforms
| local proposal 2 type INTEG has 1 transforms
| local proposal 2 type DH has 1 transforms
| local proposal 2 type ESN has 1 transforms
| local proposal 2 transforms: required: ENCR+ESN; optional: INTEG+DH
| local proposal 3 type ENCR has 1 transforms
| local proposal 3 type PRF has 0 transforms
| local proposal 3 type INTEG has 2 transforms
| local proposal 3 type DH has 1 transforms
| local proposal 3 type ESN has 1 transforms
| local proposal 3 transforms: required: ENCR+INTEG+ESN; optional: DH
| local proposal 4 type ENCR has 1 transforms
| local proposal 4 type PRF has 0 transforms
| local proposal 4 type INTEG has 2 transforms
| local proposal 4 type DH has 1 transforms
| local proposal 4 type ESN has 1 transforms
| local proposal 4 transforms: required: ENCR+INTEG+ESN; optional: DH
| ***parse IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_NON_LAST (0x2)
|    length: 32 (0x20)
|    prop #: 1 (0x1)
|    proto ID: IKEv2_SEC_PROTO_ESP (0x3)
|    spi size: 4 (0x4)
|    # transforms: 2 (0x2)
| parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI
| remote SPI  f8 fb 7e 1a
| Comparing remote proposal 1 containing 2 transforms against local proposal [1..4] of 4 local proposals
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 12 (0xc)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_GCM_C (0x14)
| *****parse IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 256 (0x100)
| remote proposal 1 transform 0 (ENCR=AES_GCM_C_256) matches local proposal 1 type 1 (ENCR) transform 0
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_ESN (0x5)
|    IKEv2 transform ID: ESN_DISABLED (0x0)
| remote proposal 1 transform 1 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0
| remote proposal 1 transform 1 (ESN=DISABLED) matches local proposal 2 type 5 (ESN) transform 0
| remote proposal 1 transform 1 (ESN=DISABLED) matches local proposal 3 type 5 (ESN) transform 0
| remote proposal 1 transform 1 (ESN=DISABLED) matches local proposal 4 type 5 (ESN) transform 0
| remote proposal 1 proposed transforms: ENCR+ESN; matched: ENCR+ESN; unmatched: none
| comparing remote proposal 1 containing ENCR+ESN transforms to local proposal 1; required: ENCR+ESN; optional: INTEG+DH; matched: ENCR+ESN
| remote proposal 1 matches local proposal 1
| ***parse IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_NON_LAST (0x2)
|    length: 32 (0x20)
|    prop #: 2 (0x2)
|    proto ID: IKEv2_SEC_PROTO_ESP (0x3)
|    spi size: 4 (0x4)
|    # transforms: 2 (0x2)
| parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI
| remote SPI  f8 fb 7e 1a
| Comparing remote proposal 2 containing 2 transforms against local proposal [1..0] of 4 local proposals
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 12 (0xc)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_GCM_C (0x14)
| *****parse IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 128 (0x80)
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_ESN (0x5)
|    IKEv2 transform ID: ESN_DISABLED (0x0)
| remote proposal 2 proposed transforms: ENCR+ESN; matched: none; unmatched: ENCR+ESN
| remote proposal 2 does not match; unmatched remote transforms: ENCR+ESN
| ***parse IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_NON_LAST (0x2)
|    length: 48 (0x30)
|    prop #: 3 (0x3)
|    proto ID: IKEv2_SEC_PROTO_ESP (0x3)
|    spi size: 4 (0x4)
|    # transforms: 4 (0x4)
| parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI
| remote SPI  f8 fb 7e 1a
| Comparing remote proposal 3 containing 4 transforms against local proposal [1..0] of 4 local proposals
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 12 (0xc)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_CBC (0xc)
| *****parse IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 256 (0x100)
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_INTEG (0x3)
|    IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe)
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_INTEG (0x3)
|    IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc)
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_ESN (0x5)
|    IKEv2 transform ID: ESN_DISABLED (0x0)
| remote proposal 3 proposed transforms: ENCR+INTEG+ESN; matched: none; unmatched: ENCR+INTEG+ESN
| remote proposal 3 does not match; unmatched remote transforms: ENCR+INTEG+ESN
| ***parse IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_LAST (0x0)
|    length: 48 (0x30)
|    prop #: 4 (0x4)
|    proto ID: IKEv2_SEC_PROTO_ESP (0x3)
|    spi size: 4 (0x4)
|    # transforms: 4 (0x4)
| parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI
| remote SPI  f8 fb 7e 1a
| Comparing remote proposal 4 containing 4 transforms against local proposal [1..0] of 4 local proposals
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 12 (0xc)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_CBC (0xc)
| *****parse IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 128 (0x80)
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_INTEG (0x3)
|    IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe)
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_INTEG (0x3)
|    IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc)
| ****parse IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    length: 8 (0x8)
|    IKEv2 transform type: TRANS_TYPE_ESN (0x5)
|    IKEv2 transform ID: ESN_DISABLED (0x0)
| remote proposal 4 proposed transforms: ENCR+INTEG+ESN; matched: none; unmatched: ENCR+INTEG+ESN
| remote proposal 4 does not match; unmatched remote transforms: ENCR+INTEG+ESN
"westnet-eastnet-ikev2" #1: proposal 1:ESP:SPI=f8fb7e1a;ENCR=AES_GCM_C_256;ESN=DISABLED chosen from remote proposals 1:ESP:ENCR=AES_GCM_C_256;ESN=DISABLED[first-match] 2:ESP:ENCR=AES_GCM_C_128;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256;INTEG=HMAC_SHA2_256_128;ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256;INTEG=HMAC_SHA2_256_128;ESN=DISABLED
| IKE_AUTH responder matching remote ESP/AH proposals ikev2_proposal: 1:ESP:SPI=f8fb7e1a;ENCR=AES_GCM_C_256;ESN=DISABLED
| converting proposal to internal trans attrs
| netlink_get_spi: allocated 0x9e779691 for esp.0@192.1.2.23
| Emitting ikev2_proposal ...
| ****emit IKEv2 Security Association Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
| next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA)
| next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet'
| *****emit IKEv2 Proposal Substructure Payload:
|    last proposal: v2_PROPOSAL_LAST (0x0)
|    prop #: 1 (0x1)
|    proto ID: IKEv2_SEC_PROTO_ESP (0x3)
|    spi size: 4 (0x4)
|    # transforms: 2 (0x2)
| last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal'
| emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload
| our spi  9e 77 96 91
| ******emit IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_NON_LAST (0x3)
|    IKEv2 transform type: TRANS_TYPE_ENCR (0x1)
|    IKEv2 transform ID: AES_GCM_C (0x14)
| last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform'
| *******emit IKEv2 Attribute Substructure Payload:
|    af+type: AF+IKEv2_KEY_LENGTH (0x800e)
|    length/value: 256 (0x100)
| emitting length of IKEv2 Transform Substructure Payload: 12
| ******emit IKEv2 Transform Substructure Payload:
|    last transform: v2_TRANSFORM_LAST (0x0)
|    IKEv2 transform type: TRANS_TYPE_ESN (0x5)
|    IKEv2 transform ID: ESN_DISABLED (0x0)
| last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3)
| last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform'
| emitting length of IKEv2 Transform Substructure Payload: 8
| emitting length of IKEv2 Proposal Substructure Payload: 32
| last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0
| emitting length of IKEv2 Security Association Payload: 36
| last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0
| ****emit IKEv2 Traffic Selector - Initiator - Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    number of TS: 1 (0x1)
| next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi)
| next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet'
| *****emit IKEv2 Traffic Selector:
|    TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7)
|    IP Protocol ID: 0 (0x0)
|    start port: 0 (0x0)
|    end port: 65535 (0xffff)
| emitting 4 raw bytes of ipv4 start into IKEv2 Traffic Selector
| ipv4 start  c0 00 01 00
| emitting 4 raw bytes of ipv4 end into IKEv2 Traffic Selector
| ipv4 end  c0 00 01 ff
| emitting length of IKEv2 Traffic Selector: 16
| emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24
| ****emit IKEv2 Traffic Selector - Responder - Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    number of TS: 1 (0x1)
| next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr)
| next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet'
| *****emit IKEv2 Traffic Selector:
|    TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7)
|    IP Protocol ID: 0 (0x0)
|    start port: 0 (0x0)
|    end port: 65535 (0xffff)
| emitting 4 raw bytes of ipv4 start into IKEv2 Traffic Selector
| ipv4 start  c0 00 02 00
| emitting 4 raw bytes of ipv4 end into IKEv2 Traffic Selector
| ipv4 end  c0 00 02 ff
| emitting length of IKEv2 Traffic Selector: 16
| emitting length of IKEv2 Traffic Selector - Responder - Payload: 24
| Initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED
| integ=none: .key_size=0 encrypt=aes_gcm_16: .key_size=32 .salt_size=4 keymat_len=36
| NULL Authentication - all clients appear identical
|     #1 spent 1.05 milliseconds
| install_ipsec_sa() for #2: inbound and outbound
| could_route called for westnet-eastnet-ikev2 (kind=CK_PERMANENT)
| FOR_EACH_CONNECTION_... in route_owner
|  conn westnet-eastnet-ikev2 mark 0/00000000, 0/00000000 vs
|  conn westnet-eastnet-ikev2 mark 0/00000000, 0/00000000
| route owner of "westnet-eastnet-ikev2" unrouted: NULL; eroute owner: NULL
| looking for alg with encrypt: AES_GCM_16 keylen: 256 integ: NONE
| encrypt AES_GCM_16 keylen=256 transid=20, key_size=32, encryptalg=20
| AES_GCM_16 requires 4 salt bytes
| st->st_esp.keymat_len=36 is encrypt_keymat_size=36 + integ_keymat_size=0
| setting IPsec SA replay-window to 32
| NIC esp-hw-offload not for connection 'westnet-eastnet-ikev2' not available on interface eth1
| netlink: enabling tunnel mode
| netlink: setting IPsec SA replay-window to 32 using old-style req
| netlink: esp-hw-offload not set for IPsec SA
| netlink response for Add SA esp.f8fb7e1a@192.1.2.45 included non-error error
| set up outgoing SA, ref=0/0
| looking for alg with encrypt: AES_GCM_16 keylen: 256 integ: NONE
| encrypt AES_GCM_16 keylen=256 transid=20, key_size=32, encryptalg=20
| AES_GCM_16 requires 4 salt bytes
| st->st_esp.keymat_len=36 is encrypt_keymat_size=36 + integ_keymat_size=0
| setting IPsec SA replay-window to 32
| NIC esp-hw-offload not for connection 'westnet-eastnet-ikev2' not available on interface eth1
| netlink: enabling tunnel mode
| netlink: setting IPsec SA replay-window to 32 using old-style req
| netlink: esp-hw-offload not set for IPsec SA
| netlink response for Add SA esp.9e779691@192.1.2.23 included non-error error
| priority calculation of connection "westnet-eastnet-ikev2" is 0xfe7e7
| add inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.10000@192.1.2.23 (raw_eroute)
| IPsec Sa SPD priority set to 1042407
| raw_eroute result=success
| set up incoming SA, ref=0/0
| sr for #2: unrouted
| route_and_eroute() for proto 0, and source port 0 dest port 0
| FOR_EACH_CONNECTION_... in route_owner
|  conn westnet-eastnet-ikev2 mark 0/00000000, 0/00000000 vs
|  conn westnet-eastnet-ikev2 mark 0/00000000, 0/00000000
| route owner of "westnet-eastnet-ikev2" unrouted: NULL; eroute owner: NULL
| route_and_eroute with c: westnet-eastnet-ikev2 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #2
| priority calculation of connection "westnet-eastnet-ikev2" is 0xfe7e7
| eroute_connection add eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.0@192.1.2.45 (raw_eroute)
| IPsec Sa SPD priority set to 1042407
| raw_eroute result=success
| running updown command "ipsec _updown" for verb up 
| command executing up-client
| trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-ikev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAM
| popen cmd is 1283 chars long
| cmd(   0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-ike:
| cmd(  80):v2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLU:
| cmd( 160):TO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0:
| cmd( 240):' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' P:
| cmd( 320):LUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID=:
| cmd( 400):'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.l:
| cmd( 480):ibreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1.0/24:
| cmd( 560):' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO:
| cmd( 640):_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toront:
| cmd( 720):o, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@l:
| cmd( 800):ibreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='AUTHNULL:
| cmd( 880):+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KI:
| cmd( 960):ND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISC:
| cmd(1040):O='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUT:
| cmd(1120):O_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_R:
| cmd(1200):OUTING='no' VTI_SHARED='no' SPI_IN=0xf8fb7e1a SPI_OUT=0x9e779691 ipsec _updown 2:
| cmd(1280):>&1:
| route_and_eroute: firewall_notified: true
| running updown command "ipsec _updown" for verb prepare 
| command executing prepare-client
| trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-ikev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CO
| popen cmd is 1288 chars long
| cmd(   0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne:
| cmd(  80):t-ikev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23:
| cmd( 160):' PLUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.:
| cmd( 240):0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL=:
| cmd( 320):'0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEE:
| cmd( 400):R_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.test:
| cmd( 480):ing.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1:
| cmd( 560):.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' :
| cmd( 640):PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=T:
| cmd( 720):oronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=test:
| cmd( 800):ing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='AUT:
| cmd( 880):HNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CO:
| cmd( 960):NN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER:
| cmd(1040):_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='':
| cmd(1120): PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' :
| cmd(1200):VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xf8fb7e1a SPI_OUT=0x9e779691 ipsec _upd:
| cmd(1280):own 2>&1:
| running updown command "ipsec _updown" for verb route 
| command executing route-client
| trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
| executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-ikev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_A
| popen cmd is 1286 chars long
| cmd(   0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-:
| cmd(  80):ikev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' :
| cmd( 160):PLUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.:
| cmd( 240):2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0:
| cmd( 320):' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_:
| cmd( 400):ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testin:
| cmd( 480):g.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1.0:
| cmd( 560):/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PL:
| cmd( 640):UTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Tor:
| cmd( 720):onto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testin:
| cmd( 800):g@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='AUTHN:
| cmd( 880):ULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN:
| cmd( 960):_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_C:
| cmd(1040):ISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' P:
| cmd(1120):LUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VT:
| cmd(1200):I_ROUTING='no' VTI_SHARED='no' SPI_IN=0xf8fb7e1a SPI_OUT=0x9e779691 ipsec _updow:
| cmd(1280):n 2>&1:
| route_and_eroute: instance "westnet-eastnet-ikev2", setting eroute_owner {spd=0x556f6835d1d8,sr=0x556f6835d1d8} to #2 (was #0) (newest_ipsec_sa=#0)
|     #1 spent 1.57 milliseconds in install_ipsec_sa()
| ISAKMP_v2_IKE_AUTH: instance westnet-eastnet-ikev2[0], setting IKEv2 newest_ipsec_sa to #2 (was #0) (spd.eroute=#2) cloned from #1
| adding 1 bytes of padding (including 1 byte padding-length)
| emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload
| emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload
| emitting length of IKEv2 Encryption Payload: 193
| emitting length of ISAKMP Message: 221
| ikev2_parent_inI2outR2_continue_tail returned STF_OK
|   #1 spent 5.98 milliseconds in processing: Responder: process IKE_AUTH request in ikev2_process_state_packet()
| suspend processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3379)
| start processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3379)
| #2 complete_v2_state_transition() md.from_state=PARENT_R1 md.svm.state[from]=PARENT_R1 UNDEFINED->V2_IPSEC_R with status STF_OK
| IKEv2: transition from state STATE_PARENT_R1 to state STATE_V2_IPSEC_R
| child state #2: UNDEFINED(ignore) => V2_IPSEC_R(established CHILD SA)
| Message ID: updating counters for #2 to 1 after switching state
| Message ID: recv #1.#2 request 1; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=0 responder.recv=0->1; child: wip.initiator=-1 wip.responder=1->-1
| Message ID: sent #1.#2 response 1; ike: initiator.sent=-1 initiator.recv=-1 responder.sent=0->1 responder.recv=1; child: wip.initiator=-1 wip.responder=-1
| pstats #2 ikev2.child established
"westnet-eastnet-ikev2" #2: negotiated connection [192.0.2.0-192.0.2.255:0-65535 0] -> [192.0.1.0-192.0.1.255:0-65535 0]
| NAT-T: encaps is 'auto'
"westnet-eastnet-ikev2" #2: STATE_V2_IPSEC_R: IPsec SA established tunnel mode {ESP=>0xf8fb7e1a <0x9e779691 xfrm=AES_GCM_16_256-NONE NATOA=none NATD=none DPD=passive}
| sending V2 new request packet to 192.1.2.45:500 (from 192.1.2.23:500)
| sending 221 bytes for STATE_PARENT_R1 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   2e 20 23 20  00 00 00 01  00 00 00 dd  24 00 00 c1
|   90 61 f5 b9  95 fa 6e ba  bb f9 33 79  fa 6a 69 9f
|   4a cc c9 29  c4 86 e4 c4  33 9c 9d ac  66 98 71 fd
|   22 51 ee c7  87 4b 3a 92  81 ec 49 93  45 b8 19 46
|   77 50 d6 c0  1a d4 d8 49  40 d1 85 eb  cc 7a 1a 2a
|   a3 34 e1 d7  54 21 8a 81  e9 07 30 43  43 3e 9d 2f
|   0e c6 1b ea  b5 1b 1a ae  77 8e ba cd  b0 85 3a b9
|   7d 73 5a d6  da bc 64 23  66 39 ae 7c  19 77 a5 34
|   04 0c 3e d6  0d 19 60 fa  1d 31 ae 71  90 29 59 7f
|   af ae cd 7f  c0 bc 4e 4a  d5 5e 35 f5  7c b7 ab f9
|   2e eb 22 39  fd 67 c7 1c  4c c2 17 4d  87 71 9e 92
|   67 56 40 67  d1 9c a3 1b  14 50 5f 59  19 36 66 0c
|   c7 d0 d2 62  52 97 ab 07  2a 8e ca 20  2c
| releasing whack for #2 (sock=fd@-1)
| releasing whack and unpending for parent #1
| unpending state #1 connection "westnet-eastnet-ikev2"
| #2 will start re-keying in 28530 seconds with margin of 270 seconds (attempting re-key)
| event_schedule: new EVENT_SA_REKEY-pe@0x7f113c002b78
| inserting event EVENT_SA_REKEY, timeout in 28530 seconds for #2
| libevent_malloc: new ptr-libevent@0x556f6836fed8 size 128
| resume sending helper answer for #1 suppresed complete_v2_state_transition()
| #1 spent 6.26 milliseconds in resume sending helper answer
| stop processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in resume_handler() at server.c:833)
| libevent_free: release ptr-libevent@0x7f1134000f48
| processing signal PLUTO_SIGCHLD
| waitpid returned ECHILD (no child processes left)
| spent 0.00454 milliseconds in signal handler PLUTO_SIGCHLD
| processing signal PLUTO_SIGCHLD
| waitpid returned ECHILD (no child processes left)
| spent 0.00278 milliseconds in signal handler PLUTO_SIGCHLD
| processing signal PLUTO_SIGCHLD
| waitpid returned ECHILD (no child processes left)
| spent 0.00282 milliseconds in signal handler PLUTO_SIGCHLD
| accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722)
| FOR_EACH_CONNECTION_... in show_connections_status
| FOR_EACH_CONNECTION_... in show_connections_status
| FOR_EACH_STATE_... in show_states_status (sort_states)
| FOR_EACH_STATE_... in sort_states
| get_sa_info esp.9e779691@192.1.2.23
| get_sa_info esp.f8fb7e1a@192.1.2.45
| close_any(fd@16) (in whack_process() at rcv_whack.c:700)
| spent 0.375 milliseconds in whack
| accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722)
shutting down
| processing: RESET whack log_fd (was fd@16) (in exit_pluto() at plutomain.c:1825)
destroying root certificate cache
| certs and keys locked by 'free_preshared_secrets'
forgetting secrets
| certs and keys unlocked by 'free_preshared_secrets'
| unreference key: 0x556f68365ce8 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org cnt 1--
| unreference key: 0x556f68365658 user-west@testing.libreswan.org cnt 1--
| unreference key: 0x556f683653b8 @west.testing.libreswan.org cnt 1--
| unreference key: 0x556f68364f58 west@testing.libreswan.org cnt 1--
| unreference key: 0x556f683640c8 192.1.2.45 cnt 1--
| start processing: connection "westnet-eastnet-ikev2" (in delete_connection() at connections.c:189)
| Deleting states for connection - including all other IPsec SA's of this IKE SA
| pass 0
| FOR_EACH_STATE_... in foreach_state_by_connection_func_delete
| state #2
| suspend processing: connection "westnet-eastnet-ikev2" (in foreach_state_by_connection_func_delete() at state.c:1310)
| start processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in foreach_state_by_connection_func_delete() at state.c:1310)
| pstats #2 ikev2.child deleted completed
| [RE]START processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in delete_state() at state.c:879)
"westnet-eastnet-ikev2" #2: deleting state (STATE_V2_IPSEC_R) aged 4.161s and sending notification
| child state #2: V2_IPSEC_R(established CHILD SA) => delete
| get_sa_info esp.f8fb7e1a@192.1.2.45
| get_sa_info esp.9e779691@192.1.2.23
"westnet-eastnet-ikev2" #2: ESP traffic information: in=336B out=336B
| #2 send IKEv2 delete notification for STATE_V2_IPSEC_R
| Opening output PBS informational exchange delete request
| **emit ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_NONE (0x0)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_INFORMATIONAL (0x25)
|    flags: none (0x0)
|    Message ID: 0 (0x0)
| next payload chain: saving message location 'ISAKMP Message'.'next payload type'
| ***emit IKEv2 Encryption Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
| next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK)
| next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request'
| emitting 8 zero bytes of IV into IKEv2 Encryption Payload
| ****emit IKEv2 Delete Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    protocol ID: PROTO_v2_ESP (0x3)
|    SPI size: 4 (0x4)
|    number of SPIs: 1 (0x1)
| next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D)
| next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request'
| emitting 4 raw bytes of local spis into IKEv2 Delete Payload
| local spis  9e 77 96 91
| emitting length of IKEv2 Delete Payload: 12
| adding 1 bytes of padding (including 1 byte padding-length)
| emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload
| emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload
| emitting length of IKEv2 Encryption Payload: 41
| emitting length of ISAKMP Message: 69
| sending 69 bytes for delete notification through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #2)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   2e 20 25 00  00 00 00 00  00 00 00 45  2a 00 00 29
|   7c 00 56 78  1e 27 57 3d  49 c7 6c 8b  e1 5c f3 a5
|   3e 0e f4 2b  1f 53 95 4c  95 ac 0f 48  0f 3c fe 3d
|   4d d3 27 68  54
| Message ID: IKE #1 sender #2 in send_delete record 'n' sending delete request so forcing IKE nextuse=0->1 and sender msgid=0->0
| Message ID: IKE #1 sender #2 in send_delete hacking around record ' send
| Message ID: sent #1 request 0; ike: initiator.sent=-1->0 initiator.recv=-1 responder.sent=1 responder.recv=1 wip.initiator=-1->0 wip.responder=-1
| state #2 requesting EVENT_SA_REKEY to be deleted
| libevent_free: release ptr-libevent@0x556f6836fed8
| free_event_entry: release EVENT_SA_REKEY-pe@0x7f113c002b78
| running updown command "ipsec _updown" for verb down 
| command executing down-client
| executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-ikev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844353' PLUTO_CONN_POLICY='AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_
| popen cmd is 1176 chars long
| cmd(   0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-i:
| cmd(  80):kev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' P:
| cmd( 160):LUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2:
| cmd( 240):.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0':
| cmd( 320): PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_I:
| cmd( 400):D='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing:
| cmd( 480):.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1.0/:
| cmd( 560):24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLU:
| cmd( 640):TO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' P:
| cmd( 720):LUTO_ADDTIME='1566844353' PLUTO_CONN_POLICY='AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_A:
| cmd( 800):LLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CON:
| cmd( 880):N_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO=':
| cmd( 960):' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_:
| cmd(1040):CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no':
| cmd(1120): SPI_IN=0xf8fb7e1a SPI_OUT=0x9e779691 ipsec _updown 2>&1:
| shunt_eroute() called for connection 'westnet-eastnet-ikev2' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0
| netlink_shunt_eroute for proto 0, and source port 0 dest port 0
| priority calculation of connection "westnet-eastnet-ikev2" is 0xfe7e7
| IPsec Sa SPD priority set to 1042407
| delete esp.f8fb7e1a@192.1.2.45
| netlink response for Del SA esp.f8fb7e1a@192.1.2.45 included non-error error
| priority calculation of connection "westnet-eastnet-ikev2" is 0xfe7e7
| delete inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => unk255.10000@192.1.2.23 (raw_eroute)
| raw_eroute result=success
| delete esp.9e779691@192.1.2.23
| netlink response for Del SA esp.9e779691@192.1.2.23 included non-error error
| stop processing: connection "westnet-eastnet-ikev2" (BACKGROUND) (in update_state_connection() at connections.c:4076)
| start processing: connection NULL (in update_state_connection() at connections.c:4077)
| in connection_discard for connection westnet-eastnet-ikev2
| State DB: deleting IKEv2 state #2 in V2_IPSEC_R
| child state #2: V2_IPSEC_R(established CHILD SA) => UNDEFINED(ignore)
| stop processing: state #2 from 192.1.2.45:500 (in delete_state() at state.c:1143)
| processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312)
| state #1
| pass 1
| FOR_EACH_STATE_... in foreach_state_by_connection_func_delete
| state #1
| start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in foreach_state_by_connection_func_delete() at state.c:1310)
| pstats #1 ikev2.ike deleted completed
| #1 spent 9.62 milliseconds in total
| [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.45:500 (in delete_state() at state.c:879)
"westnet-eastnet-ikev2" #1: deleting state (STATE_PARENT_R2) aged 4.189s and sending notification
| parent state #1: PARENT_R2(established IKE SA) => delete
| #1 send IKEv2 delete notification for STATE_PARENT_R2
| Opening output PBS informational exchange delete request
| **emit ISAKMP Message:
|    initiator cookie:
|   1a 17 bf 9e  53 2f a9 69
|    responder cookie:
|   b4 b4 69 40  ef b8 67 79
|    next payload type: ISAKMP_NEXT_NONE (0x0)
|    ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20)
|    exchange type: ISAKMP_v2_INFORMATIONAL (0x25)
|    flags: none (0x0)
|    Message ID: 1 (0x1)
| next payload chain: saving message location 'ISAKMP Message'.'next payload type'
| ***emit IKEv2 Encryption Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
| next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK)
| next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request'
| emitting 8 zero bytes of IV into IKEv2 Encryption Payload
| ****emit IKEv2 Delete Payload:
|    next payload type: ISAKMP_NEXT_v2NONE (0x0)
|    flags: none (0x0)
|    protocol ID: PROTO_v2_IKE (0x1)
|    SPI size: 0 (0x0)
|    number of SPIs: 0 (0x0)
| next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D)
| next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request'
| emitting length of IKEv2 Delete Payload: 8
| adding 1 bytes of padding (including 1 byte padding-length)
| emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload
| emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload
| emitting length of IKEv2 Encryption Payload: 37
| emitting length of ISAKMP Message: 65
| sending 65 bytes for delete notification through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1)
|   1a 17 bf 9e  53 2f a9 69  b4 b4 69 40  ef b8 67 79
|   2e 20 25 00  00 00 00 01  00 00 00 41  2a 00 00 25
|   ee 40 17 05  7a 6a 69 05  3b 70 38 28  20 3d cc ba
|   5f 99 e1 23  4a 38 e7 51  97 c1 14 1f  1e e2 51 4e
|   bc
| Message ID: IKE #1 sender #1 in send_delete record 'n' sending delete request so forcing IKE nextuse=1->2 and sender msgid=0->1
| Message ID: IKE #1 sender #1 in send_delete hacking around record ' send
| Message ID: #1 XXX: expecting sender.wip.initiator 0 == -1 - suspect record'n'send out-of-order?); initiator.sent=1 initiator.recv=-1 responder.sent=1 responder.recv=1 wip.initiator=1 wip.responder=-1
| Message ID: sent #1 request 1; ike: initiator.sent=0->1 initiator.recv=-1 responder.sent=1 responder.recv=1 wip.initiator=0->1 wip.responder=-1
| state #1 requesting EVENT_SA_REKEY to be deleted
| libevent_free: release ptr-libevent@0x556f68380e78
| free_event_entry: release EVENT_SA_REKEY-pe@0x556f68365a88
| State DB: IKEv2 state not found (flush_incomplete_children)
| in connection_discard for connection westnet-eastnet-ikev2
| State DB: deleting IKEv2 state #1 in PARENT_R2
| parent state #1: PARENT_R2(established IKE SA) => UNDEFINED(ignore)
| unreference key: 0x556f6837e808 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org cnt 2--
| stop processing: state #1 from 192.1.2.45:500 (in delete_state() at state.c:1143)
| unreference key: 0x556f6837e808 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org cnt 1--
| unreference key: 0x556f683700a8 user-west@testing.libreswan.org cnt 1--
| unreference key: 0x556f6836cda8 @west.testing.libreswan.org cnt 1--
| unreference key: 0x556f6836ff88 west@testing.libreswan.org cnt 1--
| unreference key: 0x556f6836d1a8 192.1.2.45 cnt 1--
| processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312)
| shunt_eroute() called for connection 'westnet-eastnet-ikev2' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0
| netlink_shunt_eroute for proto 0, and source port 0 dest port 0
| priority calculation of connection "westnet-eastnet-ikev2" is 0xfe7e7
| priority calculation of connection "westnet-eastnet-ikev2" is 0xfe7e7
| FOR_EACH_CONNECTION_... in route_owner
|  conn westnet-eastnet-ikev2 mark 0/00000000, 0/00000000 vs
|  conn westnet-eastnet-ikev2 mark 0/00000000, 0/00000000
| route owner of "westnet-eastnet-ikev2" unrouted: NULL
| running updown command "ipsec _updown" for verb unroute 
| command executing unroute-client
| executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-ikev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.testing.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PE
| popen cmd is 1157 chars long
| cmd(   0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne:
| cmd(  80):t-ikev2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23:
| cmd( 160):' PLUTO_MY_ID='ID_NULL' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.:
| cmd( 240):0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL=:
| cmd( 320):'0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.45' PLUTO_PE:
| cmd( 400):ER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west.tes:
| cmd( 480):ting.libreswan.org, E=user-west@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.:
| cmd( 560):1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0':
| cmd( 640): PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netke:
| cmd( 720):y' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='AUTHNULL+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+:
| cmd( 800):SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADD:
| cmd( 880):RFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLU:
| cmd( 960):TO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIEN:
| cmd(1040):T='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_:
| cmd(1120):IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1:
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
unroute-client output: Error: Peer netns reference is invalid.
| free hp@0x556f68365eb8
| flush revival: connection 'westnet-eastnet-ikev2' wasn't on the list
| processing: STOP connection NULL (in discard_connection() at connections.c:249)
| crl fetch request list locked by 'free_crl_fetch'
| crl fetch request list unlocked by 'free_crl_fetch'
shutting down interface lo/lo 127.0.0.1:4500
shutting down interface lo/lo 127.0.0.1:500
shutting down interface eth0/eth0 192.0.2.254:4500
shutting down interface eth0/eth0 192.0.2.254:500
shutting down interface eth1/eth1 192.1.2.23:4500
shutting down interface eth1/eth1 192.1.2.23:500
| FOR_EACH_STATE_... in delete_states_dead_interfaces
| libevent_free: release ptr-libevent@0x556f683508e8
| free_event_entry: release EVENT_NULL-pe@0x556f6835c7d8
| libevent_free: release ptr-libevent@0x556f682f6ff8
| free_event_entry: release EVENT_NULL-pe@0x556f6835c888
| libevent_free: release ptr-libevent@0x556f682f6918
| free_event_entry: release EVENT_NULL-pe@0x556f6835c938
| libevent_free: release ptr-libevent@0x556f682fe1d8
| free_event_entry: release EVENT_NULL-pe@0x556f6835c9e8
| libevent_free: release ptr-libevent@0x556f682fe2d8
| free_event_entry: release EVENT_NULL-pe@0x556f6835ca98
| libevent_free: release ptr-libevent@0x556f682fe3d8
| free_event_entry: release EVENT_NULL-pe@0x556f6835cb48
| FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations
| libevent_free: release ptr-libevent@0x556f68350998
| free_event_entry: release EVENT_NULL-pe@0x556f68344ab8
| libevent_free: release ptr-libevent@0x556f682f6f48
| free_event_entry: release EVENT_NULL-pe@0x556f68344618
| libevent_free: release ptr-libevent@0x556f6833d4f8
| free_event_entry: release EVENT_NULL-pe@0x556f68343af8
| global timer EVENT_REINIT_SECRET uninitialized
| global timer EVENT_SHUNT_SCAN uninitialized
| global timer EVENT_PENDING_DDNS uninitialized
| global timer EVENT_PENDING_PHASE2 uninitialized
| global timer EVENT_CHECK_CRLS uninitialized
| global timer EVENT_REVIVE_CONNS uninitialized
| global timer EVENT_FREE_ROOT_CERTS uninitialized
| global timer EVENT_RESET_LOG_RATE_LIMIT uninitialized
| global timer EVENT_NAT_T_KEEPALIVE uninitialized
| libevent_free: release ptr-libevent@0x556f68302a58
| signal event handler PLUTO_SIGCHLD uninstalled
| libevent_free: release ptr-libevent@0x556f68280718
| signal event handler PLUTO_SIGTERM uninstalled
| libevent_free: release ptr-libevent@0x556f6835bfb8
| signal event handler PLUTO_SIGHUP uninstalled
| libevent_free: release ptr-libevent@0x556f6835c1f8
| signal event handler PLUTO_SIGSYS uninstalled
| releasing event base
| libevent_free: release ptr-libevent@0x556f6835c0c8
| libevent_free: release ptr-libevent@0x556f6833edd8
| libevent_free: release ptr-libevent@0x556f6833ed88
| libevent_free: release ptr-libevent@0x556f682f6298
| libevent_free: release ptr-libevent@0x556f6833ed48
| libevent_free: release ptr-libevent@0x556f6835bc88
| libevent_free: release ptr-libevent@0x556f6835bef8
| libevent_free: release ptr-libevent@0x556f6833ef88
| libevent_free: release ptr-libevent@0x556f68344688
| libevent_free: release ptr-libevent@0x556f683442e8
| libevent_free: release ptr-libevent@0x556f6835cbb8
| libevent_free: release ptr-libevent@0x556f6835cb08
| libevent_free: release ptr-libevent@0x556f6835ca58
| libevent_free: release ptr-libevent@0x556f6835c9a8
| libevent_free: release ptr-libevent@0x556f6835c8f8
| libevent_free: release ptr-libevent@0x556f6835c848
| libevent_free: release ptr-libevent@0x556f6827fa38
| libevent_free: release ptr-libevent@0x556f6835bf78
| libevent_free: release ptr-libevent@0x556f6835bf38
| libevent_free: release ptr-libevent@0x556f6835bdf8
| libevent_free: release ptr-libevent@0x556f6835c088
| libevent_free: release ptr-libevent@0x556f6835bcc8
| libevent_free: release ptr-libevent@0x556f683045e8
| libevent_free: release ptr-libevent@0x556f68304568
| libevent_free: release ptr-libevent@0x556f6827fda8
| releasing global libevent data
| libevent_free: release ptr-libevent@0x556f68304768
| libevent_free: release ptr-libevent@0x556f683046e8
| libevent_free: release ptr-libevent@0x556f68304668
leak detective found no leaks