FIPS Product: YES FIPS Kernel: NO FIPS Mode: NO NSS DB directory: sql:/etc/ipsec.d Initializing NSS Opening NSS database "sql:/etc/ipsec.d" read-only NSS initialized NSS crypto library initialized FIPS HMAC integrity support [enabled] FIPS mode disabled for pluto daemon FIPS HMAC integrity verification self-test FAILED libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v3.28-685-gbfd5aef521-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:29589 core dump dir: /var/tmp secrets file: /etc/ipsec.secrets leak-detective enabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: new ptr-libevent@0x55954d4d5628 size 40 | libevent_malloc: new ptr-libevent@0x55954d4d55a8 size 40 | libevent_malloc: new ptr-libevent@0x55954d4d5528 size 40 | creating event base | libevent_malloc: new ptr-libevent@0x55954d4c7158 size 56 | libevent_malloc: new ptr-libevent@0x55954d448c88 size 664 | libevent_malloc: new ptr-libevent@0x55954d50fc48 size 24 | libevent_malloc: new ptr-libevent@0x55954d50fc98 size 384 | libevent_malloc: new ptr-libevent@0x55954d50fc08 size 16 | libevent_malloc: new ptr-libevent@0x55954d4d54a8 size 40 | libevent_malloc: new ptr-libevent@0x55954d4d5428 size 48 | libevent_realloc: new ptr-libevent@0x55954d448918 size 256 | libevent_malloc: new ptr-libevent@0x55954d50fe48 size 16 | libevent_free: release ptr-libevent@0x55954d4c7158 | libevent initialized | libevent_realloc: new ptr-libevent@0x55954d4c7158 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm, aes_ccm_c AES_CCM_12 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_b AES_CCM_8 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_a 3DES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS [*192] 3des CAMELLIA_CTR IKEv1: ESP IKEv2: ESP {256,192,*128} CAMELLIA_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} camellia AES_GCM_16 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm, aes_gcm_c AES_GCM_12 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_b AES_GCM_8 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_a AES_CTR IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aesctr AES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aes SERPENT_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} serpent TWOFISH_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} twofish TWOFISH_SSH IKEv1: IKE IKEv2: IKE ESP {256,192,*128} twofish_cbc_ssh NULL_AUTH_AES_GMAC IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_gmac NULL IKEv1: ESP IKEv2: ESP [] CHACHA20_POLY1305 IKEv1: IKEv2: IKE ESP [*256] chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: SHA1 IKEv1: IKE IKEv2: FIPS sha SHA2_256 IKEv1: IKE IKEv2: FIPS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: FIPS sha384 SHA2_512 IKEv1: IKE IKEv2: FIPS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 crypto helpers started thread for crypto helper 0 started thread for crypto helper 1 | starting up helper thread 1 started thread for crypto helper 2 | status value returned by setting the priority of this thread (crypto helper 1) 22 | crypto helper 1 waiting (nothing to do) started thread for crypto helper 3 started thread for crypto helper 4 | starting up helper thread 3 | starting up helper thread 4 | status value returned by setting the priority of this thread (crypto helper 3) 22 | crypto helper 3 waiting (nothing to do) started thread for crypto helper 5 started thread for crypto helper 6 | checking IKEv1 state table | status value returned by setting the priority of this thread (crypto helper 4) 22 | crypto helper 4 waiting (nothing to do) | MAIN_R0: category: half-open IKE SA flags: 0: | -> MAIN_R1 EVENT_SO_DISCARD | MAIN_I1: category: half-open IKE SA flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT | MAIN_R1: category: open IKE SA flags: 200: | -> MAIN_R2 EVENT_RETRANSMIT | starting up helper thread 0 | starting up helper thread 6 | status value returned by setting the priority of this thread (crypto helper 6) 22 | status value returned by setting the priority of this thread (crypto helper 0) 22 | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | crypto helper 6 waiting (nothing to do) | MAIN_I2: category: open IKE SA flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | crypto helper 0 waiting (nothing to do) | MAIN_R2: category: open IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | -> MAIN_R3 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_I3: category: open IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | -> MAIN_I4 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_R3: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | MAIN_I4: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | AGGR_R0: category: half-open IKE SA flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD | AGGR_I1: category: half-open IKE SA flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE | -> AGGR_I2 EVENT_SA_REPLACE | AGGR_R1: category: open IKE SA flags: 200: | -> AGGR_R2 EVENT_SA_REPLACE | -> AGGR_R2 EVENT_SA_REPLACE | AGGR_I2: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | AGGR_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | QUICK_R0: category: established CHILD SA flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT | QUICK_I1: category: established CHILD SA flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE | QUICK_R1: category: established CHILD SA flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE | QUICK_I2: category: established CHILD SA flags: 200: | -> UNDEFINED EVENT_NULL | QUICK_R2: category: established CHILD SA flags: 0: | -> UNDEFINED EVENT_NULL | INFO: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | INFO_PROTECTED: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | XAUTH_R0: category: established IKE SA flags: 0: | -> XAUTH_R1 EVENT_NULL | XAUTH_R1: category: established IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | MODE_CFG_R0: category: informational flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE | MODE_CFG_R1: category: established IKE SA flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE | MODE_CFG_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | MODE_CFG_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | XAUTH_I0: category: established IKE SA flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT | XAUTH_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT | checking IKEv2 state table | PARENT_I0: category: ignore flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA flags: 0: | -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH) | PARENT_I2: category: open IKE SA flags: 0: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_I3: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_RETAIN (I3: Informational Request) | -> PARENT_I3 EVENT_RETAIN (I3: Informational Response) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response) | PARENT_R0: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED)) | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request) | PARENT_R2: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request) | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response) | V2_CREATE_I0: category: established IKE SA flags: 0: | -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | V2_CREATE_I: category: established IKE SA flags: 0: | -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_IKE_I0: category: established IKE SA flags: 0: | -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_REKEY_CHILD_I0: category: established IKE SA flags: 0: | -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_REKEY_CHILD_I: category: established IKE SA flags: 0: | V2_CREATE_R: category: established IKE SA flags: 0: | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request) | V2_REKEY_IKE_R: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_R: category: established IKE SA flags: 0: | V2_IPSEC_I: category: established CHILD SA flags: 0: | V2_IPSEC_R: category: established CHILD SA flags: 0: | IKESA_DEL: category: established IKE SA flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational flags: 0: Using Linux XFRM/NETKEY IPsec interface code on 5.1.18-200.fc29.x86_64 | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding SERPENT_CBC to kernel algorithm db | adding TWOFISH_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x55954d4cf348 | libevent_malloc: new ptr-libevent@0x55954d50e2a8 size 128 | libevent_malloc: new ptr-libevent@0x55954d515448 size 16 | add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x55954d5153d8 | libevent_malloc: new ptr-libevent@0x55954d50e358 size 128 | libevent_malloc: new ptr-libevent@0x55954d5150a8 size 16 | starting up helper thread 5 | status value returned by setting the priority of this thread (crypto helper 5) 22 | crypto helper 5 waiting (nothing to do) | global one-shot timer EVENT_CHECK_CRLS initialized selinux support is enabled. | starting up helper thread 2 | status value returned by setting the priority of this thread (crypto helper 2) 22 | crypto helper 2 waiting (nothing to do) | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | Loading dnssec root key from:/var/lib/unbound/root.key | No additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x55954d515878 | libevent_malloc: new ptr-libevent@0x55954d5216d8 size 128 | libevent_malloc: new ptr-libevent@0x55954d52c948 size 16 | libevent_realloc: new ptr-libevent@0x55954d52c988 size 256 | libevent_malloc: new ptr-libevent@0x55954d52cab8 size 8 | libevent_realloc: new ptr-libevent@0x55954d52caf8 size 144 | libevent_malloc: new ptr-libevent@0x55954d4d3918 size 152 | libevent_malloc: new ptr-libevent@0x55954d52cbb8 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: new ptr-libevent@0x55954d52cbf8 size 8 | libevent_malloc: new ptr-libevent@0x55954d44baf8 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: new ptr-libevent@0x55954d52cc38 size 8 | libevent_malloc: new ptr-libevent@0x55954d44c558 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: new ptr-libevent@0x55954d52cc78 size 8 | libevent_realloc: release ptr-libevent@0x55954d52caf8 | libevent_realloc: new ptr-libevent@0x55954d52ccb8 size 256 | libevent_malloc: new ptr-libevent@0x55954d52cde8 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:29702) using fork+execve | forked child 29702 | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.3.254 | Inspecting interface eth1 | found eth1 with address 192.1.3.33 Kernel supports NIC esp-hw-offload adding interface eth1/eth1 (esp-hw-offload not supported by kernel) 192.1.3.33:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth1/eth1 192.1.3.33:4500 adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.0.3.254:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth0/eth0 192.0.3.254:4500 adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface lo/lo 127.0.0.1:4500 | no interfaces to sort | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | add_fd_read_event_handler: new ethX-pe@0x55954d52d3c8 | libevent_malloc: new ptr-libevent@0x55954d521628 size 128 | libevent_malloc: new ptr-libevent@0x55954d52d438 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 22 | add_fd_read_event_handler: new ethX-pe@0x55954d52d478 | libevent_malloc: new ptr-libevent@0x55954d4c7e08 size 128 | libevent_malloc: new ptr-libevent@0x55954d52d4e8 size 16 | setup callback for interface lo 127.0.0.1:500 fd 21 | add_fd_read_event_handler: new ethX-pe@0x55954d52d528 | libevent_malloc: new ptr-libevent@0x55954d4c7eb8 size 128 | libevent_malloc: new ptr-libevent@0x55954d52d598 size 16 | setup callback for interface eth0 192.0.3.254:4500 fd 20 | add_fd_read_event_handler: new ethX-pe@0x55954d52d5d8 | libevent_malloc: new ptr-libevent@0x55954d4c6e78 size 128 | libevent_malloc: new ptr-libevent@0x55954d52d648 size 16 | setup callback for interface eth0 192.0.3.254:500 fd 19 | add_fd_read_event_handler: new ethX-pe@0x55954d52d688 | libevent_malloc: new ptr-libevent@0x55954d4cf188 size 128 | libevent_malloc: new ptr-libevent@0x55954d52d6f8 size 16 | setup callback for interface eth1 192.1.3.33:4500 fd 18 | add_fd_read_event_handler: new ethX-pe@0x55954d52d738 | libevent_malloc: new ptr-libevent@0x55954d4cfca8 size 128 | libevent_malloc: new ptr-libevent@0x55954d52d7a8 size 16 | setup callback for interface eth1 192.1.3.33:500 fd 17 | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f | computed rsa CKAID 88 aa 7c 5d loaded private key for keyid: PKK_RSA:AQPl33O2P | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.583 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.3.254 | Inspecting interface eth1 | found eth1 with address 192.1.3.33 | no interfaces to sort | libevent_free: release ptr-libevent@0x55954d521628 | free_event_entry: release EVENT_NULL-pe@0x55954d52d3c8 | add_fd_read_event_handler: new ethX-pe@0x55954d52d3c8 | libevent_malloc: new ptr-libevent@0x55954d521628 size 128 | setup callback for interface lo 127.0.0.1:4500 fd 22 | libevent_free: release ptr-libevent@0x55954d4c7e08 | free_event_entry: release EVENT_NULL-pe@0x55954d52d478 | add_fd_read_event_handler: new ethX-pe@0x55954d52d478 | libevent_malloc: new ptr-libevent@0x55954d4c7e08 size 128 | setup callback for interface lo 127.0.0.1:500 fd 21 | libevent_free: release ptr-libevent@0x55954d4c7eb8 | free_event_entry: release EVENT_NULL-pe@0x55954d52d528 | add_fd_read_event_handler: new ethX-pe@0x55954d52d528 | libevent_malloc: new ptr-libevent@0x55954d4c7eb8 size 128 | setup callback for interface eth0 192.0.3.254:4500 fd 20 | libevent_free: release ptr-libevent@0x55954d4c6e78 | free_event_entry: release EVENT_NULL-pe@0x55954d52d5d8 | add_fd_read_event_handler: new ethX-pe@0x55954d52d5d8 | libevent_malloc: new ptr-libevent@0x55954d4c6e78 size 128 | setup callback for interface eth0 192.0.3.254:500 fd 19 | libevent_free: release ptr-libevent@0x55954d4cf188 | free_event_entry: release EVENT_NULL-pe@0x55954d52d688 | add_fd_read_event_handler: new ethX-pe@0x55954d52d688 | libevent_malloc: new ptr-libevent@0x55954d4cf188 size 128 | setup callback for interface eth1 192.1.3.33:4500 fd 18 | libevent_free: release ptr-libevent@0x55954d4cfca8 | free_event_entry: release EVENT_NULL-pe@0x55954d52d738 | add_fd_read_event_handler: new ethX-pe@0x55954d52d738 | libevent_malloc: new ptr-libevent@0x55954d4cfca8 size 128 | setup callback for interface eth1 192.1.3.33:500 fd 17 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f | computed rsa CKAID 88 aa 7c 5d loaded private key for keyid: PKK_RSA:AQPl33O2P | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.386 milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 29702 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0141 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection north-east-x509-ipv4 with policy ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_ALLOW_NARROWING+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | ike (phase1) algorithm values: AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_CBC_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp= | ESP/AH string values: AES_GCM_16_256-NONE, AES_GCM_16_128-NONE, AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128, AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128 | setting ID to ID_DER_ASN1_DN: 'E=user-north@testing.libreswan.org,CN=north.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA' | loading left certificate 'north' pubkey | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d530db8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d530d68 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d530d18 | unreference key: 0x55954d530e08 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org cnt 1-- | certs and keys locked by 'lsw_add_rsa_secret' | certs and keys unlocked by 'lsw_add_rsa_secret' | counting wild cards for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org is 0 | setting ID to ID_DER_ASN1_DN: 'E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA' | loading right certificate 'east' pubkey | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d533ed8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d5350e8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d5344a8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d533fd8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d530a68 | unreference key: 0x55954d539dc8 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 1-- | warning: no secret key loaded for right certificate with nickname east: NSS: cert private key not found | counting wild cards for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org is 0 | based upon policy narrowing=yes, the connection is a template. | connect_to_host_pair: 192.1.3.33:500 192.1.2.23:500 -> hp@(nil): none | new hp@0x55954d538918 added connection description "north-east-x509-ipv4" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKEV2_ALLOW_NARROWING+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 0.0.0.0/0===192.1.3.33<192.1.3.33>[C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org,+MC+S=C]...192.1.2.23<192.1.2.23>[C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org]===0.0.0.0/0 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 2.53 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | dup_any(fd@16) -> fd@23 (in whack_process() at rcv_whack.c:590) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "north-east-x509-ipv4" (in initiate_a_connection() at initiate.c:186) | find_host_pair: comparing 192.1.3.33:500 to 192.1.2.23:500 but ignoring ports | connect_to_host_pair: 192.1.3.33:500 192.1.2.23:500 -> hp@0x55954d538918: north-east-x509-ipv4 | connection 'north-east-x509-ipv4' +POLICY_UP | dup_any(fd@23) -> fd@24 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | creating state object #1 at 0x55954d53beb8 | State DB: adding IKEv2 state #1 in UNDEFINED | pstats #1 ikev2.ike started | Message ID: init #1: msgid=0 lastack=4294967295 nextuse=0 lastrecv=4294967295 lastreplied=0 | parent state #1: UNDEFINED(ignore) => PARENT_I0(ignore) | Message ID: init_ike #1; ike: initiator.sent=0->-1 initiator.recv=0->-1 responder.sent=0->-1 responder.recv=0->-1 wip.initiator=0->-1 wip.responder=0->-1 | suspend processing: connection "north-east-x509-ipv4" (in ikev2_parent_outI1() at ikev2_parent.c:535) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_parent_outI1() at ikev2_parent.c:535) | dup_any(fd@24) -> fd@25 (in ikev2_parent_outI1() at ikev2_parent.c:551) | Queuing pending IPsec SA negotiating with 192.1.2.23 "north-east-x509-ipv4"[1] 192.1.2.23 IKE SA #1 "north-east-x509-ipv4"[1] 192.1.2.23 "north-east-x509-ipv4"[1] 192.1.2.23 #1: initiating v2 parent SA | constructing local IKE proposals for north-east-x509-ipv4 (IKE SA initiator selecting KE) | converting ike_info AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_CBC_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 "north-east-x509-ipv4"[1] 192.1.2.23: constructed local IKE proposals for north-east-x509-ipv4 (IKE SA initiator selecting KE): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | adding ikev2_outI1 KE work-order 1 for state #1 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x55954d537d58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x55954d539d18 size 128 | #1 spent 0.176 milliseconds in ikev2_parent_outI1() | processing: RESET whack log_fd (was fd@16) (in ikev2_parent_outI1() at ikev2_parent.c:610) | crypto helper 1 resuming | RESET processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_parent_outI1() at ikev2_parent.c:610) | crypto helper 1 starting work-order 1 for state #1 | RESET processing: connection "north-east-x509-ipv4" (in ikev2_parent_outI1() at ikev2_parent.c:610) | processing: STOP connection NULL (in initiate_a_connection() at initiate.c:349) | crypto helper 1 doing build KE and nonce (ikev2_outI1 KE); request ID 1 | close_any(fd@23) (in initiate_connection() at initiate.c:372) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.24 milliseconds in whack | crypto helper 1 finished build KE and nonce (ikev2_outI1 KE); request ID 1 time elapsed 0.000596 seconds | (#1) spent 0.594 milliseconds in crypto helper computing work-order 1: ikev2_outI1 KE (pcr) | crypto helper 1 sending results from work-order 1 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f5a24002888 size 128 | crypto helper 1 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 1 replies to request ID 1 | calling continuation function 0x55954d23db50 | ikev2_parent_outI1_continue for #1 | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | using existing local IKE proposals for connection north-east-x509-ipv4 (IKE SA initiator emitting local proposals): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | Emitting ikev2_proposals ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discarding INTEG=NONE | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 11 (0xb) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding INTEG=NONE | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding INTEG=NONE | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 2 (0x2) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 11 (0xb) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding INTEG=NONE | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 3 (0x3) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 13 (0xd) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 116 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 4 (0x4) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 13 (0xd) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 116 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 436 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x bc 0b ac 50 d5 f2 b2 a5 b8 95 0b 68 0a 61 62 e1 | ikev2 g^x 6c a7 a7 93 59 41 48 6e 37 83 f8 be f8 6d 51 53 | ikev2 g^x 71 62 2b 77 82 46 f8 4f 63 00 ae 18 0e 11 7b f5 | ikev2 g^x 5e 8b 8e 8e 18 24 32 5a 4f 40 81 ce 43 b1 6e 46 | ikev2 g^x e8 aa 90 47 81 ea 28 bb e7 a9 c7 59 84 c6 71 50 | ikev2 g^x c6 04 7e 0c e4 d4 40 d7 7c 5c 91 b7 ea 12 23 e7 | ikev2 g^x 12 24 dc e8 26 a1 c3 92 a9 95 79 fc ce 74 1e 17 | ikev2 g^x 40 9d 20 7e a7 ca 77 ef bd 78 b0 d0 58 53 e5 dd | ikev2 g^x 25 4d 16 8a 3a c7 dc 0f 1c fe a7 35 9e ad 79 f8 | ikev2 g^x ce 1f e3 b3 57 9d 49 49 ab 73 aa c4 b8 1a 6d c0 | ikev2 g^x bd b0 cf 9a c8 78 8f b6 8a 55 c9 5c 6a 59 b5 2a | ikev2 g^x 31 d6 b3 2d 91 3e 75 81 70 58 d6 a7 49 06 70 4e | ikev2 g^x 5b 08 25 2e 3f a3 14 c0 ab 31 fc 9c 99 61 92 47 | ikev2 g^x 47 8c 08 4e 26 e4 19 6d 5c d9 42 d9 90 ef 37 2c | ikev2 g^x d4 34 ca 38 9a b8 b1 73 8e 87 db e2 25 f4 52 c8 | ikev2 g^x f9 ad ee b1 4f a9 e7 f4 de 26 5d 90 26 43 5f 24 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | next payload chain: ignoring supplied 'IKEv2 Nonce Payload'.'next payload type' value 41:ISAKMP_NEXT_v2N | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce 73 d5 14 e3 cb 70 bd 50 8e e5 56 fa f8 7b d0 11 | IKEv2 nonce 05 7f 1d 6d f5 e1 97 c7 b7 f9 1e 54 e1 b6 7f b0 | emitting length of IKEv2 Nonce Payload: 36 | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | NAT-Traversal support [enabled] add v2N payloads. | natd_hash: rcookie is zero | natd_hash: hasher=0x55954d312800(20) | natd_hash: icookie= f0 a6 a1 a2 93 0b 81 56 | natd_hash: rcookie= 00 00 00 00 00 00 00 00 | natd_hash: ip= c0 01 03 21 | natd_hash: port=500 | natd_hash: hash= bd 89 d7 bd f6 8e 14 b6 10 8b 0b 17 5a c0 8f 8e | natd_hash: hash= 4d ad ad 0e | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data bd 89 d7 bd f6 8e 14 b6 10 8b 0b 17 5a c0 8f 8e | Notify data 4d ad ad 0e | emitting length of IKEv2 Notify Payload: 28 | natd_hash: rcookie is zero | natd_hash: hasher=0x55954d312800(20) | natd_hash: icookie= f0 a6 a1 a2 93 0b 81 56 | natd_hash: rcookie= 00 00 00 00 00 00 00 00 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 75 f6 a4 ae 97 14 40 ed 7e 9a 99 72 56 64 c0 87 | natd_hash: hash= af 0e 15 ae | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data 75 f6 a4 ae 97 14 40 ed 7e 9a 99 72 56 64 c0 87 | Notify data af 0e 15 ae | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 828 | stop processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_parent_outI1_common() at ikev2_parent.c:817) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #1 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK | IKEv2: transition from state STATE_PARENT_I0 to state STATE_PARENT_I1 | parent state #1: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) | Message ID: updating counters for #1 to 4294967295 after switching state | Message ID: IKE #1 skipping update_recv as MD is fake | Message ID: sent #1 request 0; ike: initiator.sent=-1->0 initiator.recv=-1 responder.sent=-1 responder.recv=-1 wip.initiator=-1->0 wip.responder=-1 "north-east-x509-ipv4"[1] 192.1.2.23 #1: STATE_PARENT_I1: sent v2I1, expected v2R1 | sending V2 reply packet to 192.1.2.23:500 (from 192.1.3.33:500) | sending 828 bytes for STATE_PARENT_I0 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | f0 a6 a1 a2 93 0b 81 56 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 03 3c 22 00 01 b4 | 02 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 14 | 80 0e 01 00 03 00 00 08 02 00 00 07 03 00 00 08 | 02 00 00 05 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 02 00 00 64 02 01 00 0b 03 00 00 0c | 01 00 00 14 80 0e 00 80 03 00 00 08 02 00 00 07 | 03 00 00 08 02 00 00 05 03 00 00 08 04 00 00 0e | 03 00 00 08 04 00 00 0f 03 00 00 08 04 00 00 10 | 03 00 00 08 04 00 00 12 03 00 00 08 04 00 00 13 | 03 00 00 08 04 00 00 14 03 00 00 08 04 00 00 15 | 00 00 00 08 04 00 00 1f 02 00 00 74 03 01 00 0d | 03 00 00 0c 01 00 00 0c 80 0e 01 00 03 00 00 08 | 02 00 00 07 03 00 00 08 02 00 00 05 03 00 00 08 | 03 00 00 0e 03 00 00 08 03 00 00 0c 03 00 00 08 | 04 00 00 0e 03 00 00 08 04 00 00 0f 03 00 00 08 | 04 00 00 10 03 00 00 08 04 00 00 12 03 00 00 08 | 04 00 00 13 03 00 00 08 04 00 00 14 03 00 00 08 | 04 00 00 15 00 00 00 08 04 00 00 1f 00 00 00 74 | 04 01 00 0d 03 00 00 0c 01 00 00 0c 80 0e 00 80 | 03 00 00 08 02 00 00 07 03 00 00 08 02 00 00 05 | 03 00 00 08 03 00 00 0e 03 00 00 08 03 00 00 0c | 03 00 00 08 04 00 00 0e 03 00 00 08 04 00 00 0f | 03 00 00 08 04 00 00 10 03 00 00 08 04 00 00 12 | 03 00 00 08 04 00 00 13 03 00 00 08 04 00 00 14 | 03 00 00 08 04 00 00 15 00 00 00 08 04 00 00 1f | 28 00 01 08 00 0e 00 00 bc 0b ac 50 d5 f2 b2 a5 | b8 95 0b 68 0a 61 62 e1 6c a7 a7 93 59 41 48 6e | 37 83 f8 be f8 6d 51 53 71 62 2b 77 82 46 f8 4f | 63 00 ae 18 0e 11 7b f5 5e 8b 8e 8e 18 24 32 5a | 4f 40 81 ce 43 b1 6e 46 e8 aa 90 47 81 ea 28 bb | e7 a9 c7 59 84 c6 71 50 c6 04 7e 0c e4 d4 40 d7 | 7c 5c 91 b7 ea 12 23 e7 12 24 dc e8 26 a1 c3 92 | a9 95 79 fc ce 74 1e 17 40 9d 20 7e a7 ca 77 ef | bd 78 b0 d0 58 53 e5 dd 25 4d 16 8a 3a c7 dc 0f | 1c fe a7 35 9e ad 79 f8 ce 1f e3 b3 57 9d 49 49 | ab 73 aa c4 b8 1a 6d c0 bd b0 cf 9a c8 78 8f b6 | 8a 55 c9 5c 6a 59 b5 2a 31 d6 b3 2d 91 3e 75 81 | 70 58 d6 a7 49 06 70 4e 5b 08 25 2e 3f a3 14 c0 | ab 31 fc 9c 99 61 92 47 47 8c 08 4e 26 e4 19 6d | 5c d9 42 d9 90 ef 37 2c d4 34 ca 38 9a b8 b1 73 | 8e 87 db e2 25 f4 52 c8 f9 ad ee b1 4f a9 e7 f4 | de 26 5d 90 26 43 5f 24 29 00 00 24 73 d5 14 e3 | cb 70 bd 50 8e e5 56 fa f8 7b d0 11 05 7f 1d 6d | f5 e1 97 c7 b7 f9 1e 54 e1 b6 7f b0 29 00 00 08 | 00 00 40 2e 29 00 00 1c 00 00 40 04 bd 89 d7 bd | f6 8e 14 b6 10 8b 0b 17 5a c0 8f 8e 4d ad ad 0e | 00 00 00 1c 00 00 40 05 75 f6 a4 ae 97 14 40 ed | 7e 9a 99 72 56 64 c0 87 af 0e 15 ae | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x55954d539d18 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x55954d537d58 | success_v2_state_transition scheduling EVENT_RETRANSMIT of c->r_interval=500ms | event_schedule: new EVENT_RETRANSMIT-pe@0x55954d537d58 | inserting event EVENT_RETRANSMIT, timeout in 0.5 seconds for #1 | libevent_malloc: new ptr-libevent@0x55954d53b868 size 128 | #1 STATE_PARENT_I1: retransmits: first event in 0.5 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29670.912087 | resume sending helper answer for #1 suppresed complete_v2_state_transition() and stole MD | #1 spent 0.849 milliseconds in resume sending helper answer | stop processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f5a24002888 | spent 0.00183 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 437 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b 09 6c 01 0e | 21 20 22 20 00 00 00 00 00 00 01 b5 22 00 00 28 | 00 00 00 24 01 01 00 03 03 00 00 0c 01 00 00 14 | 80 0e 01 00 03 00 00 08 02 00 00 07 00 00 00 08 | 04 00 00 0e 28 00 01 08 00 0e 00 00 ed 94 a1 b0 | 9c a8 6a 01 cc 19 77 77 dd 40 da 1c 20 df af a6 | 51 c5 68 47 7d 02 bc 07 14 45 b7 d2 96 85 ba 0a | 88 31 85 d2 d5 92 40 b7 2b 04 a2 dc 62 1d af 5f | 99 96 53 0b 6c e0 8d f1 c1 37 59 ae 80 69 1f 8d | 05 4b 6d fe 1a 14 66 71 7e 2f 44 6b b5 87 b9 9d | a0 48 5b c9 0e 0c 88 25 a6 fd fb 9a 64 99 e5 a6 | da c1 84 49 f0 af 42 2d 5e 1a 49 d6 ac 56 bf 38 | de 63 38 17 ff 94 3e 72 97 ea cf f2 82 a6 3c cf | 13 cd dd 4d da 06 e3 63 1e fc 4b 79 ca 71 e5 fd | d7 81 1c fb 5f 9f 96 3c 7d 3e 2b 88 1e bf d3 d8 | 02 07 3d 2d 99 0d ca a3 43 c9 db e8 82 96 0c ee | c5 ec e8 9b 1c 7c d8 21 de 1b de 6c 33 80 f0 0a | 8d e4 77 15 e8 e8 15 d3 87 6b 4b 79 71 00 a0 2b | 2d 3c 30 bb 5d 04 dd 98 63 78 f1 a4 6f 2b 3a 30 | 54 41 7f 7c 3f ca 26 7a 05 ad bc 17 27 76 3c c9 | 1b 20 bb 13 42 6a d0 08 81 b6 66 be 29 00 00 24 | 4e 74 16 03 63 23 bf 78 77 63 10 46 0b 16 09 63 | 77 36 24 50 fe cb 60 ea 2a 63 c5 36 87 7c 4b 2d | 29 00 00 08 00 00 40 2e 29 00 00 1c 00 00 40 04 | 78 e9 d0 8c 8b fe bc 6e 5e f7 b9 a8 98 68 2f e2 | 1d 6f 74 43 26 00 00 1c 00 00 40 05 fb 04 7d 98 | b2 c5 86 9c 92 48 e3 33 89 0a da a6 5c a5 20 88 | 00 00 00 05 04 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (0x0) | length: 437 (0x1b5) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response | State DB: found IKEv2 state #1 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | [RE]START processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | #1 is idle | #1 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 40 (0x28) | processing payload: ISAKMP_NEXT_v2SA (len=36) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (0x108) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (0x24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (0x8) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (0x1c) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2CERTREQ (0x26) | flags: none (0x0) | length: 28 (0x1c) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2CERTREQ) | ***parse IKEv2 Certificate Request Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 5 (0x5) | ikev2 cert encoding: CERT_X509_SIGNATURE (0x4) | processing payload: ISAKMP_NEXT_v2CERTREQ (len=0) | State DB: re-hashing IKEv2 state #1 IKE SPIi and SPI[ir] | #1 in state PARENT_I1: sent v2I1, expected v2R1 | selected state microcode Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH | Now let's proceed with state specific processing | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH | ikev2 parent inR1: calculating g^{xy} in order to send I2 | using existing local IKE proposals for connection north-east-x509-ipv4 (IKE SA initiator accepting remote proposal): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | Comparing remote proposals against IKE initiator (accepting) 4 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 2 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+DH; optional: INTEG | local proposal 2 type ENCR has 1 transforms | local proposal 2 type PRF has 2 transforms | local proposal 2 type INTEG has 1 transforms | local proposal 2 type DH has 8 transforms | local proposal 2 type ESN has 0 transforms | local proposal 2 transforms: required: ENCR+PRF+DH; optional: INTEG | local proposal 3 type ENCR has 1 transforms | local proposal 3 type PRF has 2 transforms | local proposal 3 type INTEG has 2 transforms | local proposal 3 type DH has 8 transforms | local proposal 3 type ESN has 0 transforms | local proposal 3 transforms: required: ENCR+PRF+INTEG+DH; optional: none | local proposal 4 type ENCR has 1 transforms | local proposal 4 type PRF has 2 transforms | local proposal 4 type INTEG has 2 transforms | local proposal 4 type DH has 8 transforms | local proposal 4 type ESN has 0 transforms | local proposal 4 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 36 (0x24) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 3 (0x3) | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 4 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (0xc) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | remote proposal 1 transform 0 (ENCR=AES_GCM_C_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (0x8) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | remote proposal 1 transform 1 (PRF=HMAC_SHA2_512) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (0x8) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 2 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | remote proposal 1 proposed transforms: ENCR+PRF+DH; matched: ENCR+PRF+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+DH transforms to local proposal 1; required: ENCR+PRF+DH; optional: INTEG; matched: ENCR+PRF+DH | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512;DH=MODP2048[first-match] | converting proposal to internal trans attrs | natd_hash: hasher=0x55954d312800(20) | natd_hash: icookie= f0 a6 a1 a2 93 0b 81 56 | natd_hash: rcookie= 31 d8 72 8b 09 6c 01 0e | natd_hash: ip= c0 01 03 21 | natd_hash: port=500 | natd_hash: hash= af a7 e9 26 78 bb 96 bc 20 61 83 2c bb ea 70 43 | natd_hash: hash= b1 66 b3 98 | natd_hash: hasher=0x55954d312800(20) | natd_hash: icookie= f0 a6 a1 a2 93 0b 81 56 | natd_hash: rcookie= 31 d8 72 8b 09 6c 01 0e | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 78 e9 d0 8c 8b fe bc 6e 5e f7 b9 a8 98 68 2f e2 | natd_hash: hash= 1d 6f 74 43 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | NAT: #1 floating local endpoint from 192.1.3.33:500 to 192.1.3.33:4500 using pluto_nat_port (in ikev2_parent_inR1outI2() at ikev2_parent.c:1695) | NAT: #1 floating endpoint ended up on interface eth1 192.1.3.33:4500 | NAT-T: #1 floating remote port from 500 to 4500 using pluto_nat_port (in ikev2_parent_inR1outI2() at ikev2_parent.c:1695) | offloading IKEv2 SKEYSEED using prf=HMAC_SHA2_512 integ=NONE cipherkey=AES_GCM_16 | adding ikev2_inR1outI2 KE work-order 2 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_PARENT_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x55954d53b868 | free_event_entry: release EVENT_RETRANSMIT-pe@0x55954d537d58 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x55954d537d58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x7f5a24002888 size 128 | #1 spent 0.153 milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH in ikev2_process_state_packet() | [RE]START processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #1 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND | suspending state #1 and saving MD | #1 is busy; has a suspended MD | [RE]START processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in log_stf_suspend() at ikev2.c:3269) | crypto helper 3 resuming | "north-east-x509-ipv4"[1] 192.1.2.23 #1 complete v2 state STATE_PARENT_I1 transition with STF_SUSPEND suspended from complete_v2_state_transition:3451 | crypto helper 3 starting work-order 2 for state #1 | stop processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | crypto helper 3 doing compute dh (V2) (ikev2_inR1outI2 KE); request ID 2 | #1 spent 0.356 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.366 milliseconds in comm_handle_cb() reading and processing packet | calculating skeyseed using prf=sha2_512 integ=none cipherkey-size=32 salt-size=4 | crypto helper 3 finished compute dh (V2) (ikev2_inR1outI2 KE); request ID 2 time elapsed 0.000806 seconds | (#1) spent 0.805 milliseconds in crypto helper computing work-order 2: ikev2_inR1outI2 KE (pcr) | crypto helper 3 sending results from work-order 2 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f5a1c000f48 size 128 | crypto helper 3 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 3 replies to request ID 2 | calling continuation function 0x55954d23db50 | ikev2_parent_inR1outI2_continue for #1: calculating g^{xy}, sending I2 | creating state object #2 at 0x55954d5408e8 | State DB: adding IKEv2 state #2 in UNDEFINED | pstats #2 ikev2.child started | duplicating state object #1 "north-east-x509-ipv4"[1] 192.1.2.23 as #2 for IPSEC SA | #2 setting local endpoint to 192.1.3.33:4500 from #1.st_localport (in duplicate_state() at state.c:1484) | Message ID: init_child #1.#2; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1; child: wip.initiator=0->-1 wip.responder=0->-1 | Message ID: switch-from #1 response 0; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1 wip.initiator=0->-1 wip.responder=-1 | Message ID: switch-to #1.#2 response 0; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1; child: wip.initiator=-1->0 wip.responder=-1 | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7f5a24002888 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x55954d537d58 | event_schedule: new EVENT_SA_REPLACE-pe@0x55954d537d58 | inserting event EVENT_SA_REPLACE, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x7f5a24002888 size 128 | parent state #1: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | IKEv2 CERT: send a certificate? | IKEv2 CERT: OK to send a certificate (always) | IDr payload will be sent | ****emit IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_DER_ASN1_DN (0x9) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' | emitting 185 raw bytes of my identity into IKEv2 Identification - Initiator - Payload | my identity 30 81 b6 31 0b 30 09 06 03 55 04 06 13 02 43 41 | my identity 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | my identity 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | my identity 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | my identity 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | my identity 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | my identity 6e 74 31 24 30 22 06 03 55 04 03 0c 1b 6e 6f 72 | my identity 74 68 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 | my identity 73 77 61 6e 2e 6f 72 67 31 2f 30 2d 06 09 2a 86 | my identity 48 86 f7 0d 01 09 01 16 20 75 73 65 72 2d 6e 6f | my identity 72 74 68 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 | my identity 65 73 77 61 6e 2e 6f 72 67 | emitting length of IKEv2 Identification - Initiator - Payload: 193 | Sending [CERT] of certificate: E=user-north@testing.libreswan.org,CN=north.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | ****emit IKEv2 Certificate Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ikev2 cert encoding: CERT_X509_SIGNATURE (0x4) | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Certificate Payload (37:ISAKMP_NEXT_v2CERT) | next payload chain: saving location 'IKEv2 Certificate Payload'.'next payload type' in 'reply packet' | emitting 1227 raw bytes of CERT into IKEv2 Certificate Payload | CERT 30 82 04 c7 30 82 04 30 a0 03 02 01 02 02 01 06 | CERT 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 | CERT 81 ac 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 | CERT 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 69 | CERT 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 6f | CERT 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c 69 | CERT 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 0b | CERT 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 6e | CERT 74 31 25 30 23 06 03 55 04 03 0c 1c 4c 69 62 72 | CERT 65 73 77 61 6e 20 74 65 73 74 20 43 41 20 66 6f | CERT 72 20 6d 61 69 6e 63 61 31 24 30 22 06 09 2a 86 | CERT 48 86 f7 0d 01 09 01 16 15 74 65 73 74 69 6e 67 | CERT 40 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 22 | CERT 18 0f 32 30 31 39 30 38 32 34 30 39 30 37 35 33 | CERT 5a 18 0f 32 30 32 32 30 38 32 33 30 39 30 37 35 | CERT 33 5a 30 81 b6 31 0b 30 09 06 03 55 04 06 13 02 | CERT 43 41 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 | CERT 61 72 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 | CERT 6f 72 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c | CERT 09 4c 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 | CERT 55 04 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 | CERT 6d 65 6e 74 31 24 30 22 06 03 55 04 03 0c 1b 6e | CERT 6f 72 74 68 2e 74 65 73 74 69 6e 67 2e 6c 69 62 | CERT 72 65 73 77 61 6e 2e 6f 72 67 31 2f 30 2d 06 09 | CERT 2a 86 48 86 f7 0d 01 09 01 16 20 75 73 65 72 2d | CERT 6e 6f 72 74 68 40 74 65 73 74 69 6e 67 2e 6c 69 | CERT 62 72 65 73 77 61 6e 2e 6f 72 67 30 82 01 a2 30 | CERT 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 | CERT 01 8f 00 30 82 01 8a 02 82 01 81 00 c0 59 bd 4b | CERT 40 fd f4 2c e7 cf 9e f3 29 e6 61 73 de ab 42 3d | CERT cc 51 1a e8 79 d6 53 46 a1 fd 66 d1 9e ab b4 65 | CERT 76 51 ad 3f 6f 8f ef d2 73 f9 fd 8f 44 b0 6c 36 | CERT 4b 95 c3 b2 45 0f 31 0c e9 df 35 95 44 c0 19 53 | CERT 8d df 6a 4b b2 af d6 d3 e8 dd f5 20 df 9c cd 8a | CERT f7 6a 09 92 60 00 45 44 39 4c 17 6c 06 02 91 37 | CERT 4b f5 6a c3 5e 21 c6 64 32 32 98 1d b7 99 1f 3c | CERT 13 fe ec c7 a4 a5 3b 37 30 df e4 31 95 47 91 b1 | CERT ca 96 66 b7 9e 49 65 a2 4c 79 54 17 ed 68 19 34 | CERT 9d 7e 67 91 27 51 f0 ee cb b3 90 68 7c 1d fd 83 | CERT 32 06 2e e6 6f d5 f0 62 00 4d ef 11 90 b6 ad 61 | CERT 83 0b 21 94 18 d9 2b 88 09 0d 33 2e 3b 71 18 f4 | CERT ce 4a 45 f3 37 f4 db c0 d6 ab c2 da da cd 6d e0 | CERT a3 9d 21 53 19 34 b1 0c d9 63 7c 45 b7 26 a4 d9 | CERT d6 93 25 1e 1f 74 3c 07 32 69 9b bc 0f db ba 3e | CERT 30 85 a4 3d ec 5c 70 fe fe 7d 64 3c 2c 48 b3 8a | CERT eb 26 bf 05 d4 33 1e c3 f7 1c 24 c9 99 e3 d1 99 | CERT 91 df 32 10 d5 7c 31 7e 9e 6f 70 01 dc 0d d7 21 | CERT 03 76 4d f5 b2 e3 87 30 94 8c b2 0a c0 b4 d9 0b | CERT d4 d9 37 e0 7a 73 13 50 8d 6f 93 9a 7c 5a 1a b2 | CERT 87 7e 0c 64 60 cb 4b 2c ef 22 75 b1 7c 60 3e e3 | CERT e5 f1 94 38 51 8f 00 e8 35 7b b5 01 ed c1 c4 fd | CERT a3 4b 56 42 d6 8b 64 38 74 95 c4 13 70 f0 f0 23 | CERT 29 57 2b ef 74 97 97 76 8d 30 48 91 02 03 01 00 | CERT 01 a3 81 e4 30 81 e1 30 09 06 03 55 1d 13 04 02 | CERT 30 00 30 26 06 03 55 1d 11 04 1f 30 1d 82 1b 6e | CERT 6f 72 74 68 2e 74 65 73 74 69 6e 67 2e 6c 69 62 | CERT 72 65 73 77 61 6e 2e 6f 72 67 30 0b 06 03 55 1d | CERT 0f 04 04 03 02 07 80 30 1d 06 03 55 1d 25 04 16 | CERT 30 14 06 08 2b 06 01 05 05 07 03 01 06 08 2b 06 | CERT 01 05 05 07 03 02 30 41 06 08 2b 06 01 05 05 07 | CERT 01 01 04 35 30 33 30 31 06 08 2b 06 01 05 05 07 | CERT 30 01 86 25 68 74 74 70 3a 2f 2f 6e 69 63 2e 74 | CERT 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e | CERT 2e 6f 72 67 3a 32 35 36 30 30 3d 06 03 55 1d 1f | CERT 04 36 30 34 30 32 a0 30 a0 2e 86 2c 68 74 74 70 | CERT 3a 2f 2f 6e 69 63 2e 74 65 73 74 69 6e 67 2e 6c | CERT 69 62 72 65 73 77 61 6e 2e 6f 72 67 2f 72 65 76 | CERT 6f 6b 65 64 2e 63 72 6c 30 0d 06 09 2a 86 48 86 | CERT f7 0d 01 01 0b 05 00 03 81 81 00 9e e9 26 57 73 | CERT c2 4c 64 c6 ab d6 d3 1a 13 4f 6b 48 e3 17 b2 3d | CERT fb 30 93 2d 15 92 6e a3 60 29 10 1d 3e a7 93 48 | CERT 3c 40 5b af 9e e5 93 b7 2f d5 4b 9f db bd ab 5d | CERT 03 57 3a 1a f9 81 87 13 dd 32 e7 93 b5 9e 3b 40 | CERT 3c c6 c9 d5 ce c6 c7 5d da 89 36 3d d0 36 82 fd | CERT b2 ab 00 2a 7c 0e a7 ad 3e e2 b1 5a 0d 88 45 26 | CERT 48 51 b3 c7 79 d7 04 e7 47 5f 28 f8 63 fb ae 58 | CERT 52 8b ba 60 ce 19 ac fa 4e 65 7d | emitting length of IKEv2 Certificate Payload: 1232 | IKEv2 CERTREQ: send a cert request? | IKEv2 CERTREQ: OK to send a certificate request | Sending [CERTREQ] of C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org | connection->kind is not CK_PERMANENT (instance), so collect CAs | Not a roadwarrior instance, sending empty CA in CERTREQ | ****emit IKEv2 Certificate Request Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ikev2 cert encoding: CERT_X509_SIGNATURE (0x4) | next payload chain: setting previous 'IKEv2 Certificate Payload'.'next payload type' to current IKEv2 Certificate Request Payload (38:ISAKMP_NEXT_v2CERTREQ) | next payload chain: saving location 'IKEv2 Certificate Request Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Certificate Request Payload: 5 | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | ID type: ID_DER_ASN1_DN (0x9) | next payload chain: ignoring supplied 'IKEv2 Identification - Responder - Payload'.'next payload type' value 39:ISAKMP_NEXT_v2AUTH | next payload chain: setting previous 'IKEv2 Certificate Request Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 183 raw bytes of IDr into IKEv2 Identification - Responder - Payload | IDr 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | IDr 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | IDr 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | IDr 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | IDr 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | IDr 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | IDr 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 65 61 73 | IDr 74 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | IDr 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a 86 48 | IDr 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 65 61 73 | IDr 74 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | IDr 77 61 6e 2e 6f 72 67 | emitting length of IKEv2 Identification - Responder - Payload: 191 | not sending INITIAL_CONTACT | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_RSA (0x1) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org->C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org of kind PKK_RSA | searching for certificate PKK_RSA:AwEAAcBZv vs PKK_RSA:AwEAAcBZv | #1 spent 5.38 milliseconds in ikev2_calculate_rsa_hash() calling sign_hash_RSA() | emitting 384 raw bytes of rsa signature into IKEv2 Authentication Payload | rsa signature 69 61 38 01 69 fc ce a1 f8 e1 77 30 a8 7f 89 d8 | rsa signature 66 0e 2d 1d da 0a ba 27 b5 93 be 65 34 0b a8 2c | rsa signature 10 25 e2 8b 74 7e 79 66 83 a3 44 55 39 67 86 f1 | rsa signature 6f e2 8f e6 da d4 43 a1 f0 f7 d0 60 dc fc c6 7d | rsa signature fd a5 0f 15 97 fd 80 71 e0 69 07 70 c3 b9 e5 93 | rsa signature 46 af 73 47 08 34 9b 67 28 42 65 dc 33 f0 8f 4e | rsa signature 77 d9 67 c8 3c b5 91 cd 3a c0 c1 60 76 34 4a 46 | rsa signature f9 7b 79 3b e0 89 e9 3a dc a6 e8 0c b0 3d e5 48 | rsa signature 56 3a eb 6f 36 f1 e2 74 95 98 50 92 dd b6 27 0f | rsa signature 97 1e 2b f7 76 6b a4 65 de 19 24 20 b0 4d a3 2b | rsa signature 5d 33 33 1c 85 6a bc 63 36 cc b0 75 2c c4 44 a1 | rsa signature 3c 4c 19 d1 18 e6 0c a6 c8 4c 47 5e 36 81 29 70 | rsa signature de b5 15 b3 d8 bd 8c 80 3e 3e ad 17 15 d4 e2 60 | rsa signature 3f f8 6f 35 25 8c d7 4c cf 69 7e fd 05 6f 16 08 | rsa signature 15 de 1b 84 e0 c6 b3 10 c9 1e e5 25 f0 89 fc e4 | rsa signature 23 8a 95 44 b0 6c fb 0b fc b2 e1 f2 83 37 53 59 | rsa signature 94 f3 62 96 be 08 6a 24 01 a0 35 36 3a 9d a8 f8 | rsa signature fc 5c bd 8b 05 3f 48 f8 68 43 2e fb 19 88 f9 4a | rsa signature 53 2d 9d 97 1d 2d 64 2f ab d0 5b 1d 67 ff 6d 82 | rsa signature 39 f9 6c b1 7b 26 3d 0e 62 0d 6b 8f 23 a0 fe 9d | rsa signature e8 c5 e0 a6 09 a7 22 fe c0 05 86 b6 39 16 66 5b | rsa signature b8 41 fa b3 df 08 ba 8e 99 73 2b b9 e9 b4 49 2a | rsa signature 1c 49 2d b9 2b 15 8b 8a 63 64 2b 7d 6a 49 ae 2b | rsa signature 0c f9 3a dd ec 9d d3 3f aa 0a 02 a5 bb 1b d7 ab | #1 spent 5.5 milliseconds in ikev2_calculate_rsa_hash() | emitting length of IKEv2 Authentication Payload: 392 | Send Configuration Payload request | ****emit IKEv2 Configuration Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | ikev2_cfg_type: IKEv2_CP_CFG_REQUEST (0x1) | next payload chain: ignoring supplied 'IKEv2 Configuration Payload'.'next payload type' value 33:ISAKMP_NEXT_v2SA | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Configuration Payload (47:ISAKMP_NEXT_v2CP) | next payload chain: saving location 'IKEv2 Configuration Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Configuration Payload Attribute: | Attribute Type: IKEv2_INTERNAL_IP4_ADDRESS (0x1) | emitting length of IKEv2 Configuration Payload Attribute: 0 | *****emit IKEv2 Configuration Payload Attribute: | Attribute Type: IKEv2_INTERNAL_IP4_DNS (0x3) | emitting length of IKEv2 Configuration Payload Attribute: 0 | *****emit IKEv2 Configuration Payload Attribute: | Attribute Type: IKEv2_INTERNAL_IP6_ADDRESS (0x8) | emitting length of IKEv2 Configuration Payload Attribute: 0 | *****emit IKEv2 Configuration Payload Attribute: | Attribute Type: IKEv2_INTERNAL_IP6_DNS (0xa) | emitting length of IKEv2 Configuration Payload Attribute: 0 | *****emit IKEv2 Configuration Payload Attribute: | Attribute Type: IKEv2_INTERNAL_DNS_DOMAIN (0x19) | emitting length of IKEv2 Configuration Payload Attribute: 0 | emitting length of IKEv2 Configuration Payload: 28 | getting first pending from state #1 | netlink_get_spi: allocated 0x9d4a90ca for esp.0@192.1.3.33 | constructing ESP/AH proposals with all DH removed for north-east-x509-ipv4 (IKE SA initiator emitting ESP/AH proposals) | converting proposal AES_GCM_16_256-NONE to ikev2 ... | ... ikev2_proposal: 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED | converting proposal AES_GCM_16_128-NONE to ikev2 ... | ... ikev2_proposal: 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED | converting proposal AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ... | ... ikev2_proposal: 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED | converting proposal AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ... | ... ikev2_proposal: 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED "north-east-x509-ipv4"[1] 192.1.2.23: constructed local ESP/AH proposals for north-east-x509-ipv4 (IKE SA initiator emitting ESP/AH proposals): 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED | Emitting ikev2_proposals ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Configuration Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discarding INTEG=NONE | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 2 (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi 9d 4a 90 ca | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | discarding INTEG=NONE | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 32 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding INTEG=NONE | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 2 (0x2) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 2 (0x2) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi 9d 4a 90 ca | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | discarding INTEG=NONE | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 32 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 3 (0x3) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 4 (0x4) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi 9d 4a 90 ca | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 48 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 4 (0x4) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 4 (0x4) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi 9d 4a 90 ca | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 48 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 164 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (0x1) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: 0 (0x0) | start port: 0 (0x0) | end port: 65535 (0xffff) | emitting 4 raw bytes of ipv4 start into IKEv2 Traffic Selector | ipv4 start 00 00 00 00 | emitting 4 raw bytes of ipv4 end into IKEv2 Traffic Selector | ipv4 end ff ff ff ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (0x1) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: 0 (0x0) | start port: 0 (0x0) | end port: 65535 (0xffff) | emitting 4 raw bytes of ipv4 start into IKEv2 Traffic Selector | ipv4 start 00 00 00 00 | emitting 4 raw bytes of ipv4 end into IKEv2 Traffic Selector | ipv4 end ff ff ff ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE | Initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 2282 | emitting length of ISAKMP Message: 2310 | **parse ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | length: 2310 (0x906) | **parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 2282 (0x8ea) | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | fragment number: 1 (0x1) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 474 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 25 00 00 c1 09 00 00 00 30 81 b6 31 0b 30 09 06 | cleartext fragment 03 55 04 06 13 02 43 41 31 10 30 0e 06 03 55 04 | cleartext fragment 08 0c 07 4f 6e 74 61 72 69 6f 31 10 30 0e 06 03 | cleartext fragment 55 04 07 0c 07 54 6f 72 6f 6e 74 6f 31 12 30 10 | cleartext fragment 06 03 55 04 0a 0c 09 4c 69 62 72 65 73 77 61 6e | cleartext fragment 31 18 30 16 06 03 55 04 0b 0c 0f 54 65 73 74 20 | cleartext fragment 44 65 70 61 72 74 6d 65 6e 74 31 24 30 22 06 03 | cleartext fragment 55 04 03 0c 1b 6e 6f 72 74 68 2e 74 65 73 74 69 | cleartext fragment 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 | cleartext fragment 31 2f 30 2d 06 09 2a 86 48 86 f7 0d 01 09 01 16 | cleartext fragment 20 75 73 65 72 2d 6e 6f 72 74 68 40 74 65 73 74 | cleartext fragment 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 | cleartext fragment 67 26 00 04 d0 04 30 82 04 c7 30 82 04 30 a0 03 | cleartext fragment 02 01 02 02 01 06 30 0d 06 09 2a 86 48 86 f7 0d | cleartext fragment 01 01 0b 05 00 30 81 ac 31 0b 30 09 06 03 55 04 | cleartext fragment 06 13 02 43 41 31 10 30 0e 06 03 55 04 08 0c 07 | cleartext fragment 4f 6e 74 61 72 69 6f 31 10 30 0e 06 03 55 04 07 | cleartext fragment 0c 07 54 6f 72 6f 6e 74 6f 31 12 30 10 06 03 55 | cleartext fragment 04 0a 0c 09 4c 69 62 72 65 73 77 61 6e 31 18 30 | cleartext fragment 16 06 03 55 04 0b 0c 0f 54 65 73 74 20 44 65 70 | cleartext fragment 61 72 74 6d 65 6e 74 31 25 30 23 06 03 55 04 03 | cleartext fragment 0c 1c 4c 69 62 72 65 73 77 61 6e 20 74 65 73 74 | cleartext fragment 20 43 41 20 66 6f 72 20 6d 61 69 6e 63 61 31 24 | cleartext fragment 30 22 06 09 2a 86 48 86 f7 0d 01 09 01 16 15 74 | cleartext fragment 65 73 74 69 6e 67 40 6c 69 62 72 65 73 77 61 6e | cleartext fragment 2e 6f 72 67 30 22 18 0f 32 30 31 39 30 38 32 34 | cleartext fragment 30 39 30 37 35 33 5a 18 0f 32 30 32 32 30 38 32 | cleartext fragment 33 30 39 30 37 35 33 5a 30 81 b6 31 0b 30 09 06 | cleartext fragment 03 55 04 06 13 02 43 41 31 10 30 0e 06 03 55 04 | cleartext fragment 08 0c 07 4f 6e 74 61 72 69 6f | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 507 | emitting length of ISAKMP Message: 535 | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 2 (0x2) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 474 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 6f 6e | cleartext fragment 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c 69 62 | cleartext fragment 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 0b 0c | cleartext fragment 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 6e 74 | cleartext fragment 31 24 30 22 06 03 55 04 03 0c 1b 6e 6f 72 74 68 | cleartext fragment 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 | cleartext fragment 61 6e 2e 6f 72 67 31 2f 30 2d 06 09 2a 86 48 86 | cleartext fragment f7 0d 01 09 01 16 20 75 73 65 72 2d 6e 6f 72 74 | cleartext fragment 68 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | cleartext fragment 77 61 6e 2e 6f 72 67 30 82 01 a2 30 0d 06 09 2a | cleartext fragment 86 48 86 f7 0d 01 01 01 05 00 03 82 01 8f 00 30 | cleartext fragment 82 01 8a 02 82 01 81 00 c0 59 bd 4b 40 fd f4 2c | cleartext fragment e7 cf 9e f3 29 e6 61 73 de ab 42 3d cc 51 1a e8 | cleartext fragment 79 d6 53 46 a1 fd 66 d1 9e ab b4 65 76 51 ad 3f | cleartext fragment 6f 8f ef d2 73 f9 fd 8f 44 b0 6c 36 4b 95 c3 b2 | cleartext fragment 45 0f 31 0c e9 df 35 95 44 c0 19 53 8d df 6a 4b | cleartext fragment b2 af d6 d3 e8 dd f5 20 df 9c cd 8a f7 6a 09 92 | cleartext fragment 60 00 45 44 39 4c 17 6c 06 02 91 37 4b f5 6a c3 | cleartext fragment 5e 21 c6 64 32 32 98 1d b7 99 1f 3c 13 fe ec c7 | cleartext fragment a4 a5 3b 37 30 df e4 31 95 47 91 b1 ca 96 66 b7 | cleartext fragment 9e 49 65 a2 4c 79 54 17 ed 68 19 34 9d 7e 67 91 | cleartext fragment 27 51 f0 ee cb b3 90 68 7c 1d fd 83 32 06 2e e6 | cleartext fragment 6f d5 f0 62 00 4d ef 11 90 b6 ad 61 83 0b 21 94 | cleartext fragment 18 d9 2b 88 09 0d 33 2e 3b 71 18 f4 ce 4a 45 f3 | cleartext fragment 37 f4 db c0 d6 ab c2 da da cd 6d e0 a3 9d 21 53 | cleartext fragment 19 34 b1 0c d9 63 7c 45 b7 26 a4 d9 d6 93 25 1e | cleartext fragment 1f 74 3c 07 32 69 9b bc 0f db ba 3e 30 85 a4 3d | cleartext fragment ec 5c 70 fe fe 7d 64 3c 2c 48 b3 8a eb 26 bf 05 | cleartext fragment d4 33 1e c3 f7 1c 24 c9 99 e3 d1 99 91 df 32 10 | cleartext fragment d5 7c 31 7e 9e 6f 70 01 dc 0d | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 507 | emitting length of ISAKMP Message: 535 | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 3 (0x3) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 474 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment d7 21 03 76 4d f5 b2 e3 87 30 94 8c b2 0a c0 b4 | cleartext fragment d9 0b d4 d9 37 e0 7a 73 13 50 8d 6f 93 9a 7c 5a | cleartext fragment 1a b2 87 7e 0c 64 60 cb 4b 2c ef 22 75 b1 7c 60 | cleartext fragment 3e e3 e5 f1 94 38 51 8f 00 e8 35 7b b5 01 ed c1 | cleartext fragment c4 fd a3 4b 56 42 d6 8b 64 38 74 95 c4 13 70 f0 | cleartext fragment f0 23 29 57 2b ef 74 97 97 76 8d 30 48 91 02 03 | cleartext fragment 01 00 01 a3 81 e4 30 81 e1 30 09 06 03 55 1d 13 | cleartext fragment 04 02 30 00 30 26 06 03 55 1d 11 04 1f 30 1d 82 | cleartext fragment 1b 6e 6f 72 74 68 2e 74 65 73 74 69 6e 67 2e 6c | cleartext fragment 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 0b 06 03 | cleartext fragment 55 1d 0f 04 04 03 02 07 80 30 1d 06 03 55 1d 25 | cleartext fragment 04 16 30 14 06 08 2b 06 01 05 05 07 03 01 06 08 | cleartext fragment 2b 06 01 05 05 07 03 02 30 41 06 08 2b 06 01 05 | cleartext fragment 05 07 01 01 04 35 30 33 30 31 06 08 2b 06 01 05 | cleartext fragment 05 07 30 01 86 25 68 74 74 70 3a 2f 2f 6e 69 63 | cleartext fragment 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 | cleartext fragment 61 6e 2e 6f 72 67 3a 32 35 36 30 30 3d 06 03 55 | cleartext fragment 1d 1f 04 36 30 34 30 32 a0 30 a0 2e 86 2c 68 74 | cleartext fragment 74 70 3a 2f 2f 6e 69 63 2e 74 65 73 74 69 6e 67 | cleartext fragment 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 2f 72 | cleartext fragment 65 76 6f 6b 65 64 2e 63 72 6c 30 0d 06 09 2a 86 | cleartext fragment 48 86 f7 0d 01 01 0b 05 00 03 81 81 00 9e e9 26 | cleartext fragment 57 73 c2 4c 64 c6 ab d6 d3 1a 13 4f 6b 48 e3 17 | cleartext fragment b2 3d fb 30 93 2d 15 92 6e a3 60 29 10 1d 3e a7 | cleartext fragment 93 48 3c 40 5b af 9e e5 93 b7 2f d5 4b 9f db bd | cleartext fragment ab 5d 03 57 3a 1a f9 81 87 13 dd 32 e7 93 b5 9e | cleartext fragment 3b 40 3c c6 c9 d5 ce c6 c7 5d da 89 36 3d d0 36 | cleartext fragment 82 fd b2 ab 00 2a 7c 0e a7 ad 3e e2 b1 5a 0d 88 | cleartext fragment 45 26 48 51 b3 c7 79 d7 04 e7 47 5f 28 f8 63 fb | cleartext fragment ae 58 52 8b ba 60 ce 19 ac fa | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 507 | emitting length of ISAKMP Message: 535 | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 4 (0x4) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 474 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 4e 65 7d 24 00 00 05 04 27 00 00 bf 09 00 00 00 | cleartext fragment 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | cleartext fragment 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | cleartext fragment 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | cleartext fragment 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | cleartext fragment 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | cleartext fragment 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | cleartext fragment 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 65 61 73 | cleartext fragment 74 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | cleartext fragment 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a 86 48 | cleartext fragment 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 65 61 73 | cleartext fragment 74 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | cleartext fragment 77 61 6e 2e 6f 72 67 2f 00 01 88 01 00 00 00 69 | cleartext fragment 61 38 01 69 fc ce a1 f8 e1 77 30 a8 7f 89 d8 66 | cleartext fragment 0e 2d 1d da 0a ba 27 b5 93 be 65 34 0b a8 2c 10 | cleartext fragment 25 e2 8b 74 7e 79 66 83 a3 44 55 39 67 86 f1 6f | cleartext fragment e2 8f e6 da d4 43 a1 f0 f7 d0 60 dc fc c6 7d fd | cleartext fragment a5 0f 15 97 fd 80 71 e0 69 07 70 c3 b9 e5 93 46 | cleartext fragment af 73 47 08 34 9b 67 28 42 65 dc 33 f0 8f 4e 77 | cleartext fragment d9 67 c8 3c b5 91 cd 3a c0 c1 60 76 34 4a 46 f9 | cleartext fragment 7b 79 3b e0 89 e9 3a dc a6 e8 0c b0 3d e5 48 56 | cleartext fragment 3a eb 6f 36 f1 e2 74 95 98 50 92 dd b6 27 0f 97 | cleartext fragment 1e 2b f7 76 6b a4 65 de 19 24 20 b0 4d a3 2b 5d | cleartext fragment 33 33 1c 85 6a bc 63 36 cc b0 75 2c c4 44 a1 3c | cleartext fragment 4c 19 d1 18 e6 0c a6 c8 4c 47 5e 36 81 29 70 de | cleartext fragment b5 15 b3 d8 bd 8c 80 3e 3e ad 17 15 d4 e2 60 3f | cleartext fragment f8 6f 35 25 8c d7 4c cf 69 7e fd 05 6f 16 08 15 | cleartext fragment de 1b 84 e0 c6 b3 10 c9 1e e5 25 f0 89 fc e4 23 | cleartext fragment 8a 95 44 b0 6c fb 0b fc b2 e1 f2 83 37 53 59 94 | cleartext fragment f3 62 96 be 08 6a 24 01 a0 35 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 507 | emitting length of ISAKMP Message: 535 | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 5 (0x5) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 357 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 36 3a 9d a8 f8 fc 5c bd 8b 05 3f 48 f8 68 43 2e | cleartext fragment fb 19 88 f9 4a 53 2d 9d 97 1d 2d 64 2f ab d0 5b | cleartext fragment 1d 67 ff 6d 82 39 f9 6c b1 7b 26 3d 0e 62 0d 6b | cleartext fragment 8f 23 a0 fe 9d e8 c5 e0 a6 09 a7 22 fe c0 05 86 | cleartext fragment b6 39 16 66 5b b8 41 fa b3 df 08 ba 8e 99 73 2b | cleartext fragment b9 e9 b4 49 2a 1c 49 2d b9 2b 15 8b 8a 63 64 2b | cleartext fragment 7d 6a 49 ae 2b 0c f9 3a dd ec 9d d3 3f aa 0a 02 | cleartext fragment a5 bb 1b d7 ab 21 00 00 1c 01 00 00 00 00 01 00 | cleartext fragment 00 00 03 00 00 00 08 00 00 00 0a 00 00 00 19 00 | cleartext fragment 00 2c 00 00 a4 02 00 00 20 01 03 04 02 9d 4a 90 | cleartext fragment ca 03 00 00 0c 01 00 00 14 80 0e 01 00 00 00 00 | cleartext fragment 08 05 00 00 00 02 00 00 20 02 03 04 02 9d 4a 90 | cleartext fragment ca 03 00 00 0c 01 00 00 14 80 0e 00 80 00 00 00 | cleartext fragment 08 05 00 00 00 02 00 00 30 03 03 04 04 9d 4a 90 | cleartext fragment ca 03 00 00 0c 01 00 00 0c 80 0e 01 00 03 00 00 | cleartext fragment 08 03 00 00 0e 03 00 00 08 03 00 00 0c 00 00 00 | cleartext fragment 08 05 00 00 00 00 00 00 30 04 03 04 04 9d 4a 90 | cleartext fragment ca 03 00 00 0c 01 00 00 0c 80 0e 00 80 03 00 00 | cleartext fragment 08 03 00 00 0e 03 00 00 08 03 00 00 0c 00 00 00 | cleartext fragment 08 05 00 00 00 2d 00 00 18 01 00 00 00 07 00 00 | cleartext fragment 10 00 00 ff ff 00 00 00 00 ff ff ff ff 00 00 00 | cleartext fragment 18 01 00 00 00 07 00 00 10 00 00 ff ff 00 00 00 | cleartext fragment 00 ff ff ff ff | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 390 | emitting length of ISAKMP Message: 418 | suspend processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #2 complete_v2_state_transition() md.from_state=PARENT_I1 md.svm.state[from]=PARENT_I1 UNDEFINED->PARENT_I2 with status STF_OK | IKEv2: transition from state STATE_PARENT_I1 to state STATE_PARENT_I2 | child state #2: UNDEFINED(ignore) => PARENT_I2(open IKE SA) | Message ID: updating counters for #2 to 0 after switching state | Message ID: recv #1.#2 response 0; ike: initiator.sent=0 initiator.recv=-1->0 responder.sent=-1 responder.recv=-1; child: wip.initiator=0->-1 wip.responder=-1 | Message ID: sent #1.#2 request 1; ike: initiator.sent=0->1 initiator.recv=0 responder.sent=-1 responder.recv=-1; child: wip.initiator=-1->1 wip.responder=-1 "north-east-x509-ipv4"[1] 192.1.2.23 #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048} | sending V2 reply packet to 192.1.2.23:4500 (from 192.1.3.33:4500) | sending fragments ... | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #1) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 35 20 23 08 00 00 00 01 00 00 02 17 | 23 00 01 fb 00 01 00 05 5d 7d cb cf 2d d6 e6 0d | 9b ad 86 be b2 95 f3 e9 bd 29 14 d1 d6 4e d3 72 | a4 bd 97 a3 13 1e ef 50 b0 06 26 b1 a1 6e 90 ea | b8 2a 46 fa 25 92 55 57 f9 84 ac 8b 8a 1c 08 bc | c4 55 c8 dc a6 55 19 f9 9d ed 1f b0 c8 e0 bd 17 | 6e aa 0f 0a 68 aa 05 8b 1c 00 23 c0 13 5b 40 ae | 91 ce e2 31 dd 55 5a 0a 64 59 33 c0 80 f5 f0 38 | 2a cf 50 be 4f 32 7c 15 c3 71 a1 0d ec 00 1c ef | 14 5b 31 59 0b 17 a8 a2 32 d8 95 15 3a 85 5a 16 | 91 48 40 e7 2c e6 03 f7 1d 09 7f ec 3b 05 64 54 | e2 59 a3 5b 42 5c 73 94 cf 27 f9 7a 27 f5 2b 78 | e4 9c ea fb 4c fc e0 04 8d 40 bc 2f b1 63 6e 33 | b3 df 46 2e 05 9f e8 1c 2b 94 d3 4f 95 96 65 24 | 09 94 22 62 a3 07 4d b2 f7 56 4a 12 86 91 6d b5 | ad ee 54 42 3e 96 e6 8f ce a1 96 43 7e e7 5c 62 | ed db 0f 31 5c 23 e0 1b cc b4 f2 e0 26 aa 43 35 | cf 47 a4 ea 55 8c 5b 57 4f 3d 2a be 0f 03 78 bd | b6 5a 79 1f 20 46 2e 84 c1 fb 1f 59 b4 78 d3 b9 | bf ae c7 0e 68 4a 66 0f 51 86 6f 1f 68 67 bf 0e | f1 78 8d 69 6f 2b 4d 0c 2c 89 57 46 ab 3b e3 32 | b4 f5 30 61 ff 15 fd 98 79 b4 3c cc 37 41 54 7f | ab 8c 3a 35 dc 6e f9 3c ae 6c 8d 33 c7 b3 52 2e | 96 73 43 0a 91 a5 98 1a f6 ea f4 e3 74 c4 6b 4f | d9 19 aa cd 1b 95 05 94 a1 c4 aa 20 6d 47 d5 b6 | 9c 53 0f 92 37 6b 93 5a fd 8e fa a3 22 f2 95 0e | b8 e3 c3 8d 1e d0 9a d8 5e 74 ab f2 37 4d 22 02 | 23 34 e5 0b e3 2b 0a d3 d9 a0 cc 33 fb 4c 7e 08 | 72 cc 6f 99 cb fe 2e 63 10 9c 82 36 12 0c c2 5f | 86 49 1e 3b 38 42 98 cc 65 00 bc 60 07 3e d0 c6 | 8a 24 80 ee 4f 08 22 70 00 9e 7e 8b 79 95 60 a4 | 6a 1d 9f 7f 6e 19 c4 08 b5 cc 43 e0 cb 7d 5b 39 | a8 db d3 e8 91 f7 da 5e 5d c1 27 | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #1) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 35 20 23 08 00 00 00 01 00 00 02 17 | 00 00 01 fb 00 02 00 05 ff cd 22 e2 11 57 c1 ab | ea 0b 76 12 95 3c 05 02 cd 87 80 aa 19 2e 1c 87 | 3d 1b 30 84 64 4b 3d 1b ac c7 09 b1 84 69 94 c7 | 73 29 39 23 c4 4e c0 a9 e8 bb f0 b9 13 42 5a 58 | 7c 8a 35 a7 91 e4 c8 a8 36 fa 9e 63 81 54 68 4b | a5 e7 3b c4 1a a3 32 96 01 70 a7 80 d5 b3 7c 36 | d8 0d 7f 8b db 57 64 32 8b 34 dd 71 fd d4 4e 06 | 16 b8 f7 81 f8 a1 68 fd 7c 82 cb e1 40 e1 cd b1 | b1 67 80 e0 97 9e c4 df b6 f3 a4 3b 7a a3 3d 86 | ab 0c 7d e6 97 e5 ca 14 02 43 69 d1 2b 6e da f0 | b6 54 c8 f2 d8 ed 68 d8 01 d0 9c a7 4f 96 05 3f | 88 a5 8a af 62 8b ba 42 b2 c3 0b 78 a0 b8 cf 37 | 6a 0b 49 8a 5f 43 e4 67 73 1b 9d f6 91 10 45 f0 | bb 81 70 26 89 00 87 ce dc 65 b8 4a 8b a6 10 3a | 9d c0 a8 b7 93 42 c6 a8 3a 85 e1 1b 64 78 e4 8b | e0 d4 a7 4f 67 54 80 b6 fe 39 92 56 d5 23 4b 51 | e0 1f 42 73 d4 c8 a0 5c b2 73 fd 89 87 7b 0a a0 | f9 71 bb 4f cd 6e 79 08 bf 9e 79 70 c8 a4 09 b9 | 20 22 a1 b7 6b 66 31 cc ff a6 79 52 57 69 a8 48 | 9f a2 a5 25 00 2c 18 19 b2 b7 07 0f 31 94 b3 dd | 9b f2 21 a6 aa bc 1d f6 c1 ed e1 8d 5b e9 3d fc | 27 ef 6c 72 fc 4b 9c 19 45 f2 40 62 00 72 fe e4 | 63 a1 e8 f0 c5 eb e5 c4 1e 8f ec f4 36 5f 9f c9 | 29 bf c6 d4 e8 47 8d 8e 0b b7 2a 99 36 82 fa 53 | 96 bd 00 44 cb d7 ee 76 5f 24 0b c1 cb 48 3d 8d | 38 01 22 8d d8 ec 1d 69 cf 4a 07 f3 ec c9 83 3e | b1 4c fb 91 18 ba 17 5f e7 18 36 a7 ed 19 92 ba | cd 4e c6 c8 50 df 06 e2 d0 7c 5d 95 c2 28 86 47 | 70 60 8d db 3a ea 95 b1 f8 f9 0d f2 80 72 e7 6c | 67 71 e9 7f e8 f3 d1 77 a7 dc 46 18 e8 b1 65 f7 | b6 84 df c8 b6 4b a2 6e 2a ee d2 82 0a 20 9c 28 | 5b d0 1b 23 ac e0 0d 0b c4 19 3a | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #1) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 35 20 23 08 00 00 00 01 00 00 02 17 | 00 00 01 fb 00 03 00 05 08 fc 08 95 79 58 61 6c | 46 de f5 cf 21 1a d5 b6 ce 47 9a d6 f0 24 34 9d | a1 cd 52 a4 55 c3 3b fc 3b 75 9a 8c 5b 7b 1e 8d | 85 4c a0 c6 b0 d0 63 b4 dd 46 6e 0c a2 90 f3 b4 | be 54 39 45 1e 66 4a 2e bf 18 1c 2c 27 d4 1b cc | 9c d9 0c f4 a4 62 64 46 c7 0b 78 32 be b8 3b d9 | 9e ef ca fb ba 85 ac f1 64 94 0d 26 15 39 74 ce | 4b 77 ba 76 6e db 57 19 7b a3 fb 25 d6 03 ed 1a | 25 16 1a a0 ad 21 8f d0 af 7f 42 73 09 ff de b2 | cb 69 ce ab 6f 3a 11 f2 d2 e7 27 7f e3 da 2b 19 | c4 66 30 fa 0b 4d de 48 90 db 14 71 a2 61 22 fb | 21 c9 34 25 4a 30 0b 81 d3 ec af 9c 1c 34 cc b2 | 48 49 c9 6c 32 58 c6 67 23 df 3f 54 5a 4e fd dc | fe 4d af e0 ba 81 3a a5 d7 d2 7e 4b fd 68 ad 33 | 8c 7e ad c8 ad 4b 8f 08 7b 3e aa 33 a8 3f 53 6e | 89 96 34 df dc 92 03 d2 0f 1b 19 f1 dc c2 95 68 | b1 9e c9 a3 c9 7e dc 66 6a c5 6e 90 71 90 52 55 | 47 41 0b f4 63 ac e0 5c 23 b3 d5 4e f1 d5 0d d7 | e3 b0 05 66 69 12 d2 e7 59 40 8f a1 8b 93 88 27 | ef 95 df c6 47 af 6d fa f1 8e 27 30 99 60 b7 ee | 64 82 c0 bd fe f8 0c 0b 5a 92 a4 c0 0e fd c9 ed | 61 86 35 6b 2f 1a 7b 1c d3 e2 60 62 ae 84 7f 48 | ec 85 8e d7 56 6a a3 b6 99 83 2a 1d e4 54 4e bf | 47 93 20 67 64 5d 79 72 29 e5 ad f7 da 98 1d b6 | f1 bc 22 9d 2a a5 e9 de b1 0b 8a 90 dc f7 21 14 | db a0 29 cb f3 93 ec 63 a2 89 8a 31 24 02 77 8c | 68 21 83 46 63 cc 2a 9d e0 f4 8e 18 86 3b 3f 7e | 8f bb 59 f2 21 38 c5 96 33 53 85 f8 90 f8 b2 92 | f3 a5 d5 4b 04 67 18 38 18 03 50 b4 c2 3d 0b de | ae 59 30 6b ed 6e 1e aa 6e 35 dd 30 9e 9e b7 60 | 13 00 91 c8 a5 88 db bc da 25 41 05 58 4e dd 97 | 91 44 da cb bf e3 53 4b bf 4f e0 | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #1) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 35 20 23 08 00 00 00 01 00 00 02 17 | 00 00 01 fb 00 04 00 05 f5 3e fa 3b 40 11 04 0d | 9f a0 b1 6b 14 a5 34 ef 7d cb 20 62 34 ca 41 8f | a3 4d 1f ac 42 39 01 21 67 6f f0 e4 dd 23 33 e0 | c9 e6 88 14 92 b6 95 23 57 da d6 76 fe 2d 7d 94 | 07 6c 4c 35 fa 10 20 a8 ec 28 0a 40 7b 17 8f 7c | b7 27 7c 34 8b 63 04 e1 76 31 d9 c4 e0 83 c2 e4 | 8d a7 79 cb 45 eb aa b2 26 72 cb 10 d2 c2 87 e9 | 5e b2 b2 43 68 9a 58 4d 2f 22 53 28 dd ab 56 6e | f2 bf 22 dc 6d 83 7b 5a a3 4e 99 cb d8 fb 2e 6a | 46 bb 27 bf f6 0b d2 2f 8f 4c 7d bf c7 22 c0 bd | 32 a5 84 d1 b7 48 94 75 35 d0 5a b1 2d 0e f3 bf | 39 c5 f9 c5 e1 48 5c 45 c3 74 d8 ea f7 20 41 79 | f2 23 36 a5 30 ad 68 f2 78 fc a7 ae 2a 55 e0 42 | f2 24 8a f4 bf 10 c0 9d 34 3d 6c 78 93 98 e3 71 | a2 d1 60 be d4 ec dd 11 d6 03 cb 84 d8 3e 0e 26 | 71 5e 6c a1 67 58 cd 4c a5 c5 19 2e c5 7c e2 66 | b3 33 1d df ad 86 ac 47 ac a0 9f 28 39 91 79 3d | aa 5e f3 a2 f1 00 4a 94 ef 0c be 5a 01 86 87 6c | 87 d3 98 c7 62 73 03 bc 24 dd 80 bc 8a 68 6c 13 | 7b 61 af 9f 7d 2c 04 9f 8b 0a e7 1e 43 1f 0c 01 | 0b 71 64 0d 8d 21 cd a2 f4 4c 34 95 99 81 53 bd | 24 7a 71 70 69 25 f3 d4 e8 a6 a2 bb d4 9d 97 5a | a5 71 6f 91 29 1e f5 ff 1d 75 fc f6 86 40 52 ad | 04 3b f3 9b b3 b3 54 98 8e e9 7a 84 9e 3c 5c 9b | 5f f2 51 7f 26 ab 75 25 ce a5 c7 b1 1b 00 79 c7 | 1c 78 97 6c 71 31 6f 69 90 57 35 f7 9c 70 90 8e | de 6f 2c 31 c0 5c 09 41 c3 80 d0 42 68 af 45 bc | 6a 5f 6d 24 63 0b 43 f8 84 bd b5 ff ed dc 08 6c | a7 52 82 44 7a ee 71 cb db 3f 70 bd 38 bc d7 d7 | 31 f4 5e 6a 18 08 f6 bc 49 b6 da eb 68 c8 d2 5a | 60 7c 85 70 4d 89 df f5 6b 69 34 87 c5 5b 0e a2 | 21 2d a0 d6 a2 5b 53 8a d3 5f e3 | sending 422 bytes for STATE_PARENT_I1 through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #1) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 35 20 23 08 00 00 00 01 00 00 01 a2 | 00 00 01 86 00 05 00 05 1d 1b 5a 5f 08 ed d9 0b | c5 24 1f c0 9c 73 67 62 46 4c a7 6c 34 e1 45 d5 | 4d e3 dd 3d 18 58 97 d7 54 05 f9 c5 24 56 3b fd | 3d 08 dd 24 63 74 ea 02 74 be a9 ac 8c 61 19 81 | 9a 02 7d 21 7a 49 f1 59 e8 49 89 4d 22 3a 17 fe | fb 32 a9 50 fe ed ce 0e d1 b3 d4 18 ea dc 78 a6 | 4b 63 58 64 82 c2 64 1b 97 b5 8d 88 21 f8 68 e2 | 51 a4 7d 3d bf 01 ba 2f e3 82 be 27 6b bc 77 5d | 86 03 52 72 78 19 13 27 c2 60 4f 13 9a 9e 29 b1 | d1 97 d3 3a 25 c6 86 99 b6 7a 48 40 ee 6e 79 47 | c4 25 05 43 f9 e6 86 34 87 be fa 13 bd 0e a9 90 | 76 4e c5 03 e0 61 49 d7 c8 7b de 59 20 00 d6 2f | bb 1f aa 7d 9f 96 2a 5e 2a 83 cd 08 c0 2d af 94 | f6 f1 be e8 3d 69 ac 7e 7b 81 2b 6f 3d cc 37 3c | 3f 66 89 23 77 71 3e 38 e1 f0 69 d0 eb 9d e9 3c | ab d4 35 cc b1 a5 83 1d ba 17 ab 2d 37 b5 29 1d | 29 a0 24 6d 66 14 1c df 0f 2a 5c aa b2 1d fc eb | 16 bb b7 0c 34 be b1 5f 3c 42 53 96 b6 14 d6 73 | 6c b9 9f db 72 65 9f 34 02 73 4c b9 09 6f 38 bc | 08 3e 51 16 e7 4d 67 21 d1 17 10 08 9d c7 07 70 | 18 8c b5 4b 66 25 14 10 cc 19 bf 39 d4 eb 4d f8 | 5c 9b 3f 45 f4 85 69 36 4a 4d f8 7b 7b 4a 33 84 | 70 62 9a a0 14 07 3b 8e 69 fb 78 a3 86 88 99 7b | 75 e5 da ce 0c de ad 43 c2 93 54 9c dd 33 a3 0a | 99 c9 df 15 32 2a | sent 5 fragments | success_v2_state_transition scheduling EVENT_RETRANSMIT of c->r_interval=500ms | event_schedule: new EVENT_RETRANSMIT-pe@0x7f5a24002b78 | inserting event EVENT_RETRANSMIT, timeout in 0.5 seconds for #2 | libevent_malloc: new ptr-libevent@0x55954d53b868 size 128 | #2 STATE_PARENT_I2: retransmits: first event in 0.5 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29670.922143 | resume sending helper answer for #1 suppresed complete_v2_state_transition() | #1 spent 6.74 milliseconds in resume sending helper answer | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f5a1c000f48 | spent 0.00308 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 535 bytes from 192.1.2.23:4500 on eth1 (192.1.3.33:4500) | f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b 09 6c 01 0e | 35 20 23 20 00 00 00 01 00 00 02 17 24 00 01 fb | 00 01 00 05 1a fa d1 fe e3 30 4e 01 b5 f7 32 43 | 01 18 e2 b9 0e b0 57 a8 e6 14 8b cd af 66 f3 6c | ea 5a 52 cc e5 f4 12 53 96 c7 94 c3 53 ab 3b 61 | 2b 8b 86 78 79 f5 7b 0c 09 1f 0a 64 09 58 11 3f | d4 9c 24 94 2b c2 4d b2 a1 20 1e 32 a1 fe 32 89 | ef 51 f3 29 03 ec 85 cd 19 4e 75 67 db 38 90 6a | 0a 4e f5 42 6f ce 15 40 33 10 16 da e3 c3 3c 9a | 05 b8 8e 38 55 73 11 aa 10 cd 70 7e 25 32 5f 54 | 53 74 bc cb b6 7e c0 5c 62 17 b8 88 41 7c f0 4b | 40 0d fd e8 1e f9 1d 58 0c c4 32 f1 c6 f6 28 cf | cf 14 6e 36 91 7c 9e 90 52 ac d6 dc db 93 9b 55 | 1c 68 a9 aa b0 98 7d 07 89 c6 d2 c3 ac ee b7 84 | 00 f8 b7 8e 6d 6b bd 8d fa 62 1b 9f 1a 55 3c ef | 9f 78 29 c5 bb 59 68 a6 07 64 50 a5 4d 3b 4e 2d | 15 04 b4 ff df 71 70 d0 4d 05 02 db 36 fe a5 c1 | 01 31 bb a2 42 13 27 18 81 1b 17 55 47 99 cc be | 32 f7 0a 5d 97 f6 03 01 04 06 39 40 f9 28 3c e0 | 14 fa 1b 74 d5 84 53 35 6e d9 65 c0 a9 5f 45 8d | 63 d6 61 76 6f 43 ba 7b a4 90 eb 57 2a 70 e3 0f | 0c d6 6d ca c1 a6 32 e2 38 85 fa 22 ab 5c c0 03 | f5 9e 4c a9 13 50 18 fc 04 f7 4a aa 84 a1 63 fc | 31 f1 bf 18 73 99 e5 2a 07 1e e8 e9 57 43 06 f9 | 98 41 b0 98 f5 fb 0c 3e f9 6c 22 e8 6d df 41 59 | 5e e9 e0 61 98 e3 d1 60 7b b5 ac f2 07 51 ce ae | 18 e5 d0 b7 23 0f 74 44 b1 e3 e2 7e 72 d2 48 75 | 61 8c 0d f2 e3 d4 49 f6 e9 31 a2 b0 9b f3 5b ef | 0a 31 a3 64 ed 63 dd f1 dc 3d 85 03 23 fd 23 ba | 0f 2e 95 81 37 83 c4 ae 04 0b bb a8 89 2e 8a d6 | 0a 24 2c c5 25 4e 39 08 1c f0 ff 1e 46 be 6b de | 53 dd 31 29 34 a9 d9 eb 98 b6 16 27 59 90 cc a2 | 94 59 c1 6e 39 f5 b0 11 f2 64 f0 7f e7 00 72 c4 | b5 a5 fa e8 40 13 88 | start processing: from 192.1.2.23:4500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (0x1) | length: 535 (0x217) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | State DB: found IKEv2 state #2 in PARENT_I2 (find_v2_sa_by_initiator_wip) | suspend processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | #2 is idle | #2 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 507 (0x1fb) | fragment number: 1 (0x1) | total fragments: 5 (0x5) | processing payload: ISAKMP_NEXT_v2SKF (len=499) | #2 in state PARENT_I2: sent v2I2, expected v2R2 | received IKE encrypted fragment number '1', total number '5', next payload '36' | updated IKE fragment state to respond using fragments without waiting for re-transmits | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.106 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:4500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.114 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00106 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 535 bytes from 192.1.2.23:4500 on eth1 (192.1.3.33:4500) | f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b 09 6c 01 0e | 35 20 23 20 00 00 00 01 00 00 02 17 00 00 01 fb | 00 02 00 05 55 01 a9 c7 64 d4 b5 9c 9b f4 52 65 | 1c 69 65 8b 64 c7 51 1e dd b0 09 da b2 42 0e 84 | ee c4 a0 8c 9a ec 2f e2 98 fc 85 c0 b6 4a a4 9b | 1a 1d 6c 0a c7 de 03 fa bf 14 ea a3 2c d3 59 ef | 25 56 1b 82 45 ed 2b 8f 74 e9 98 72 98 97 ac a5 | be 55 29 7d ca ae 7d 2f 77 0b ee ae ed 8f 16 46 | dd 1a 4f cc f4 9b f0 20 19 79 46 f6 14 37 c2 cd | 4f 85 13 f0 b6 ff 49 c6 61 5e be 75 fa 43 ad 97 | 22 85 96 77 65 d7 c5 61 e6 84 03 dc 07 b5 64 7d | dc 9e dc 96 61 96 e6 08 fa 1f 2a ef 69 24 88 b1 | e8 f5 4d 59 a5 0a c5 77 f3 66 a4 a1 8e 99 ef 6f | 99 86 6b ea da 17 51 ab 4b 72 03 2f 22 7b 04 6a | 44 eb 61 72 35 a5 58 88 49 2e 2f b9 41 8c cb 1c | f5 9b 40 59 3d 3e d5 2f 31 5f 3b ad 39 11 5e e5 | 64 fa 27 c1 34 de b8 2d c2 83 ff 1a 06 e7 47 d2 | 43 96 49 3c 7c 13 7c b6 e1 e4 60 84 86 f1 24 72 | d3 56 ad 5f 82 4a b6 ee bb 24 00 f7 d0 95 42 71 | bb 97 1e ca c3 47 37 03 3e df 32 31 a7 70 85 5d | 70 63 73 cb d8 bb 08 f0 b8 ba 4d 72 0d 68 83 ab | 07 50 6e dc 9d ce 34 04 9d 4a 0e 54 76 51 fb 9a | 76 d7 f9 c9 e4 0d 00 2e 3c 8d ea 35 8b 65 00 8d | bc 67 04 66 73 8a 71 49 56 f5 b8 a9 fb 18 d6 03 | ef 42 7e fc 92 92 7e 3b 76 e1 15 f2 a6 36 fa ae | 4b d6 59 ee f6 2a 9d 61 b0 81 15 8c 1f 77 68 0e | 26 32 1d 29 dc 52 92 54 32 07 86 0d eb f3 00 71 | 9e a2 ef 83 ac a8 03 96 59 28 ea a2 09 e2 5d 49 | 82 cd 80 8e bb 44 5f 3d c3 df d9 be 5a 42 6c 0a | 7b ad f5 17 d0 b4 8a 96 d8 50 65 48 47 26 33 3f | 41 11 e4 96 c9 9b 2d 6f cc 06 d9 5f ae 3c 28 bd | cb 4b 6d c4 21 a3 89 84 ea 30 b1 b2 fc 35 e9 6c | 46 48 0a eb 66 0a b5 a3 63 84 a0 6b fe c7 7c 4c | 4d ea cf f1 d0 55 a0 | start processing: from 192.1.2.23:4500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (0x1) | length: 535 (0x217) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | State DB: found IKEv2 state #2 in PARENT_I2 (find_v2_sa_by_initiator_wip) | suspend processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | #2 is idle | #2 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 507 (0x1fb) | fragment number: 2 (0x2) | total fragments: 5 (0x5) | processing payload: ISAKMP_NEXT_v2SKF (len=499) | #2 in state PARENT_I2: sent v2I2, expected v2R2 | received IKE encrypted fragment number '2', total number '5', next payload '0' | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.0891 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:4500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.0957 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00103 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 535 bytes from 192.1.2.23:4500 on eth1 (192.1.3.33:4500) | f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b 09 6c 01 0e | 35 20 23 20 00 00 00 01 00 00 02 17 00 00 01 fb | 00 03 00 05 76 27 98 91 fd 07 78 02 02 2b 3c 83 | ab 3d 2c 2e 78 a2 ae 99 43 b9 ea a6 44 b5 44 9b | 7b 6a 18 88 8f 9c 1e e3 bd 0c d9 f9 18 a7 d9 6b | 29 a6 1c e6 d5 b8 f5 c4 63 39 bb 31 3f 38 e3 4c | 83 05 ee 19 46 36 c3 74 33 db e0 4b 0d aa 9b 91 | dc 89 93 57 27 2b 7e 18 9e 96 b8 d1 7d 7c b4 7f | fb 17 81 3a fa 33 33 a6 84 a4 5c c3 09 3d 0b 04 | b2 34 f6 6c f8 7e 24 00 26 9d 28 bc bf 30 9b 59 | c4 72 04 cd f8 55 14 84 00 7e 50 3a ab 58 13 fb | 05 ae 45 2a 0c 2d 9b 4a ae 2c 91 45 4c 1c 0f 36 | 44 54 51 dd bb 0b 02 4b 03 ab 62 5c 80 a7 c5 12 | df 0d 42 22 ef 32 97 f1 38 9e 24 e1 34 32 d5 6e | f4 11 c3 ed 34 8d 34 6b f4 e6 8f b7 98 54 2f 56 | 1c 42 9e a6 4d f5 a4 35 fa 21 e7 0c 8c 29 46 76 | a7 74 94 52 4c bf 31 c3 ab 16 46 4b 5c 58 fa 1b | e5 d0 af 0b 9e 78 e1 3f 45 1c 22 84 46 6b ea f0 | 23 48 a4 4a 7c 41 4a 76 ab 16 a3 31 4e d3 1b 80 | 8e 50 c0 f1 32 e0 91 ab 3e b4 9a 98 57 69 0c b9 | c6 f2 21 3e d7 1f 5c 99 fe 84 43 78 22 0d a7 b6 | e6 0b 7f 4b 7c 6b 4e d9 60 25 85 aa 26 22 22 7e | d5 b4 bf 5e 7a 61 45 e5 db 7a 5a 8c f8 a7 6b 21 | 27 51 17 45 bc 8f 89 28 af 4f d4 a7 c6 db e5 48 | a9 11 dd 54 1b 18 13 30 1a fd f9 8f 7c 7b 19 9b | 08 7b af 25 16 7b e7 20 01 80 91 d4 d8 11 d7 17 | ea 06 15 c0 63 b8 4a 7f 16 93 24 e6 46 04 bc b8 | fb 7f 48 58 81 aa 56 48 24 a8 d8 96 f3 43 d1 b2 | 34 12 d8 a5 45 fe c4 fe eb 77 d1 d9 6c 43 36 ac | ba d9 c5 42 10 0e 1a 26 18 f5 2f b7 9d 34 b1 1a | 29 2c d0 c2 bb bb a2 50 79 1b 3e 47 a7 43 ee fd | c1 48 21 dd 68 41 e6 13 e3 30 a2 ac 7c c8 de 8e | e8 14 b2 fa 0f b1 98 26 5d aa 7e 94 21 bf bf 1a | 10 8a 5d 29 ef ea ba | start processing: from 192.1.2.23:4500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (0x1) | length: 535 (0x217) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | State DB: found IKEv2 state #2 in PARENT_I2 (find_v2_sa_by_initiator_wip) | suspend processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | #2 is idle | #2 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 507 (0x1fb) | fragment number: 3 (0x3) | total fragments: 5 (0x5) | processing payload: ISAKMP_NEXT_v2SKF (len=499) | #2 in state PARENT_I2: sent v2I2, expected v2R2 | received IKE encrypted fragment number '3', total number '5', next payload '0' | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.0866 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:4500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.0931 milliseconds in comm_handle_cb() reading and processing packet | spent 0.000985 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 535 bytes from 192.1.2.23:4500 on eth1 (192.1.3.33:4500) | f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b 09 6c 01 0e | 35 20 23 20 00 00 00 01 00 00 02 17 00 00 01 fb | 00 04 00 05 63 82 38 9d d1 fc 78 a9 70 ab a0 23 | ec 6d 9c 8d 2d 86 cb 7e f9 07 0a 31 ce b1 85 0b | b7 8c 51 47 6c 4e 58 8f 36 13 80 01 43 83 62 ad | 84 ec 85 a4 2e f9 36 5f 15 a9 12 fe 6a a6 bb 28 | 64 a6 49 0d 3e 98 0b a8 93 58 2e 51 7d f9 88 75 | b5 4a 0a 39 50 53 f6 d2 1e 18 15 d5 34 e3 75 d9 | e8 c6 dc 10 bd 3b c9 a1 13 12 05 31 b9 d9 59 1d | ff ee 97 7e 6c 6b 2b 90 a4 84 8b f7 21 a8 e3 47 | 33 51 5e b3 2b 8a dd e0 4d da 7b 66 68 ef 88 ef | de ce d0 1f ca 10 c4 64 75 b7 2c 4e 14 5a b3 ae | 49 aa 7b 28 97 14 42 55 91 5c 3a a3 3f d8 01 e5 | 3e 09 40 7f 76 f7 e9 70 8d 98 b7 73 68 de 15 91 | 21 f2 39 e6 ad d8 67 06 19 8a 1f d3 6a de 3d 8b | a9 52 84 d0 1e a7 79 87 19 f9 d1 28 1c 0a a6 43 | 67 1f be 46 cb a5 4e d5 89 9d aa 09 1f 04 85 2e | cb 26 25 d9 40 d3 ab a1 c6 01 28 28 04 78 02 e6 | 27 f1 d0 2b 38 b2 43 03 9f 4e 91 72 4e 59 c7 fc | d4 c3 b5 a8 f7 09 64 e9 1d 70 da 6b 15 26 6b d6 | f4 c3 0b ee 86 ed 5c 2a 54 7b e3 6b 26 b8 bf b5 | 45 a6 cd d0 5e 26 a7 4d 58 be 57 15 d4 a2 30 af | 8f ec ee 89 b9 fc 3a cb c8 78 77 cb f2 16 cc 4c | 85 a9 8b ad ce 71 c5 ee dc 8c a4 b3 28 2f 8e fa | 98 76 6b 2d 84 8b c4 81 92 a3 ac 5a c3 f8 4d 35 | a1 4c 84 61 4d ca 60 5b c7 20 79 27 19 a5 8e 2f | 29 a9 9c eb 68 7d c1 e2 26 ef 65 8a f9 6a a5 de | ea 93 bd 9b d2 68 84 fc 2a 8a e4 ee d8 b0 be b2 | 95 3f 75 64 fa f5 a3 20 4b 56 89 b3 49 07 e0 3b | d1 32 d2 0e 32 82 a0 da 7f 45 c3 5d 7c e9 ae c8 | 3f 62 95 d8 9a 93 ef c4 75 ee 83 94 4b 26 25 0b | e2 24 24 31 84 0d 36 00 c6 9a 1c 99 f6 5e 30 eb | 68 3e 94 5b 4a b4 c7 06 64 6c b9 e8 eb 59 9d 6d | bd a2 e6 5b f6 38 16 | start processing: from 192.1.2.23:4500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (0x1) | length: 535 (0x217) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | State DB: found IKEv2 state #2 in PARENT_I2 (find_v2_sa_by_initiator_wip) | suspend processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | #2 is idle | #2 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 507 (0x1fb) | fragment number: 4 (0x4) | total fragments: 5 (0x5) | processing payload: ISAKMP_NEXT_v2SKF (len=499) | #2 in state PARENT_I2: sent v2I2, expected v2R2 | received IKE encrypted fragment number '4', total number '5', next payload '0' | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.0861 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:4500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.0924 milliseconds in comm_handle_cb() reading and processing packet | spent 0.000992 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 113 bytes from 192.1.2.23:4500 on eth1 (192.1.3.33:4500) | f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b 09 6c 01 0e | 35 20 23 20 00 00 00 01 00 00 00 71 00 00 00 55 | 00 05 00 05 ee 8f e2 76 f8 09 fc 86 6b 72 6a e1 | a0 2d c3 34 1e c1 0e 90 aa b1 35 9b 18 79 a8 08 | 77 cb 49 fa df c6 44 6a fd f0 f0 7f 11 c9 20 8f | ec be b5 63 df 15 99 4e 07 61 ec ff 53 98 a8 a3 | 2d 14 6d 01 79 4b 7e 7f 3c 85 f5 d7 b9 0a b6 dd | fd | start processing: from 192.1.2.23:4500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (0x1) | length: 113 (0x71) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | State DB: found IKEv2 state #2 in PARENT_I2 (find_v2_sa_by_initiator_wip) | suspend processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | #2 is idle | #2 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 85 (0x55) | fragment number: 5 (0x5) | total fragments: 5 (0x5) | processing payload: ISAKMP_NEXT_v2SKF (len=77) | #2 in state PARENT_I2: sent v2I2, expected v2R2 | received IKE encrypted fragment number '5', total number '5', next payload '0' | #2 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2CERT (0x25) | flags: none (0x0) | length: 191 (0xbf) | ID type: ID_DER_ASN1_DN (0x9) | processing payload: ISAKMP_NEXT_v2IDr (len=183) | Now let's proceed with payload (ISAKMP_NEXT_v2CERT) | **parse IKEv2 Certificate Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 1265 (0x4f1) | ikev2 cert encoding: CERT_X509_SIGNATURE (0x4) | processing payload: ISAKMP_NEXT_v2CERT (len=1260) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2CP (0x2f) | flags: none (0x0) | length: 392 (0x188) | auth method: IKEv2_AUTH_RSA (0x1) | processing payload: ISAKMP_NEXT_v2AUTH (len=384) | Now let's proceed with payload (ISAKMP_NEXT_v2CP) | **parse IKEv2 Configuration Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 16 (0x10) | ikev2_cfg_type: IKEv2_CP_CFG_REPLY (0x2) | processing payload: ISAKMP_NEXT_v2CP (len=8) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 36 (0x24) | processing payload: ISAKMP_NEXT_v2SA (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (0x18) | number of TS: 1 (0x1) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (0x18) | number of TS: 1 (0x1) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Initiator: process IKE_AUTH response | Now let's proceed with state specific processing | calling processor Initiator: process IKE_AUTH response | global one-shot timer EVENT_FREE_ROOT_CERTS scheduled in 300 seconds loading root certificate cache | spent 2.78 milliseconds in get_root_certs() calling PK11_ListCertsInSlot() | spent 0.0141 milliseconds in get_root_certs() filtering CAs | #1 spent 2.82 milliseconds in find_and_verify_certs() calling get_root_certs() | checking for known CERT payloads | saving certificate of type 'X509_SIGNATURE' | decoded cert: E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | #1 spent 0.0311 milliseconds in find_and_verify_certs() calling decode_cert_payloads() | cert_issuer_has_current_crl: looking for a CRL issued by E=testing@libreswan.org,CN=Libreswan test CA for mainca,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | #1 spent 0.03 milliseconds in find_and_verify_certs() calling crl_update_check() | missing or expired CRL | crl_strict: 0, ocsp: 0, ocsp_strict: 0, ocsp_post: 0 | verify_end_cert trying profile IPsec | certificate is valid (profile IPsec) | #1 spent 0.0852 milliseconds in find_and_verify_certs() calling verify_end_cert() "north-east-x509-ipv4"[1] 192.1.2.23 #2: certificate verified OK: E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d556568 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d5563b8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d556208 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d548da8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55954d548d58 | unreference key: 0x55954d55aa18 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 1-- | #1 spent 0.239 milliseconds in decode_certs() calling add_pubkey_from_nss_cert() | #1 spent 3.23 milliseconds in decode_certs() | DER ASN1 DN: 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | DER ASN1 DN: 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | DER ASN1 DN: 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | DER ASN1 DN: 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | DER ASN1 DN: 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | DER ASN1 DN: 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | DER ASN1 DN: 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 65 61 73 | DER ASN1 DN: 74 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | DER ASN1 DN: 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a 86 48 | DER ASN1 DN: 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 65 61 73 | DER ASN1 DN: 74 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | DER ASN1 DN: 77 61 6e 2e 6f 72 67 | ID_DER_ASN1_DN 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' needs further ID comparison against 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | ID_DER_ASN1_DN 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' matched our ID | X509: CERT and ID matches current connection | offered CA: 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' "north-east-x509-ipv4"[1] 192.1.2.23 #2: IKEv2 mode peer ID is ID_DER_ASN1_DN: 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | verifying AUTH payload | required RSA CA is 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | checking RSA keyid 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' for match with 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | key issuer CA is 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | an RSA Sig check passed with *AwEAAbEef [remote certificates] | #1 spent 0.125 milliseconds in try_all_RSA_keys() trying a pubkey "north-east-x509-ipv4"[1] 192.1.2.23 #2: Authenticated using RSA | #1 spent 0.158 milliseconds in ikev2_verify_rsa_hash() | parent state #1: PARENT_I2(open IKE SA) => PARENT_I3(established IKE SA) | #1 will start re-keying in 2607 seconds with margin of 993 seconds (attempting re-key) | state #1 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x7f5a24002888 | free_event_entry: release EVENT_SA_REPLACE-pe@0x55954d537d58 | event_schedule: new EVENT_SA_REKEY-pe@0x55954d537d58 | inserting event EVENT_SA_REKEY, timeout in 2607 seconds for #1 | libevent_malloc: new ptr-libevent@0x55954d55e2c8 size 128 | pstats #1 ikev2.ike established | FOR_EACH_STATE_... in nat_traversal_ka_event (for_each_state) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1575) | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | resume processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | suspend processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1575) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1575) | NAT-T: keepalive packet not required as recent DPD event used the IKE SA on conn north-east-x509-ipv4 | stop processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | resume processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | global one-shot timer EVENT_NAT_T_KEEPALIVE scheduled in 20 seconds | libevent_realloc: release ptr-libevent@0x55954d4c7158 | libevent_realloc: new ptr-libevent@0x55954d5428c8 size 128 | #2 north-east-x509-ipv4[1] parsing ISAKMP_NEXT_v2CP payload | ***parse IKEv2 Configuration Payload Attribute: | Attribute Type: IKEv2_INTERNAL_IP4_ADDRESS (0x1) | length/value: 4 (0x4) | parsing 4 raw bytes of IKEv2 Configuration Payload Attribute into INTERNAL_IP_ADDRESS | INTERNAL_IP_ADDRESS c0 00 02 64 "north-east-x509-ipv4"[1] 192.1.2.23 #2: received INTERNAL_IP4_ADDRESS 192.0.2.100 | setting host source IP address to 192.0.2.100 | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: 0 (0x0) | length: 16 (0x10) | start port: 0 (0x0) | end port: 65535 (0xffff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low c0 00 02 64 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high c0 00 02 64 | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: 0 (0x0) | length: 16 (0x10) | start port: 0 (0x0) | end port: 65535 (0xffff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low 00 00 00 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high ff ff ff ff | TSr: parsed 1 traffic selectors | evaluating our conn="north-east-x509-ipv4"[1] 192.1.2.23 I=192.0.2.100/32:0/0 R=0.0.0.0/0:0/0 to their: | TSi[0] .net=192.0.2.100-192.0.2.100 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.100/32 >= TSi[0]net=192.0.2.100-192.0.2.100: YES fitness 32 | narrow port end=0..65535 >= TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 >= TSi[0]=*0: 0 | match end->protocol=*0 >= TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=0.0.0.0-255.255.255.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=0.0.0.0/0 >= TSr[0]net=0.0.0.0-255.255.255.255: YES fitness 32 | narrow port end=0..65535 >= TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 >= TSr[0]=*0: 0 | match end->protocol=*0 >= TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found an acceptable TSi/TSr Traffic Selector | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV6_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.100-192.0.2.100 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV6_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 0.0.0.0-255.255.255.255 | using existing local ESP/AH proposals for north-east-x509-ipv4 (IKE_AUTH initiator accepting remote ESP/AH proposal): 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED | Comparing remote proposals against IKE_AUTH initiator accepting remote ESP/AH proposal 4 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+ESN; optional: INTEG+DH | local proposal 2 type ENCR has 1 transforms | local proposal 2 type PRF has 0 transforms | local proposal 2 type INTEG has 1 transforms | local proposal 2 type DH has 1 transforms | local proposal 2 type ESN has 1 transforms | local proposal 2 transforms: required: ENCR+ESN; optional: INTEG+DH | local proposal 3 type ENCR has 1 transforms | local proposal 3 type PRF has 0 transforms | local proposal 3 type INTEG has 2 transforms | local proposal 3 type DH has 1 transforms | local proposal 3 type ESN has 1 transforms | local proposal 3 transforms: required: ENCR+INTEG+ESN; optional: DH | local proposal 4 type ENCR has 1 transforms | local proposal 4 type PRF has 0 transforms | local proposal 4 type INTEG has 2 transforms | local proposal 4 type DH has 1 transforms | local proposal 4 type ESN has 1 transforms | local proposal 4 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 32 (0x20) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 2 (0x2) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI a4 c6 0d d3 | Comparing remote proposal 1 containing 2 transforms against local proposal [1..1] of 4 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (0xc) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | remote proposal 1 transform 0 (ENCR=AES_GCM_C_256) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (0x8) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 1 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+ESN; matched: ENCR+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+ESN transforms to local proposal 1; required: ENCR+ESN; optional: INTEG+DH; matched: ENCR+ESN | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:ESP:ENCR=AES_GCM_C_256;ESN=DISABLED[first-match] | IKE_AUTH initiator accepting remote ESP/AH proposal ikev2_proposal: 1:ESP:SPI=a4c60dd3;ENCR=AES_GCM_C_256;ESN=DISABLED | converting proposal to internal trans attrs | integ=none: .key_size=0 encrypt=aes_gcm_16: .key_size=32 .salt_size=4 keymat_len=36 | install_ipsec_sa() for #2: inbound and outbound | could_route called for north-east-x509-ipv4 (kind=CK_INSTANCE) | FOR_EACH_CONNECTION_... in route_owner | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 vs | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 vs | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 | route owner of "north-east-x509-ipv4"[1] 192.1.2.23 unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_GCM_16 keylen: 256 integ: NONE | encrypt AES_GCM_16 keylen=256 transid=20, key_size=32, encryptalg=20 | AES_GCM_16 requires 4 salt bytes | st->st_esp.keymat_len=36 is encrypt_keymat_size=36 + integ_keymat_size=0 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'north-east-x509-ipv4' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.a4c60dd3@192.1.2.23 included non-error error | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_GCM_16 keylen: 256 integ: NONE | encrypt AES_GCM_16 keylen=256 transid=20, key_size=32, encryptalg=20 | AES_GCM_16 requires 4 salt bytes | st->st_esp.keymat_len=36 is encrypt_keymat_size=36 + integ_keymat_size=0 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'north-east-x509-ipv4' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.9d4a90ca@192.1.3.33 included non-error error | priority calculation of connection "north-east-x509-ipv4" is 0xfdfff | add inbound eroute 0.0.0.0/0:0 --0-> 192.0.2.100/32:0 => tun.10000@192.1.3.33 (raw_eroute) | IPsec Sa SPD priority set to 1040383 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #2: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 vs | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 vs | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 | route owner of "north-east-x509-ipv4"[1] 192.1.2.23 unrouted: NULL; eroute owner: NULL | route_and_eroute with c: north-east-x509-ipv4 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #2 | priority calculation of connection "north-east-x509-ipv4" is 0xfdfff | eroute_connection add eroute 192.0.2.100/32:0 --0-> 0.0.0.0/0:0 => tun.0@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1040383 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x509-ipv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0' PLUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+EN | popen cmd is 1452 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x509-ipv: | cmd( 80):4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUT: | cmd( 160):O_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.: | cmd( 240):testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.: | cmd( 320):0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.: | cmd( 400):255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYP: | cmd( 480):E='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Li: | cmd( 560):breswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.: | cmd( 640):libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0' PLU: | cmd( 720):TO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_: | cmd( 800):PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libres: | cmd( 880):wan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDT: | cmd( 960):IME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKEV2_ALLOW_: | cmd(1040):NARROWING+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_INSTANCE' PLUTO: | cmd(1120):_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_MY_SOURCEIP='192.0.2.100' PLUTO_IS_: | cmd(1200):PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNE: | cmd(1280):R='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI_IFACE: | cmd(1360):='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa4c60dd3 SPI_OUT=0x9d4a90ca ipsec : | cmd(1440):_updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x509-ipv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0' PLUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY= | popen cmd is 1457 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x50: | cmd( 80):9-ipv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33': | cmd( 160): PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=n: | cmd( 240):orth.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT=: | cmd( 320):'192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255: | cmd( 400):.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_S: | cmd( 480):A_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto,: | cmd( 560): O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@tes: | cmd( 640):ting.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0: | cmd( 720):' PLUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' P: | cmd( 800):LUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=L: | cmd( 880):ibreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO: | cmd( 960):_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKEV2_A: | cmd(1040):LLOW_NARROWING+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_INSTANCE' : | cmd(1120):PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_MY_SOURCEIP='192.0.2.100' PLUT: | cmd(1200):O_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_: | cmd(1280):BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI_: | cmd(1360):IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa4c60dd3 SPI_OUT=0x9d4a90ca i: | cmd(1440):psec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x509-ipv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0' PLUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSA | popen cmd is 1455 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x509-: | cmd( 80):ipv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' P: | cmd( 160):LUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=nor: | cmd( 240):th.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='1: | cmd( 320):92.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.2: | cmd( 400):55.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_: | cmd( 480):TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O: | cmd( 560):=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testi: | cmd( 640):ng.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0' : | cmd( 720):PLUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLU: | cmd( 800):TO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Lib: | cmd( 880):reswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_A: | cmd( 960):DDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKEV2_ALL: | cmd(1040):OW_NARROWING+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_INSTANCE' PL: | cmd(1120):UTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_MY_SOURCEIP='192.0.2.100' PLUTO_: | cmd(1200):IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BA: | cmd(1280):NNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI_IF: | cmd(1360):ACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa4c60dd3 SPI_OUT=0x9d4a90ca ips: | cmd(1440):ec _updown 2>&1: "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23 #2: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "north-east-x509-ipv4"[1] 192.1.2.23, setting eroute_owner {spd=0x55954d538b48,sr=0x55954d538b48} to #2 (was #0) (newest_ipsec_sa=#0) | #1 spent 1.76 milliseconds in install_ipsec_sa() | inR2: instance north-east-x509-ipv4[1], setting IKEv2 newest_ipsec_sa to #2 (was #0) (spd.eroute=#2) cloned from #1 | state #2 requesting EVENT_RETRANSMIT to be deleted | #2 STATE_PARENT_I2: retransmits: cleared | libevent_free: release ptr-libevent@0x55954d53b868 | free_event_entry: release EVENT_RETRANSMIT-pe@0x7f5a24002b78 | #2 spent 5.76 milliseconds in processing: Initiator: process IKE_AUTH response in ikev2_process_state_packet() | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #2 complete_v2_state_transition() PARENT_I2->V2_IPSEC_I with status STF_OK | IKEv2: transition from state STATE_PARENT_I2 to state STATE_V2_IPSEC_I | child state #2: PARENT_I2(open IKE SA) => V2_IPSEC_I(established CHILD SA) | Message ID: updating counters for #2 to 1 after switching state | Message ID: recv #1.#2 response 1; ike: initiator.sent=1 initiator.recv=0->1 responder.sent=-1 responder.recv=-1; child: wip.initiator=1->-1 wip.responder=-1 | Message ID: #1.#2 skipping update_send as nothing to send; initiator.sent=1 initiator.recv=1 responder.sent=-1 responder.recv=-1 wip.initiator=-1 wip.responder=-1 | pstats #2 ikev2.child established "north-east-x509-ipv4"[1] 192.1.2.23 #2: negotiated connection [192.0.2.100-192.0.2.100:0-65535 0] -> [0.0.0.0-255.255.255.255:0-65535 0] | NAT-T: NAT Traversal detected - their IKE port is '500' | NAT-T: encaps is 'auto' "north-east-x509-ipv4"[1] 192.1.2.23 #2: STATE_V2_IPSEC_I: IPsec SA established tunnel mode {ESP/NAT=>0xa4c60dd3 <0x9d4a90ca xfrm=AES_GCM_16_256-NONE NATOA=none NATD=192.1.2.23:4500 DPD=active} | releasing whack for #2 (sock=fd@25) | close_any(fd@25) (in release_whack() at state.c:654) | releasing whack and unpending for parent #1 | unpending state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 | delete from pending Child SA with 192.1.2.23 "north-east-x509-ipv4"[1] 192.1.2.23 | removing pending policy for no connection {0x55954d52d888} | close_any(fd@24) (in release_whack() at state.c:654) | #2 will start re-keying in 28048 seconds with margin of 752 seconds (attempting re-key) | event_schedule: new EVENT_SA_REKEY-pe@0x7f5a24002b78 | inserting event EVENT_SA_REKEY, timeout in 28048 seconds for #2 | libevent_malloc: new ptr-libevent@0x55954d5485d8 size 128 | dpd enabled, scheduling ikev2 liveness checks | event_schedule: new EVENT_v2_LIVENESS-pe@0x55954d4c7158 | inserting event EVENT_v2_LIVENESS, timeout in 3 seconds for #2 | libevent_malloc: new ptr-libevent@0x55954d54a178 size 128 | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 6.06 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:4500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 6.08 milliseconds in comm_handle_cb() reading and processing packet | kernel_process_msg_cb process netlink message | netlink_get: XFRM_MSG_DELPOLICY message | xfrm netlink address change RTM_NEWADDR msg len 76 | XFRM RTM_NEWADDR 192.0.2.100 IFA_LOCAL | FOR_EACH_STATE_... in record_newaddr (for_each_state) | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1575) | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1575) | stop processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | IKEv2 received address RTM_NEWADDR type 3 | IKEv2 received address RTM_NEWADDR type 8 | IKEv2 received address RTM_NEWADDR type 6 | netlink_get: XFRM_MSG_EXPIRE message | netlink_get: XFRM_MSG_EXPIRE message | netlink_get: XFRM_MSG_EXPIRE message | spent 0.0443 milliseconds in kernel message | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00309 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00191 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.0019 milliseconds in signal handler PLUTO_SIGCHLD | timer_event_cb: processing event@0x55954d4c7158 | handling event EVENT_v2_LIVENESS for child state #2 | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in liveness_check() at timer.c:113) | get_sa_info esp.9d4a90ca@192.1.3.33 | #2 liveness_check - peer 192.1.2.23 is ok schedule new | event_schedule: new EVENT_v2_LIVENESS-pe@0x55954d546148 | inserting event EVENT_v2_LIVENESS, timeout in 3 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f5a1c000f48 size 128 | libevent_free: release ptr-libevent@0x55954d54a178 | free_event_entry: release EVENT_v2_LIVENESS-pe@0x55954d4c7158 | #2 spent 0.211 milliseconds in timer_event_cb() EVENT_v2_LIVENESS | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:557) | timer_event_cb: processing event@0x55954d546148 | handling event EVENT_v2_LIVENESS for child state #2 | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in liveness_check() at timer.c:113) | get_sa_info esp.9d4a90ca@192.1.3.33 | #2 liveness_check - peer 192.1.2.23 is ok schedule new | event_schedule: new EVENT_v2_LIVENESS-pe@0x55954d4c7158 | inserting event EVENT_v2_LIVENESS, timeout in 3 seconds for #2 | libevent_malloc: new ptr-libevent@0x55954d54a178 size 128 | libevent_free: release ptr-libevent@0x7f5a1c000f48 | free_event_entry: release EVENT_v2_LIVENESS-pe@0x55954d546148 | #2 spent 0.0708 milliseconds in timer_event_cb() EVENT_v2_LIVENESS | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:557) | timer_event_cb: processing event@0x55954d4c7158 | handling event EVENT_v2_LIVENESS for child state #2 | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in liveness_check() at timer.c:113) | get_sa_info esp.9d4a90ca@192.1.3.33 | #2 liveness_check - peer 192.1.2.23 is ok schedule new | event_schedule: new EVENT_v2_LIVENESS-pe@0x55954d546148 | inserting event EVENT_v2_LIVENESS, timeout in 3 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f5a1c000f48 size 128 | libevent_free: release ptr-libevent@0x55954d54a178 | free_event_entry: release EVENT_v2_LIVENESS-pe@0x55954d4c7158 | #2 spent 0.0729 milliseconds in timer_event_cb() EVENT_v2_LIVENESS | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:557) | spent 0.00303 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 57 bytes from 192.1.2.23:4500 on eth1 (192.1.3.33:4500) | f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b 09 6c 01 0e | 2e 20 25 00 00 00 00 00 00 00 00 39 00 00 00 1d | de c7 9a fd 3a ba ba a9 87 6c 0a 4c d3 6b 89 6b | ed 62 f9 7c ad a7 4b b0 7b | start processing: from 192.1.2.23:4500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: none (0x0) | Message ID: 0 (0x0) | length: 57 (0x39) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #1 in PARENT_I3 (find_v2_ike_sa) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | [RE]START processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ike_process_packet() at ikev2.c:2064) | #1 st.st_msgid_lastrecv -1 md.hdr.isa_msgid 00000000 | Message ID: #1 not a duplicate - message is new; initiator.sent=1 initiator.recv=1 responder.sent=-1 responder.recv=-1 | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 29 (0x1d) | processing payload: ISAKMP_NEXT_v2SK (len=25) | Message ID: start-responder #1 request 0; ike: initiator.sent=1 initiator.recv=1 responder.sent=-1 responder.recv=-1 wip.initiator=-1 wip.responder=-1->0 | #1 in state PARENT_I3: PARENT SA established | #1 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | selected state microcode I3: Informational Request | Now let's proceed with state specific processing | calling processor I3: Informational Request | an informational request should send a response | MOBIKE request: not updating IPsec SA | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT+ISAKMP_FLAG_v2_MSG_RESPONSE (0x28) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 29 | emitting length of ISAKMP Message: 57 | sending 61 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #1) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 2e 20 25 28 00 00 00 00 00 00 00 39 | 00 00 00 1d 13 65 c4 34 90 fd 8e b6 98 89 b0 db | 26 9a db b4 a2 07 06 9e 6a bf d2 13 ae | Message ID: #1 XXX: in process_encrypted_informational_ikev2() hacking around record'n'send bypassing send queue hacking around delete_my_family(); initiator.sent=1 initiator.recv=1 responder.sent=-1 responder.recv=-1 wip.initiator=-1 wip.responder=0 | Message ID: sent #1 response 0; ike: initiator.sent=1 initiator.recv=1 responder.sent=-1->0 responder.recv=-1 wip.initiator=-1 wip.responder=0 | #1 spent 0.117 milliseconds in processing: I3: Informational Request in ikev2_process_state_packet() | [RE]START processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #1 complete_v2_state_transition() PARENT_I3->PARENT_I3 with status STF_OK | Message ID: updating counters for #1 to 0 after switching state | Message ID: recv #1 request 0; ike: initiator.sent=1 initiator.recv=1 responder.sent=0 responder.recv=-1->0 wip.initiator=-1 wip.responder=0->-1 | Message ID: #1 skipping update_send as nothing to send; initiator.sent=1 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=-1 | STATE_PARENT_I3: PARENT SA established | stop processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.257 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:4500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.27 milliseconds in comm_handle_cb() reading and processing packet | timer_event_cb: processing event@0x55954d546148 | handling event EVENT_v2_LIVENESS for child state #2 | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in liveness_check() at timer.c:113) | get_sa_info esp.9d4a90ca@192.1.3.33 | #2 liveness_check - last_liveness: 29682.93727, now: 29682.981509 parent #1 | Opening output PBS liveness probe informational request | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (0x2) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'liveness probe informational request' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 29 | emitting length of ISAKMP Message: 57 | sending 61 bytes for liveness probe informational request through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #2) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 2e 20 25 08 00 00 00 02 00 00 00 39 | 00 00 00 1d df 59 a4 92 b6 54 cf 7c a8 f1 08 e9 | 64 88 83 28 8b 28 0a 73 4e 21 9b 6a 9c | Message ID: #1.#2 XXX: in ikev2_send_livenss_probe() hacking around record'n'send bypassing send queue; initiator.sent=1 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=-1 | Message ID: sent #1 request 2; ike: initiator.sent=1->2 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=-1->2 wip.responder=-1 | #2 liveness_check - peer 192.1.2.23 is missing - giving them some time to come back | #2 liveness_check - peer 192.1.2.23 is ok schedule new | event_schedule: new EVENT_v2_LIVENESS-pe@0x55954d541e48 | inserting event EVENT_v2_LIVENESS, timeout in 3 seconds for #2 | libevent_malloc: new ptr-libevent@0x55954d53b868 size 128 | libevent_free: release ptr-libevent@0x7f5a1c000f48 | free_event_entry: release EVENT_v2_LIVENESS-pe@0x55954d546148 | #2 spent 0.151 milliseconds in timer_event_cb() EVENT_v2_LIVENESS | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:557) | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_STATE_... in show_traffic_status (sort_states) | FOR_EACH_STATE_... in sort_states | get_sa_info esp.9d4a90ca@192.1.3.33 | get_sa_info esp.a4c60dd3@192.1.2.23 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.276 milliseconds in whack | timer_event_cb: processing event@0x55954d541e48 | handling event EVENT_v2_LIVENESS for child state #2 | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in liveness_check() at timer.c:113) | get_sa_info esp.9d4a90ca@192.1.3.33 | #2 liveness_check - last_liveness: 29682.93727, now: 29685.983861 parent #1 | Opening output PBS liveness probe informational request | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (0x3) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'liveness probe informational request' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 29 | emitting length of ISAKMP Message: 57 | sending 61 bytes for liveness probe informational request through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #2) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 2e 20 25 08 00 00 00 03 00 00 00 39 | 00 00 00 1d 08 26 1e 9a 5a 57 f4 97 07 59 54 5d | fb 38 83 b9 cf b5 08 14 c8 f5 e3 3e 74 ERROR: "north-east-x509-ipv4"[1] 192.1.2.23 #2: sendto on eth1 to 192.1.2.23:4500 failed in liveness probe informational request. Errno 1: Operation not permitted | Message ID: #1.#2 XXX: in ikev2_send_livenss_probe() hacking around record'n'send bypassing send queue; initiator.sent=2 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=-1 | Message ID: #1 XXX: expecting sender.wip.initiator 2 == -1 - suspect record'n'send out-of-order?); initiator.sent=3 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=3 wip.responder=-1 | Message ID: sent #1 request 3; ike: initiator.sent=2->3 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=2->3 wip.responder=-1 | #2 liveness_check - peer 192.1.2.23 is missing - giving them some time to come back | #2 liveness_check - peer 192.1.2.23 is ok schedule new | event_schedule: new EVENT_v2_LIVENESS-pe@0x55954d546148 | inserting event EVENT_v2_LIVENESS, timeout in 3 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f5a1c000f48 size 128 | libevent_free: release ptr-libevent@0x55954d53b868 | free_event_entry: release EVENT_v2_LIVENESS-pe@0x55954d541e48 | #2 spent 0.152 milliseconds in timer_event_cb() EVENT_v2_LIVENESS | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:557) | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | dup_any(fd@16) -> fd@23 (in whack_process() at rcv_whack.c:590) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "north-east-x509-ipv4"[1] 192.1.2.23 (in initiate_a_connection() at initiate.c:186) | connection 'north-east-x509-ipv4' +POLICY_UP | dup_any(fd@23) -> fd@24 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | FOR_EACH_STATE_... in find_pending_phase2 | creating state object #3 at 0x55954d556de8 | State DB: adding IKEv2 state #3 in UNDEFINED | pstats #3 ikev2.child started | duplicating state object #1 "north-east-x509-ipv4"[1] 192.1.2.23 as #3 for IPSEC SA | #3 setting local endpoint to 192.1.3.33:4500 from #1.st_localport (in duplicate_state() at state.c:1484) | Message ID: init_child #1.#3; ike: initiator.sent=3 initiator.recv=1 responder.sent=0 responder.recv=0; child: wip.initiator=0->-1 wip.responder=0->-1 | suspend processing: connection "north-east-x509-ipv4"[1] 192.1.2.23 (in ikev2_initiate_child_sa() at ikev2_parent.c:5637) | start processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_initiate_child_sa() at ikev2_parent.c:5637) | child state #3: UNDEFINED(ignore) => V2_CREATE_I0(established IKE SA) | create child proposal's DH changed from no-PFS to MODP2048, flushing | constructing ESP/AH proposals with default DH MODP2048 for north-east-x509-ipv4 (ESP/AH initiator emitting proposals) | converting proposal AES_GCM_16_256-NONE to ikev2 ... | ... ikev2_proposal: 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=MODP2048;ESN=DISABLED | converting proposal AES_GCM_16_128-NONE to ikev2 ... | ... ikev2_proposal: 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=MODP2048;ESN=DISABLED | converting proposal AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ... | ... ikev2_proposal: 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048;ESN=DISABLED | converting proposal AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ... | ... ikev2_proposal: 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048;ESN=DISABLED "north-east-x509-ipv4"[1] 192.1.2.23: constructed local ESP/AH proposals for north-east-x509-ipv4 (ESP/AH initiator emitting proposals): 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=MODP2048;ESN=DISABLED 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=MODP2048;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048;ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048;ESN=DISABLED | #3 schedule initiate IPsec SA RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKEV2_ALLOW_NARROWING+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO using IKE# 1 pfs=MODP2048 | event_schedule: new EVENT_v2_INITIATE_CHILD-pe@0x55954d541e48 | inserting event EVENT_v2_INITIATE_CHILD, timeout in 0 seconds for #3 | libevent_malloc: new ptr-libevent@0x55954d53b868 size 128 | processing: RESET whack log_fd (was fd@16) (in ikev2_initiate_child_sa() at ikev2_parent.c:5737) | RESET processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in ikev2_initiate_child_sa() at ikev2_parent.c:5737) | RESET processing: connection "north-east-x509-ipv4"[1] 192.1.2.23 (in ikev2_initiate_child_sa() at ikev2_parent.c:5737) | processing: STOP connection NULL (in initiate_a_connection() at initiate.c:349) | close_any(fd@23) (in initiate_connection() at initiate.c:372) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.19 milliseconds in whack | timer_event_cb: processing event@0x55954d541e48 | handling event EVENT_v2_INITIATE_CHILD for child state #3 | start processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | adding Child Initiator KE and nonce ni work-order 3 for state #3 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x55954d5442c8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: new ptr-libevent@0x55954d54a178 size 128 | libevent_free: release ptr-libevent@0x55954d53b868 | free_event_entry: release EVENT_v2_INITIATE_CHILD-pe@0x55954d541e48 | #3 spent 0.0273 milliseconds in timer_event_cb() EVENT_v2_INITIATE_CHILD | crypto helper 4 resuming | stop processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:557) | crypto helper 4 starting work-order 3 for state #3 | crypto helper 4 doing build KE and nonce (Child Initiator KE and nonce ni); request ID 3 | crypto helper 4 finished build KE and nonce (Child Initiator KE and nonce ni); request ID 3 time elapsed 0.000949 seconds | (#3) spent 0.951 milliseconds in crypto helper computing work-order 3: Child Initiator KE and nonce ni (pcr) | crypto helper 4 sending results from work-order 3 for state #3 to event queue | scheduling resume sending helper answer for #3 | libevent_malloc: new ptr-libevent@0x7f5a20002888 size 128 | crypto helper 4 waiting (nothing to do) | processing resume sending helper answer for #3 | start processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 4 replies to request ID 3 | calling continuation function 0x55954d23db50 | ikev2_child_outI_continue for #3 STATE_V2_CREATE_I0 | state #3 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x55954d54a178 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x55954d5442c8 | event_schedule: new EVENT_SA_REPLACE-pe@0x55954d5442c8 | inserting event EVENT_SA_REPLACE, timeout in 200 seconds for #3 | libevent_malloc: new ptr-libevent@0x55954d54a178 size 128 | [RE]START processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #3 complete_v2_state_transition() V2_CREATE_I0->V2_CREATE_I with status STF_SUSPEND | suspending state #3 and saving MD | #3 is busy; has a suspended MD | [RE]START processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in log_stf_suspend() at ikev2.c:3269) | "north-east-x509-ipv4"[1] 192.1.2.23 #3 complete v2 state STATE_V2_CREATE_I0 transition with STF_SUSPEND suspended from complete_v2_state_transition:3451 | resume sending helper answer for #3 suppresed complete_v2_state_transition() | #3 spent 0.0339 milliseconds in resume sending helper answer | stop processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f5a20002888 | timer_event_cb: processing event@0x55954d546148 | handling event EVENT_v2_LIVENESS for child state #2 | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in liveness_check() at timer.c:113) | get_sa_info esp.9d4a90ca@192.1.3.33 | #2 liveness_check - last_liveness: 29682.93727, now: 29688.988709 parent #1 | Opening output PBS liveness probe informational request | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 4 (0x4) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'liveness probe informational request' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 29 | emitting length of ISAKMP Message: 57 | sending 61 bytes for liveness probe informational request through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #2) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 2e 20 25 08 00 00 00 04 00 00 00 39 | 00 00 00 1d 4d a9 96 13 7f 7a 23 9b cf e4 ac 4a | 2c f5 b1 3b bc 46 a9 0d 60 e6 9e 01 2b ERROR: "north-east-x509-ipv4"[1] 192.1.2.23 #2: sendto on eth1 to 192.1.2.23:4500 failed in liveness probe informational request. Errno 1: Operation not permitted | Message ID: #1.#2 XXX: in ikev2_send_livenss_probe() hacking around record'n'send bypassing send queue; initiator.sent=3 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=-1 | Message ID: #1 XXX: expecting sender.wip.initiator 3 == -1 - suspect record'n'send out-of-order?); initiator.sent=4 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=4 wip.responder=-1 | Message ID: sent #1 request 4; ike: initiator.sent=3->4 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=3->4 wip.responder=-1 | #2 liveness_check - peer 192.1.2.23 is missing - giving them some time to come back | #2 liveness_check - peer 192.1.2.23 is ok schedule new | event_schedule: new EVENT_v2_LIVENESS-pe@0x7f5a20002b78 | inserting event EVENT_v2_LIVENESS, timeout in 3 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f5a20002888 size 128 | libevent_free: release ptr-libevent@0x7f5a1c000f48 | free_event_entry: release EVENT_v2_LIVENESS-pe@0x55954d546148 | #2 spent 1.06 milliseconds in timer_event_cb() EVENT_v2_LIVENESS | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:557) | processing global timer EVENT_SHUNT_SCAN | expiring aged bare shunts from shunt table | spent 0.0106 milliseconds in global timer EVENT_SHUNT_SCAN | processing global timer EVENT_NAT_T_KEEPALIVE | FOR_EACH_STATE_... in nat_traversal_ka_event (for_each_state) | start processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1575) | stop processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1575) | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1575) | NAT-T: keepalive packet not required as recent DPD event used the IKE SA on conn north-east-x509-ipv4 | stop processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in for_each_state() at state.c:1577) | global one-shot timer EVENT_NAT_T_KEEPALIVE scheduled in 20 seconds | spent 0.147 milliseconds in global timer EVENT_NAT_T_KEEPALIVE | timer_event_cb: processing event@0x7f5a20002b78 | handling event EVENT_v2_LIVENESS for child state #2 | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in liveness_check() at timer.c:113) | get_sa_info esp.9d4a90ca@192.1.3.33 | #2 liveness_check - last_liveness: 29682.93727, now: 29691.989852 parent #1 | Opening output PBS liveness probe informational request | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 5 (0x5) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'liveness probe informational request' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 29 | emitting length of ISAKMP Message: 57 | sending 61 bytes for liveness probe informational request through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #2) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 2e 20 25 08 00 00 00 05 00 00 00 39 | 00 00 00 1d 1f e8 68 4f 40 c3 ff 9d 56 64 93 bb | 56 1c dc 29 15 7b bb 26 1d 90 26 35 4c ERROR: "north-east-x509-ipv4"[1] 192.1.2.23 #2: sendto on eth1 to 192.1.2.23:4500 failed in liveness probe informational request. Errno 1: Operation not permitted | Message ID: #1.#2 XXX: in ikev2_send_livenss_probe() hacking around record'n'send bypassing send queue; initiator.sent=4 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=-1 wip.responder=-1 | Message ID: #1 XXX: expecting sender.wip.initiator 4 == -1 - suspect record'n'send out-of-order?); initiator.sent=5 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=5 wip.responder=-1 | Message ID: sent #1 request 5; ike: initiator.sent=4->5 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=4->5 wip.responder=-1 | #2 liveness_check - peer 192.1.2.23 is missing - giving them some time to come back | #2 liveness_check - peer 192.1.2.23 is ok schedule new | event_schedule: new EVENT_v2_LIVENESS-pe@0x55954d546148 | inserting event EVENT_v2_LIVENESS, timeout in 3 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f5a1c000f48 size 128 | libevent_free: release ptr-libevent@0x7f5a20002888 | free_event_entry: release EVENT_v2_LIVENESS-pe@0x7f5a20002b78 | #2 spent 0.161 milliseconds in timer_event_cb() EVENT_v2_LIVENESS | stop processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:557) | timer_event_cb: processing event@0x55954d546148 | handling event EVENT_v2_LIVENESS for child state #2 | start processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in timer_event_cb() at timer.c:250) | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in liveness_check() at timer.c:113) | get_sa_info esp.9d4a90ca@192.1.3.33 | #2 liveness_check - last_liveness: 29682.93727, now: 29694.992829 parent #1 "north-east-x509-ipv4"[1] 192.1.2.23 #2: liveness_check - peer 192.1.2.23 has not responded in 12 seconds, with a timeout of 10, taking action:clear "north-east-x509-ipv4"[1] 192.1.2.23 #2: IKEv2 liveness action - clearing connection kind CK_INSTANCE | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #3 | suspend processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in foreach_state_by_connection_func_delete() at state.c:1310) | start processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #3 ikev2.child deleted other | #3 spent 1.01 milliseconds in total | [RE]START processing: state #3 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in delete_state() at state.c:879) "north-east-x509-ipv4"[1] 192.1.2.23 #3: deleting state (STATE_V2_CREATE_I0) aged 8.985s and NOT sending notification | child state #3: V2_CREATE_I0(established IKE SA) => delete | disconnecting state #3 from md | child state #3: V2_CREATE_I0(established IKE SA) => CHILDSA_DEL(informational) | state #3 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x55954d54a178 | free_event_entry: release EVENT_SA_REPLACE-pe@0x55954d5442c8 | in connection_discard for connection north-east-x509-ipv4 | State DB: deleting IKEv2 state #3 in CHILDSA_DEL | child state #3: CHILDSA_DEL(informational) => UNDEFINED(ignore) | close_any(fd@24) (in release_whack() at state.c:654) | stop processing: state #3 from 192.1.2.23 (in delete_state() at state.c:1143) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | resume processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in foreach_state_by_connection_func_delete() at state.c:1312) | state #2 | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #2 ikev2.child deleted completed | #2 spent 7.65 milliseconds in total | [RE]START processing: state #2 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in delete_state() at state.c:879) "north-east-x509-ipv4"[1] 192.1.2.23 #2: deleting state (STATE_V2_IPSEC_I) aged 24.077s and sending notification | child state #2: V2_IPSEC_I(established CHILD SA) => delete | get_sa_info esp.a4c60dd3@192.1.2.23 | get_sa_info esp.9d4a90ca@192.1.3.33 "north-east-x509-ipv4"[1] 192.1.2.23 #2: ESP traffic information: in=0B out=336B | #2 send IKEv2 delete notification for STATE_V2_IPSEC_I | Opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 6 (0x6) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: PROTO_v2_ESP (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting 4 raw bytes of local spis into IKEv2 Delete Payload | local spis 9d 4a 90 ca | emitting length of IKEv2 Delete Payload: 12 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 41 | emitting length of ISAKMP Message: 69 | sending 73 bytes for delete notification through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #2) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 2e 20 25 08 00 00 00 06 00 00 00 45 | 2a 00 00 29 ae 72 ed c1 0c 08 05 aa da 33 62 65 | 33 ce c8 53 f7 aa 6c ad 5c 2f cb eb 4c 40 99 53 | 92 78 0d 75 db f6 91 0b 1d ERROR: "north-east-x509-ipv4"[1] 192.1.2.23 #2: sendto on eth1 to 192.1.2.23:4500 failed in delete notification. Errno 1: Operation not permitted | Message ID: IKE #1 sender #2 in send_delete record 'n' sending delete request so forcing IKE nextuse=0->1 and sender msgid=0->0 | Message ID: IKE #1 sender #2 in send_delete hacking around record ' send | Message ID: #1 XXX: expecting sender.wip.initiator 5 == -1 - suspect record'n'send out-of-order?); initiator.sent=6 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=6 wip.responder=-1 | Message ID: sent #1 request 6; ike: initiator.sent=5->6 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=5->6 wip.responder=-1 | state #2 requesting EVENT_SA_REKEY to be deleted | libevent_free: release ptr-libevent@0x55954d5485d8 | free_event_entry: release EVENT_SA_REKEY-pe@0x7f5a24002b78 | running updown command "ipsec _updown" for verb down | command executing down-client | trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x509-ipv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0' PLUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844385' PLUTO_CONN_POLI | popen cmd is 1465 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x509-i: | cmd( 80):pv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PL: | cmd( 160):UTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=nort: | cmd( 240):h.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='19: | cmd( 320):2.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.25: | cmd( 400):5.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_T: | cmd( 480):YPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=: | cmd( 560):Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testin: | cmd( 640):g.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0' P: | cmd( 720):LUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUT: | cmd( 800):O_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libr: | cmd( 880):eswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_AD: | cmd( 960):DTIME='1566844385' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+I: | cmd(1040):KEV2_ALLOW_NARROWING+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_GOIN: | cmd(1120):G_AWAY' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_MY_SOURCEIP='192.0.2.1: | cmd(1200):00' PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLU: | cmd(1280):TO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED=: | cmd(1360):'0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa4c60dd3 SPI_OUT=0x9d: | cmd(1440):4a90ca ipsec _updown 2>&1: "north-east-x509-ipv4"[1] 192.1.2.23 #2: down-client output: restoring resolvconf "north-east-x509-ipv4"[1] 192.1.2.23 #2: down-client output: Problem in restoring the resolv.conf, as there is no backup file | shunt_eroute() called for connection 'north-east-x509-ipv4' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "north-east-x509-ipv4" is 0xfdfff | IPsec Sa SPD priority set to 1040383 | delete esp.a4c60dd3@192.1.2.23 | netlink response for Del SA esp.a4c60dd3@192.1.2.23 included non-error error | priority calculation of connection "north-east-x509-ipv4" is 0xfdfff | delete inbound eroute 0.0.0.0/0:0 --0-> 192.0.2.100/32:0 => unk255.10000@192.1.3.33 (raw_eroute) | raw_eroute result=success | delete esp.9d4a90ca@192.1.3.33 | netlink response for Del SA esp.9d4a90ca@192.1.3.33 included non-error error | in connection_discard for connection north-east-x509-ipv4 | State DB: deleting IKEv2 state #2 in V2_IPSEC_I | child state #2: V2_IPSEC_I(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #2 from 192.1.2.23 (in delete_state() at state.c:1143) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #1 | start processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #1 ikev2.ike deleted completed | #1 spent 16.2 milliseconds in total | [RE]START processing: state #1 connection "north-east-x509-ipv4"[1] 192.1.2.23 from 192.1.2.23 (in delete_state() at state.c:879) "north-east-x509-ipv4"[1] 192.1.2.23 #1: deleting state (STATE_PARENT_I3) aged 24.115s and sending notification | parent state #1: PARENT_I3(established IKE SA) => delete | #1 send IKEv2 delete notification for STATE_PARENT_I3 | Opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator cookie: | f0 a6 a1 a2 93 0b 81 56 | responder cookie: | 31 d8 72 8b 09 6c 01 0e | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 7 (0x7) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: PROTO_v2_IKE (0x1) | SPI size: 0 (0x0) | number of SPIs: 0 (0x0) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting length of IKEv2 Delete Payload: 8 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 37 | emitting length of ISAKMP Message: 65 | sending 69 bytes for delete notification through eth1 from 192.1.3.33:4500 to 192.1.2.23:4500 (using #1) | 00 00 00 00 f0 a6 a1 a2 93 0b 81 56 31 d8 72 8b | 09 6c 01 0e 2e 20 25 08 00 00 00 07 00 00 00 41 | 2a 00 00 25 0c b6 db cd 38 01 3e d0 ee fd b5 3c | c7 94 ad 77 bf 82 9d 85 57 38 cf e5 ce 4b d0 4b | 7d a6 bb 3e 29 ERROR: "north-east-x509-ipv4"[1] 192.1.2.23 #1: sendto on eth1 to 192.1.2.23:4500 failed in delete notification. Errno 1: Operation not permitted | Message ID: IKE #1 sender #1 in send_delete record 'n' sending delete request so forcing IKE nextuse=1->2 and sender msgid=0->1 | Message ID: IKE #1 sender #1 in send_delete hacking around record ' send | Message ID: #1 XXX: expecting sender.wip.initiator 6 == -1 - suspect record'n'send out-of-order?); initiator.sent=7 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=7 wip.responder=-1 | Message ID: sent #1 request 7; ike: initiator.sent=6->7 initiator.recv=1 responder.sent=0 responder.recv=0 wip.initiator=6->7 wip.responder=-1 | state #1 requesting EVENT_SA_REKEY to be deleted | libevent_free: release ptr-libevent@0x55954d55e2c8 | free_event_entry: release EVENT_SA_REKEY-pe@0x55954d537d58 | State DB: IKEv2 state not found (flush_incomplete_children) | picked newest_isakmp_sa #0 for #1 "north-east-x509-ipv4"[1] 192.1.2.23 #1: deleting IKE SA for connection 'north-east-x509-ipv4' but connection is supposed to remain up; schedule EVENT_REVIVE_CONNS | add revival: connection 'north-east-x509-ipv4' added to the list and scheduled for 0 seconds | global one-shot timer EVENT_REVIVE_CONNS scheduled in 0 seconds | in connection_discard for connection north-east-x509-ipv4 | State DB: deleting IKEv2 state #1 in PARENT_I3 | parent state #1: PARENT_I3(established IKE SA) => UNDEFINED(ignore) | unreference key: 0x55954d53e398 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 2-- | stop processing: state #1 from 192.1.2.23 (in delete_state() at state.c:1143) | unreference key: 0x55954d53e398 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 1-- | unreference key: 0x55954d54a088 user-east@testing.libreswan.org cnt 1-- | unreference key: 0x55954d54a228 @east.testing.libreswan.org cnt 1-- | unreference key: 0x55954d549f78 east@testing.libreswan.org cnt 1-- | unreference key: 0x55954d558728 192.1.2.23 cnt 1-- | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | start processing: connection "north-east-x509-ipv4"[1] 192.1.2.23 (in delete_connection() at connections.c:189) "north-east-x509-ipv4"[1] 192.1.2.23: deleting connection "north-east-x509-ipv4"[1] 192.1.2.23 instance with peer 192.1.2.23 {isakmp=#0/ipsec=#0} | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'north-east-x509-ipv4' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "north-east-x509-ipv4" is 0xfdfff | priority calculation of connection "north-east-x509-ipv4" is 0xfdfff | FOR_EACH_CONNECTION_... in route_owner | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 vs | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 vs | conn north-east-x509-ipv4 mark 0/00000000, 0/00000000 | route owner of "north-east-x509-ipv4" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | trusted_ca_nss: trustor B = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x509-ipv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.0' PLUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY | popen cmd is 1446 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east-x50: | cmd( 80):9-ipv4' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33': | cmd( 160): PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=n: | cmd( 240):orth.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT=: | cmd( 320):'192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255: | cmd( 400):.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_S: | cmd( 480):A_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto: | cmd( 560):, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@te: | cmd( 640):sting.libreswan.org' PLUTO_PEER_CLIENT='0.0.0.0/0' PLUTO_PEER_CLIENT_NET='0.0.0.: | cmd( 720):0' PLUTO_PEER_CLIENT_MASK='0.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' : | cmd( 800):PLUTO_PEER_CA='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=: | cmd( 880):Libreswan test CA for mainca, E=testing@libreswan.org' PLUTO_STACK='netkey' PLUT: | cmd( 960):O_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKEV2_: | cmd(1040):ALLOW_NARROWING+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_GOING_AWA: | cmd(1120):Y' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_MY_SOURCEIP='192.0.2.100' P: | cmd(1200):LUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PE: | cmd(1280):ER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' V: | cmd(1360):TI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updow: | cmd(1440):n 2>&1: "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. "north-east-x509-ipv4"[1] 192.1.2.23: unroute-client output: Error: Peer netns reference is invalid. | flush revival: connection 'north-east-x509-ipv4' revival flushed | stop processing: connection "north-east-x509-ipv4"[1] 192.1.2.23 (in discard_connection() at connections.c:249) | libevent_free: release ptr-libevent@0x7f5a1c000f48 | free_event_entry: release EVENT_v2_LIVENESS-pe@0x55954d546148 | in statetime_stop() and could not find #2 | processing: STOP state #0 (in timer_event_cb() at timer.c:557) | kernel_process_msg_cb process netlink message | netlink_get: XFRM_MSG_UPDPOLICY message | netlink_get: XFRM_MSG_UPDPOLICY message | netlink_get: XFRM_MSG_GETPOLICY message | xfrm netlink address change RTM_DELADDR msg len 76 | XFRM RTM_DELADDR 192.0.2.100 IFA_LOCAL | FOR_EACH_STATE_... in record_deladdr (for_each_state) | IKEv2 received address RTM_DELADDR type 3 | IKEv2 received address RTM_DELADDR type 8 | IKEv2 received address RTM_DELADDR type 6 | netlink_get: XFRM_MSG_UPDPOLICY message | spent 0.0352 milliseconds in kernel message | processing global timer EVENT_REVIVE_CONNS | spent 0.000651 milliseconds in global timer EVENT_REVIVE_CONNS | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00491 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00274 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_STATE_... in show_traffic_status (sort_states) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0392 milliseconds in whack | processing global timer EVENT_SHUNT_SCAN | expiring aged bare shunts from shunt table | spent 0.0054 milliseconds in global timer EVENT_SHUNT_SCAN | processing global timer EVENT_NAT_T_KEEPALIVE | FOR_EACH_STATE_... in nat_traversal_ka_event (for_each_state) | spent 0.00573 milliseconds in global timer EVENT_NAT_T_KEEPALIVE | processing global timer EVENT_PENDING_DDNS | FOR_EACH_CONNECTION_... in connection_check_ddns | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | elapsed time in connection_check_ddns for hostname lookup 0.000004 | spent 0.00846 milliseconds in global timer EVENT_PENDING_DDNS | processing global timer EVENT_SHUNT_SCAN | expiring aged bare shunts from shunt table | spent 0.0022 milliseconds in global timer EVENT_SHUNT_SCAN