FIPS Product: YES FIPS Kernel: NO FIPS Mode: NO NSS DB directory: sql:/etc/ipsec.d Initializing NSS Opening NSS database "sql:/etc/ipsec.d" read-only NSS initialized NSS crypto library initialized FIPS HMAC integrity support [enabled] FIPS mode disabled for pluto daemon FIPS HMAC integrity verification self-test FAILED libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v3.28-685-gbfd5aef521-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:2643 core dump dir: /var/tmp secrets file: /etc/ipsec.secrets leak-detective enabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: new ptr-libevent@0x5624647d97a8 size 40 | libevent_malloc: new ptr-libevent@0x5624647d9728 size 40 | libevent_malloc: new ptr-libevent@0x5624647d96a8 size 40 | creating event base | libevent_malloc: new ptr-libevent@0x5624647cb2d8 size 56 | libevent_malloc: new ptr-libevent@0x562464754e78 size 664 | libevent_malloc: new ptr-libevent@0x562464813dc8 size 24 | libevent_malloc: new ptr-libevent@0x562464813e18 size 384 | libevent_malloc: new ptr-libevent@0x562464813d88 size 16 | libevent_malloc: new ptr-libevent@0x5624647d9628 size 40 | libevent_malloc: new ptr-libevent@0x5624647d95a8 size 48 | libevent_realloc: new ptr-libevent@0x562464754b08 size 256 | libevent_malloc: new ptr-libevent@0x562464813fc8 size 16 | libevent_free: release ptr-libevent@0x5624647cb2d8 | libevent initialized | libevent_realloc: new ptr-libevent@0x5624647cb2d8 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm, aes_ccm_c AES_CCM_12 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_b AES_CCM_8 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_a 3DES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS [*192] 3des CAMELLIA_CTR IKEv1: ESP IKEv2: ESP {256,192,*128} CAMELLIA_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} camellia AES_GCM_16 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm, aes_gcm_c AES_GCM_12 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_b AES_GCM_8 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_a AES_CTR IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aesctr AES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aes SERPENT_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} serpent TWOFISH_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} twofish TWOFISH_SSH IKEv1: IKE IKEv2: IKE ESP {256,192,*128} twofish_cbc_ssh NULL_AUTH_AES_GMAC IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_gmac NULL IKEv1: ESP IKEv2: ESP [] CHACHA20_POLY1305 IKEv1: IKEv2: IKE ESP [*256] chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: SHA1 IKEv1: IKE IKEv2: FIPS sha SHA2_256 IKEv1: IKE IKEv2: FIPS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: FIPS sha384 SHA2_512 IKEv1: IKE IKEv2: FIPS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 crypto helpers started thread for crypto helper 0 | starting up helper thread 0 | status value returned by setting the priority of this thread (crypto helper 0) 22 | crypto helper 0 waiting (nothing to do) started thread for crypto helper 1 started thread for crypto helper 2 | starting up helper thread 2 | status value returned by setting the priority of this thread (crypto helper 2) 22 | crypto helper 2 waiting (nothing to do) started thread for crypto helper 3 | starting up helper thread 3 | status value returned by setting the priority of this thread (crypto helper 3) 22 | crypto helper 3 waiting (nothing to do) started thread for crypto helper 4 | starting up helper thread 4 | status value returned by setting the priority of this thread (crypto helper 4) 22 | crypto helper 4 waiting (nothing to do) started thread for crypto helper 5 | starting up helper thread 5 | status value returned by setting the priority of this thread (crypto helper 5) 22 | crypto helper 5 waiting (nothing to do) started thread for crypto helper 6 | starting up helper thread 6 | checking IKEv1 state table | status value returned by setting the priority of this thread (crypto helper 6) 22 | crypto helper 6 waiting (nothing to do) | MAIN_R0: category: half-open IKE SA flags: 0: | -> MAIN_R1 EVENT_SO_DISCARD | MAIN_I1: category: half-open IKE SA flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT | MAIN_R1: category: open IKE SA flags: 200: | -> MAIN_R2 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_I2: category: open IKE SA flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_R2: category: open IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | -> MAIN_R3 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_I3: category: open IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | -> MAIN_I4 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_R3: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | MAIN_I4: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | AGGR_R0: category: half-open IKE SA flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD | AGGR_I1: category: half-open IKE SA flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE | -> AGGR_I2 EVENT_SA_REPLACE | AGGR_R1: category: open IKE SA flags: 200: | -> AGGR_R2 EVENT_SA_REPLACE | -> AGGR_R2 EVENT_SA_REPLACE | AGGR_I2: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | AGGR_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | QUICK_R0: category: established CHILD SA flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT | QUICK_I1: category: established CHILD SA flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE | QUICK_R1: category: established CHILD SA flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE | QUICK_I2: category: established CHILD SA flags: 200: | -> UNDEFINED EVENT_NULL | QUICK_R2: category: established CHILD SA flags: 0: | -> UNDEFINED EVENT_NULL | INFO: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | INFO_PROTECTED: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | XAUTH_R0: category: established IKE SA flags: 0: | -> XAUTH_R1 EVENT_NULL | XAUTH_R1: category: established IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | MODE_CFG_R0: category: informational flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE | MODE_CFG_R1: category: established IKE SA flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE | MODE_CFG_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | MODE_CFG_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | XAUTH_I0: category: established IKE SA flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT | XAUTH_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT | checking IKEv2 state table | PARENT_I0: category: ignore flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA flags: 0: | -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH) | PARENT_I2: category: open IKE SA flags: 0: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_I3: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_RETAIN (I3: Informational Request) | -> PARENT_I3 EVENT_RETAIN (I3: Informational Response) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response) | PARENT_R0: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED)) | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request) | PARENT_R2: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request) | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response) | V2_CREATE_I0: category: established IKE SA flags: 0: | -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | V2_CREATE_I: category: established IKE SA flags: 0: | -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_IKE_I0: category: established IKE SA flags: 0: | -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_REKEY_CHILD_I0: category: established IKE SA flags: 0: | -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_REKEY_CHILD_I: category: established IKE SA flags: 0: | V2_CREATE_R: category: established IKE SA flags: 0: | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request) | V2_REKEY_IKE_R: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_R: category: established IKE SA flags: 0: | V2_IPSEC_I: category: established CHILD SA flags: 0: | V2_IPSEC_R: category: established CHILD SA flags: 0: | IKESA_DEL: category: established IKE SA flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational flags: 0: Using Linux XFRM/NETKEY IPsec interface code on 5.1.18-200.fc29.x86_64 | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding SERPENT_CBC to kernel algorithm db | adding TWOFISH_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x5624647d34c8 | libevent_malloc: new ptr-libevent@0x562464812538 size 128 | libevent_malloc: new ptr-libevent@0x5624648195c8 size 16 | add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x562464819558 | libevent_malloc: new ptr-libevent@0x5624647cbf88 size 128 | libevent_malloc: new ptr-libevent@0x562464819228 size 16 | global one-shot timer EVENT_CHECK_CRLS initialized selinux support is enabled. | starting up helper thread 1 | status value returned by setting the priority of this thread (crypto helper 1) 22 | crypto helper 1 waiting (nothing to do) | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | Loading dnssec root key from:/var/lib/unbound/root.key | No additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x5624648199f8 | libevent_malloc: new ptr-libevent@0x562464825858 size 128 | libevent_malloc: new ptr-libevent@0x562464830b48 size 16 | libevent_realloc: new ptr-libevent@0x562464830b88 size 256 | libevent_malloc: new ptr-libevent@0x562464830cb8 size 8 | libevent_realloc: new ptr-libevent@0x562464830cf8 size 144 | libevent_malloc: new ptr-libevent@0x5624647d7a98 size 152 | libevent_malloc: new ptr-libevent@0x562464830db8 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: new ptr-libevent@0x562464830df8 size 8 | libevent_malloc: new ptr-libevent@0x5624647557e8 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: new ptr-libevent@0x562464830e38 size 8 | libevent_malloc: new ptr-libevent@0x562464830e78 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: new ptr-libevent@0x562464830f48 size 8 | libevent_realloc: release ptr-libevent@0x562464830cf8 | libevent_realloc: new ptr-libevent@0x562464830f88 size 256 | libevent_malloc: new ptr-libevent@0x5624648310b8 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:2757) using fork+execve | forked child 2757 | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 Kernel supports NIC esp-hw-offload adding interface eth1/eth1 (esp-hw-offload not supported by kernel) 192.1.2.45:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth1/eth1 192.1.2.45:4500 adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.0.1.254:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth0/eth0 192.0.1.254:4500 adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface lo/lo 127.0.0.1:4500 | no interfaces to sort | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | add_fd_read_event_handler: new ethX-pe@0x562464831698 | libevent_malloc: new ptr-libevent@0x5624648257a8 size 128 | libevent_malloc: new ptr-libevent@0x562464831708 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 22 | add_fd_read_event_handler: new ethX-pe@0x562464831748 | libevent_malloc: new ptr-libevent@0x5624647cc038 size 128 | libevent_malloc: new ptr-libevent@0x5624648317b8 size 16 | setup callback for interface lo 127.0.0.1:500 fd 21 | add_fd_read_event_handler: new ethX-pe@0x5624648317f8 | libevent_malloc: new ptr-libevent@0x5624647cb958 size 128 | libevent_malloc: new ptr-libevent@0x562464831868 size 16 | setup callback for interface eth0 192.0.1.254:4500 fd 20 | add_fd_read_event_handler: new ethX-pe@0x5624648318a8 | libevent_malloc: new ptr-libevent@0x5624647d3218 size 128 | libevent_malloc: new ptr-libevent@0x562464831918 size 16 | setup callback for interface eth0 192.0.1.254:500 fd 19 | add_fd_read_event_handler: new ethX-pe@0x562464831958 | libevent_malloc: new ptr-libevent@0x5624647d3318 size 128 | libevent_malloc: new ptr-libevent@0x5624648319c8 size 16 | setup callback for interface eth1 192.1.2.45:4500 fd 18 | add_fd_read_event_handler: new ethX-pe@0x562464831a08 | libevent_malloc: new ptr-libevent@0x5624647d3418 size 128 | libevent_malloc: new ptr-libevent@0x562464831a78 size 16 | setup callback for interface eth1 192.1.2.45:500 fd 17 | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 loaded private key for keyid: PKK_RSA:AQOm9dY/4 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.27 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 | no interfaces to sort | libevent_free: release ptr-libevent@0x5624648257a8 | free_event_entry: release EVENT_NULL-pe@0x562464831698 | add_fd_read_event_handler: new ethX-pe@0x562464831698 | libevent_malloc: new ptr-libevent@0x5624648257a8 size 128 | setup callback for interface lo 127.0.0.1:4500 fd 22 | libevent_free: release ptr-libevent@0x5624647cc038 | free_event_entry: release EVENT_NULL-pe@0x562464831748 | add_fd_read_event_handler: new ethX-pe@0x562464831748 | libevent_malloc: new ptr-libevent@0x5624647cc038 size 128 | setup callback for interface lo 127.0.0.1:500 fd 21 | libevent_free: release ptr-libevent@0x5624647cb958 | free_event_entry: release EVENT_NULL-pe@0x5624648317f8 | add_fd_read_event_handler: new ethX-pe@0x5624648317f8 | libevent_malloc: new ptr-libevent@0x5624647cb958 size 128 | setup callback for interface eth0 192.0.1.254:4500 fd 20 | libevent_free: release ptr-libevent@0x5624647d3218 | free_event_entry: release EVENT_NULL-pe@0x5624648318a8 | add_fd_read_event_handler: new ethX-pe@0x5624648318a8 | libevent_malloc: new ptr-libevent@0x5624647d3218 size 128 | setup callback for interface eth0 192.0.1.254:500 fd 19 | libevent_free: release ptr-libevent@0x5624647d3318 | free_event_entry: release EVENT_NULL-pe@0x562464831958 | add_fd_read_event_handler: new ethX-pe@0x562464831958 | libevent_malloc: new ptr-libevent@0x5624647d3318 size 128 | setup callback for interface eth1 192.1.2.45:4500 fd 18 | libevent_free: release ptr-libevent@0x5624647d3418 | free_event_entry: release EVENT_NULL-pe@0x562464831a08 | add_fd_read_event_handler: new ethX-pe@0x562464831a08 | libevent_malloc: new ptr-libevent@0x5624647d3418 size 128 | setup callback for interface eth1 192.1.2.45:500 fd 17 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 loaded private key for keyid: PKK_RSA:AQOm9dY/4 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.312 milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 2757 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0115 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection ikev2-westnet-eastnet-x509-cr with policy RSASIG+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | ike (phase1) algorithm values: AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_CBC_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp= | ESP/AH string values: AES_GCM_16_256-NONE, AES_GCM_16_128-NONE, AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128, AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128 | setting ID to ID_DER_ASN1_DN: 'E=user-west-ekuCritical@testing.libreswan.org,CN=west-ekuCritical.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA' | loading left certificate 'west-ekuCritical' pubkey | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x562464835058 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x562464835008 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x562464834fb8 | unreference key: 0x5624648350a8 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west-ekuCritical.testing.libreswan.org, E=user-west-ekuCritical@testing.libreswan.org cnt 1-- | certs and keys locked by 'lsw_add_rsa_secret' | certs and keys unlocked by 'lsw_add_rsa_secret' | counting wild cards for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west-ekuCritical.testing.libreswan.org, E=user-west-ekuCritical@testing.libreswan.org is 0 | counting wild cards for %fromcert is 0 | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | new hp@0x562464839828 added connection description "ikev2-westnet-eastnet-x509-cr" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.1.0/24===192.1.2.45<192.1.2.45>[C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west-ekuCritical.testing.libreswan.org, E=user-west-ekuCritical@testing.libreswan.org]...192.1.2.23<192.1.2.23>[%fromcert]===192.0.2.0/24 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.22 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | dup_any(fd@16) -> fd@23 (in whack_process() at rcv_whack.c:590) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "ikev2-westnet-eastnet-x509-cr" (in initiate_a_connection() at initiate.c:186) | connection 'ikev2-westnet-eastnet-x509-cr' +POLICY_UP | dup_any(fd@23) -> fd@24 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | creating state object #1 at 0x562464839bf8 | State DB: adding IKEv2 state #1 in UNDEFINED | pstats #1 ikev2.ike started | Message ID: init #1: msgid=0 lastack=4294967295 nextuse=0 lastrecv=4294967295 lastreplied=0 | parent state #1: UNDEFINED(ignore) => PARENT_I0(ignore) | Message ID: init_ike #1; ike: initiator.sent=0->-1 initiator.recv=0->-1 responder.sent=0->-1 responder.recv=0->-1 wip.initiator=0->-1 wip.responder=0->-1 | suspend processing: connection "ikev2-westnet-eastnet-x509-cr" (in ikev2_parent_outI1() at ikev2_parent.c:535) | start processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ikev2_parent_outI1() at ikev2_parent.c:535) | dup_any(fd@24) -> fd@25 (in ikev2_parent_outI1() at ikev2_parent.c:551) | Queuing pending IPsec SA negotiating with 192.1.2.23 "ikev2-westnet-eastnet-x509-cr" IKE SA #1 "ikev2-westnet-eastnet-x509-cr" "ikev2-westnet-eastnet-x509-cr" #1: initiating v2 parent SA | constructing local IKE proposals for ikev2-westnet-eastnet-x509-cr (IKE SA initiator selecting KE) | converting ike_info AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_CBC_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 "ikev2-westnet-eastnet-x509-cr": constructed local IKE proposals for ikev2-westnet-eastnet-x509-cr (IKE SA initiator selecting KE): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | adding ikev2_outI1 KE work-order 1 for state #1 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x562464839908 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x562464834be8 size 128 | #1 spent 0.123 milliseconds in ikev2_parent_outI1() | processing: RESET whack log_fd (was fd@16) (in ikev2_parent_outI1() at ikev2_parent.c:610) | RESET processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ikev2_parent_outI1() at ikev2_parent.c:610) | RESET processing: connection "ikev2-westnet-eastnet-x509-cr" (in ikev2_parent_outI1() at ikev2_parent.c:610) | processing: STOP connection NULL (in initiate_a_connection() at initiate.c:349) | crypto helper 0 resuming | crypto helper 0 starting work-order 1 for state #1 | close_any(fd@23) (in initiate_connection() at initiate.c:372) | crypto helper 0 doing build KE and nonce (ikev2_outI1 KE); request ID 1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.191 milliseconds in whack | crypto helper 0 finished build KE and nonce (ikev2_outI1 KE); request ID 1 time elapsed 0.000581 seconds | (#1) spent 0.583 milliseconds in crypto helper computing work-order 1: ikev2_outI1 KE (pcr) | crypto helper 0 sending results from work-order 1 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7fe488002888 size 128 | crypto helper 0 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 1 | calling continuation function 0x562463b2eb50 | ikev2_parent_outI1_continue for #1 | **emit ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | using existing local IKE proposals for connection ikev2-westnet-eastnet-x509-cr (IKE SA initiator emitting local proposals): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | Emitting ikev2_proposals ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discarding INTEG=NONE | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 11 (0xb) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding INTEG=NONE | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding INTEG=NONE | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 2 (0x2) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 11 (0xb) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding INTEG=NONE | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 3 (0x3) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 13 (0xd) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 116 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 4 (0x4) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 13 (0xd) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 116 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 436 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x b5 68 40 1b bf 5c 31 c9 f5 7b f7 ce e4 6e 44 ab | ikev2 g^x 6a a3 9a d6 ea ff 03 bc 0f ae 7b 87 29 83 d7 25 | ikev2 g^x 66 bd f7 e6 81 2b bd d0 ea d4 25 23 89 9e b5 ae | ikev2 g^x ad b1 9f cf f8 df da d7 f4 a9 ae 97 3b 85 e4 27 | ikev2 g^x 32 0f 7f 57 8e 87 93 d1 6b 91 93 45 2b f1 38 de | ikev2 g^x 72 04 7a f4 5c 21 5a 9f 04 2a 8e bd 09 3a 6e 51 | ikev2 g^x 46 e2 66 e8 3b 30 33 e3 ba f9 a0 81 86 27 20 fb | ikev2 g^x d1 d4 cc 24 b3 02 cc 46 b8 33 ec 13 13 74 d9 50 | ikev2 g^x 67 fb b8 68 70 86 2d b4 45 d4 35 98 1f 2b 55 00 | ikev2 g^x 3a 6f 9a bb ad 8b 49 f6 9e 83 b9 a4 54 8e f5 46 | ikev2 g^x 50 f6 33 f2 f7 ec 3e 27 a4 aa d1 ef 1f 6b dd d2 | ikev2 g^x 08 28 2e 72 34 29 f0 bc 36 76 48 36 19 b2 4f 33 | ikev2 g^x 7f c1 9a 7c 49 6a f1 86 11 86 60 ca 08 6a 31 bd | ikev2 g^x d3 b5 9f bc 8c d4 52 22 bd 33 81 91 6f 52 7a a5 | ikev2 g^x 59 ab a0 4a e2 f9 28 02 59 b1 b3 51 b9 62 44 98 | ikev2 g^x dd 8b 15 c4 42 15 a3 cc 32 05 54 8a a0 15 25 96 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | next payload chain: ignoring supplied 'IKEv2 Nonce Payload'.'next payload type' value 41:ISAKMP_NEXT_v2N | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce 77 eb 94 32 f4 db 2e 82 6b 1c f0 0c c7 76 b1 62 | IKEv2 nonce 4d 30 6e ed 9f 80 b3 3a 98 f4 3e ae e4 05 9f ae | emitting length of IKEv2 Nonce Payload: 36 | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | NAT-Traversal support [enabled] add v2N payloads. | natd_hash: rcookie is zero | natd_hash: hasher=0x562463c03800(20) | natd_hash: icookie= 79 f6 25 53 15 ca 61 32 | natd_hash: rcookie= 00 00 00 00 00 00 00 00 | natd_hash: ip= c0 01 02 2d | natd_hash: port=500 | natd_hash: hash= 1f e9 1b 59 6f 18 a4 ca 6d e7 24 c4 8e c6 09 24 | natd_hash: hash= 5b da 9c 19 | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data 1f e9 1b 59 6f 18 a4 ca 6d e7 24 c4 8e c6 09 24 | Notify data 5b da 9c 19 | emitting length of IKEv2 Notify Payload: 28 | natd_hash: rcookie is zero | natd_hash: hasher=0x562463c03800(20) | natd_hash: icookie= 79 f6 25 53 15 ca 61 32 | natd_hash: rcookie= 00 00 00 00 00 00 00 00 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 0d 42 c3 1f d4 8d c1 7e 83 88 00 66 d8 b0 4e bf | natd_hash: hash= a4 51 97 7b | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data 0d 42 c3 1f d4 8d c1 7e 83 88 00 66 d8 b0 4e bf | Notify data a4 51 97 7b | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 828 | stop processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ikev2_parent_outI1_common() at ikev2_parent.c:817) | start processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #1 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK | IKEv2: transition from state STATE_PARENT_I0 to state STATE_PARENT_I1 | parent state #1: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) | Message ID: updating counters for #1 to 4294967295 after switching state | Message ID: IKE #1 skipping update_recv as MD is fake | Message ID: sent #1 request 0; ike: initiator.sent=-1->0 initiator.recv=-1 responder.sent=-1 responder.recv=-1 wip.initiator=-1->0 wip.responder=-1 "ikev2-westnet-eastnet-x509-cr" #1: STATE_PARENT_I1: sent v2I1, expected v2R1 | sending V2 reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 828 bytes for STATE_PARENT_I0 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 79 f6 25 53 15 ca 61 32 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 03 3c 22 00 01 b4 | 02 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 14 | 80 0e 01 00 03 00 00 08 02 00 00 07 03 00 00 08 | 02 00 00 05 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 02 00 00 64 02 01 00 0b 03 00 00 0c | 01 00 00 14 80 0e 00 80 03 00 00 08 02 00 00 07 | 03 00 00 08 02 00 00 05 03 00 00 08 04 00 00 0e | 03 00 00 08 04 00 00 0f 03 00 00 08 04 00 00 10 | 03 00 00 08 04 00 00 12 03 00 00 08 04 00 00 13 | 03 00 00 08 04 00 00 14 03 00 00 08 04 00 00 15 | 00 00 00 08 04 00 00 1f 02 00 00 74 03 01 00 0d | 03 00 00 0c 01 00 00 0c 80 0e 01 00 03 00 00 08 | 02 00 00 07 03 00 00 08 02 00 00 05 03 00 00 08 | 03 00 00 0e 03 00 00 08 03 00 00 0c 03 00 00 08 | 04 00 00 0e 03 00 00 08 04 00 00 0f 03 00 00 08 | 04 00 00 10 03 00 00 08 04 00 00 12 03 00 00 08 | 04 00 00 13 03 00 00 08 04 00 00 14 03 00 00 08 | 04 00 00 15 00 00 00 08 04 00 00 1f 00 00 00 74 | 04 01 00 0d 03 00 00 0c 01 00 00 0c 80 0e 00 80 | 03 00 00 08 02 00 00 07 03 00 00 08 02 00 00 05 | 03 00 00 08 03 00 00 0e 03 00 00 08 03 00 00 0c | 03 00 00 08 04 00 00 0e 03 00 00 08 04 00 00 0f | 03 00 00 08 04 00 00 10 03 00 00 08 04 00 00 12 | 03 00 00 08 04 00 00 13 03 00 00 08 04 00 00 14 | 03 00 00 08 04 00 00 15 00 00 00 08 04 00 00 1f | 28 00 01 08 00 0e 00 00 b5 68 40 1b bf 5c 31 c9 | f5 7b f7 ce e4 6e 44 ab 6a a3 9a d6 ea ff 03 bc | 0f ae 7b 87 29 83 d7 25 66 bd f7 e6 81 2b bd d0 | ea d4 25 23 89 9e b5 ae ad b1 9f cf f8 df da d7 | f4 a9 ae 97 3b 85 e4 27 32 0f 7f 57 8e 87 93 d1 | 6b 91 93 45 2b f1 38 de 72 04 7a f4 5c 21 5a 9f | 04 2a 8e bd 09 3a 6e 51 46 e2 66 e8 3b 30 33 e3 | ba f9 a0 81 86 27 20 fb d1 d4 cc 24 b3 02 cc 46 | b8 33 ec 13 13 74 d9 50 67 fb b8 68 70 86 2d b4 | 45 d4 35 98 1f 2b 55 00 3a 6f 9a bb ad 8b 49 f6 | 9e 83 b9 a4 54 8e f5 46 50 f6 33 f2 f7 ec 3e 27 | a4 aa d1 ef 1f 6b dd d2 08 28 2e 72 34 29 f0 bc | 36 76 48 36 19 b2 4f 33 7f c1 9a 7c 49 6a f1 86 | 11 86 60 ca 08 6a 31 bd d3 b5 9f bc 8c d4 52 22 | bd 33 81 91 6f 52 7a a5 59 ab a0 4a e2 f9 28 02 | 59 b1 b3 51 b9 62 44 98 dd 8b 15 c4 42 15 a3 cc | 32 05 54 8a a0 15 25 96 29 00 00 24 77 eb 94 32 | f4 db 2e 82 6b 1c f0 0c c7 76 b1 62 4d 30 6e ed | 9f 80 b3 3a 98 f4 3e ae e4 05 9f ae 29 00 00 08 | 00 00 40 2e 29 00 00 1c 00 00 40 04 1f e9 1b 59 | 6f 18 a4 ca 6d e7 24 c4 8e c6 09 24 5b da 9c 19 | 00 00 00 1c 00 00 40 05 0d 42 c3 1f d4 8d c1 7e | 83 88 00 66 d8 b0 4e bf a4 51 97 7b | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x562464834be8 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x562464839908 | success_v2_state_transition scheduling EVENT_RETRANSMIT of c->r_interval=15000ms | event_schedule: new EVENT_RETRANSMIT-pe@0x562464839908 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x562464838a28 size 128 | #1 STATE_PARENT_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29369.870361 | resume sending helper answer for #1 suppresed complete_v2_state_transition() and stole MD | #1 spent 0.82 milliseconds in resume sending helper answer | stop processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fe488002888 | spent 0.00202 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 437 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | 79 f6 25 53 15 ca 61 32 86 6d 30 a6 12 dd 70 c0 | 21 20 22 20 00 00 00 00 00 00 01 b5 22 00 00 28 | 00 00 00 24 01 01 00 03 03 00 00 0c 01 00 00 14 | 80 0e 01 00 03 00 00 08 02 00 00 07 00 00 00 08 | 04 00 00 0e 28 00 01 08 00 0e 00 00 ca b9 b3 8a | 53 8f fe b0 a6 99 d1 c9 46 ec 59 4a 6b 14 a3 f5 | 9b d7 9e c8 7d 07 8e f8 45 1f 43 db 6c 05 87 b2 | 32 0c d3 11 23 f7 95 e7 79 c9 bf 9c 2a d6 d5 ce | cc cb 5e 57 4d c9 27 d1 d3 9d 8d 33 81 2c a4 d3 | 33 18 34 ba 70 c0 4e db 93 7e 63 aa a0 7c 0c d8 | 58 bb 34 17 17 c8 02 ce 46 36 35 0d e3 11 4b 30 | 1d 03 9e e4 eb e6 8b 02 f7 6d 1d e9 aa 79 60 b7 | d4 13 77 0f 32 ab 60 78 88 c5 5b 07 88 f2 6d a1 | 44 4c 93 75 e5 b0 62 83 5e e9 51 b2 c1 10 9a a0 | aa f7 46 69 47 3e 3f 37 87 f0 ab 5a 01 68 1b 0e | 02 31 bd d8 36 34 0e c3 5c 83 d7 7e 22 d3 65 5e | 6d eb a2 e0 48 71 5a 75 dc fa 38 42 4f 7b 2a a0 | fd 67 f2 5c 1d c6 f9 37 63 b0 fb 35 36 f2 63 4e | 11 97 7b 38 97 9c 0b 4c 3f b1 70 a2 d3 e1 0b f5 | f2 b1 d5 89 50 5d 2e 33 ec dc 91 b1 70 bc 71 57 | ed 8b ee d5 4f 42 33 c0 a3 ef da ad 29 00 00 24 | 55 71 93 f9 ad de 90 b9 18 da 88 2f a2 1d 9d cd | a9 bc 36 55 c2 11 bf 33 6b 2e 76 c2 38 86 f0 27 | 29 00 00 08 00 00 40 2e 29 00 00 1c 00 00 40 04 | 4f 05 47 6c ff d4 74 0b 5d 82 8c 36 74 4b de 20 | 72 d9 58 55 26 00 00 1c 00 00 40 05 d3 06 21 27 | 42 76 0d 01 d1 13 b1 17 a7 96 db 18 73 35 e7 a8 | 00 00 00 05 04 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (0x0) | length: 437 (0x1b5) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response | State DB: found IKEv2 state #1 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) | start processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | [RE]START processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | #1 is idle | #1 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 40 (0x28) | processing payload: ISAKMP_NEXT_v2SA (len=36) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (0x108) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (0x24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (0x8) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (0x1c) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2CERTREQ (0x26) | flags: none (0x0) | length: 28 (0x1c) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2CERTREQ) | ***parse IKEv2 Certificate Request Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 5 (0x5) | ikev2 cert encoding: CERT_X509_SIGNATURE (0x4) | processing payload: ISAKMP_NEXT_v2CERTREQ (len=0) | State DB: re-hashing IKEv2 state #1 IKE SPIi and SPI[ir] | #1 in state PARENT_I1: sent v2I1, expected v2R1 | selected state microcode Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH | Now let's proceed with state specific processing | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH | ikev2 parent inR1: calculating g^{xy} in order to send I2 | using existing local IKE proposals for connection ikev2-westnet-eastnet-x509-cr (IKE SA initiator accepting remote proposal): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | Comparing remote proposals against IKE initiator (accepting) 4 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 2 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+DH; optional: INTEG | local proposal 2 type ENCR has 1 transforms | local proposal 2 type PRF has 2 transforms | local proposal 2 type INTEG has 1 transforms | local proposal 2 type DH has 8 transforms | local proposal 2 type ESN has 0 transforms | local proposal 2 transforms: required: ENCR+PRF+DH; optional: INTEG | local proposal 3 type ENCR has 1 transforms | local proposal 3 type PRF has 2 transforms | local proposal 3 type INTEG has 2 transforms | local proposal 3 type DH has 8 transforms | local proposal 3 type ESN has 0 transforms | local proposal 3 transforms: required: ENCR+PRF+INTEG+DH; optional: none | local proposal 4 type ENCR has 1 transforms | local proposal 4 type PRF has 2 transforms | local proposal 4 type INTEG has 2 transforms | local proposal 4 type DH has 8 transforms | local proposal 4 type ESN has 0 transforms | local proposal 4 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 36 (0x24) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 3 (0x3) | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 4 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (0xc) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | remote proposal 1 transform 0 (ENCR=AES_GCM_C_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (0x8) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | remote proposal 1 transform 1 (PRF=HMAC_SHA2_512) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (0x8) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 2 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | remote proposal 1 proposed transforms: ENCR+PRF+DH; matched: ENCR+PRF+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+DH transforms to local proposal 1; required: ENCR+PRF+DH; optional: INTEG; matched: ENCR+PRF+DH | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512;DH=MODP2048[first-match] | converting proposal to internal trans attrs | natd_hash: hasher=0x562463c03800(20) | natd_hash: icookie= 79 f6 25 53 15 ca 61 32 | natd_hash: rcookie= 86 6d 30 a6 12 dd 70 c0 | natd_hash: ip= c0 01 02 2d | natd_hash: port=500 | natd_hash: hash= d3 06 21 27 42 76 0d 01 d1 13 b1 17 a7 96 db 18 | natd_hash: hash= 73 35 e7 a8 | natd_hash: hasher=0x562463c03800(20) | natd_hash: icookie= 79 f6 25 53 15 ca 61 32 | natd_hash: rcookie= 86 6d 30 a6 12 dd 70 c0 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 4f 05 47 6c ff d4 74 0b 5d 82 8c 36 74 4b de 20 | natd_hash: hash= 72 d9 58 55 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA2_512 integ=NONE cipherkey=AES_GCM_16 | adding ikev2_inR1outI2 KE work-order 2 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_PARENT_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x562464838a28 | free_event_entry: release EVENT_RETRANSMIT-pe@0x562464839908 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x562464839908 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x7fe488002888 size 128 | #1 spent 0.141 milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH in ikev2_process_state_packet() | [RE]START processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #1 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND | suspending state #1 and saving MD | #1 is busy; has a suspended MD | [RE]START processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in log_stf_suspend() at ikev2.c:3269) | "ikev2-westnet-eastnet-x509-cr" #1 complete v2 state STATE_PARENT_I1 transition with STF_SUSPEND suspended from complete_v2_state_transition:3451 | stop processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.303 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.311 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 2 resuming | crypto helper 2 starting work-order 2 for state #1 | crypto helper 2 doing compute dh (V2) (ikev2_inR1outI2 KE); request ID 2 | calculating skeyseed using prf=sha2_512 integ=none cipherkey-size=32 salt-size=4 | crypto helper 2 finished compute dh (V2) (ikev2_inR1outI2 KE); request ID 2 time elapsed 0.000801 seconds | (#1) spent 0.803 milliseconds in crypto helper computing work-order 2: ikev2_inR1outI2 KE (pcr) | crypto helper 2 sending results from work-order 2 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7fe480000f48 size 128 | crypto helper 2 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 2 replies to request ID 2 | calling continuation function 0x562463b2eb50 | ikev2_parent_inR1outI2_continue for #1: calculating g^{xy}, sending I2 | creating state object #2 at 0x56246483e2b8 | State DB: adding IKEv2 state #2 in UNDEFINED | pstats #2 ikev2.child started | duplicating state object #1 "ikev2-westnet-eastnet-x509-cr" as #2 for IPSEC SA | #2 setting local endpoint to 192.1.2.45:500 from #1.st_localport (in duplicate_state() at state.c:1484) | Message ID: init_child #1.#2; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1; child: wip.initiator=0->-1 wip.responder=0->-1 | Message ID: switch-from #1 response 0; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1 wip.initiator=0->-1 wip.responder=-1 | Message ID: switch-to #1.#2 response 0; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1; child: wip.initiator=-1->0 wip.responder=-1 | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7fe488002888 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x562464839908 | event_schedule: new EVENT_SA_REPLACE-pe@0x562464839908 | inserting event EVENT_SA_REPLACE, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x7fe488002888 size 128 | parent state #1: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) | **emit ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | IKEv2 CERT: send a certificate? | IKEv2 CERT: OK to send a certificate (always) | IDr payload will NOT be sent | ****emit IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_DER_ASN1_DN (0x9) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' | emitting 207 raw bytes of my identity into IKEv2 Identification - Initiator - Payload | my identity 30 81 cc 31 0b 30 09 06 03 55 04 06 13 02 43 41 | my identity 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | my identity 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | my identity 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | my identity 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | my identity 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | my identity 6e 74 31 2f 30 2d 06 03 55 04 03 0c 26 77 65 73 | my identity 74 2d 65 6b 75 43 72 69 74 69 63 61 6c 2e 74 65 | my identity 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e | my identity 6f 72 67 31 3a 30 38 06 09 2a 86 48 86 f7 0d 01 | my identity 09 01 16 2b 75 73 65 72 2d 77 65 73 74 2d 65 6b | my identity 75 43 72 69 74 69 63 61 6c 40 74 65 73 74 69 6e | my identity 67 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 | emitting length of IKEv2 Identification - Initiator - Payload: 215 | Sending [CERT] of certificate: E=user-west-ekuCritical@testing.libreswan.org,CN=west-ekuCritical.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | ****emit IKEv2 Certificate Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ikev2 cert encoding: CERT_X509_SIGNATURE (0x4) | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Certificate Payload (37:ISAKMP_NEXT_v2CERT) | next payload chain: saving location 'IKEv2 Certificate Payload'.'next payload type' in 'reply packet' | emitting 1266 raw bytes of CERT into IKEv2 Certificate Payload | CERT 30 82 04 ee 30 82 04 57 a0 03 02 01 02 02 01 1b | CERT 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 | CERT 81 ac 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 | CERT 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 69 | CERT 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 6f | CERT 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c 69 | CERT 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 0b | CERT 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 6e | CERT 74 31 25 30 23 06 03 55 04 03 0c 1c 4c 69 62 72 | CERT 65 73 77 61 6e 20 74 65 73 74 20 43 41 20 66 6f | CERT 72 20 6d 61 69 6e 63 61 31 24 30 22 06 09 2a 86 | CERT 48 86 f7 0d 01 09 01 16 15 74 65 73 74 69 6e 67 | CERT 40 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 22 | CERT 18 0f 32 30 31 39 30 38 32 34 30 39 30 37 35 33 | CERT 5a 18 0f 32 30 32 32 30 38 32 33 30 39 30 37 35 | CERT 33 5a 30 81 cc 31 0b 30 09 06 03 55 04 06 13 02 | CERT 43 41 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 | CERT 61 72 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 | CERT 6f 72 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c | CERT 09 4c 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 | CERT 55 04 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 | CERT 6d 65 6e 74 31 2f 30 2d 06 03 55 04 03 0c 26 77 | CERT 65 73 74 2d 65 6b 75 43 72 69 74 69 63 61 6c 2e | CERT 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 61 | CERT 6e 2e 6f 72 67 31 3a 30 38 06 09 2a 86 48 86 f7 | CERT 0d 01 09 01 16 2b 75 73 65 72 2d 77 65 73 74 2d | CERT 65 6b 75 43 72 69 74 69 63 61 6c 40 74 65 73 74 | CERT 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 | CERT 67 30 82 01 a2 30 0d 06 09 2a 86 48 86 f7 0d 01 | CERT 01 01 05 00 03 82 01 8f 00 30 82 01 8a 02 82 01 | CERT 81 00 bd 09 77 bb 3d 39 45 8b 81 1c 36 f8 84 73 | CERT c9 45 b4 f0 97 a8 7b 49 26 e3 2f 73 98 c9 58 d5 | CERT 85 8a 3d 1f f4 77 8f 49 33 a4 d2 99 66 f5 82 8a | CERT 4e 3f e3 37 3f 12 64 de f9 42 ba 10 49 63 05 68 | CERT 81 28 a5 18 76 c3 5d a3 c9 86 cc c9 4c 14 4a a4 | CERT 26 7b 54 dd 57 bf 5a 67 64 69 6b 90 52 e3 1b 3f | CERT 03 c7 4e 43 37 79 c4 cd 16 22 e3 a7 8c 2c c4 8f | CERT 6d b0 e0 ff 03 7d e7 d1 71 f1 20 c4 45 21 50 e0 | CERT ca 92 a1 79 43 8a e3 3e 0b 44 bb 46 e8 06 25 2d | CERT c3 77 c9 f2 87 85 aa e0 bd b4 9c 16 67 44 64 4d | CERT f2 36 4c 37 ec ac 93 a8 1b 93 d7 cc fd e7 bb a3 | CERT 26 64 f4 90 f9 6a 2f 40 7e ed 84 e8 9e b8 56 60 | CERT 9c 0f 61 56 f4 62 86 29 21 6f bc 09 a6 97 05 f1 | CERT 24 e0 d6 42 cf 01 af 20 72 4f 5d 83 42 10 46 92 | CERT 08 c2 d1 c1 6e 75 ee a0 51 14 e9 2e 6a 26 d9 d0 | CERT 5f 64 fb 4c b6 99 75 21 cc 66 25 fc 8a ed e8 47 | CERT 8d 03 fb 8c e4 ae 1d 01 1a 03 68 1d 26 da 3d 5f | CERT f2 9f cd 81 73 78 2d 9f 13 63 cc 36 e4 be 74 eb | CERT 16 d0 ac fb 36 ba d7 fe 85 93 80 51 d7 62 ec c6 | CERT bc fe 1a 1c 0e 41 32 6c 4f 0b 73 78 14 21 cb c2 | CERT 38 88 59 4c bf 14 35 65 6c 21 4e 99 17 d0 f0 76 | CERT ef 26 5c c3 08 d2 35 c3 81 07 01 19 1a aa a8 e0 | CERT bb 28 33 e3 4e 75 5f 38 c3 df ed cc ac 24 39 e3 | CERT f0 d6 47 df c8 50 2b d6 df 54 4d 20 07 2b d1 77 | CERT d5 e7 02 03 01 00 01 a3 81 f5 30 81 f2 30 09 06 | CERT 03 55 1d 13 04 02 30 00 30 31 06 03 55 1d 11 04 | CERT 2a 30 28 82 26 77 65 73 74 2d 65 6b 75 43 72 69 | CERT 74 69 63 61 6c 2e 74 65 73 74 69 6e 67 2e 6c 69 | CERT 62 72 65 73 77 61 6e 2e 6f 72 67 30 0e 06 03 55 | CERT 1d 0f 01 01 ff 04 04 03 02 07 80 30 20 06 03 55 | CERT 1d 25 01 01 ff 04 16 30 14 06 08 2b 06 01 05 05 | CERT 07 03 01 06 08 2b 06 01 05 05 07 03 02 30 41 06 | CERT 08 2b 06 01 05 05 07 01 01 04 35 30 33 30 31 06 | CERT 08 2b 06 01 05 05 07 30 01 86 25 68 74 74 70 3a | CERT 2f 2f 6e 69 63 2e 74 65 73 74 69 6e 67 2e 6c 69 | CERT 62 72 65 73 77 61 6e 2e 6f 72 67 3a 32 35 36 30 | CERT 30 3d 06 03 55 1d 1f 04 36 30 34 30 32 a0 30 a0 | CERT 2e 86 2c 68 74 74 70 3a 2f 2f 6e 69 63 2e 74 65 | CERT 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e | CERT 6f 72 67 2f 72 65 76 6f 6b 65 64 2e 63 72 6c 30 | CERT 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 03 81 | CERT 81 00 21 6d 8b 73 7c d3 ce 2f a4 13 71 6e 03 d5 | CERT 49 f1 4f 7f 9e 22 78 a4 ed 98 ab 83 d0 07 25 c5 | CERT e2 99 b0 0a 3b 10 58 51 5f 40 4f cb ec 48 d2 e3 | CERT a1 54 ae 13 7c 8a 99 07 b9 14 46 e6 58 87 53 2b | CERT 76 2d fe 76 4a 10 5b 1e 6d 6d 0f 19 6a 66 8d 06 | CERT b8 a6 3e 87 fe b2 31 12 fa ca a5 02 b0 09 5a cf | CERT 3f c7 8b 0e 3a 8d 32 e2 58 03 86 78 f9 29 2e 88 | CERT 71 e6 c5 5f 6c c9 07 c5 6a 5f 7d a1 f1 17 04 51 | CERT 7f fa | emitting length of IKEv2 Certificate Payload: 1271 | IKEv2 CERTREQ: send a cert request? | IKEv2 CERTREQ: no CA DN known to send | not sending INITIAL_CONTACT | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_RSA (0x1) | next payload chain: setting previous 'IKEv2 Certificate Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=west-ekuCritical.testing.libreswan.org, E=user-west-ekuCritical@testing.libreswan.org->%fromcert of kind PKK_RSA | searching for certificate PKK_RSA:AwEAAb0Jd vs PKK_RSA:AwEAAb0Jd | #1 spent 5.38 milliseconds in ikev2_calculate_rsa_hash() calling sign_hash_RSA() | emitting 384 raw bytes of rsa signature into IKEv2 Authentication Payload | rsa signature 83 50 4b a3 b6 81 9f 56 cf 98 6e 60 b0 2b 79 1d | rsa signature 27 74 82 06 73 80 f0 f5 bc 25 83 d1 4b 01 f0 03 | rsa signature 71 1a d1 f2 81 c1 fc a2 39 d1 1b 49 15 f2 f1 03 | rsa signature 96 fc a3 73 3e 40 82 e3 d4 20 08 11 67 7e d6 d4 | rsa signature de 1f 2d b0 e6 a8 63 11 43 97 2f 24 b2 67 69 f1 | rsa signature 6d 02 ca ec 73 ff b9 67 25 9e 65 ed 97 ec 8b 13 | rsa signature 36 6b 46 31 04 c8 e2 d8 f9 df 3d 76 ad 82 8d 5a | rsa signature 30 88 14 89 a9 28 83 c4 2a 90 5d 10 e0 72 06 4c | rsa signature 2c c8 62 38 03 4a 82 97 11 13 31 6e d1 41 87 98 | rsa signature f1 7c 90 4d 88 c3 59 4b e3 3e c6 dc 18 a3 54 0f | rsa signature 97 9e d9 00 5d 84 8c a2 8c 9c 6f 8d 2e 3d 9d 54 | rsa signature 71 5e 44 2a 81 9a bc 93 74 51 53 84 7e 63 a2 83 | rsa signature 05 5d e9 77 79 ef 09 b6 53 5d e4 1b e4 60 32 d4 | rsa signature 47 32 1a fd 04 d3 38 b5 1e 9f be 01 ab 16 09 22 | rsa signature 3f b0 9c ba 9d d5 26 bd bc 63 44 90 71 ff 3b 93 | rsa signature c7 a3 62 2a cb 2d 93 42 27 cc 18 0e 75 a3 33 88 | rsa signature bf 8b 25 27 32 11 9c b4 0b 31 b7 a3 49 cd 3e 9a | rsa signature 75 0d ac 85 d2 49 10 30 11 fe b7 f2 4b bd 29 f2 | rsa signature a5 63 f1 76 95 0d 70 5f 84 6f 0b 3b f4 7d 9e 0b | rsa signature ec ec 94 ea 01 67 99 dc 7a 0e 34 66 80 5c 00 d5 | rsa signature 03 21 a3 50 af 4d 18 01 52 f7 5f a2 18 1f 24 4a | rsa signature f1 54 4e 56 f7 80 89 03 07 fc cb b2 e8 1c 8d 46 | rsa signature a5 2f a7 41 2e 61 d4 d1 c6 39 4b aa 9b 9d 3f 15 | rsa signature 93 94 77 d3 7d f0 81 ae 3a e6 e0 10 91 d1 40 44 | #1 spent 5.52 milliseconds in ikev2_calculate_rsa_hash() | emitting length of IKEv2 Authentication Payload: 392 | getting first pending from state #1 | netlink_get_spi: allocated 0xefede225 for esp.0@192.1.2.45 | constructing ESP/AH proposals with all DH removed for ikev2-westnet-eastnet-x509-cr (IKE SA initiator emitting ESP/AH proposals) | converting proposal AES_GCM_16_256-NONE to ikev2 ... | ... ikev2_proposal: 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED | converting proposal AES_GCM_16_128-NONE to ikev2 ... | ... ikev2_proposal: 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED | converting proposal AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ... | ... ikev2_proposal: 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED | converting proposal AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ... | ... ikev2_proposal: 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED "ikev2-westnet-eastnet-x509-cr": constructed local ESP/AH proposals for ikev2-westnet-eastnet-x509-cr (IKE SA initiator emitting ESP/AH proposals): 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED | Emitting ikev2_proposals ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discarding INTEG=NONE | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 2 (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi ef ed e2 25 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | discarding INTEG=NONE | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 32 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding INTEG=NONE | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 2 (0x2) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 2 (0x2) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi ef ed e2 25 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | discarding INTEG=NONE | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 32 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 3 (0x3) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 4 (0x4) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi ef ed e2 25 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 48 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 4 (0x4) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 4 (0x4) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi ef ed e2 25 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 48 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 164 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (0x1) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: 0 (0x0) | start port: 0 (0x0) | end port: 65535 (0xffff) | emitting 4 raw bytes of ipv4 start into IKEv2 Traffic Selector | ipv4 start c0 00 01 00 | emitting 4 raw bytes of ipv4 end into IKEv2 Traffic Selector | ipv4 end c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (0x1) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: 0 (0x0) | start port: 0 (0x0) | end port: 65535 (0xffff) | emitting 4 raw bytes of ipv4 start into IKEv2 Traffic Selector | ipv4 start c0 00 02 00 | emitting 4 raw bytes of ipv4 end into IKEv2 Traffic Selector | ipv4 end c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE | Initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 2119 | emitting length of ISAKMP Message: 2147 | **parse ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | length: 2147 (0x863) | **parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 2119 (0x847) | **emit ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | fragment number: 1 (0x1) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 478 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 25 00 00 d7 09 00 00 00 30 81 cc 31 0b 30 09 06 | cleartext fragment 03 55 04 06 13 02 43 41 31 10 30 0e 06 03 55 04 | cleartext fragment 08 0c 07 4f 6e 74 61 72 69 6f 31 10 30 0e 06 03 | cleartext fragment 55 04 07 0c 07 54 6f 72 6f 6e 74 6f 31 12 30 10 | cleartext fragment 06 03 55 04 0a 0c 09 4c 69 62 72 65 73 77 61 6e | cleartext fragment 31 18 30 16 06 03 55 04 0b 0c 0f 54 65 73 74 20 | cleartext fragment 44 65 70 61 72 74 6d 65 6e 74 31 2f 30 2d 06 03 | cleartext fragment 55 04 03 0c 26 77 65 73 74 2d 65 6b 75 43 72 69 | cleartext fragment 74 69 63 61 6c 2e 74 65 73 74 69 6e 67 2e 6c 69 | cleartext fragment 62 72 65 73 77 61 6e 2e 6f 72 67 31 3a 30 38 06 | cleartext fragment 09 2a 86 48 86 f7 0d 01 09 01 16 2b 75 73 65 72 | cleartext fragment 2d 77 65 73 74 2d 65 6b 75 43 72 69 74 69 63 61 | cleartext fragment 6c 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | cleartext fragment 77 61 6e 2e 6f 72 67 27 00 04 f7 04 30 82 04 ee | cleartext fragment 30 82 04 57 a0 03 02 01 02 02 01 1b 30 0d 06 09 | cleartext fragment 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 ac 31 0b | cleartext fragment 30 09 06 03 55 04 06 13 02 43 41 31 10 30 0e 06 | cleartext fragment 03 55 04 08 0c 07 4f 6e 74 61 72 69 6f 31 10 30 | cleartext fragment 0e 06 03 55 04 07 0c 07 54 6f 72 6f 6e 74 6f 31 | cleartext fragment 12 30 10 06 03 55 04 0a 0c 09 4c 69 62 72 65 73 | cleartext fragment 77 61 6e 31 18 30 16 06 03 55 04 0b 0c 0f 54 65 | cleartext fragment 73 74 20 44 65 70 61 72 74 6d 65 6e 74 31 25 30 | cleartext fragment 23 06 03 55 04 03 0c 1c 4c 69 62 72 65 73 77 61 | cleartext fragment 6e 20 74 65 73 74 20 43 41 20 66 6f 72 20 6d 61 | cleartext fragment 69 6e 63 61 31 24 30 22 06 09 2a 86 48 86 f7 0d | cleartext fragment 01 09 01 16 15 74 65 73 74 69 6e 67 40 6c 69 62 | cleartext fragment 72 65 73 77 61 6e 2e 6f 72 67 30 22 18 0f 32 30 | cleartext fragment 31 39 30 38 32 34 30 39 30 37 35 33 5a 18 0f 32 | cleartext fragment 30 32 32 30 38 32 33 30 39 30 37 35 33 5a 30 81 | cleartext fragment cc 31 0b 30 09 06 03 55 04 06 13 02 43 41 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 511 | emitting length of ISAKMP Message: 539 | **emit ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 2 (0x2) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 478 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | cleartext fragment 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | cleartext fragment 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | cleartext fragment 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | cleartext fragment 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | cleartext fragment 6e 74 31 2f 30 2d 06 03 55 04 03 0c 26 77 65 73 | cleartext fragment 74 2d 65 6b 75 43 72 69 74 69 63 61 6c 2e 74 65 | cleartext fragment 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e | cleartext fragment 6f 72 67 31 3a 30 38 06 09 2a 86 48 86 f7 0d 01 | cleartext fragment 09 01 16 2b 75 73 65 72 2d 77 65 73 74 2d 65 6b | cleartext fragment 75 43 72 69 74 69 63 61 6c 40 74 65 73 74 69 6e | cleartext fragment 67 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 | cleartext fragment 82 01 a2 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 | cleartext fragment 05 00 03 82 01 8f 00 30 82 01 8a 02 82 01 81 00 | cleartext fragment bd 09 77 bb 3d 39 45 8b 81 1c 36 f8 84 73 c9 45 | cleartext fragment b4 f0 97 a8 7b 49 26 e3 2f 73 98 c9 58 d5 85 8a | cleartext fragment 3d 1f f4 77 8f 49 33 a4 d2 99 66 f5 82 8a 4e 3f | cleartext fragment e3 37 3f 12 64 de f9 42 ba 10 49 63 05 68 81 28 | cleartext fragment a5 18 76 c3 5d a3 c9 86 cc c9 4c 14 4a a4 26 7b | cleartext fragment 54 dd 57 bf 5a 67 64 69 6b 90 52 e3 1b 3f 03 c7 | cleartext fragment 4e 43 37 79 c4 cd 16 22 e3 a7 8c 2c c4 8f 6d b0 | cleartext fragment e0 ff 03 7d e7 d1 71 f1 20 c4 45 21 50 e0 ca 92 | cleartext fragment a1 79 43 8a e3 3e 0b 44 bb 46 e8 06 25 2d c3 77 | cleartext fragment c9 f2 87 85 aa e0 bd b4 9c 16 67 44 64 4d f2 36 | cleartext fragment 4c 37 ec ac 93 a8 1b 93 d7 cc fd e7 bb a3 26 64 | cleartext fragment f4 90 f9 6a 2f 40 7e ed 84 e8 9e b8 56 60 9c 0f | cleartext fragment 61 56 f4 62 86 29 21 6f bc 09 a6 97 05 f1 24 e0 | cleartext fragment d6 42 cf 01 af 20 72 4f 5d 83 42 10 46 92 08 c2 | cleartext fragment d1 c1 6e 75 ee a0 51 14 e9 2e 6a 26 d9 d0 5f 64 | cleartext fragment fb 4c b6 99 75 21 cc 66 25 fc 8a ed e8 47 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 511 | emitting length of ISAKMP Message: 539 | **emit ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 3 (0x3) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 478 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 8d 03 fb 8c e4 ae 1d 01 1a 03 68 1d 26 da 3d 5f | cleartext fragment f2 9f cd 81 73 78 2d 9f 13 63 cc 36 e4 be 74 eb | cleartext fragment 16 d0 ac fb 36 ba d7 fe 85 93 80 51 d7 62 ec c6 | cleartext fragment bc fe 1a 1c 0e 41 32 6c 4f 0b 73 78 14 21 cb c2 | cleartext fragment 38 88 59 4c bf 14 35 65 6c 21 4e 99 17 d0 f0 76 | cleartext fragment ef 26 5c c3 08 d2 35 c3 81 07 01 19 1a aa a8 e0 | cleartext fragment bb 28 33 e3 4e 75 5f 38 c3 df ed cc ac 24 39 e3 | cleartext fragment f0 d6 47 df c8 50 2b d6 df 54 4d 20 07 2b d1 77 | cleartext fragment d5 e7 02 03 01 00 01 a3 81 f5 30 81 f2 30 09 06 | cleartext fragment 03 55 1d 13 04 02 30 00 30 31 06 03 55 1d 11 04 | cleartext fragment 2a 30 28 82 26 77 65 73 74 2d 65 6b 75 43 72 69 | cleartext fragment 74 69 63 61 6c 2e 74 65 73 74 69 6e 67 2e 6c 69 | cleartext fragment 62 72 65 73 77 61 6e 2e 6f 72 67 30 0e 06 03 55 | cleartext fragment 1d 0f 01 01 ff 04 04 03 02 07 80 30 20 06 03 55 | cleartext fragment 1d 25 01 01 ff 04 16 30 14 06 08 2b 06 01 05 05 | cleartext fragment 07 03 01 06 08 2b 06 01 05 05 07 03 02 30 41 06 | cleartext fragment 08 2b 06 01 05 05 07 01 01 04 35 30 33 30 31 06 | cleartext fragment 08 2b 06 01 05 05 07 30 01 86 25 68 74 74 70 3a | cleartext fragment 2f 2f 6e 69 63 2e 74 65 73 74 69 6e 67 2e 6c 69 | cleartext fragment 62 72 65 73 77 61 6e 2e 6f 72 67 3a 32 35 36 30 | cleartext fragment 30 3d 06 03 55 1d 1f 04 36 30 34 30 32 a0 30 a0 | cleartext fragment 2e 86 2c 68 74 74 70 3a 2f 2f 6e 69 63 2e 74 65 | cleartext fragment 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e | cleartext fragment 6f 72 67 2f 72 65 76 6f 6b 65 64 2e 63 72 6c 30 | cleartext fragment 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 03 81 | cleartext fragment 81 00 21 6d 8b 73 7c d3 ce 2f a4 13 71 6e 03 d5 | cleartext fragment 49 f1 4f 7f 9e 22 78 a4 ed 98 ab 83 d0 07 25 c5 | cleartext fragment e2 99 b0 0a 3b 10 58 51 5f 40 4f cb ec 48 d2 e3 | cleartext fragment a1 54 ae 13 7c 8a 99 07 b9 14 46 e6 58 87 53 2b | cleartext fragment 76 2d fe 76 4a 10 5b 1e 6d 6d 0f 19 6a 66 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 511 | emitting length of ISAKMP Message: 539 | **emit ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 4 (0x4) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 478 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 8d 06 b8 a6 3e 87 fe b2 31 12 fa ca a5 02 b0 09 | cleartext fragment 5a cf 3f c7 8b 0e 3a 8d 32 e2 58 03 86 78 f9 29 | cleartext fragment 2e 88 71 e6 c5 5f 6c c9 07 c5 6a 5f 7d a1 f1 17 | cleartext fragment 04 51 7f fa 21 00 01 88 01 00 00 00 83 50 4b a3 | cleartext fragment b6 81 9f 56 cf 98 6e 60 b0 2b 79 1d 27 74 82 06 | cleartext fragment 73 80 f0 f5 bc 25 83 d1 4b 01 f0 03 71 1a d1 f2 | cleartext fragment 81 c1 fc a2 39 d1 1b 49 15 f2 f1 03 96 fc a3 73 | cleartext fragment 3e 40 82 e3 d4 20 08 11 67 7e d6 d4 de 1f 2d b0 | cleartext fragment e6 a8 63 11 43 97 2f 24 b2 67 69 f1 6d 02 ca ec | cleartext fragment 73 ff b9 67 25 9e 65 ed 97 ec 8b 13 36 6b 46 31 | cleartext fragment 04 c8 e2 d8 f9 df 3d 76 ad 82 8d 5a 30 88 14 89 | cleartext fragment a9 28 83 c4 2a 90 5d 10 e0 72 06 4c 2c c8 62 38 | cleartext fragment 03 4a 82 97 11 13 31 6e d1 41 87 98 f1 7c 90 4d | cleartext fragment 88 c3 59 4b e3 3e c6 dc 18 a3 54 0f 97 9e d9 00 | cleartext fragment 5d 84 8c a2 8c 9c 6f 8d 2e 3d 9d 54 71 5e 44 2a | cleartext fragment 81 9a bc 93 74 51 53 84 7e 63 a2 83 05 5d e9 77 | cleartext fragment 79 ef 09 b6 53 5d e4 1b e4 60 32 d4 47 32 1a fd | cleartext fragment 04 d3 38 b5 1e 9f be 01 ab 16 09 22 3f b0 9c ba | cleartext fragment 9d d5 26 bd bc 63 44 90 71 ff 3b 93 c7 a3 62 2a | cleartext fragment cb 2d 93 42 27 cc 18 0e 75 a3 33 88 bf 8b 25 27 | cleartext fragment 32 11 9c b4 0b 31 b7 a3 49 cd 3e 9a 75 0d ac 85 | cleartext fragment d2 49 10 30 11 fe b7 f2 4b bd 29 f2 a5 63 f1 76 | cleartext fragment 95 0d 70 5f 84 6f 0b 3b f4 7d 9e 0b ec ec 94 ea | cleartext fragment 01 67 99 dc 7a 0e 34 66 80 5c 00 d5 03 21 a3 50 | cleartext fragment af 4d 18 01 52 f7 5f a2 18 1f 24 4a f1 54 4e 56 | cleartext fragment f7 80 89 03 07 fc cb b2 e8 1c 8d 46 a5 2f a7 41 | cleartext fragment 2e 61 d4 d1 c6 39 4b aa 9b 9d 3f 15 93 94 77 d3 | cleartext fragment 7d f0 81 ae 3a e6 e0 10 91 d1 40 44 2c 00 00 a4 | cleartext fragment 02 00 00 20 01 03 04 02 ef ed e2 25 03 00 00 0c | cleartext fragment 01 00 00 14 80 0e 01 00 00 00 00 08 05 00 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 511 | emitting length of ISAKMP Message: 539 | **emit ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 5 (0x5) | total fragments: 5 (0x5) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 178 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 00 00 02 00 00 20 02 03 04 02 ef ed e2 25 03 00 | cleartext fragment 00 0c 01 00 00 14 80 0e 00 80 00 00 00 08 05 00 | cleartext fragment 00 00 02 00 00 30 03 03 04 04 ef ed e2 25 03 00 | cleartext fragment 00 0c 01 00 00 0c 80 0e 01 00 03 00 00 08 03 00 | cleartext fragment 00 0e 03 00 00 08 03 00 00 0c 00 00 00 08 05 00 | cleartext fragment 00 00 00 00 00 30 04 03 04 04 ef ed e2 25 03 00 | cleartext fragment 00 0c 01 00 00 0c 80 0e 00 80 03 00 00 08 03 00 | cleartext fragment 00 0e 03 00 00 08 03 00 00 0c 00 00 00 08 05 00 | cleartext fragment 00 00 2d 00 00 18 01 00 00 00 07 00 00 10 00 00 | cleartext fragment ff ff c0 00 01 00 c0 00 01 ff 00 00 00 18 01 00 | cleartext fragment 00 00 07 00 00 10 00 00 ff ff c0 00 02 00 c0 00 | cleartext fragment 02 ff | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 211 | emitting length of ISAKMP Message: 239 | suspend processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | start processing: state #2 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #2 complete_v2_state_transition() md.from_state=PARENT_I1 md.svm.state[from]=PARENT_I1 UNDEFINED->PARENT_I2 with status STF_OK | IKEv2: transition from state STATE_PARENT_I1 to state STATE_PARENT_I2 | child state #2: UNDEFINED(ignore) => PARENT_I2(open IKE SA) | Message ID: updating counters for #2 to 0 after switching state | Message ID: recv #1.#2 response 0; ike: initiator.sent=0 initiator.recv=-1->0 responder.sent=-1 responder.recv=-1; child: wip.initiator=0->-1 wip.responder=-1 | Message ID: sent #1.#2 request 1; ike: initiator.sent=0->1 initiator.recv=0 responder.sent=-1 responder.recv=-1; child: wip.initiator=-1->1 wip.responder=-1 "ikev2-westnet-eastnet-x509-cr" #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048} | sending V2 reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending fragments ... | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 79 f6 25 53 15 ca 61 32 86 6d 30 a6 12 dd 70 c0 | 35 20 23 08 00 00 00 01 00 00 02 1b 23 00 01 ff | 00 01 00 05 13 5c 1a fc ab ff 33 ff 29 06 4a 83 | cc b8 a2 1b e1 69 26 16 ef 64 4a b1 be d3 72 8e | d4 90 cd 7f c6 d4 43 e4 e4 cf 2e 22 4b a1 fc 5c | c5 c4 69 45 12 ef 72 09 60 f9 ee 8b 7b a0 9b 7b | a8 a2 1b e0 e6 01 c9 be 8a d3 e7 3e 3f 6c ff 50 | 18 76 d8 ff 0f 27 3a 61 91 9e 78 af d6 56 ed d7 | 9f 80 0e 01 82 c5 d8 62 98 e9 0e c2 45 b6 6c e3 | 68 a0 d1 4f e9 c8 7d b1 8d f7 ba 3e 8a 7f 38 6a | c1 20 17 ad 4f ed 53 36 be 91 c4 f6 62 c8 24 b2 | dd 7f 38 81 01 92 18 21 bf f7 65 e5 c9 a4 88 9b | 8a 8e 5a b4 79 bb b4 f8 8a 0e f4 04 c7 d5 3b 59 | ec bc 5f f5 d0 36 94 79 28 f6 fc 9e 93 1e 63 ad | a0 0a 04 4f c7 f1 4a 6c 5e 9e f6 48 a5 33 5d 50 | 31 31 51 b5 94 ce c5 0a 66 91 8c 3b 9a dc 6c cb | 40 17 32 0e d3 eb d6 ad c2 23 5f 2f 0e e2 d9 0a | c9 40 b4 a6 97 a4 41 76 98 4f e5 38 bf 98 39 84 | 34 92 ed 6c cb 16 61 1a 70 8d 7a 44 24 9b 1d 97 | 51 f2 e9 ea c3 dd 13 32 3c 20 2d 79 57 49 59 2e | 50 05 b1 4f f1 26 8f 62 8d 73 94 1c ae 84 0a 6f | 6d 5c 76 9a 29 73 ce 70 6e 84 17 a3 60 fd 3b d1 | e4 8c cc 29 93 f4 9e 94 fd b3 dc 3e 1f f5 d5 a9 | 07 bb cc 94 cf 8a cd 5e 17 9d 82 d4 8e 5e c1 db | 1b ad 25 3b ab 69 d9 7f 21 05 c4 94 f8 85 f5 95 | 1d dc dd 65 81 83 c1 47 9d e6 fe ac f8 f0 b5 3f | b5 84 43 d7 4a eb 14 e5 d6 f1 13 bc ba 9c cf a1 | 9b 0a e9 d5 d4 ee 90 97 99 7d a6 0b 13 12 a5 73 | b7 a4 f4 2b eb 55 5a ef 5c a8 e0 fd d5 bf b9 3e | 6b a6 b9 07 55 ab 7b bb af cc 54 9f 02 76 ff 26 | e4 47 c4 c4 70 01 68 58 c2 97 19 1a 2f f9 6f b0 | b1 ed ad 25 16 c6 0d ee 0b 96 64 15 7c 1d 0e b3 | 15 08 30 f9 c0 44 48 84 45 6a 7d 89 35 5c 46 cb | dc 96 7f f4 45 13 1d 5c d7 50 0f | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 79 f6 25 53 15 ca 61 32 86 6d 30 a6 12 dd 70 c0 | 35 20 23 08 00 00 00 01 00 00 02 1b 00 00 01 ff | 00 02 00 05 d3 1b e7 96 a6 cb 3f d2 02 13 8b 43 | c4 1f ad f7 37 e4 a4 88 2b b3 90 8f 98 c2 a5 7c | be 00 7a c1 45 7d f7 eb 25 67 26 51 8c cc f9 eb | 6e aa dd 9a 03 76 7b 40 7d ec 6c b6 1e 21 78 a2 | e4 f1 97 e6 e1 b7 31 46 85 db 40 47 29 88 fd c2 | bb 2d b1 c2 56 73 9d 80 51 84 45 65 b5 26 b2 b7 | 6d 81 fc 67 df 59 10 43 43 10 ea f7 37 d3 c2 16 | 7b ce c1 b5 06 40 f3 9c f6 7a ef 08 1d 2e 07 ec | d1 e9 18 24 05 e0 37 cc 45 69 c6 64 1f 0b 1e 2a | 4e 0e 61 f2 f0 8a ce b7 75 62 ae 67 de e2 7a cd | ff 87 2c dd ae c7 5e 60 0a 34 69 1a 73 0e ea 07 | c0 09 67 57 e7 a5 06 fe e3 38 c3 c2 cd 98 34 6b | a6 12 64 28 0a 1f 9e 18 bb 3a 08 26 f6 19 35 2e | 75 22 97 df 41 e9 ae df c5 98 89 86 6d 19 55 a7 | 7a 55 60 dc c6 36 8d ff bf 19 2d 8b af 69 d0 ce | 88 90 22 f0 45 45 c2 4c 2d 8c ce 69 49 63 54 ef | c7 ae ee 0b 84 3a da 02 55 e8 86 98 51 0c ae 73 | 94 01 f1 fa f2 33 b5 58 fc 37 4d a2 f4 5c 04 92 | ed 6b f4 e7 d4 4c 29 81 2b ed 96 27 a5 b5 b0 1e | e0 2b fd c0 3a 34 e4 a5 ac fd fb 9c 54 c7 cd 05 | 36 96 f7 de 21 b9 ac f2 c8 61 1b 84 63 4a 5a a0 | 11 0a 12 22 a2 31 62 c7 f9 51 d7 9a 09 b4 a2 3c | d1 ec c3 0f 97 d8 e8 51 b1 dd fc d5 19 da cc 7a | eb 99 68 71 98 73 b5 96 80 fe 1f 44 98 84 dc 02 | c3 c2 0f 7e 5e 6f 76 25 b3 91 7d 5d ba 43 3d bf | 31 d6 6b ec 93 79 48 03 e8 a5 1d 19 e1 19 9c d8 | 35 1f 9b 03 ce 10 04 21 ea c9 b9 f7 6f ab 6d 6e | b3 49 1b 2e c5 ba b7 01 cf 48 99 69 d4 ea 87 60 | 70 23 61 2b b3 23 a8 89 5d 24 23 4a d5 e2 38 ee | 42 12 1c ee 9c 4c df ae d1 1b 11 a7 6e 75 c3 3c | 75 59 d8 32 79 32 1a 38 61 06 d4 0b ea 4b c2 25 | 7c ba e0 dd 9d 35 41 2c 8a 20 e0 | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 79 f6 25 53 15 ca 61 32 86 6d 30 a6 12 dd 70 c0 | 35 20 23 08 00 00 00 01 00 00 02 1b 00 00 01 ff | 00 03 00 05 5a 94 5d 61 12 94 11 44 e9 fe 5d b5 | e4 dc 02 ea 0b d0 5a 0f d7 fe ec c9 f5 03 1e b3 | 09 04 30 d6 a6 92 51 e6 09 c1 3c 2c 81 9e e0 01 | 9f 24 2f 35 a1 32 ce 77 06 73 dc 32 7f 20 94 76 | fc 06 ed 70 c8 9b 5f d6 59 3a 73 cf 26 f8 17 ee | 18 63 58 ae 9f 37 0f 09 e0 c0 57 d6 a2 6f 15 97 | b5 a5 0b 88 ee a9 0e c0 ef 58 a8 49 5b f7 12 f2 | 04 17 56 ca fd b2 88 1a ad 22 a0 8f 1d 49 04 bb | eb 0c 17 00 9e 98 12 e6 67 3b fb 7d 28 11 e0 14 | 43 88 f1 5f dc a2 4d 02 2d bb 38 c0 72 cd 9e 4d | 1c 3f be 7d ee 83 26 db be 7c db 0e 56 c9 37 5c | 9d 3f ac 2f 6e 7f db 4e a2 35 cd bb 91 60 8a d1 | 3a 51 1c 64 9a 33 73 3e 93 a9 7b e6 fc a8 02 f5 | b0 47 52 ba 43 88 33 2d f4 18 0f 42 6b ba ca 92 | 22 22 a2 dd 98 0c ed 01 62 04 e3 ca 8d ae 6d 23 | 30 0a 1c b6 cf 6a 7a 4a 69 c1 4c 0c be 19 1e 48 | ca f5 55 9d 56 61 41 f6 f6 e6 b7 1d 33 b6 d7 59 | 3a 6b b9 81 3b 7a b9 20 c6 52 11 85 e7 98 93 37 | d3 28 4f 1f 5b 47 c4 a5 0e c4 93 83 c4 78 a4 ae | 5f 4a 50 94 d8 31 4d 72 53 27 10 8a 96 5c 56 fd | f1 74 2b 8b 85 d7 36 d8 d9 8f 59 91 9e d4 6b 6b | d5 d0 cc 73 5e 03 fe 6b 69 a3 30 0f 05 a6 15 57 | e8 b8 cf a2 58 48 b0 6a 1e e7 d1 93 1b e4 9d ac | b1 ed b2 8f 37 25 9f cb 88 f7 c6 8c 58 2c bb 9a | ab 80 d7 a8 5b 13 a7 43 26 a2 2e 44 74 dc 18 47 | f2 05 37 ae 9d b8 a0 cc 71 fb d4 b9 39 34 4f 9d | b9 63 e1 72 89 d7 bf 46 72 f6 1e b4 98 63 ac 33 | 03 b5 50 f9 21 90 ff f6 cf de 9e 36 6b 06 d4 38 | 2a 32 11 55 68 95 d6 fa 34 3b 2c ad 24 a6 af df | 19 59 4f 29 b8 33 3f 59 93 da a1 b9 f3 59 0b d5 | d1 29 a8 6a 3a b3 f8 94 2b d5 3d 23 ca cf 96 72 | a5 a3 11 ef 6b 6e d3 8d 5c b9 93 | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 79 f6 25 53 15 ca 61 32 86 6d 30 a6 12 dd 70 c0 | 35 20 23 08 00 00 00 01 00 00 02 1b 00 00 01 ff | 00 04 00 05 e4 c1 eb 41 58 2d 44 64 e4 95 44 d2 | 6c 89 dd 4e 83 d7 c4 02 64 4b 9b 3a 3e d0 5e ff | b3 d4 d8 45 1c 4b d7 b8 48 88 45 59 83 80 5c ed | 26 51 bc 21 23 de 15 66 95 1d ee 89 eb 8e 4d ab | 2b dc 69 8b ca 5b 1f d6 d5 27 2e e7 fc 48 2d 46 | 63 8d fe d1 19 d2 06 a6 36 16 f9 dc 4a d9 31 18 | c9 a9 79 20 76 da a4 a7 13 bc c6 7b b8 13 67 75 | 00 57 81 6a a3 ef 8d 7d 06 78 0f 81 fd 29 67 9b | c9 dd f3 b8 86 89 3d 99 ee cb da ae 19 ba a1 94 | 0d 9a 66 14 30 37 54 fc 98 74 1f 17 19 45 1a aa | 1d 03 91 c4 f4 5e fa 04 f4 7f d1 6a 0d 40 bb a1 | ea ea 43 0f 3d c3 27 bc 98 b8 70 4d e0 29 d6 6f | 11 25 a7 b1 d3 ec 77 46 a0 f6 8b 1b 55 7d 65 11 | 36 28 b6 be b4 78 64 46 fc f0 34 82 d5 42 db 62 | 7d b3 c8 84 b8 f4 98 f9 68 04 58 43 88 f5 b7 e7 | f0 bb 65 4b a8 ed c1 9e 2d e4 be 4f 24 dc 02 a9 | bc 4f 86 13 57 79 20 25 96 49 8a cf 3a 74 07 da | 47 8c 8c 95 b0 b8 c5 13 71 09 31 13 f0 c6 25 3b | b1 c0 aa 41 f8 de 16 f1 37 1b 6e 78 45 78 2f 3e | 30 23 a7 6f 99 40 cc c0 3b d1 64 87 b5 d1 f1 73 | d6 4c 2c 60 59 24 fb 98 51 cf e3 64 dd 43 fc b2 | 30 67 e2 4d 6d 23 8a d0 a3 3e b3 3a db 7f 30 fe | d2 58 69 46 61 48 76 50 dc 07 1b 58 6a 68 5e 05 | af a3 98 46 f8 0c 46 de fb 14 54 64 85 d3 f6 75 | 4c 3a e3 8e 60 32 af e3 33 32 de 6f 75 d8 77 d4 | b0 67 e2 31 59 4f 00 9c 10 cc 2b 02 60 e6 15 dd | 76 ea 3e fc 1b be 0c 06 6d c4 8a b7 24 a5 02 db | 10 2f 1a 37 29 9b e6 54 62 8b 41 83 53 32 e4 b8 | 91 a8 16 8c a7 27 3e 64 b4 df aa aa b5 05 a4 ad | b2 43 e0 25 50 bc 24 2e fc b6 69 ea 21 16 aa 5b | 2a 7b 10 44 49 20 af 85 bc f0 fe 36 83 76 77 79 | 89 34 82 c9 9d 8b 5d 62 b1 41 bf | sending 239 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 79 f6 25 53 15 ca 61 32 86 6d 30 a6 12 dd 70 c0 | 35 20 23 08 00 00 00 01 00 00 00 ef 00 00 00 d3 | 00 05 00 05 90 73 c7 64 f7 d3 49 4b c2 1a 3d 2c | a2 9f 2a 5c f4 13 07 4d b5 88 9f 08 3a 73 8f cb | 41 52 d4 48 85 67 9b ec ac 61 7f a3 2b 50 63 03 | 7e c9 f0 3f 18 7a f9 23 e2 80 b6 64 d7 3b 7b fd | ee a0 ee 59 5d 92 37 8d e4 05 1d f6 0c b5 66 36 | 35 f8 70 d6 db c7 e6 3a b3 9b 4b 6c d0 d3 24 da | 55 57 e8 07 e3 37 29 bc 64 47 a3 a8 e1 7b 46 00 | e8 93 3f 25 38 07 cd fc b0 d9 6b fc 19 e6 c6 b0 | db 07 81 48 0e 05 0d 3d ed bb d6 31 5d 35 97 7c | 73 95 1a ef 7a b7 90 ca f5 8e 74 6d b6 42 b1 bc | d6 99 80 29 25 e5 28 4a c1 cd 0f be f5 50 cf 66 | df de 46 40 6a 44 99 17 54 84 e3 96 a5 72 66 80 | c1 a3 12 82 b3 43 9e 55 61 54 45 fb ff 3f 83 | sent 5 fragments | success_v2_state_transition scheduling EVENT_RETRANSMIT of c->r_interval=15000ms | event_schedule: new EVENT_RETRANSMIT-pe@0x7fe488002b78 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #2 | libevent_malloc: new ptr-libevent@0x562464838a28 size 128 | #2 STATE_PARENT_I2: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29369.880023 | resume sending helper answer for #1 suppresed complete_v2_state_transition() | #1 spent 6.64 milliseconds in resume sending helper answer | stop processing: state #2 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fe480000f48 | spent 0.00225 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 65 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | 79 f6 25 53 15 ca 61 32 86 6d 30 a6 12 dd 70 c0 | 2e 20 23 20 00 00 00 01 00 00 00 41 29 00 00 25 | 1a ea 6d f1 27 2a 9a 33 df 55 78 a1 a6 e3 10 03 | 59 08 cd 76 b5 ef f5 72 8e 8a 35 74 a4 27 c1 1a | 1b | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 79 f6 25 53 15 ca 61 32 | responder cookie: | 86 6d 30 a6 12 dd 70 c0 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (0x1) | length: 65 (0x41) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) | start processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2016) | State DB: found IKEv2 state #2 in PARENT_I2 (find_v2_sa_by_initiator_wip) | suspend processing: state #1 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | start processing: state #2 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ike_process_packet() at ikev2.c:2062) | #2 is idle | #2 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 37 (0x25) | processing payload: ISAKMP_NEXT_v2SK (len=33) | #2 in state PARENT_I2: sent v2I2, expected v2R2 | #2 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2N) | **parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 8 (0x8) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_AUTHENTICATION_FAILED (0x18) | processing payload: ISAKMP_NEXT_v2N (len=0) | selected state microcode Initiator: process AUTHENTICATION_FAILED AUTH notification | Now let's proceed with state specific processing | calling processor Initiator: process AUTHENTICATION_FAILED AUTH notification "ikev2-westnet-eastnet-x509-cr" #2: IKE SA authentication request rejected by peer: AUTHENTICATION_FAILED | pstats #1 ikev2.ike failed auth-failed "ikev2-westnet-eastnet-x509-cr" #2: scheduling retry attempt 1 of an unlimited number, but releasing whack | release_pending_whacks: state #2 fd@25 .st_dev=9 .st_ino=10365399 | close_any(fd@25) (in release_whack() at state.c:654) | close_any(fd@24) (in release_whack() at state.c:654) | release_pending_whacks: IKE SA #1 fd@-1 has pending CHILD SA with socket fd@25 | libevent_free: release ptr-libevent@0x562464838a28 | free_event_entry: release EVENT_RETRANSMIT-pe@0x7fe488002b78 | event_schedule: new EVENT_RETRANSMIT-pe@0x7fe488002b78 | inserting event EVENT_RETRANSMIT, timeout in 59.994996 seconds for #2 | libevent_malloc: new ptr-libevent@0x7fe480000f48 size 128 "ikev2-westnet-eastnet-x509-cr" #2: STATE_PARENT_I2: suppressing retransmits; will wait 59.994996 seconds for retry | #2 spent 0.0366 milliseconds in processing: Initiator: process AUTHENTICATION_FAILED AUTH notification in ikev2_process_state_packet() | [RE]START processing: state #2 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in complete_v2_state_transition() at ikev2.c:3379) | #2 complete_v2_state_transition() PARENT_I2->PARENT_I2 with status STF_IGNORE | stop processing: state #2 connection "ikev2-westnet-eastnet-x509-cr" from 192.1.2.23 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.13 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.138 milliseconds in comm_handle_cb() reading and processing packet