FIPS Product: YES FIPS Kernel: NO FIPS Mode: NO NSS DB directory: sql:/etc/ipsec.d Initializing NSS Opening NSS database "sql:/etc/ipsec.d" read-only NSS initialized NSS crypto library initialized FIPS HMAC integrity support [enabled] FIPS mode disabled for pluto daemon FIPS HMAC integrity verification self-test FAILED libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v3.28-685-gbfd5aef521-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:1340 core dump dir: /var/tmp secrets file: /etc/ipsec.secrets leak-detective enabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: new ptr-libevent@0x564d24334128 size 40 | libevent_malloc: new ptr-libevent@0x564d24309cd8 size 40 | libevent_malloc: new ptr-libevent@0x564d24309dd8 size 40 | creating event base | libevent_malloc: new ptr-libevent@0x564d2438e578 size 56 | libevent_malloc: new ptr-libevent@0x564d24332c88 size 664 | libevent_malloc: new ptr-libevent@0x564d2438e5e8 size 24 | libevent_malloc: new ptr-libevent@0x564d2438e638 size 384 | libevent_malloc: new ptr-libevent@0x564d2438e538 size 16 | libevent_malloc: new ptr-libevent@0x564d24309908 size 40 | libevent_malloc: new ptr-libevent@0x564d24309d38 size 48 | libevent_realloc: new ptr-libevent@0x564d24333788 size 256 | libevent_malloc: new ptr-libevent@0x564d2438e7e8 size 16 | libevent_free: release ptr-libevent@0x564d2438e578 | libevent initialized | libevent_realloc: new ptr-libevent@0x564d2438e578 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm, aes_ccm_c AES_CCM_12 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_b AES_CCM_8 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_a 3DES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS [*192] 3des CAMELLIA_CTR IKEv1: ESP IKEv2: ESP {256,192,*128} CAMELLIA_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} camellia AES_GCM_16 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm, aes_gcm_c AES_GCM_12 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_b AES_GCM_8 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_a AES_CTR IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aesctr AES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aes SERPENT_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} serpent TWOFISH_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} twofish TWOFISH_SSH IKEv1: IKE IKEv2: IKE ESP {256,192,*128} twofish_cbc_ssh NULL_AUTH_AES_GMAC IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_gmac NULL IKEv1: ESP IKEv2: ESP [] CHACHA20_POLY1305 IKEv1: IKEv2: IKE ESP [*256] chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: SHA1 IKEv1: IKE IKEv2: FIPS sha SHA2_256 IKEv1: IKE IKEv2: FIPS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: FIPS sha384 SHA2_512 IKEv1: IKE IKEv2: FIPS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 crypto helpers started thread for crypto helper 0 | starting up helper thread 0 | status value returned by setting the priority of this thread (crypto helper 0) 22 | crypto helper 0 waiting (nothing to do) started thread for crypto helper 1 started thread for crypto helper 2 | starting up helper thread 2 | status value returned by setting the priority of this thread (crypto helper 2) 22 | crypto helper 2 waiting (nothing to do) started thread for crypto helper 3 | starting up helper thread 3 | status value returned by setting the priority of this thread (crypto helper 3) 22 | crypto helper 3 waiting (nothing to do) started thread for crypto helper 4 | starting up helper thread 4 | status value returned by setting the priority of this thread (crypto helper 4) 22 | crypto helper 4 waiting (nothing to do) started thread for crypto helper 5 | starting up helper thread 5 | status value returned by setting the priority of this thread (crypto helper 5) 22 | crypto helper 5 waiting (nothing to do) started thread for crypto helper 6 | checking IKEv1 state table | starting up helper thread 6 | MAIN_R0: category: half-open IKE SA flags: 0: | -> MAIN_R1 EVENT_SO_DISCARD | status value returned by setting the priority of this thread (crypto helper 6) 22 | starting up helper thread 1 | crypto helper 6 waiting (nothing to do) | status value returned by setting the priority of this thread (crypto helper 1) 22 | MAIN_I1: category: half-open IKE SA flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT | crypto helper 1 waiting (nothing to do) | MAIN_R1: category: open IKE SA flags: 200: | -> MAIN_R2 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_I2: category: open IKE SA flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_R2: category: open IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | -> MAIN_R3 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_I3: category: open IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | -> MAIN_I4 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_R3: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | MAIN_I4: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | AGGR_R0: category: half-open IKE SA flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD | AGGR_I1: category: half-open IKE SA flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE | -> AGGR_I2 EVENT_SA_REPLACE | AGGR_R1: category: open IKE SA flags: 200: | -> AGGR_R2 EVENT_SA_REPLACE | -> AGGR_R2 EVENT_SA_REPLACE | AGGR_I2: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | AGGR_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | QUICK_R0: category: established CHILD SA flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT | QUICK_I1: category: established CHILD SA flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE | QUICK_R1: category: established CHILD SA flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE | QUICK_I2: category: established CHILD SA flags: 200: | -> UNDEFINED EVENT_NULL | QUICK_R2: category: established CHILD SA flags: 0: | -> UNDEFINED EVENT_NULL | INFO: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | INFO_PROTECTED: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | XAUTH_R0: category: established IKE SA flags: 0: | -> XAUTH_R1 EVENT_NULL | XAUTH_R1: category: established IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | MODE_CFG_R0: category: informational flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE | MODE_CFG_R1: category: established IKE SA flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE | MODE_CFG_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | MODE_CFG_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | XAUTH_I0: category: established IKE SA flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT | XAUTH_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT | checking IKEv2 state table | PARENT_I0: category: ignore flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA flags: 0: | -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH) | PARENT_I2: category: open IKE SA flags: 0: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_I3: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_RETAIN (I3: Informational Request) | -> PARENT_I3 EVENT_RETAIN (I3: Informational Response) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response) | PARENT_R0: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED)) | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request) | PARENT_R2: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request) | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response) | V2_CREATE_I0: category: established IKE SA flags: 0: | -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | V2_CREATE_I: category: established IKE SA flags: 0: | -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_IKE_I0: category: established IKE SA flags: 0: | -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_REKEY_CHILD_I0: category: established IKE SA flags: 0: | -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_REKEY_CHILD_I: category: established IKE SA flags: 0: | V2_CREATE_R: category: established IKE SA flags: 0: | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request) | V2_REKEY_IKE_R: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_R: category: established IKE SA flags: 0: | V2_IPSEC_I: category: established CHILD SA flags: 0: | V2_IPSEC_R: category: established CHILD SA flags: 0: | IKESA_DEL: category: established IKE SA flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational flags: 0: Using Linux XFRM/NETKEY IPsec interface code on 5.1.18-200.fc29.x86_64 | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding SERPENT_CBC to kernel algorithm db | adding TWOFISH_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x564d243931b8 | libevent_malloc: new ptr-libevent@0x564d24377568 size 128 | libevent_malloc: new ptr-libevent@0x564d243932c8 size 16 | add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x564d24393cf8 | libevent_malloc: new ptr-libevent@0x564d24334188 size 128 | libevent_malloc: new ptr-libevent@0x564d24393cb8 size 16 | global one-shot timer EVENT_CHECK_CRLS initialized selinux support is enabled. | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | Loading dnssec root key from:/var/lib/unbound/root.key | No additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x564d24393d68 | libevent_malloc: new ptr-libevent@0x564d2439ff78 size 128 | libevent_malloc: new ptr-libevent@0x564d243ab248 size 16 | libevent_realloc: new ptr-libevent@0x564d24332918 size 256 | libevent_malloc: new ptr-libevent@0x564d243ab288 size 8 | libevent_realloc: new ptr-libevent@0x564d243343f8 size 144 | libevent_malloc: new ptr-libevent@0x564d2433e778 size 152 | libevent_malloc: new ptr-libevent@0x564d243ab2c8 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: new ptr-libevent@0x564d243ab308 size 8 | libevent_malloc: new ptr-libevent@0x564d24336578 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: new ptr-libevent@0x564d243ab348 size 8 | libevent_malloc: new ptr-libevent@0x564d243ab388 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: new ptr-libevent@0x564d243ab458 size 8 | libevent_realloc: release ptr-libevent@0x564d243343f8 | libevent_realloc: new ptr-libevent@0x564d243ab498 size 256 | libevent_malloc: new ptr-libevent@0x564d243ab5c8 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:1501) using fork+execve | forked child 1501 | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.2.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.23 Kernel supports NIC esp-hw-offload adding interface eth1/eth1 (esp-hw-offload not supported by kernel) 192.1.2.23:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth1/eth1 192.1.2.23:4500 adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.0.2.254:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth0/eth0 192.0.2.254:4500 adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface lo/lo 127.0.0.1:4500 | no interfaces to sort | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | add_fd_read_event_handler: new ethX-pe@0x564d243ab9c8 | libevent_malloc: new ptr-libevent@0x564d2439fec8 size 128 | libevent_malloc: new ptr-libevent@0x564d243aba38 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 22 | add_fd_read_event_handler: new ethX-pe@0x564d243aba78 | libevent_malloc: new ptr-libevent@0x564d24335928 size 128 | libevent_malloc: new ptr-libevent@0x564d243abae8 size 16 | setup callback for interface lo 127.0.0.1:500 fd 21 | add_fd_read_event_handler: new ethX-pe@0x564d243abb28 | libevent_malloc: new ptr-libevent@0x564d24335878 size 128 | libevent_malloc: new ptr-libevent@0x564d243abb98 size 16 | setup callback for interface eth0 192.0.2.254:4500 fd 20 | add_fd_read_event_handler: new ethX-pe@0x564d243abbd8 | libevent_malloc: new ptr-libevent@0x564d243364a8 size 128 | libevent_malloc: new ptr-libevent@0x564d243abc48 size 16 | setup callback for interface eth0 192.0.2.254:500 fd 19 | add_fd_read_event_handler: new ethX-pe@0x564d243abc88 | libevent_malloc: new ptr-libevent@0x564d2430a4e8 size 128 | libevent_malloc: new ptr-libevent@0x564d243abcf8 size 16 | setup callback for interface eth1 192.1.2.23:4500 fd 18 | add_fd_read_event_handler: new ethX-pe@0x564d243abd38 | libevent_malloc: new ptr-libevent@0x564d2430a1d8 size 128 | libevent_malloc: new ptr-libevent@0x564d243abda8 size 16 | setup callback for interface eth1 192.1.2.23:500 fd 17 | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 loaded private key for keyid: PKK_RSA:AQO9bJbr3 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.32 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.2.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.23 | no interfaces to sort | libevent_free: release ptr-libevent@0x564d2439fec8 | free_event_entry: release EVENT_NULL-pe@0x564d243ab9c8 | add_fd_read_event_handler: new ethX-pe@0x564d243ab9c8 | libevent_malloc: new ptr-libevent@0x564d2439fec8 size 128 | setup callback for interface lo 127.0.0.1:4500 fd 22 | libevent_free: release ptr-libevent@0x564d24335928 | free_event_entry: release EVENT_NULL-pe@0x564d243aba78 | add_fd_read_event_handler: new ethX-pe@0x564d243aba78 | libevent_malloc: new ptr-libevent@0x564d24335928 size 128 | setup callback for interface lo 127.0.0.1:500 fd 21 | libevent_free: release ptr-libevent@0x564d24335878 | free_event_entry: release EVENT_NULL-pe@0x564d243abb28 | add_fd_read_event_handler: new ethX-pe@0x564d243abb28 | libevent_malloc: new ptr-libevent@0x564d24335878 size 128 | setup callback for interface eth0 192.0.2.254:4500 fd 20 | libevent_free: release ptr-libevent@0x564d243364a8 | free_event_entry: release EVENT_NULL-pe@0x564d243abbd8 | add_fd_read_event_handler: new ethX-pe@0x564d243abbd8 | libevent_malloc: new ptr-libevent@0x564d243364a8 size 128 | setup callback for interface eth0 192.0.2.254:500 fd 19 | libevent_free: release ptr-libevent@0x564d2430a4e8 | free_event_entry: release EVENT_NULL-pe@0x564d243abc88 | add_fd_read_event_handler: new ethX-pe@0x564d243abc88 | libevent_malloc: new ptr-libevent@0x564d2430a4e8 size 128 | setup callback for interface eth1 192.1.2.23:4500 fd 18 | libevent_free: release ptr-libevent@0x564d2430a1d8 | free_event_entry: release EVENT_NULL-pe@0x564d243abd38 | add_fd_read_event_handler: new ethX-pe@0x564d243abd38 | libevent_malloc: new ptr-libevent@0x564d2430a1d8 size 128 | setup callback for interface eth1 192.1.2.23:500 fd 17 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 loaded private key for keyid: PKK_RSA:AQO9bJbr3 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.669 milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 1501 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0145 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-subnets/1x1 with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | counting wild cards for @west is 0 | counting wild cards for @east is 0 | connect_to_host_pair: 192.1.2.23:500 192.1.2.45:500 -> hp@(nil): none | new hp@0x564d243ace78 added connection description "westnet-eastnet-subnets/1x1" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.2.16/28===192.1.2.23<192.1.2.23>[@east]...192.1.2.45<192.1.2.45>[@west]===192.0.1.0/28 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.105 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @west | add pubkey 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | add pubkey 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | add pubkey b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | add pubkey 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | add pubkey 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | add pubkey f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | add pubkey ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | add pubkey 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | add pubkey b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | add pubkey 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | add pubkey 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | add pubkey ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | add pubkey 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | add pubkey d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | add pubkey 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | add pubkey 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | add pubkey c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | add pubkey 15 04 37 f9 | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0741 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @east | add pubkey 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | add pubkey e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | add pubkey 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | add pubkey 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | add pubkey 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | add pubkey d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | add pubkey 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | add pubkey 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | add pubkey bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | add pubkey ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | add pubkey e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | add pubkey 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | add pubkey 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | add pubkey 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | add pubkey d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | add pubkey 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | add pubkey 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | add pubkey 51 51 48 ef | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0655 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-subnets/1x2 with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | counting wild cards for @west is 0 | counting wild cards for @east is 0 | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | connect_to_host_pair: 192.1.2.23:500 192.1.2.45:500 -> hp@0x564d243ace78: westnet-eastnet-subnets/1x1 added connection description "westnet-eastnet-subnets/1x2" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.2.64/30===192.1.2.23<192.1.2.23>[@east]...192.1.2.45<192.1.2.45>[@west]===192.0.1.0/28 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0823 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @west | unreference key: 0x564d24305c48 @west cnt 1-- | add pubkey 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | add pubkey 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | add pubkey b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | add pubkey 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | add pubkey 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | add pubkey f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | add pubkey ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | add pubkey 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | add pubkey b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | add pubkey 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | add pubkey 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | add pubkey ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | add pubkey 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | add pubkey d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | add pubkey 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | add pubkey 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | add pubkey c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | add pubkey 15 04 37 f9 | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0745 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @east | unreference key: 0x564d243ad1e8 @east cnt 1-- | add pubkey 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | add pubkey e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | add pubkey 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | add pubkey 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | add pubkey 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | add pubkey d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | add pubkey 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | add pubkey 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | add pubkey bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | add pubkey ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | add pubkey e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | add pubkey 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | add pubkey 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | add pubkey 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | add pubkey d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | add pubkey 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | add pubkey 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | add pubkey 51 51 48 ef | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0602 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-subnets/2x1 with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | counting wild cards for @west is 0 | counting wild cards for @east is 0 | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | connect_to_host_pair: 192.1.2.23:500 192.1.2.45:500 -> hp@0x564d243ace78: westnet-eastnet-subnets/1x2 added connection description "westnet-eastnet-subnets/2x1" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.2.16/28===192.1.2.23<192.1.2.23>[@east]...192.1.2.45<192.1.2.45>[@west]===192.0.1.128/28 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0497 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @west | unreference key: 0x564d24305c48 @west cnt 1-- | add pubkey 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | add pubkey 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | add pubkey b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | add pubkey 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | add pubkey 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | add pubkey f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | add pubkey ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | add pubkey 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | add pubkey b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | add pubkey 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | add pubkey 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | add pubkey ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | add pubkey 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | add pubkey d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | add pubkey 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | add pubkey 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | add pubkey c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | add pubkey 15 04 37 f9 | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0433 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @east | unreference key: 0x564d243ad1e8 @east cnt 1-- | add pubkey 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | add pubkey e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | add pubkey 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | add pubkey 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | add pubkey 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | add pubkey d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | add pubkey 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | add pubkey 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | add pubkey bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | add pubkey ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | add pubkey e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | add pubkey 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | add pubkey 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | add pubkey 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | add pubkey d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | add pubkey 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | add pubkey 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | add pubkey 51 51 48 ef | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0434 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-subnets/2x2 with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | counting wild cards for @west is 0 | counting wild cards for @east is 0 | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | connect_to_host_pair: 192.1.2.23:500 192.1.2.45:500 -> hp@0x564d243ace78: westnet-eastnet-subnets/2x1 added connection description "westnet-eastnet-subnets/2x2" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.2.64/30===192.1.2.23<192.1.2.23>[@east]...192.1.2.45<192.1.2.45>[@west]===192.0.1.128/28 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0446 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @west | unreference key: 0x564d24305c48 @west cnt 1-- | add pubkey 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | add pubkey 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | add pubkey b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | add pubkey 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | add pubkey 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | add pubkey f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | add pubkey ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | add pubkey 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | add pubkey b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | add pubkey 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | add pubkey 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | add pubkey ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | add pubkey 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | add pubkey d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | add pubkey 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | add pubkey 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | add pubkey c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | add pubkey 15 04 37 f9 | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0519 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @east | unreference key: 0x564d243ad1e8 @east cnt 1-- | add pubkey 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | add pubkey e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | add pubkey 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | add pubkey 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | add pubkey 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | add pubkey d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | add pubkey 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | add pubkey 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | add pubkey bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | add pubkey ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | add pubkey e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | add pubkey 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | add pubkey 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | add pubkey 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | add pubkey d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | add pubkey 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | add pubkey 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | add pubkey 51 51 48 ef | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0659 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_STATE_... in show_states_status (sort_states) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.428 milliseconds in whack | spent 0.00298 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 792 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 00 00 00 00 00 00 00 00 | 01 10 02 00 00 00 00 00 00 00 03 18 0d 00 02 84 | 00 00 00 01 00 00 00 01 00 00 02 78 00 01 00 12 | 03 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 00 03 80 04 00 0e | 80 0e 01 00 03 00 00 24 01 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 04 80 03 00 03 | 80 04 00 0e 80 0e 00 80 03 00 00 24 02 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 06 | 80 03 00 03 80 04 00 0e 80 0e 01 00 03 00 00 24 | 03 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 06 80 03 00 03 80 04 00 0e 80 0e 00 80 | 03 00 00 24 04 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 02 80 03 00 03 80 04 00 0e | 80 0e 01 00 03 00 00 24 05 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 02 80 03 00 03 | 80 04 00 0e 80 0e 00 80 03 00 00 24 06 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 04 | 80 03 00 03 80 04 00 05 80 0e 01 00 03 00 00 24 | 07 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 04 80 03 00 03 80 04 00 05 80 0e 00 80 | 03 00 00 24 08 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 06 80 03 00 03 80 04 00 05 | 80 0e 01 00 03 00 00 24 09 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 06 80 03 00 03 | 80 04 00 05 80 0e 00 80 03 00 00 24 0a 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 02 | 80 03 00 03 80 04 00 05 80 0e 01 00 03 00 00 24 | 0b 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 02 80 03 00 03 80 04 00 05 80 0e 00 80 | 03 00 00 20 0c 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 00 03 80 04 00 0e | 03 00 00 20 0d 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 00 03 80 04 00 0e | 03 00 00 20 0e 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 0e | 03 00 00 20 0f 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 00 03 80 04 00 05 | 03 00 00 20 10 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 00 03 80 04 00 05 | 00 00 00 20 11 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 05 | 0d 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 de 7f | 00 d6 c2 d3 0d 00 00 14 af ca d7 13 68 a1 f1 c9 | 6b 86 96 fc 77 57 01 00 0d 00 00 14 4a 13 1c 81 | 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 00 14 | 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 | ec 42 7b 1f 00 00 00 14 cd 60 46 43 35 df 21 f8 | 7c fd b2 fc 68 b6 a4 48 | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 792 (0x318) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: IKEv1 state not found (find_state_ikev1_init) | #null state always idle | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x2 opt: 0x2080 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 644 (0x284) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 20 (0x14) | message 'main_inI1_outR1' HASH payload not checked early | received Vendor ID payload [FRAGMENTATION] | received Vendor ID payload [Dead Peer Detection] | quirks.qnat_traversal_vid set to=117 [RFC 3947] | received Vendor ID payload [RFC 3947] | Ignoring older NAT-T Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] | ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] | Ignoring older NAT-T Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] | ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] | Ignoring older NAT-T Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] | ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] | in statetime_start() with no state | find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=IKEV1_ALLOW but ignoring ports | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | find_next_host_connection policy=IKEV1_ALLOW | found policy = RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO (westnet-eastnet-subnets/2x2) | find_next_host_connection returns westnet-eastnet-subnets/2x2 | find_next_host_connection policy=IKEV1_ALLOW | found policy = RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO (westnet-eastnet-subnets/2x1) | find_next_host_connection returns westnet-eastnet-subnets/2x1 | find_next_host_connection policy=IKEV1_ALLOW | found policy = RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO (westnet-eastnet-subnets/1x2) | find_next_host_connection returns westnet-eastnet-subnets/1x2 | find_next_host_connection policy=IKEV1_ALLOW | found policy = RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO (westnet-eastnet-subnets/1x1) | find_next_host_connection returns westnet-eastnet-subnets/1x1 | find_next_host_connection policy=IKEV1_ALLOW | find_next_host_connection returns empty | creating state object #1 at 0x564d243b0a38 | State DB: adding IKEv1 state #1 in UNDEFINED | pstats #1 ikev1.isakmp started | #1 updating local interface from to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2669) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in main_inI1_outR1() at ikev1_main.c:667) | parent state #1: UNDEFINED(ignore) => MAIN_R0(half-open IKE SA) | sender checking NAT-T: enabled; VID 117 | returning NAT-T method NAT_TRAVERSAL_METHOD_IETF_RFC | enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal) "westnet-eastnet-subnets/2x2" #1: responding to Main Mode | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 1:ISAKMP_NEXT_SA | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 632 (0x278) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 18 (0x12) | *****parse ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 36 (0x24) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | OAKLEY proposal verified unconditionally; no alg_info to check against | Oakley Transform 0 accepted | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 1 (0x1) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | emitting 28 raw bytes of attributes into ISAKMP Transform Payload (ISAKMP) | attributes 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 04 | attributes 80 03 00 03 80 04 00 0e 80 0e 01 00 | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | emitting length of ISAKMP Proposal Payload: 44 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 56 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | out_vid(): sending [FRAGMENTATION] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [Dead Peer Detection] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [RFC 3947] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | emitting length of ISAKMP Vendor ID Payload: 20 | no IKEv1 message padding required | emitting length of ISAKMP Message: 144 | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:no, t_xauth_client_done:no | peer supports fragmentation | peer supports DPD | IKEv1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1 | parent state #1: MAIN_R0(half-open IKE SA) => MAIN_R1(open IKE SA) | event_already_set, deleting event | sending reply packet to 192.1.2.45:500 (from 192.1.2.23:500) | sending 144 bytes for STATE_MAIN_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 01 10 02 00 00 00 00 00 00 00 00 90 0d 00 00 38 | 00 00 00 01 00 00 00 01 00 00 00 2c 00 01 00 01 | 00 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 00 03 80 04 00 0e | 80 0e 01 00 0d 00 00 14 40 48 b7 d5 6e bc e8 85 | 25 e7 de 7f 00 d6 c2 d3 0d 00 00 14 af ca d7 13 | 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 00 00 00 14 | 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | !event_already_set at reschedule | event_schedule: new EVENT_SO_DISCARD-pe@0x564d243acf58 | inserting event EVENT_SO_DISCARD, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x564d243ad2d8 size 128 "westnet-eastnet-subnets/2x2" #1: STATE_MAIN_R1: sent MR1, expecting MI2 | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.642 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00295 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 396 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | 34 0a 69 1e b8 10 36 ca 3a ad e2 ce e1 59 b5 54 | 42 ed a4 da 19 ea d9 3c 13 5b 67 58 55 1e 63 5c | 1d 25 60 93 6c 42 30 26 71 55 5a 58 e7 a1 cf 94 | f6 2e fd 18 e7 40 6d b2 f2 3a aa d8 56 a8 aa 7b | f3 e6 b5 3e 02 fd 16 8b 0f ee be 24 3e 08 05 39 | a1 33 58 77 cb d5 11 1d c2 ce f6 95 6f 99 cf 3e | e6 30 0e 7c dd 42 3b e0 7e 02 82 80 4f 95 ab 2d | a8 61 81 28 5b 85 74 a0 fb 61 e8 ff c5 b8 e9 bf | 33 cc 69 b4 2a a8 a1 92 bd f0 2d 44 f4 11 7c 53 | 4e 46 33 bb 9e 9f a8 9e e7 75 f1 b5 36 f0 21 cc | b3 8b 30 69 9f ad 3a a0 f2 74 cd f0 1d ef 86 fa | 07 21 dd 25 b1 04 67 9c d8 b7 3c 3a 5e 79 c3 29 | f7 fd 71 bd ce c0 da ce 63 a8 5a 08 c6 9a 69 ac | e0 39 65 06 11 19 92 50 24 e7 48 4f 47 74 ed a9 | cd 50 3b 77 71 5e a3 16 b5 bc 1e 7c a6 a9 a6 cd | bd 72 1c 62 3c 5e cd da 26 9b 0e f8 1c 8e 80 1c | 14 00 00 24 92 2e 4c 21 40 60 bf 40 f0 b6 34 ee | 20 1a 07 58 b7 0d 8c 0e 8a d9 7b 33 5d b9 d2 92 | 99 4a ea 12 14 00 00 24 42 f8 be 31 64 32 6c e0 | 37 1b 9d f8 b6 ca 6c 9c 70 28 22 0c d5 46 10 4d | 8f d9 f2 b9 25 40 54 e4 00 00 00 24 9f 65 ba 86 | 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 4a 5b 9d 49 | 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_KE (0x4) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 396 (0x18c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_R1 (find_state_ikev1) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1459) | #1 is idle | #1 idle | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x410 opt: 0x102080 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 260 (0x104) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x102080 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | message 'main_inI2_outR2' HASH payload not checked early | init checking NAT-T: enabled; RFC 3947 (NAT-Traversal) | natd_hash: hasher=0x564d23ea2ca0(32) | natd_hash: icookie= c1 22 4f 37 94 92 35 7c | natd_hash: rcookie= 67 7f 04 7b d5 9e 0e 70 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | natd_hash: hash= 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | natd_hash: hasher=0x564d23ea2ca0(32) | natd_hash: icookie= c1 22 4f 37 94 92 35 7c | natd_hash: rcookie= 67 7f 04 7b d5 9e 0e 70 | natd_hash: ip= c0 01 02 2d | natd_hash: port=500 | natd_hash: hash= 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | natd_hash: hash= 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | expected NAT-D(me): 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | expected NAT-D(me): 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | expected NAT-D(him): | 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | received NAT-D: 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | received NAT-D: 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | received NAT-D: 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | received NAT-D: 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.45 | NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: no NAT detected | NAT_T_WITH_KA detected | global one-shot timer EVENT_NAT_T_KEEPALIVE scheduled in 20 seconds | adding inI2_outR2 KE work-order 1 for state #1 | state #1 requesting EVENT_SO_DISCARD to be deleted | libevent_free: release ptr-libevent@0x564d243ad2d8 | free_event_entry: release EVENT_SO_DISCARD-pe@0x564d243acf58 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x564d243acf58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x564d243b07c8 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #1 and saving MD | #1 is busy; has a suspended MD | crypto helper 0 resuming | crypto helper 0 starting work-order 1 for state #1 | crypto helper 0 doing build KE and nonce (inI2_outR2 KE); request ID 1 | crypto helper 0 finished build KE and nonce (inI2_outR2 KE); request ID 1 time elapsed 0.000974 seconds | (#1) spent 0.969 milliseconds in crypto helper computing work-order 1: inI2_outR2 KE (pcr) | crypto helper 0 sending results from work-order 1 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7fbaf8002888 size 128 | crypto helper 0 waiting (nothing to do) | #1 spent 0.121 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.276 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #1 | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 1 | calling continuation function 0x564d23dcdb50 | main_inI2_outR2_continue for #1: calculated ke+nonce, sending R2 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value a6 b8 f8 75 f0 c3 a9 8e 2b 32 ad 87 0b 31 18 84 | keyex value 61 e5 e4 c2 0c 27 7e 94 08 4f 09 0c bd 69 dc b1 | keyex value 44 1b 8a 1a a0 bd fe 93 a1 a1 40 43 4b ca 18 5a | keyex value ce 74 38 71 1d 34 92 76 4c f0 87 a5 e0 22 13 07 | keyex value 17 22 f4 7f d6 68 8b 1e 7e e9 af fb ff ad 8a 7a | keyex value 2f 16 4c ec be 23 91 cc 67 fd 29 94 23 19 2b a8 | keyex value 24 44 95 ca 84 c4 12 f5 ed 96 c1 3e 01 8c df 9f | keyex value 89 b4 35 8d c9 22 cc 32 a9 ba 60 0f f4 7d a6 85 | keyex value f8 43 a8 d1 56 55 5e 11 1d 30 b6 1f 0c 6e 9d 28 | keyex value cb 23 e0 87 1a 0e f8 a4 e3 c3 88 d3 64 91 bb d2 | keyex value d2 7f c2 c7 52 ee 24 04 4a b0 26 db 70 81 3e 26 | keyex value 2c 6a cb c7 6b c0 8b 15 ab 06 39 2d f1 4b aa f6 | keyex value dc 31 d8 98 53 a6 25 23 5b 29 2c 42 2b 1e ff 73 | keyex value 8e 2d 1a be 65 04 d9 58 09 c1 90 12 6e 9d c3 2a | keyex value d8 54 bd 6d 0a e5 9b 8c 98 bc ac 88 cc d0 25 12 | keyex value ca 20 62 67 c0 9a a6 8c aa 32 24 65 82 1e bd be | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Nr into ISAKMP Nonce Payload | Nr 1f 19 aa 66 69 9f 04 57 bf 4a 63 f7 5e a0 90 45 | Nr 2a 40 28 a2 a2 bb 65 f4 07 4f fb 50 97 c9 e3 d9 | emitting length of ISAKMP Nonce Payload: 36 | sending NAT-D payloads | natd_hash: hasher=0x564d23ea2ca0(32) | natd_hash: icookie= c1 22 4f 37 94 92 35 7c | natd_hash: rcookie= 67 7f 04 7b d5 9e 0e 70 | natd_hash: ip= c0 01 02 2d | natd_hash: port=500 | natd_hash: hash= 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | natd_hash: hash= 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | next payload chain: ignoring supplied 'ISAKMP NAT-D Payload'.'next payload type' value 20:ISAKMP_NEXT_NATD_RFC | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | NAT-D 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | emitting length of ISAKMP NAT-D Payload: 36 | natd_hash: hasher=0x564d23ea2ca0(32) | natd_hash: icookie= c1 22 4f 37 94 92 35 7c | natd_hash: rcookie= 67 7f 04 7b d5 9e 0e 70 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | natd_hash: hash= 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP NAT-D Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | NAT-D 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | emitting length of ISAKMP NAT-D Payload: 36 | no IKEv1 message padding required | emitting length of ISAKMP Message: 396 | main inI2_outR2: starting async DH calculation (group=14) | started looking for secret for @east->@west of kind PKK_PSK | actually looking for secret for @east->@west of kind PKK_PSK | line 1: key type PKK_PSK(@east) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding main_inI2_outR2_tail work-order 2 for state #1 | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x564d243b07c8 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x564d243acf58 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x564d243acf58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x564d243b1b38 size 128 | #1 main_inI2_outR2_continue1_tail:1165 st->st_calculating = FALSE; | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | crypto helper 2 resuming | crypto helper 2 starting work-order 2 for state #1 | #1 is idle; has background offloaded task | crypto helper 2 doing compute dh+iv (V1 Phase 1) (main_inI2_outR2_tail); request ID 2 | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 | parent state #1: MAIN_R1(open IKE SA) => MAIN_R2(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x564d243b1b38 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x564d243acf58 | sending reply packet to 192.1.2.45:500 (from 192.1.2.23:500) | sending 396 bytes for STATE_MAIN_R1 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | a6 b8 f8 75 f0 c3 a9 8e 2b 32 ad 87 0b 31 18 84 | 61 e5 e4 c2 0c 27 7e 94 08 4f 09 0c bd 69 dc b1 | 44 1b 8a 1a a0 bd fe 93 a1 a1 40 43 4b ca 18 5a | ce 74 38 71 1d 34 92 76 4c f0 87 a5 e0 22 13 07 | 17 22 f4 7f d6 68 8b 1e 7e e9 af fb ff ad 8a 7a | 2f 16 4c ec be 23 91 cc 67 fd 29 94 23 19 2b a8 | 24 44 95 ca 84 c4 12 f5 ed 96 c1 3e 01 8c df 9f | 89 b4 35 8d c9 22 cc 32 a9 ba 60 0f f4 7d a6 85 | f8 43 a8 d1 56 55 5e 11 1d 30 b6 1f 0c 6e 9d 28 | cb 23 e0 87 1a 0e f8 a4 e3 c3 88 d3 64 91 bb d2 | d2 7f c2 c7 52 ee 24 04 4a b0 26 db 70 81 3e 26 | 2c 6a cb c7 6b c0 8b 15 ab 06 39 2d f1 4b aa f6 | dc 31 d8 98 53 a6 25 23 5b 29 2c 42 2b 1e ff 73 | 8e 2d 1a be 65 04 d9 58 09 c1 90 12 6e 9d c3 2a | d8 54 bd 6d 0a e5 9b 8c 98 bc ac 88 cc d0 25 12 | ca 20 62 67 c0 9a a6 8c aa 32 24 65 82 1e bd be | 14 00 00 24 1f 19 aa 66 69 9f 04 57 bf 4a 63 f7 | 5e a0 90 45 2a 40 28 a2 a2 bb 65 f4 07 4f fb 50 | 97 c9 e3 d9 14 00 00 24 9f 65 ba 86 59 13 ab 6a | 75 fe 3a cc 03 a2 1c 98 4a 5b 9d 49 7c c4 2f 3e | c2 82 8e 25 12 a1 70 ef 00 00 00 24 42 f8 be 31 | 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c 70 28 22 0c | d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x564d243acf58 | inserting event EVENT_RETRANSMIT, timeout in 0.5 seconds for #1 | libevent_malloc: new ptr-libevent@0x564d243b1b38 size 128 | #1 STATE_MAIN_R2: retransmits: first event in 0.5 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.656736 "westnet-eastnet-subnets/2x2" #1: STATE_MAIN_R2: sent MR2, expecting MI3 | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 0.38 milliseconds in resume sending helper answer | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbaf8002888 | crypto helper 2 finished compute dh+iv (V1 Phase 1) (main_inI2_outR2_tail); request ID 2 time elapsed 0.00114 seconds | (#1) spent 1.13 milliseconds in crypto helper computing work-order 2: main_inI2_outR2_tail (pcr) | crypto helper 2 sending results from work-order 2 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7fbaf0000f48 size 128 | crypto helper 2 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 2 replies to request ID 2 | calling continuation function 0x564d23dcdb50 | main_inI2_outR2_calcdone for #1: calculate DH finished | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in main_inI2_outR2_continue2() at ikev1_main.c:1015) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in main_inI2_outR2_continue2() at ikev1_main.c:1028) | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 0.0218 milliseconds in resume sending helper answer | processing: STOP state #0 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbaf0000f48 | spent 0.00349 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 332 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 05 10 02 01 00 00 00 00 00 00 01 4c f4 2a ed be | a1 d9 eb 6d b6 36 a8 b6 d4 d6 34 30 a0 51 d3 7c | bd 7b 72 6d b0 ba 1e 08 80 6b 79 53 89 60 51 b1 | 37 f5 ce 48 57 24 2d 5d 79 e1 c4 c1 c8 9d a7 c5 | aa 1c ee 39 70 39 7d 7c e6 fc c4 f3 6b c7 86 b4 | 8b 52 1e f8 ae ac 61 3a 18 be 98 39 13 7e 8f e8 | 8a d3 5f 26 1e 7c 72 91 2b 76 59 0b 91 90 0c db | 27 4c da b8 84 0e 07 0a 0c 48 9b 01 49 25 1c d4 | 49 e0 5b d5 4e 35 03 d1 08 a7 b3 77 84 1a 87 12 | 22 1d 89 8d 84 95 ee 05 f8 12 8c a9 d0 cb 69 9b | ef c6 7f f8 6f 27 6a e4 11 8b de db bb 3b 1b 47 | 52 36 62 30 61 13 74 6e de 94 44 26 97 9c 04 f2 | f0 1e 38 63 79 52 11 49 b9 f6 79 0c db f1 fb 14 | 67 18 cd bf c2 4b 79 49 8a cd 70 03 84 b7 44 89 | ff 55 e9 43 3f b8 09 34 bb 9b fe b5 07 14 e0 7c | 74 24 f0 e0 6a 4b 6f 50 b9 fb 0d 77 93 94 81 74 | 79 2f 41 dc 15 75 ce 14 5a eb a2 b8 9d d0 e7 14 | fb 3a 6d 18 b0 63 b3 73 0a f8 a3 a4 d7 a1 db 57 | d0 fc 9a 43 85 8e ab 27 1d af ba 2c 0d 9c 76 f7 | c8 3b 54 95 48 d0 94 4d 11 12 33 3f | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | length: 332 (0x14c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_R2 (find_state_ikev1) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1459) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x220 opt: 0x20c0 | ***parse ISAKMP Identification Payload: | next payload type: ISAKMP_NEXT_SIG (0x9) | length: 12 (0xc) | ID type: ID_FQDN (0x2) | DOI specific A: 0 (0x0) | DOI specific B: 0 (0x0) | obj: 77 65 73 74 | got payload 0x200 (ISAKMP_NEXT_SIG) needed: 0x200 opt: 0x20c0 | ***parse ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 278 (0x116) | removing 14 bytes of padding | message 'main_inI3_outR3' HASH payload not checked early "westnet-eastnet-subnets/2x2" #1: Peer ID is ID_FQDN: '@west' | X509: no CERT payloads to process | refine_host_connection for IKEv1: starting with "westnet-eastnet-subnets/2x2" | match_id a=@west | b=@west | results matched | refine_host_connection: checking "westnet-eastnet-subnets/2x2" against "westnet-eastnet-subnets/2x2", best=(none) with match=1(id=1(0)/ca=1(0)/reqca=1(0)) | Warning: not switching back to template of current instance | No IDr payload received from peer | refine_host_connection: checked westnet-eastnet-subnets/2x2 against westnet-eastnet-subnets/2x2, now for see if best | started looking for secret for @east->@west of kind PKK_RSA | actually looking for secret for @east->@west of kind PKK_RSA | line 1: key type PKK_RSA(@east) to type PKK_RSA | 1: compared key (none) to @east / @west -> 002 | 2: compared key (none) to @east / @west -> 002 | line 1: match=002 | match 002 beats previous best_match 000 match=0x564d24305b58 (line=1) | concluding with best_match=002 best=0x564d24305b58 (lineno=1) | returning because exact peer id match | offered CA: '%none' | required RSA CA is '%any' | checking RSA keyid '@east' for match with '@west' | checking RSA keyid '@west' for match with '@west' | key issuer CA is '%any' | an RSA Sig check passed with *AQOm9dY/4 [preloaded key] | #1 spent 0.0654 milliseconds in try_all_RSA_keys() trying a pubkey "westnet-eastnet-subnets/2x2" #1: Authenticated using RSA | thinking about whether to send my certificate: | I have RSA key: OAKLEY_RSA_SIG cert.type: 0?? | sendcert: CERT_ALWAYSSEND and I did not get a certificate request | so do not send cert. | I did not send a certificate because I do not have one. | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 5:ISAKMP_NEXT_ID | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_SIG (0x9) | ID type: ID_FQDN (0x2) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 9:ISAKMP_NEXT_SIG | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into ISAKMP Identification Payload (IPsec DOI) | my identity 65 61 73 74 | emitting length of ISAKMP Identification Payload (IPsec DOI): 12 | started looking for secret for @east->@west of kind PKK_RSA | actually looking for secret for @east->@west of kind PKK_RSA | line 1: key type PKK_RSA(@east) to type PKK_RSA | 1: compared key (none) to @east / @west -> 002 | 2: compared key (none) to @east / @west -> 002 | line 1: match=002 | match 002 beats previous best_match 000 match=0x564d24305b58 (line=1) | concluding with best_match=002 best=0x564d24305b58 (lineno=1) | ***emit ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Signature Payload (9:ISAKMP_NEXT_SIG) | next payload chain: saving location 'ISAKMP Signature Payload'.'next payload type' in 'reply packet' | emitting 274 raw bytes of SIG_R into ISAKMP Signature Payload | SIG_R 94 de 1b 8e 6c 1f ff 87 2c eb 1f f5 ce 44 4b 7f | SIG_R 20 03 1c a0 50 90 a0 54 44 7c c9 d2 d9 98 ff 24 | SIG_R 0c 42 f5 ae 51 b5 ed 57 1b 1d ba 61 48 f3 58 6c | SIG_R a8 05 c5 b7 4b 04 1e a1 26 50 2d 46 aa 4e dc 12 | SIG_R 4d 69 0a a1 e9 88 89 8c 98 5b 36 9c 6b b3 26 66 | SIG_R 9f 14 45 97 73 6e 1d f3 19 f4 bb d3 91 4a ba f7 | SIG_R 6b 7d c0 0b 15 4f 71 6c fe ac 8f 4c c1 65 a3 f5 | SIG_R 5c 21 aa 09 c7 32 72 80 47 2f be a0 8a dc 24 e8 | SIG_R 7e 9b 02 48 a5 35 57 02 ab b2 c1 82 93 d8 cf ca | SIG_R 49 e6 ef fb f0 a3 69 ff 47 b9 22 38 63 eb 0e da | SIG_R 9b 65 50 f5 f4 7a 1e 2f 6f 80 32 52 ae 67 df d6 | SIG_R 8a 0f 04 a3 9e 07 a8 a8 2b a2 04 9a 34 c0 55 df | SIG_R 42 16 44 56 ce 8c 8e 04 a6 ff a9 90 00 99 24 ba | SIG_R 8f f5 77 00 9d b3 35 55 57 be e8 61 62 3d 10 f0 | SIG_R bf 81 aa 43 86 92 98 e3 0d d6 22 40 cb 41 a8 fe | SIG_R 41 53 6c 1f e9 01 56 ea 55 37 53 17 02 98 45 56 | SIG_R 75 58 b0 eb 1f 4d 06 7d 59 75 f8 69 30 0a d9 93 | SIG_R 7c 06 | emitting length of ISAKMP Signature Payload: 278 | emitting 14 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 332 | FOR_EACH_CONNECTION_... in ISAKMP_SA_established | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3 | parent state #1: MAIN_R2(open IKE SA) => MAIN_R3(established IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_R3: retransmits: cleared | libevent_free: release ptr-libevent@0x564d243b1b38 | free_event_entry: release EVENT_RETRANSMIT-pe@0x564d243acf58 | sending reply packet to 192.1.2.45:500 (from 192.1.2.23:500) | sending 332 bytes for STATE_MAIN_R2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 05 10 02 01 00 00 00 00 00 00 01 4c 94 65 35 40 | 14 54 c7 f3 16 10 1b bc dd 93 7b 15 9e 30 ec 18 | cb c7 ee 04 26 b8 f7 6e 69 b7 9c 57 a2 7e 8c c6 | e5 b4 79 a2 a5 8d 3d 51 ae b9 2a 41 e7 32 99 2a | d7 7e d8 b3 18 1c cc 86 14 71 b1 4e 14 66 bd 20 | 2e 42 26 2a ce 26 eb 29 d1 64 8f 5a d8 54 26 d2 | 1c 1f 2e eb 27 bb 0b 39 7e 62 bd b9 78 54 51 a5 | ab 07 bf 97 8e b2 33 c6 97 cd 48 b2 00 f7 9f 0a | 93 77 b6 d2 e5 8d 36 f4 af fe 8b 69 df 89 b8 9c | 50 7e e4 0d f3 df 44 27 5f 34 61 0a 75 eb cd e0 | 8d 6b 69 a5 45 9f 03 d0 a6 9d a0 26 51 1d 66 57 | 9a 40 bc bc f0 85 d6 e6 04 87 4c 4b 2a 36 05 80 | e6 c9 c9 80 8d 59 59 55 de d4 e5 0b a4 82 1a 32 | 13 35 28 13 32 d4 df e4 39 94 4a 3c 19 70 dc 2a | fb 12 b2 76 d9 f3 67 54 42 c8 c8 62 af 51 5e 0e | c9 8b 08 bb 57 e2 bc 49 bb c7 a2 c4 d7 4f 6e 90 | 85 7a 29 65 9b 7a 36 ca 9a 73 da 6e 78 62 7f bb | 2a 3c 9e 4f ed e5 03 b3 7f 32 1c 8f 34 f2 d5 4e | cd f5 a7 eb 31 18 75 f7 57 a9 f8 b8 c4 e5 ab 6e | 72 c7 ac 49 81 8e 8c a2 a3 6b 27 31 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x564d243acf58 | inserting event EVENT_SA_REPLACE, timeout in 3330 seconds for #1 | libevent_malloc: new ptr-libevent@0x7fbaf8002888 size 128 | pstats #1 ikev1.isakmp established "westnet-eastnet-subnets/2x2" #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | unpending state #1 | #1 spent 5.2 milliseconds | #1 spent 5.37 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 5.53 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00291 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 476 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 bb f2 d7 7d 00 00 01 dc fd ab ee 49 | 5d 6d 65 13 66 1c ac 18 81 71 91 3d 22 93 59 2b | 8a b2 e0 1a f8 9e 3b d5 e1 1a e0 13 27 88 d7 1b | 1c 37 72 be 16 e1 d9 43 0a 7f 77 59 3f d0 44 c2 | 8e ca e3 0b 19 2e ec 19 cd bd 8f 82 de bb 9f 4c | 58 db 64 a7 08 38 77 c5 09 40 3e 00 df bf f1 a2 | d1 70 1a 13 36 54 56 90 75 a5 87 16 da 5c f7 72 | 31 f5 4d bc 79 fe 84 8f 70 05 77 0a 49 e3 42 e1 | 4a ac 2a 0d ab be 8b 55 b3 d2 ec aa bb 82 9e 37 | 9a 2d 34 9b 94 c5 65 4d ca db 21 bf 2f 9b bb 3d | 30 b2 58 a4 12 c8 9a 7a 0b ed d2 05 44 34 c1 8a | 3f 6f 57 3b 63 64 29 07 64 af 31 9e 50 6a b4 69 | 6d d3 d1 eb 84 90 f2 72 de d9 4d 23 b6 da c9 51 | a0 f1 9b ee c5 13 86 9b 99 19 a2 5a 95 19 75 f4 | b2 17 a9 0d 04 17 22 40 67 5c 84 54 0f 86 86 ab | 84 67 43 dc 09 01 52 a2 28 36 c7 74 26 e8 4c 7a | 08 97 f8 fe 0a 40 4d 74 fb cb 79 0d 74 cd ca d5 | 83 2a 29 32 72 40 4c 90 64 40 d0 a0 d2 9f cd 51 | 45 d1 4e 70 aa 70 c8 fd f2 f1 15 b5 81 91 3c e6 | 0a 33 f0 ad 06 42 fc e6 1c 2a 03 2e 82 ae 04 28 | 52 6c e6 48 be 04 41 5d 22 e0 c7 1a b8 03 d7 ec | a5 90 34 55 82 c0 bf 81 c7 22 4e 11 01 b5 74 b8 | 7f 81 cb 0f 62 da 9b 98 99 03 d2 f6 62 80 26 d8 | c8 94 9b 0a 58 ce eb fa f4 18 88 71 3f 01 59 96 | 9c bc c4 03 04 4a e5 69 5f e2 a1 0a d7 80 e4 43 | af e7 c0 f9 70 f2 c9 81 d1 97 e6 18 4c b6 93 ca | a4 ee 0c 2b 2b 26 f1 ea be 87 b5 18 61 3c 69 cc | 52 a3 47 b6 9e 11 3c 80 88 22 ee a8 30 85 f4 21 | 55 1b 8d dd 2c 8d 86 2e e6 ff ec 38 | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3153254269 (0xbbf2d77d) | length: 476 (0x1dc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: IKEv1 state not found (find_state_ikev1) | State DB: found IKEv1 state #1 in MAIN_R3 (find_state_ikev1) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1607) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 84 (0x54) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 01 00 ff ff ff f0 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 10 ff ff ff f0 | quick_inI1_outR1 HASH(1): | 57 a5 c0 84 a7 41 78 25 ef 1e 19 41 09 0c 07 44 | 8c 91 e9 d1 d4 ac 43 45 66 15 c0 0e cb 68 9f f9 | received 'quick_inI1_outR1' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 01 00 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | peer client is subnet 192.0.1.0/28 | peer client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 10 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | our client is subnet 192.0.2.16/28 | our client protocol/port is 0/0 "westnet-eastnet-subnets/2x2" #1: the peer proposed: 192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 | find_client_connection starting with westnet-eastnet-subnets/2x2 | looking for 192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 | concrete checking against sr#0 192.0.2.64/30 -> 192.0.1.128/28 | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 vs westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 | our client (192.0.2.64/30) not in our_net (192.0.2.16/28) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 vs westnet-eastnet-subnets/2x1:192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 | their client (192.0.1.128/28) not in same peer_net (192.0.1.0/28) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 vs westnet-eastnet-subnets/1x2:192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 | our client (192.0.2.64/30) not in our_net (192.0.2.16/28) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 vs westnet-eastnet-subnets/1x1:192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 | fc_try concluding with westnet-eastnet-subnets/1x1 [128] | fc_try westnet-eastnet-subnets/2x2 gives westnet-eastnet-subnets/1x1 | concluding with d = westnet-eastnet-subnets/1x1 | using connection "westnet-eastnet-subnets/1x1" | client wildcard: no port wildcard: no virtual: no | creating state object #2 at 0x564d243b9b68 | State DB: adding IKEv1 state #2 in UNDEFINED | pstats #2 ikev1.ipsec started | duplicating state object #1 "westnet-eastnet-subnets/2x2" as #2 for IPSEC SA | #2 setting local endpoint to 192.1.2.23:500 from #1.st_localport (in duplicate_state() at state.c:1484) | in connection_discard for connection westnet-eastnet-subnets/2x2 | start processing: connection "westnet-eastnet-subnets/1x1" (BACKGROUND) (in quick_inI1_outR1_tail() at ikev1_quick.c:1286) | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in quick_inI1_outR1_tail() at ikev1_quick.c:1295) | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in quick_inI1_outR1_tail() at ikev1_quick.c:1295) | child state #2: UNDEFINED(ignore) => QUICK_R0(established CHILD SA) | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 72 (0x48) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 92 10 c7 f8 | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | adding quick_outI1 KE work-order 3 for state #2 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7fbaf8002b78 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x564d243b5d48 size 128 | crypto helper 3 resuming | crypto helper 3 starting work-order 3 for state #2 | crypto helper 3 doing build KE and nonce (quick_outI1 KE); request ID 3 | crypto helper 3 finished build KE and nonce (quick_outI1 KE); request ID 3 time elapsed 0.000854 seconds | (#2) spent 0.861 milliseconds in crypto helper computing work-order 3: quick_outI1 KE (pcr) | crypto helper 3 sending results from work-order 3 for state #2 to event queue | scheduling resume sending helper answer for #2 | libevent_malloc: new ptr-libevent@0x7fbaf4003f28 size 128 | libevent_realloc: release ptr-libevent@0x564d2438e578 | libevent_realloc: new ptr-libevent@0x7fbaf4003e78 size 128 | crypto helper 3 waiting (nothing to do) | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #2 and saving MD | #2 is busy; has a suspended MD | #1 spent 0.257 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in process_md() at demux.c:382) | resume processing: connection "westnet-eastnet-subnets/1x1" (in process_md() at demux.c:382) | stop processing: connection "westnet-eastnet-subnets/1x1" (in process_md() at demux.c:383) | spent 0.505 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #2 | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 3 replies to request ID 3 | calling continuation function 0x564d23dcdb50 | quick_inI1_outR1_cryptocontinue1 for #2: calculated ke+nonce, calculating DH | started looking for secret for @east->@west of kind PKK_PSK | actually looking for secret for @east->@west of kind PKK_PSK | line 1: key type PKK_PSK(@east) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outR1 DH work-order 4 for state #2 | state #2 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x564d243b5d48 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7fbaf8002b78 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7fbaf8002b78 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x564d243b5d48 size 128 | crypto helper 4 resuming | crypto helper 4 starting work-order 4 for state #2 | crypto helper 4 doing compute dh (V1 Phase 2 PFS) (quick outR1 DH); request ID 4 | crypto helper 4 finished compute dh (V1 Phase 2 PFS) (quick outR1 DH); request ID 4 time elapsed 0.000881 seconds | (#2) spent 0.888 milliseconds in crypto helper computing work-order 4: quick outR1 DH (pcr) | crypto helper 4 sending results from work-order 4 for state #2 to event queue | scheduling resume sending helper answer for #2 | libevent_malloc: new ptr-libevent@0x7fbae8003618 size 128 | crypto helper 4 waiting (nothing to do) | suspending state #2 and saving MD | #2 is busy; has a suspended MD | resume sending helper answer for #2 suppresed complete_v1_state_transition() and stole MD | #2 spent 0.053 milliseconds in resume sending helper answer | stop processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbaf4003f28 | processing resume sending helper answer for #2 | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 4 replies to request ID 4 | calling continuation function 0x564d23dcdb50 | quick_inI1_outR1_cryptocontinue2 for #2: calculated DH, sending R1 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3153254269 (0xbbf2d77d) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 72 (0x48) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 92 10 c7 f8 | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0x2974b46f for esp.0@192.1.2.23 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI 29 74 b4 6f | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | emitting 24 raw bytes of attributes into ISAKMP Transform Payload (ESP) | attributes 80 03 00 0e 80 04 00 01 80 01 00 01 80 02 70 80 | attributes 80 05 00 02 80 06 00 80 | emitting length of ISAKMP Transform Payload (ESP): 32 | emitting length of ISAKMP Proposal Payload: 44 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 56 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 "westnet-eastnet-subnets/1x1" #2: responding to Quick Mode proposal {msgid:bbf2d77d} "westnet-eastnet-subnets/1x1" #2: us: 192.0.2.16/28===192.1.2.23<192.1.2.23>[@east] "westnet-eastnet-subnets/1x1" #2: them: 192.1.2.45<192.1.2.45>[@west]===192.0.1.0/28 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Nr into ISAKMP Nonce Payload | Nr f1 b0 cd 16 ed ab 02 30 73 12 2c d2 6b 9b 65 8d | Nr 2f 8f 45 39 b1 ab e9 a3 42 05 d4 3b 4a 07 50 37 | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value ff 72 02 e1 0d ec 08 d5 13 53 b7 4e 9f 38 85 97 | keyex value 5c 4e 47 ef 34 df 99 5b 93 c0 0c 49 25 ac 21 ed | keyex value ca 54 d4 65 f4 d2 bf a2 4c 22 49 6a 48 b7 1c 10 | keyex value 51 78 1d dc ff 7f 44 5f 5e 01 70 78 c7 f5 c0 f6 | keyex value 92 19 01 ca 6f cd 04 f7 27 b9 ec 4e 28 85 36 99 | keyex value c4 7a 54 e2 88 10 23 d3 9a 3f f8 e1 d0 87 af de | keyex value 3e 0f 5a f2 12 bf 57 06 e6 1d 1d 2c c8 3c 69 21 | keyex value fa 51 2a a2 d8 7c e0 09 48 7b 96 f7 15 cb a1 88 | keyex value 15 00 fa 52 7b 75 73 ea 55 5c 9a 5a 2f d2 37 cf | keyex value 6e 33 e9 1e 3c 4b 1e 52 fa a9 d2 69 d5 2b 0c 78 | keyex value ca 21 3b 8b 21 a4 70 f9 8e e6 3d e8 d3 b2 39 52 | keyex value 56 b0 76 df 4f 25 36 15 4e 1e f7 a2 6b 8f 1d d6 | keyex value 3d 61 1f 6c 3d 0d 4a 5b 37 86 08 bd c8 fb d4 97 | keyex value e8 52 e3 af 3e 8c 5e 75 c7 7e cb 84 99 7f 5d 3b | keyex value f7 be 3b f5 34 30 ee fb 0f df ad 12 07 ac 6e 95 | keyex value 51 d4 78 ca ae 83 f2 a9 65 6e 2c 61 5f 74 01 f2 | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 8 raw bytes of ID body into ISAKMP Identification Payload (IPsec DOI) | ID body c0 00 01 00 ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 8 raw bytes of ID body into ISAKMP Identification Payload (IPsec DOI) | ID body c0 00 02 10 ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | quick inR1 outI2 HASH(2): | 81 32 43 c9 1f 3e 94 d4 6b 9c 93 62 11 59 31 ae | 65 14 f5 56 dc 97 92 cb dd d2 85 da cb ab af 37 | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x1" unrouted: NULL | install_inbound_ipsec_sa() checking if we can route | could_route called for westnet-eastnet-subnets/1x1 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x1" unrouted: NULL; eroute owner: NULL | routing is easy, or has resolvable near-conflict | checking if this is a replacement state | st=0x564d243b9b68 ost=(nil) st->serialno=#2 ost->serialno=#0 | installing outgoing SA now as refhim=0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/1x1' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.9210c7f8@192.1.2.45 included non-error error | outgoing SA has refhim=0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/1x1' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.2974b46f@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | add inbound eroute 192.0.1.0/28:0 --0-> 192.0.2.16/28:0 => tun.10000@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1041379 | raw_eroute result=success | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 460 | finished processing quick inI1 | complete v1 state transition with STF_OK | [RE]START processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #2 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1 | child state #2: QUICK_R0(established CHILD SA) => QUICK_R1(established CHILD SA) | event_already_set, deleting event | state #2 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x564d243b5d48 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7fbaf8002b78 | sending reply packet to 192.1.2.45:500 (from 192.1.2.23:500) | sending 460 bytes for STATE_QUICK_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #2) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 bb f2 d7 7d 00 00 01 cc ce 45 32 f2 | 8e 67 d9 c1 68 36 ad 66 b9 8a 53 bc 6f 49 a7 0d | 54 1c bb aa f9 71 80 7b d7 ff 9c ff af 04 40 63 | 08 f5 f9 63 8d 50 14 f1 34 4d 24 f5 49 8a dd 20 | 73 86 66 f7 db f2 17 3a 47 5d c0 65 c4 dd 2b 28 | c2 c9 12 2a bd 07 6d f0 64 b4 c2 be 9b 8b f5 0f | 0a da 04 b4 96 e9 51 f6 93 6d 06 91 7a 57 4b 08 | 28 79 e7 b4 62 5f 8f 17 2e 42 dc 77 77 92 e5 2a | f3 09 b5 7f 67 c4 9c 36 5f 26 66 24 60 a7 55 2e | a2 7f 62 1d f3 3a a2 73 be 3d 25 1f 91 b3 bd 50 | 76 91 f7 fe 45 48 d0 94 39 34 76 3d 33 27 2a d3 | 31 eb 9d 15 e6 5b d3 1a a1 7f 70 7f a2 6b 9b 07 | b7 fb 4b cc 07 24 5e 11 91 d4 e5 b5 fa a5 eb cf | 55 e1 05 a5 f7 b7 86 05 72 30 79 6b ab 64 97 69 | 3c 54 f6 f9 63 96 16 70 68 44 4c 26 fa be cc c0 | 7c f9 a7 8a c4 54 f5 56 19 e6 5b 47 b9 d7 c7 9c | 45 d0 14 5d c1 a0 c9 b6 e1 cf 69 d9 3c 2a 59 01 | cd 68 e0 b4 e1 0f 4d fa 24 ed de 91 a3 a6 53 03 | b3 1b 1f 7b f0 c1 f0 3a c8 1c 9f de 02 84 ef ab | 05 e5 98 19 af c7 e5 01 d2 ae d7 f2 4c 21 dd 48 | d3 17 a6 83 2d 87 bb 1f e3 59 bc 39 08 f2 22 3f | 4b 0d cb ad 1a 09 83 90 78 a0 b9 1f 5d 54 46 ad | 31 ad 87 84 b0 40 98 bf e7 2c 27 d5 41 53 9b b0 | 65 ff 65 a7 da 49 21 aa 0c 9a e2 f1 b9 e1 d0 22 | f4 cc 72 b6 14 6b 17 73 7f f0 ec 7b ac 79 b2 fd | f7 2d 33 72 e0 a9 c9 8c d5 4f da 13 d4 f4 63 82 | 9a d5 ea 95 d5 80 15 f2 4d e6 a0 d8 14 1a 7a 15 | 93 e6 0b c2 2b 6c e6 24 12 ac d0 34 | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x7fbaf8002b78 | inserting event EVENT_RETRANSMIT, timeout in 0.5 seconds for #2 | libevent_malloc: new ptr-libevent@0x7fbaf4003f28 size 128 | #2 STATE_QUICK_R1: retransmits: first event in 0.5 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.676975 | pstats #2 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/1x1" #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 tunnel mode {ESP=>0x9210c7f8 <0x2974b46f xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #2 suppresed complete_v1_state_transition() | #2 spent 0.904 milliseconds in resume sending helper answer | stop processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbae8003618 | spent 0.00163 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 476 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 09 9e a1 a1 00 00 01 dc 92 e3 d7 81 | 35 f9 a6 b6 28 1a 40 4d 2c ee c5 a9 32 d4 41 25 | 87 fb 4d c1 de 0c 01 a3 6d fb 57 60 60 7b 22 03 | 58 10 4b 61 69 b4 f9 3d ac 40 5f bd da 39 03 47 | 31 47 bb 42 37 c5 71 08 2a 07 2f 40 a5 19 09 5c | 75 3e 5a 8f 12 e4 e1 99 61 d5 8d e1 97 9d dc b2 | 84 25 21 c6 be 13 fd da d4 57 29 64 d2 50 de 46 | cc 8b b8 41 fe a9 aa 95 ce c9 7e 39 55 d0 50 68 | 09 b2 51 01 2c 1c 10 e9 bc 27 00 98 0b 0e b2 5c | 6b 47 93 bc ec c0 8e 2d 0e b6 8e 94 4a 54 3e 6e | 90 dd e2 b9 b3 aa a6 24 63 d9 0e 02 54 5a cf cb | 9d 38 80 44 ef 91 04 39 91 75 67 c6 90 ce a9 75 | b1 0f d6 75 62 dd f2 4d c7 ef b0 c9 bd 50 e5 e5 | c8 62 20 e9 36 76 3a 90 3a cb ef ec 97 8f 82 50 | 1a 89 1c e7 a2 e6 c2 e2 58 e8 58 a2 b5 8e 64 17 | b9 a5 2b 87 b1 1b 56 79 0b e3 8b 41 1d a9 78 58 | a9 88 0c 54 16 f0 b3 b2 7b 3c f5 9b af ba 07 7b | 86 b0 25 71 42 8b 8c 46 3b 2b 1a 5b 2b 88 23 17 | 00 a9 11 97 3c fe 2e 3a 36 7e 94 f3 9f 67 d2 59 | 9f 1a b9 5c b0 29 e4 55 e8 19 6e 6d 3d d8 17 b4 | b9 fd 1e 6d 8a 07 33 52 15 78 ee 4b 3f 0b b0 28 | f7 ca f6 d0 78 16 04 89 eb 5b a8 84 b9 0e ca f2 | f2 20 24 34 d8 34 c6 58 9a 06 e2 2b 2b 3a 9c 1f | d6 f0 7a 41 85 06 76 54 c7 5a 76 9d 0e 27 57 d1 | f6 8e 27 4f 9f 11 ec 39 09 d5 3a 3a 35 46 59 f7 | 65 c1 5e e5 54 42 dd 7d 2d 34 fa 9f 0c 6d ef 85 | a0 90 ee 19 e5 16 24 27 0e 76 58 ee 28 3b 76 81 | 28 e5 18 c7 9e cd 1d d6 a9 a2 7e 06 c5 65 99 4e | 4a 5a f5 32 63 2e 69 02 18 eb 75 db | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 161391009 (0x99ea1a1) | length: 476 (0x1dc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: IKEv1 state not found (find_state_ikev1) | State DB: found IKEv1 state #1 in MAIN_R3 (find_state_ikev1) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1607) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 84 (0x54) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 01 80 ff ff ff f0 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 40 ff ff ff fc | quick_inI1_outR1 HASH(1): | 66 00 ca 60 b0 2f 0b ed ba 5e 2c 23 df cd 9e fe | 2b bd f2 64 34 87 2a f6 e1 35 2f 75 68 f2 f6 4b | received 'quick_inI1_outR1' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 01 80 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | peer client is subnet 192.0.1.128/28 | peer client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 40 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff fc | our client is subnet 192.0.2.64/30 | our client protocol/port is 0/0 "westnet-eastnet-subnets/2x2" #1: the peer proposed: 192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 | find_client_connection starting with westnet-eastnet-subnets/2x2 | looking for 192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 | concrete checking against sr#0 192.0.2.64/30 -> 192.0.1.128/28 | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 vs westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 vs westnet-eastnet-subnets/2x1:192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 | our client (192.0.2.16/28) not in our_net (192.0.2.64/30) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 vs westnet-eastnet-subnets/1x2:192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 | their client (192.0.1.0/28) not in same peer_net (192.0.1.128/28) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 vs westnet-eastnet-subnets/1x1:192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 | our client (192.0.2.16/28) not in our_net (192.0.2.64/30) | fc_try concluding with westnet-eastnet-subnets/2x2 [129] | fc_try westnet-eastnet-subnets/2x2 gives westnet-eastnet-subnets/2x2 | concluding with d = westnet-eastnet-subnets/2x2 | client wildcard: no port wildcard: no virtual: no | creating state object #3 at 0x564d243badc8 | State DB: adding IKEv1 state #3 in UNDEFINED | pstats #3 ikev1.ipsec started | duplicating state object #1 "westnet-eastnet-subnets/2x2" as #3 for IPSEC SA | #3 setting local endpoint to 192.1.2.23:500 from #1.st_localport (in duplicate_state() at state.c:1484) | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in quick_inI1_outR1_tail() at ikev1_quick.c:1295) | start processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in quick_inI1_outR1_tail() at ikev1_quick.c:1295) | child state #3: UNDEFINED(ignore) => QUICK_R0(established CHILD SA) | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 72 (0x48) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI a1 fe 27 ca | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | adding quick_outI1 KE work-order 5 for state #3 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7fbaf4004218 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: new ptr-libevent@0x7fbae8003618 size 128 | crypto helper 5 resuming | crypto helper 5 starting work-order 5 for state #3 | crypto helper 5 doing build KE and nonce (quick_outI1 KE); request ID 5 | crypto helper 5 finished build KE and nonce (quick_outI1 KE); request ID 5 time elapsed 0.0009 seconds | (#3) spent 0.906 milliseconds in crypto helper computing work-order 5: quick_outI1 KE (pcr) | crypto helper 5 sending results from work-order 5 for state #3 to event queue | scheduling resume sending helper answer for #3 | libevent_malloc: new ptr-libevent@0x7fbaec002888 size 128 | crypto helper 5 waiting (nothing to do) | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #3 and saving MD | #3 is busy; has a suspended MD | #1 spent 0.239 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.465 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00173 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 476 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 81 73 dc 8a 00 00 01 dc e0 24 5a b8 | 14 42 fb 21 2a 5c 12 99 59 e8 8e ec 8f 50 cc b2 | e1 fe 20 a7 c0 0a 14 c4 ed b2 c3 c1 1d 1a c6 50 | 11 db 55 83 46 6d d3 dd d8 55 cd af b0 b3 dd a5 | 77 ff d6 ca 41 23 14 4f 2b b5 70 ba b9 18 00 2f | 16 bd 1f 61 fa b7 de 8a 35 91 a9 c1 b4 80 b7 26 | 80 5e 72 34 54 e6 36 e6 83 1c 4e 00 a0 11 64 82 | cd 51 43 da b8 2d 54 5b 22 96 ee f5 42 8f 9f 23 | 99 8b 21 ee 2e 22 68 2c 66 7a c1 96 c8 3f d5 ad | bf 17 0c c7 ad 41 f8 c4 6b 6a 2b b4 3d 80 94 48 | 3a 2b e8 f4 4c 85 ff b5 9c 2e f6 3d 71 c7 e9 3d | a3 74 a9 1b a2 cb bb 28 0a a8 c9 bd 1b 60 30 90 | 4b 22 58 6b 59 8d 51 84 da 11 00 f2 fc 99 33 0f | f2 d8 77 04 4d 68 38 fd 05 e0 48 d1 bc d1 28 6c | 42 c3 8d 9e 34 e1 a2 d8 5d 03 a0 5b 58 7e 50 b0 | 75 a7 f0 92 66 b8 81 1c 72 cd 6c 1a e4 39 ff 69 | e4 3b b7 29 73 72 fa 29 24 12 1f 06 74 57 0b 4d | ed 25 4a d1 00 d8 36 1f 70 79 f3 af a3 de 7a 06 | 0e 7b 60 89 11 b6 fa c9 75 33 b2 70 57 16 90 4c | ac 3c 81 85 65 b0 7a b4 61 ba 3c 30 34 cb 75 d1 | 34 30 83 b7 7c a5 b0 3f 7f fe a2 db 85 2d 65 d2 | 19 02 ce 44 02 23 57 5b a5 61 b8 11 3a b5 a1 de | 33 e4 6b 81 16 5f 44 29 f0 9a 0c 85 61 eb 7a 10 | 4d 5f ef ce c6 61 87 d6 cc b2 13 06 cf 3b 55 c8 | 34 d5 77 06 c1 98 b9 9f ca 2a d7 75 37 3d df 82 | ad 25 69 3e 6c c4 4f dd 5f 9d ab 58 56 84 df 40 | 96 31 00 99 d9 06 92 20 2d f3 53 62 0a ff df 66 | 2a 69 e5 34 d6 fb 6e ad 19 aa 4f f9 28 e8 d1 c5 | 6b 9e 07 90 2f aa 61 8d d8 a3 ae b1 | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2171853962 (0x8173dc8a) | length: 476 (0x1dc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: IKEv1 state not found (find_state_ikev1) | State DB: found IKEv1 state #1 in MAIN_R3 (find_state_ikev1) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1607) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 84 (0x54) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 01 00 ff ff ff f0 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 40 ff ff ff fc | quick_inI1_outR1 HASH(1): | fb df 58 ca 9b 5c e1 76 a5 66 41 a5 73 79 41 5d | 36 8f 53 f9 5d fe 63 ac fe 02 4e 0f 58 90 0e ee | received 'quick_inI1_outR1' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 01 00 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | peer client is subnet 192.0.1.0/28 | peer client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 40 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff fc | our client is subnet 192.0.2.64/30 | our client protocol/port is 0/0 "westnet-eastnet-subnets/2x2" #1: the peer proposed: 192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 | find_client_connection starting with westnet-eastnet-subnets/2x2 | looking for 192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 | concrete checking against sr#0 192.0.2.64/30 -> 192.0.1.128/28 | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 vs westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 | their client (192.0.1.128/28) not in same peer_net (192.0.1.0/28) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 vs westnet-eastnet-subnets/2x1:192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 | our client (192.0.2.16/28) not in our_net (192.0.2.64/30) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 vs westnet-eastnet-subnets/1x2:192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 vs westnet-eastnet-subnets/1x1:192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 | our client (192.0.2.16/28) not in our_net (192.0.2.64/30) | fc_try concluding with westnet-eastnet-subnets/1x2 [128] | fc_try westnet-eastnet-subnets/2x2 gives westnet-eastnet-subnets/1x2 | concluding with d = westnet-eastnet-subnets/1x2 | using connection "westnet-eastnet-subnets/1x2" | client wildcard: no port wildcard: no virtual: no | creating state object #4 at 0x564d243c1938 | State DB: adding IKEv1 state #4 in UNDEFINED | pstats #4 ikev1.ipsec started | duplicating state object #1 "westnet-eastnet-subnets/2x2" as #4 for IPSEC SA | #4 setting local endpoint to 192.1.2.23:500 from #1.st_localport (in duplicate_state() at state.c:1484) | in connection_discard for connection westnet-eastnet-subnets/2x2 | start processing: connection "westnet-eastnet-subnets/1x2" (BACKGROUND) (in quick_inI1_outR1_tail() at ikev1_quick.c:1286) | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in quick_inI1_outR1_tail() at ikev1_quick.c:1295) | start processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in quick_inI1_outR1_tail() at ikev1_quick.c:1295) | child state #4: UNDEFINED(ignore) => QUICK_R0(established CHILD SA) | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 72 (0x48) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 68 7d 26 9a | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | adding quick_outI1 KE work-order 6 for state #4 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x564d243b0758 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #4 | libevent_malloc: new ptr-libevent@0x564d243b5d48 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #4 and saving MD | #4 is busy; has a suspended MD | crypto helper 6 resuming | crypto helper 6 starting work-order 6 for state #4 | #1 spent 0.27 milliseconds in process_packet_tail() | crypto helper 6 doing build KE and nonce (quick_outI1 KE); request ID 6 | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | resume processing: connection "westnet-eastnet-subnets/1x2" (in process_md() at demux.c:382) | stop processing: connection "westnet-eastnet-subnets/1x2" (in process_md() at demux.c:383) | spent 0.502 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #3 | start processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 5 replies to request ID 5 | calling continuation function 0x564d23dcdb50 | quick_inI1_outR1_cryptocontinue1 for #3: calculated ke+nonce, calculating DH | started looking for secret for @east->@west of kind PKK_PSK | actually looking for secret for @east->@west of kind PKK_PSK | line 1: key type PKK_PSK(@east) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outR1 DH work-order 7 for state #3 | state #3 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7fbae8003618 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7fbaf4004218 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7fbaf4004218 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: new ptr-libevent@0x7fbae8003618 size 128 | suspending state #3 and saving MD | #3 is busy; has a suspended MD | resume sending helper answer for #3 suppresed complete_v1_state_transition() and stole MD | #3 spent 0.0525 milliseconds in resume sending helper answer | stop processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbaec002888 | spent 0.0022 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 476 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 21 48 18 52 00 00 01 dc c2 96 39 58 | 90 8a b0 27 9b 50 cc c6 c7 ec 52 bb 28 6f 7b 11 | 14 44 a5 ef 4f 09 cb 9f 22 d9 0c d4 f1 61 f4 61 | 27 c5 6f ee d0 9f 58 a7 3e bc 9f d0 79 8a f5 65 | ae 40 d8 21 a6 63 5e 03 78 66 13 64 86 99 e8 46 | 9e 76 ef 53 31 0d c7 49 e7 fc f4 93 7e b2 9d 5a | 0d 37 70 c7 ef cd fe 42 2c f8 69 e6 7a 56 06 66 | 17 01 fc 14 f2 db bd 68 da e4 9a a8 c6 18 5f a9 | 9a d2 3a 36 2b c4 74 34 33 03 35 d0 06 7d 1a b9 | 21 0f ed 42 27 61 d7 e4 1f ef 84 a5 51 7c de 7c | 12 50 97 dc 59 76 43 7e 0f 7a 92 5f 43 a8 d2 be | 3c 7d f0 06 87 ff d7 26 d8 a2 ed db f7 fe 1c d4 | 72 ad d3 b1 16 f8 81 0d 33 0e a9 21 87 06 64 e4 | fa a5 36 ec f0 0b 48 df 55 d0 57 91 cf 84 81 c1 | 20 39 79 77 6e 21 1b b2 aa 38 ed 2f 06 7f 51 11 | 77 e5 2c 43 09 95 45 4d 6a 0f 79 b5 4c 58 8a c3 | c3 d7 65 64 ed 41 40 a3 b7 79 08 3f 44 90 1f b1 | 56 18 56 4c c7 09 4f 95 00 79 02 03 83 60 29 cd | 34 72 43 f2 6a 56 6e d5 87 82 09 41 97 25 33 b3 | 76 39 14 d6 35 cd 25 9a 92 76 25 68 79 89 7e 10 | 37 70 3b 6b 70 26 f4 34 fb 38 e0 7b 1c 66 d2 96 | 33 b3 3b a8 0e ec 2a 1d 18 2c fb 3c eb a1 7d c3 | 69 bb 29 2b 4d 66 c7 87 7f 0e f6 ec c2 91 28 67 | 29 99 d9 cc 3c de e6 b5 50 b2 74 f1 c0 28 d2 58 | d6 c8 dc 00 c7 25 65 ea 2a 69 af 38 1d 70 1d df | a5 28 eb 12 f1 da 9c 83 d2 50 4b f6 53 a4 5d 3d | ce 2c b7 78 02 10 0c 30 c9 6c 28 6d 41 ed a6 36 | 1c b9 3a ab d5 6a 2e 98 2f 58 81 05 8c 2e c8 03 | 70 fe 04 0d b4 a1 d2 e4 65 0d 7d be | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 558372946 (0x21481852) | length: 476 (0x1dc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: IKEv1 state not found (find_state_ikev1) | State DB: found IKEv1 state #1 in MAIN_R3 (find_state_ikev1) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1607) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 84 (0x54) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 01 80 ff ff ff f0 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 10 ff ff ff f0 | quick_inI1_outR1 HASH(1): | 22 90 01 62 bd 72 09 b1 0b 3a b1 97 cb 09 a2 dc | b7 94 cd d6 88 a5 74 5c 85 21 4a 4b e5 6e 6a 7c | received 'quick_inI1_outR1' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 01 80 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | peer client is subnet 192.0.1.128/28 | peer client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 10 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | our client is subnet 192.0.2.16/28 | our client protocol/port is 0/0 "westnet-eastnet-subnets/2x2" #1: the peer proposed: 192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 | find_client_connection starting with westnet-eastnet-subnets/2x2 | looking for 192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 | concrete checking against sr#0 192.0.2.64/30 -> 192.0.1.128/28 | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 vs westnet-eastnet-subnets/2x2:192.0.2.64/30:0/0 -> 192.0.1.128/28:0/0 | our client (192.0.2.64/30) not in our_net (192.0.2.16/28) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 vs westnet-eastnet-subnets/2x1:192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 vs westnet-eastnet-subnets/1x2:192.0.2.64/30:0/0 -> 192.0.1.0/28:0/0 | our client (192.0.2.64/30) not in our_net (192.0.2.16/28) | match_id a=@west | b=@west | results matched | fc_try trying westnet-eastnet-subnets/2x2:192.0.2.16/28:0/0 -> 192.0.1.128/28:0/0 vs westnet-eastnet-subnets/1x1:192.0.2.16/28:0/0 -> 192.0.1.0/28:0/0 | their client (192.0.1.0/28) not in same peer_net (192.0.1.128/28) | fc_try concluding with westnet-eastnet-subnets/2x1 [128] | fc_try westnet-eastnet-subnets/2x2 gives westnet-eastnet-subnets/2x1 | concluding with d = westnet-eastnet-subnets/2x1 | using connection "westnet-eastnet-subnets/2x1" | client wildcard: no port wildcard: no virtual: no | creating state object #5 at 0x564d243bb8b8 | State DB: adding IKEv1 state #5 in UNDEFINED | pstats #5 ikev1.ipsec started | duplicating state object #1 "westnet-eastnet-subnets/2x2" as #5 for IPSEC SA | #5 setting local endpoint to 192.1.2.23:500 from #1.st_localport (in duplicate_state() at state.c:1484) | in connection_discard for connection westnet-eastnet-subnets/2x2 | start processing: connection "westnet-eastnet-subnets/2x1" (BACKGROUND) (in quick_inI1_outR1_tail() at ikev1_quick.c:1286) | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in quick_inI1_outR1_tail() at ikev1_quick.c:1295) | start processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in quick_inI1_outR1_tail() at ikev1_quick.c:1295) | child state #5: UNDEFINED(ignore) => QUICK_R0(established CHILD SA) | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 72 (0x48) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 97 0c 0d 6c | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | adding quick_outI1 KE work-order 8 for state #5 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7fbaec002b78 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: new ptr-libevent@0x7fbaec002888 size 128 | crypto helper 6 finished build KE and nonce (quick_outI1 KE); request ID 6 time elapsed 0.000979 seconds | (#4) spent 0.98 milliseconds in crypto helper computing work-order 6: quick_outI1 KE (pcr) | crypto helper 6 sending results from work-order 6 for state #4 to event queue | scheduling resume sending helper answer for #4 | libevent_malloc: new ptr-libevent@0x7fbae0003f28 size 128 | complete v1 state transition with STF_SUSPEND | crypto helper 0 resuming | [RE]START processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2648) | crypto helper 0 starting work-order 7 for state #3 | suspending state #5 and saving MD | #5 is busy; has a suspended MD | crypto helper 1 resuming | #1 spent 0.275 milliseconds in process_packet_tail() | crypto helper 1 starting work-order 8 for state #5 | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in process_md() at demux.c:382) | resume processing: connection "westnet-eastnet-subnets/2x1" (in process_md() at demux.c:382) | crypto helper 1 doing build KE and nonce (quick_outI1 KE); request ID 8 | stop processing: connection "westnet-eastnet-subnets/2x1" (in process_md() at demux.c:383) | spent 0.527 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 6 waiting (nothing to do) | processing resume sending helper answer for #4 | start processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 6 replies to request ID 6 | calling continuation function 0x564d23dcdb50 | quick_inI1_outR1_cryptocontinue1 for #4: calculated ke+nonce, calculating DH | started looking for secret for @east->@west of kind PKK_PSK | actually looking for secret for @east->@west of kind PKK_PSK | line 1: key type PKK_PSK(@east) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outR1 DH work-order 9 for state #4 | state #4 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x564d243b5d48 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x564d243b0758 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x564d243b0758 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #4 | libevent_malloc: new ptr-libevent@0x564d243b5d48 size 128 | crypto helper 2 resuming | crypto helper 2 starting work-order 9 for state #4 | crypto helper 2 doing compute dh (V1 Phase 2 PFS) (quick outR1 DH); request ID 9 | crypto helper 2 finished compute dh (V1 Phase 2 PFS) (quick outR1 DH); request ID 9 time elapsed 0.000843 seconds | crypto helper 1 finished build KE and nonce (quick_outI1 KE); request ID 8 time elapsed 0.000946 seconds | suspending state #4 and saving MD | (#5) spent 0.956 milliseconds in crypto helper computing work-order 8: quick_outI1 KE (pcr) | crypto helper 1 sending results from work-order 8 for state #5 to event queue | scheduling resume sending helper answer for #5 | libevent_malloc: new ptr-libevent@0x7fbae4003f28 size 128 | crypto helper 1 waiting (nothing to do) | crypto helper 0 doing compute dh (V1 Phase 2 PFS) (quick outR1 DH); request ID 7 | (#4) spent 0.855 milliseconds in crypto helper computing work-order 9: quick outR1 DH (pcr) | crypto helper 2 sending results from work-order 9 for state #4 to event queue | scheduling resume sending helper answer for #4 | libevent_malloc: new ptr-libevent@0x7fbaf0004fd8 size 128 | crypto helper 2 waiting (nothing to do) | #4 is busy; has a suspended MD | resume sending helper answer for #4 suppresed complete_v1_state_transition() and stole MD | #4 spent 0.0586 milliseconds in resume sending helper answer | stop processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbae0003f28 | processing resume sending helper answer for #5 | start processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 1 replies to request ID 8 | calling continuation function 0x564d23dcdb50 | quick_inI1_outR1_cryptocontinue1 for #5: calculated ke+nonce, calculating DH | started looking for secret for @east->@west of kind PKK_PSK | actually looking for secret for @east->@west of kind PKK_PSK | line 1: key type PKK_PSK(@east) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outR1 DH work-order 10 for state #5 | state #5 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7fbaec002888 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7fbaec002b78 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7fbaec002b78 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: new ptr-libevent@0x7fbae0003f28 size 128 | suspending state #5 and saving MD | #5 is busy; has a suspended MD | resume sending helper answer for #5 suppresed complete_v1_state_transition() and stole MD | crypto helper 3 resuming | crypto helper 3 starting work-order 10 for state #5 | #5 spent 0.0471 milliseconds in resume sending helper answer | crypto helper 3 doing compute dh (V1 Phase 2 PFS) (quick outR1 DH); request ID 10 | stop processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbae4003f28 | processing resume sending helper answer for #4 | start processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 2 replies to request ID 9 | calling continuation function 0x564d23dcdb50 | quick_inI1_outR1_cryptocontinue2 for #4: calculated DH, sending R1 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2171853962 (0x8173dc8a) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 72 (0x48) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 68 7d 26 9a | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0x587c7ea5 for esp.0@192.1.2.23 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI 58 7c 7e a5 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | emitting 24 raw bytes of attributes into ISAKMP Transform Payload (ESP) | attributes 80 03 00 0e 80 04 00 01 80 01 00 01 80 02 70 80 | attributes 80 05 00 02 80 06 00 80 | emitting length of ISAKMP Transform Payload (ESP): 32 | emitting length of ISAKMP Proposal Payload: 44 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 56 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 "westnet-eastnet-subnets/1x2" #4: responding to Quick Mode proposal {msgid:8173dc8a} "westnet-eastnet-subnets/1x2" #4: us: 192.0.2.64/30===192.1.2.23<192.1.2.23>[@east] "westnet-eastnet-subnets/1x2" #4: them: 192.1.2.45<192.1.2.45>[@west]===192.0.1.0/28 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Nr into ISAKMP Nonce Payload | Nr 34 63 db 7c f0 96 e4 d9 b2 9e 9c 6b 11 8c 1d 97 | Nr 86 99 b2 80 32 ba d5 53 58 e0 64 f3 bc 0c e2 54 | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 9e 46 76 43 ec 02 7b 34 4e c0 0a f3 82 c8 13 e0 | keyex value c1 bc c6 d7 f3 f2 01 f4 e2 1c 42 9d b7 5c b5 13 | keyex value ac 99 a0 8b da 15 9f e4 6b 07 ec 92 83 ea af 67 | keyex value 66 d4 a1 c6 11 34 d7 9d a2 b7 b7 30 ab dc 20 21 | keyex value d4 41 0f f1 7a ca 6c da a7 b9 03 d4 6f f8 66 30 | keyex value 24 83 51 39 f0 88 cb 8c b4 a1 79 fa 25 06 2e 6f | keyex value 45 c0 c8 b1 65 94 de 35 62 8b 8d fb b3 f1 8f 57 | keyex value 96 62 69 f2 b5 15 ac b0 90 8e 6a e4 68 a1 a7 2c | keyex value 51 3b f0 28 8c 82 31 9b 47 ad 64 a0 6f 58 c6 9f | keyex value 1c d5 39 61 88 49 4f 3f 0d c0 c4 56 b6 6e 16 d3 | keyex value 89 09 c6 f9 51 a1 f0 a7 a8 de 7f bc 16 41 ee 48 | keyex value 13 91 c4 1a 53 f1 c2 ae e3 6b f2 17 f4 9e 17 32 | keyex value 60 99 d7 40 bf 8a c3 77 59 19 5d 45 0d 75 08 c3 | keyex value 79 dc 06 89 96 33 95 6a 07 de 27 d0 14 06 87 8b | keyex value 37 22 3c 9a e8 99 6c 3c 4b 7d a6 1e 5e aa 20 18 | keyex value c1 98 28 c8 2b 9d eb b3 cc ff ea 24 38 d3 81 ed | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 8 raw bytes of ID body into ISAKMP Identification Payload (IPsec DOI) | ID body c0 00 01 00 ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 8 raw bytes of ID body into ISAKMP Identification Payload (IPsec DOI) | ID body c0 00 02 40 ff ff ff fc | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | quick inR1 outI2 HASH(2): | 19 b2 f7 24 8f ff c4 fa ee c4 33 ff ea de 73 30 | 40 13 51 f9 34 30 a1 c5 a8 95 eb 0a 27 46 bb 98 | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x2" unrouted: NULL | install_inbound_ipsec_sa() checking if we can route | could_route called for westnet-eastnet-subnets/1x2 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x2" unrouted: NULL; eroute owner: NULL | routing is easy, or has resolvable near-conflict | checking if this is a replacement state | st=0x564d243c1938 ost=(nil) st->serialno=#4 ost->serialno=#0 | installing outgoing SA now as refhim=0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/1x2' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.687d269a@192.1.2.45 included non-error error | outgoing SA has refhim=0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/1x2' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.587c7ea5@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe1e3 | crypto helper 0 finished compute dh (V1 Phase 2 PFS) (quick outR1 DH); request ID 7 time elapsed 0.001957 seconds | add inbound eroute 192.0.1.0/28:0 --0-> 192.0.2.64/30:0 => tun.10000@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1040867 | (#3) spent 0.964 milliseconds in crypto helper computing work-order 7: quick outR1 DH (pcr) | crypto helper 0 sending results from work-order 7 for state #3 to event queue | scheduling resume sending helper answer for #3 | libevent_malloc: new ptr-libevent@0x7fbaf80027d8 size 128 | crypto helper 0 waiting (nothing to do) | raw_eroute result=success | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 460 | finished processing quick inI1 | complete v1 state transition with STF_OK | [RE]START processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #4 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1 | child state #4: QUICK_R0(established CHILD SA) => QUICK_R1(established CHILD SA) | event_already_set, deleting event | state #4 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x564d243b5d48 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x564d243b0758 | sending reply packet to 192.1.2.45:500 (from 192.1.2.23:500) | sending 460 bytes for STATE_QUICK_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #4) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 81 73 dc 8a 00 00 01 cc 86 cc ee c1 | a7 49 09 1f 32 9c ca 6a 56 0e 79 7e 45 b7 a4 3e | 49 fd 13 db 59 08 bb bc 39 d5 52 ec a0 ed 69 4b | 69 10 17 06 74 5f 82 c9 de c9 72 c0 5f 12 0b 7e | 45 c1 c8 3e 2d cb 8c 17 6c 84 4f 8e 1c 50 fb 26 | 17 69 ec 46 e7 fe 6b b9 6b d5 e1 5c b5 b9 f1 6d | ce da a0 44 6c f3 38 4e 2f 6a a4 61 ff 5c c2 36 | b5 b1 18 78 ea 1a c2 f1 eb f7 76 7e 3d 40 dc 3b | 7d a5 cf d4 5b 20 fa fb 09 55 93 44 9b d6 83 0d | f3 e9 48 19 bd bc 07 50 f7 9b 06 58 3b 79 60 cd | 5d c7 0e 1e af e2 31 eb 47 78 f8 f1 08 7c 43 7d | 63 82 00 5a 81 ec d8 89 bc 45 32 14 67 1f 91 48 | c5 5f 0d 74 e6 2e f2 d5 1f 27 57 43 ee 2d 7c 4b | crypto helper 3 finished compute dh (V1 Phase 2 PFS) (quick outR1 DH); request ID 10 time elapsed 0.000918 seconds | a4 ac 84 6b e3 36 21 42 77 d1 21 26 41 58 ca 57 | (#5) spent 0.901 milliseconds in crypto helper computing work-order 10: quick outR1 DH (pcr) | crypto helper 3 sending results from work-order 10 for state #5 to event queue | scheduling resume sending helper answer for #5 | 0c 5b f3 ab 29 55 5b 5b a1 f4 9c 18 e4 b7 42 54 | libevent_malloc: new ptr-libevent@0x7fbaf4005118 size 128 | crypto helper 3 waiting (nothing to do) | 4c a1 17 a6 4c 2f ec ee b1 44 29 9d b8 65 12 ec | d6 1f 44 d7 a5 5d 9b c3 20 4e 72 f1 e8 e4 c1 f6 | 91 19 c2 0c e0 1f fd 33 3f a0 6d 2e 9b 8a 57 bb | 71 20 80 b4 de ba 3b e2 ed 8f 20 e0 a5 5d f3 e5 | 1a da 60 81 d0 59 76 96 a8 eb 64 0a 04 94 c9 b7 | eb 9c c6 4f 1a 66 01 0b 9e e3 1b a3 2b dc 98 80 | b7 6d ea 3a 36 4e 71 d5 b0 60 83 63 74 36 46 e8 | 1f 4f 66 e3 d8 de e9 fd 61 e7 28 0f 6e 60 64 63 | 06 37 bf 1e 17 a3 69 30 1f 1f c2 2a e2 bf 76 b0 | 73 57 24 50 f0 5e 3b 85 9a 6b 39 a3 99 a8 77 f6 | 81 77 b3 42 bc eb d2 88 83 5c 74 e6 02 83 ea e4 | 7f 4f 54 45 a2 23 15 9a f8 8b fd c5 42 cc 7a 14 | f1 f8 a8 6d 4e 5b b3 d1 48 45 b2 4a | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x564d243b0758 | inserting event EVENT_RETRANSMIT, timeout in 0.5 seconds for #4 | libevent_malloc: new ptr-libevent@0x7fbae4003f28 size 128 | #4 STATE_QUICK_R1: retransmits: first event in 0.5 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.683083 | pstats #4 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/1x2" #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 tunnel mode {ESP=>0x687d269a <0x587c7ea5 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #4 suppresed complete_v1_state_transition() | #4 spent 0.953 milliseconds in resume sending helper answer | stop processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbaf0004fd8 | processing resume sending helper answer for #3 | start processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 7 | calling continuation function 0x564d23dcdb50 | quick_inI1_outR1_cryptocontinue2 for #3: calculated DH, sending R1 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 161391009 (0x99ea1a1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 72 (0x48) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI a1 fe 27 ca | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0xb890e0ea for esp.0@192.1.2.23 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI b8 90 e0 ea | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | emitting 24 raw bytes of attributes into ISAKMP Transform Payload (ESP) | attributes 80 03 00 0e 80 04 00 01 80 01 00 01 80 02 70 80 | attributes 80 05 00 02 80 06 00 80 | emitting length of ISAKMP Transform Payload (ESP): 32 | emitting length of ISAKMP Proposal Payload: 44 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 56 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 "westnet-eastnet-subnets/2x2" #3: responding to Quick Mode proposal {msgid:099ea1a1} "westnet-eastnet-subnets/2x2" #3: us: 192.0.2.64/30===192.1.2.23<192.1.2.23>[@east] "westnet-eastnet-subnets/2x2" #3: them: 192.1.2.45<192.1.2.45>[@west]===192.0.1.128/28 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Nr into ISAKMP Nonce Payload | Nr d6 40 59 2a ff 36 35 50 96 1f 68 ba 23 81 96 d7 | Nr 00 ca 58 1d 17 38 e6 cc ee 14 8e 03 e9 cd 98 dc | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 79 81 fd 69 17 bc 81 5d 3e 7a 7c fa 39 7d c8 df | keyex value 05 ad f7 90 11 0e 51 b9 4d 07 be cf fb 68 53 1d | keyex value 7c ff ec 4d 0d 68 65 f4 83 cc a8 9e 51 3b 85 58 | keyex value 07 ea fb b4 2b 0b 01 41 30 07 5b f6 e5 bb 6e 44 | keyex value a1 3d 32 bf c3 0f f3 e0 15 a6 f6 7b 4b 5e 8a 44 | keyex value 96 f6 37 a2 09 fa df 62 43 2c 70 a8 ad d1 31 3f | keyex value 92 d0 e5 a6 a1 82 c5 02 67 12 3d 61 eb 67 8a 93 | keyex value 00 9d be fa 9a e1 72 22 e1 d5 43 01 60 5b 8b 82 | keyex value 05 12 66 c7 5c 66 4e f2 d9 ce 0b af ca 7c c3 21 | keyex value 48 d4 48 5b 2f cc 17 92 57 49 dc 5b a0 19 7c 25 | keyex value 2a 34 ab e2 4c d6 0c eb a7 fc fb 6f 25 90 9e 21 | keyex value 18 3d f2 5a d0 b8 b4 e4 03 a8 b4 b0 2b f5 0e c7 | keyex value 8f 39 31 68 01 62 47 fe 98 35 8b cc e3 96 68 9a | keyex value 5f 75 0c 49 07 dd 6f b9 05 28 ea 99 ee 85 f3 ff | keyex value 42 79 4c 54 b7 40 f4 1e 95 22 91 63 86 37 03 8b | keyex value 27 d2 88 3b e2 fd 8e 8a 0a bf 72 c6 6a d8 4e 44 | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 8 raw bytes of ID body into ISAKMP Identification Payload (IPsec DOI) | ID body c0 00 01 80 ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 8 raw bytes of ID body into ISAKMP Identification Payload (IPsec DOI) | ID body c0 00 02 40 ff ff ff fc | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | quick inR1 outI2 HASH(2): | 05 c5 3b d5 a1 be 50 e8 a8 b0 c2 0b 8e 57 cb 27 | d2 4d 79 c5 c4 36 be 77 44 d9 fd 7c 26 f6 e9 c1 | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x2" unrouted: NULL | install_inbound_ipsec_sa() checking if we can route | could_route called for westnet-eastnet-subnets/2x2 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x2" unrouted: NULL; eroute owner: NULL | routing is easy, or has resolvable near-conflict | checking if this is a replacement state | st=0x564d243badc8 ost=(nil) st->serialno=#3 ost->serialno=#0 | installing outgoing SA now as refhim=0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/2x2' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.a1fe27ca@192.1.2.45 included non-error error | outgoing SA has refhim=0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/2x2' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.b890e0ea@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe1e3 | add inbound eroute 192.0.1.128/28:0 --0-> 192.0.2.64/30:0 => tun.10000@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1040867 | raw_eroute result=success | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 460 | finished processing quick inI1 | complete v1 state transition with STF_OK | [RE]START processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #3 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1 | child state #3: QUICK_R0(established CHILD SA) => QUICK_R1(established CHILD SA) | event_already_set, deleting event | state #3 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7fbae8003618 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7fbaf4004218 | sending reply packet to 192.1.2.45:500 (from 192.1.2.23:500) | sending 460 bytes for STATE_QUICK_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #3) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 09 9e a1 a1 00 00 01 cc 11 35 a7 7a | e7 81 5b 6d 02 52 47 a7 95 1b 05 52 d4 3a 13 54 | 02 03 d8 a8 2d be 81 f4 09 36 f0 26 28 f1 99 d1 | ba 32 ee 16 71 f9 b8 d7 d8 fe 99 69 a7 0d 10 0b | 11 df 08 93 94 c3 dd 96 72 08 64 9d ba fc 37 1a | 0e 71 e7 2d 51 f6 3d 57 f5 ce e3 0c 3a 03 2f 71 | 02 9b f8 4b 30 f6 16 4f 04 b8 94 e1 31 c3 bc a0 | ff ff d6 cb a7 d1 a8 05 8a 9a f5 a7 1a 2b 20 60 | 2e b5 c8 d9 44 e7 21 69 c5 b7 a5 54 8d 71 21 fc | 53 c2 a9 d3 33 40 32 c0 38 cd c7 03 65 a1 ac b5 | 21 a0 57 43 82 0a cd 21 16 95 45 13 95 e0 c1 1f | 80 28 ad 8d 4c b6 54 86 ce 0d d2 c4 dc 30 ec 63 | 0b 4d da b6 a4 76 d5 6b f3 91 22 bd 16 af 6c fa | 31 90 c0 4a 4c 6c 51 4b 0b 29 8a 40 b2 13 db 7b | f0 28 e0 c7 8e c3 9a 87 46 a8 88 d6 01 18 2d 2d | c5 8b e7 7c c4 e3 9a 74 49 4f b4 bf 83 e1 a9 d0 | 5a 51 c0 c2 0d c7 30 b7 e1 62 b5 45 0d 79 8c 90 | 12 af 21 46 ea e7 46 fa 71 e2 ce 20 88 63 0b 0d | 23 95 c3 e1 7b d3 4d e8 60 01 74 86 ad 69 5f 62 | 97 4a 8d f4 2a c9 d9 d8 64 f0 09 07 21 55 bc 91 | 50 42 74 23 1a 03 68 67 eb 7c 1b ca e0 35 df b1 | da 16 32 66 f3 75 0a b1 a5 02 89 0a 32 84 d2 22 | 48 8a e1 2b d3 01 f6 fb ed 47 e7 34 dd de 93 78 | 2d 1a 95 f4 3f d7 38 20 48 32 79 56 5f 30 86 4a | e4 1a b7 3e 3d ba 4b e3 57 33 b1 4d 40 2c c5 df | 4c 0e c7 71 71 9c 8f 5b 7c d1 ff b0 bf 44 31 3b | fa ae 2a 7e 7c 83 a6 64 c8 a4 11 c6 6e 3a ab 0d | 49 26 38 be a2 3c 01 ac f1 09 63 dc | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x7fbaf4004218 | inserting event EVENT_RETRANSMIT, timeout in 0.5 seconds for #3 | libevent_malloc: new ptr-libevent@0x7fbaf0004fd8 size 128 | #3 STATE_QUICK_R1: retransmits: first event in 0.5 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.68394 | pstats #3 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/2x2" #3: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 tunnel mode {ESP=>0xa1fe27ca <0xb890e0ea xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #3 suppresed complete_v1_state_transition() | #3 spent 0.816 milliseconds in resume sending helper answer | stop processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbaf80027d8 | processing resume sending helper answer for #5 | start processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in resume_handler() at server.c:797) | crypto helper 3 replies to request ID 10 | calling continuation function 0x564d23dcdb50 | quick_inI1_outR1_cryptocontinue2 for #5: calculated DH, sending R1 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 558372946 (0x21481852) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 72 (0x48) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 97 0c 0d 6c | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0xfd13a8b3 for esp.0@192.1.2.23 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI fd 13 a8 b3 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | emitting 24 raw bytes of attributes into ISAKMP Transform Payload (ESP) | attributes 80 03 00 0e 80 04 00 01 80 01 00 01 80 02 70 80 | attributes 80 05 00 02 80 06 00 80 | emitting length of ISAKMP Transform Payload (ESP): 32 | emitting length of ISAKMP Proposal Payload: 44 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 56 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 "westnet-eastnet-subnets/2x1" #5: responding to Quick Mode proposal {msgid:21481852} "westnet-eastnet-subnets/2x1" #5: us: 192.0.2.16/28===192.1.2.23<192.1.2.23>[@east] "westnet-eastnet-subnets/2x1" #5: them: 192.1.2.45<192.1.2.45>[@west]===192.0.1.128/28 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Nr into ISAKMP Nonce Payload | Nr 50 c9 1f 8b f2 56 92 29 2b 93 9a f7 41 14 d1 9f | Nr 38 bb e9 83 58 ef ae af 50 77 12 6c 96 e6 3e 88 | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 4c b9 8d 72 5a c8 74 9e 2d 30 e4 2d 83 64 82 d8 | keyex value 44 d1 c0 f6 84 af 63 3d f4 96 11 cf 69 d1 f5 fc | keyex value 22 5d 15 20 1f ca d8 41 e8 42 c8 2f d4 e1 30 a5 | keyex value e2 d2 5e 8b f5 2d 40 e2 51 fe 4b fe b0 92 05 b3 | keyex value 62 47 8e 43 a7 8f ec 9f 8c 34 b5 d9 dc 6f 0f 79 | keyex value 0f a6 bb c9 63 e4 6d fa 0e eb ef 62 07 a2 a9 0a | keyex value ad 26 71 69 1a 05 f4 31 2b 8b ac f5 81 4d 8a 97 | keyex value 91 17 e9 96 d1 9e 2a ff 6c 8a b8 61 2c da a6 4b | keyex value f0 0d 03 b4 5f c8 fe 0f 63 fe b6 72 66 d1 8a 4a | keyex value 4c ab ae 64 29 8d 2c e0 4c b7 d1 57 22 d5 ec 33 | keyex value 54 91 2e dc fe 47 1b 8a 50 85 de dd 6d e8 72 9a | keyex value 11 53 fe 31 e4 92 50 1e b8 1a c2 b2 1d cf b7 da | keyex value e6 e6 c3 9f cd 52 43 88 3c 35 dc f9 dd 8b a9 33 | keyex value 21 dc da 4f b1 f9 7d af ce ab c9 36 62 69 bb 9a | keyex value e9 8a c8 e8 31 63 05 fc 5a 2e 21 e7 64 62 8f fb | keyex value 46 2b a6 83 d7 8b 98 08 4c 82 70 a0 94 46 9d f3 | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 8 raw bytes of ID body into ISAKMP Identification Payload (IPsec DOI) | ID body c0 00 01 80 ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 8 raw bytes of ID body into ISAKMP Identification Payload (IPsec DOI) | ID body c0 00 02 10 ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | quick inR1 outI2 HASH(2): | 7d 52 91 f6 50 26 fb cf 1a 07 89 60 c8 81 c0 d4 | a5 a7 e0 8c 77 fe 44 79 18 32 04 37 fd 4e 99 66 | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x1" unrouted: NULL | install_inbound_ipsec_sa() checking if we can route | could_route called for westnet-eastnet-subnets/2x1 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x1" unrouted: NULL; eroute owner: NULL | routing is easy, or has resolvable near-conflict | checking if this is a replacement state | st=0x564d243bb8b8 ost=(nil) st->serialno=#5 ost->serialno=#0 | installing outgoing SA now as refhim=0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/2x1' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.970c0d6c@192.1.2.45 included non-error error | outgoing SA has refhim=0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/2x1' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.fd13a8b3@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | add inbound eroute 192.0.1.128/28:0 --0-> 192.0.2.16/28:0 => tun.10000@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1041379 | raw_eroute result=success | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 460 | finished processing quick inI1 | complete v1 state transition with STF_OK | [RE]START processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #5 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1 | child state #5: QUICK_R0(established CHILD SA) => QUICK_R1(established CHILD SA) | event_already_set, deleting event | state #5 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7fbae0003f28 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7fbaec002b78 | sending reply packet to 192.1.2.45:500 (from 192.1.2.23:500) | sending 460 bytes for STATE_QUICK_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #5) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 21 48 18 52 00 00 01 cc 9d 46 f6 b2 | 6e 51 c3 aa bd 97 b9 63 d2 3f 5c 13 f0 d4 00 36 | f8 11 b2 dc 4d e2 bd 15 7d fc 09 55 ce 9b 50 94 | 1e 4a 58 76 7c 1f 41 71 e3 cc 8a 3d 58 ce 3d bb | 17 ba fa 19 9f 19 6d 1c b3 ab e2 42 3f 74 4d d2 | e3 28 42 85 30 15 46 9d d6 eb f2 2f 18 f0 a6 04 | 87 99 fe fa de 70 39 e3 c0 7d 9e d4 4b 70 0e 01 | ef 4f 6f 23 20 28 bd 57 f4 d0 f3 8c bf e6 25 f4 | 0c 57 bd 86 43 97 91 d7 aa ad fa 02 63 78 33 7b | 7b 6c 54 b4 33 94 24 3b 3f 06 2b 56 4c a1 74 d6 | 95 a3 f9 7e fa 67 73 6c 66 85 4c 92 df 47 e2 ff | 32 a6 d3 83 73 c8 8e 81 a2 b9 32 41 4c b8 f9 6f | 6e 59 a3 1f 2a 42 1b 80 9c 01 b7 62 85 58 f1 80 | d6 72 08 46 66 e8 85 95 16 6e 60 27 98 28 42 6d | 94 28 07 2a 56 40 91 0d 64 39 40 44 a1 10 08 55 | ed a1 27 b5 0a 8d 68 6a 7c 62 b1 2d e0 52 fe af | c6 fe 59 a0 d9 98 58 77 a8 15 e3 cc 7e 57 8c 48 | df 05 01 dc e8 81 48 81 e5 ef 8b 52 d8 8f 15 64 | 1e 5b b1 5a 19 cc d1 d5 96 9d 77 4d 7d da d8 89 | 93 ac ad d9 61 48 b0 18 54 eb d4 4c 80 da c3 7b | 8c 92 00 98 38 ee 3b 76 75 21 1d e3 ea 04 15 87 | 5b 74 2d 57 3b 2b e1 fb b0 79 d1 cf b2 cc e1 e1 | 08 22 79 04 c3 b8 56 cf 49 15 bf 31 4d 78 47 d3 | dc 6c e0 f6 04 97 4c 53 c2 c1 c8 37 2a 2a 5c 54 | a3 b1 24 ee 71 51 33 74 d1 79 2a 02 c5 e8 d6 e5 | 40 93 cb 8a f2 e9 64 54 e8 54 9b 81 66 43 57 7c | 00 30 9a 7f 0d 4f 11 16 b7 a7 d6 de 8f 87 8c 0a | e2 96 8f ea 87 bc 53 22 94 46 aa 75 | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x7fbaec002b78 | inserting event EVENT_RETRANSMIT, timeout in 0.5 seconds for #5 | libevent_malloc: new ptr-libevent@0x7fbaf80027d8 size 128 | #5 STATE_QUICK_R1: retransmits: first event in 0.5 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.684781 | pstats #5 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/2x1" #5: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2 tunnel mode {ESP=>0x970c0d6c <0xfd13a8b3 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #5 suppresed complete_v1_state_transition() | #5 spent 0.795 milliseconds in resume sending helper answer | stop processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7fbaf4005118 | spent 0.00327 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 76 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 bb f2 d7 7d 00 00 00 4c 93 d2 03 f6 | 63 00 c1 10 0a 66 fb b5 04 15 e7 60 66 43 fe a8 | 76 5b 8f 41 3e a5 7a 97 29 ce 0d 51 6b ce 4b ca | 44 29 85 60 81 3a 53 6c 93 d5 1c 1e | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3153254269 (0xbbf2d77d) | length: 76 (0x4c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #2 in QUICK_R1 (find_state_ikev1) | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1633) | #2 is idle | #2 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | removing 12 bytes of padding | quick_inI2 HASH(3): | ec ef 6e 94 7a 2a d8 a8 84 55 b8 d4 3d e8 7a c1 | ec 2b 71 fe 99 b1 cb 03 f5 af 19 b1 d6 96 9f 95 | received 'quick_inI2' message HASH(3) data ok | install_ipsec_sa() for #2: outbound only | could_route called for westnet-eastnet-subnets/1x1 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x1" unrouted: NULL; eroute owner: NULL | sr for #2: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x1" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-subnets/1x1 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #2 | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | eroute_connection add eroute 192.0.2.16/28:0 --0-> 192.0.1.0/28:0 => tun.0@192.1.2.45 (raw_eroute) | IPsec Sa SPD priority set to 1041379 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' | popen cmd is 1052 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-sub: | cmd( 80):nets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.2: | cmd( 160):3' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.: | cmd( 240):0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOC: | cmd( 320):OL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_: | cmd( 400):PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.: | cmd( 480):0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTO: | cmd( 560):COL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLIC: | cmd( 640):Y='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUT: | cmd( 720):O_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_: | cmd( 800):PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNE: | cmd( 880):R='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE: | cmd( 960):='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x9210c7f8 SPI_OUT=0x2974b46f ipsec : | cmd(1040):_updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_S | popen cmd is 1057 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.: | cmd( 160):1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET=: | cmd( 240):'192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_P: | cmd( 320):ROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' P: | cmd( 400):LUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192: | cmd( 480):.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_: | cmd( 560):PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_: | cmd( 640):POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO': | cmd( 720): PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUT: | cmd( 800):O_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_: | cmd( 880):BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_: | cmd( 960):IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x9210c7f8 SPI_OUT=0x2974b46f i: | cmd(1040):psec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARE | popen cmd is 1055 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.: | cmd( 160):2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='1: | cmd( 240):92.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PRO: | cmd( 320):TOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLU: | cmd( 400):TO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0: | cmd( 480):.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PR: | cmd( 560):OTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_PO: | cmd( 640):LICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' P: | cmd( 720):LUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_: | cmd( 800):IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BA: | cmd( 880):NNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IF: | cmd( 960):ACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x9210c7f8 SPI_OUT=0x2974b46f ips: | cmd(1040):ec _updown 2>&1: | route_and_eroute: instance "westnet-eastnet-subnets/1x1", setting eroute_owner {spd=0x564d243ac7b8,sr=0x564d243ac7b8} to #2 (was #0) (newest_ipsec_sa=#0) | #1 spent 1.8 milliseconds in install_ipsec_sa() | inI2: instance westnet-eastnet-subnets/1x1[0], setting IKEv1 newest_ipsec_sa to #2 (was #0) (spd.eroute=#2) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #2 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 | child state #2: QUICK_R1(established CHILD SA) => QUICK_R2(established CHILD SA) | event_already_set, deleting event | state #2 requesting EVENT_RETRANSMIT to be deleted | #2 STATE_QUICK_R2: retransmits: cleared | libevent_free: release ptr-libevent@0x7fbaf4003f28 | free_event_entry: release EVENT_RETRANSMIT-pe@0x7fbaf8002b78 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x7fbaf8002b78 | inserting event EVENT_SA_REPLACE, timeout in 28530 seconds for #2 | libevent_malloc: new ptr-libevent@0x7fbaf4005118 size 128 | pstats #2 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/1x1" #2: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x9210c7f8 <0x2974b46f xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | #2 spent 1.91 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 2.06 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00244 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 76 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 81 73 dc 8a 00 00 00 4c c3 0b f2 72 | 03 98 37 75 bc fc be 24 11 04 e9 19 43 a2 a2 80 | a4 ec b7 25 12 74 a2 4d c6 fb 59 27 f3 56 e0 9f | d0 0a 04 da 4e 5b 8a 64 9b 89 36 67 | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2171853962 (0x8173dc8a) | length: 76 (0x4c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #4 in QUICK_R1 (find_state_ikev1) | start processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1633) | #4 is idle | #4 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | removing 12 bytes of padding | quick_inI2 HASH(3): | 12 11 f9 19 a9 63 0e 6e f4 c2 df 1c f9 2d 86 a3 | 7c 5b c6 a2 f3 53 f5 92 c5 56 ab 70 cd 12 1d 2a | received 'quick_inI2' message HASH(3) data ok | install_ipsec_sa() for #4: outbound only | could_route called for westnet-eastnet-subnets/1x2 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x2" unrouted: "westnet-eastnet-subnets/1x1" erouted; eroute owner: NULL | sr for #4: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x2" unrouted: "westnet-eastnet-subnets/1x1" erouted; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-subnets/1x2 (next: none) ero:null esr:{(nil)} ro:westnet-eastnet-subnets/1x1 rosr:{0x564d243ac7b8} and state: #4 | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe1e3 | eroute_connection add eroute 192.0.2.64/30:0 --0-> 192.0.1.0/28:0 => tun.0@192.1.2.45 (raw_eroute) | IPsec Sa SPD priority set to 1040867 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='192.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' | popen cmd is 1052 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-sub: | cmd( 80):nets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.2: | cmd( 160):3' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='192.: | cmd( 240):0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROTOC: | cmd( 320):OL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_: | cmd( 400):PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.: | cmd( 480):0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTO: | cmd( 560):COL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLIC: | cmd( 640):Y='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUT: | cmd( 720):O_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_: | cmd( 800):PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNE: | cmd( 880):R='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE: | cmd( 960):='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x687d269a SPI_OUT=0x587c7ea5 ipsec : | cmd(1040):_updown 2>&1: | route_and_eroute: firewall_notified: true | route_and_eroute: instance "westnet-eastnet-subnets/1x2", setting eroute_owner {spd=0x564d243adaa8,sr=0x564d243adaa8} to #4 (was #0) (newest_ipsec_sa=#0) | #1 spent 0.697 milliseconds in install_ipsec_sa() | inI2: instance westnet-eastnet-subnets/1x2[0], setting IKEv1 newest_ipsec_sa to #4 (was #0) (spd.eroute=#4) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #4 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 | child state #4: QUICK_R1(established CHILD SA) => QUICK_R2(established CHILD SA) | event_already_set, deleting event | state #4 requesting EVENT_RETRANSMIT to be deleted | #4 STATE_QUICK_R2: retransmits: cleared | libevent_free: release ptr-libevent@0x7fbae4003f28 | free_event_entry: release EVENT_RETRANSMIT-pe@0x564d243b0758 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x564d243b0758 | inserting event EVENT_SA_REPLACE, timeout in 28530 seconds for #4 | libevent_malloc: new ptr-libevent@0x564d243b5d48 size 128 | pstats #4 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/1x2" #4: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x687d269a <0x587c7ea5 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | #4 spent 0.793 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.989 milliseconds in comm_handle_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00444 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00275 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.0027 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00263 milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00189 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 76 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 09 9e a1 a1 00 00 00 4c 16 cc 78 5a | 73 42 37 a7 98 c2 ab 4a fa 52 ce 0e 4a 54 25 2d | 61 b1 24 6f 42 41 77 1e c4 18 7f f5 eb 96 b3 25 | 29 fc 55 d1 d4 59 f2 16 e2 b4 72 4d | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 161391009 (0x99ea1a1) | length: 76 (0x4c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #3 in QUICK_R1 (find_state_ikev1) | start processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1633) | #3 is idle | #3 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | removing 12 bytes of padding | quick_inI2 HASH(3): | f5 91 12 bd c3 fa 3a 66 30 d4 00 96 7b 2a 5d 49 | dd bc 85 e7 fc 74 3d 12 a4 aa f7 8a 94 b7 4f e1 | received 'quick_inI2' message HASH(3) data ok | install_ipsec_sa() for #3: outbound only | could_route called for westnet-eastnet-subnets/2x2 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x2" unrouted: NULL; eroute owner: NULL | sr for #3: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x2" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-subnets/2x2 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #3 | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe1e3 | eroute_connection add eroute 192.0.2.64/30:0 --0-> 192.0.1.128/28:0 => tun.0@192.1.2.45 (raw_eroute) | IPsec Sa SPD priority set to 1040867 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='192.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED= | popen cmd is 1056 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-sub: | cmd( 80):nets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.2: | cmd( 160):3' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='192.: | cmd( 240):0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROTOC: | cmd( 320):OL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_: | cmd( 400):PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.: | cmd( 480):1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_P: | cmd( 560):ROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_P: | cmd( 640):OLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' : | cmd( 720):PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO: | cmd( 800):_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_B: | cmd( 880):ANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_I: | cmd( 960):FACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa1fe27ca SPI_OUT=0xb890e0ea ip: | cmd(1040):sec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='192.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' V | popen cmd is 1061 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-subnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.: | cmd( 160):1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET=: | cmd( 240):'192.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_P: | cmd( 320):ROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' P: | cmd( 400):LUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='1: | cmd( 480):92.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_P: | cmd( 560):EER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_C: | cmd( 640):ONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN: | cmd( 720):_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 : | cmd( 800):PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_P: | cmd( 880):EER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' : | cmd( 960):VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa1fe27ca SPI_OUT=0xb890e0: | cmd(1040):ea ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='192.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_S | popen cmd is 1059 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):subnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.: | cmd( 160):2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='1: | cmd( 240):92.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PRO: | cmd( 320):TOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLU: | cmd( 400):TO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192: | cmd( 480):.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEE: | cmd( 560):R_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CON: | cmd( 640):N_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_N: | cmd( 720):O' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PL: | cmd( 800):UTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEE: | cmd( 880):R_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VT: | cmd( 960):I_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa1fe27ca SPI_OUT=0xb890e0ea: | cmd(1040): ipsec _updown 2>&1: | route_and_eroute: instance "westnet-eastnet-subnets/2x2", setting eroute_owner {spd=0x564d243ae8e8,sr=0x564d243ae8e8} to #3 (was #0) (newest_ipsec_sa=#0) | #1 spent 1.78 milliseconds in install_ipsec_sa() | inI2: instance westnet-eastnet-subnets/2x2[0], setting IKEv1 newest_ipsec_sa to #3 (was #0) (spd.eroute=#3) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #3 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 | child state #3: QUICK_R1(established CHILD SA) => QUICK_R2(established CHILD SA) | event_already_set, deleting event | state #3 requesting EVENT_RETRANSMIT to be deleted | #3 STATE_QUICK_R2: retransmits: cleared | libevent_free: release ptr-libevent@0x7fbaf0004fd8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x7fbaf4004218 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x7fbaf4004218 | inserting event EVENT_SA_REPLACE, timeout in 28530 seconds for #3 | libevent_malloc: new ptr-libevent@0x564d243b3368 size 128 | pstats #3 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/2x2" #3: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0xa1fe27ca <0xb890e0ea xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | #3 spent 1.88 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 2.07 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00241 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 76 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 21 48 18 52 00 00 00 4c ea 1c 6a fb | 04 95 61 52 cf 6b 01 d2 67 de ad 18 f2 08 1c d7 | e7 2a de 0e 81 c9 56 9a 25 41 0d 61 6c a1 0e 12 | eb a0 a7 4d 36 6b 98 da e4 35 40 d6 | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 558372946 (0x21481852) | length: 76 (0x4c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #5 in QUICK_R1 (find_state_ikev1) | start processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1633) | #5 is idle | #5 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | removing 12 bytes of padding | quick_inI2 HASH(3): | 99 b3 57 3e d8 72 89 c7 7c 87 ca f9 c2 05 14 f4 | 9f 4d 64 7b 0c b8 74 be cf ad c2 e9 fc ea e5 a8 | received 'quick_inI2' message HASH(3) data ok | install_ipsec_sa() for #5: outbound only | could_route called for westnet-eastnet-subnets/2x1 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x1" unrouted: "westnet-eastnet-subnets/2x2" erouted; eroute owner: NULL | sr for #5: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x1" unrouted: "westnet-eastnet-subnets/2x2" erouted; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-subnets/2x1 (next: none) ero:null esr:{(nil)} ro:westnet-eastnet-subnets/2x2 rosr:{0x564d243ae8e8} and state: #5 | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | eroute_connection add eroute 192.0.2.16/28:0 --0-> 192.0.1.128/28:0 => tun.0@192.1.2.45 (raw_eroute) | IPsec Sa SPD priority set to 1041379 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED= | popen cmd is 1056 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-sub: | cmd( 80):nets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.2: | cmd( 160):3' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.: | cmd( 240):0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOC: | cmd( 320):OL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_: | cmd( 400):PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.: | cmd( 480):1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_P: | cmd( 560):ROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_P: | cmd( 640):OLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' : | cmd( 720):PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO: | cmd( 800):_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_B: | cmd( 880):ANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_I: | cmd( 960):FACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x970c0d6c SPI_OUT=0xfd13a8b3 ip: | cmd(1040):sec _updown 2>&1: | route_and_eroute: firewall_notified: true | route_and_eroute: instance "westnet-eastnet-subnets/2x1", setting eroute_owner {spd=0x564d243ae0d8,sr=0x564d243ae0d8} to #5 (was #0) (newest_ipsec_sa=#0) | #1 spent 0.714 milliseconds in install_ipsec_sa() | inI2: instance westnet-eastnet-subnets/2x1[0], setting IKEv1 newest_ipsec_sa to #5 (was #0) (spd.eroute=#5) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in complete_v1_state_transition() at ikev1.c:2673) | #5 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 | child state #5: QUICK_R1(established CHILD SA) => QUICK_R2(established CHILD SA) | event_already_set, deleting event | state #5 requesting EVENT_RETRANSMIT to be deleted | #5 STATE_QUICK_R2: retransmits: cleared | libevent_free: release ptr-libevent@0x7fbaf80027d8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x7fbaec002b78 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x7fbaec002b78 | inserting event EVENT_SA_REPLACE, timeout in 28530 seconds for #5 | libevent_malloc: new ptr-libevent@0x564d243bc458 size 128 | pstats #5 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/2x1" #5: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x970c0d6c <0xfd13a8b3 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | #5 spent 0.831 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 1.02 milliseconds in comm_handle_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.0035 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00271 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00265 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00271 milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00263 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 27 ad 33 90 00 00 00 5c 24 54 09 ed | 26 ff 8d ae 8e 26 22 ee be 5d 62 03 fe ae 65 fb | a3 2f 23 3e c2 a1 1e 57 d9 c2 1c a5 db ed 04 20 | b0 24 0b f9 ad b0 3a 00 ba 2d cb 3e bc 44 61 b5 | ed c6 bf c9 c7 d0 ba 3a 94 d9 fb 57 | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 665662352 (0x27ad3390) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #5; msgid=00000000 st_msgid=21481852 st_msgid_phase15=00000000 | peer and cookies match on #4; msgid=00000000 st_msgid=8173dc8a st_msgid_phase15=00000000 | peer and cookies match on #3; msgid=00000000 st_msgid=099ea1a1 st_msgid_phase15=00000000 | peer and cookies match on #2; msgid=00000000 st_msgid=bbf2d77d st_msgid_phase15=00000000 | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_R3 | State DB: found IKEv1 state #1 in MAIN_R3 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | 7c 75 de 8a b4 4f 18 fc 72 74 1a 0c 01 5c a6 9a | 2a f8 80 4c ee 17 80 15 fe e6 58 5d 0e 9f 6d 89 | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI a1 fe 27 ca | FOR_EACH_STATE_... in find_phase2_state_to_delete | start processing: connection "westnet-eastnet-subnets/2x2" (BACKGROUND) (in accept_delete() at ikev1_main.c:2515) "westnet-eastnet-subnets/2x2" #1: received Delete SA(0xa1fe27ca) payload: deleting IPsec State #3 | pstats #3 ikev1.ipsec deleted completed | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:879) | start processing: state #3 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:879) "westnet-eastnet-subnets/2x2" #3: deleting other state #3 (STATE_QUICK_R2) aged 0.333s and sending notification | child state #3: QUICK_R2(established CHILD SA) => delete | get_sa_info esp.a1fe27ca@192.1.2.45 | get_sa_info esp.b890e0ea@192.1.2.23 "westnet-eastnet-subnets/2x2" #3: ESP traffic information: in=0B out=0B | #3 send IKEv1 delete notification for STATE_QUICK_R2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2403355716 (0x8f404c44) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload b8 90 e0 ea | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | ec 02 94 6a a7 33 e4 71 7d 26 00 4e 75 20 d3 1b | 39 e5 ad d4 d4 5a 98 a5 9e a2 1b 01 c2 45 de 1e | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 8f 40 4c 44 00 00 00 5c 53 42 3f 4c | d9 cd ed 67 04 37 eb ee 15 b8 53 47 19 d3 ba f9 | 19 93 ac 4f 89 ea cf 37 da 46 8f 32 26 0e dc eb | 49 15 26 d6 2f a8 9a cd fb 0a 1d ba e3 ab bb cd | 22 11 4e d5 de 21 eb 48 dc 38 62 49 | state #3 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x564d243b3368 | free_event_entry: release EVENT_SA_REPLACE-pe@0x7fbaf4004218 | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='192.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no | popen cmd is 1067 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-s: | cmd( 80):ubnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2: | cmd( 160):.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='19: | cmd( 240):2.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROT: | cmd( 320):OCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUT: | cmd( 400):O_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.: | cmd( 480):0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER: | cmd( 560):_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' P: | cmd( 640):LUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALL: | cmd( 720):OW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAI: | cmd( 800):LED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' P: | cmd( 880):LUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURE: | cmd( 960):D='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa1fe27ca SPI_OUT=0x: | cmd(1040):b890e0ea ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-subnets/2x2' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe1e3 | IPsec Sa SPD priority set to 1040867 | delete esp.a1fe27ca@192.1.2.45 | netlink response for Del SA esp.a1fe27ca@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe1e3 | delete inbound eroute 192.0.1.128/28:0 --0-> 192.0.2.64/30:0 => unk255.10000@192.1.2.23 (raw_eroute) | raw_eroute result=success | delete esp.b890e0ea@192.1.2.23 | netlink response for Del SA esp.b890e0ea@192.1.2.23 included non-error error | stop processing: connection "westnet-eastnet-subnets/2x2" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/2x2 | State DB: deleting IKEv1 state #3 in QUICK_R2 | child state #3: QUICK_R2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #3 from 192.1.2.45:500 (in delete_state() at state.c:1143) | resume processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:1143) | connection 'westnet-eastnet-subnets/2x2' -POLICY_UP | FOR_EACH_STATE_... in shared_phase1_connection | processing: STOP connection NULL (in accept_delete() at ikev1_main.c:2556) | processing: STOP connection NULL (in accept_delete() at ikev1_main.c:2559) | del: | complete v1 state transition with STF_IGNORE | #1 spent 0.00581 milliseconds in process_packet_tail() | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 1.27 milliseconds in comm_handle_cb() reading and processing packet | spent 0.0029 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 f0 78 33 6e 00 00 00 5c 87 93 47 63 | ec 96 3d 42 95 9e 2d 42 df f3 bd c3 0d 85 28 a9 | e6 1a f5 eb fb 2d 3e 00 cf 37 fc 55 40 33 8c be | e7 2c b1 ed e3 b2 6f 8d 44 7e c7 3c 1e 15 c4 9c | 7e 67 fe c0 59 ca e9 bc b5 5c 35 8d | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 4034409326 (0xf078336e) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #5; msgid=00000000 st_msgid=21481852 st_msgid_phase15=00000000 | peer and cookies match on #4; msgid=00000000 st_msgid=8173dc8a st_msgid_phase15=00000000 | peer and cookies match on #2; msgid=00000000 st_msgid=bbf2d77d st_msgid_phase15=00000000 | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_R3 | State DB: found IKEv1 state #1 in MAIN_R3 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | 9c a1 3e 29 18 f2 e6 cb 44 6f 02 05 68 78 4f 1c | 15 45 31 82 d3 e1 3f bb 28 97 6a ca 71 a6 f7 02 | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI 97 0c 0d 6c | FOR_EACH_STATE_... in find_phase2_state_to_delete | start processing: connection "westnet-eastnet-subnets/2x1" (BACKGROUND) (in accept_delete() at ikev1_main.c:2515) "westnet-eastnet-subnets/2x2" #1: received Delete SA(0x970c0d6c) payload: deleting IPsec State #5 | pstats #5 ikev1.ipsec deleted completed | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:879) | start processing: state #5 connection "westnet-eastnet-subnets/2x1" from 192.1.2.45:500 (in delete_state() at state.c:879) "westnet-eastnet-subnets/2x1" #5: deleting other state #5 connection (STATE_QUICK_R2) "westnet-eastnet-subnets/2x1" aged 0.351s and sending notification | child state #5: QUICK_R2(established CHILD SA) => delete | get_sa_info esp.970c0d6c@192.1.2.45 | get_sa_info esp.fd13a8b3@192.1.2.23 "westnet-eastnet-subnets/2x1" #5: ESP traffic information: in=0B out=0B | #5 send IKEv1 delete notification for STATE_QUICK_R2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2780877015 (0xa5c0d0d7) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload fd 13 a8 b3 | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | 51 0d e8 15 2c 17 e2 10 85 94 b0 4d f2 64 4b 00 | e6 ed cd 78 4d 53 71 35 87 99 be 0d 68 cc 91 4d | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 a5 c0 d0 d7 00 00 00 5c 91 e8 ee 24 | 70 54 04 fd 6c f6 78 54 ff 8f f2 84 40 5f 4a c4 | 66 f8 a3 06 c0 d5 b4 2f 65 27 8c 27 4e 8e 7e 05 | 14 6c c3 8e 07 a7 25 db 2d 63 d7 1f 1a 5d 88 65 | 19 3b 71 05 a3 48 93 13 53 2d 07 f0 | state #5 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x564d243bc458 | free_event_entry: release EVENT_SA_REPLACE-pe@0x7fbaec002b78 | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no | popen cmd is 1067 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-s: | cmd( 80):ubnets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2: | cmd( 160):.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='19: | cmd( 240):2.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROT: | cmd( 320):OCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUT: | cmd( 400):O_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.: | cmd( 480):0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER: | cmd( 560):_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' P: | cmd( 640):LUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALL: | cmd( 720):OW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAI: | cmd( 800):LED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' P: | cmd( 880):LUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURE: | cmd( 960):D='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x970c0d6c SPI_OUT=0x: | cmd(1040):fd13a8b3 ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-subnets/2x1' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | IPsec Sa SPD priority set to 1041379 | delete esp.970c0d6c@192.1.2.45 | netlink response for Del SA esp.970c0d6c@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | delete inbound eroute 192.0.1.128/28:0 --0-> 192.0.2.16/28:0 => unk255.10000@192.1.2.23 (raw_eroute) | raw_eroute result=success | delete esp.fd13a8b3@192.1.2.23 | netlink response for Del SA esp.fd13a8b3@192.1.2.23 included non-error error | stop processing: connection "westnet-eastnet-subnets/2x1" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/2x1 | State DB: deleting IKEv1 state #5 in QUICK_R2 | child state #5: QUICK_R2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #5 from 192.1.2.45:500 (in delete_state() at state.c:1143) | resume processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:1143) | connection 'westnet-eastnet-subnets/2x1' -POLICY_UP | Deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #4 | state #2 | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #4 | state #2 | state #1 | processing: STOP connection NULL (in accept_delete() at ikev1_main.c:2556) | processing: STOP connection NULL (in accept_delete() at ikev1_main.c:2559) | del: | in statetime_start() with no state | complete v1 state transition with STF_IGNORE | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 1.33 milliseconds in comm_handle_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00429 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.0026 milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00261 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 45 6a e5 10 00 00 00 5c 8e a3 05 15 | 08 a4 f8 3b 5a ba d4 30 2c 58 d3 eb 54 37 06 8f | bf cf b8 b2 27 c8 8b 13 3d 25 01 4e 97 9f f9 fd | 4e bc 19 01 7d e4 60 fc 7d 7a da 64 06 12 ae 24 | 33 9a 8b 14 f7 4f a0 e1 ff 7d 92 20 | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1164633360 (0x456ae510) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #4; msgid=00000000 st_msgid=8173dc8a st_msgid_phase15=00000000 | peer and cookies match on #2; msgid=00000000 st_msgid=bbf2d77d st_msgid_phase15=00000000 | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_R3 | State DB: found IKEv1 state #1 in MAIN_R3 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | 6b 27 d4 5d 8e 3a 8d 96 ca a6 86 da 69 d6 0d 66 | 06 84 d3 80 bf f7 c4 6c aa 84 2b 2c 11 cb 85 b1 | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI 68 7d 26 9a | FOR_EACH_STATE_... in find_phase2_state_to_delete | start processing: connection "westnet-eastnet-subnets/1x2" (BACKGROUND) (in accept_delete() at ikev1_main.c:2515) "westnet-eastnet-subnets/2x2" #1: received Delete SA(0x687d269a) payload: deleting IPsec State #4 | pstats #4 ikev1.ipsec deleted completed | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:879) | start processing: state #4 connection "westnet-eastnet-subnets/1x2" from 192.1.2.45:500 (in delete_state() at state.c:879) "westnet-eastnet-subnets/1x2" #4: deleting other state #4 connection (STATE_QUICK_R2) "westnet-eastnet-subnets/1x2" aged 0.383s and sending notification | child state #4: QUICK_R2(established CHILD SA) => delete | get_sa_info esp.687d269a@192.1.2.45 | get_sa_info esp.587c7ea5@192.1.2.23 "westnet-eastnet-subnets/1x2" #4: ESP traffic information: in=0B out=0B | #4 send IKEv1 delete notification for STATE_QUICK_R2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3390380882 (0xca151b52) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload 58 7c 7e a5 | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | cc 53 eb 21 9c 07 77 56 d5 89 33 2b 33 6b b3 bc | fb b8 a8 71 c7 42 68 9f 74 54 7f 8f 24 93 85 b7 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 ca 15 1b 52 00 00 00 5c d0 96 f0 9e | 6a 17 17 a5 73 1a 4b c3 9d 47 a3 3a c2 d4 87 f1 | 23 78 9d 14 9b 74 0b 13 01 fa 91 aa 74 00 cd 52 | 9b 28 8c 83 c1 00 de 89 01 d5 91 0d 83 01 8d 42 | ff 42 a0 76 d1 d0 7a 9d ec f7 ea b3 | state #4 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x564d243b5d48 | free_event_entry: release EVENT_SA_REPLACE-pe@0x564d243b0758 | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='192.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VT | popen cmd is 1063 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-s: | cmd( 80):ubnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2: | cmd( 160):.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.64/30' PLUTO_MY_CLIENT_NET='19: | cmd( 240):2.0.2.64' PLUTO_MY_CLIENT_MASK='255.255.255.252' PLUTO_MY_PORT='0' PLUTO_MY_PROT: | cmd( 320):OCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUT: | cmd( 400):O_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.: | cmd( 480):1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PRO: | cmd( 560):TOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO: | cmd( 640):_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+E: | cmd( 720):SN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=: | cmd( 800):0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO: | cmd( 880):_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0: | cmd( 960):' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x687d269a SPI_OUT=0x587c: | cmd(1040):7ea5 ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-subnets/1x2' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe1e3 | IPsec Sa SPD priority set to 1040867 | delete esp.687d269a@192.1.2.45 | netlink response for Del SA esp.687d269a@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe1e3 | delete inbound eroute 192.0.1.0/28:0 --0-> 192.0.2.64/30:0 => unk255.10000@192.1.2.23 (raw_eroute) | raw_eroute result=success | delete esp.587c7ea5@192.1.2.23 | netlink response for Del SA esp.587c7ea5@192.1.2.23 included non-error error | stop processing: connection "westnet-eastnet-subnets/1x2" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/1x2 | State DB: deleting IKEv1 state #4 in QUICK_R2 | child state #4: QUICK_R2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #4 from 192.1.2.45:500 (in delete_state() at state.c:1143) | resume processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:1143) | connection 'westnet-eastnet-subnets/1x2' -POLICY_UP | Deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #2 | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #2 | state #1 | processing: STOP connection NULL (in accept_delete() at ikev1_main.c:2556) | processing: STOP connection NULL (in accept_delete() at ikev1_main.c:2559) | del: | in statetime_start() with no state | complete v1 state transition with STF_IGNORE | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 1.27 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00246 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.45:500 on eth1 (192.1.2.23:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 77 b5 95 75 00 00 00 5c e8 e7 fc 96 | 3a 06 aa 00 97 cd 7f de 5b 4a 0d a5 9b f3 9d d6 | c9 28 13 71 37 fc 97 2f 51 cf 47 3a 8a b1 b4 81 | c9 e0 5e 21 b0 43 74 9b 4b bc 00 d3 e0 65 29 62 | a8 51 d3 2b 79 88 e3 7d a5 55 47 0a | start processing: from 192.1.2.45:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2008388981 (0x77b59575) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #2; msgid=00000000 st_msgid=bbf2d77d st_msgid_phase15=00000000 | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_R3 | State DB: found IKEv1 state #1 in MAIN_R3 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.45:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | a7 dd ca af b0 09 61 59 91 8e 39 02 dc 8f cb 8f | a3 8c 96 22 1d b7 ea c1 41 90 e0 5e c6 a1 e0 5e | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI 92 10 c7 f8 | FOR_EACH_STATE_... in find_phase2_state_to_delete | start processing: connection "westnet-eastnet-subnets/1x1" (BACKGROUND) (in accept_delete() at ikev1_main.c:2515) "westnet-eastnet-subnets/2x2" #1: received Delete SA(0x9210c7f8) payload: deleting IPsec State #2 | pstats #2 ikev1.ipsec deleted completed | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:879) | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.45:500 (in delete_state() at state.c:879) "westnet-eastnet-subnets/1x1" #2: deleting other state #2 connection (STATE_QUICK_R2) "westnet-eastnet-subnets/1x1" aged 0.405s and sending notification | child state #2: QUICK_R2(established CHILD SA) => delete | get_sa_info esp.9210c7f8@192.1.2.45 | get_sa_info esp.2974b46f@192.1.2.23 "westnet-eastnet-subnets/1x1" #2: ESP traffic information: in=0B out=0B | #2 send IKEv1 delete notification for STATE_QUICK_R2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 794184716 (0x2f564c0c) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload 29 74 b4 6f | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | 87 6b fe 24 58 9c bc 76 de a5 e9 cc fb 32 5d 53 | aa 70 88 c4 81 40 03 3d 7e 72 93 33 72 da 75 1d | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 2f 56 4c 0c 00 00 00 5c a6 00 bd 92 | 79 39 dd a8 47 ee be d1 6b e5 41 be f0 d4 2e ef | 28 88 88 9c 07 79 e8 ea 89 61 37 87 11 fa 95 e2 | 7c c4 dc 8f b7 d4 b4 da c8 4c d4 97 3c c7 57 f5 | 4b e6 29 bc c3 11 fa 1a 4f 2c 69 b5 | state #2 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x7fbaf4005118 | free_event_entry: release EVENT_SA_REPLACE-pe@0x7fbaf8002b78 | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VT | popen cmd is 1063 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-s: | cmd( 80):ubnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2: | cmd( 160):.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='19: | cmd( 240):2.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROT: | cmd( 320):OCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUT: | cmd( 400):O_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.: | cmd( 480):1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PRO: | cmd( 560):TOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO: | cmd( 640):_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+E: | cmd( 720):SN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=: | cmd( 800):0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO: | cmd( 880):_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0: | cmd( 960):' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x9210c7f8 SPI_OUT=0x2974: | cmd(1040):b46f ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-subnets/1x1' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | IPsec Sa SPD priority set to 1041379 | delete esp.9210c7f8@192.1.2.45 | netlink response for Del SA esp.9210c7f8@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | delete inbound eroute 192.0.1.0/28:0 --0-> 192.0.2.16/28:0 => unk255.10000@192.1.2.23 (raw_eroute) | raw_eroute result=success | delete esp.2974b46f@192.1.2.23 | netlink response for Del SA esp.2974b46f@192.1.2.23 included non-error error | stop processing: connection "westnet-eastnet-subnets/1x1" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/1x1 | State DB: deleting IKEv1 state #2 in QUICK_R2 | child state #2: QUICK_R2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #2 from 192.1.2.45:500 (in delete_state() at state.c:1143) | resume processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:1143) | connection 'westnet-eastnet-subnets/1x1' -POLICY_UP | Deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #1 | processing: STOP connection NULL (in accept_delete() at ikev1_main.c:2556) | processing: STOP connection NULL (in accept_delete() at ikev1_main.c:2559) | del: | in statetime_start() with no state | complete v1 state transition with STF_IGNORE | stop processing: from 192.1.2.45:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 1.16 milliseconds in comm_handle_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00483 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00286 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_STATE_... in show_states_status (sort_states) | FOR_EACH_STATE_... in sort_states | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.03 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) shutting down | processing: RESET whack log_fd (was fd@16) (in exit_pluto() at plutomain.c:1825) | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' | unreference key: 0x564d243ad1e8 @east cnt 1-- | unreference key: 0x564d24305c48 @west cnt 2-- | start processing: connection "westnet-eastnet-subnets/2x2" (in delete_connection() at connections.c:189) | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #1 | suspend processing: connection "westnet-eastnet-subnets/2x2" (in foreach_state_by_connection_func_delete() at state.c:1310) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #1 ikev1.isakmp deleted completed | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.45:500 (in delete_state() at state.c:879) "westnet-eastnet-subnets/2x2" #1: deleting state (STATE_MAIN_R3) aged 1.872s and sending notification | parent state #1: MAIN_R3(established IKE SA) => delete | #1 send IKEv1 delete notification for STATE_MAIN_R3 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2448675022 (0x91f3d0ce) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 1 (0x1) | SPI size: 16 (0x10) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 8 raw bytes of initiator SPI into ISAKMP Delete Payload | initiator SPI c1 22 4f 37 94 92 35 7c | emitting 8 raw bytes of responder SPI into ISAKMP Delete Payload | responder SPI 67 7f 04 7b d5 9e 0e 70 | emitting length of ISAKMP Delete Payload: 28 | send delete HASH(1): | bc 6f ba 24 e4 60 8a 12 ba 37 01 97 26 21 a5 90 | 83 db b5 5f 84 f4 19 2d a3 c8 c6 0a 03 39 5e d9 | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.23:500 to 192.1.2.45:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 91 f3 d0 ce 00 00 00 5c 4e 1c 75 8b | 72 9c 48 3d b6 fd 69 8a 90 4f be 02 e5 eb 71 27 | 5b 75 d7 30 40 3c a8 3e f2 2c c2 95 8c 7e d7 74 | 4f 8a 51 b3 e4 d8 80 de 1d 99 ef 8d bb d2 ae 4c | e0 df 00 ff 29 b8 96 51 41 83 a4 26 | state #1 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x7fbaf8002888 | free_event_entry: release EVENT_SA_REPLACE-pe@0x564d243acf58 | State DB: IKEv1 state not found (flush_incomplete_children) | stop processing: connection "westnet-eastnet-subnets/2x2" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/2x2 | State DB: deleting IKEv1 state #1 in MAIN_R3 | parent state #1: MAIN_R3(established IKE SA) => UNDEFINED(ignore) | unreference key: 0x564d24305c48 @west cnt 1-- | stop processing: state #1 from 192.1.2.45:500 (in delete_state() at state.c:1143) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | shunt_eroute() called for connection 'westnet-eastnet-subnets/2x2' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe1e3 | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe1e3 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x2" unrouted: "westnet-eastnet-subnets/2x1" prospective erouted | flush revival: connection 'westnet-eastnet-subnets/2x2' wasn't on the list | processing: STOP connection NULL (in discard_connection() at connections.c:249) | start processing: connection "westnet-eastnet-subnets/2x1" (in delete_connection() at connections.c:189) | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-subnets/2x1' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x1" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET='192.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' | popen cmd is 1048 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-subnets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.: | cmd( 160):1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET=: | cmd( 240):'192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_P: | cmd( 320):ROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.45' : | cmd( 400):PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.128/28' PLUTO_PEER_CLIENT_NET=': | cmd( 480):192.0.1.128' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_: | cmd( 560):PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_: | cmd( 640):CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ES: | cmd( 720):N_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0: | cmd( 800): PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_: | cmd( 880):PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0': | cmd( 960): VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _upd: | cmd(1040):own 2>&1: "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/2x1": unroute-client output: Error: Peer netns reference is invalid. | flush revival: connection 'westnet-eastnet-subnets/2x1' wasn't on the list | stop processing: connection "westnet-eastnet-subnets/2x1" (in discard_connection() at connections.c:249) | start processing: connection "westnet-eastnet-subnets/1x2" (in delete_connection() at connections.c:189) | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-subnets/1x2' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe1e3 | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe1e3 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x2" unrouted: "westnet-eastnet-subnets/1x1" prospective erouted | flush revival: connection 'westnet-eastnet-subnets/1x2' wasn't on the list | stop processing: connection "westnet-eastnet-subnets/1x2" (in discard_connection() at connections.c:249) | start processing: connection "westnet-eastnet-subnets/1x1" (in delete_connection() at connections.c:189) | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-subnets/1x1' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x1" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET='192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_ | popen cmd is 1044 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.: | cmd( 160):1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.16/28' PLUTO_MY_CLIENT_NET=: | cmd( 240):'192.0.2.16' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_P: | cmd( 320):ROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.45' : | cmd( 400):PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/28' PLUTO_PEER_CLIENT_NET='19: | cmd( 480):2.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER: | cmd( 560):_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN: | cmd( 640):_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO: | cmd( 720):' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLU: | cmd( 800):TO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER: | cmd( 880):_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI: | cmd( 960):_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown : | cmd(1040):2>&1: "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. | free hp@0x564d243ace78 | flush revival: connection 'westnet-eastnet-subnets/1x1' wasn't on the list | stop processing: connection "westnet-eastnet-subnets/1x1" (in discard_connection() at connections.c:249) | crl fetch request list locked by 'free_crl_fetch' | crl fetch request list unlocked by 'free_crl_fetch' shutting down interface lo/lo 127.0.0.1:4500 shutting down interface lo/lo 127.0.0.1:500 shutting down interface eth0/eth0 192.0.2.254:4500 shutting down interface eth0/eth0 192.0.2.254:500 shutting down interface eth1/eth1 192.1.2.23:4500 shutting down interface eth1/eth1 192.1.2.23:500 | FOR_EACH_STATE_... in delete_states_dead_interfaces | libevent_free: release ptr-libevent@0x564d2439fec8 | free_event_entry: release EVENT_NULL-pe@0x564d243ab9c8 | libevent_free: release ptr-libevent@0x564d24335928 | free_event_entry: release EVENT_NULL-pe@0x564d243aba78 | libevent_free: release ptr-libevent@0x564d24335878 | free_event_entry: release EVENT_NULL-pe@0x564d243abb28 | libevent_free: release ptr-libevent@0x564d243364a8 | free_event_entry: release EVENT_NULL-pe@0x564d243abbd8 | libevent_free: release ptr-libevent@0x564d2430a4e8 | free_event_entry: release EVENT_NULL-pe@0x564d243abc88 | libevent_free: release ptr-libevent@0x564d2430a1d8 | free_event_entry: release EVENT_NULL-pe@0x564d243abd38 | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | libevent_free: release ptr-libevent@0x564d2439ff78 | free_event_entry: release EVENT_NULL-pe@0x564d24393d68 | libevent_free: release ptr-libevent@0x564d24334188 | free_event_entry: release EVENT_NULL-pe@0x564d24393cf8 | libevent_free: release ptr-libevent@0x564d24377568 | free_event_entry: release EVENT_NULL-pe@0x564d243931b8 | global timer EVENT_REINIT_SECRET uninitialized | global timer EVENT_SHUNT_SCAN uninitialized | global timer EVENT_PENDING_DDNS uninitialized | global timer EVENT_PENDING_PHASE2 uninitialized | global timer EVENT_CHECK_CRLS uninitialized | global timer EVENT_REVIVE_CONNS uninitialized | global timer EVENT_FREE_ROOT_CERTS uninitialized | global timer EVENT_RESET_LOG_RATE_LIMIT uninitialized | global timer EVENT_NAT_T_KEEPALIVE uninitialized | libevent_free: release ptr-libevent@0x564d2433e778 | signal event handler PLUTO_SIGCHLD uninstalled | libevent_free: release ptr-libevent@0x564d24336578 | signal event handler PLUTO_SIGTERM uninstalled | libevent_free: release ptr-libevent@0x564d243ab388 | signal event handler PLUTO_SIGHUP uninstalled | libevent_free: release ptr-libevent@0x564d243ab5c8 | signal event handler PLUTO_SIGSYS uninstalled | releasing event base | libevent_free: release ptr-libevent@0x564d243ab498 | libevent_free: release ptr-libevent@0x564d2438e638 | libevent_free: release ptr-libevent@0x564d2438e5e8 | libevent_free: release ptr-libevent@0x7fbaf4003e78 | libevent_free: release ptr-libevent@0x564d2438e538 | libevent_free: release ptr-libevent@0x564d243ab248 | libevent_free: release ptr-libevent@0x564d243ab2c8 | libevent_free: release ptr-libevent@0x564d2438e7e8 | libevent_free: release ptr-libevent@0x564d243932c8 | libevent_free: release ptr-libevent@0x564d24393cb8 | libevent_free: release ptr-libevent@0x564d243abda8 | libevent_free: release ptr-libevent@0x564d243abcf8 | libevent_free: release ptr-libevent@0x564d243abc48 | libevent_free: release ptr-libevent@0x564d243abb98 | libevent_free: release ptr-libevent@0x564d243abae8 | libevent_free: release ptr-libevent@0x564d243aba38 | libevent_free: release ptr-libevent@0x564d24333788 | libevent_free: release ptr-libevent@0x564d243ab348 | libevent_free: release ptr-libevent@0x564d243ab308 | libevent_free: release ptr-libevent@0x564d243ab288 | libevent_free: release ptr-libevent@0x564d243ab458 | libevent_free: release ptr-libevent@0x564d24332918 | libevent_free: release ptr-libevent@0x564d24309908 | libevent_free: release ptr-libevent@0x564d24309d38 | libevent_free: release ptr-libevent@0x564d24332c88 | releasing global libevent data | libevent_free: release ptr-libevent@0x564d24334128 | libevent_free: release ptr-libevent@0x564d24309cd8 | libevent_free: release ptr-libevent@0x564d24309dd8 leak detective found no leaks