FIPS Product: YES FIPS Kernel: NO FIPS Mode: NO NSS DB directory: sql:/etc/ipsec.d Initializing NSS Opening NSS database "sql:/etc/ipsec.d" read-only NSS initialized NSS crypto library initialized FIPS HMAC integrity support [enabled] FIPS mode disabled for pluto daemon FIPS HMAC integrity verification self-test FAILED libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v3.28-685-gbfd5aef521-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:6936 core dump dir: /var/tmp secrets file: /etc/ipsec.secrets leak-detective enabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: new ptr-libevent@0x5650ce289128 size 40 | libevent_malloc: new ptr-libevent@0x5650ce25ecd8 size 40 | libevent_malloc: new ptr-libevent@0x5650ce25edd8 size 40 | creating event base | libevent_malloc: new ptr-libevent@0x5650ce2e3578 size 56 | libevent_malloc: new ptr-libevent@0x5650ce287c88 size 664 | libevent_malloc: new ptr-libevent@0x5650ce2e35e8 size 24 | libevent_malloc: new ptr-libevent@0x5650ce2e3638 size 384 | libevent_malloc: new ptr-libevent@0x5650ce2e3538 size 16 | libevent_malloc: new ptr-libevent@0x5650ce25e908 size 40 | libevent_malloc: new ptr-libevent@0x5650ce25ed38 size 48 | libevent_realloc: new ptr-libevent@0x5650ce288788 size 256 | libevent_malloc: new ptr-libevent@0x5650ce2e37e8 size 16 | libevent_free: release ptr-libevent@0x5650ce2e3578 | libevent initialized | libevent_realloc: new ptr-libevent@0x5650ce2e3578 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm, aes_ccm_c AES_CCM_12 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_b AES_CCM_8 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_a 3DES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS [*192] 3des CAMELLIA_CTR IKEv1: ESP IKEv2: ESP {256,192,*128} CAMELLIA_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} camellia AES_GCM_16 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm, aes_gcm_c AES_GCM_12 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_b AES_GCM_8 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_a AES_CTR IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aesctr AES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aes SERPENT_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} serpent TWOFISH_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} twofish TWOFISH_SSH IKEv1: IKE IKEv2: IKE ESP {256,192,*128} twofish_cbc_ssh NULL_AUTH_AES_GMAC IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_gmac NULL IKEv1: ESP IKEv2: ESP [] CHACHA20_POLY1305 IKEv1: IKEv2: IKE ESP [*256] chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: SHA1 IKEv1: IKE IKEv2: FIPS sha SHA2_256 IKEv1: IKE IKEv2: FIPS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: FIPS sha384 SHA2_512 IKEv1: IKE IKEv2: FIPS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 crypto helpers started thread for crypto helper 0 | starting up helper thread 0 | status value returned by setting the priority of this thread (crypto helper 0) 22 | crypto helper 0 waiting (nothing to do) started thread for crypto helper 1 started thread for crypto helper 2 | starting up helper thread 2 | status value returned by setting the priority of this thread (crypto helper 2) 22 | crypto helper 2 waiting (nothing to do) started thread for crypto helper 3 | starting up helper thread 3 | status value returned by setting the priority of this thread (crypto helper 3) 22 | crypto helper 3 waiting (nothing to do) started thread for crypto helper 4 | starting up helper thread 4 | status value returned by setting the priority of this thread (crypto helper 4) 22 | crypto helper 4 waiting (nothing to do) started thread for crypto helper 5 | starting up helper thread 5 | status value returned by setting the priority of this thread (crypto helper 5) 22 | crypto helper 5 waiting (nothing to do) | starting up helper thread 1 | status value returned by setting the priority of this thread (crypto helper 1) 22 | crypto helper 1 waiting (nothing to do) started thread for crypto helper 6 | checking IKEv1 state table | MAIN_R0: category: half-open IKE SA flags: 0: | -> MAIN_R1 EVENT_SO_DISCARD | MAIN_I1: category: half-open IKE SA flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT | MAIN_R1: category: open IKE SA flags: 200: | -> MAIN_R2 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_I2: category: open IKE SA flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_R2: category: open IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | -> MAIN_R3 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_I3: category: open IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | -> MAIN_I4 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_R3: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | MAIN_I4: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | AGGR_R0: category: half-open IKE SA flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD | AGGR_I1: category: half-open IKE SA flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE | -> AGGR_I2 EVENT_SA_REPLACE | AGGR_R1: category: open IKE SA flags: 200: | -> AGGR_R2 EVENT_SA_REPLACE | -> AGGR_R2 EVENT_SA_REPLACE | AGGR_I2: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | AGGR_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | QUICK_R0: category: established CHILD SA flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT | QUICK_I1: category: established CHILD SA flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE | QUICK_R1: category: established CHILD SA flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE | QUICK_I2: category: established CHILD SA flags: 200: | -> UNDEFINED EVENT_NULL | QUICK_R2: category: established CHILD SA flags: 0: | -> UNDEFINED EVENT_NULL | INFO: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | INFO_PROTECTED: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | XAUTH_R0: category: established IKE SA flags: 0: | -> XAUTH_R1 EVENT_NULL | XAUTH_R1: category: established IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | MODE_CFG_R0: category: informational flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE | MODE_CFG_R1: category: established IKE SA flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE | MODE_CFG_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | MODE_CFG_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | XAUTH_I0: category: established IKE SA flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT | XAUTH_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT | checking IKEv2 state table | PARENT_I0: category: ignore flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA flags: 0: | -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH) | PARENT_I2: category: open IKE SA flags: 0: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_I3: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_RETAIN (I3: Informational Request) | -> PARENT_I3 EVENT_RETAIN (I3: Informational Response) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response) | PARENT_R0: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED)) | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request) | PARENT_R2: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request) | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response) | V2_CREATE_I0: category: established IKE SA flags: 0: | -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | V2_CREATE_I: category: established IKE SA flags: 0: | -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_IKE_I0: category: established IKE SA flags: 0: | -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_REKEY_CHILD_I0: category: established IKE SA flags: 0: | -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_REKEY_CHILD_I: category: established IKE SA flags: 0: | V2_CREATE_R: category: established IKE SA flags: 0: | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request) | V2_REKEY_IKE_R: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_R: category: established IKE SA flags: 0: | V2_IPSEC_I: category: established CHILD SA flags: 0: | V2_IPSEC_R: category: established CHILD SA flags: 0: | IKESA_DEL: category: established IKE SA flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational flags: 0: Using Linux XFRM/NETKEY IPsec interface code on 5.1.18-200.fc29.x86_64 | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding SERPENT_CBC to kernel algorithm db | adding TWOFISH_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x5650ce2e81b8 | libevent_malloc: new ptr-libevent@0x5650ce2cc568 size 128 | libevent_malloc: new ptr-libevent@0x5650ce2e82c8 size 16 | add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x5650ce2e8cf8 | libevent_malloc: new ptr-libevent@0x5650ce289188 size 128 | libevent_malloc: new ptr-libevent@0x5650ce2e8cb8 size 16 | starting up helper thread 6 | status value returned by setting the priority of this thread (crypto helper 6) 22 | crypto helper 6 waiting (nothing to do) | global one-shot timer EVENT_CHECK_CRLS initialized selinux support is enabled. | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | Loading dnssec root key from:/var/lib/unbound/root.key | No additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x5650ce2e8d68 | libevent_malloc: new ptr-libevent@0x5650ce2f4f78 size 128 | libevent_malloc: new ptr-libevent@0x5650ce300248 size 16 | libevent_realloc: new ptr-libevent@0x5650ce287918 size 256 | libevent_malloc: new ptr-libevent@0x5650ce300288 size 8 | libevent_realloc: new ptr-libevent@0x5650ce2893f8 size 144 | libevent_malloc: new ptr-libevent@0x5650ce293778 size 152 | libevent_malloc: new ptr-libevent@0x5650ce3002c8 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: new ptr-libevent@0x5650ce300308 size 8 | libevent_malloc: new ptr-libevent@0x5650ce28b578 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: new ptr-libevent@0x5650ce300348 size 8 | libevent_malloc: new ptr-libevent@0x5650ce300388 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: new ptr-libevent@0x5650ce300458 size 8 | libevent_realloc: release ptr-libevent@0x5650ce2893f8 | libevent_realloc: new ptr-libevent@0x5650ce300498 size 256 | libevent_malloc: new ptr-libevent@0x5650ce3005c8 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:7320) using fork+execve | forked child 7320 | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 Kernel supports NIC esp-hw-offload adding interface eth1/eth1 (esp-hw-offload not supported by kernel) 192.1.2.45:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth1/eth1 192.1.2.45:4500 adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.0.1.254:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth0/eth0 192.0.1.254:4500 adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface lo/lo 127.0.0.1:4500 | no interfaces to sort | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | add_fd_read_event_handler: new ethX-pe@0x5650ce3009c8 | libevent_malloc: new ptr-libevent@0x5650ce2f4ec8 size 128 | libevent_malloc: new ptr-libevent@0x5650ce300a38 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 22 | add_fd_read_event_handler: new ethX-pe@0x5650ce300a78 | libevent_malloc: new ptr-libevent@0x5650ce28ab38 size 128 | libevent_malloc: new ptr-libevent@0x5650ce300ae8 size 16 | setup callback for interface lo 127.0.0.1:500 fd 21 | add_fd_read_event_handler: new ethX-pe@0x5650ce300b28 | libevent_malloc: new ptr-libevent@0x5650ce28aa88 size 128 | libevent_malloc: new ptr-libevent@0x5650ce300b98 size 16 | setup callback for interface eth0 192.0.1.254:4500 fd 20 | add_fd_read_event_handler: new ethX-pe@0x5650ce300bd8 | libevent_malloc: new ptr-libevent@0x5650ce28b4a8 size 128 | libevent_malloc: new ptr-libevent@0x5650ce300c48 size 16 | setup callback for interface eth0 192.0.1.254:500 fd 19 | add_fd_read_event_handler: new ethX-pe@0x5650ce300c88 | libevent_malloc: new ptr-libevent@0x5650ce25f4e8 size 128 | libevent_malloc: new ptr-libevent@0x5650ce300cf8 size 16 | setup callback for interface eth1 192.1.2.45:4500 fd 18 | add_fd_read_event_handler: new ethX-pe@0x5650ce300d38 | libevent_malloc: new ptr-libevent@0x5650ce25f1d8 size 128 | libevent_malloc: new ptr-libevent@0x5650ce300da8 size 16 | setup callback for interface eth1 192.1.2.45:500 fd 17 | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 loaded private key for keyid: PKK_RSA:AQOm9dY/4 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.629 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 | no interfaces to sort | libevent_free: release ptr-libevent@0x5650ce2f4ec8 | free_event_entry: release EVENT_NULL-pe@0x5650ce3009c8 | add_fd_read_event_handler: new ethX-pe@0x5650ce3009c8 | libevent_malloc: new ptr-libevent@0x5650ce2f4ec8 size 128 | setup callback for interface lo 127.0.0.1:4500 fd 22 | libevent_free: release ptr-libevent@0x5650ce28ab38 | free_event_entry: release EVENT_NULL-pe@0x5650ce300a78 | add_fd_read_event_handler: new ethX-pe@0x5650ce300a78 | libevent_malloc: new ptr-libevent@0x5650ce28ab38 size 128 | setup callback for interface lo 127.0.0.1:500 fd 21 | libevent_free: release ptr-libevent@0x5650ce28aa88 | free_event_entry: release EVENT_NULL-pe@0x5650ce300b28 | add_fd_read_event_handler: new ethX-pe@0x5650ce300b28 | libevent_malloc: new ptr-libevent@0x5650ce28aa88 size 128 | setup callback for interface eth0 192.0.1.254:4500 fd 20 | libevent_free: release ptr-libevent@0x5650ce28b4a8 | free_event_entry: release EVENT_NULL-pe@0x5650ce300bd8 | add_fd_read_event_handler: new ethX-pe@0x5650ce300bd8 | libevent_malloc: new ptr-libevent@0x5650ce28b4a8 size 128 | setup callback for interface eth0 192.0.1.254:500 fd 19 | libevent_free: release ptr-libevent@0x5650ce25f4e8 | free_event_entry: release EVENT_NULL-pe@0x5650ce300c88 | add_fd_read_event_handler: new ethX-pe@0x5650ce300c88 | libevent_malloc: new ptr-libevent@0x5650ce25f4e8 size 128 | setup callback for interface eth1 192.1.2.45:4500 fd 18 | libevent_free: release ptr-libevent@0x5650ce25f1d8 | free_event_entry: release EVENT_NULL-pe@0x5650ce300d38 | add_fd_read_event_handler: new ethX-pe@0x5650ce300d38 | libevent_malloc: new ptr-libevent@0x5650ce25f1d8 size 128 | setup callback for interface eth1 192.1.2.45:500 fd 17 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 loaded private key for keyid: PKK_RSA:AQOm9dY/4 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.797 milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 7320 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0201 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-subnets/1x1 with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | counting wild cards for @west is 0 | counting wild cards for @east is 0 | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | new hp@0x5650ce301e78 added connection description "westnet-eastnet-subnets/1x1" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.1.0/28===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.16/28 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.113 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @west | add pubkey 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | add pubkey 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | add pubkey b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | add pubkey 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | add pubkey 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | add pubkey f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | add pubkey ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | add pubkey 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | add pubkey b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | add pubkey 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | add pubkey 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | add pubkey ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | add pubkey 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | add pubkey d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | add pubkey 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | add pubkey 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | add pubkey c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | add pubkey 15 04 37 f9 | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.111 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @east | add pubkey 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | add pubkey e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | add pubkey 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | add pubkey 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | add pubkey 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | add pubkey d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | add pubkey 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | add pubkey 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | add pubkey bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | add pubkey ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | add pubkey e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | add pubkey 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | add pubkey 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | add pubkey 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | add pubkey d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | add pubkey 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | add pubkey 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | add pubkey 51 51 48 ef | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0881 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-subnets/1x2 with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | counting wild cards for @west is 0 | counting wild cards for @east is 0 | find_host_pair: comparing 192.1.2.45:500 to 192.1.2.23:500 but ignoring ports | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@0x5650ce301e78: westnet-eastnet-subnets/1x1 added connection description "westnet-eastnet-subnets/1x2" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.1.0/28===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.64/30 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0858 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @west | unreference key: 0x5650ce25ac48 @west cnt 1-- | add pubkey 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | add pubkey 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | add pubkey b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | add pubkey 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | add pubkey 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | add pubkey f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | add pubkey ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | add pubkey 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | add pubkey b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | add pubkey 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | add pubkey 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | add pubkey ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | add pubkey 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | add pubkey d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | add pubkey 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | add pubkey 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | add pubkey c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | add pubkey 15 04 37 f9 | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0765 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @east | unreference key: 0x5650ce3021e8 @east cnt 1-- | add pubkey 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | add pubkey e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | add pubkey 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | add pubkey 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | add pubkey 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | add pubkey d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | add pubkey 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | add pubkey 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | add pubkey bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | add pubkey ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | add pubkey e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | add pubkey 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | add pubkey 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | add pubkey 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | add pubkey d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | add pubkey 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | add pubkey 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | add pubkey 51 51 48 ef | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0679 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-subnets/2x1 with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | counting wild cards for @west is 0 | counting wild cards for @east is 0 | find_host_pair: comparing 192.1.2.45:500 to 192.1.2.23:500 but ignoring ports | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@0x5650ce301e78: westnet-eastnet-subnets/1x2 added connection description "westnet-eastnet-subnets/2x1" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.1.128/28===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.16/28 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0593 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @west | unreference key: 0x5650ce25ac48 @west cnt 1-- | add pubkey 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | add pubkey 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | add pubkey b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | add pubkey 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | add pubkey 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | add pubkey f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | add pubkey ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | add pubkey 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | add pubkey b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | add pubkey 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | add pubkey 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | add pubkey ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | add pubkey 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | add pubkey d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | add pubkey 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | add pubkey 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | add pubkey c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | add pubkey 15 04 37 f9 | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0606 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @east | unreference key: 0x5650ce3021e8 @east cnt 1-- | add pubkey 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | add pubkey e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | add pubkey 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | add pubkey 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | add pubkey 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | add pubkey d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | add pubkey 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | add pubkey 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | add pubkey bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | add pubkey ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | add pubkey e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | add pubkey 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | add pubkey 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | add pubkey 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | add pubkey d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | add pubkey 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | add pubkey 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | add pubkey 51 51 48 ef | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0724 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-subnets/2x2 with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | counting wild cards for @west is 0 | counting wild cards for @east is 0 | find_host_pair: comparing 192.1.2.45:500 to 192.1.2.23:500 but ignoring ports | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@0x5650ce301e78: westnet-eastnet-subnets/2x1 added connection description "westnet-eastnet-subnets/2x2" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.1.128/28===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.64/30 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0765 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @west | unreference key: 0x5650ce25ac48 @west cnt 1-- | add pubkey 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | add pubkey 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | add pubkey b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | add pubkey 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | add pubkey 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | add pubkey f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | add pubkey ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | add pubkey 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | add pubkey b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | add pubkey 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | add pubkey 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | add pubkey ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | add pubkey 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | add pubkey d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | add pubkey 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | add pubkey 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | add pubkey c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | add pubkey 15 04 37 f9 | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0776 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) add keyid @east | unreference key: 0x5650ce3021e8 @east cnt 1-- | add pubkey 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | add pubkey e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | add pubkey 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | add pubkey 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | add pubkey 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | add pubkey d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | add pubkey 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | add pubkey 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | add pubkey bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | add pubkey ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | add pubkey e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | add pubkey 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | add pubkey 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | add pubkey 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | add pubkey d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | add pubkey 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | add pubkey 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | add pubkey 51 51 48 ef | computed rsa CKAID 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | computed rsa CKAID 8a 82 25 f1 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0746 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_STATE_... in show_states_status (sort_states) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.442 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | old debugging base+cpu-usage + none | base debugging = base+cpu-usage | old impairing none + suppress-retransmits | base impairing = suppress-retransmits | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0578 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | dup_any(fd@16) -> fd@23 (in whack_process() at rcv_whack.c:590) | FOR_EACH_CONNECTION_... in conn_by_name initiating all conns with alias='westnet-eastnet-subnets' | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | start processing: connection "westnet-eastnet-subnets/2x2" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'westnet-eastnet-subnets/2x2' +POLICY_UP | dup_any(fd@23) -> fd@24 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | creating state object #1 at 0x5650ce304108 | State DB: adding IKEv1 state #1 in UNDEFINED | pstats #1 ikev1.isakmp started | suspend processing: connection "westnet-eastnet-subnets/2x2" (in main_outI1() at ikev1_main.c:118) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in main_outI1() at ikev1_main.c:118) | parent state #1: UNDEFINED(ignore) => MAIN_I1(half-open IKE SA) | dup_any(fd@24) -> fd@25 (in main_outI1() at ikev1_main.c:123) | Queuing pending IPsec SA negotiating with 192.1.2.23 "westnet-eastnet-subnets/2x2" IKE SA #1 "westnet-eastnet-subnets/2x2" "westnet-eastnet-subnets/2x2" #1: initiating Main Mode | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 1:ISAKMP_NEXT_SA | no specific IKE algorithms specified - using defaults | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() returning 0x5650ce306f98 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 18 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 18 (0x12) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 1 (0x1) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 2 (0x2) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 3 (0x3) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 4 (0x4) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 5 (0x5) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 6 (0x6) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 7 (0x7) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 8 (0x8) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 9 (0x9) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 10 (0xa) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 11 (0xb) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 12 (0xc) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 13 (0xd) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 14 (0xe) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 15 (0xf) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 16 (0x10) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP transform number: 17 (0x11) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | emitting length of ISAKMP Proposal Payload: 632 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 644 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | out_vid(): sending [FRAGMENTATION] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [Dead Peer Detection] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 | emitting length of ISAKMP Vendor ID Payload: 20 | nat add vid | sending draft and RFC NATT VIDs | out_vid(): sending [RFC 3947] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | emitting length of ISAKMP Vendor ID Payload: 20 | skipping VID_NATT_RFC | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-03] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02_n] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 | emitting length of ISAKMP Vendor ID Payload: 20 | no IKEv1 message padding required | emitting length of ISAKMP Message: 792 | sending 792 bytes for reply packet for main_outI1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | c1 22 4f 37 94 92 35 7c 00 00 00 00 00 00 00 00 | 01 10 02 00 00 00 00 00 00 00 03 18 0d 00 02 84 | 00 00 00 01 00 00 00 01 00 00 02 78 00 01 00 12 | 03 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 00 03 80 04 00 0e | 80 0e 01 00 03 00 00 24 01 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 04 80 03 00 03 | 80 04 00 0e 80 0e 00 80 03 00 00 24 02 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 06 | 80 03 00 03 80 04 00 0e 80 0e 01 00 03 00 00 24 | 03 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 06 80 03 00 03 80 04 00 0e 80 0e 00 80 | 03 00 00 24 04 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 02 80 03 00 03 80 04 00 0e | 80 0e 01 00 03 00 00 24 05 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 02 80 03 00 03 | 80 04 00 0e 80 0e 00 80 03 00 00 24 06 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 04 | 80 03 00 03 80 04 00 05 80 0e 01 00 03 00 00 24 | 07 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 04 80 03 00 03 80 04 00 05 80 0e 00 80 | 03 00 00 24 08 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 06 80 03 00 03 80 04 00 05 | 80 0e 01 00 03 00 00 24 09 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 06 80 03 00 03 | 80 04 00 05 80 0e 00 80 03 00 00 24 0a 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 02 | 80 03 00 03 80 04 00 05 80 0e 01 00 03 00 00 24 | 0b 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 02 80 03 00 03 80 04 00 05 80 0e 00 80 | 03 00 00 20 0c 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 00 03 80 04 00 0e | 03 00 00 20 0d 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 00 03 80 04 00 0e | 03 00 00 20 0e 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 0e | 03 00 00 20 0f 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 00 03 80 04 00 05 | 03 00 00 20 10 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 00 03 80 04 00 05 | 00 00 00 20 11 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 05 | 0d 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 de 7f | 00 d6 c2 d3 0d 00 00 14 af ca d7 13 68 a1 f1 c9 | 6b 86 96 fc 77 57 01 00 0d 00 00 14 4a 13 1c 81 | 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 00 14 | 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 | ec 42 7b 1f 00 00 00 14 cd 60 46 43 35 df 21 f8 | 7c fd b2 fc 68 b6 a4 48 "westnet-eastnet-subnets/2x2" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5650ce301f58 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5650ce3022d8 size 128 | #1 STATE_MAIN_I1: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.652535 | #1 spent 1.62 milliseconds in main_outI1() | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in main_outI1() at ikev1_main.c:228) | resume processing: connection "westnet-eastnet-subnets/2x2" (in main_outI1() at ikev1_main.c:228) | stop processing: connection "westnet-eastnet-subnets/2x2" (in initiate_a_connection() at initiate.c:349) | start processing: connection "westnet-eastnet-subnets/2x1" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'westnet-eastnet-subnets/2x1' +POLICY_UP | dup_any(fd@23) -> fd@26 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | Queuing pending IPsec SA negotiating with 192.1.2.23 "westnet-eastnet-subnets/2x1" IKE SA #1 "westnet-eastnet-subnets/2x2" | stop processing: connection "westnet-eastnet-subnets/2x1" (in initiate_a_connection() at initiate.c:349) | start processing: connection "westnet-eastnet-subnets/1x2" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'westnet-eastnet-subnets/1x2' +POLICY_UP | dup_any(fd@23) -> fd@27 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | Queuing pending IPsec SA negotiating with 192.1.2.23 "westnet-eastnet-subnets/1x2" IKE SA #1 "westnet-eastnet-subnets/2x2" | stop processing: connection "westnet-eastnet-subnets/1x2" (in initiate_a_connection() at initiate.c:349) | start processing: connection "westnet-eastnet-subnets/1x1" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'westnet-eastnet-subnets/1x1' +POLICY_UP | dup_any(fd@23) -> fd@28 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | Queuing pending IPsec SA negotiating with 192.1.2.23 "westnet-eastnet-subnets/1x1" IKE SA #1 "westnet-eastnet-subnets/2x2" | stop processing: connection "westnet-eastnet-subnets/1x1" (in initiate_a_connection() at initiate.c:349) | close_any(fd@23) (in initiate_connection() at initiate.c:384) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.75 milliseconds in whack | spent 0.00267 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 144 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 01 10 02 00 00 00 00 00 00 00 00 90 0d 00 00 38 | 00 00 00 01 00 00 00 01 00 00 00 2c 00 01 00 01 | 00 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 00 03 80 04 00 0e | 80 0e 01 00 0d 00 00 14 40 48 b7 d5 6e bc e8 85 | 25 e7 de 7f 00 d6 c2 d3 0d 00 00 14 af ca d7 13 | 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 00 00 00 14 | 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 144 (0x90) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: IKEv1 state not found (find_state_ikev1) | State DB: found IKEv1 state #1 in MAIN_I1 (find_state_ikev1_init) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1459) | #1 is idle | #1 idle | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x2 opt: 0x2080 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 20 (0x14) | message 'main_inR1_outI2' HASH payload not checked early | received Vendor ID payload [FRAGMENTATION] | received Vendor ID payload [Dead Peer Detection] | quirks.qnat_traversal_vid set to=117 [RFC 3947] | received Vendor ID payload [RFC 3947] | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 1 (0x1) | *****parse ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | OAKLEY proposal verified unconditionally; no alg_info to check against | Oakley Transform 0 accepted | sender checking NAT-T: enabled; VID 117 | returning NAT-T method NAT_TRAVERSAL_METHOD_IETF_RFC | enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal) | adding outI2 KE work-order 1 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x5650ce3022d8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5650ce301f58 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5650ce301f58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5650ce3022d8 size 128 | crypto helper 0 resuming | crypto helper 0 starting work-order 1 for state #1 | crypto helper 0 doing build KE and nonce (outI2 KE); request ID 1 | crypto helper 0 finished build KE and nonce (outI2 KE); request ID 1 time elapsed 0.000996 seconds | (#1) spent 0.989 milliseconds in crypto helper computing work-order 1: outI2 KE (pcr) | crypto helper 0 sending results from work-order 1 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f11f4002888 size 128 | crypto helper 0 waiting (nothing to do) | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #1 and saving MD | #1 is busy; has a suspended MD | #1 spent 0.136 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.278 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #1 | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 1 | calling continuation function 0x5650cd7b4b50 | main_inR1_outI2_continue for #1: calculated ke+nonce, sending I2 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 34 0a 69 1e b8 10 36 ca 3a ad e2 ce e1 59 b5 54 | keyex value 42 ed a4 da 19 ea d9 3c 13 5b 67 58 55 1e 63 5c | keyex value 1d 25 60 93 6c 42 30 26 71 55 5a 58 e7 a1 cf 94 | keyex value f6 2e fd 18 e7 40 6d b2 f2 3a aa d8 56 a8 aa 7b | keyex value f3 e6 b5 3e 02 fd 16 8b 0f ee be 24 3e 08 05 39 | keyex value a1 33 58 77 cb d5 11 1d c2 ce f6 95 6f 99 cf 3e | keyex value e6 30 0e 7c dd 42 3b e0 7e 02 82 80 4f 95 ab 2d | keyex value a8 61 81 28 5b 85 74 a0 fb 61 e8 ff c5 b8 e9 bf | keyex value 33 cc 69 b4 2a a8 a1 92 bd f0 2d 44 f4 11 7c 53 | keyex value 4e 46 33 bb 9e 9f a8 9e e7 75 f1 b5 36 f0 21 cc | keyex value b3 8b 30 69 9f ad 3a a0 f2 74 cd f0 1d ef 86 fa | keyex value 07 21 dd 25 b1 04 67 9c d8 b7 3c 3a 5e 79 c3 29 | keyex value f7 fd 71 bd ce c0 da ce 63 a8 5a 08 c6 9a 69 ac | keyex value e0 39 65 06 11 19 92 50 24 e7 48 4f 47 74 ed a9 | keyex value cd 50 3b 77 71 5e a3 16 b5 bc 1e 7c a6 a9 a6 cd | keyex value bd 72 1c 62 3c 5e cd da 26 9b 0e f8 1c 8e 80 1c | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni 92 2e 4c 21 40 60 bf 40 f0 b6 34 ee 20 1a 07 58 | Ni b7 0d 8c 0e 8a d9 7b 33 5d b9 d2 92 99 4a ea 12 | emitting length of ISAKMP Nonce Payload: 36 | NAT-T checking st_nat_traversal | NAT-T found (implies NAT_T_WITH_NATD) | sending NAT-D payloads | natd_hash: hasher=0x5650cd889ca0(32) | natd_hash: icookie= c1 22 4f 37 94 92 35 7c | natd_hash: rcookie= 67 7f 04 7b d5 9e 0e 70 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | natd_hash: hash= 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | next payload chain: ignoring supplied 'ISAKMP NAT-D Payload'.'next payload type' value 20:ISAKMP_NEXT_NATD_RFC | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | NAT-D 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | emitting length of ISAKMP NAT-D Payload: 36 | natd_hash: hasher=0x5650cd889ca0(32) | natd_hash: icookie= c1 22 4f 37 94 92 35 7c | natd_hash: rcookie= 67 7f 04 7b d5 9e 0e 70 | natd_hash: ip= c0 01 02 2d | natd_hash: port=500 | natd_hash: hash= 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | natd_hash: hash= 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP NAT-D Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | NAT-D 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | emitting length of ISAKMP NAT-D Payload: 36 | no IKEv1 message padding required | emitting length of ISAKMP Message: 396 | State DB: re-hashing IKEv1 state #1 IKE SPIi and SPI[ir] | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:no, t_xauth_client_done:no | peer supports fragmentation | peer supports DPD | IKEv1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 | parent state #1: MAIN_I1(half-open IKE SA) => MAIN_I2(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5650ce3022d8 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5650ce301f58 | sending reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 396 bytes for STATE_MAIN_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | 34 0a 69 1e b8 10 36 ca 3a ad e2 ce e1 59 b5 54 | 42 ed a4 da 19 ea d9 3c 13 5b 67 58 55 1e 63 5c | 1d 25 60 93 6c 42 30 26 71 55 5a 58 e7 a1 cf 94 | f6 2e fd 18 e7 40 6d b2 f2 3a aa d8 56 a8 aa 7b | f3 e6 b5 3e 02 fd 16 8b 0f ee be 24 3e 08 05 39 | a1 33 58 77 cb d5 11 1d c2 ce f6 95 6f 99 cf 3e | e6 30 0e 7c dd 42 3b e0 7e 02 82 80 4f 95 ab 2d | a8 61 81 28 5b 85 74 a0 fb 61 e8 ff c5 b8 e9 bf | 33 cc 69 b4 2a a8 a1 92 bd f0 2d 44 f4 11 7c 53 | 4e 46 33 bb 9e 9f a8 9e e7 75 f1 b5 36 f0 21 cc | b3 8b 30 69 9f ad 3a a0 f2 74 cd f0 1d ef 86 fa | 07 21 dd 25 b1 04 67 9c d8 b7 3c 3a 5e 79 c3 29 | f7 fd 71 bd ce c0 da ce 63 a8 5a 08 c6 9a 69 ac | e0 39 65 06 11 19 92 50 24 e7 48 4f 47 74 ed a9 | cd 50 3b 77 71 5e a3 16 b5 bc 1e 7c a6 a9 a6 cd | bd 72 1c 62 3c 5e cd da 26 9b 0e f8 1c 8e 80 1c | 14 00 00 24 92 2e 4c 21 40 60 bf 40 f0 b6 34 ee | 20 1a 07 58 b7 0d 8c 0e 8a d9 7b 33 5d b9 d2 92 | 99 4a ea 12 14 00 00 24 42 f8 be 31 64 32 6c e0 | 37 1b 9d f8 b6 ca 6c 9c 70 28 22 0c d5 46 10 4d | 8f d9 f2 b9 25 40 54 e4 00 00 00 24 9f 65 ba 86 | 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 4a 5b 9d 49 | 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | !event_already_set at reschedule "westnet-eastnet-subnets/2x2" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5650ce301f58 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5650ce306bf8 size 128 | #1 STATE_MAIN_I2: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.655033 "westnet-eastnet-subnets/2x2" #1: STATE_MAIN_I2: sent MI2, expecting MR2 | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 0.332 milliseconds in resume sending helper answer | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11f4002888 | spent 0.00253 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 396 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | a6 b8 f8 75 f0 c3 a9 8e 2b 32 ad 87 0b 31 18 84 | 61 e5 e4 c2 0c 27 7e 94 08 4f 09 0c bd 69 dc b1 | 44 1b 8a 1a a0 bd fe 93 a1 a1 40 43 4b ca 18 5a | ce 74 38 71 1d 34 92 76 4c f0 87 a5 e0 22 13 07 | 17 22 f4 7f d6 68 8b 1e 7e e9 af fb ff ad 8a 7a | 2f 16 4c ec be 23 91 cc 67 fd 29 94 23 19 2b a8 | 24 44 95 ca 84 c4 12 f5 ed 96 c1 3e 01 8c df 9f | 89 b4 35 8d c9 22 cc 32 a9 ba 60 0f f4 7d a6 85 | f8 43 a8 d1 56 55 5e 11 1d 30 b6 1f 0c 6e 9d 28 | cb 23 e0 87 1a 0e f8 a4 e3 c3 88 d3 64 91 bb d2 | d2 7f c2 c7 52 ee 24 04 4a b0 26 db 70 81 3e 26 | 2c 6a cb c7 6b c0 8b 15 ab 06 39 2d f1 4b aa f6 | dc 31 d8 98 53 a6 25 23 5b 29 2c 42 2b 1e ff 73 | 8e 2d 1a be 65 04 d9 58 09 c1 90 12 6e 9d c3 2a | d8 54 bd 6d 0a e5 9b 8c 98 bc ac 88 cc d0 25 12 | ca 20 62 67 c0 9a a6 8c aa 32 24 65 82 1e bd be | 14 00 00 24 1f 19 aa 66 69 9f 04 57 bf 4a 63 f7 | 5e a0 90 45 2a 40 28 a2 a2 bb 65 f4 07 4f fb 50 | 97 c9 e3 d9 14 00 00 24 9f 65 ba 86 59 13 ab 6a | 75 fe 3a cc 03 a2 1c 98 4a 5b 9d 49 7c c4 2f 3e | c2 82 8e 25 12 a1 70 ef 00 00 00 24 42 f8 be 31 | 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c 70 28 22 0c | d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_KE (0x4) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 396 (0x18c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_I2 (find_state_ikev1) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1459) | #1 is idle | #1 idle | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x410 opt: 0x102080 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 260 (0x104) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x102080 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | message 'main_inR2_outI3' HASH payload not checked early | started looking for secret for @west->@east of kind PKK_PSK | actually looking for secret for @west->@east of kind PKK_PSK | line 1: key type PKK_PSK(@west) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding aggr outR1 DH work-order 2 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I2: retransmits: cleared | libevent_free: release ptr-libevent@0x5650ce306bf8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5650ce301f58 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5650ce301f58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x7f11f4002888 size 128 | crypto helper 2 resuming | crypto helper 2 starting work-order 2 for state #1 | crypto helper 2 doing compute dh+iv (V1 Phase 1) (aggr outR1 DH); request ID 2 | crypto helper 2 finished compute dh+iv (V1 Phase 1) (aggr outR1 DH); request ID 2 time elapsed 0.00107 seconds | (#1) spent 1.08 milliseconds in crypto helper computing work-order 2: aggr outR1 DH (pcr) | crypto helper 2 sending results from work-order 2 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f11ec000f48 size 128 | crypto helper 2 waiting (nothing to do) | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #1 and saving MD | #1 is busy; has a suspended MD | #1 spent 0.056 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.205 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #1 | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 2 replies to request ID 2 | calling continuation function 0x5650cd7b4b50 | main_inR2_outI3_cryptotail for #1: calculated DH, sending R1 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 5:ISAKMP_NEXT_ID | thinking about whether to send my certificate: | I have RSA key: OAKLEY_RSA_SIG cert.type: 0?? | sendcert: CERT_ALWAYSSEND and I did not get a certificate request | so do not send cert. | I did not send a certificate because I do not have one. | I am not sending a certificate request | I will NOT send an initial contact payload | init checking NAT-T: enabled; RFC 3947 (NAT-Traversal) | natd_hash: hasher=0x5650cd889ca0(32) | natd_hash: icookie= c1 22 4f 37 94 92 35 7c | natd_hash: rcookie= 67 7f 04 7b d5 9e 0e 70 | natd_hash: ip= c0 01 02 2d | natd_hash: port=500 | natd_hash: hash= 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | natd_hash: hash= 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | natd_hash: hasher=0x5650cd889ca0(32) | natd_hash: icookie= c1 22 4f 37 94 92 35 7c | natd_hash: rcookie= 67 7f 04 7b d5 9e 0e 70 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | natd_hash: hash= 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | expected NAT-D(me): 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | expected NAT-D(me): 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | expected NAT-D(him): | 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | received NAT-D: 9f 65 ba 86 59 13 ab 6a 75 fe 3a cc 03 a2 1c 98 | received NAT-D: 4a 5b 9d 49 7c c4 2f 3e c2 82 8e 25 12 a1 70 ef | received NAT-D: 42 f8 be 31 64 32 6c e0 37 1b 9d f8 b6 ca 6c 9c | received NAT-D: 70 28 22 0c d5 46 10 4d 8f d9 f2 b9 25 40 54 e4 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: no NAT detected | NAT_T_WITH_KA detected | global one-shot timer EVENT_NAT_T_KEEPALIVE scheduled in 20 seconds | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_SIG (0x9) | ID type: ID_FQDN (0x2) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 9:ISAKMP_NEXT_SIG | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into ISAKMP Identification Payload (IPsec DOI) | my identity 77 65 73 74 | emitting length of ISAKMP Identification Payload (IPsec DOI): 12 | started looking for secret for @west->@east of kind PKK_RSA | actually looking for secret for @west->@east of kind PKK_RSA | line 1: key type PKK_RSA(@west) to type PKK_RSA | 1: compared key (none) to @west / @east -> 002 | 2: compared key (none) to @west / @east -> 002 | line 1: match=002 | match 002 beats previous best_match 000 match=0x5650ce25ab58 (line=1) | concluding with best_match=002 best=0x5650ce25ab58 (lineno=1) | ***emit ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Signature Payload (9:ISAKMP_NEXT_SIG) | next payload chain: saving location 'ISAKMP Signature Payload'.'next payload type' in 'reply packet' | emitting 274 raw bytes of SIG_I into ISAKMP Signature Payload | SIG_I 2e 73 61 dc 62 5d ea 7e 2a 3f 7b be 78 32 c3 22 | SIG_I 9c 36 af f3 ce d7 f3 76 e5 26 50 8d 46 fb c9 44 | SIG_I ce 8a f2 9a 20 de 96 d1 b6 bc c8 a3 66 da fc 13 | SIG_I d3 6c 67 78 ab 1d 91 a6 02 ce 4d 6a 82 ba f4 c0 | SIG_I c7 b6 29 95 ab ab f7 e5 08 59 76 a7 f9 c9 47 b3 | SIG_I a4 7a 42 c2 e5 83 98 df 46 70 aa e9 98 95 51 39 | SIG_I 6b 01 24 6d f8 e0 b9 40 f1 7c e7 74 4a af 6c 1e | SIG_I c4 44 67 bb 1f 9f a8 be 44 2b a6 b5 d3 2d d1 5a | SIG_I 05 64 97 e8 ba 4f 0c ee 75 06 5d 3b f7 a8 1a 66 | SIG_I d4 0d 5e 36 d2 0e 0d 3d e9 e5 0c ed a6 f8 e3 0a | SIG_I 04 c8 57 fa c2 b2 a4 ca 96 85 20 cb a0 4b f5 82 | SIG_I 9d ec 5f 13 c7 68 6f dd 39 9c 32 3d 23 8e 89 68 | SIG_I f5 ea 39 b4 d3 79 5c ea cd a3 92 d2 83 33 52 bf | SIG_I 0e 65 df ce e5 19 b3 ae c8 93 d4 4e de 17 f7 d0 | SIG_I 22 fc 44 f2 ad 62 cd 95 92 2c 61 58 8b bf 76 40 | SIG_I 87 63 7b cf 4f 4a b5 bf d5 8c 6d de 21 6a 60 e8 | SIG_I 88 62 db 89 fb ac 4e c2 5c f9 3c dd 44 f7 d4 56 | SIG_I 5a 98 | emitting length of ISAKMP Signature Payload: 278 | Not sending INITIAL_CONTACT | emitting 14 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 332 | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 | parent state #1: MAIN_I2(open IKE SA) => MAIN_I3(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7f11f4002888 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5650ce301f58 | sending reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 332 bytes for STATE_MAIN_I2 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 05 10 02 01 00 00 00 00 00 00 01 4c f4 2a ed be | a1 d9 eb 6d b6 36 a8 b6 d4 d6 34 30 a0 51 d3 7c | bd 7b 72 6d b0 ba 1e 08 80 6b 79 53 89 60 51 b1 | 37 f5 ce 48 57 24 2d 5d 79 e1 c4 c1 c8 9d a7 c5 | aa 1c ee 39 70 39 7d 7c e6 fc c4 f3 6b c7 86 b4 | 8b 52 1e f8 ae ac 61 3a 18 be 98 39 13 7e 8f e8 | 8a d3 5f 26 1e 7c 72 91 2b 76 59 0b 91 90 0c db | 27 4c da b8 84 0e 07 0a 0c 48 9b 01 49 25 1c d4 | 49 e0 5b d5 4e 35 03 d1 08 a7 b3 77 84 1a 87 12 | 22 1d 89 8d 84 95 ee 05 f8 12 8c a9 d0 cb 69 9b | ef c6 7f f8 6f 27 6a e4 11 8b de db bb 3b 1b 47 | 52 36 62 30 61 13 74 6e de 94 44 26 97 9c 04 f2 | f0 1e 38 63 79 52 11 49 b9 f6 79 0c db f1 fb 14 | 67 18 cd bf c2 4b 79 49 8a cd 70 03 84 b7 44 89 | ff 55 e9 43 3f b8 09 34 bb 9b fe b5 07 14 e0 7c | 74 24 f0 e0 6a 4b 6f 50 b9 fb 0d 77 93 94 81 74 | 79 2f 41 dc 15 75 ce 14 5a eb a2 b8 9d d0 e7 14 | fb 3a 6d 18 b0 63 b3 73 0a f8 a3 a4 d7 a1 db 57 | d0 fc 9a 43 85 8e ab 27 1d af ba 2c 0d 9c 76 f7 | c8 3b 54 95 48 d0 94 4d 11 12 33 3f | !event_already_set at reschedule "westnet-eastnet-subnets/2x2" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5650ce301f58 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5650ce3022d8 size 128 | #1 STATE_MAIN_I3: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.663259 "westnet-eastnet-subnets/2x2" #1: STATE_MAIN_I3: sent MI3, expecting MR3 | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 5.08 milliseconds in resume sending helper answer | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11ec000f48 | spent 0.00367 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 332 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 05 10 02 01 00 00 00 00 00 00 01 4c 94 65 35 40 | 14 54 c7 f3 16 10 1b bc dd 93 7b 15 9e 30 ec 18 | cb c7 ee 04 26 b8 f7 6e 69 b7 9c 57 a2 7e 8c c6 | e5 b4 79 a2 a5 8d 3d 51 ae b9 2a 41 e7 32 99 2a | d7 7e d8 b3 18 1c cc 86 14 71 b1 4e 14 66 bd 20 | 2e 42 26 2a ce 26 eb 29 d1 64 8f 5a d8 54 26 d2 | 1c 1f 2e eb 27 bb 0b 39 7e 62 bd b9 78 54 51 a5 | ab 07 bf 97 8e b2 33 c6 97 cd 48 b2 00 f7 9f 0a | 93 77 b6 d2 e5 8d 36 f4 af fe 8b 69 df 89 b8 9c | 50 7e e4 0d f3 df 44 27 5f 34 61 0a 75 eb cd e0 | 8d 6b 69 a5 45 9f 03 d0 a6 9d a0 26 51 1d 66 57 | 9a 40 bc bc f0 85 d6 e6 04 87 4c 4b 2a 36 05 80 | e6 c9 c9 80 8d 59 59 55 de d4 e5 0b a4 82 1a 32 | 13 35 28 13 32 d4 df e4 39 94 4a 3c 19 70 dc 2a | fb 12 b2 76 d9 f3 67 54 42 c8 c8 62 af 51 5e 0e | c9 8b 08 bb 57 e2 bc 49 bb c7 a2 c4 d7 4f 6e 90 | 85 7a 29 65 9b 7a 36 ca 9a 73 da 6e 78 62 7f bb | 2a 3c 9e 4f ed e5 03 b3 7f 32 1c 8f 34 f2 d5 4e | cd f5 a7 eb 31 18 75 f7 57 a9 f8 b8 c4 e5 ab 6e | 72 c7 ac 49 81 8e 8c a2 a3 6b 27 31 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | length: 332 (0x14c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_I3 (find_state_ikev1) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1459) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x220 opt: 0x20c0 | ***parse ISAKMP Identification Payload: | next payload type: ISAKMP_NEXT_SIG (0x9) | length: 12 (0xc) | ID type: ID_FQDN (0x2) | DOI specific A: 0 (0x0) | DOI specific B: 0 (0x0) | obj: 65 61 73 74 | got payload 0x200 (ISAKMP_NEXT_SIG) needed: 0x200 opt: 0x20c0 | ***parse ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 278 (0x116) | removing 14 bytes of padding | message 'main_inR3' HASH payload not checked early "westnet-eastnet-subnets/2x2" #1: Peer ID is ID_FQDN: '@east' | X509: no CERT payloads to process | required RSA CA is '%any' | checking RSA keyid '@east' for match with '@east' | key issuer CA is '%any' | an RSA Sig check passed with *AQO9bJbr3 [preloaded key] | #1 spent 0.0674 milliseconds in try_all_RSA_keys() trying a pubkey "westnet-eastnet-subnets/2x2" #1: Authenticated using RSA | FOR_EACH_CONNECTION_... in ISAKMP_SA_established | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 | parent state #1: MAIN_I3(open IKE SA) => MAIN_I4(established IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I4: retransmits: cleared | libevent_free: release ptr-libevent@0x5650ce3022d8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5650ce301f58 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x5650ce301f58 | inserting event EVENT_SA_REPLACE, timeout in 2607 seconds for #1 | libevent_malloc: new ptr-libevent@0x7f11ec000f48 size 128 | pstats #1 ikev1.isakmp established "westnet-eastnet-subnets/2x2" #1: STATE_MAIN_I4: ISAKMP SA established {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | unpending state #1 | creating state object #2 at 0x5650ce304bf8 | State DB: adding IKEv1 state #2 in UNDEFINED | pstats #2 ikev1.ipsec started | duplicating state object #1 "westnet-eastnet-subnets/2x2" as #2 for IPSEC SA | #2 setting local endpoint to 192.1.2.45:500 from #1.st_localport (in duplicate_state() at state.c:1484) | in connection_discard for connection westnet-eastnet-subnets/2x2 | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | child state #2: UNDEFINED(ignore) => QUICK_I1(established CHILD SA) "westnet-eastnet-subnets/1x1" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:bbf2d77d proposal=defaults pfsgroup=MODP2048} | adding quick_outI1 KE work-order 3 for state #2 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7f11f4002b78 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x5650ce302078 size 128 | stop processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | resume processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | crypto helper 3 resuming | crypto helper 3 starting work-order 3 for state #2 | crypto helper 3 doing build KE and nonce (quick_outI1 KE); request ID 3 | crypto helper 3 finished build KE and nonce (quick_outI1 KE); request ID 3 time elapsed 0.000894 seconds | (#2) spent 0.905 milliseconds in crypto helper computing work-order 3: quick_outI1 KE (pcr) | crypto helper 3 sending results from work-order 3 for state #2 to event queue | scheduling resume sending helper answer for #2 | libevent_malloc: new ptr-libevent@0x7f11f0003f28 size 128 | libevent_realloc: release ptr-libevent@0x5650ce2e3578 | libevent_realloc: new ptr-libevent@0x7f11f0003e78 size 128 | crypto helper 3 waiting (nothing to do) | unqueuing pending Quick Mode with 192.1.2.23 "westnet-eastnet-subnets/1x1" | removing pending policy for no connection {0x5650ce307ae8} | creating state object #3 at 0x5650ce3110a8 | State DB: adding IKEv1 state #3 in UNDEFINED | pstats #3 ikev1.ipsec started | duplicating state object #1 "westnet-eastnet-subnets/2x2" as #3 for IPSEC SA | #3 setting local endpoint to 192.1.2.45:500 from #1.st_localport (in duplicate_state() at state.c:1484) | in connection_discard for connection westnet-eastnet-subnets/2x2 | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | start processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | child state #3: UNDEFINED(ignore) => QUICK_I1(established CHILD SA) "westnet-eastnet-subnets/1x2" #3: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:8173dc8a proposal=defaults pfsgroup=MODP2048} | adding quick_outI1 KE work-order 4 for state #3 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5650ce306f48 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: new ptr-libevent@0x5650ce301fc8 size 128 | stop processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | resume processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | crypto helper 4 resuming | crypto helper 4 starting work-order 4 for state #3 | unqueuing pending Quick Mode with 192.1.2.23 "westnet-eastnet-subnets/1x2" | crypto helper 4 doing build KE and nonce (quick_outI1 KE); request ID 4 | removing pending policy for no connection {0x5650ce3010a8} | creating state object #4 at 0x5650ce312768 | State DB: adding IKEv1 state #4 in UNDEFINED | pstats #4 ikev1.ipsec started | duplicating state object #1 "westnet-eastnet-subnets/2x2" as #4 for IPSEC SA | #4 setting local endpoint to 192.1.2.45:500 from #1.st_localport (in duplicate_state() at state.c:1484) | in connection_discard for connection westnet-eastnet-subnets/2x2 | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | start processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | child state #4: UNDEFINED(ignore) => QUICK_I1(established CHILD SA) "westnet-eastnet-subnets/2x1" #4: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:21481852 proposal=defaults pfsgroup=MODP2048} | adding quick_outI1 KE work-order 5 for state #4 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5650ce30d0a8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #4 | libevent_malloc: new ptr-libevent@0x5650ce302888 size 128 | stop processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | resume processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | unqueuing pending Quick Mode with 192.1.2.23 "westnet-eastnet-subnets/2x1" | removing pending policy for no connection {0x5650ce25a898} | creating state object #5 at 0x5650ce313e28 | State DB: adding IKEv1 state #5 in UNDEFINED | pstats #5 ikev1.ipsec started | duplicating state object #1 "westnet-eastnet-subnets/2x2" as #5 for IPSEC SA | #5 setting local endpoint to 192.1.2.45:500 from #1.st_localport (in duplicate_state() at state.c:1484) | suspend processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | start processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | child state #5: UNDEFINED(ignore) => QUICK_I1(established CHILD SA) "westnet-eastnet-subnets/2x2" #5: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:099ea1a1 proposal=defaults pfsgroup=MODP2048} | adding quick_outI1 KE work-order 6 for state #5 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5650ce287678 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: new ptr-libevent@0x5650ce3027d8 size 128 | stop processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | resume processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | unqueuing pending Quick Mode with 192.1.2.23 "westnet-eastnet-subnets/2x2" | removing pending policy for no connection {0x5650ce2f4358} | close_any(fd@24) (in release_whack() at state.c:654) | #1 spent 0.676 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.833 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #2 | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 3 replies to request ID 3 | calling continuation function 0x5650cd7b4b50 | quick_outI1_continue for #2: calculated ke+nonce, sending I1 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3153254269 (0xbbf2d77d) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | emitting quick defaults using policy none | empty esp_info, returning defaults for ENCRYPT | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 2 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0x9210c7f8 for esp.0@192.1.2.45 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI 92 10 c7 f8 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ESP): 32 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 1 (0x1) | ESP transform ID: ESP_3DES (0x3) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | emitting length of ISAKMP Transform Payload (ESP): 28 | emitting length of ISAKMP Proposal Payload: 72 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 84 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni e4 26 b0 f3 7f f3 38 24 02 17 11 58 87 86 14 8a | Ni 2c d9 d9 56 92 cc 3b 17 ec 0e bc 55 23 c2 93 da | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value eb 83 81 2b 4b a0 f4 04 28 2a 78 4e 20 f2 ba 18 | keyex value 4f 31 a6 2d 65 e7 d6 a9 2a 7d 44 a9 be 27 1f d9 | keyex value 19 f0 56 ef 3e 4e 97 ec 19 7f a8 9c ff 54 6d d0 | keyex value 54 b9 a4 08 8e 4c 67 67 4b 3e 1a 81 4a 1a 09 85 | keyex value db 2d 87 54 d4 97 ed 36 0c 79 19 64 8c 64 a1 ed | keyex value 81 c0 7e 9a ba 8e b5 fd c1 8d 7e bd 7d ee f4 6a | keyex value 8b 77 c6 f4 bc b4 60 21 c2 59 52 5a d5 8d 31 14 | keyex value 56 e4 9e 6b 6a 09 24 3e 4a 3c 73 b9 bc d4 62 5b | keyex value 82 98 86 5f 9e 0a 10 27 0a 9c 76 07 e2 54 5a 25 | keyex value be 04 a6 3c 65 4e 11 53 46 a0 b4 c6 56 69 12 ff | keyex value fc 10 7e 78 22 bf 89 e3 49 aa 92 34 3b 6c 2f 31 | keyex value b5 c6 01 bc e5 b8 c6 f3 8f c6 56 2d 64 84 4d 67 | keyex value ef d7 b6 72 b6 ee 2d 3a 5e 3e fd 87 62 0c aa 58 | keyex value c7 b1 b5 8e 92 f4 54 4d ad 5f c7 45 f2 4a a3 c7 | keyex value 30 41 68 eb c2 33 5e bd 0c 46 14 c1 1f 3b 1e 3f | keyex value 08 cd 84 8f ba 38 a3 86 9d 74 e3 4c 19 14 e8 9b | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 01 00 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 02 10 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | outI1 HASH(1): | 57 a5 c0 84 a7 41 78 25 ef 1e 19 41 09 0c 07 44 | 8c 91 e9 d1 d4 ac 43 45 66 15 c0 0e cb 68 9f f9 | no IKEv1 message padding required | emitting length of ISAKMP Message: 476 | sending 476 bytes for reply packet from quick_outI1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #2) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 bb f2 d7 7d 00 00 01 dc fd ab ee 49 | 5d 6d 65 13 66 1c ac 18 81 71 91 3d 22 93 59 2b | 8a b2 e0 1a f8 9e 3b d5 e1 1a e0 13 27 88 d7 1b | 1c 37 72 be 16 e1 d9 43 0a 7f 77 59 3f d0 44 c2 | 8e ca e3 0b 19 2e ec 19 cd bd 8f 82 de bb 9f 4c | 58 db 64 a7 08 38 77 c5 09 40 3e 00 df bf f1 a2 | d1 70 1a 13 36 54 56 90 75 a5 87 16 da 5c f7 72 | 31 f5 4d bc 79 fe 84 8f 70 05 77 0a 49 e3 42 e1 | 4a ac 2a 0d ab be 8b 55 b3 d2 ec aa bb 82 9e 37 | 9a 2d 34 9b 94 c5 65 4d ca db 21 bf 2f 9b bb 3d | 30 b2 58 a4 12 c8 9a 7a 0b ed d2 05 44 34 c1 8a | 3f 6f 57 3b 63 64 29 07 64 af 31 9e 50 6a b4 69 | 6d d3 d1 eb 84 90 f2 72 de d9 4d 23 b6 da c9 51 | a0 f1 9b ee c5 13 86 9b 99 19 a2 5a 95 19 75 f4 | b2 17 a9 0d 04 17 22 40 67 5c 84 54 0f 86 86 ab | 84 67 43 dc 09 01 52 a2 28 36 c7 74 26 e8 4c 7a | 08 97 f8 fe 0a 40 4d 74 fb cb 79 0d 74 cd ca d5 | 83 2a 29 32 72 40 4c 90 64 40 d0 a0 d2 9f cd 51 | 45 d1 4e 70 aa 70 c8 fd f2 f1 15 b5 81 91 3c e6 | 0a 33 f0 ad 06 42 fc e6 1c 2a 03 2e 82 ae 04 28 | 52 6c e6 48 be 04 41 5d 22 e0 c7 1a b8 03 d7 ec | a5 90 34 55 82 c0 bf 81 c7 22 4e 11 01 b5 74 b8 | 7f 81 cb 0f 62 da 9b 98 99 03 d2 f6 62 80 26 d8 | c8 94 9b 0a 58 ce eb fa f4 18 88 71 3f 01 59 96 | 9c bc c4 03 04 4a e5 69 5f e2 a1 0a d7 80 e4 43 | af e7 c0 f9 70 f2 c9 81 d1 97 e6 18 4c b6 93 ca | a4 ee 0c 2b 2b 26 f1 ea be 87 b5 18 61 3c 69 cc | 52 a3 47 b6 9e 11 3c 80 88 22 ee a8 30 85 f4 21 | 55 1b 8d dd 2c 8d 86 2e e6 ff ec 38 | state #2 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5650ce302078 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7f11f4002b78 "westnet-eastnet-subnets/1x1" #2: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x7f11f4002b78 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x5650ce30c638 size 128 | #2 STATE_QUICK_I1: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.673601 | resume sending helper answer for #2 suppresed complete_v1_state_transition() | #2 spent 0.489 milliseconds in resume sending helper answer | stop processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11f0003f28 | crypto helper 1 resuming | crypto helper 1 starting work-order 5 for state #4 | crypto helper 1 doing build KE and nonce (quick_outI1 KE); request ID 5 | crypto helper 5 resuming | crypto helper 5 starting work-order 6 for state #5 | crypto helper 5 doing build KE and nonce (quick_outI1 KE); request ID 6 | crypto helper 5 finished build KE and nonce (quick_outI1 KE); request ID 6 time elapsed 0.001684 seconds | (#5) spent 0.949 milliseconds in crypto helper computing work-order 6: quick_outI1 KE (pcr) | crypto helper 5 sending results from work-order 6 for state #5 to event queue | scheduling resume sending helper answer for #5 | libevent_malloc: new ptr-libevent@0x7f11dc0055c8 size 128 | crypto helper 5 waiting (nothing to do) | processing resume sending helper answer for #5 | start processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 5 replies to request ID 6 | calling continuation function 0x5650cd7b4b50 | crypto helper 4 finished build KE and nonce (quick_outI1 KE); request ID 4 time elapsed 0.002686 seconds | quick_outI1_continue for #5: calculated ke+nonce, sending I1 | (#3) spent 0.952 milliseconds in crypto helper computing work-order 4: quick_outI1 KE (pcr) | crypto helper 4 sending results from work-order 4 for state #3 to event queue | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | scheduling resume sending helper answer for #3 | next payload type: ISAKMP_NEXT_NONE (0x0) | libevent_malloc: new ptr-libevent@0x7f11e40055c8 size 128 | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | crypto helper 4 waiting (nothing to do) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 161391009 (0x99ea1a1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | crypto helper 1 finished build KE and nonce (quick_outI1 KE); request ID 5 time elapsed 0.002006 seconds | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | (#4) spent 0.85 milliseconds in crypto helper computing work-order 5: quick_outI1 KE (pcr) | crypto helper 1 sending results from work-order 5 for state #4 to event queue | scheduling resume sending helper answer for #4 | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | libevent_malloc: new ptr-libevent@0x7f11e8003f28 size 128 | emitting length of ISAKMP Hash Payload: 36 | emitting quick defaults using policy none | crypto helper 1 waiting (nothing to do) | empty esp_info, returning defaults for ENCRYPT | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 2 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0xa1fe27ca for esp.0@192.1.2.45 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI a1 fe 27 ca | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ESP): 32 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 1 (0x1) | ESP transform ID: ESP_3DES (0x3) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | emitting length of ISAKMP Transform Payload (ESP): 28 | emitting length of ISAKMP Proposal Payload: 72 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 84 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni c8 3f e2 24 e0 92 bd d6 7c 62 64 82 50 27 f5 0c | Ni 7c 84 1e 94 1d ba 07 06 20 df f8 a6 91 3d 67 ef | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 3e 16 7f 49 a2 57 b8 01 b0 cd dc cf 58 73 34 72 | keyex value 3c ae 48 a0 1e e8 86 52 81 f7 fe 8f 98 83 88 3f | keyex value 94 19 95 f6 8a 4c c4 f4 c2 80 93 a2 68 82 f8 c6 | keyex value ca 68 e3 4c 06 37 65 d5 16 25 73 15 b6 99 0e 00 | keyex value b8 74 de 14 26 08 31 5d fb 09 c0 77 fc 2f a8 5b | keyex value f0 6a 7a 98 49 a2 5e 2d 17 54 3c 1f 43 20 17 40 | keyex value 70 ac c3 53 32 b2 5b a8 c3 71 4d ca e4 fb ca be | keyex value 33 92 13 5d 84 92 37 5c c6 d2 f5 7c 4d 30 fa be | keyex value 96 64 04 8a 77 20 ae 39 95 cc a6 7d b8 26 c8 df | keyex value 5b a8 f4 5a cd 5d a1 f4 34 d2 ef 62 6f f1 05 3f | keyex value c5 d0 d4 0a 12 d4 fc 5e 1e 2b 59 e6 cd 84 3c ff | keyex value f3 16 6e ce b3 95 cd 56 d1 53 75 27 3b 5d 1c a9 | keyex value 9c 1d f4 14 49 a6 05 e8 d1 36 b0 b7 61 4b 12 e2 | keyex value 11 2f d2 b7 11 06 95 68 ae 9b e6 b0 e3 03 64 67 | keyex value 8b 96 1a 3d ac ab 30 78 d5 71 45 da e0 e0 a8 7c | keyex value 8d a6 ed 80 be 97 b3 eb 73 8a ab 3d a2 99 a3 c6 | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 01 80 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 02 40 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff fc | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | outI1 HASH(1): | 66 00 ca 60 b0 2f 0b ed ba 5e 2c 23 df cd 9e fe | 2b bd f2 64 34 87 2a f6 e1 35 2f 75 68 f2 f6 4b | no IKEv1 message padding required | emitting length of ISAKMP Message: 476 | sending 476 bytes for reply packet from quick_outI1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #5) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 09 9e a1 a1 00 00 01 dc 92 e3 d7 81 | 35 f9 a6 b6 28 1a 40 4d 2c ee c5 a9 32 d4 41 25 | 87 fb 4d c1 de 0c 01 a3 6d fb 57 60 60 7b 22 03 | 58 10 4b 61 69 b4 f9 3d ac 40 5f bd da 39 03 47 | 31 47 bb 42 37 c5 71 08 2a 07 2f 40 a5 19 09 5c | 75 3e 5a 8f 12 e4 e1 99 61 d5 8d e1 97 9d dc b2 | 84 25 21 c6 be 13 fd da d4 57 29 64 d2 50 de 46 | cc 8b b8 41 fe a9 aa 95 ce c9 7e 39 55 d0 50 68 | 09 b2 51 01 2c 1c 10 e9 bc 27 00 98 0b 0e b2 5c | 6b 47 93 bc ec c0 8e 2d 0e b6 8e 94 4a 54 3e 6e | 90 dd e2 b9 b3 aa a6 24 63 d9 0e 02 54 5a cf cb | 9d 38 80 44 ef 91 04 39 91 75 67 c6 90 ce a9 75 | b1 0f d6 75 62 dd f2 4d c7 ef b0 c9 bd 50 e5 e5 | c8 62 20 e9 36 76 3a 90 3a cb ef ec 97 8f 82 50 | 1a 89 1c e7 a2 e6 c2 e2 58 e8 58 a2 b5 8e 64 17 | b9 a5 2b 87 b1 1b 56 79 0b e3 8b 41 1d a9 78 58 | a9 88 0c 54 16 f0 b3 b2 7b 3c f5 9b af ba 07 7b | 86 b0 25 71 42 8b 8c 46 3b 2b 1a 5b 2b 88 23 17 | 00 a9 11 97 3c fe 2e 3a 36 7e 94 f3 9f 67 d2 59 | 9f 1a b9 5c b0 29 e4 55 e8 19 6e 6d 3d d8 17 b4 | b9 fd 1e 6d 8a 07 33 52 15 78 ee 4b 3f 0b b0 28 | f7 ca f6 d0 78 16 04 89 eb 5b a8 84 b9 0e ca f2 | f2 20 24 34 d8 34 c6 58 9a 06 e2 2b 2b 3a 9c 1f | d6 f0 7a 41 85 06 76 54 c7 5a 76 9d 0e 27 57 d1 | f6 8e 27 4f 9f 11 ec 39 09 d5 3a 3a 35 46 59 f7 | 65 c1 5e e5 54 42 dd 7d 2d 34 fa 9f 0c 6d ef 85 | a0 90 ee 19 e5 16 24 27 0e 76 58 ee 28 3b 76 81 | 28 e5 18 c7 9e cd 1d d6 a9 a2 7e 06 c5 65 99 4e | 4a 5a f5 32 63 2e 69 02 18 eb 75 db | state #5 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5650ce3027d8 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5650ce287678 "westnet-eastnet-subnets/2x2" #5: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x7f11f0004218 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #5 | libevent_malloc: new ptr-libevent@0x7f11f0003f28 size 128 | #5 STATE_QUICK_I1: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.676189 | resume sending helper answer for #5 suppresed complete_v1_state_transition() | #5 spent 0.571 milliseconds in resume sending helper answer | stop processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11dc0055c8 | processing resume sending helper answer for #3 | start processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 4 replies to request ID 4 | calling continuation function 0x5650cd7b4b50 | quick_outI1_continue for #3: calculated ke+nonce, sending I1 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2171853962 (0x8173dc8a) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | emitting quick defaults using policy none | empty esp_info, returning defaults for ENCRYPT | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 2 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0x687d269a for esp.0@192.1.2.45 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI 68 7d 26 9a | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ESP): 32 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 1 (0x1) | ESP transform ID: ESP_3DES (0x3) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | emitting length of ISAKMP Transform Payload (ESP): 28 | emitting length of ISAKMP Proposal Payload: 72 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 84 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni ab 8f 24 4c 4d 15 2e 3b 81 55 b2 28 3c 47 f1 d0 | Ni 6a 9f 04 30 06 fb 07 a1 79 5d 25 8f ec 9c dc ba | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 6f 33 6b 96 41 2e 1d d0 d1 b1 d3 e9 72 4e 6d 55 | keyex value 73 c1 ec f7 94 9c 30 a7 ce 8b 0a 3a 99 6e c3 16 | keyex value ee 4a 69 e8 f2 a8 56 d6 ed 5b 09 7e 84 ab f6 af | keyex value 26 51 e2 2d 3f ea a9 73 61 31 c2 e4 02 c7 e7 75 | keyex value a5 ac 6f 52 ca b7 95 3a b6 d7 2c 51 87 b4 7b bc | keyex value 4c 52 d8 85 dd 30 b1 26 3b 9a 15 1b 0a ee 94 50 | keyex value 96 7b 01 a9 2c 6e b4 fa 8a ee 32 c6 69 d4 01 06 | keyex value 64 1c b1 ac bd ca de 68 0e 17 19 91 8f 54 14 0f | keyex value 04 03 67 fd 43 98 ce 5f fd c3 a5 7f 47 dd 8e 3e | keyex value 2f 12 04 fa ac 33 90 90 32 d1 a6 b4 20 fc ca eb | keyex value 39 9e 90 74 ce 8e 29 1c 24 a3 37 27 52 39 51 57 | keyex value ba 48 33 30 f0 24 70 a1 c7 60 eb d6 48 c0 f6 89 | keyex value c7 a4 62 65 16 75 9d ec 07 ff 14 94 37 69 3c 2d | keyex value 2f 96 fa 68 c0 9c fb 4e b4 ce ad 7e 8e 55 84 8f | keyex value a5 fc 32 24 bd e5 d5 c3 8a c3 d3 37 68 40 29 53 | keyex value 62 50 1e 0b f1 2e d0 6c cc e2 2b 96 ab ec 76 61 | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 01 00 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 02 40 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff fc | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | outI1 HASH(1): | fb df 58 ca 9b 5c e1 76 a5 66 41 a5 73 79 41 5d | 36 8f 53 f9 5d fe 63 ac fe 02 4e 0f 58 90 0e ee | no IKEv1 message padding required | emitting length of ISAKMP Message: 476 | sending 476 bytes for reply packet from quick_outI1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #3) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 81 73 dc 8a 00 00 01 dc e0 24 5a b8 | 14 42 fb 21 2a 5c 12 99 59 e8 8e ec 8f 50 cc b2 | e1 fe 20 a7 c0 0a 14 c4 ed b2 c3 c1 1d 1a c6 50 | 11 db 55 83 46 6d d3 dd d8 55 cd af b0 b3 dd a5 | 77 ff d6 ca 41 23 14 4f 2b b5 70 ba b9 18 00 2f | 16 bd 1f 61 fa b7 de 8a 35 91 a9 c1 b4 80 b7 26 | 80 5e 72 34 54 e6 36 e6 83 1c 4e 00 a0 11 64 82 | cd 51 43 da b8 2d 54 5b 22 96 ee f5 42 8f 9f 23 | 99 8b 21 ee 2e 22 68 2c 66 7a c1 96 c8 3f d5 ad | bf 17 0c c7 ad 41 f8 c4 6b 6a 2b b4 3d 80 94 48 | 3a 2b e8 f4 4c 85 ff b5 9c 2e f6 3d 71 c7 e9 3d | a3 74 a9 1b a2 cb bb 28 0a a8 c9 bd 1b 60 30 90 | 4b 22 58 6b 59 8d 51 84 da 11 00 f2 fc 99 33 0f | f2 d8 77 04 4d 68 38 fd 05 e0 48 d1 bc d1 28 6c | 42 c3 8d 9e 34 e1 a2 d8 5d 03 a0 5b 58 7e 50 b0 | 75 a7 f0 92 66 b8 81 1c 72 cd 6c 1a e4 39 ff 69 | e4 3b b7 29 73 72 fa 29 24 12 1f 06 74 57 0b 4d | ed 25 4a d1 00 d8 36 1f 70 79 f3 af a3 de 7a 06 | 0e 7b 60 89 11 b6 fa c9 75 33 b2 70 57 16 90 4c | ac 3c 81 85 65 b0 7a b4 61 ba 3c 30 34 cb 75 d1 | 34 30 83 b7 7c a5 b0 3f 7f fe a2 db 85 2d 65 d2 | 19 02 ce 44 02 23 57 5b a5 61 b8 11 3a b5 a1 de | 33 e4 6b 81 16 5f 44 29 f0 9a 0c 85 61 eb 7a 10 | 4d 5f ef ce c6 61 87 d6 cc b2 13 06 cf 3b 55 c8 | 34 d5 77 06 c1 98 b9 9f ca 2a d7 75 37 3d df 82 | ad 25 69 3e 6c c4 4f dd 5f 9d ab 58 56 84 df 40 | 96 31 00 99 d9 06 92 20 2d f3 53 62 0a ff df 66 | 2a 69 e5 34 d6 fb 6e ad 19 aa 4f f9 28 e8 d1 c5 | 6b 9e 07 90 2f aa 61 8d d8 a3 ae b1 | state #3 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5650ce301fc8 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5650ce306f48 "westnet-eastnet-subnets/1x2" #3: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5650ce306f48 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #3 | libevent_malloc: new ptr-libevent@0x7f11dc0055c8 size 128 | #3 STATE_QUICK_I1: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.676658 | resume sending helper answer for #3 suppresed complete_v1_state_transition() | #3 spent 0.435 milliseconds in resume sending helper answer | stop processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11e40055c8 | processing resume sending helper answer for #4 | start processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 1 replies to request ID 5 | calling continuation function 0x5650cd7b4b50 | quick_outI1_continue for #4: calculated ke+nonce, sending I1 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 558372946 (0x21481852) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | emitting quick defaults using policy none | empty esp_info, returning defaults for ENCRYPT | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 2 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0x970c0d6c for esp.0@192.1.2.45 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI 97 0c 0d 6c | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ESP): 32 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 1 (0x1) | ESP transform ID: ESP_3DES (0x3) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | emitting length of ISAKMP Transform Payload (ESP): 28 | emitting length of ISAKMP Proposal Payload: 72 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 84 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni 90 47 fe b3 7d 97 48 78 5a 16 95 96 ab 53 30 3b | Ni 6b 1f 3d fe 6b b4 b7 b0 83 c3 84 bc 1c d6 96 3c | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value b5 af d3 31 76 41 85 37 84 b4 6c 5b 12 7b 32 66 | keyex value f4 1a 80 02 68 6a 23 2d f6 18 41 31 41 dc 41 fc | keyex value d5 67 59 73 48 d9 32 25 61 4d 50 35 54 7c 5d 13 | keyex value 20 36 35 4e 1c d3 c2 76 1c ed 6c 22 2c f7 94 60 | keyex value 23 14 c8 90 f6 c4 5e f0 18 8e 3a 61 4d d7 0a 31 | keyex value 2d ec a8 a3 d2 c9 fb 03 25 0e fb 73 44 9a ed bd | keyex value 4a cf 07 a6 31 a6 aa 01 b7 d1 6a 2b 11 eb b5 fe | keyex value b0 59 63 62 2d fa f1 36 57 69 a2 19 d0 33 16 68 | keyex value 62 8e 73 ba 4b 32 46 d1 83 48 6e fc 0c be f1 5c | keyex value 18 54 6e 58 80 83 4e a8 2e 13 2d e5 42 9e 3f 19 | keyex value 7c 55 34 18 42 3a 1f bc ac 84 41 e0 f0 a9 34 c5 | keyex value 97 f9 10 f7 5e 32 e1 a6 ea 2e ea eb 90 56 93 bc | keyex value 83 6e de 47 18 04 0a ba a3 ef 4a a4 ae d6 a3 8a | keyex value 94 7f 50 e5 09 b4 46 ee 07 b5 2b 30 f1 cf 26 98 | keyex value 55 8d f0 83 71 93 da 65 5d ba 7d 97 84 c0 f2 c3 | keyex value 40 a2 cb 10 f1 60 6f 95 ae 37 37 b1 5a 57 43 79 | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 01 80 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 02 10 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff f0 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | outI1 HASH(1): | 22 90 01 62 bd 72 09 b1 0b 3a b1 97 cb 09 a2 dc | b7 94 cd d6 88 a5 74 5c 85 21 4a 4b e5 6e 6a 7c | no IKEv1 message padding required | emitting length of ISAKMP Message: 476 | sending 476 bytes for reply packet from quick_outI1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #4) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 21 48 18 52 00 00 01 dc c2 96 39 58 | 90 8a b0 27 9b 50 cc c6 c7 ec 52 bb 28 6f 7b 11 | 14 44 a5 ef 4f 09 cb 9f 22 d9 0c d4 f1 61 f4 61 | 27 c5 6f ee d0 9f 58 a7 3e bc 9f d0 79 8a f5 65 | ae 40 d8 21 a6 63 5e 03 78 66 13 64 86 99 e8 46 | 9e 76 ef 53 31 0d c7 49 e7 fc f4 93 7e b2 9d 5a | 0d 37 70 c7 ef cd fe 42 2c f8 69 e6 7a 56 06 66 | 17 01 fc 14 f2 db bd 68 da e4 9a a8 c6 18 5f a9 | 9a d2 3a 36 2b c4 74 34 33 03 35 d0 06 7d 1a b9 | 21 0f ed 42 27 61 d7 e4 1f ef 84 a5 51 7c de 7c | 12 50 97 dc 59 76 43 7e 0f 7a 92 5f 43 a8 d2 be | 3c 7d f0 06 87 ff d7 26 d8 a2 ed db f7 fe 1c d4 | 72 ad d3 b1 16 f8 81 0d 33 0e a9 21 87 06 64 e4 | fa a5 36 ec f0 0b 48 df 55 d0 57 91 cf 84 81 c1 | 20 39 79 77 6e 21 1b b2 aa 38 ed 2f 06 7f 51 11 | 77 e5 2c 43 09 95 45 4d 6a 0f 79 b5 4c 58 8a c3 | c3 d7 65 64 ed 41 40 a3 b7 79 08 3f 44 90 1f b1 | 56 18 56 4c c7 09 4f 95 00 79 02 03 83 60 29 cd | 34 72 43 f2 6a 56 6e d5 87 82 09 41 97 25 33 b3 | 76 39 14 d6 35 cd 25 9a 92 76 25 68 79 89 7e 10 | 37 70 3b 6b 70 26 f4 34 fb 38 e0 7b 1c 66 d2 96 | 33 b3 3b a8 0e ec 2a 1d 18 2c fb 3c eb a1 7d c3 | 69 bb 29 2b 4d 66 c7 87 7f 0e f6 ec c2 91 28 67 | 29 99 d9 cc 3c de e6 b5 50 b2 74 f1 c0 28 d2 58 | d6 c8 dc 00 c7 25 65 ea 2a 69 af 38 1d 70 1d df | a5 28 eb 12 f1 da 9c 83 d2 50 4b f6 53 a4 5d 3d | ce 2c b7 78 02 10 0c 30 c9 6c 28 6d 41 ed a6 36 | 1c b9 3a ab d5 6a 2e 98 2f 58 81 05 8c 2e c8 03 | 70 fe 04 0d b4 a1 d2 e4 65 0d 7d be | state #4 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5650ce302888 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5650ce30d0a8 "westnet-eastnet-subnets/2x1" #4: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5650ce30d0a8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #4 | libevent_malloc: new ptr-libevent@0x7f11e40055c8 size 128 | #4 STATE_QUICK_I1: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29887.677632 | resume sending helper answer for #4 suppresed complete_v1_state_transition() | #4 spent 0.441 milliseconds in resume sending helper answer | stop processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11e8003f28 | spent 0.00154 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 460 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 bb f2 d7 7d 00 00 01 cc ce 45 32 f2 | 8e 67 d9 c1 68 36 ad 66 b9 8a 53 bc 6f 49 a7 0d | 54 1c bb aa f9 71 80 7b d7 ff 9c ff af 04 40 63 | 08 f5 f9 63 8d 50 14 f1 34 4d 24 f5 49 8a dd 20 | 73 86 66 f7 db f2 17 3a 47 5d c0 65 c4 dd 2b 28 | c2 c9 12 2a bd 07 6d f0 64 b4 c2 be 9b 8b f5 0f | 0a da 04 b4 96 e9 51 f6 93 6d 06 91 7a 57 4b 08 | 28 79 e7 b4 62 5f 8f 17 2e 42 dc 77 77 92 e5 2a | f3 09 b5 7f 67 c4 9c 36 5f 26 66 24 60 a7 55 2e | a2 7f 62 1d f3 3a a2 73 be 3d 25 1f 91 b3 bd 50 | 76 91 f7 fe 45 48 d0 94 39 34 76 3d 33 27 2a d3 | 31 eb 9d 15 e6 5b d3 1a a1 7f 70 7f a2 6b 9b 07 | b7 fb 4b cc 07 24 5e 11 91 d4 e5 b5 fa a5 eb cf | 55 e1 05 a5 f7 b7 86 05 72 30 79 6b ab 64 97 69 | 3c 54 f6 f9 63 96 16 70 68 44 4c 26 fa be cc c0 | 7c f9 a7 8a c4 54 f5 56 19 e6 5b 47 b9 d7 c7 9c | 45 d0 14 5d c1 a0 c9 b6 e1 cf 69 d9 3c 2a 59 01 | cd 68 e0 b4 e1 0f 4d fa 24 ed de 91 a3 a6 53 03 | b3 1b 1f 7b f0 c1 f0 3a c8 1c 9f de 02 84 ef ab | 05 e5 98 19 af c7 e5 01 d2 ae d7 f2 4c 21 dd 48 | d3 17 a6 83 2d 87 bb 1f e3 59 bc 39 08 f2 22 3f | 4b 0d cb ad 1a 09 83 90 78 a0 b9 1f 5d 54 46 ad | 31 ad 87 84 b0 40 98 bf e7 2c 27 d5 41 53 9b b0 | 65 ff 65 a7 da 49 21 aa 0c 9a e2 f1 b9 e1 d0 22 | f4 cc 72 b6 14 6b 17 73 7f f0 ec 7b ac 79 b2 fd | f7 2d 33 72 e0 a9 c9 8c d5 4f da 13 d4 f4 63 82 | 9a d5 ea 95 d5 80 15 f2 4d e6 a0 d8 14 1a 7a 15 | 93 e6 0b c2 2b 6c e6 24 12 ac d0 34 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3153254269 (0xbbf2d77d) | length: 460 (0x1cc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #2 in QUICK_I1 (find_state_ikev1) | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1633) | #2 is idle | #2 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 01 00 ff ff ff f0 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 10 ff ff ff f0 | removing 12 bytes of padding | quick_inR1_outI2 HASH(2): | 81 32 43 c9 1f 3e 94 d4 6b 9c 93 62 11 59 31 ae | 65 14 f5 56 dc 97 92 cb dd d2 85 da cb ab af 37 | received 'quick_inR1_outI2' message HASH(2) data ok | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 29 74 b4 6f | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | started looking for secret for @west->@east of kind PKK_PSK | actually looking for secret for @west->@east of kind PKK_PSK | line 1: key type PKK_PSK(@west) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outI2 DH work-order 7 for state #2 | state #2 requesting EVENT_RETRANSMIT to be deleted | #2 STATE_QUICK_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x5650ce30c638 | free_event_entry: release EVENT_RETRANSMIT-pe@0x7f11f4002b78 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7f11f4002b78 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f11e8003f28 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #2 and saving MD | crypto helper 6 resuming | crypto helper 6 starting work-order 7 for state #2 | crypto helper 6 doing compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 7 | #2 is busy; has a suspended MD | #2 spent 0.139 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.362 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 6 finished compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 7 time elapsed 0.000958 seconds | (#2) spent 0.965 milliseconds in crypto helper computing work-order 7: quick outI2 DH (pcr) | crypto helper 6 sending results from work-order 7 for state #2 to event queue | scheduling resume sending helper answer for #2 | libevent_malloc: new ptr-libevent@0x7f11e0001f78 size 128 | crypto helper 6 waiting (nothing to do) | processing resume sending helper answer for #2 | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 6 replies to request ID 7 | calling continuation function 0x5650cd7b4b50 | quick_inR1_outI2_continue for #2: calculated ke+nonce, calculating DH | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3153254269 (0xbbf2d77d) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 01 00 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | our client is subnet 192.0.1.0/28 | our client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 10 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | peer client is subnet 192.0.2.16/28 | peer client protocol/port is 0/0 | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | quick_inR1_outI2 HASH(3): | ec ef 6e 94 7a 2a d8 a8 84 55 b8 d4 3d e8 7a c1 | ec 2b 71 fe 99 b1 cb 03 f5 af 19 b1 d6 96 9f 95 | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | install_ipsec_sa() for #2: inbound and outbound | could_route called for westnet-eastnet-subnets/1x1 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x1" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/1x1' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.2974b46f@192.1.2.23 included non-error error | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/1x1' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.9210c7f8@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | add inbound eroute 192.0.2.16/28:0 --0-> 192.0.1.0/28:0 => tun.10000@192.1.2.45 (raw_eroute) | IPsec Sa SPD priority set to 1041379 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #2: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x1" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-subnets/1x1 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #2 | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | eroute_connection add eroute 192.0.1.0/28:0 --0-> 192.0.2.16/28:0 => tun.0@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1041379 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED=' | popen cmd is 1055 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-sub: | cmd( 80):nets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.4: | cmd( 160):5' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0: | cmd( 240):.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL: | cmd( 320):='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PE: | cmd( 400):ER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2.1: | cmd( 480):6' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTO: | cmd( 560):COL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLIC: | cmd( 640):Y='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' P: | cmd( 720):LUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_: | cmd( 800):IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BA: | cmd( 880):NNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IF: | cmd( 960):ACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x2974b46f SPI_OUT=0x9210c7f8 ips: | cmd(1040):ec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VT | popen cmd is 1060 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.: | cmd( 160):1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET=': | cmd( 240):192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PRO: | cmd( 320):TOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLU: | cmd( 400):TO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.: | cmd( 480):0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_: | cmd( 560):PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_: | cmd( 640):POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_: | cmd( 720):NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 P: | cmd( 800):LUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PE: | cmd( 880):ER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' V: | cmd( 960):TI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x2974b46f SPI_OUT=0x9210c7f: | cmd(1040):8 ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SH | popen cmd is 1058 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.: | cmd( 160):2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='19: | cmd( 240):2.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTO: | cmd( 320):COL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO: | cmd( 400):_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.: | cmd( 480):2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PR: | cmd( 560):OTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_PO: | cmd( 640):LICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO: | cmd( 720):' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLU: | cmd( 800):TO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER: | cmd( 880):_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI: | cmd( 960):_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x2974b46f SPI_OUT=0x9210c7f8 : | cmd(1040):ipsec _updown 2>&1: | route_and_eroute: instance "westnet-eastnet-subnets/1x1", setting eroute_owner {spd=0x5650ce3017b8,sr=0x5650ce3017b8} to #2 (was #0) (newest_ipsec_sa=#0) | #1 spent 2.09 milliseconds in install_ipsec_sa() | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 | inR1_outI2: instance westnet-eastnet-subnets/1x1[0], setting IKEv1 newest_ipsec_sa to #2 (was #0) (spd.eroute=#2) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #2 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 | child state #2: QUICK_I1(established CHILD SA) => QUICK_I2(established CHILD SA) | event_already_set, deleting event | state #2 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7f11e8003f28 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7f11f4002b78 | sending reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 76 bytes for STATE_QUICK_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #2) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 bb f2 d7 7d 00 00 00 4c 93 d2 03 f6 | 63 00 c1 10 0a 66 fb b5 04 15 e7 60 66 43 fe a8 | 76 5b 8f 41 3e a5 7a 97 29 ce 0d 51 6b ce 4b ca | 44 29 85 60 81 3a 53 6c 93 d5 1c 1e | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x7f11f4002b78 | inserting event EVENT_SA_REPLACE, timeout in 28048 seconds for #2 | libevent_malloc: new ptr-libevent@0x5650ce302888 size 128 | pstats #2 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/1x1" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x2974b46f <0x9210c7f8 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | close_any(fd@28) (in release_whack() at state.c:654) | resume sending helper answer for #2 suppresed complete_v1_state_transition() | #2 spent 2.53 milliseconds in resume sending helper answer | stop processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11e0001f78 | spent 0.00139 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 460 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 81 73 dc 8a 00 00 01 cc 86 cc ee c1 | a7 49 09 1f 32 9c ca 6a 56 0e 79 7e 45 b7 a4 3e | 49 fd 13 db 59 08 bb bc 39 d5 52 ec a0 ed 69 4b | 69 10 17 06 74 5f 82 c9 de c9 72 c0 5f 12 0b 7e | 45 c1 c8 3e 2d cb 8c 17 6c 84 4f 8e 1c 50 fb 26 | 17 69 ec 46 e7 fe 6b b9 6b d5 e1 5c b5 b9 f1 6d | ce da a0 44 6c f3 38 4e 2f 6a a4 61 ff 5c c2 36 | b5 b1 18 78 ea 1a c2 f1 eb f7 76 7e 3d 40 dc 3b | 7d a5 cf d4 5b 20 fa fb 09 55 93 44 9b d6 83 0d | f3 e9 48 19 bd bc 07 50 f7 9b 06 58 3b 79 60 cd | 5d c7 0e 1e af e2 31 eb 47 78 f8 f1 08 7c 43 7d | 63 82 00 5a 81 ec d8 89 bc 45 32 14 67 1f 91 48 | c5 5f 0d 74 e6 2e f2 d5 1f 27 57 43 ee 2d 7c 4b | a4 ac 84 6b e3 36 21 42 77 d1 21 26 41 58 ca 57 | 0c 5b f3 ab 29 55 5b 5b a1 f4 9c 18 e4 b7 42 54 | 4c a1 17 a6 4c 2f ec ee b1 44 29 9d b8 65 12 ec | d6 1f 44 d7 a5 5d 9b c3 20 4e 72 f1 e8 e4 c1 f6 | 91 19 c2 0c e0 1f fd 33 3f a0 6d 2e 9b 8a 57 bb | 71 20 80 b4 de ba 3b e2 ed 8f 20 e0 a5 5d f3 e5 | 1a da 60 81 d0 59 76 96 a8 eb 64 0a 04 94 c9 b7 | eb 9c c6 4f 1a 66 01 0b 9e e3 1b a3 2b dc 98 80 | b7 6d ea 3a 36 4e 71 d5 b0 60 83 63 74 36 46 e8 | 1f 4f 66 e3 d8 de e9 fd 61 e7 28 0f 6e 60 64 63 | 06 37 bf 1e 17 a3 69 30 1f 1f c2 2a e2 bf 76 b0 | 73 57 24 50 f0 5e 3b 85 9a 6b 39 a3 99 a8 77 f6 | 81 77 b3 42 bc eb d2 88 83 5c 74 e6 02 83 ea e4 | 7f 4f 54 45 a2 23 15 9a f8 8b fd c5 42 cc 7a 14 | f1 f8 a8 6d 4e 5b b3 d1 48 45 b2 4a | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2171853962 (0x8173dc8a) | length: 460 (0x1cc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #3 in QUICK_I1 (find_state_ikev1) | start processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1633) | #3 is idle | #3 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 01 00 ff ff ff f0 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 40 ff ff ff fc | removing 12 bytes of padding | quick_inR1_outI2 HASH(2): | 19 b2 f7 24 8f ff c4 fa ee c4 33 ff ea de 73 30 | 40 13 51 f9 34 30 a1 c5 a8 95 eb 0a 27 46 bb 98 | received 'quick_inR1_outI2' message HASH(2) data ok | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 58 7c 7e a5 | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | started looking for secret for @west->@east of kind PKK_PSK | actually looking for secret for @west->@east of kind PKK_PSK | line 1: key type PKK_PSK(@west) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outI2 DH work-order 8 for state #3 | state #3 requesting EVENT_RETRANSMIT to be deleted | #3 STATE_QUICK_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x7f11dc0055c8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5650ce306f48 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5650ce306f48 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: new ptr-libevent@0x7f11e0001f78 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #3 and saving MD | #3 is busy; has a suspended MD | crypto helper 0 resuming | crypto helper 0 starting work-order 8 for state #3 | crypto helper 0 doing compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 8 | crypto helper 0 finished compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 8 time elapsed 0.00096 seconds | (#3) spent 0.966 milliseconds in crypto helper computing work-order 8: quick outI2 DH (pcr) | crypto helper 0 sending results from work-order 8 for state #3 to event queue | scheduling resume sending helper answer for #3 | libevent_malloc: new ptr-libevent@0x7f11f40027d8 size 128 | crypto helper 0 waiting (nothing to do) | #3 spent 0.129 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.37 milliseconds in comm_handle_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00412 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00265 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.0026 milliseconds in signal handler PLUTO_SIGCHLD | spent 0.0025 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 460 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 09 9e a1 a1 00 00 01 cc 11 35 a7 7a | e7 81 5b 6d 02 52 47 a7 95 1b 05 52 d4 3a 13 54 | 02 03 d8 a8 2d be 81 f4 09 36 f0 26 28 f1 99 d1 | ba 32 ee 16 71 f9 b8 d7 d8 fe 99 69 a7 0d 10 0b | 11 df 08 93 94 c3 dd 96 72 08 64 9d ba fc 37 1a | 0e 71 e7 2d 51 f6 3d 57 f5 ce e3 0c 3a 03 2f 71 | 02 9b f8 4b 30 f6 16 4f 04 b8 94 e1 31 c3 bc a0 | ff ff d6 cb a7 d1 a8 05 8a 9a f5 a7 1a 2b 20 60 | 2e b5 c8 d9 44 e7 21 69 c5 b7 a5 54 8d 71 21 fc | 53 c2 a9 d3 33 40 32 c0 38 cd c7 03 65 a1 ac b5 | 21 a0 57 43 82 0a cd 21 16 95 45 13 95 e0 c1 1f | 80 28 ad 8d 4c b6 54 86 ce 0d d2 c4 dc 30 ec 63 | 0b 4d da b6 a4 76 d5 6b f3 91 22 bd 16 af 6c fa | 31 90 c0 4a 4c 6c 51 4b 0b 29 8a 40 b2 13 db 7b | f0 28 e0 c7 8e c3 9a 87 46 a8 88 d6 01 18 2d 2d | c5 8b e7 7c c4 e3 9a 74 49 4f b4 bf 83 e1 a9 d0 | 5a 51 c0 c2 0d c7 30 b7 e1 62 b5 45 0d 79 8c 90 | 12 af 21 46 ea e7 46 fa 71 e2 ce 20 88 63 0b 0d | 23 95 c3 e1 7b d3 4d e8 60 01 74 86 ad 69 5f 62 | 97 4a 8d f4 2a c9 d9 d8 64 f0 09 07 21 55 bc 91 | 50 42 74 23 1a 03 68 67 eb 7c 1b ca e0 35 df b1 | da 16 32 66 f3 75 0a b1 a5 02 89 0a 32 84 d2 22 | 48 8a e1 2b d3 01 f6 fb ed 47 e7 34 dd de 93 78 | 2d 1a 95 f4 3f d7 38 20 48 32 79 56 5f 30 86 4a | e4 1a b7 3e 3d ba 4b e3 57 33 b1 4d 40 2c c5 df | 4c 0e c7 71 71 9c 8f 5b 7c d1 ff b0 bf 44 31 3b | fa ae 2a 7e 7c 83 a6 64 c8 a4 11 c6 6e 3a ab 0d | 49 26 38 be a2 3c 01 ac f1 09 63 dc | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 161391009 (0x99ea1a1) | length: 460 (0x1cc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #5 in QUICK_I1 (find_state_ikev1) | start processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1633) | #5 is idle | #5 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 01 80 ff ff ff f0 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 40 ff ff ff fc | removing 12 bytes of padding | quick_inR1_outI2 HASH(2): | 05 c5 3b d5 a1 be 50 e8 a8 b0 c2 0b 8e 57 cb 27 | d2 4d 79 c5 c4 36 be 77 44 d9 fd 7c 26 f6 e9 c1 | received 'quick_inR1_outI2' message HASH(2) data ok | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI b8 90 e0 ea | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | started looking for secret for @west->@east of kind PKK_PSK | actually looking for secret for @west->@east of kind PKK_PSK | line 1: key type PKK_PSK(@west) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outI2 DH work-order 9 for state #5 | state #5 requesting EVENT_RETRANSMIT to be deleted | #5 STATE_QUICK_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x7f11f0003f28 | free_event_entry: release EVENT_RETRANSMIT-pe@0x7f11f0004218 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7f11f0004218 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: new ptr-libevent@0x5650ce30c998 size 128 | crypto helper 2 resuming | crypto helper 2 starting work-order 9 for state #5 | crypto helper 2 doing compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 9 | crypto helper 2 finished compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 9 time elapsed 0.000948 seconds | (#5) spent 0.953 milliseconds in crypto helper computing work-order 9: quick outI2 DH (pcr) | crypto helper 2 sending results from work-order 9 for state #5 to event queue | scheduling resume sending helper answer for #5 | libevent_malloc: new ptr-libevent@0x7f11ec000e98 size 128 | crypto helper 2 waiting (nothing to do) | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #5 and saving MD | #5 is busy; has a suspended MD | #5 spent 0.138 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.382 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #3 | start processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 8 | calling continuation function 0x5650cd7b4b50 | quick_inR1_outI2_continue for #3: calculated ke+nonce, calculating DH | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2171853962 (0x8173dc8a) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 01 00 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | our client is subnet 192.0.1.0/28 | our client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 40 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff fc | peer client is subnet 192.0.2.64/30 | peer client protocol/port is 0/0 | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | quick_inR1_outI2 HASH(3): | 12 11 f9 19 a9 63 0e 6e f4 c2 df 1c f9 2d 86 a3 | 7c 5b c6 a2 f3 53 f5 92 c5 56 ab 70 cd 12 1d 2a | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | install_ipsec_sa() for #3: inbound and outbound | could_route called for westnet-eastnet-subnets/1x2 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x2" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/1x2' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.587c7ea5@192.1.2.23 included non-error error | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/1x2' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.687d269a@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe3e1 | add inbound eroute 192.0.2.64/30:0 --0-> 192.0.1.0/28:0 => tun.10000@192.1.2.45 (raw_eroute) | IPsec Sa SPD priority set to 1041377 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #3: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x2" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-subnets/1x2 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #3 | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe3e1 | eroute_connection add eroute 192.0.1.0/28:0 --0-> 192.0.2.64/30:0 => tun.0@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1041377 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED=' | popen cmd is 1055 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-sub: | cmd( 80):nets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.4: | cmd( 160):5' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0: | cmd( 240):.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL: | cmd( 320):='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PE: | cmd( 400):ER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2.6: | cmd( 480):4' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTO: | cmd( 560):COL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLIC: | cmd( 640):Y='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' P: | cmd( 720):LUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_: | cmd( 800):IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BA: | cmd( 880):NNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IF: | cmd( 960):ACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x587c7ea5 SPI_OUT=0x687d269a ips: | cmd(1040):ec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VT | popen cmd is 1060 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.: | cmd( 160):1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET=': | cmd( 240):192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PRO: | cmd( 320):TOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLU: | cmd( 400):TO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.: | cmd( 480):0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_: | cmd( 560):PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_: | cmd( 640):POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_: | cmd( 720):NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 P: | cmd( 800):LUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PE: | cmd( 880):ER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' V: | cmd( 960):TI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x587c7ea5 SPI_OUT=0x687d269: | cmd(1040):a ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SH | popen cmd is 1058 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.: | cmd( 160):2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='19: | cmd( 240):2.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTO: | cmd( 320):COL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO: | cmd( 400):_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.: | cmd( 480):2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PR: | cmd( 560):OTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_PO: | cmd( 640):LICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO: | cmd( 720):' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLU: | cmd( 800):TO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER: | cmd( 880):_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI: | cmd( 960):_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x587c7ea5 SPI_OUT=0x687d269a : | cmd(1040):ipsec _updown 2>&1: | route_and_eroute: instance "westnet-eastnet-subnets/1x2", setting eroute_owner {spd=0x5650ce302aa8,sr=0x5650ce302aa8} to #3 (was #0) (newest_ipsec_sa=#0) | #1 spent 1.96 milliseconds in install_ipsec_sa() | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 | inR1_outI2: instance westnet-eastnet-subnets/1x2[0], setting IKEv1 newest_ipsec_sa to #3 (was #0) (spd.eroute=#3) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #3 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 | child state #3: QUICK_I1(established CHILD SA) => QUICK_I2(established CHILD SA) | event_already_set, deleting event | state #3 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7f11e0001f78 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5650ce306f48 | sending reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 76 bytes for STATE_QUICK_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #3) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 81 73 dc 8a 00 00 00 4c c3 0b f2 72 | 03 98 37 75 bc fc be 24 11 04 e9 19 43 a2 a2 80 | a4 ec b7 25 12 74 a2 4d c6 fb 59 27 f3 56 e0 9f | d0 0a 04 da 4e 5b 8a 64 9b 89 36 67 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x5650ce306f48 | inserting event EVENT_SA_REPLACE, timeout in 27838 seconds for #3 | libevent_malloc: new ptr-libevent@0x5650ce30b8c8 size 128 | pstats #3 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/1x2" #3: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x587c7ea5 <0x687d269a xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | close_any(fd@27) (in release_whack() at state.c:654) | resume sending helper answer for #3 suppresed complete_v1_state_transition() | #3 spent 2.4 milliseconds in resume sending helper answer | stop processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11f40027d8 | spent 0.00169 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 460 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 21 48 18 52 00 00 01 cc 9d 46 f6 b2 | 6e 51 c3 aa bd 97 b9 63 d2 3f 5c 13 f0 d4 00 36 | f8 11 b2 dc 4d e2 bd 15 7d fc 09 55 ce 9b 50 94 | 1e 4a 58 76 7c 1f 41 71 e3 cc 8a 3d 58 ce 3d bb | 17 ba fa 19 9f 19 6d 1c b3 ab e2 42 3f 74 4d d2 | e3 28 42 85 30 15 46 9d d6 eb f2 2f 18 f0 a6 04 | 87 99 fe fa de 70 39 e3 c0 7d 9e d4 4b 70 0e 01 | ef 4f 6f 23 20 28 bd 57 f4 d0 f3 8c bf e6 25 f4 | 0c 57 bd 86 43 97 91 d7 aa ad fa 02 63 78 33 7b | 7b 6c 54 b4 33 94 24 3b 3f 06 2b 56 4c a1 74 d6 | 95 a3 f9 7e fa 67 73 6c 66 85 4c 92 df 47 e2 ff | 32 a6 d3 83 73 c8 8e 81 a2 b9 32 41 4c b8 f9 6f | 6e 59 a3 1f 2a 42 1b 80 9c 01 b7 62 85 58 f1 80 | d6 72 08 46 66 e8 85 95 16 6e 60 27 98 28 42 6d | 94 28 07 2a 56 40 91 0d 64 39 40 44 a1 10 08 55 | ed a1 27 b5 0a 8d 68 6a 7c 62 b1 2d e0 52 fe af | c6 fe 59 a0 d9 98 58 77 a8 15 e3 cc 7e 57 8c 48 | df 05 01 dc e8 81 48 81 e5 ef 8b 52 d8 8f 15 64 | 1e 5b b1 5a 19 cc d1 d5 96 9d 77 4d 7d da d8 89 | 93 ac ad d9 61 48 b0 18 54 eb d4 4c 80 da c3 7b | 8c 92 00 98 38 ee 3b 76 75 21 1d e3 ea 04 15 87 | 5b 74 2d 57 3b 2b e1 fb b0 79 d1 cf b2 cc e1 e1 | 08 22 79 04 c3 b8 56 cf 49 15 bf 31 4d 78 47 d3 | dc 6c e0 f6 04 97 4c 53 c2 c1 c8 37 2a 2a 5c 54 | a3 b1 24 ee 71 51 33 74 d1 79 2a 02 c5 e8 d6 e5 | 40 93 cb 8a f2 e9 64 54 e8 54 9b 81 66 43 57 7c | 00 30 9a 7f 0d 4f 11 16 b7 a7 d6 de 8f 87 8c 0a | e2 96 8f ea 87 bc 53 22 94 46 aa 75 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 558372946 (0x21481852) | length: 460 (0x1cc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #4 in QUICK_I1 (find_state_ikev1) | start processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1633) | #4 is idle | #4 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 01 80 ff ff ff f0 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 10 ff ff ff f0 | removing 12 bytes of padding | quick_inR1_outI2 HASH(2): | 7d 52 91 f6 50 26 fb cf 1a 07 89 60 c8 81 c0 d4 | a5 a7 e0 8c 77 fe 44 79 18 32 04 37 fd 4e 99 66 | received 'quick_inR1_outI2' message HASH(2) data ok | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI fd 13 a8 b3 | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | started looking for secret for @west->@east of kind PKK_PSK | actually looking for secret for @west->@east of kind PKK_PSK | line 1: key type PKK_PSK(@west) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outI2 DH work-order 10 for state #4 | state #4 requesting EVENT_RETRANSMIT to be deleted | #4 STATE_QUICK_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x7f11e40055c8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5650ce30d0a8 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5650ce30d0a8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #4 | libevent_malloc: new ptr-libevent@0x7f11f40027d8 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #4 and saving MD | #4 is busy; has a suspended MD | #4 spent 0.138 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.386 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #5 | start processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 2 replies to request ID 9 | calling continuation function 0x5650cd7b4b50 | quick_inR1_outI2_continue for #5: calculated ke+nonce, calculating DH | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 161391009 (0x99ea1a1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 01 80 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | our client is subnet 192.0.1.128/28 | our client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 40 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff fc | peer client is subnet 192.0.2.64/30 | peer client protocol/port is 0/0 | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | quick_inR1_outI2 HASH(3): | f5 91 12 bd c3 fa 3a 66 30 d4 00 96 7b 2a 5d 49 | dd bc 85 e7 fc 74 3d 12 a4 aa f7 8a 94 b7 4f e1 | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | install_ipsec_sa() for #5: inbound and outbound | could_route called for westnet-eastnet-subnets/2x2 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x2" unrouted: "westnet-eastnet-subnets/1x2" erouted; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/2x2' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.b890e0ea@192.1.2.23 included non-error error | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/2x2' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.a1fe27ca@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe3e1 | add inbound eroute 192.0.2.64/30:0 --0-> 192.0.1.128/28:0 => tun.10000@192.1.2.45 (raw_eroute) | IPsec Sa SPD priority set to 1041377 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #5: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x2" unrouted: "westnet-eastnet-subnets/1x2" erouted; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-subnets/2x2 (next: none) ero:null esr:{(nil)} ro:westnet-eastnet-subnets/1x2 rosr:{0x5650ce302aa8} and state: #5 | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe3e1 | eroute_connection add eroute 192.0.1.128/28:0 --0-> 192.0.2.64/30:0 => tun.0@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1041377 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.128/28' PLUTO_MY_CLIENT_NET='192.0.1.128' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHAR | popen cmd is 1059 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-sub: | cmd( 80):nets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.4: | cmd( 160):5' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.128/28' PLUTO_MY_CLIENT_NET='192: | cmd( 240):.0.1.128' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROT: | cmd( 320):OCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUT: | cmd( 400):O_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0: | cmd( 480):.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_P: | cmd( 560):ROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_P: | cmd( 640):OLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_N: | cmd( 720):O' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PL: | cmd( 800):UTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEE: | cmd( 880):R_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VT: | cmd( 960):I_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xb890e0ea SPI_OUT=0xa1fe27ca: | cmd(1040): ipsec _updown 2>&1: | crypto helper 3 resuming | crypto helper 3 starting work-order 10 for state #4 | crypto helper 3 doing compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 10 | crypto helper 3 finished compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 10 time elapsed 0.000866 seconds | (#4) spent 0.843 milliseconds in crypto helper computing work-order 10: quick outI2 DH (pcr) | crypto helper 3 sending results from work-order 10 for state #4 to event queue | scheduling resume sending helper answer for #4 | libevent_malloc: new ptr-libevent@0x7f11f0005118 size 128 | crypto helper 3 waiting (nothing to do) | route_and_eroute: firewall_notified: true | route_and_eroute: instance "westnet-eastnet-subnets/2x2", setting eroute_owner {spd=0x5650ce3038e8,sr=0x5650ce3038e8} to #5 (was #0) (newest_ipsec_sa=#0) | #1 spent 1.07 milliseconds in install_ipsec_sa() | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 | inR1_outI2: instance westnet-eastnet-subnets/2x2[0], setting IKEv1 newest_ipsec_sa to #5 (was #0) (spd.eroute=#5) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #5 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 | child state #5: QUICK_I1(established CHILD SA) => QUICK_I2(established CHILD SA) | event_already_set, deleting event | state #5 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5650ce30c998 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7f11f0004218 | sending reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 76 bytes for STATE_QUICK_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #5) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 09 9e a1 a1 00 00 00 4c 16 cc 78 5a | 73 42 37 a7 98 c2 ab 4a fa 52 ce 0e 4a 54 25 2d | 61 b1 24 6f 42 41 77 1e c4 18 7f f5 eb 96 b3 25 | 29 fc 55 d1 d4 59 f2 16 e2 b4 72 4d | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x7f11f0004218 | inserting event EVENT_SA_REPLACE, timeout in 27829 seconds for #5 | libevent_malloc: new ptr-libevent@0x5650ce314b18 size 128 | pstats #5 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/2x2" #5: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xb890e0ea <0xa1fe27ca xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | close_any(fd@25) (in release_whack() at state.c:654) | resume sending helper answer for #5 suppresed complete_v1_state_transition() | #5 spent 1.51 milliseconds in resume sending helper answer | stop processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11ec000e98 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00439 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00276 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00261 milliseconds in signal handler PLUTO_SIGCHLD | processing resume sending helper answer for #4 | start processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 3 replies to request ID 10 | calling continuation function 0x5650cd7b4b50 | quick_inR1_outI2_continue for #4: calculated ke+nonce, calculating DH | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 558372946 (0x21481852) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 01 80 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | our client is subnet 192.0.1.128/28 | our client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 10 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff f0 | peer client is subnet 192.0.2.16/28 | peer client protocol/port is 0/0 | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | quick_inR1_outI2 HASH(3): | 99 b3 57 3e d8 72 89 c7 7c 87 ca f9 c2 05 14 f4 | 9f 4d 64 7b 0c b8 74 be cf ad c2 e9 fc ea e5 a8 | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | install_ipsec_sa() for #4: inbound and outbound | could_route called for westnet-eastnet-subnets/2x1 (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x1" unrouted: "westnet-eastnet-subnets/1x1" erouted; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/2x1' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.fd13a8b3@192.1.2.23 included non-error error | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-subnets/2x1' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.970c0d6c@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | add inbound eroute 192.0.2.16/28:0 --0-> 192.0.1.128/28:0 => tun.10000@192.1.2.45 (raw_eroute) | IPsec Sa SPD priority set to 1041379 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #4: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x1" unrouted: "westnet-eastnet-subnets/1x1" erouted; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-subnets/2x1 (next: none) ero:null esr:{(nil)} ro:westnet-eastnet-subnets/1x1 rosr:{0x5650ce3017b8} and state: #4 | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | eroute_connection add eroute 192.0.1.128/28:0 --0-> 192.0.2.16/28:0 => tun.0@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1041379 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.128/28' PLUTO_MY_CLIENT_NET='192.0.1.128' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHAR | popen cmd is 1059 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-sub: | cmd( 80):nets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.4: | cmd( 160):5' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.128/28' PLUTO_MY_CLIENT_NET='192: | cmd( 240):.0.1.128' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROT: | cmd( 320):OCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUT: | cmd( 400):O_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0: | cmd( 480):.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_P: | cmd( 560):ROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_P: | cmd( 640):OLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_N: | cmd( 720):O' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PL: | cmd( 800):UTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEE: | cmd( 880):R_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VT: | cmd( 960):I_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xfd13a8b3 SPI_OUT=0x970c0d6c: | cmd(1040): ipsec _updown 2>&1: | route_and_eroute: firewall_notified: true | route_and_eroute: instance "westnet-eastnet-subnets/2x1", setting eroute_owner {spd=0x5650ce3030d8,sr=0x5650ce3030d8} to #4 (was #0) (newest_ipsec_sa=#0) | #1 spent 1.02 milliseconds in install_ipsec_sa() | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 | inR1_outI2: instance westnet-eastnet-subnets/2x1[0], setting IKEv1 newest_ipsec_sa to #4 (was #0) (spd.eroute=#4) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #4 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 | child state #4: QUICK_I1(established CHILD SA) => QUICK_I2(established CHILD SA) | event_already_set, deleting event | state #4 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7f11f40027d8 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5650ce30d0a8 | sending reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 76 bytes for STATE_QUICK_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #4) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 20 01 21 48 18 52 00 00 00 4c ea 1c 6a fb | 04 95 61 52 cf 6b 01 d2 67 de ad 18 f2 08 1c d7 | e7 2a de 0e 81 c9 56 9a 25 41 0d 61 6c a1 0e 12 | eb a0 a7 4d 36 6b 98 da e4 35 40 d6 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x5650ce30d0a8 | inserting event EVENT_SA_REPLACE, timeout in 27768 seconds for #4 | libevent_malloc: new ptr-libevent@0x7f11ec000e98 size 128 | pstats #4 ikev1.ipsec established | NAT-T: encaps is 'auto' "westnet-eastnet-subnets/2x1" #4: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xfd13a8b3 <0x970c0d6c xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | close_any(fd@26) (in release_whack() at state.c:654) | resume sending helper answer for #4 suppresed complete_v1_state_transition() | #4 spent 1.83 milliseconds in resume sending helper answer | stop processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f11f0005118 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00428 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00333 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_STATE_... in show_traffic_status (sort_states) | FOR_EACH_STATE_... in sort_states | get_sa_info esp.9210c7f8@192.1.2.45 | get_sa_info esp.2974b46f@192.1.2.23 | get_sa_info esp.687d269a@192.1.2.45 | get_sa_info esp.587c7ea5@192.1.2.23 | get_sa_info esp.970c0d6c@192.1.2.45 | get_sa_info esp.fd13a8b3@192.1.2.23 | get_sa_info esp.a1fe27ca@192.1.2.45 | get_sa_info esp.b890e0ea@192.1.2.23 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.143 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | start processing: connection "westnet-eastnet-subnets/2x2" (in terminate_a_connection() at terminate.c:69) "westnet-eastnet-subnets/2x2": terminating SAs using this connection | connection 'westnet-eastnet-subnets/2x2' -POLICY_UP | FOR_EACH_STATE_... in shared_phase1_connection "westnet-eastnet-subnets/2x2": IKE SA is shared - only terminating IPsec SA | suspend processing: connection "westnet-eastnet-subnets/2x2" (in terminate_a_connection() at terminate.c:79) | start processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in terminate_a_connection() at terminate.c:79) | pstats #5 ikev1.ipsec deleted completed | [RE]START processing: state #5 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in delete_state() at state.c:879) "westnet-eastnet-subnets/2x2" #5: deleting state (STATE_QUICK_I2) aged 0.336s and sending notification | child state #5: QUICK_I2(established CHILD SA) => delete | get_sa_info esp.b890e0ea@192.1.2.23 | get_sa_info esp.a1fe27ca@192.1.2.45 "westnet-eastnet-subnets/2x2" #5: ESP traffic information: in=0B out=0B | #5 send IKEv1 delete notification for STATE_QUICK_I2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 665662352 (0x27ad3390) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload a1 fe 27 ca | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | 7c 75 de 8a b4 4f 18 fc 72 74 1a 0c 01 5c a6 9a | 2a f8 80 4c ee 17 80 15 fe e6 58 5d 0e 9f 6d 89 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 27 ad 33 90 00 00 00 5c 24 54 09 ed | 26 ff 8d ae 8e 26 22 ee be 5d 62 03 fe ae 65 fb | a3 2f 23 3e c2 a1 1e 57 d9 c2 1c a5 db ed 04 20 | b0 24 0b f9 ad b0 3a 00 ba 2d cb 3e bc 44 61 b5 | ed c6 bf c9 c7 d0 ba 3a 94 d9 fb 57 | state #5 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x5650ce314b18 | free_event_entry: release EVENT_SA_REPLACE-pe@0x7f11f0004218 | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.128/28' PLUTO_MY_CLIENT_NET='192.0.1.128' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844602' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no | popen cmd is 1067 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-s: | cmd( 80):ubnets/2x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2: | cmd( 160):.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.128/28' PLUTO_MY_CLIENT_NET='1: | cmd( 240):92.0.1.128' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PR: | cmd( 320):OTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PL: | cmd( 400):UTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192: | cmd( 480):.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER: | cmd( 560):_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844602' P: | cmd( 640):LUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALL: | cmd( 720):OW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAI: | cmd( 800):LED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' P: | cmd( 880):LUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURE: | cmd( 960):D='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xb890e0ea SPI_OUT=0x: | cmd(1040):a1fe27ca ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-subnets/2x2' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe3e1 | IPsec Sa SPD priority set to 1041377 | delete esp.b890e0ea@192.1.2.23 | netlink response for Del SA esp.b890e0ea@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe3e1 | delete inbound eroute 192.0.2.64/30:0 --0-> 192.0.1.128/28:0 => unk255.10000@192.1.2.45 (raw_eroute) | raw_eroute result=success | delete esp.a1fe27ca@192.1.2.45 | netlink response for Del SA esp.a1fe27ca@192.1.2.45 included non-error error | stop processing: connection "westnet-eastnet-subnets/2x2" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/2x2 | State DB: deleting IKEv1 state #5 in QUICK_I2 | child state #5: QUICK_I2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #5 from 192.1.2.23 (in delete_state() at state.c:1143) | processing: STOP connection NULL (in terminate_a_connection() at terminate.c:87) | start processing: connection "westnet-eastnet-subnets/2x1" (in terminate_a_connection() at terminate.c:69) "westnet-eastnet-subnets/2x1": terminating SAs using this connection | connection 'westnet-eastnet-subnets/2x1' -POLICY_UP | connection not shared - terminating IKE and IPsec SA | Deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #4 | suspend processing: connection "westnet-eastnet-subnets/2x1" (in foreach_state_by_connection_func_delete() at state.c:1310) | start processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #4 ikev1.ipsec deleted completed | [RE]START processing: state #4 connection "westnet-eastnet-subnets/2x1" from 192.1.2.23 (in delete_state() at state.c:879) "westnet-eastnet-subnets/2x1" #4: deleting state (STATE_QUICK_I2) aged 0.350s and sending notification | child state #4: QUICK_I2(established CHILD SA) => delete | get_sa_info esp.fd13a8b3@192.1.2.23 | get_sa_info esp.970c0d6c@192.1.2.45 "westnet-eastnet-subnets/2x1" #4: ESP traffic information: in=0B out=0B | #4 send IKEv1 delete notification for STATE_QUICK_I2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 4034409326 (0xf078336e) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload 97 0c 0d 6c | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | 9c a1 3e 29 18 f2 e6 cb 44 6f 02 05 68 78 4f 1c | 15 45 31 82 d3 e1 3f bb 28 97 6a ca 71 a6 f7 02 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 f0 78 33 6e 00 00 00 5c 87 93 47 63 | ec 96 3d 42 95 9e 2d 42 df f3 bd c3 0d 85 28 a9 | e6 1a f5 eb fb 2d 3e 00 cf 37 fc 55 40 33 8c be | e7 2c b1 ed e3 b2 6f 8d 44 7e c7 3c 1e 15 c4 9c | 7e 67 fe c0 59 ca e9 bc b5 5c 35 8d | state #4 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x7f11ec000e98 | free_event_entry: release EVENT_SA_REPLACE-pe@0x5650ce30d0a8 | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.128/28' PLUTO_MY_CLIENT_NET='192.0.1.128' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844602' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no | popen cmd is 1067 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-s: | cmd( 80):ubnets/2x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2: | cmd( 160):.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.128/28' PLUTO_MY_CLIENT_NET='1: | cmd( 240):92.0.1.128' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PR: | cmd( 320):OTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PL: | cmd( 400):UTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192: | cmd( 480):.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER: | cmd( 560):_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844602' P: | cmd( 640):LUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALL: | cmd( 720):OW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAI: | cmd( 800):LED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' P: | cmd( 880):LUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURE: | cmd( 960):D='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xfd13a8b3 SPI_OUT=0x: | cmd(1040):970c0d6c ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-subnets/2x1' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | IPsec Sa SPD priority set to 1041379 | delete esp.fd13a8b3@192.1.2.23 | netlink response for Del SA esp.fd13a8b3@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | delete inbound eroute 192.0.2.16/28:0 --0-> 192.0.1.128/28:0 => unk255.10000@192.1.2.45 (raw_eroute) | raw_eroute result=success | delete esp.970c0d6c@192.1.2.45 | netlink response for Del SA esp.970c0d6c@192.1.2.45 included non-error error | stop processing: connection "westnet-eastnet-subnets/2x1" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/2x1 | State DB: deleting IKEv1 state #4 in QUICK_I2 | child state #4: QUICK_I2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #4 from 192.1.2.23 (in delete_state() at state.c:1143) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | state #3 | state #2 | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #3 | state #2 | state #1 | processing: STOP connection NULL (in terminate_a_connection() at terminate.c:87) | start processing: connection "westnet-eastnet-subnets/1x2" (in terminate_a_connection() at terminate.c:69) "westnet-eastnet-subnets/1x2": terminating SAs using this connection | connection 'westnet-eastnet-subnets/1x2' -POLICY_UP | connection not shared - terminating IKE and IPsec SA | Deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #3 | suspend processing: connection "westnet-eastnet-subnets/1x2" (in foreach_state_by_connection_func_delete() at state.c:1310) | start processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #3 ikev1.ipsec deleted completed | [RE]START processing: state #3 connection "westnet-eastnet-subnets/1x2" from 192.1.2.23 (in delete_state() at state.c:879) "westnet-eastnet-subnets/1x2" #3: deleting state (STATE_QUICK_I2) aged 0.372s and sending notification | child state #3: QUICK_I2(established CHILD SA) => delete | get_sa_info esp.587c7ea5@192.1.2.23 | get_sa_info esp.687d269a@192.1.2.45 "westnet-eastnet-subnets/1x2" #3: ESP traffic information: in=0B out=0B | #3 send IKEv1 delete notification for STATE_QUICK_I2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1164633360 (0x456ae510) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload 68 7d 26 9a | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | 6b 27 d4 5d 8e 3a 8d 96 ca a6 86 da 69 d6 0d 66 | 06 84 d3 80 bf f7 c4 6c aa 84 2b 2c 11 cb 85 b1 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 45 6a e5 10 00 00 00 5c 8e a3 05 15 | 08 a4 f8 3b 5a ba d4 30 2c 58 d3 eb 54 37 06 8f | bf cf b8 b2 27 c8 8b 13 3d 25 01 4e 97 9f f9 fd | 4e bc 19 01 7d e4 60 fc 7d 7a da 64 06 12 ae 24 | 33 9a 8b 14 f7 4f a0 e1 ff 7d 92 20 | state #3 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x5650ce30b8c8 | free_event_entry: release EVENT_SA_REPLACE-pe@0x5650ce306f48 | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VT | popen cmd is 1063 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-s: | cmd( 80):ubnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2: | cmd( 160):.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192: | cmd( 240):.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOC: | cmd( 320):OL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_: | cmd( 400):PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2: | cmd( 480):.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PRO: | cmd( 560):TOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO: | cmd( 640):_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+E: | cmd( 720):SN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=: | cmd( 800):0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO: | cmd( 880):_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0: | cmd( 960):' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x587c7ea5 SPI_OUT=0x687d: | cmd(1040):269a ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-subnets/1x2' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe3e1 | IPsec Sa SPD priority set to 1041377 | delete esp.587c7ea5@192.1.2.23 | netlink response for Del SA esp.587c7ea5@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe3e1 | delete inbound eroute 192.0.2.64/30:0 --0-> 192.0.1.0/28:0 => unk255.10000@192.1.2.45 (raw_eroute) | raw_eroute result=success | delete esp.687d269a@192.1.2.45 | netlink response for Del SA esp.687d269a@192.1.2.45 included non-error error | stop processing: connection "westnet-eastnet-subnets/1x2" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/1x2 | State DB: deleting IKEv1 state #3 in QUICK_I2 | child state #3: QUICK_I2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #3 from 192.1.2.23 (in delete_state() at state.c:1143) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | state #2 | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #2 | state #1 | processing: STOP connection NULL (in terminate_a_connection() at terminate.c:87) | start processing: connection "westnet-eastnet-subnets/1x1" (in terminate_a_connection() at terminate.c:69) "westnet-eastnet-subnets/1x1": terminating SAs using this connection | connection 'westnet-eastnet-subnets/1x1' -POLICY_UP | connection not shared - terminating IKE and IPsec SA | Deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #2 | suspend processing: connection "westnet-eastnet-subnets/1x1" (in foreach_state_by_connection_func_delete() at state.c:1310) | start processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #2 ikev1.ipsec deleted completed | [RE]START processing: state #2 connection "westnet-eastnet-subnets/1x1" from 192.1.2.23 (in delete_state() at state.c:879) "westnet-eastnet-subnets/1x1" #2: deleting state (STATE_QUICK_I2) aged 0.393s and sending notification | child state #2: QUICK_I2(established CHILD SA) => delete | get_sa_info esp.2974b46f@192.1.2.23 | get_sa_info esp.9210c7f8@192.1.2.45 "westnet-eastnet-subnets/1x1" #2: ESP traffic information: in=0B out=0B | #2 send IKEv1 delete notification for STATE_QUICK_I2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2008388981 (0x77b59575) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload 92 10 c7 f8 | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | a7 dd ca af b0 09 61 59 91 8e 39 02 dc 8f cb 8f | a3 8c 96 22 1d b7 ea c1 41 90 e0 5e c6 a1 e0 5e | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 77 b5 95 75 00 00 00 5c e8 e7 fc 96 | 3a 06 aa 00 97 cd 7f de 5b 4a 0d a5 9b f3 9d d6 | c9 28 13 71 37 fc 97 2f 51 cf 47 3a 8a b1 b4 81 | c9 e0 5e 21 b0 43 74 9b 4b bc 00 d3 e0 65 29 62 | a8 51 d3 2b 79 88 e3 7d a5 55 47 0a | state #2 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x5650ce302888 | free_event_entry: release EVENT_SA_REPLACE-pe@0x7f11f4002b78 | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VT | popen cmd is 1063 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-s: | cmd( 80):ubnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2: | cmd( 160):.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192: | cmd( 240):.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOC: | cmd( 320):OL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_: | cmd( 400):PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2: | cmd( 480):.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PRO: | cmd( 560):TOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844601' PLUTO: | cmd( 640):_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+E: | cmd( 720):SN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=: | cmd( 800):0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO: | cmd( 880):_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0: | cmd( 960):' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x2974b46f SPI_OUT=0x9210: | cmd(1040):c7f8 ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-subnets/1x1' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | IPsec Sa SPD priority set to 1041379 | delete esp.2974b46f@192.1.2.23 | netlink response for Del SA esp.2974b46f@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | delete inbound eroute 192.0.2.16/28:0 --0-> 192.0.1.0/28:0 => unk255.10000@192.1.2.45 (raw_eroute) | raw_eroute result=success | delete esp.9210c7f8@192.1.2.45 | netlink response for Del SA esp.9210c7f8@192.1.2.45 included non-error error | stop processing: connection "westnet-eastnet-subnets/1x1" (BACKGROUND) (in update_state_connection() at connections.c:4076) | start processing: connection NULL (in update_state_connection() at connections.c:4077) | in connection_discard for connection westnet-eastnet-subnets/1x1 | State DB: deleting IKEv1 state #2 in QUICK_I2 | child state #2: QUICK_I2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #2 from 192.1.2.23 (in delete_state() at state.c:1143) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #1 | processing: STOP connection NULL (in terminate_a_connection() at terminate.c:87) terminated 4 connections from aliased connection "westnet-eastnet-subnets" | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 4.93 milliseconds in whack | spent 0.00329 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 8f 40 4c 44 00 00 00 5c 53 42 3f 4c | d9 cd ed 67 04 37 eb ee 15 b8 53 47 19 d3 ba f9 | 19 93 ac 4f 89 ea cf 37 da 46 8f 32 26 0e dc eb | 49 15 26 d6 2f a8 9a cd fb 0a 1d ba e3 ab bb cd | 22 11 4e d5 de 21 eb 48 dc 38 62 49 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2403355716 (0x8f404c44) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | ec 02 94 6a a7 33 e4 71 7d 26 00 4e 75 20 d3 1b | 39 e5 ad d4 d4 5a 98 a5 9e a2 1b 01 c2 45 de 1e | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI b8 90 e0 ea | FOR_EACH_STATE_... in find_phase2_state_to_delete "westnet-eastnet-subnets/2x2" #1: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xb890e0ea) not found (maybe expired) | del: | complete v1 state transition with STF_IGNORE | #1 spent 0.00507 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.217 milliseconds in comm_handle_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00405 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00289 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.0026 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00275 milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00157 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 a5 c0 d0 d7 00 00 00 5c 91 e8 ee 24 | 70 54 04 fd 6c f6 78 54 ff 8f f2 84 40 5f 4a c4 | 66 f8 a3 06 c0 d5 b4 2f 65 27 8c 27 4e 8e 7e 05 | 14 6c c3 8e 07 a7 25 db 2d 63 d7 1f 1a 5d 88 65 | 19 3b 71 05 a3 48 93 13 53 2d 07 f0 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2780877015 (0xa5c0d0d7) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | 51 0d e8 15 2c 17 e2 10 85 94 b0 4d f2 64 4b 00 | e6 ed cd 78 4d 53 71 35 87 99 be 0d 68 cc 91 4d | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI fd 13 a8 b3 | FOR_EACH_STATE_... in find_phase2_state_to_delete "westnet-eastnet-subnets/2x2" #1: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0xfd13a8b3) not found (maybe expired) | del: | complete v1 state transition with STF_IGNORE | #1 spent 0.00274 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.146 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00143 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 ca 15 1b 52 00 00 00 5c d0 96 f0 9e | 6a 17 17 a5 73 1a 4b c3 9d 47 a3 3a c2 d4 87 f1 | 23 78 9d 14 9b 74 0b 13 01 fa 91 aa 74 00 cd 52 | 9b 28 8c 83 c1 00 de 89 01 d5 91 0d 83 01 8d 42 | ff 42 a0 76 d1 d0 7a 9d ec f7 ea b3 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3390380882 (0xca151b52) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | cc 53 eb 21 9c 07 77 56 d5 89 33 2b 33 6b b3 bc | fb b8 a8 71 c7 42 68 9f 74 54 7f 8f 24 93 85 b7 | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI 58 7c 7e a5 | FOR_EACH_STATE_... in find_phase2_state_to_delete "westnet-eastnet-subnets/2x2" #1: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0x587c7ea5) not found (maybe expired) | del: | complete v1 state transition with STF_IGNORE | #1 spent 0.00292 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.144 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00136 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 2f 56 4c 0c 00 00 00 5c a6 00 bd 92 | 79 39 dd a8 47 ee be d1 6b e5 41 be f0 d4 2e ef | 28 88 88 9c 07 79 e8 ea 89 61 37 87 11 fa 95 e2 | 7c c4 dc 8f b7 d4 b4 da c8 4c d4 97 3c c7 57 f5 | 4b e6 29 bc c3 11 fa 1a 4f 2c 69 b5 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 794184716 (0x2f564c0c) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | 87 6b fe 24 58 9c bc 76 de a5 e9 cc fb 32 5d 53 | aa 70 88 c4 81 40 03 3d 7e 72 93 33 72 da 75 1d | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI 29 74 b4 6f | FOR_EACH_STATE_... in find_phase2_state_to_delete "westnet-eastnet-subnets/2x2" #1: ignoring Delete SA payload: PROTO_IPSEC_ESP SA(0x2974b46f) not found (maybe expired) | del: | complete v1 state transition with STF_IGNORE | #1 spent 0.00286 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.142 milliseconds in comm_handle_cb() reading and processing packet | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_STATE_... in show_states_status (sort_states) | FOR_EACH_STATE_... in sort_states | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.537 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_STATE_... in show_states_status (sort_states) | FOR_EACH_STATE_... in sort_states | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.509 milliseconds in whack | spent 0.00257 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 91 f3 d0 ce 00 00 00 5c 4e 1c 75 8b | 72 9c 48 3d b6 fd 69 8a 90 4f be 02 e5 eb 71 27 | 5b 75 d7 30 40 3c a8 3e f2 2c c2 95 8c 7e d7 74 | 4f 8a 51 b3 e4 d8 80 de 1d 99 ef 8d bb d2 ae 4c | e0 df 00 ff 29 b8 96 51 41 83 a4 26 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2448675022 (0x91f3d0ce) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 28 (0x1c) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 1 (0x1) | SPI size: 16 (0x10) | number of SPIs: 1 (0x1) | informational HASH(1): | bc 6f ba 24 e4 60 8a 12 ba 37 01 97 26 21 a5 90 | 83 db b5 5f 84 f4 19 2d a3 c8 c6 0a 03 39 5e d9 | received 'informational' message HASH(1) data ok | parsing 8 raw bytes of ISAKMP Delete Payload into iCookie | iCookie c1 22 4f 37 94 92 35 7c | parsing 8 raw bytes of ISAKMP Delete Payload into rCookie | rCookie 67 7f 04 7b d5 9e 0e 70 | State DB: found IKEv1 state #1 in MAIN_I4 (find_state_ikev1) | del: "westnet-eastnet-subnets/2x2" #1: received Delete SA payload: self-deleting ISAKMP State #1 | pstats #1 ikev1.isakmp deleted completed | [RE]START processing: state #1 connection "westnet-eastnet-subnets/2x2" from 192.1.2.23 (in delete_state() at state.c:879) "westnet-eastnet-subnets/2x2" #1: deleting state (STATE_MAIN_I4) aged 1.875s and sending notification | parent state #1: MAIN_I4(established IKE SA) => delete | #1 send IKEv1 delete notification for STATE_MAIN_I4 | **emit ISAKMP Message: | initiator cookie: | c1 22 4f 37 94 92 35 7c | responder cookie: | 67 7f 04 7b d5 9e 0e 70 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2698009842 (0xa0d05cf2) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 1 (0x1) | SPI size: 16 (0x10) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 8 raw bytes of initiator SPI into ISAKMP Delete Payload | initiator SPI c1 22 4f 37 94 92 35 7c | emitting 8 raw bytes of responder SPI into ISAKMP Delete Payload | responder SPI 67 7f 04 7b d5 9e 0e 70 | emitting length of ISAKMP Delete Payload: 28 | send delete HASH(1): | db 73 f3 a1 da f6 9c ae 15 4c 41 fd f5 85 f3 68 | 87 18 59 b7 a8 52 ee 41 0d 8d bd c5 d1 6b 3a 0c | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | c1 22 4f 37 94 92 35 7c 67 7f 04 7b d5 9e 0e 70 | 08 10 05 01 a0 d0 5c f2 00 00 00 5c ea 22 1e a5 | 62 3b f5 03 e3 b1 b8 c1 bf 00 63 f7 03 88 c2 9e | e6 ed 61 9e 9d c7 c8 8d 8a b1 bb 20 63 90 49 50 | 42 9f 83 69 ef 4a d8 4f 5b 51 d6 54 50 0b 48 61 | 17 74 56 0d 91 dc 7c d5 fe 14 cb 94 | state #1 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x7f11ec000f48 | free_event_entry: release EVENT_SA_REPLACE-pe@0x5650ce301f58 | State DB: IKEv1 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-subnets/2x2 | State DB: deleting IKEv1 state #1 in MAIN_I4 | parent state #1: MAIN_I4(established IKE SA) => UNDEFINED(ignore) | unreference key: 0x5650ce3021e8 @east cnt 2-- | stop processing: state #1 from 192.1.2.23 (in delete_state() at state.c:1143) | in statetime_start() with no state | complete v1 state transition with STF_IGNORE | stop processing: from 192.1.2.23:500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.363 milliseconds in comm_handle_cb() reading and processing packet | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) shutting down | processing: RESET whack log_fd (was fd@16) (in exit_pluto() at plutomain.c:1825) | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' | unreference key: 0x5650ce3021e8 @east cnt 1-- | unreference key: 0x5650ce25ac48 @west cnt 1-- | start processing: connection "westnet-eastnet-subnets/2x2" (in delete_connection() at connections.c:189) | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-subnets/2x2' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe3e1 | priority calculation of connection "westnet-eastnet-subnets/2x2" is 0xfe3e1 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x2" unrouted: "westnet-eastnet-subnets/1x2" prospective erouted | flush revival: connection 'westnet-eastnet-subnets/2x2' wasn't on the list | stop processing: connection "westnet-eastnet-subnets/2x2" (in discard_connection() at connections.c:249) | start processing: connection "westnet-eastnet-subnets/2x1" (in delete_connection() at connections.c:189) | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-subnets/2x1' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | priority calculation of connection "westnet-eastnet-subnets/2x1" is 0xfe3e3 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/2x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/2x1" unrouted: "westnet-eastnet-subnets/1x1" prospective erouted | flush revival: connection 'westnet-eastnet-subnets/2x1' wasn't on the list | stop processing: connection "westnet-eastnet-subnets/2x1" (in discard_connection() at connections.c:249) | start processing: connection "westnet-eastnet-subnets/1x2" (in delete_connection() at connections.c:189) | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-subnets/1x2' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe3e1 | priority calculation of connection "westnet-eastnet-subnets/1x2" is 0xfe3e1 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 | conn westnet-eastnet-subnets/1x2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x2" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_ | popen cmd is 1044 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-subnets/1x2' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.: | cmd( 160):1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET=': | cmd( 240):192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PRO: | cmd( 320):TOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PL: | cmd( 400):UTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.64/30' PLUTO_PEER_CLIENT_NET='192: | cmd( 480):.0.2.64' PLUTO_PEER_CLIENT_MASK='255.255.255.252' PLUTO_PEER_PORT='0' PLUTO_PEER: | cmd( 560):_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN: | cmd( 640):_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO: | cmd( 720):' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLU: | cmd( 800):TO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER: | cmd( 880):_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI: | cmd( 960):_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown : | cmd(1040):2>&1: "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x2": unroute-client output: Error: Peer netns reference is invalid. | flush revival: connection 'westnet-eastnet-subnets/1x2' wasn't on the list | stop processing: connection "westnet-eastnet-subnets/1x2" (in discard_connection() at connections.c:249) | start processing: connection "westnet-eastnet-subnets/1x1" (in delete_connection() at connections.c:189) | Deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-subnets/1x1' to 'delete' for rt_kind 'unrouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | priority calculation of connection "westnet-eastnet-subnets/1x1" is 0xfe3e3 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-subnets/1x1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-subnets/1x1" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_ | popen cmd is 1044 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-subnets/1x1' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.: | cmd( 160):1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/28' PLUTO_MY_CLIENT_NET=': | cmd( 240):192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.240' PLUTO_MY_PORT='0' PLUTO_MY_PRO: | cmd( 320):TOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PL: | cmd( 400):UTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.16/28' PLUTO_PEER_CLIENT_NET='192: | cmd( 480):.0.2.16' PLUTO_PEER_CLIENT_MASK='255.255.255.240' PLUTO_PEER_PORT='0' PLUTO_PEER: | cmd( 560):_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN: | cmd( 640):_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO: | cmd( 720):' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLU: | cmd( 800):TO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER: | cmd( 880):_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI: | cmd( 960):_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown : | cmd(1040):2>&1: "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. "westnet-eastnet-subnets/1x1": unroute-client output: Error: Peer netns reference is invalid. | free hp@0x5650ce301e78 | flush revival: connection 'westnet-eastnet-subnets/1x1' wasn't on the list | stop processing: connection "westnet-eastnet-subnets/1x1" (in discard_connection() at connections.c:249) | crl fetch request list locked by 'free_crl_fetch' | crl fetch request list unlocked by 'free_crl_fetch' shutting down interface lo/lo 127.0.0.1:4500 shutting down interface lo/lo 127.0.0.1:500 shutting down interface eth0/eth0 192.0.1.254:4500 shutting down interface eth0/eth0 192.0.1.254:500 shutting down interface eth1/eth1 192.1.2.45:4500 shutting down interface eth1/eth1 192.1.2.45:500 | FOR_EACH_STATE_... in delete_states_dead_interfaces | libevent_free: release ptr-libevent@0x5650ce2f4ec8 | free_event_entry: release EVENT_NULL-pe@0x5650ce3009c8 | libevent_free: release ptr-libevent@0x5650ce28ab38 | free_event_entry: release EVENT_NULL-pe@0x5650ce300a78 | libevent_free: release ptr-libevent@0x5650ce28aa88 | free_event_entry: release EVENT_NULL-pe@0x5650ce300b28 | libevent_free: release ptr-libevent@0x5650ce28b4a8 | free_event_entry: release EVENT_NULL-pe@0x5650ce300bd8 | libevent_free: release ptr-libevent@0x5650ce25f4e8 | free_event_entry: release EVENT_NULL-pe@0x5650ce300c88 | libevent_free: release ptr-libevent@0x5650ce25f1d8 | free_event_entry: release EVENT_NULL-pe@0x5650ce300d38 | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | libevent_free: release ptr-libevent@0x5650ce2f4f78 | free_event_entry: release EVENT_NULL-pe@0x5650ce2e8d68 | libevent_free: release ptr-libevent@0x5650ce289188 | free_event_entry: release EVENT_NULL-pe@0x5650ce2e8cf8 | libevent_free: release ptr-libevent@0x5650ce2cc568 | free_event_entry: release EVENT_NULL-pe@0x5650ce2e81b8 | global timer EVENT_REINIT_SECRET uninitialized | global timer EVENT_SHUNT_SCAN uninitialized | global timer EVENT_PENDING_DDNS uninitialized | global timer EVENT_PENDING_PHASE2 uninitialized | global timer EVENT_CHECK_CRLS uninitialized | global timer EVENT_REVIVE_CONNS uninitialized | global timer EVENT_FREE_ROOT_CERTS uninitialized | global timer EVENT_RESET_LOG_RATE_LIMIT uninitialized | global timer EVENT_NAT_T_KEEPALIVE uninitialized | libevent_free: release ptr-libevent@0x5650ce293778 | signal event handler PLUTO_SIGCHLD uninstalled | libevent_free: release ptr-libevent@0x5650ce28b578 | signal event handler PLUTO_SIGTERM uninstalled | libevent_free: release ptr-libevent@0x5650ce300388 | signal event handler PLUTO_SIGHUP uninstalled | libevent_free: release ptr-libevent@0x5650ce3005c8 | signal event handler PLUTO_SIGSYS uninstalled | releasing event base | libevent_free: release ptr-libevent@0x5650ce300498 | libevent_free: release ptr-libevent@0x5650ce2e3638 | libevent_free: release ptr-libevent@0x5650ce2e35e8 | libevent_free: release ptr-libevent@0x7f11f0003e78 | libevent_free: release ptr-libevent@0x5650ce2e3538 | libevent_free: release ptr-libevent@0x5650ce300248 | libevent_free: release ptr-libevent@0x5650ce3002c8 | libevent_free: release ptr-libevent@0x5650ce2e37e8 | libevent_free: release ptr-libevent@0x5650ce2e82c8 | libevent_free: release ptr-libevent@0x5650ce2e8cb8 | libevent_free: release ptr-libevent@0x5650ce300da8 | libevent_free: release ptr-libevent@0x5650ce300cf8 | libevent_free: release ptr-libevent@0x5650ce300c48 | libevent_free: release ptr-libevent@0x5650ce300b98 | libevent_free: release ptr-libevent@0x5650ce300ae8 | libevent_free: release ptr-libevent@0x5650ce300a38 | libevent_free: release ptr-libevent@0x5650ce288788 | libevent_free: release ptr-libevent@0x5650ce300348 | libevent_free: release ptr-libevent@0x5650ce300308 | libevent_free: release ptr-libevent@0x5650ce300288 | libevent_free: release ptr-libevent@0x5650ce300458 | libevent_free: release ptr-libevent@0x5650ce287918 | libevent_free: release ptr-libevent@0x5650ce25e908 | libevent_free: release ptr-libevent@0x5650ce25ed38 | libevent_free: release ptr-libevent@0x5650ce287c88 | releasing global libevent data | libevent_free: release ptr-libevent@0x5650ce289128 | libevent_free: release ptr-libevent@0x5650ce25ecd8 | libevent_free: release ptr-libevent@0x5650ce25edd8 leak detective found no leaks