FIPS Product: YES FIPS Kernel: NO FIPS Mode: NO NSS DB directory: sql:/etc/ipsec.d Initializing NSS Opening NSS database "sql:/etc/ipsec.d" read-only NSS initialized NSS crypto library initialized FIPS HMAC integrity support [enabled] FIPS mode disabled for pluto daemon FIPS HMAC integrity verification self-test FAILED libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v3.28-685-gbfd5aef521-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:16085 core dump dir: /tmp secrets file: /etc/ipsec.secrets leak-detective enabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: new ptr-libevent@0x563f070c5738 size 40 | libevent_malloc: new ptr-libevent@0x563f070c56b8 size 40 | libevent_malloc: new ptr-libevent@0x563f070c5638 size 40 | creating event base | libevent_malloc: new ptr-libevent@0x563f070b7268 size 56 | libevent_malloc: new ptr-libevent@0x563f07040df8 size 664 | libevent_malloc: new ptr-libevent@0x563f070ffd18 size 24 | libevent_malloc: new ptr-libevent@0x563f070ffd68 size 384 | libevent_malloc: new ptr-libevent@0x563f070ffcd8 size 16 | libevent_malloc: new ptr-libevent@0x563f070c55b8 size 40 | libevent_malloc: new ptr-libevent@0x563f070c5538 size 48 | libevent_realloc: new ptr-libevent@0x563f07040a88 size 256 | libevent_malloc: new ptr-libevent@0x563f070fff18 size 16 | libevent_free: release ptr-libevent@0x563f070b7268 | libevent initialized | libevent_realloc: new ptr-libevent@0x563f070b7268 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm, aes_ccm_c AES_CCM_12 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_b AES_CCM_8 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_a 3DES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS [*192] 3des CAMELLIA_CTR IKEv1: ESP IKEv2: ESP {256,192,*128} CAMELLIA_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} camellia AES_GCM_16 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm, aes_gcm_c AES_GCM_12 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_b AES_GCM_8 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_a AES_CTR IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aesctr AES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aes SERPENT_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} serpent TWOFISH_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} twofish TWOFISH_SSH IKEv1: IKE IKEv2: IKE ESP {256,192,*128} twofish_cbc_ssh NULL_AUTH_AES_GMAC IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_gmac NULL IKEv1: ESP IKEv2: ESP [] CHACHA20_POLY1305 IKEv1: IKEv2: IKE ESP [*256] chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: SHA1 IKEv1: IKE IKEv2: FIPS sha SHA2_256 IKEv1: IKE IKEv2: FIPS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: FIPS sha384 SHA2_512 IKEv1: IKE IKEv2: FIPS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 crypto helpers started thread for crypto helper 0 | starting up helper thread 0 | status value returned by setting the priority of this thread (crypto helper 0) 22 | crypto helper 0 waiting (nothing to do) started thread for crypto helper 1 started thread for crypto helper 2 started thread for crypto helper 3 started thread for crypto helper 4 | starting up helper thread 2 | status value returned by setting the priority of this thread (crypto helper 2) 22 | crypto helper 2 waiting (nothing to do) started thread for crypto helper 5 started thread for crypto helper 6 | checking IKEv1 state table | starting up helper thread 1 | MAIN_R0: category: half-open IKE SA flags: 0: | starting up helper thread 5 | starting up helper thread 3 | -> MAIN_R1 EVENT_SO_DISCARD | status value returned by setting the priority of this thread (crypto helper 1) 22 | MAIN_I1: category: half-open IKE SA flags: 0: | status value returned by setting the priority of this thread (crypto helper 5) 22 | -> MAIN_I2 EVENT_RETRANSMIT | crypto helper 1 waiting (nothing to do) | status value returned by setting the priority of this thread (crypto helper 3) 22 | crypto helper 3 waiting (nothing to do) | MAIN_R1: category: open IKE SA flags: 200: | -> MAIN_R2 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_I2: category: open IKE SA flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_R2: category: open IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | -> MAIN_R3 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_I3: category: open IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | -> MAIN_I4 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_R3: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | MAIN_I4: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | AGGR_R0: category: half-open IKE SA flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD | AGGR_I1: category: half-open IKE SA flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE | -> AGGR_I2 EVENT_SA_REPLACE | AGGR_R1: category: open IKE SA flags: 200: | -> AGGR_R2 EVENT_SA_REPLACE | -> AGGR_R2 EVENT_SA_REPLACE | AGGR_I2: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | AGGR_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | QUICK_R0: category: established CHILD SA flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT | QUICK_I1: category: established CHILD SA flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE | QUICK_R1: category: established CHILD SA flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE | QUICK_I2: category: established CHILD SA flags: 200: | -> UNDEFINED EVENT_NULL | QUICK_R2: category: established CHILD SA flags: 0: | -> UNDEFINED EVENT_NULL | INFO: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | INFO_PROTECTED: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | XAUTH_R0: category: established IKE SA flags: 0: | -> XAUTH_R1 EVENT_NULL | XAUTH_R1: category: established IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | MODE_CFG_R0: category: informational flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE | MODE_CFG_R1: category: established IKE SA flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE | MODE_CFG_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | MODE_CFG_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | XAUTH_I0: category: established IKE SA flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT | XAUTH_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT | checking IKEv2 state table | PARENT_I0: category: ignore flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA flags: 0: | -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH) | PARENT_I2: category: open IKE SA flags: 0: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_I3: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_RETAIN (I3: Informational Request) | -> PARENT_I3 EVENT_RETAIN (I3: Informational Response) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response) | PARENT_R0: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED)) | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request) | PARENT_R2: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request) | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response) | V2_CREATE_I0: category: established IKE SA flags: 0: | -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | V2_CREATE_I: category: established IKE SA flags: 0: | -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_IKE_I0: category: established IKE SA flags: 0: | -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_REKEY_CHILD_I0: category: established IKE SA flags: 0: | -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_REKEY_CHILD_I: category: established IKE SA flags: 0: | V2_CREATE_R: category: established IKE SA flags: 0: | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request) | V2_REKEY_IKE_R: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_R: category: established IKE SA flags: 0: | V2_IPSEC_I: category: established CHILD SA flags: 0: | V2_IPSEC_R: category: established CHILD SA flags: 0: | IKESA_DEL: category: established IKE SA flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational flags: 0: Using Linux XFRM/NETKEY IPsec interface code on 5.1.18-200.fc29.x86_64 | starting up helper thread 4 | status value returned by setting the priority of this thread (crypto helper 4) 22 | crypto helper 4 waiting (nothing to do) | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding SERPENT_CBC to kernel algorithm db | adding TWOFISH_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x563f070bf458 | libevent_malloc: new ptr-libevent@0x563f070fe488 size 128 | libevent_malloc: new ptr-libevent@0x563f07105568 size 16 | add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x563f071054f8 | libevent_malloc: new ptr-libevent@0x563f070b7e78 size 128 | libevent_malloc: new ptr-libevent@0x563f071051c8 size 16 | global one-shot timer EVENT_CHECK_CRLS initialized selinux support is enabled. | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | starting up helper thread 6 | status value returned by setting the priority of this thread (crypto helper 6) 22 | crypto helper 6 waiting (nothing to do) | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | Loading dnssec root key from:/var/lib/unbound/root.key | No additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x563f07105998 | libevent_malloc: new ptr-libevent@0x563f07111878 size 128 | libevent_malloc: new ptr-libevent@0x563f0711cb68 size 16 | libevent_realloc: new ptr-libevent@0x563f0711cba8 size 256 | libevent_malloc: new ptr-libevent@0x563f0711ccd8 size 8 | libevent_realloc: new ptr-libevent@0x563f0711cd18 size 144 | libevent_malloc: new ptr-libevent@0x563f070c3a28 size 152 | libevent_malloc: new ptr-libevent@0x563f0711cdd8 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: new ptr-libevent@0x563f0711ce18 size 8 | libevent_malloc: new ptr-libevent@0x563f07041768 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: new ptr-libevent@0x563f0711ce58 size 8 | libevent_malloc: new ptr-libevent@0x563f0711ce98 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: new ptr-libevent@0x563f0711cf68 size 8 | libevent_realloc: release ptr-libevent@0x563f0711cd18 | libevent_realloc: new ptr-libevent@0x563f0711cfa8 size 256 | libevent_malloc: new ptr-libevent@0x563f0711d0d8 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:16211) using fork+execve | forked child 16211 | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.1.3.209 Kernel supports NIC esp-hw-offload adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.1.3.209:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth0/eth0 192.1.3.209:4500 adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface lo/lo 127.0.0.1:4500 | no interfaces to sort | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | add_fd_read_event_handler: new ethX-pe@0x563f0711d4d8 | libevent_malloc: new ptr-libevent@0x563f071117c8 size 128 | libevent_malloc: new ptr-libevent@0x563f0711d548 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 20 | add_fd_read_event_handler: new ethX-pe@0x563f0711d588 | libevent_malloc: new ptr-libevent@0x563f070b7f28 size 128 | libevent_malloc: new ptr-libevent@0x563f0711d5f8 size 16 | setup callback for interface lo 127.0.0.1:500 fd 19 | add_fd_read_event_handler: new ethX-pe@0x563f0711d638 | libevent_malloc: new ptr-libevent@0x563f070b7848 size 128 | libevent_malloc: new ptr-libevent@0x563f0711d6a8 size 16 | setup callback for interface eth0 192.1.3.209:4500 fd 18 | add_fd_read_event_handler: new ethX-pe@0x563f0711d6e8 | libevent_malloc: new ptr-libevent@0x563f070bf1a8 size 128 | libevent_malloc: new ptr-libevent@0x563f0711d758 size 16 | setup callback for interface eth0 192.1.3.209:500 fd 17 | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | computed rsa CKAID 1a 15 cc e8 92 73 43 9c 2b f4 20 2a c1 06 6e f2 | computed rsa CKAID 59 b0 ef 45 loaded private key for keyid: PKK_RSA:AQPHFfpyJ | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.03 milliseconds in whack | crypto helper 5 waiting (nothing to do) | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.1.3.209 | no interfaces to sort | libevent_free: release ptr-libevent@0x563f071117c8 | free_event_entry: release EVENT_NULL-pe@0x563f0711d4d8 | add_fd_read_event_handler: new ethX-pe@0x563f0711d4d8 | libevent_malloc: new ptr-libevent@0x563f071117c8 size 128 | setup callback for interface lo 127.0.0.1:4500 fd 20 | libevent_free: release ptr-libevent@0x563f070b7f28 | free_event_entry: release EVENT_NULL-pe@0x563f0711d588 | add_fd_read_event_handler: new ethX-pe@0x563f0711d588 | libevent_malloc: new ptr-libevent@0x563f070b7f28 size 128 | setup callback for interface lo 127.0.0.1:500 fd 19 | libevent_free: release ptr-libevent@0x563f070b7848 | free_event_entry: release EVENT_NULL-pe@0x563f0711d638 | add_fd_read_event_handler: new ethX-pe@0x563f0711d638 | libevent_malloc: new ptr-libevent@0x563f070b7848 size 128 | setup callback for interface eth0 192.1.3.209:4500 fd 18 | libevent_free: release ptr-libevent@0x563f070bf1a8 | free_event_entry: release EVENT_NULL-pe@0x563f0711d6e8 | add_fd_read_event_handler: new ethX-pe@0x563f0711d6e8 | libevent_malloc: new ptr-libevent@0x563f070bf1a8 size 128 | setup callback for interface eth0 192.1.3.209:500 fd 17 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | computed rsa CKAID 1a 15 cc e8 92 73 43 9c 2b f4 20 2a c1 06 6e f2 | computed rsa CKAID 59 b0 ef 45 loaded private key for keyid: PKK_RSA:AQPHFfpyJ | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.424 milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 16211 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0241 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection road-east with policy ENCRYPT+TUNNEL+PFS+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | setting ID to ID_DER_ASN1_DN: 'E=user-road@testing.libreswan.org,CN=road.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA' | loading left certificate 'road' pubkey | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x563f0711ebf8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x563f0711eb88 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x563f0711ea48 | unreference key: 0x563f0711ec48 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org cnt 1-- | certs and keys locked by 'lsw_add_rsa_secret' | certs and keys unlocked by 'lsw_add_rsa_secret' | counting wild cards for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org is 0 | counting wild cards for %fromcert is 0 | connect_to_host_pair: 192.1.3.209:500 192.1.2.23:500 -> hp@(nil): none | new hp@0x563f07123eb8 added connection description "road-east" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.1.3.209[C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org,+MC+XC+S=C]---192.1.3.254...192.1.2.23<192.1.2.23>[%fromcert,MS+XS+S=C]===192.0.2.0/24 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.41 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | dup_any(fd@16) -> fd@21 (in whack_process() at rcv_whack.c:590) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "road-east" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'road-east' +POLICY_UP | dup_any(fd@21) -> fd@22 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | creating state object #1 at 0x563f071242d8 | State DB: adding IKEv1 state #1 in UNDEFINED | pstats #1 ikev1.isakmp started | suspend processing: connection "road-east" (in main_outI1() at ikev1_main.c:118) | start processing: state #1 connection "road-east" from 192.1.2.23 (in main_outI1() at ikev1_main.c:118) | parent state #1: UNDEFINED(ignore) => MAIN_I1(half-open IKE SA) | dup_any(fd@22) -> fd@23 (in main_outI1() at ikev1_main.c:123) | Queuing pending IPsec SA negotiating with 192.1.2.23 "road-east" IKE SA #1 "road-east" "road-east" #1: initiating Main Mode | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 1:ISAKMP_NEXT_SA | no specific IKE algorithms specified - using defaults | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() returning 0x563f07126688 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 18 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 18 (0x12) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 1 (0x1) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 2 (0x2) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 3 (0x3) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 4 (0x4) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 5 (0x5) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 6 (0x6) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 7 (0x7) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 8 (0x8) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 9 (0x9) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 10 (0xa) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 11 (0xb) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 12 (0xc) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 13 (0xd) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 14 (0xe) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 15 (0xf) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 16 (0x10) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP transform number: 17 (0x11) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | emitting length of ISAKMP Proposal Payload: 632 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 644 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | out_vid(): sending [FRAGMENTATION] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [XAUTH] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 8 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 09 00 26 89 df d6 b7 12 | emitting length of ISAKMP Vendor ID Payload: 12 | out_vid(): sending [Dead Peer Detection] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 | emitting length of ISAKMP Vendor ID Payload: 20 | nat add vid | sending draft and RFC NATT VIDs | out_vid(): sending [RFC 3947] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | emitting length of ISAKMP Vendor ID Payload: 20 | skipping VID_NATT_RFC | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-03] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02_n] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 | emitting length of ISAKMP Vendor ID Payload: 20 | no IKEv1 message padding required | emitting length of ISAKMP Message: 804 | sending 804 bytes for reply packet for main_outI1 through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #1) | 73 37 a3 72 2c 29 3b a5 00 00 00 00 00 00 00 00 | 01 10 02 00 00 00 00 00 00 00 03 24 0d 00 02 84 | 00 00 00 01 00 00 00 01 00 00 02 78 00 01 00 12 | 03 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 fd ed 80 04 00 0e | 80 0e 01 00 03 00 00 24 01 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 04 80 03 fd ed | 80 04 00 0e 80 0e 00 80 03 00 00 24 02 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 06 | 80 03 fd ed 80 04 00 0e 80 0e 01 00 03 00 00 24 | 03 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 06 80 03 fd ed 80 04 00 0e 80 0e 00 80 | 03 00 00 24 04 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 02 80 03 fd ed 80 04 00 0e | 80 0e 01 00 03 00 00 24 05 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 02 80 03 fd ed | 80 04 00 0e 80 0e 00 80 03 00 00 24 06 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 04 | 80 03 fd ed 80 04 00 05 80 0e 01 00 03 00 00 24 | 07 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 04 80 03 fd ed 80 04 00 05 80 0e 00 80 | 03 00 00 24 08 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 06 80 03 fd ed 80 04 00 05 | 80 0e 01 00 03 00 00 24 09 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 06 80 03 fd ed | 80 04 00 05 80 0e 00 80 03 00 00 24 0a 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 02 | 80 03 fd ed 80 04 00 05 80 0e 01 00 03 00 00 24 | 0b 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 02 80 03 fd ed 80 04 00 05 80 0e 00 80 | 03 00 00 20 0c 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 fd ed 80 04 00 0e | 03 00 00 20 0d 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 fd ed 80 04 00 0e | 03 00 00 20 0e 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 fd ed 80 04 00 0e | 03 00 00 20 0f 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 fd ed 80 04 00 05 | 03 00 00 20 10 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 fd ed 80 04 00 05 | 00 00 00 20 11 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 fd ed 80 04 00 05 | 0d 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 de 7f | 00 d6 c2 d3 0d 00 00 0c 09 00 26 89 df d6 b7 12 | 0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc | 77 57 01 00 0d 00 00 14 4a 13 1c 81 07 03 58 45 | 5c 57 28 f2 0e 95 45 2f 0d 00 00 14 7d 94 19 a6 | 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14 | 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | 00 00 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc | 68 b6 a4 48 | event_schedule: new EVENT_RETRANSMIT-pe@0x563f071271e8 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x563f0711e5d8 size 128 | #1 STATE_MAIN_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29856.832113 | #1 spent 1.97 milliseconds in main_outI1() | stop processing: state #1 connection "road-east" from 192.1.2.23 (in main_outI1() at ikev1_main.c:228) | resume processing: connection "road-east" (in main_outI1() at ikev1_main.c:228) | stop processing: connection "road-east" (in initiate_a_connection() at initiate.c:349) | close_any(fd@21) (in initiate_connection() at initiate.c:372) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 2.25 milliseconds in whack | spent 0.00264 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 156 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 01 10 02 00 00 00 00 00 00 00 00 9c 0d 00 00 38 | 00 00 00 01 00 00 00 01 00 00 00 2c 00 01 00 01 | 00 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 fd ed 80 04 00 0e | 80 0e 01 00 0d 00 00 14 40 48 b7 d5 6e bc e8 85 | 25 e7 de 7f 00 d6 c2 d3 0d 00 00 0c 09 00 26 89 | df d6 b7 12 0d 00 00 14 af ca d7 13 68 a1 f1 c9 | 6b 86 96 fc 77 57 01 00 00 00 00 14 4a 13 1c 81 | 07 03 58 45 5c 57 28 f2 0e 95 45 2f | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 156 (0x9c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: IKEv1 state not found (find_state_ikev1) | State DB: found IKEv1 state #1 in MAIN_I1 (find_state_ikev1_init) | start processing: state #1 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1459) | #1 is idle | #1 idle | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x2 opt: 0x2080 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 12 (0xc) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 20 (0x14) | message 'main_inR1_outI2' HASH payload not checked early | received Vendor ID payload [FRAGMENTATION] | received Vendor ID payload [XAUTH] | received Vendor ID payload [Dead Peer Detection] | quirks.qnat_traversal_vid set to=117 [RFC 3947] | received Vendor ID payload [RFC 3947] | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 1 (0x1) | *****parse ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | OAKLEY proposal verified unconditionally; no alg_info to check against | Oakley Transform 0 accepted | sender checking NAT-T: enabled; VID 117 | returning NAT-T method NAT_TRAVERSAL_METHOD_IETF_RFC | enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal) | adding outI2 KE work-order 1 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x563f0711e5d8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x563f071271e8 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x563f071271e8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x563f0711e5d8 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | crypto helper 0 resuming | suspending state #1 and saving MD | #1 is busy; has a suspended MD | crypto helper 0 starting work-order 1 for state #1 | #1 spent 0.133 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | crypto helper 0 doing build KE and nonce (outI2 KE); request ID 1 | stop processing: state #1 connection "road-east" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.286 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 0 finished build KE and nonce (outI2 KE); request ID 1 time elapsed 0.001016 seconds | (#1) spent 1.02 milliseconds in crypto helper computing work-order 1: outI2 KE (pcr) | crypto helper 0 sending results from work-order 1 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f6494002888 size 128 | crypto helper 0 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 1 | calling continuation function 0x563f04fc7b50 | main_inR1_outI2_continue for #1: calculated ke+nonce, sending I2 | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 53 96 2d 1d 86 24 dc 8f 9b fb cf a8 30 7d af 55 | keyex value b2 21 de b5 a5 f0 df 04 33 6f 5e 26 45 7b 0f 2a | keyex value 92 ad 91 e6 87 b8 a5 99 a3 7a 43 fc 60 d4 5b 2d | keyex value a8 38 bf be c0 02 5c ec 7d f0 0f 3b d1 87 64 1c | keyex value 6c 1c 55 bf b6 b8 c5 15 d2 46 54 be 06 de c1 b2 | keyex value 96 3a 97 bb 70 5f de 80 d4 58 a6 f1 ab 1e 75 89 | keyex value f9 76 f5 3c 3e 31 e9 c7 08 91 ae fc 2b d1 17 b3 | keyex value a4 d9 80 2f 8a 54 f5 8f b1 9c 9b 40 5e 98 5c 6a | keyex value c6 28 1f 93 14 a3 de e0 c3 ff d5 79 1d 49 56 a6 | keyex value 4c e9 ba 7e aa 4c cb d5 0c 1a 16 92 56 f4 94 a1 | keyex value a8 29 25 13 50 1f de e3 59 13 fa be 9b a8 d0 ab | keyex value e8 13 0c cc 7d bf b3 7a ac 86 2d f9 b7 6a f8 17 | keyex value 23 c1 64 1f b6 f4 7e 9e b1 54 40 21 e8 f4 3e 0e | keyex value d9 58 4e 02 4c 4f 33 4a 8f 60 a8 8a a6 c9 3e 66 | keyex value 30 c7 c2 be 3a 2e 26 ec 37 6c 88 e3 43 dc 78 ba | keyex value 36 b6 4f d1 b0 a1 c1 17 54 8a cb 3c 8b 3d b5 5f | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni 5f c0 c5 62 3a d6 39 9f 15 49 ed 48 ff 2a be 36 | Ni 34 a4 bd 2d ae 32 b5 3e 4f fc 6b 15 92 07 b9 af | emitting length of ISAKMP Nonce Payload: 36 | NAT-T checking st_nat_traversal | NAT-T found (implies NAT_T_WITH_NATD) | sending NAT-D payloads | natd_hash: hasher=0x563f0509cca0(32) | natd_hash: icookie= 73 37 a3 72 2c 29 3b a5 | natd_hash: rcookie= bd ee 07 08 d4 7a e6 57 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 07 cf ad 2c 98 25 c4 3d fe 39 e7 94 f5 91 1d 37 | natd_hash: hash= 26 82 55 d2 8c 6c 64 aa 04 a6 84 53 76 84 e4 c6 | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | next payload chain: ignoring supplied 'ISAKMP NAT-D Payload'.'next payload type' value 20:ISAKMP_NEXT_NATD_RFC | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 07 cf ad 2c 98 25 c4 3d fe 39 e7 94 f5 91 1d 37 | NAT-D 26 82 55 d2 8c 6c 64 aa 04 a6 84 53 76 84 e4 c6 | emitting length of ISAKMP NAT-D Payload: 36 | natd_hash: hasher=0x563f0509cca0(32) | natd_hash: icookie= 73 37 a3 72 2c 29 3b a5 | natd_hash: rcookie= bd ee 07 08 d4 7a e6 57 | natd_hash: ip= c0 01 03 d1 | natd_hash: port=500 | natd_hash: hash= 6c b3 bb 41 4b 12 16 27 0e 95 aa 39 ab fa 7b 91 | natd_hash: hash= bb d4 2f 2f 0d ab a8 0c a5 c8 5c ee 18 32 78 ef | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP NAT-D Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 6c b3 bb 41 4b 12 16 27 0e 95 aa 39 ab fa 7b 91 | NAT-D bb d4 2f 2f 0d ab a8 0c a5 c8 5c ee 18 32 78 ef | emitting length of ISAKMP NAT-D Payload: 36 | no IKEv1 message padding required | emitting length of ISAKMP Message: 396 | State DB: re-hashing IKEv1 state #1 IKE SPIi and SPI[ir] | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:yes, t_xauth_client_done:no | peer supports fragmentation | peer supports DPD | IKEv1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 | parent state #1: MAIN_I1(half-open IKE SA) => MAIN_I2(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x563f0711e5d8 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x563f071271e8 | sending reply packet to 192.1.2.23:500 (from 192.1.3.209:500) | sending 396 bytes for STATE_MAIN_I1 through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #1) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | 53 96 2d 1d 86 24 dc 8f 9b fb cf a8 30 7d af 55 | b2 21 de b5 a5 f0 df 04 33 6f 5e 26 45 7b 0f 2a | 92 ad 91 e6 87 b8 a5 99 a3 7a 43 fc 60 d4 5b 2d | a8 38 bf be c0 02 5c ec 7d f0 0f 3b d1 87 64 1c | 6c 1c 55 bf b6 b8 c5 15 d2 46 54 be 06 de c1 b2 | 96 3a 97 bb 70 5f de 80 d4 58 a6 f1 ab 1e 75 89 | f9 76 f5 3c 3e 31 e9 c7 08 91 ae fc 2b d1 17 b3 | a4 d9 80 2f 8a 54 f5 8f b1 9c 9b 40 5e 98 5c 6a | c6 28 1f 93 14 a3 de e0 c3 ff d5 79 1d 49 56 a6 | 4c e9 ba 7e aa 4c cb d5 0c 1a 16 92 56 f4 94 a1 | a8 29 25 13 50 1f de e3 59 13 fa be 9b a8 d0 ab | e8 13 0c cc 7d bf b3 7a ac 86 2d f9 b7 6a f8 17 | 23 c1 64 1f b6 f4 7e 9e b1 54 40 21 e8 f4 3e 0e | d9 58 4e 02 4c 4f 33 4a 8f 60 a8 8a a6 c9 3e 66 | 30 c7 c2 be 3a 2e 26 ec 37 6c 88 e3 43 dc 78 ba | 36 b6 4f d1 b0 a1 c1 17 54 8a cb 3c 8b 3d b5 5f | 14 00 00 24 5f c0 c5 62 3a d6 39 9f 15 49 ed 48 | ff 2a be 36 34 a4 bd 2d ae 32 b5 3e 4f fc 6b 15 | 92 07 b9 af 14 00 00 24 07 cf ad 2c 98 25 c4 3d | fe 39 e7 94 f5 91 1d 37 26 82 55 d2 8c 6c 64 aa | 04 a6 84 53 76 84 e4 c6 00 00 00 24 6c b3 bb 41 | 4b 12 16 27 0e 95 aa 39 ab fa 7b 91 bb d4 2f 2f | 0d ab a8 0c a5 c8 5c ee 18 32 78 ef | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x563f071271e8 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x563f0711e5d8 size 128 | #1 STATE_MAIN_I2: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29856.835349 "road-east" #1: STATE_MAIN_I2: sent MI2, expecting MR2 | XAUTH client is not yet authenticated | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 0.301 milliseconds in resume sending helper answer | stop processing: state #1 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f6494002888 | spent 0.00192 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 396 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | ad 24 54 e4 6d 10 0a fb 7e 98 2e cf 73 0d 23 54 | 2d c6 55 14 85 e6 fb cb 8b 81 18 62 bd 14 67 6f | 4d 4f 93 32 d0 ae 30 4a c2 40 74 33 39 93 a1 e6 | 8f 69 5b e0 9a 18 fa 29 2a 22 7f cd da 01 f3 80 | 68 12 76 3b 0c a8 a9 6e 4a 80 bf 4b 92 0c 79 f5 | eb 4a 5b 66 5f 2b 5b 23 0f 7b 82 a9 2b 54 3f 92 | a8 cf ff c4 fc 88 b5 a6 87 b0 ed 05 e5 5d 56 62 | ab f5 df a3 7a b1 ae d6 4b 00 26 40 79 94 e3 b5 | d5 54 a2 f6 ec 1f 97 4a 24 2c 84 6b fb 0f 5b d5 | 54 2a d7 1b da 95 4c 96 93 35 51 c2 37 c5 41 50 | ee 24 aa 8b af c0 1e e4 86 2c 16 9b e9 9d 4f 19 | c9 e4 5b 0e 60 1c 69 b1 8f 02 a8 9a b0 a4 e1 d5 | b1 f4 ae cc 1c 62 44 c2 b3 87 3b 1a 2d 31 ea 7c | 89 64 f8 b8 f9 b9 de be d5 6a 79 61 f5 b1 a0 d5 | 6a 5c d3 f2 35 ae 5d af 8e c4 04 ec ad 8e 4d dd | ce 17 ff 6f fd e8 b6 90 e4 0d f5 1c 2f f3 b2 6d | 14 00 00 24 40 63 63 5a 86 d8 db 58 54 e7 58 b8 | a4 2f 55 51 80 40 9a 98 a3 92 5d 6b 16 2d 2b c3 | c3 7b 2a 09 14 00 00 24 6c b3 bb 41 4b 12 16 27 | 0e 95 aa 39 ab fa 7b 91 bb d4 2f 2f 0d ab a8 0c | a5 c8 5c ee 18 32 78 ef 00 00 00 24 07 cf ad 2c | 98 25 c4 3d fe 39 e7 94 f5 91 1d 37 26 82 55 d2 | 8c 6c 64 aa 04 a6 84 53 76 84 e4 c6 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_KE (0x4) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 396 (0x18c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_I2 (find_state_ikev1) | start processing: state #1 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1459) | #1 is idle | #1 idle | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x410 opt: 0x102080 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 260 (0x104) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x102080 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | message 'main_inR2_outI3' HASH payload not checked early | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org->%fromcert of kind PKK_PSK | actually looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org->%fromcert of kind PKK_PSK | line 0: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org) to type PKK_RSA | line 1: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding aggr outR1 DH work-order 2 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I2: retransmits: cleared | libevent_free: release ptr-libevent@0x563f0711e5d8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x563f071271e8 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x563f071271e8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x7f6494002888 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #1 and saving MD | #1 is busy; has a suspended MD | crypto helper 2 resuming | #1 spent 0.0648 milliseconds in process_packet_tail() | crypto helper 2 starting work-order 2 for state #1 | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | crypto helper 2 doing compute dh+iv (V1 Phase 1) (aggr outR1 DH); request ID 2 | stop processing: state #1 connection "road-east" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.216 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 2 finished compute dh+iv (V1 Phase 1) (aggr outR1 DH); request ID 2 time elapsed 0.001167 seconds | (#1) spent 1.17 milliseconds in crypto helper computing work-order 2: aggr outR1 DH (pcr) | crypto helper 2 sending results from work-order 2 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f648c000f48 size 128 | crypto helper 2 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 2 replies to request ID 2 | calling continuation function 0x563f04fc7b50 | main_inR2_outI3_cryptotail for #1: calculated DH, sending R1 | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 5:ISAKMP_NEXT_ID | thinking about whether to send my certificate: | I have RSA key: OAKLEY_RSA_SIG cert.type: CERT_X509_SIGNATURE | sendcert: CERT_ALWAYSSEND and I did not get a certificate request | so send cert. | I am sending a certificate request | I will NOT send an initial contact payload | init checking NAT-T: enabled; RFC 3947 (NAT-Traversal) | natd_hash: hasher=0x563f0509cca0(32) | natd_hash: icookie= 73 37 a3 72 2c 29 3b a5 | natd_hash: rcookie= bd ee 07 08 d4 7a e6 57 | natd_hash: ip= c0 01 03 d1 | natd_hash: port=500 | natd_hash: hash= 6c b3 bb 41 4b 12 16 27 0e 95 aa 39 ab fa 7b 91 | natd_hash: hash= bb d4 2f 2f 0d ab a8 0c a5 c8 5c ee 18 32 78 ef | natd_hash: hasher=0x563f0509cca0(32) | natd_hash: icookie= 73 37 a3 72 2c 29 3b a5 | natd_hash: rcookie= bd ee 07 08 d4 7a e6 57 | natd_hash: ip= c0 01 02 17 | natd_hash: port=500 | natd_hash: hash= 07 cf ad 2c 98 25 c4 3d fe 39 e7 94 f5 91 1d 37 | natd_hash: hash= 26 82 55 d2 8c 6c 64 aa 04 a6 84 53 76 84 e4 c6 | expected NAT-D(me): 6c b3 bb 41 4b 12 16 27 0e 95 aa 39 ab fa 7b 91 | expected NAT-D(me): bb d4 2f 2f 0d ab a8 0c a5 c8 5c ee 18 32 78 ef | expected NAT-D(him): | 07 cf ad 2c 98 25 c4 3d fe 39 e7 94 f5 91 1d 37 | 26 82 55 d2 8c 6c 64 aa 04 a6 84 53 76 84 e4 c6 | received NAT-D: 6c b3 bb 41 4b 12 16 27 0e 95 aa 39 ab fa 7b 91 | received NAT-D: bb d4 2f 2f 0d ab a8 0c a5 c8 5c ee 18 32 78 ef | received NAT-D: 07 cf ad 2c 98 25 c4 3d fe 39 e7 94 f5 91 1d 37 | received NAT-D: 26 82 55 d2 8c 6c 64 aa 04 a6 84 53 76 84 e4 c6 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: no NAT detected | NAT_T_WITH_KA detected | global one-shot timer EVENT_NAT_T_KEEPALIVE scheduled in 20 seconds | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_CERT (0x6) | ID type: ID_DER_ASN1_DN (0x9) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 6:ISAKMP_NEXT_CERT | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 183 raw bytes of my identity into ISAKMP Identification Payload (IPsec DOI) | my identity 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | my identity 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | my identity 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | my identity 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | my identity 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | my identity 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | my identity 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 72 6f 61 | my identity 64 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | my identity 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a 86 48 | my identity 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 72 6f 61 | my identity 64 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | my identity 77 61 6e 2e 6f 72 67 | emitting length of ISAKMP Identification Payload (IPsec DOI): 191 "road-east" #1: I am sending my cert | ***emit ISAKMP Certificate Payload: | next payload type: ISAKMP_NEXT_CR (0x7) | cert encoding: CERT_X509_SIGNATURE (0x4) | next payload chain: ignoring supplied 'ISAKMP Certificate Payload'.'next payload type' value 7:ISAKMP_NEXT_CR | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Certificate Payload (6:ISAKMP_NEXT_CERT) | next payload chain: saving location 'ISAKMP Certificate Payload'.'next payload type' in 'reply packet' | emitting 1224 raw bytes of CERT into ISAKMP Certificate Payload | CERT 30 82 04 c4 30 82 04 2d a0 03 02 01 02 02 01 05 | CERT 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 | CERT 81 ac 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 | CERT 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 69 | CERT 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 6f | CERT 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c 69 | CERT 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 0b | CERT 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 6e | CERT 74 31 25 30 23 06 03 55 04 03 0c 1c 4c 69 62 72 | CERT 65 73 77 61 6e 20 74 65 73 74 20 43 41 20 66 6f | CERT 72 20 6d 61 69 6e 63 61 31 24 30 22 06 09 2a 86 | CERT 48 86 f7 0d 01 09 01 16 15 74 65 73 74 69 6e 67 | CERT 40 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 22 | CERT 18 0f 32 30 31 39 30 38 32 34 30 39 30 37 35 33 | CERT 5a 18 0f 32 30 32 32 30 38 32 33 30 39 30 37 35 | CERT 33 5a 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 | CERT 43 41 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 | CERT 61 72 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 | CERT 6f 72 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c | CERT 09 4c 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 | CERT 55 04 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 | CERT 6d 65 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 72 | CERT 6f 61 64 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 | CERT 65 73 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a | CERT 86 48 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 72 | CERT 6f 61 64 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 | CERT 65 73 77 61 6e 2e 6f 72 67 30 82 01 a2 30 0d 06 | CERT 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 8f | CERT 00 30 82 01 8a 02 82 01 81 00 de eb 73 26 86 d7 | CERT 2c 84 21 13 0e a4 23 30 11 c6 d4 b1 e8 99 58 5b | CERT 54 fa 8c cb 90 bf aa 54 64 e2 ef 00 f9 df b2 5a | CERT 20 d0 1f fd fb 02 a8 d4 60 ac 44 ab c0 91 e1 eb | CERT 81 59 f7 6d 08 30 04 c9 63 5f 07 58 6a d7 e6 ff | CERT 96 d3 79 c2 a1 6b d3 24 00 31 74 f3 8f b4 e9 17 | CERT af d1 3c 33 ee 8b a9 19 b2 03 f1 98 8a 60 f2 f6 | CERT 14 4b 31 a3 8b cb cb ae 31 d9 70 5a 88 2d cc c8 | CERT 77 e8 27 1f 75 07 9a 9b cc 5a 53 bd 69 be 82 0e | CERT 9c b9 3b c8 4f fa 84 87 bb b6 0d 2d ff 11 a1 2d | CERT 51 d4 3f c2 93 09 22 b4 2e 48 0e 77 81 b6 79 ee | CERT 31 37 3d 55 2f 3d 4f 0e 26 7e 73 34 4f 0d d1 90 | CERT 84 c9 06 53 b6 31 7f 6e 62 51 c6 35 3b a1 03 8a | CERT 8b 62 bb 4d 37 a5 44 42 54 a2 10 80 5f 75 0e 17 | CERT a0 4e d8 46 e8 02 bf a1 f5 e5 2a 2e 5c dc b2 d7 | CERT 93 d9 04 45 51 1d 5e 7d d8 fd 03 96 0c d5 02 5b | CERT 72 03 26 b7 d6 cd a0 18 86 a7 07 d0 74 c6 07 e8 | CERT 5c 1f 7a af be d0 ae b8 e7 7a 3b cf 5c fa ca ea | CERT ae c3 6f 85 22 9b 46 81 be 7c 89 15 4f 06 47 30 | CERT 9f bb ee 24 55 e2 21 cd 8e 93 f5 0e 33 49 5d 50 | CERT 48 39 ac ab 37 59 f8 a2 61 be a0 81 d5 25 97 2f | CERT 8b 2f bd d9 47 a4 5c a5 3b c0 99 19 c5 fb 43 da | CERT 6f 6c 33 54 60 af 00 d5 41 12 60 e5 bb 07 b8 76 | CERT 8a 55 c4 c3 47 8b bd 12 bc e8 5e 94 62 7a 20 91 | CERT 11 fb 23 b7 2d f5 6f 73 b6 a9 02 03 01 00 01 a3 | CERT 81 e3 30 81 e0 30 09 06 03 55 1d 13 04 02 30 00 | CERT 30 25 06 03 55 1d 11 04 1e 30 1c 82 1a 72 6f 61 | CERT 64 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | CERT 77 61 6e 2e 6f 72 67 30 0b 06 03 55 1d 0f 04 04 | CERT 03 02 07 80 30 1d 06 03 55 1d 25 04 16 30 14 06 | CERT 08 2b 06 01 05 05 07 03 01 06 08 2b 06 01 05 05 | CERT 07 03 02 30 41 06 08 2b 06 01 05 05 07 01 01 04 | CERT 35 30 33 30 31 06 08 2b 06 01 05 05 07 30 01 86 | CERT 25 68 74 74 70 3a 2f 2f 6e 69 63 2e 74 65 73 74 | CERT 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 | CERT 67 3a 32 35 36 30 30 3d 06 03 55 1d 1f 04 36 30 | CERT 34 30 32 a0 30 a0 2e 86 2c 68 74 74 70 3a 2f 2f | CERT 6e 69 63 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 | CERT 65 73 77 61 6e 2e 6f 72 67 2f 72 65 76 6f 6b 65 | CERT 64 2e 63 72 6c 30 0d 06 09 2a 86 48 86 f7 0d 01 | CERT 01 0b 05 00 03 81 81 00 79 c0 dc 4f ca 3c 5f 4e | CERT 21 3c 76 b0 44 66 c8 74 40 7b 34 5d 63 96 6e ee | CERT c5 df ef 0f fe c2 e4 25 18 39 25 d8 f8 6a b8 87 | CERT f9 17 94 73 7f 8d fb 7d 9d 24 5e c5 95 19 96 3e | CERT 04 dd 8a d0 ad 11 f4 97 32 43 d2 f3 1a d3 1c b1 | CERT e9 01 90 f2 72 36 cf d4 bd 14 e6 ad 8d d2 84 3b | CERT 92 94 99 40 21 16 68 aa e7 5e ac 95 88 11 40 55 | CERT 28 90 af 7f 98 b1 80 36 c5 18 f7 6e 43 40 bc 93 | CERT 86 b3 f1 aa b3 89 b4 15 | emitting length of ISAKMP Certificate Payload: 1229 "road-east" #1: I am sending a certificate request | ***emit ISAKMP Certificate RequestPayload: | next payload type: ISAKMP_NEXT_SIG (0x9) | cert type: CERT_X509_SIGNATURE (0x4) | next payload chain: ignoring supplied 'ISAKMP Certificate RequestPayload'.'next payload type' value 9:ISAKMP_NEXT_SIG | next payload chain: setting previous 'ISAKMP Certificate Payload'.'next payload type' to current ISAKMP Certificate RequestPayload (7:ISAKMP_NEXT_CR) | next payload chain: saving location 'ISAKMP Certificate RequestPayload'.'next payload type' in 'reply packet' | emitting length of ISAKMP Certificate RequestPayload: 5 | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org->%fromcert of kind PKK_RSA | searching for certificate PKK_RSA:AwEAAd7rc vs PKK_RSA:AwEAAd7rc | ***emit ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Certificate RequestPayload'.'next payload type' to current ISAKMP Signature Payload (9:ISAKMP_NEXT_SIG) | next payload chain: saving location 'ISAKMP Signature Payload'.'next payload type' in 'reply packet' | emitting 384 raw bytes of SIG_I into ISAKMP Signature Payload | SIG_I 3d 1c 7d 49 2a cb e4 b5 95 e5 c5 ef c0 5e 61 dd | SIG_I 6a 28 81 4c 99 62 01 59 d7 17 96 7d 48 37 56 15 | SIG_I 2d 85 ad bc a7 b5 00 68 5f 6f b2 e3 4e 09 5f 0d | SIG_I dd 6d b1 79 67 89 25 9c 78 66 65 27 16 15 76 87 | SIG_I 2a c8 83 03 6e 89 f0 99 a0 12 09 dc f5 17 6f 10 | SIG_I 08 14 af b5 1b ad 26 df e0 0f d4 e5 97 c4 af d3 | SIG_I 17 de 56 d0 e7 e4 a8 29 99 c5 e5 31 9d d4 45 13 | SIG_I db 2f 88 93 1f 3d d8 42 73 1a 33 7f ac 26 63 ac | SIG_I e5 20 9e d4 c6 28 89 26 06 36 dc 19 40 88 85 23 | SIG_I 14 6c 2e ae df 41 6f 79 80 66 00 14 60 78 d9 d6 | SIG_I 87 87 6d 01 f0 f6 26 c9 54 8e f1 ef 1d 0f fa 97 | SIG_I a4 f9 b3 bf 33 92 5b 87 db 89 55 93 31 17 97 0c | SIG_I 7b 7f b3 a4 90 61 66 89 0a 33 e7 d6 d5 9d 41 d1 | SIG_I db d7 3b 03 b3 39 1c 10 1c a2 8a 9e 54 14 0f 29 | SIG_I f1 c5 6d 32 71 f1 69 c6 55 b9 bb 80 ba ce 99 f4 | SIG_I 37 75 07 bf 6f 91 6b 90 5e 69 42 dc c2 95 9a 82 | SIG_I 8e b1 c6 94 80 19 5f 0e e7 66 23 dc 38 5c b0 15 | SIG_I 41 d6 8c 78 a5 e0 54 4e b2 02 f1 94 92 f4 c3 9f | SIG_I 6e 08 2d 24 e8 db 5b 3b 2f b6 d9 14 38 01 1f 81 | SIG_I 29 df 92 c7 da 5f 18 aa 89 2b 42 56 8b 98 e2 68 | SIG_I 82 34 d7 9c 56 cf 2f 3f c1 a3 cb 5d 16 04 d1 24 | SIG_I 45 ad 3d 1c 3f 7a 93 37 1a 54 3a 23 ed fe 3c fd | SIG_I 66 0b e4 94 d7 21 c1 0d 5f 28 1a 6c 45 af 63 dd | SIG_I 5d bb bc c3 b0 a8 a3 f2 a0 0a ac d1 fb 3c 9f dd | emitting length of ISAKMP Signature Payload: 388 | Not sending INITIAL_CONTACT | emitting 11 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 1852 | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:yes, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 | parent state #1: MAIN_I2(open IKE SA) => MAIN_I3(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7f6494002888 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x563f071271e8 | sending reply packet to 192.1.2.23:500 (from 192.1.3.209:500) | sending 1852 bytes for STATE_MAIN_I2 through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #1) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 05 10 02 01 00 00 00 00 00 00 07 3c 69 bc ed 07 | c1 49 7f 6d 02 42 52 28 c9 68 34 d3 c8 79 fc 43 | 81 78 9b 39 c8 ef 1e 74 33 6f 9a 7e 15 94 00 45 | 4d 84 1f c7 45 e8 d5 64 5d 7e c3 f8 97 ba 9b 05 | 7d 14 f0 46 43 52 8a 55 3d 67 7e 87 36 9d a1 b0 | 81 cc 15 7b fc 54 f7 19 38 b7 85 25 0f a7 e0 fb | 00 36 98 9a a5 5e 52 34 1c 1d e7 37 d8 29 5f d9 | ae 0c 63 35 d8 95 1b 6e 3f 29 b8 b7 b5 76 17 e2 | fa 72 6d c1 10 c2 f5 d5 1b fb 79 51 f1 70 61 0a | 31 e5 34 dd ee 3a 13 64 5f fe bc fa fd a9 c4 65 | 6a 53 e2 d3 b3 72 72 bb a2 65 e1 b1 05 d1 a8 2e | 72 58 c4 bc b4 f3 97 ab 07 72 77 e4 13 01 7d 47 | 36 3e 32 62 c3 8a cc bb 16 d5 95 f4 45 94 6f bd | 72 99 9c 96 60 7c 32 f1 88 5c 59 73 cb c7 3d c1 | dc b4 1e e7 60 ed d3 88 0a a1 ba 6e f1 78 4c d2 | 3f 98 be 52 4f c8 2f d5 9e a9 dd 92 b4 bf 46 68 | 90 3a d9 f4 f9 c0 32 2d f6 ec b0 6b 6a a6 79 c9 | b0 44 d5 13 bf 19 22 95 c5 c6 5e 0e e6 0f 65 25 | 85 45 1d e7 74 1e ce bf 24 30 25 43 f3 e2 bf aa | 92 46 a0 3e 2c aa 62 11 c9 a1 34 ad 55 92 3f 9b | 81 71 1b bb be eb 05 0d 8a 0d ee 54 ea 6d 3f 40 | 7c 5b 83 a3 72 05 4b fe a1 b1 e2 5c 98 de d2 32 | ad 62 f9 d6 ac 10 e3 e8 cb 0f 37 99 34 db 97 5a | bb e8 a3 98 81 96 30 c2 2e 9e 55 c8 d3 b8 5f 4b | 18 a2 20 c9 23 76 27 eb 3a b2 0d c6 ab 1d 46 7b | c1 4b 39 e9 c1 98 f9 e5 ee 6e 07 34 59 a8 7e 87 | e2 36 0b c6 8b ea 8d 99 9b 2a 55 cf b8 20 0d 58 | 43 33 d3 87 27 ce d0 58 48 2d 0c 57 f9 26 89 53 | d8 8b e9 0c 2f 3d 05 49 30 eb d8 43 40 54 63 29 | 8b 3d 03 9d a7 10 01 78 3a 22 97 09 17 ca 0b 2a | cf 41 61 68 27 b3 90 e5 9c d2 4a c7 b8 aa 19 07 | 27 2f a4 fd 55 5b af 46 88 35 88 b0 f9 f2 c0 33 | 55 83 30 40 4b 1b 0c 69 ef 34 94 2d ba c2 d0 0e | 2e 4b 7b bf 68 97 43 99 8f 3b b3 3e f0 73 8d 1b | fa 3f a3 c1 52 f3 c9 1f 06 84 08 75 9d 70 1e eb | 95 51 ac d0 6b 7d ad 78 52 7f 2e 76 56 3c 8d b5 | eb b4 90 ef d8 f9 c6 5f c0 a3 82 df 80 7e dd 14 | 86 6f 0f 62 fe 98 ea e6 d0 8a ad 85 a9 1f 38 ca | 7a 0d 70 1d 54 0e 48 88 fd d5 e6 66 80 52 9c 25 | 6c b2 a3 c1 73 29 e8 ef b0 80 68 af e6 99 d3 64 | ae 2a 05 ec 6f ec 63 77 d9 49 16 f9 63 9a 86 f2 | 15 52 4f ee ed 02 cf 97 e2 f4 8f 1c bb 14 c8 c0 | 45 71 43 de 4e 70 21 25 7d aa 74 2e 7e b3 a4 6e | 10 64 cb 93 0d 21 82 90 8a 9f 4e 45 a3 31 18 b6 | e5 35 ce 79 da 4b c6 8c d8 97 54 64 4f 29 13 1e | f7 62 6c 59 fa 40 a8 f9 ad 99 b0 89 c9 6c 60 cc | 28 46 63 81 0c ed 1f 93 86 88 56 1e 5d 20 1d 12 | 43 93 5d ac 93 cb 1b 58 d3 b2 61 ec cb 66 09 28 | bd 15 73 23 80 c4 44 a4 3b 8d c3 b9 1f 08 d9 9a | c5 35 9a bb 22 34 26 4a cf 92 74 19 9f ab cf 01 | b3 97 8f f9 ce bd 87 c1 79 20 b1 1c 10 e9 db d1 | b9 44 06 f5 48 59 e3 18 ea a8 95 d1 7e 32 31 8f | 9e c4 dd 25 45 ce 06 9a d2 38 ae fe 12 5e 9c ad | e6 ff af b7 bf ec 98 80 a9 d5 2f f8 6f 27 9b e6 | f8 a9 cc 7f 11 2d 31 58 36 58 2c 12 cb ca 11 5a | 4b 01 4a 3d ed 74 b3 21 10 c7 0a 3c 37 41 f8 a2 | e1 b4 9f 89 09 f3 5f 84 ee 00 8d 65 99 8a 16 f6 | c0 74 11 98 5a ec 75 74 dd 6a 85 e2 67 93 62 ca | a4 3c ed 07 5d cc ad ec 12 a0 f5 7b a5 32 75 f7 | 38 2f 00 06 6a 8d 39 e0 4f 7c 43 e5 f6 c1 eb 4d | 8a 07 a4 6f 0c b2 c7 77 b2 c2 52 87 94 d2 eb 21 | 41 85 8b 1b c8 e1 9c 44 11 8d be 2c f2 4a 29 c1 | 75 34 c4 ff 67 9b 10 45 4e f9 a1 cb e2 32 0f c3 | 7e ac 65 90 e2 b6 00 36 b4 b7 48 1e 1e 60 8d e1 | fd 1f 1f bc a5 42 24 db 27 eb b7 ab 99 15 2a 25 | 37 2a 92 b4 e7 73 71 c0 b8 4b 06 d7 40 1f 81 5d | fb a9 ad 7e 63 0f 22 27 98 c1 14 d5 80 ad aa 27 | fd ed 8b 9b 19 15 dd 8f 7c 41 97 98 ad 3a bc f3 | 63 00 d4 f0 17 f8 eb 30 b0 13 a8 e0 02 8b 11 bf | 06 94 b3 71 9e a6 72 c0 f1 8f d9 89 26 4c 72 0b | fe 82 00 2c 6b 7b 26 53 ae 05 28 a0 8e 42 2d 39 | 37 9f 8a 6f e2 ca 06 a9 4b 1f 14 bb 11 3e 21 b0 | 5c 44 29 48 3e fd 58 35 d4 9d a4 fd 2a e1 25 8f | 76 20 92 72 89 98 97 10 1b 2e 76 01 5d f0 ae 27 | d0 a0 59 22 b2 4e bf 23 77 99 79 71 3f eb b6 2d | d3 09 f0 e5 03 4b 75 30 ca 7a d3 3a 45 e9 6c bf | 9f 01 65 88 87 9d 24 6a 8f 20 54 15 8a 17 3c 01 | bc a0 ef 6a af 09 59 33 53 8d 86 10 a6 9c 1f b6 | fa ba 11 51 19 ac b7 47 74 5b 6b c2 f7 9d ea 7b | b0 bd 12 e8 7b cc 43 7a 03 08 2c 2a bd 41 d2 0e | 8f 6a 82 f2 a8 d4 82 f3 45 96 15 20 17 43 c9 10 | 01 cf 80 f7 7b 16 a3 d1 0e 38 a3 b1 05 e6 29 5c | 84 e7 86 46 03 a1 ff a0 9a 57 a9 84 6e 79 3d 21 | 60 e4 f3 14 4e 5d c2 0a 9c 75 f2 63 8b 49 54 64 | 7d ec aa af 74 7d 7c 5e ae 76 03 3b d1 45 b9 c7 | 64 cc 96 95 98 92 1c db bc 22 e3 45 dd e0 ec b4 | 21 3c 8e 69 79 84 d3 ea 52 f3 00 37 98 97 8d ae | 58 f1 18 cf f6 30 69 cd e4 15 59 15 b4 82 fd b9 | bf 28 c7 3f 79 68 d4 16 b3 7e 23 1c ab e5 c5 5e | 48 96 95 eb ac 75 00 b6 a2 6e e7 73 94 57 1d be | 88 70 ff 0a c3 60 dc c0 79 b6 b1 1e fc 00 72 d4 | 9d 9d e8 05 60 c7 eb 45 d5 28 0e 6f 74 c4 44 26 | 8b fd 9a 62 d0 c5 f9 a4 25 04 ec e6 0e 2c 12 ea | d6 d6 0f 16 aa 96 70 c8 34 18 d4 39 44 eb 35 6b | 95 9b 85 16 cc 0d 80 58 d5 a6 e9 41 28 95 e5 df | 99 68 70 b0 12 5d fe ab c9 04 60 ee 10 d6 fd 45 | 06 85 aa b1 86 86 d2 4f ae 26 29 d0 39 7b a0 55 | fb ae 7f 08 71 62 c5 97 e9 1a d5 b9 1a 00 bf 46 | 00 1c 1e f7 0a 57 4e e4 6e 8c da 67 14 cd d5 50 | 1b cb 69 c6 e7 6c b7 ed 5a b7 85 dc 13 1b 27 9c | cb f3 5d c1 cc 6f 89 13 03 35 46 99 83 f6 40 79 | 97 cf a3 5e 9e 64 63 b2 3c 04 da 20 44 57 8f 0e | 82 75 cd 88 63 a1 18 81 15 05 5f 16 33 7b ab 2d | 3f a7 84 4b c2 fd 86 97 66 b4 1a 87 cf bc 9f 1c | fc 4f 6e 69 1a bb 13 e5 a4 f8 5c 85 8b 39 65 e6 | 83 ee bf de 4e 5e 0e ec 1d 05 5a 76 e9 73 fd 4f | bc 1a ce a4 66 64 0b 06 f8 64 dd 0e 05 8d 3d 87 | c7 c2 b2 63 f0 2a 41 20 c8 17 18 af af 09 b0 b1 | df 0a 33 c7 73 ca a0 58 29 d9 fa 04 6f e3 88 00 | 4a 19 ad 21 bc 23 c1 2f f6 61 8b 80 5e 28 a6 6a | 23 5f e3 a8 5e ec a2 72 9a aa 24 4e 91 fc e2 1a | e0 54 39 fe b8 8a e2 ff 6b 6d 21 f1 e8 0c 54 49 | 76 7a d8 85 2c 82 f0 ba c1 09 0c 67 f2 19 33 2c | 02 d5 8c cf 72 74 26 57 d7 22 72 e7 19 f3 ff 87 | 6f b0 54 ae a3 89 4c 43 4d bc 17 c6 | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x563f071271e8 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x563f071262e8 size 128 | #1 STATE_MAIN_I3: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29856.847426 "road-east" #1: STATE_MAIN_I3: sent MI3, expecting MR3 | XAUTH client is not yet authenticated | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 7.67 milliseconds in resume sending helper answer | stop processing: state #1 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f648c000f48 | spent 0.00301 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 1884 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 05 10 02 01 00 00 00 00 00 00 07 5c 2d 17 7a f7 | 8a aa ff 72 2c be c1 8d 24 a4 ad 01 37 d1 32 8b | 53 fc 93 c0 7c 2a 71 34 e5 84 61 fd ad 8d df f7 | 0d 2b 2b 2a 8a fd a0 c2 c4 ab fc 11 3f 38 d9 aa | db d9 f6 a5 80 fb f0 66 79 9f 97 71 ef b3 79 a6 | d8 6e 9d 70 19 27 89 db de 16 ee af f2 84 d5 80 | 0e ec 95 40 e4 dc c7 4e bd 46 03 e3 ab ea 5e 20 | 4c e6 88 98 f9 3c c1 11 20 06 31 46 19 ee 81 43 | 15 a6 1e b2 71 81 cd f7 5a ea 90 ac 51 1b 60 bf | 46 a5 74 15 90 42 4b b7 f0 06 86 c9 9b e9 17 46 | ea 5c 6d a3 88 d5 45 bd 0f 75 39 d9 f8 c3 26 71 | d3 34 33 f8 16 fa d4 a3 da 8d 0c a3 9d 2a 52 7c | 7d 76 5b 85 ae 9e 8e 61 62 7a ca 71 38 e5 f8 8a | 12 08 98 2e 1c 7f 43 3d a8 e0 0b 20 2f a3 d9 8c | 68 1f 02 2f 3c 59 21 32 34 50 96 e7 17 6f 7b 8f | 1e 25 eb 32 c4 28 9d d6 b4 0b 62 93 30 59 d6 3b | 88 25 a1 35 cd c5 c2 e7 37 90 a5 ab 43 0d a7 f7 | 2e a4 70 70 b3 40 48 b9 45 ae 11 97 91 d1 fb 61 | 0b 5d c8 64 b3 bc af 88 d6 5e 45 b5 b9 a3 00 bd | 8c ce 7a b7 3d 52 c1 6f ee 0d 37 9f 0c 4c 41 af | f0 bf 4f 90 c9 be 5a 0c 6f cd 35 e3 f0 7c 39 66 | 7a 9d 17 1b 27 bc 7c e1 9c 51 fd 1c 70 09 fa 23 | c0 3a 64 22 c9 8a 63 51 9c 08 2e 41 9a 78 1b a9 | 51 34 e4 42 e0 cd b8 66 5b e1 e1 31 25 2e b2 78 | e0 d4 2d b8 15 5f af 7a 53 82 c0 81 9b f4 4f 1d | bc f8 a0 bd c3 08 bf f1 0e 92 d8 5b 1f cc 8a da | 45 52 2b aa 6b 96 e6 f7 e5 0e 95 15 76 81 62 94 | 6c 2e 1b 9b d4 cc 66 2d a5 2a a6 45 5b cf 93 5b | f9 40 f7 d4 67 75 f5 c2 31 1b a9 a7 ca 14 fb ee | 32 01 b3 4c 40 98 16 d6 28 a1 21 c1 b6 b2 74 76 | 2f de d3 70 25 ef 53 4d 67 be 5f 2e 44 10 af 14 | be 17 b1 97 2d 3c 20 b0 fc 3e 4c 0a d7 93 ba 4f | 39 a5 c2 97 43 66 ec 2f a1 66 39 ce 13 7f 4d 53 | a6 a7 87 d0 c6 7d 44 c1 fe ed ae ce a2 78 37 bb | 1e e4 34 e5 7d c0 62 16 bd e4 b8 68 f0 ff f9 a4 | 36 18 5e a8 a8 68 6b 66 9d 99 f5 05 f1 56 a2 f2 | 70 e4 0c 8f d9 78 1e 68 9c e5 52 7f 0a 58 f8 41 | 83 71 0b 94 9f 72 b2 c8 8e 66 60 db 8a 9f 71 85 | a1 7a 6d 04 ab 5a 3f 79 3c a3 7e 9c f6 7f 5e 51 | f2 98 6f 3f ce 97 cb 2c 00 c0 88 cf 21 91 75 88 | 7a ff ac da 1e ce d6 7f 6b 41 13 91 42 68 45 4d | 00 a7 fa 46 2e a6 70 49 44 7d 5f 59 59 21 10 95 | 4d 31 35 10 13 c6 38 70 2a 9e 40 5f a2 d9 16 9c | 84 10 73 ec 14 a4 1b c1 3a 2f fc 40 06 6f a1 85 | 60 fe b1 97 4a a5 21 88 3a 4c 25 31 14 5b 65 97 | 4c 12 b5 53 30 c8 e4 cf 4e 64 7e d2 e3 64 b2 99 | aa 67 64 89 81 4b f8 9e fb 27 1f 8b 04 c9 12 16 | 90 07 a6 28 61 ef cf ac f4 63 ed 1f ad aa 66 a8 | ed f7 8e 34 ab a6 a8 7b f3 02 5f 54 dc 71 4e 44 | 25 09 09 62 08 6a 41 0d 26 13 66 82 8d 3e 1a 12 | 54 6b 55 95 b9 31 56 0c 6a 2c e2 6d 52 9d 84 8d | 63 3f 56 3a 7c 08 c6 80 b3 75 d2 c3 eb 9e 43 d1 | 05 c4 53 61 0f 89 4a fb e4 68 f0 e8 e6 67 38 2f | 80 0a 91 cd 20 3c 13 aa 88 28 35 16 e5 20 0a bd | db 62 47 3d 6b fd 9f 55 28 8c b6 ce 4f 15 d0 b2 | e2 b2 6b e9 c9 1a 56 75 db 0d 8e 02 60 53 c6 e4 | 81 24 8f 58 7b 3c 4f cf ed d1 4f ff 6d 44 b4 1a | cb bc 76 67 af 69 e3 8d 64 85 a1 ef cc 87 05 90 | c4 77 1b b8 fe fa 2d e5 28 87 5d 29 22 2a b0 70 | db ca 68 d0 3a 5f ae 2a 76 5a 03 8d 8f fd 5c ea | dc 39 cd 67 3f 46 6f 12 e0 f8 95 90 32 b5 b7 b9 | 9c ad b5 66 d9 f5 99 fd f7 67 7e e0 81 d2 1d ce | c2 17 e3 90 c1 d0 ca ba f4 61 b4 b1 49 dc a7 f5 | bd b3 e9 50 dd 70 d5 69 17 94 dc 61 44 e7 64 39 | 72 52 fd 5e ed 2d b8 f6 cc 62 16 ac 1b 54 07 3e | 41 20 b6 f5 db 15 d2 4c 66 dc 70 55 08 14 6f aa | 7f 83 2b 95 8b b0 41 d5 21 da b3 8b ee 73 ef 71 | a0 a5 10 4a b1 7e 55 74 87 90 65 dd 89 bc 1b e8 | 85 11 2a 8f 29 98 c9 1f 70 3d d3 4c df c0 ac bf | 13 65 18 f7 45 2f db 88 48 68 8a 1b 82 47 93 b3 | 94 23 41 d6 ed 1f 9d d5 38 7f c9 8e ce cc ff 6b | e2 b6 df a1 ba 6e 00 7b d0 b9 46 86 fc a1 39 d6 | 45 9a b6 54 40 6e 5f 14 db bb 1d 2d a9 5a 39 e1 | 47 57 24 00 20 a2 16 fa 2f 64 c7 fc 51 28 55 b9 | 92 dc dc a3 2f 1c 19 c5 15 c1 2f 5d 59 1b 97 bd | fa ae 34 7d 0f ee 17 2f 83 33 9e f3 2d a9 0c 60 | 67 b9 fb be 3c 27 d2 12 fb 18 28 80 2c c3 91 70 | f3 d0 b4 93 be 6c cd 67 4a 7e 03 a8 84 b0 ff 9d | a6 2d 59 3a 19 df 92 fd 28 49 db 60 72 1f c5 68 | 5b 64 35 67 4f b4 79 61 d5 2a 95 2c 30 ac 2d 47 | a7 52 34 21 9a 7d 00 87 7c 00 ef d0 dd bc c0 f5 | d2 cd 32 aa 6b aa 68 f7 f0 d0 cc fd 52 77 0d b6 | 86 ab 0a 63 1a cf 1b e4 41 a6 a9 4b 2b ae 8c d0 | 7c ba 1f 54 95 32 c0 01 45 bc 02 2f 7c cd 56 89 | 57 1a f4 f0 a6 d6 89 61 e0 c7 a0 03 84 61 1b f2 | 3e 62 2c 22 e7 ea 1f 12 5b 33 9a 4a 27 55 05 8b | 1c 38 a2 40 93 1f a9 02 09 32 2c 50 fa 52 3f 87 | 19 a8 db 70 88 7f 4f a3 6a 35 7e 58 fd ac c7 59 | ad ef 5f 7e 38 32 17 c5 db eb 94 46 56 e6 c2 c3 | ce 50 eb 77 42 a2 9e 2b d1 69 5f ca 42 c7 d2 74 | b9 f7 1b 07 e3 fc 23 f3 7d 74 11 c3 f6 8f d9 c4 | 69 15 0d a8 97 01 5c e4 ec af 2f 37 94 34 4b d6 | 69 f4 be 38 3f e7 d4 20 7b 35 44 15 ba e8 e4 e2 | ad f7 05 d5 77 9b 13 d0 17 c7 3a 16 04 c5 24 9a | 78 21 de fd ea 97 d7 5a d3 61 30 fe 32 a4 f6 76 | 7d 90 d8 b5 06 a0 0f 8d d0 92 89 56 59 38 00 14 | 8a 9f bd 3c 10 8f 16 50 c7 c4 5c 32 46 15 d2 f9 | c2 49 77 f2 c6 c6 20 fe 91 83 12 92 25 3f a8 e3 | f9 d2 b6 91 5d 56 fa 7d ba 1d de 1e 24 0c 88 1d | d6 1f 54 64 dc 65 67 61 3b 7d fe e3 f7 97 c9 c7 | 46 a5 93 d8 dc e7 52 46 35 23 ad 7f 7a bf 96 eb | 62 a8 e4 29 4e fa dc da 7c a9 65 a5 43 7b 9c 54 | 57 78 2c 00 c1 88 34 be 5e e0 04 a2 2d b3 3d 03 | f1 7b 45 3f dd 2b a4 26 87 fc b9 17 c5 89 1e eb | 0f 96 4e 11 25 34 27 bb da e8 97 2f 3b c5 cf 91 | b8 9b 09 82 5a 41 b1 19 26 df 54 94 69 40 a2 5f | f6 d1 f4 29 b1 df 1b 65 a8 4f 40 ff 3c e6 11 b4 | 66 52 25 81 cd 0e d8 bc b5 d2 37 db 33 70 4f 8e | cb 99 96 ec 42 a7 3b c9 23 49 30 3a 02 23 1d 52 | f2 81 fe 3d 2d b0 30 35 a4 6c 34 d4 05 cd 0e f3 | 93 15 6e 27 8b 71 b7 d9 cd ef ed c1 df 5b d0 89 | cf 29 18 9a d8 a4 8e 08 05 2a 34 ca b4 8b ec d5 | 07 76 36 29 b5 60 64 de 20 60 bd 78 0f 71 3c ea | e1 dc 84 62 71 8b a1 58 f7 60 5a c7 fa f2 a0 e5 | cd fb 97 73 8a d3 48 eb 34 c9 9d 89 48 8a 0f 92 | 37 7a 8c 72 35 b6 c6 71 95 d5 87 e0 9f 92 e5 6d | 95 bb 62 e5 a4 66 c1 a8 a1 c0 0c f5 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | length: 1884 (0x75c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_I3 (find_state_ikev1) | start processing: state #1 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1459) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x220 opt: 0x20c0 | ***parse ISAKMP Identification Payload: | next payload type: ISAKMP_NEXT_CERT (0x6) | length: 191 (0xbf) | ID type: ID_DER_ASN1_DN (0x9) | DOI specific A: 0 (0x0) | DOI specific B: 0 (0x0) | obj: 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | obj: 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | obj: 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | obj: 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | obj: 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | obj: 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | obj: 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 65 61 73 | obj: 74 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | obj: 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a 86 48 | obj: 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 65 61 73 | obj: 74 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | obj: 77 61 6e 2e 6f 72 67 | got payload 0x40 (ISAKMP_NEXT_CERT) needed: 0x200 opt: 0x20c0 | ***parse ISAKMP Certificate Payload: | next payload type: ISAKMP_NEXT_SIG (0x9) | length: 1265 (0x4f1) | cert encoding: CERT_X509_SIGNATURE (0x4) | got payload 0x200 (ISAKMP_NEXT_SIG) needed: 0x200 opt: 0x20c0 | ***parse ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 388 (0x184) | removing 12 bytes of padding | message 'main_inR3' HASH payload not checked early | DER ASN1 DN: 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | DER ASN1 DN: 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | DER ASN1 DN: 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | DER ASN1 DN: 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | DER ASN1 DN: 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | DER ASN1 DN: 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | DER ASN1 DN: 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 65 61 73 | DER ASN1 DN: 74 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | DER ASN1 DN: 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a 86 48 | DER ASN1 DN: 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 65 61 73 | DER ASN1 DN: 74 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | DER ASN1 DN: 77 61 6e 2e 6f 72 67 "road-east" #1: Peer ID is ID_DER_ASN1_DN: 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | global one-shot timer EVENT_FREE_ROOT_CERTS scheduled in 300 seconds loading root certificate cache | spent 4.36 milliseconds in get_root_certs() calling PK11_ListCertsInSlot() | spent 0.0353 milliseconds in get_root_certs() filtering CAs | #1 spent 4.43 milliseconds in find_and_verify_certs() calling get_root_certs() | checking for known CERT payloads | saving certificate of type 'X509_SIGNATURE' | decoded cert: E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | #1 spent 0.645 milliseconds in find_and_verify_certs() calling decode_cert_payloads() | cert_issuer_has_current_crl: looking for a CRL issued by E=testing@libreswan.org,CN=Libreswan test CA for mainca,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | #1 spent 0.0303 milliseconds in find_and_verify_certs() calling crl_update_check() | missing or expired CRL | crl_strict: 0, ocsp: 0, ocsp_strict: 0, ocsp_post: 0 | verify_end_cert trying profile IPsec | certificate is valid (profile IPsec) | #1 spent 0.0954 milliseconds in find_and_verify_certs() calling verify_end_cert() "road-east" #1: certificate verified OK: E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x563f0713b1a8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x563f0713a7e8 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x563f0713a638 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x563f07139c78 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x563f07138088 | unreference key: 0x563f07144e28 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 1-- | #1 spent 0.321 milliseconds in decode_certs() calling add_pubkey_from_nss_cert() | #1 spent 5.56 milliseconds in decode_certs() | ID_DER_ASN1_DN 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' needs further ID comparison against 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | ID_DER_ASN1_DN 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' matched our ID | SAN ID matched, updating that.cert | X509: CERT and ID matches current connection | required RSA CA is '%any' | checking RSA keyid 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' for match with 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | key issuer CA is 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | an RSA Sig check passed with *AwEAAbEef [remote certificates] | #1 spent 0.134 milliseconds in try_all_RSA_keys() trying a pubkey "road-east" #1: Authenticated using RSA | FOR_EACH_CONNECTION_... in ISAKMP_SA_established | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:yes, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 | parent state #1: MAIN_I3(open IKE SA) => MAIN_I4(established IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I4: retransmits: cleared | libevent_free: release ptr-libevent@0x563f071262e8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x563f071271e8 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x563f071271e8 | inserting event EVENT_SA_REPLACE, timeout in 2607 seconds for #1 | libevent_malloc: new ptr-libevent@0x563f0712c538 size 128 | pstats #1 ikev1.isakmp established "road-east" #1: STATE_MAIN_I4: ISAKMP SA established {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | XAUTH client is not yet authenticated | #1 spent 5.95 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "road-east" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 6.2 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00305 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 06 01 90 77 0d 1f 00 00 00 5c 4e 43 71 9a | 67 8e ea 84 d3 ed 7b 94 18 c3 8e 12 a3 0d 12 c1 | 35 3b 2f e9 f0 35 f8 29 5a d2 88 4b 59 29 d3 75 | cf e5 4b 77 05 ec 73 28 61 cd 9b c5 2c ef 40 30 | 18 f7 49 09 02 f5 a6 e8 45 84 70 ae | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2423721247 (0x90770d1f) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6) | peer and cookies match on #1; msgid=90770d1f st_msgid=00000000 st_msgid_phase15=00000000 | State DB: IKEv1 state not found (find_v1_info_state) | No appropriate Mode Config state yet. See if we have a Main Mode state | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1678) | processing received isakmp_xchg_type ISAKMP_XCHG_MODE_CFG. | this is a xauthclient modecfgclient | call init_phase2_iv | set from_state to STATE_MAIN_I4 this is xauthclient and IS_PHASE1() is TRUE | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x4100 opt: 0x2000 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_MODECFG (0xe) | length: 36 (0x24) | got payload 0x4000 (ISAKMP_NEXT_MODECFG) needed: 0x4000 opt: 0x2000 | ***parse ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | Attr Msg Type: ISAKMP_CFG_REQUEST (0x1) | Identifier: 0 (0x0) | removing 12 bytes of padding | xauth_inI0 HASH(1): | 20 2b bb 61 b5 fa 60 eb be 11 54 41 77 53 ad 7f | 9e a9 c3 ac fb 73 70 86 0a a9 d6 1f 02 b8 d3 65 | received 'xauth_inI0' message HASH(1) data ok | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2423721247 (0x90770d1f) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 8:ISAKMP_NEXT_HASH | arrived in xauth_inI0 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: XAUTH-USER-NAME (0x4089) | length/value: 0 (0x0) | Received Cisco XAUTH username | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: XAUTH-USER-PASSWORD (0x408a) | length/value: 0 (0x0) | Received Cisco XAUTH password | XAUTH: Username or password request received | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | Attr Msg Type: ISAKMP_CFG_REPLY (0x2) | Identifier: 0 (0x0) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Mode Attribute (14:ISAKMP_NEXT_MODECFG) | next payload chain: saving location 'ISAKMP Mode Attribute'.'next payload type' in 'reply packet' | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: XAUTH-USER-NAME (0x4089) | prompting for Username: | emitting 5 raw bytes of XAUTH username into ISAKMP ModeCfg attribute | XAUTH username 78 72 6f 61 64 | emitting length of ISAKMP ModeCfg attribute: 5 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: XAUTH-USER-PASSWORD (0x408a) | started looking for xauth secret for xroad | line 0: key type PKK_XAUTH(@xroad) to type PKK_RSA | line 1: key type PKK_XAUTH(@xroad) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | looked up username=xroad, got=(nil) | prompting for Password: | emitting 8 raw bytes of XAUTH password into ISAKMP ModeCfg attribute | XAUTH password 75 73 65 31 70 61 73 73 | emitting length of ISAKMP ModeCfg attribute: 8 | emitting length of ISAKMP Mode Attribute: 29 "road-east" #1: XAUTH: Answering XAUTH challenge with user='xroad' | XAUTH: client response HASH(1): | d8 7a 32 4d ca a2 eb d4 20 c6 63 41 39 3b 5a 42 | 8a e6 25 f2 6e 83 b2 3a 0d 29 67 32 8c 2e 3b 00 | padding IKEv1 message with 3 bytes | emitting 3 zero bytes of message padding into ISAKMP Message | emitting length of ISAKMP Message: 96 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 108 | xauth_inI0(STF_OK) | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:yes, t_xauth_client_done:no | IKEv1: transition from state STATE_XAUTH_I0 to state STATE_XAUTH_I1 | parent state #1: MAIN_I4(established IKE SA) => XAUTH_I1(established IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x563f0712c538 | free_event_entry: release EVENT_SA_REPLACE-pe@0x563f071271e8 | sending reply packet to 192.1.2.23:500 (from 192.1.3.209:500) | sending 108 bytes for STATE_XAUTH_I0 through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #1) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 06 01 90 77 0d 1f 00 00 00 6c b4 83 e2 93 | 32 89 6c 10 81 f8 76 fa 67 45 6a e4 1d c9 56 0a | 05 7c e8 9a eb f0 e9 e3 2c e5 25 17 06 4c 26 f2 | c9 31 53 af de 96 af 19 ae 3a 92 80 f4 8c 51 0a | 6c fc 2a 76 31 1f 7d ce ad 6c b1 e4 7e 6e 71 eb | a8 0d 8f 61 2d 83 e0 79 83 0c f6 33 | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x563f071271e8 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x563f0712c5e8 size 128 | #1 STATE_XAUTH_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29856.942754 | pstats #1 ikev1.isakmp established "road-east" #1: STATE_XAUTH_I1: XAUTH client - possibly awaiting CFG_set {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | XAUTH client is not yet authenticated | #1 spent 0.337 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "road-east" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.511 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00198 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 76 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 06 01 13 9a 6c e8 00 00 00 4c f4 85 26 5d | 7c 43 c8 78 e3 f9 44 bc 7f da 86 22 2d 3f ca 0b | e4 56 72 62 b3 4b 26 95 70 b3 e6 2f 33 33 08 ea | c5 ca c1 2a d8 49 8c d6 51 f7 99 8c | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 328887528 (0x139a6ce8) | length: 76 (0x4c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6) | peer and cookies match on #1; msgid=139a6ce8 st_msgid=00000000 st_msgid_phase15=00000000 | State DB: IKEv1 state not found (find_v1_info_state) | No appropriate Mode Config state yet. See if we have a Main Mode state | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_XAUTH_I1 | State DB: found IKEv1 state #1 in XAUTH_I1 (find_v1_info_state) | start processing: state #1 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1678) | processing received isakmp_xchg_type ISAKMP_XCHG_MODE_CFG. | this is a xauthclient modecfgclient | call init_phase2_iv | set from_state to STATE_XAUTH_I1 this is xauthclient and state == STATE_XAUTH_I1 | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x4100 opt: 0x2000 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_MODECFG (0xe) | length: 36 (0x24) | got payload 0x4000 (ISAKMP_NEXT_MODECFG) needed: 0x4000 opt: 0x2000 | ***parse ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 12 (0xc) | Attr Msg Type: ISAKMP_CFG_SET (0x3) | Identifier: 0 (0x0) | xauth_inI0 HASH(1): | d6 d7 b7 0e 85 0a bd a9 b7 de 75 a0 9c c5 1d e2 | 4e 18 5a 81 f1 c6 24 6d 5f 9b 35 3d f2 34 b7 84 | received 'xauth_inI0' message HASH(1) data ok | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 328887528 (0x139a6ce8) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 8:ISAKMP_NEXT_HASH | arrived in xauth_inI0 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: AF+XAUTH-STATUS (0xc08f) | length/value: 1 (0x1) | Received Cisco XAUTH status: OK | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | Attr Msg Type: ISAKMP_CFG_ACK (0x4) | Identifier: 0 (0x0) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Mode Attribute (14:ISAKMP_NEXT_MODECFG) | next payload chain: saving location 'ISAKMP Mode Attribute'.'next payload type' in 'reply packet' | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: AF+XAUTH-STATUS (0xc08f) | length/value: 1 (0x1) | no IKEv1 message padding required | emitting length of ISAKMP Mode Attribute: 12 | XAUTH: ack status HASH(1): | 48 84 f8 e1 c1 96 d5 de 5f 0a 84 05 b5 9a 34 7a | f3 2e 89 90 bc b6 6c 3d fa fd 69 1f d0 2c 3d 52 | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 "road-east" #1: XAUTH: Successfully Authenticated | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:no, t_xauth_client_done:yes | IKEv1: transition from state STATE_XAUTH_I0 to state STATE_XAUTH_I1 | event_already_set, deleting event | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_XAUTH_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x563f0712c5e8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x563f071271e8 | sending reply packet to 192.1.2.23:500 (from 192.1.3.209:500) | sending 76 bytes for STATE_XAUTH_I0 through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #1) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 06 01 13 9a 6c e8 00 00 00 4c eb 91 ce 10 | d1 7e e1 90 ba b0 7e 9f 81 a4 98 7b 50 81 9c 38 | a0 b5 e4 d5 01 6f a5 c1 57 0f 2a 8c d9 62 04 47 | b8 67 2d 66 b2 36 f2 66 82 2e a6 6a | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x563f071271e8 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x563f071262e8 size 128 | #1 STATE_XAUTH_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29856.943473 | pstats #1 ikev1.isakmp established "road-east" #1: STATE_XAUTH_I1: XAUTH client - possibly awaiting CFG_set {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | modecfg pull: noquirk policy:pull modecfg-client | modecfg client is starting due to policy "road-east" #1: modecfg: Sending IP request (MODECFG_I1) | parent state #1: XAUTH_I1(established IKE SA) => MODE_CFG_I1(established IKE SA) | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1321770172 (0x4ec89cbc) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'xauth_buf' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | Attr Msg Type: ISAKMP_CFG_REQUEST (0x1) | Identifier: 0 (0x0) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Mode Attribute (14:ISAKMP_NEXT_MODECFG) | next payload chain: saving location 'ISAKMP Mode Attribute'.'next payload type' in 'xauth_buf' | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_ADDRESS (0x1) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_NETMASK (0x2) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_DNS (0x3) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: MODECFG_BANNER (0x7000) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: MODECFG_DOMAIN (0x7002) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: CISCO_SPLIT_INC (0x7004) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | no IKEv1 message padding required | emitting length of ISAKMP Mode Attribute: 32 | XAUTH: mode config request HASH(1): | 79 4c 02 62 47 df f6 d2 68 73 48 d5 ac fa 62 57 | 4d bc 0e 8d 3a 29 db 6b 35 ec 36 ec d8 e2 94 9c | no IKEv1 message padding required | emitting length of ISAKMP Message: 96 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 108 | sending 108 bytes for modecfg: req through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #1) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 06 01 4e c8 9c bc 00 00 00 6c 9c 8b 3d 75 | 79 db 9b 68 4a fc 0b cf 88 a1 06 75 bc 99 34 bc | 5b 61 1d b6 25 47 c6 16 c8 11 47 52 c9 d7 e6 f0 | 3e 82 17 54 aa 27 8e 71 67 c0 a6 0a af 6c 86 30 | 94 20 e8 dd 39 5d 36 92 79 b4 ae 43 df 82 8e ba | db 1a 16 9d bf 8e 88 51 4f b9 1c 80 | #1 spent 0.34 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "road-east" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.489 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00201 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 124 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 06 01 4e c8 9c bc 00 00 00 7c d5 67 bc ba | 8a 04 51 ac 17 55 8d ae f3 21 00 a4 28 94 b7 d2 | 12 59 7c 93 57 80 58 01 2f d8 c7 31 89 72 88 d2 | 07 58 c2 c3 16 47 52 00 5a 15 cd 89 da a2 d8 ff | 07 9b c6 8a 7c 83 16 5b 94 41 c3 6a ac 90 a5 a6 | ff c6 6c 1f 2b 38 1f 72 f3 c3 d7 e5 8f dd 9c c7 | aa fc 80 bd ec c0 21 40 02 36 35 d1 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1321770172 (0x4ec89cbc) | length: 124 (0x7c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6) | peer and cookies match on #1; msgid=4ec89cbc st_msgid=00000000 st_msgid_phase15=4ec89cbc | p15 state object #1 found, in STATE_MODE_CFG_I1 | State DB: found IKEv1 state #1 in MODE_CFG_I1 (find_v1_info_state) | start processing: state #1 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1802) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x4100 opt: 0x2000 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_MODECFG (0xe) | length: 36 (0x24) | got payload 0x4000 (ISAKMP_NEXT_MODECFG) needed: 0x4000 opt: 0x2000 | ***parse ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 60 (0x3c) | Attr Msg Type: ISAKMP_CFG_REPLY (0x2) | Identifier: 0 (0x0) | modecfg_inR1 HASH(1): | a8 bf 3d f5 88 c7 b9 b1 aa c9 c2 ce 60 39 a1 86 | 27 55 33 77 10 fd 1c dd 24 ab 1f e8 33 a6 70 2c | received 'modecfg_inR1' message HASH(1) data ok | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1321770172 (0x4ec89cbc) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 8:ISAKMP_NEXT_HASH | modecfg_inR1: received mode cfg reply | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_ADDRESS (0x1) | length/value: 4 (0x4) | parsing 4 raw bytes of ISAKMP ModeCfg attribute into addr | addr c0 00 02 65 "road-east" #1: Received IPv4 address: 192.0.2.101/32 | setting ip source address to 192.0.2.101/32 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_NETMASK (0x2) | length/value: 4 (0x4) | parsing 4 raw bytes of ISAKMP ModeCfg attribute into addr | addr ff ff ff 00 | Received IP4 NETMASK 255.255.255.0 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_DNS (0x3) | length/value: 4 (0x4) | parsing 4 raw bytes of ISAKMP ModeCfg attribute into addr | addr 01 02 03 04 "road-east" #1: Received DNS server 1.2.3.4 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_DNS (0x3) | length/value: 4 (0x4) | parsing 4 raw bytes of ISAKMP ModeCfg attribute into addr | addr 05 06 07 08 "road-east" #1: Received DNS server 5.6.7.8 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: CISCO_SPLIT_INC (0x7004) | length/value: 14 (0xe) | *****parse CISCO split item: | IPv4 address: c0 00 02 00 | IPv4 mask: ff ff ff 00 "road-east" #1: Received subnet 192.0.2.0/24 "road-east" #1: Subnet 192.0.2.0/24 already has an spd_route - ignoring | modecfg_inR1(STF_OK) | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #1 is idle | doing_xauth:no, t_xauth_client_done:yes | IKEv1: transition from state STATE_MODE_CFG_I1 to state STATE_MAIN_I4 | parent state #1: MODE_CFG_I1(established IKE SA) => MAIN_I4(established IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I4: retransmits: cleared | libevent_free: release ptr-libevent@0x563f071262e8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x563f071271e8 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x563f071271e8 | inserting event EVENT_SA_REPLACE, timeout in 3330 seconds for #1 | libevent_malloc: new ptr-libevent@0x563f07137d78 size 128 | pstats #1 ikev1.isakmp established "road-east" #1: STATE_MAIN_I4: ISAKMP SA established {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | modecfg pull: noquirk policy:pull modecfg-client | phase 1 is done, looking for phase 2 to unpend | unpending state #1 | creating state object #2 at 0x563f0712a778 | State DB: adding IKEv1 state #2 in UNDEFINED | pstats #2 ikev1.ipsec started | duplicating state object #1 "road-east" as #2 for IPSEC SA | #2 setting local endpoint to 192.1.3.209:500 from #1.st_localport (in duplicate_state() at state.c:1484) | suspend processing: state #1 connection "road-east" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | start processing: state #2 connection "road-east" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | child state #2: UNDEFINED(ignore) => QUICK_I1(established CHILD SA) "road-east" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:bb7c7059 proposal=defaults pfsgroup=MODP2048} | adding quick_outI1 KE work-order 3 for state #2 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x563f07125108 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x563f0712e458 size 128 | libevent_realloc: release ptr-libevent@0x563f070b7268 | libevent_realloc: new ptr-libevent@0x563f0711efe8 size 128 | stop processing: state #2 connection "road-east" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | resume processing: state #1 connection "road-east" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | unqueuing pending Quick Mode with 192.1.2.23 "road-east" | removing pending policy for no connection {0x563f0710a9b8} | close_any(fd@22) (in release_whack() at state.c:654) | #1 spent 0.232 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "road-east" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.355 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 3 resuming | crypto helper 3 starting work-order 3 for state #2 | crypto helper 3 doing build KE and nonce (quick_outI1 KE); request ID 3 | crypto helper 3 finished build KE and nonce (quick_outI1 KE); request ID 3 time elapsed 0.000856 seconds | (#2) spent 0.85 milliseconds in crypto helper computing work-order 3: quick_outI1 KE (pcr) | crypto helper 3 sending results from work-order 3 for state #2 to event queue | scheduling resume sending helper answer for #2 | libevent_malloc: new ptr-libevent@0x7f6490003f28 size 128 | crypto helper 3 waiting (nothing to do) | processing resume sending helper answer for #2 | start processing: state #2 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 3 replies to request ID 3 | calling continuation function 0x563f04fc7b50 | quick_outI1_continue for #2: calculated ke+nonce, sending I1 | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3145494617 (0xbb7c7059) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | emitting quick defaults using policy none | empty esp_info, returning defaults for ENCRYPT | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 2 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0xa025d003 for esp.0@192.1.3.209 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI a0 25 d0 03 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ESP): 32 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 1 (0x1) | ESP transform ID: ESP_3DES (0x3) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | emitting length of ISAKMP Transform Payload (ESP): 28 | emitting length of ISAKMP Proposal Payload: 72 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 84 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni 3e 66 f0 ec df 43 77 2b c7 79 95 31 7a fa e2 ca | Ni 2f 92 82 d6 bc ef 4f 1c 38 ae 2d c0 45 34 41 bd | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 53 00 61 bf ed a2 8d 1e 22 e0 62 60 e0 e5 7b 5f | keyex value c9 d0 32 f9 74 34 af 7a c4 04 60 ab e2 84 31 29 | keyex value d2 50 0a 41 71 c7 1a da 4d 25 d6 86 48 9a 47 cb | keyex value 3f f0 2f 66 42 a8 b8 19 13 9c 83 a1 3a 2e b3 86 | keyex value 4e 99 33 58 57 4a 81 36 a0 2f d5 7b 19 cd aa ae | keyex value 38 61 c9 04 2e 99 03 c1 4f b5 66 fa cd e1 cf bd | keyex value 97 61 e9 1e 23 53 fb fa 04 b7 3e 73 7d 7f fa 04 | keyex value 8c fe 56 d4 b5 df dc 7c 95 a1 71 83 df 99 38 7b | keyex value 61 fc 36 2a 4d 16 18 b7 47 c3 90 d8 30 af fa 07 | keyex value 54 2f 00 5a d3 1b cc fc b5 bc 80 08 24 ef 88 51 | keyex value 7c 7a d1 ce 80 55 73 52 de 4e b8 df 85 04 4c 6a | keyex value d3 cd a8 75 e3 0d 02 c0 68 01 73 7b d3 9d 2a 1c | keyex value ce 15 b3 fc 31 1c 4f 65 0d 8b 9b 04 0a 0f cb bd | keyex value 70 b1 1f d6 b9 99 ed fa 6d f4 b2 c8 d1 72 e5 05 | keyex value 1c ee bb 17 ca 30 63 2e ab 28 70 af f2 14 07 2f | keyex value 53 10 6a 33 8d b8 e4 6d d1 60 37 27 ca c1 8f b9 | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR (0x1) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 02 65 | emitting length of ISAKMP Identification Payload (IPsec DOI): 12 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 02 00 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff 00 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | outI1 HASH(1): | 28 1b 87 73 71 a3 64 9e a9 d0 56 69 e4 66 9f 5d | 90 4b b2 58 ec f9 f3 ee 7a dc d3 4f cd 72 ce 7a | emitting 4 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 476 | sending 476 bytes for reply packet from quick_outI1 through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #2) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 20 01 bb 7c 70 59 00 00 01 dc c0 1b 00 76 | 87 c0 e0 99 7a 23 00 77 0f 83 71 db 26 f7 85 97 | ac 25 5b fd 24 85 9a dd cc 18 1a a9 18 7d a5 30 | 2b 72 ec c9 73 ec 26 48 7d 3f d7 4b e9 e3 e5 3e | bb da 87 2b 9b 6c 9e 17 1e 96 95 ab 1f 53 fd 58 | 5e 18 49 75 82 b1 85 13 27 8c 9d ee 62 a2 8f cc | 31 7f d7 fd 61 57 3b a5 e6 7b 64 01 ae b0 8b 1f | 86 ca 15 2d 94 43 27 1f b1 49 17 3e 12 dd 8b f6 | ca e2 f4 21 d8 6b 8f 23 f5 01 16 40 6d 37 ba a7 | bf 96 82 2c 1c 16 f1 df 68 cc 30 4e 62 81 fb cd | 67 c7 65 8f ad 72 f3 f3 51 4e 9a 94 67 d1 26 d7 | 83 ef 52 56 5f d3 63 a8 32 2b 78 eb 86 43 5c 1a | 7c e5 6e 70 c6 98 83 fe 95 7f 73 6d c1 42 c2 42 | 66 3d c2 da bb 0b c8 06 e4 b3 f8 48 f0 84 b0 ba | 2d 96 b6 f5 de aa 4b 06 ee ae 28 80 67 3f 21 5f | 97 41 d2 9b f0 96 5c e0 c1 58 24 7a 85 76 49 b7 | d9 ca d7 0f 22 62 b5 f9 dc 98 14 80 c8 0b 8b 59 | db 9a 93 59 1b 56 a3 44 ed 3f 8f 80 9f 67 e8 ab | 97 e0 92 f5 fa ca 98 f7 03 c5 6f 03 99 02 00 4c | 52 e6 36 9e 98 66 b5 c1 4a 24 55 84 63 87 97 13 | 35 5f 44 1e 37 92 c2 1e 01 68 c7 4a c4 6a c8 c8 | 1a 16 89 05 d0 ba 39 cb b6 18 61 ae 81 5e 24 c1 | c6 59 84 88 09 08 7c f8 87 93 2f d2 84 9d 34 d3 | 17 dc 9a ac 2b 63 99 31 90 26 bb c4 6d 62 9e de | 72 0c 36 6a 04 4a f7 07 2a bd 59 fd 19 dd ab 33 | 28 e8 8b ac 39 31 70 ee 36 57 0f f4 7c d6 51 bd | 96 f5 66 25 1d c7 37 a4 ed c3 40 6a a1 57 95 cf | 1b 09 32 8f 1b e1 7b da 6c 3d 26 68 68 ee 6d 01 | 82 c4 a0 a6 51 ed 23 0c 87 70 5b e9 | state #2 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x563f0712e458 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x563f07125108 | event_schedule: new EVENT_RETRANSMIT-pe@0x563f07125108 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #2 | libevent_malloc: new ptr-libevent@0x563f07137fd8 size 128 | #2 STATE_QUICK_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29856.946582 | resume sending helper answer for #2 suppresed complete_v1_state_transition() | #2 spent 1.21 milliseconds in resume sending helper answer | stop processing: state #2 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f6490003f28 | spent 0.0034 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 444 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 20 01 bb 7c 70 59 00 00 01 bc 84 13 c8 f4 | a6 76 98 e8 0a 81 8e 9b 20 f4 c3 69 a3 82 b3 41 | 67 5e 9b 5e 22 72 d2 22 2a e9 32 65 7d 5b 66 49 | 2f 06 c9 8d e7 bd 0f 11 10 4d f7 40 27 c5 ec 67 | 07 f9 45 e7 d8 69 bb 66 00 55 50 39 ef 9b c1 20 | 37 c4 7f e6 45 7f cf 66 71 de 64 e5 bd f7 24 19 | f0 d6 55 1a 65 95 22 78 31 05 61 92 5c 1a 6a c9 | 30 ed ed 66 52 43 41 ed 0d fc cb a3 4e 0c a3 93 | 5a be 75 4c 6b 6b fa 65 26 e3 74 f6 00 d1 93 f5 | 17 27 83 e0 08 44 30 31 a4 d2 07 9a 67 b1 ab 56 | c6 85 44 3b 98 ce a8 d7 9f e8 5b ec d5 53 64 d4 | df 28 69 14 71 5e 8f be 31 cf 87 60 10 a2 62 be | 12 67 77 fe 8b 7e 56 71 9f 97 57 50 96 9d 72 ae | 55 ee 5d dc d3 01 2b b7 94 25 7e ec bc c2 ca 9a | 4e 65 55 24 ec 88 37 aa b6 d4 6b 9f a0 e8 e6 24 | 7b f0 34 21 15 b6 00 3f ff 93 04 4f 8c 22 b4 52 | d3 b7 98 a5 54 82 86 24 c3 46 66 e9 98 24 64 d6 | e3 e9 5e c2 47 42 3b cf 14 c9 be 2a 28 5d c1 5a | 37 84 b5 19 09 a3 af 7e 1e a9 53 cd e7 3b be 33 | 12 65 14 2b 6b 62 a3 ba ad 20 73 99 ab 93 5b 9c | db 86 08 2c 32 5f c1 ec 2a c8 29 16 a1 c8 b9 7f | 58 cd 45 ab ba 66 46 8b 2d ee 32 b5 db a9 85 73 | c1 64 34 22 3c a0 f6 2b e1 c1 3d 41 aa c5 fd 06 | 81 17 59 48 5d 63 83 48 d2 89 cb c1 cc b8 75 51 | 12 0d 97 db f7 b2 21 5b f2 6b 15 64 de 89 c4 69 | 20 ab 3d 16 a5 bd 82 c9 90 55 5a ab 66 85 9d 06 | c2 1d 07 93 c3 58 1f 12 0d 93 11 ba | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3145494617 (0xbb7c7059) | length: 444 (0x1bc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #2 in QUICK_I1 (find_state_ikev1) | start processing: state #2 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1633) | #2 is idle | #2 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 12 (0xc) | ID type: ID_IPV4_ADDR (0x1) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 65 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 00 ff ff ff 00 | quick_inR1_outI2 HASH(2): | eb d8 db bf c8 f7 93 e6 45 e7 a6 23 f1 3f ed ea | 5f d2 15 3e 3f 80 f3 20 ce df ce c5 f5 0d 95 78 | received 'quick_inR1_outI2' message HASH(2) data ok | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI 28 18 98 99 | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org->C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org of kind PKK_PSK | actually looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org->C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org of kind PKK_PSK | line 0: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org) to type PKK_RSA | line 1: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outI2 DH work-order 4 for state #2 | state #2 requesting EVENT_RETRANSMIT to be deleted | #2 STATE_QUICK_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x563f07137fd8 | free_event_entry: release EVENT_RETRANSMIT-pe@0x563f07125108 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x563f07125108 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f6490003f28 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #2 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2648) | suspending state #2 and saving MD | #2 is busy; has a suspended MD | #2 spent 0.158 milliseconds in process_packet_tail() | crypto helper 4 resuming | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | crypto helper 4 starting work-order 4 for state #2 | stop processing: state #2 connection "road-east" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | crypto helper 4 doing compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 4 | spent 0.384 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 4 finished compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 4 time elapsed 0.000895 seconds | (#2) spent 0.888 milliseconds in crypto helper computing work-order 4: quick outI2 DH (pcr) | crypto helper 4 sending results from work-order 4 for state #2 to event queue | scheduling resume sending helper answer for #2 | libevent_malloc: new ptr-libevent@0x7f6484001f78 size 128 | crypto helper 4 waiting (nothing to do) | processing resume sending helper answer for #2 | start processing: state #2 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 4 replies to request ID 4 | calling continuation function 0x563f04fc7b50 | quick_inR1_outI2_continue for #2: calculated ke+nonce, calculating DH | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3145494617 (0xbb7c7059) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 65 | our client is 192.0.2.101/32 | our client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 00 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff 00 | peer client is subnet 192.0.2.0/24 | peer client protocol/port is 0/0 | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | quick_inR1_outI2 HASH(3): | 3a 79 c3 50 cb ce 3f 33 7a b3 c2 4b 47 5e 92 75 | aa 79 b2 43 88 bd b0 33 c5 f1 af f2 b6 67 30 0e | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | install_ipsec_sa() for #2: inbound and outbound | could_route called for road-east (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn road-east mark 0/00000000, 0/00000000 vs | conn road-east mark 0/00000000, 0/00000000 | route owner of "road-east" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'road-east' not available on interface eth0 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.28189899@192.1.2.23 included non-error error | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'road-east' not available on interface eth0 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.a025d003@192.1.3.209 included non-error error | priority calculation of connection "road-east" is 0xfdfe7 | add inbound eroute 192.0.2.0/24:0 --0-> 192.0.2.101/32:0 => tun.10000@192.1.3.209 (raw_eroute) | IPsec Sa SPD priority set to 1040359 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #2: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn road-east mark 0/00000000, 0/00000000 vs | conn road-east mark 0/00000000, 0/00000000 | route owner of "road-east" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: road-east (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #2 | priority calculation of connection "road-east" is 0xfdfe7 | eroute_connection add eroute 192.0.2.101/32:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1040359 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='road-east' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.209' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.101/32' PLUTO_MY_CLIENT_NET='192.0.2.101' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' P | popen cmd is 1370 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='road-east' PLUTO_IN: | cmd( 80):TERFACE='eth0' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.209' PLUTO_MY_ID=': | cmd( 160):C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.li: | cmd( 240):breswan.org, E=user-road@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.101/32': | cmd( 320): PLUTO_MY_CLIENT_NET='192.0.2.101' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_: | cmd( 400):MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLU: | cmd( 480):TO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU: | cmd( 560):=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.o: | cmd( 640):rg' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEE: | cmd( 720):R_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_: | cmd( 800):PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCR: | cmd( 880):YPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_: | cmd( 960):NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 P: | cmd(1040):LUTO_USERNAME='xroad' PLUTO_MY_SOURCEIP='192.0.2.101' PLUTO_IS_PEER_CISCO='0' PL: | cmd(1120):UTO_PEER_DNS_INFO='1.2.3.4 5.6.7.8' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER=: | cmd(1200):'' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI_IFACE=': | cmd(1280):' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x28189899 SPI_OUT=0xa025d003 ipsec _u: | cmd(1360):pdown 2>&1: "road-east" #2: up-client output: updating resolvconf "road-east" #2: up-client output: rm: cannot remove '/etc/resolv.conf': Device or resource busy | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='road-east' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.209' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.101/32' PLUTO_MY_CLIENT_NET='192.0.2.101' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PE | popen cmd is 1375 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='road-east' PLU: | cmd( 80):TO_INTERFACE='eth0' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.209' PLUTO_MY: | cmd( 160):_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testi: | cmd( 240):ng.libreswan.org, E=user-road@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.10: | cmd( 320):1/32' PLUTO_MY_CLIENT_NET='192.0.2.101' PLUTO_MY_CLIENT_MASK='255.255.255.255' P: | cmd( 400):LUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP: | cmd( 480):' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswa: | cmd( 560):n, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libres: | cmd( 640):wan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUT: | cmd( 720):O_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' P: | cmd( 800):LUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG: | cmd( 880):+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW: | cmd( 960):+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILE: | cmd(1040):D=0 PLUTO_USERNAME='xroad' PLUTO_MY_SOURCEIP='192.0.2.101' PLUTO_IS_PEER_CISCO=': | cmd(1120):0' PLUTO_PEER_DNS_INFO='1.2.3.4 5.6.7.8' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BA: | cmd(1200):NNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI_IF: | cmd(1280):ACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x28189899 SPI_OUT=0xa025d003 ips: | cmd(1360):ec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='road-east' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.209' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.101/32' PLUTO_MY_CLIENT_NET='192.0.2.101' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMAN | popen cmd is 1373 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='road-east' PLUTO: | cmd( 80):_INTERFACE='eth0' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.209' PLUTO_MY_I: | cmd( 160):D='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing: | cmd( 240):.libreswan.org, E=user-road@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.101/: | cmd( 320):32' PLUTO_MY_CLIENT_NET='192.0.2.101' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLU: | cmd( 400):TO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' : | cmd( 480):PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan,: | cmd( 560): OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswa: | cmd( 640):n.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_: | cmd( 720):PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLU: | cmd( 800):TO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+E: | cmd( 880):NCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+E: | cmd( 960):SN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=: | cmd(1040):0 PLUTO_USERNAME='xroad' PLUTO_MY_SOURCEIP='192.0.2.101' PLUTO_IS_PEER_CISCO='0': | cmd(1120): PLUTO_PEER_DNS_INFO='1.2.3.4 5.6.7.8' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANN: | cmd(1200):ER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI_IFAC: | cmd(1280):E='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x28189899 SPI_OUT=0xa025d003 ipsec: | cmd(1360): _updown 2>&1: "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. "road-east" #2: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "road-east", setting eroute_owner {spd=0x563f0711e098,sr=0x563f0711e098} to #2 (was #0) (newest_ipsec_sa=#0) | #1 spent 2.38 milliseconds in install_ipsec_sa() | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 | inR1_outI2: instance road-east[0], setting IKEv1 newest_ipsec_sa to #2 (was #0) (spd.eroute=#2) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #2 connection "road-east" from 192.1.2.23 (in complete_v1_state_transition() at ikev1.c:2673) | #2 is idle | doing_xauth:no, t_xauth_client_done:yes | IKEv1: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 | child state #2: QUICK_I1(established CHILD SA) => QUICK_I2(established CHILD SA) | event_already_set, deleting event | state #2 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7f6490003f28 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x563f07125108 | sending reply packet to 192.1.2.23:500 (from 192.1.3.209:500) | sending 76 bytes for STATE_QUICK_I1 through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #2) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 20 01 bb 7c 70 59 00 00 00 4c 4a 0a 4d 4d | 2e 68 7d 00 9a 2b 96 7a e1 74 4a 47 62 1a 0f 2a | a7 27 54 57 51 d0 3c c1 7f 10 84 ed ba 73 7e f0 | eb 80 0e 83 45 00 2a e9 6e ce 5a cb | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x563f07125108 | inserting event EVENT_SA_REPLACE, timeout in 28048 seconds for #2 | libevent_malloc: new ptr-libevent@0x563f0712c5e8 size 128 | pstats #2 ikev1.ipsec established | NAT-T: encaps is 'auto' "road-east" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0x28189899 <0xa025d003 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive username=xroad} | modecfg pull: noquirk policy:pull modecfg-client | phase 1 is done, looking for phase 2 to unpend | close_any(fd@23) (in release_whack() at state.c:654) | resume sending helper answer for #2 suppresed complete_v1_state_transition() | #2 spent 3.12 milliseconds in resume sending helper answer | stop processing: state #2 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f6484001f78 | kernel_process_msg_cb process netlink message | netlink_get: XFRM_MSG_DELPOLICY message | xfrm netlink address change RTM_NEWADDR msg len 76 | XFRM RTM_NEWADDR 192.0.2.101 IFA_LOCAL | FOR_EACH_STATE_... in record_newaddr (for_each_state) | start processing: state #2 connection "road-east" from 192.1.2.23 (in for_each_state() at state.c:1575) | stop processing: state #2 connection "road-east" from 192.1.2.23 (in for_each_state() at state.c:1577) | start processing: state #1 connection "road-east" from 192.1.2.23 (in for_each_state() at state.c:1575) | stop processing: state #1 connection "road-east" from 192.1.2.23 (in for_each_state() at state.c:1577) | IKEv2 received address RTM_NEWADDR type 3 | IKEv2 received address RTM_NEWADDR type 8 | IKEv2 received address RTM_NEWADDR type 6 | netlink_get: XFRM_MSG_EXPIRE message | netlink_get: XFRM_MSG_EXPIRE message | spent 0.396 milliseconds in kernel message | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00417 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00261 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00255 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:722) | FOR_EACH_STATE_... in show_traffic_status (sort_states) | FOR_EACH_STATE_... in sort_states | get_sa_info esp.a025d003@192.1.3.209 | get_sa_info esp.28189899@192.1.2.23 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.335 milliseconds in whack | spent 0.00324 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 05 01 29 5c 38 30 00 00 00 5c 8f 61 9f d2 | 41 cf 6a 27 40 18 2d 51 9b 10 c0 b2 82 1e 67 84 | eb e0 8c 16 71 a1 b1 0d bb f4 ef d0 2f 12 0e e1 | 7d 3c 04 6f a3 ab b8 9f ec 06 15 77 f9 d7 e8 88 | be 5c 2e 6e 95 b9 ab 72 6b e3 09 8e | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 693909552 (0x295c3830) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #2; msgid=00000000 st_msgid=bb7c7059 st_msgid_phase15=00000000 | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | 4b 80 aa bd 4e ba 59 1f 85 99 3a 45 f6 4e 9a a9 | 94 9a 35 7b 0f d9 c7 f1 81 63 f1 13 93 68 1a f4 | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI 28 18 98 99 | FOR_EACH_STATE_... in find_phase2_state_to_delete | start processing: connection "road-east" (BACKGROUND) (in accept_delete() at ikev1_main.c:2515) "road-east" #1: received Delete SA payload: replace IPsec State #2 now | state #2 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x563f0712c5e8 | free_event_entry: release EVENT_SA_REPLACE-pe@0x563f07125108 | event_schedule: new EVENT_SA_REPLACE-pe@0x563f07125108 | inserting event EVENT_SA_REPLACE, timeout in 0 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f6484001f78 size 128 | stop processing: connection "road-east" (BACKGROUND) (in accept_delete() at ikev1_main.c:2559) | del: | complete v1 state transition with STF_IGNORE | #1 spent 0.00356 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "road-east" from 192.1.2.23 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.213 milliseconds in comm_handle_cb() reading and processing packet | timer_event_cb: processing event@0x563f07125108 | handling event EVENT_SA_REPLACE for child state #2 | start processing: state #2 connection "road-east" from 192.1.2.23 (in timer_event_cb() at timer.c:250) | picked newest_ipsec_sa #2 for #2 | replacing stale IPsec SA | dup_any(fd@-1) -> fd@-1 (in ipsecdoi_replace() at ipsec_doi.c:351) | FOR_EACH_STATE_... in find_phase1_state | creating state object #3 at 0x563f07139778 | State DB: adding IKEv1 state #3 in UNDEFINED | pstats #3 ikev1.ipsec started | duplicating state object #1 "road-east" as #3 for IPSEC SA | #3 setting local endpoint to 192.1.3.209:500 from #1.st_localport (in duplicate_state() at state.c:1484) | suspend processing: state #2 connection "road-east" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | start processing: state #3 connection "road-east" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:685) | child state #3: UNDEFINED(ignore) => QUICK_I1(established CHILD SA) "road-east" #3: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO to replace #2 {using isakmp#1 msgid:683e2cce proposal=defaults pfsgroup=MODP2048} | adding quick_outI1 KE work-order 5 for state #3 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7f6490004218 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: new ptr-libevent@0x563f071262e8 size 128 | stop processing: state #3 connection "road-east" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | resume processing: state #2 connection "road-east" from 192.1.2.23 (in quick_outI1() at ikev1_quick.c:764) | event_schedule: new EVENT_SA_EXPIRE-pe@0x563f070b7268 | inserting event EVENT_SA_EXPIRE, timeout in 0 seconds for #2 | libevent_malloc: new ptr-libevent@0x563f070f9e08 size 128 | libevent_free: release ptr-libevent@0x7f6484001f78 | free_event_entry: release EVENT_SA_REPLACE-pe@0x563f07125108 | #2 spent 0.104 milliseconds in timer_event_cb() EVENT_SA_REPLACE | stop processing: state #2 connection "road-east" from 192.1.2.23 (in timer_event_cb() at timer.c:557) | timer_event_cb: processing event@0x563f070b7268 | handling event EVENT_SA_EXPIRE for child state #2 | start processing: state #2 connection "road-east" from 192.1.2.23 (in timer_event_cb() at timer.c:250) | picked newest_ipsec_sa #2 for #2 | un-established partial CHILD SA timeout (SA expired) | pstats #2 ikev1.ipsec re-failed exchange-timeout | pstats #2 ikev1.ipsec deleted completed | [RE]START processing: state #2 connection "road-east" from 192.1.2.23 (in delete_state() at state.c:879) "road-east" #2: deleting state (STATE_QUICK_I2) aged 4.090s and sending notification | child state #2: QUICK_I2(established CHILD SA) => delete | get_sa_info esp.28189899@192.1.2.23 | get_sa_info esp.a025d003@192.1.3.209 "road-east" #2: ESP traffic information: in=336B out=336B XAUTHuser=xroad | #2 send IKEv1 delete notification for STATE_QUICK_I2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1678802642 (0x64107ed2) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload a0 25 d0 03 | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | 24 28 14 7e fe a5 4a 9e 48 60 bc 40 b9 5b 02 49 | b4 9f 80 ff 1a 26 b6 d1 b6 1a a5 44 c2 10 88 ce | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #1) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 05 01 64 10 7e d2 00 00 00 5c 83 ae 83 01 | 38 09 69 5f 31 05 0c 1b aa c0 7f d7 ad 1f ad 21 | 67 df 88 3d bd 13 e9 b1 e3 56 e6 ba a2 3d 5a 7f | 15 6c 8b ed 47 7d 93 4f 4d e3 3d 93 5e 29 be fa | e4 b0 1e c9 43 74 12 53 24 9d 2b de | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='road-east' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.209' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.libreswan.org, E=user-road@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.101/32' PLUTO_MY_CLIENT_NET='192.0.2.101' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844571' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK | popen cmd is 1381 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='road-east' PLUTO_: | cmd( 80):INTERFACE='eth0' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.209' PLUTO_MY_ID: | cmd( 160):='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=road.testing.: | cmd( 240):libreswan.org, E=user-road@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.101/3: | cmd( 320):2' PLUTO_MY_CLIENT_NET='192.0.2.101' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUT: | cmd( 400):O_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' P: | cmd( 480):LUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, : | cmd( 560):OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan: | cmd( 640):.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_P: | cmd( 720):EER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUT: | cmd( 800):O_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1566844571' PLUTO_CONN_POLICY=': | cmd( 880):RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG: | cmd( 960):_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH: | cmd(1040):_FAILED=0 PLUTO_USERNAME='xroad' PLUTO_MY_SOURCEIP='192.0.2.101' PLUTO_IS_PEER_C: | cmd(1120):ISCO='0' PLUTO_PEER_DNS_INFO='1.2.3.4 5.6.7.8' PLUTO_PEER_DOMAIN_INFO='' PLUTO_P: | cmd(1200):EER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' : | cmd(1280):VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x28189899 SPI_OUT=0xa025d0: | cmd(1360):03 ipsec _updown 2>&1: | crypto helper 6 resuming | crypto helper 6 starting work-order 5 for state #3 | crypto helper 6 doing build KE and nonce (quick_outI1 KE); request ID 5 | crypto helper 6 finished build KE and nonce (quick_outI1 KE); request ID 5 time elapsed 0.000838 seconds | (#3) spent 0.847 milliseconds in crypto helper computing work-order 5: quick_outI1 KE (pcr) | crypto helper 6 sending results from work-order 5 for state #3 to event queue | scheduling resume sending helper answer for #3 | libevent_malloc: new ptr-libevent@0x7f6488002888 size 128 | crypto helper 6 waiting (nothing to do) "road-east" #2: down-client output: restoring resolvconf | shunt_eroute() called for connection 'road-east' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 0--0->-0 | netlink_shunt_eroute for proto 0, and source port 0 dest port 0 | priority calculation of connection "road-east" is 0xfdfe7 | IPsec Sa SPD priority set to 1040359 | delete esp.28189899@192.1.2.23 | netlink response for Del SA esp.28189899@192.1.2.23 included non-error error | priority calculation of connection "road-east" is 0xfdfe7 | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.2.101/32:0 => unk255.10000@192.1.3.209 (raw_eroute) | raw_eroute result=success | delete esp.a025d003@192.1.3.209 | netlink response for Del SA esp.a025d003@192.1.3.209 included non-error error | in connection_discard for connection road-east | State DB: deleting IKEv1 state #2 in QUICK_I2 | child state #2: QUICK_I2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #2 from 192.1.2.23 (in delete_state() at state.c:1143) | libevent_free: release ptr-libevent@0x563f070f9e08 | free_event_entry: release EVENT_SA_EXPIRE-pe@0x563f070b7268 | in statetime_stop() and could not find #2 | processing: STOP state #0 (in timer_event_cb() at timer.c:557) | spent 0.00285 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth0 (192.1.3.209:500) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 05 01 d7 ab 22 e3 00 00 00 5c 5c 56 d7 27 | ab df 9a e0 97 e9 3b dc 63 7f 5d 3c 1c 57 25 a6 | bb 06 e0 b1 83 a0 6a 6b a8 13 46 27 8e 90 a0 3a | 03 2a fa 51 9e 22 93 40 7a be 19 fb 6d 45 14 44 | f2 8a 86 dc d2 47 40 c0 5b 9d b8 d6 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3618317027 (0xd7ab22e3) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #3; msgid=00000000 st_msgid=683e2cce st_msgid_phase15=00000000 | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "road-east" from 192.1.2.23 (in process_v1_packet() at ikev1.c:1479) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 28 (0x1c) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 1 (0x1) | SPI size: 16 (0x10) | number of SPIs: 1 (0x1) | informational HASH(1): | 2b 5c 06 96 8b 87 40 13 02 3e 24 1d d1 9f b6 54 | 9a a6 fa a8 85 fd 22 c4 8b 99 a5 2f 8b ab 41 28 | received 'informational' message HASH(1) data ok | parsing 8 raw bytes of ISAKMP Delete Payload into iCookie | iCookie 73 37 a3 72 2c 29 3b a5 | parsing 8 raw bytes of ISAKMP Delete Payload into rCookie | rCookie bd ee 07 08 d4 7a e6 57 | State DB: found IKEv1 state #1 in MAIN_I4 (find_state_ikev1) | del: "road-east" #1: received Delete SA payload: self-deleting ISAKMP State #1 | pstats #1 ikev1.isakmp deleted completed | [RE]START processing: state #1 connection "road-east" from 192.1.2.23 (in delete_state() at state.c:879) "road-east" #1: deleting state (STATE_MAIN_I4) aged 4.266s and sending notification | parent state #1: MAIN_I4(established IKE SA) => delete | #1 send IKEv1 delete notification for STATE_MAIN_I4 | **emit ISAKMP Message: | initiator cookie: | 73 37 a3 72 2c 29 3b a5 | responder cookie: | bd ee 07 08 d4 7a e6 57 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2031252247 (0x79127317) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 1 (0x1) | SPI size: 16 (0x10) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 8 raw bytes of initiator SPI into ISAKMP Delete Payload | initiator SPI 73 37 a3 72 2c 29 3b a5 | emitting 8 raw bytes of responder SPI into ISAKMP Delete Payload | responder SPI bd ee 07 08 d4 7a e6 57 | emitting length of ISAKMP Delete Payload: 28 | send delete HASH(1): | 07 1c 38 3d 97 41 6f 17 7a 99 00 e5 e0 ce 92 47 | c2 76 90 64 4b c4 81 b8 51 65 5d 6c 90 59 6a 0e | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #1) | 73 37 a3 72 2c 29 3b a5 bd ee 07 08 d4 7a e6 57 | 08 10 05 01 79 12 73 17 00 00 00 5c d2 4e eb 84 | 32 7c c2 b1 d0 27 50 48 70 ff 7a 2d 92 6f 92 87 | 67 58 1f 00 bc ef e8 bd d9 a3 36 3e b1 16 4a 68 | 6e f5 ae 7d 57 3f 0e bb 11 5e 2e 6f 50 d3 3e bc | 9e f0 66 b5 4d 17 c3 8d 56 e5 e3 df | state #1 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x563f07137d78 | free_event_entry: release EVENT_SA_REPLACE-pe@0x563f071271e8 "road-east" #1: reschedule pending child #3 STATE_QUICK_I1 of connection "road-east" - the parent is going away | state #3 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x563f071262e8 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7f6490004218 | event_schedule: new EVENT_SA_REPLACE-pe@0x563f071271e8 | inserting event EVENT_SA_REPLACE, timeout in 0 seconds for #3 | libevent_malloc: new ptr-libevent@0x563f0713a268 size 128 | State DB: IKEv1 state not found (flush_incomplete_children) | picked newest_isakmp_sa #0 for #1 "road-east" #1: deleting IKE SA for connection 'road-east' but connection is supposed to remain up; schedule EVENT_REVIVE_CONNS | add revival: connection 'road-east' added to the list and scheduled for 0 seconds | global one-shot timer EVENT_REVIVE_CONNS scheduled in 0 seconds | in connection_discard for connection road-east | State DB: deleting IKEv1 state #1 in MAIN_I4 | parent state #1: MAIN_I4(established IKE SA) => UNDEFINED(ignore) | unreference key: 0x563f07131508 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 2-- | stop processing: state #1 from 192.1.2.23 (in delete_state() at state.c:1143) | unreference key: 0x563f07131508 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 1-- | unreference key: 0x563f07131758 user-east@testing.libreswan.org cnt 1-- | unreference key: 0x563f07133298 @east.testing.libreswan.org cnt 1-- | unreference key: 0x563f07133388 east@testing.libreswan.org cnt 1-- | unreference key: 0x563f07143268 192.1.2.23 cnt 1-- | in statetime_start() with no state | complete v1 state transition with STF_IGNORE | stop processing: from 192.1.2.23:500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.535 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #3 | start processing: state #3 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:797) | crypto helper 6 replies to request ID 5 | calling continuation function 0x563f04fc7b50 | work-order 5 state #3 crypto result suppressed | resume sending helper answer for #3 suppresed complete_v1_state_transition() | #3 spent 0.0192 milliseconds in resume sending helper answer | stop processing: state #3 connection "road-east" from 192.1.2.23 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f6488002888 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00429 milliseconds in signal handler PLUTO_SIGCHLD | timer_event_cb: processing event@0x563f071271e8 | handling event EVENT_SA_REPLACE for child state #3 | start processing: state #3 connection "road-east" from 192.1.2.23 (in timer_event_cb() at timer.c:250) | picked newest_ipsec_sa #0 for #3 | replacing stale IPsec SA | dup_any(fd@-1) -> fd@-1 (in ipsecdoi_replace() at ipsec_doi.c:351) | FOR_EACH_STATE_... in find_phase1_state | creating state object #4 at 0x563f071242d8 | State DB: adding IKEv1 state #4 in UNDEFINED | pstats #4 ikev1.isakmp started | suspend processing: state #3 connection "road-east" from 192.1.2.23 (in main_outI1() at ikev1_main.c:118) | start processing: state #4 connection "road-east" from 192.1.2.23 (in main_outI1() at ikev1_main.c:118) | parent state #4: UNDEFINED(ignore) => MAIN_I1(half-open IKE SA) | dup_any(fd@-1) -> fd@-1 (in main_outI1() at ikev1_main.c:123) | Queuing pending IPsec SA negotiating with 192.1.2.23 "road-east" IKE SA #4 "road-east" "road-east" #4: initiating Main Mode | **emit ISAKMP Message: | initiator cookie: | 2d 8d 91 3e 94 2b 26 bb | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 1:ISAKMP_NEXT_SA | no specific IKE algorithms specified - using defaults | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() returning 0x563f0712aba8 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 18 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 18 (0x12) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 1 (0x1) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 2 (0x2) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 3 (0x3) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 4 (0x4) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 5 (0x5) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 6 (0x6) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 7 (0x7) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 8 (0x8) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 9 (0x9) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 10 (0xa) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 11 (0xb) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 12 (0xc) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 13 (0xd) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 14 (0xe) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 15 (0xf) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 16 (0x10) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP transform number: 17 (0x11) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | emitting length of ISAKMP Proposal Payload: 632 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 644 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | out_vid(): sending [FRAGMENTATION] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [XAUTH] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 8 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 09 00 26 89 df d6 b7 12 | emitting length of ISAKMP Vendor ID Payload: 12 | out_vid(): sending [Dead Peer Detection] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 | emitting length of ISAKMP Vendor ID Payload: 20 | nat add vid | sending draft and RFC NATT VIDs | out_vid(): sending [RFC 3947] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | emitting length of ISAKMP Vendor ID Payload: 20 | skipping VID_NATT_RFC | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-03] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02_n] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 | emitting length of ISAKMP Vendor ID Payload: 20 | no IKEv1 message padding required | emitting length of ISAKMP Message: 804 | sending 804 bytes for reply packet for main_outI1 through eth0 from 192.1.3.209:500 to 192.1.2.23:500 (using #4) | 2d 8d 91 3e 94 2b 26 bb 00 00 00 00 00 00 00 00 | 01 10 02 00 00 00 00 00 00 00 03 24 0d 00 02 84 | 00 00 00 01 00 00 00 01 00 00 02 78 00 01 00 12 | 03 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 fd ed 80 04 00 0e | 80 0e 01 00 03 00 00 24 01 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 04 80 03 fd ed | 80 04 00 0e 80 0e 00 80 03 00 00 24 02 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 06 | 80 03 fd ed 80 04 00 0e 80 0e 01 00 03 00 00 24 | 03 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 06 80 03 fd ed 80 04 00 0e 80 0e 00 80 | 03 00 00 24 04 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 02 80 03 fd ed 80 04 00 0e | 80 0e 01 00 03 00 00 24 05 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 02 80 03 fd ed | 80 04 00 0e 80 0e 00 80 03 00 00 24 06 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 04 | 80 03 fd ed 80 04 00 05 80 0e 01 00 03 00 00 24 | 07 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 04 80 03 fd ed 80 04 00 05 80 0e 00 80 | 03 00 00 24 08 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 06 80 03 fd ed 80 04 00 05 | 80 0e 01 00 03 00 00 24 09 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 06 80 03 fd ed | 80 04 00 05 80 0e 00 80 03 00 00 24 0a 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 02 | 80 03 fd ed 80 04 00 05 80 0e 01 00 03 00 00 24 | 0b 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 02 80 03 fd ed 80 04 00 05 80 0e 00 80 | 03 00 00 20 0c 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 fd ed 80 04 00 0e | 03 00 00 20 0d 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 fd ed 80 04 00 0e | 03 00 00 20 0e 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 fd ed 80 04 00 0e | 03 00 00 20 0f 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 fd ed 80 04 00 05 | 03 00 00 20 10 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 fd ed 80 04 00 05 | 00 00 00 20 11 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 fd ed 80 04 00 05 | 0d 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 de 7f | 00 d6 c2 d3 0d 00 00 0c 09 00 26 89 df d6 b7 12 | 0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc | 77 57 01 00 0d 00 00 14 4a 13 1c 81 07 03 58 45 | 5c 57 28 f2 0e 95 45 2f 0d 00 00 14 7d 94 19 a6 | 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14 | 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | 00 00 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc | 68 b6 a4 48 | event_schedule: new EVENT_RETRANSMIT-pe@0x7f6488002b78 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #4 | libevent_malloc: new ptr-libevent@0x7f6494003878 size 128 | #4 STATE_MAIN_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 29861.098781 | #4 spent 1.5 milliseconds in main_outI1() | stop processing: state #4 connection "road-east" from 192.1.2.23 (in main_outI1() at ikev1_main.c:228) | event_schedule: new EVENT_SA_EXPIRE-pe@0x563f070b7268 | inserting event EVENT_SA_EXPIRE, timeout in 0 seconds for #3 | libevent_malloc: new ptr-libevent@0x563f0712c5e8 size 128 | libevent_free: release ptr-libevent@0x563f0713a268 | free_event_entry: release EVENT_SA_REPLACE-pe@0x563f071271e8 | #3 spent 1.54 milliseconds in timer_event_cb() EVENT_SA_REPLACE | processing: STOP state #0 (in timer_event_cb() at timer.c:557) | processing global timer EVENT_REVIVE_CONNS Initiating connection road-east which received a Delete/Notify but must remain up per local policy | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "road-east" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'road-east' +POLICY_UP | dup_any(fd@-1) -> fd@-1 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | Ignored already queued up pending IPsec SA negotiation with 192.1.2.23 "road-east" | stop processing: connection "road-east" (in initiate_a_connection() at initiate.c:349) | spent 0.0246 milliseconds in global timer EVENT_REVIVE_CONNS | timer_event_cb: processing event@0x563f070b7268 | handling event EVENT_SA_EXPIRE for child state #3 | start processing: state #3 connection "road-east" from 192.1.2.23 (in timer_event_cb() at timer.c:250) | picked newest_ipsec_sa #0 for #3 | un-established partial CHILD SA timeout (SA expired) | pstats #3 ikev1.ipsec failed exchange-timeout | pstats #3 ikev1.ipsec deleted exchange-timeout | [RE]START processing: state #3 connection "road-east" from 192.1.2.23 (in delete_state() at state.c:879) "road-east" #3: deleting state (STATE_QUICK_I1) aged 0.064s and NOT sending notification | child state #3: QUICK_I1(established CHILD SA) => delete | child state #3: QUICK_I1(established CHILD SA) => CHILDSA_DEL(informational) | priority calculation of connection "road-east" is 0xfdfe7 | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.2.101/32:0 => unk255.10000@192.1.3.209 (raw_eroute) | raw_eroute result=success | in connection_discard for connection road-east | State DB: deleting IKEv1 state #3 in CHILDSA_DEL | child state #3: CHILDSA_DEL(informational) => UNDEFINED(ignore) | stop processing: state #3 from 192.1.2.23 (in delete_state() at state.c:1143) | libevent_free: release ptr-libevent@0x563f0712c5e8 | free_event_entry: release EVENT_SA_EXPIRE-pe@0x563f070b7268 | in statetime_stop() and could not find #3 | processing: STOP state #0 (in timer_event_cb() at timer.c:557)