FIPS Product: YES FIPS Kernel: NO FIPS Mode: NO NSS DB directory: sql:/etc/ipsec.d Initializing NSS Opening NSS database "sql:/etc/ipsec.d" read-only NSS initialized NSS crypto library initialized FIPS HMAC integrity support [enabled] FIPS mode disabled for pluto daemon FIPS HMAC integrity verification self-test FAILED libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v3.28-827-gc9aa82b8a6-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC SYSTEMD_WATCHDOG FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:20793 core dump dir: /tmp secrets file: /etc/ipsec.secrets leak-detective enabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: new ptr-libevent@0x5580a0b064d8 size 40 | libevent_malloc: new ptr-libevent@0x5580a0b06458 size 40 | libevent_malloc: new ptr-libevent@0x5580a0b063d8 size 40 | creating event base | libevent_malloc: new ptr-libevent@0x5580a0b06758 size 56 | libevent_malloc: new ptr-libevent@0x5580a0a81e48 size 664 | libevent_malloc: new ptr-libevent@0x5580a0b40ac8 size 24 | libevent_malloc: new ptr-libevent@0x5580a0a825c8 size 384 | libevent_malloc: new ptr-libevent@0x5580a0b40a88 size 16 | libevent_malloc: new ptr-libevent@0x5580a0b06358 size 40 | libevent_malloc: new ptr-libevent@0x5580a0b062f8 size 48 | libevent_realloc: new ptr-libevent@0x5580a0a81ad8 size 256 | libevent_malloc: new ptr-libevent@0x5580a0b40b18 size 16 | libevent_free: release ptr-libevent@0x5580a0b06758 | libevent initialized | libevent_realloc: new ptr-libevent@0x5580a0b06758 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm, aes_ccm_c AES_CCM_12 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_b AES_CCM_8 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_a 3DES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS [*192] 3des CAMELLIA_CTR IKEv1: ESP IKEv2: ESP {256,192,*128} CAMELLIA_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} camellia AES_GCM_16 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm, aes_gcm_c AES_GCM_12 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_b AES_GCM_8 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_a AES_CTR IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aesctr AES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aes SERPENT_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} serpent TWOFISH_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} twofish TWOFISH_SSH IKEv1: IKE IKEv2: IKE ESP {256,192,*128} twofish_cbc_ssh NULL_AUTH_AES_GMAC IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_gmac NULL IKEv1: ESP IKEv2: ESP [] CHACHA20_POLY1305 IKEv1: IKEv2: IKE ESP [*256] chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: SHA1 IKEv1: IKE IKEv2: FIPS sha SHA2_256 IKEv1: IKE IKEv2: FIPS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: FIPS sha384 SHA2_512 IKEv1: IKE IKEv2: FIPS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 crypto helpers started thread for crypto helper 0 started thread for crypto helper 1 | starting up helper thread 1 | status value returned by setting the priority of this thread (crypto helper 1) 22 | crypto helper 1 waiting (nothing to do) started thread for crypto helper 2 | starting up helper thread 0 | status value returned by setting the priority of this thread (crypto helper 0) 22 | crypto helper 0 waiting (nothing to do) started thread for crypto helper 3 | starting up helper thread 2 | status value returned by setting the priority of this thread (crypto helper 2) 22 | crypto helper 2 waiting (nothing to do) | starting up helper thread 3 started thread for crypto helper 4 | starting up helper thread 4 | status value returned by setting the priority of this thread (crypto helper 3) 22 | status value returned by setting the priority of this thread (crypto helper 4) 22 | crypto helper 3 waiting (nothing to do) started thread for crypto helper 5 | crypto helper 4 waiting (nothing to do) | starting up helper thread 5 | status value returned by setting the priority of this thread (crypto helper 5) 22 | crypto helper 5 waiting (nothing to do) started thread for crypto helper 6 | checking IKEv1 state table | starting up helper thread 6 | MAIN_R0: category: half-open IKE SA flags: 0: | status value returned by setting the priority of this thread (crypto helper 6) 22 | crypto helper 6 waiting (nothing to do) | -> MAIN_R1 EVENT_SO_DISCARD | MAIN_I1: category: half-open IKE SA flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT | MAIN_R1: category: open IKE SA flags: 200: | -> MAIN_R2 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_I2: category: open IKE SA flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_R2: category: open IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | -> MAIN_R3 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_I3: category: open IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | -> MAIN_I4 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_R3: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | MAIN_I4: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | AGGR_R0: category: half-open IKE SA flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD | AGGR_I1: category: half-open IKE SA flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE | -> AGGR_I2 EVENT_SA_REPLACE | AGGR_R1: category: open IKE SA flags: 200: | -> AGGR_R2 EVENT_SA_REPLACE | -> AGGR_R2 EVENT_SA_REPLACE | AGGR_I2: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | AGGR_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | QUICK_R0: category: established CHILD SA flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT | QUICK_I1: category: established CHILD SA flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE | QUICK_R1: category: established CHILD SA flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE | QUICK_I2: category: established CHILD SA flags: 200: | -> UNDEFINED EVENT_NULL | QUICK_R2: category: established CHILD SA flags: 0: | -> UNDEFINED EVENT_NULL | INFO: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | INFO_PROTECTED: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | XAUTH_R0: category: established IKE SA flags: 0: | -> XAUTH_R1 EVENT_NULL | XAUTH_R1: category: established IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | MODE_CFG_R0: category: informational flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE | MODE_CFG_R1: category: established IKE SA flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE | MODE_CFG_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | MODE_CFG_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | XAUTH_I0: category: established IKE SA flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT | XAUTH_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT | checking IKEv2 state table | PARENT_I0: category: ignore flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA flags: 0: | -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH) | PARENT_I2: category: open IKE SA flags: 0: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_I3: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_RETAIN (I3: Informational Request) | -> PARENT_I3 EVENT_RETAIN (I3: Informational Response) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response) | PARENT_R0: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED)) | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request) | PARENT_R2: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request) | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response) | V2_CREATE_I0: category: established IKE SA flags: 0: | -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | V2_CREATE_I: category: established IKE SA flags: 0: | -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_IKE_I0: category: established IKE SA flags: 0: | -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_REKEY_CHILD_I0: category: established IKE SA flags: 0: | -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_REKEY_CHILD_I: category: established IKE SA flags: 0: | V2_CREATE_R: category: established IKE SA flags: 0: | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request) | V2_REKEY_IKE_R: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_R: category: established IKE SA flags: 0: | V2_IPSEC_I: category: established CHILD SA flags: 0: | V2_IPSEC_R: category: established CHILD SA flags: 0: | IKESA_DEL: category: established IKE SA flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational flags: 0: Using Linux XFRM/NETKEY IPsec interface code on 5.2.11+ | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding SERPENT_CBC to kernel algorithm db | adding TWOFISH_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x5580a0b00208 | libevent_malloc: new ptr-libevent@0x5580a0b3f258 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b461e8 size 16 | add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x5580a0b46178 | libevent_malloc: new ptr-libevent@0x5580a0af8b28 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b45e48 size 16 | global one-shot timer EVENT_CHECK_CRLS initialized selinux support is enabled. systemd watchdog not enabled - not sending watchdog keepalives | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | Loading dnssec root key from:/var/lib/unbound/root.key | No additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x5580a0b46618 | libevent_malloc: new ptr-libevent@0x5580a0b524e8 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b5d828 size 16 | libevent_realloc: new ptr-libevent@0x5580a0b5d868 size 256 | libevent_malloc: new ptr-libevent@0x5580a0b5d998 size 8 | libevent_realloc: new ptr-libevent@0x5580a0a576e8 size 144 | libevent_malloc: new ptr-libevent@0x5580a0b45818 size 152 | libevent_malloc: new ptr-libevent@0x5580a0b5d9d8 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: new ptr-libevent@0x5580a0b5da18 size 8 | libevent_malloc: new ptr-libevent@0x5580a0b5da58 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: new ptr-libevent@0x5580a0b5db28 size 8 | libevent_malloc: new ptr-libevent@0x5580a0b5db68 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: new ptr-libevent@0x5580a0b5dc38 size 8 | libevent_realloc: release ptr-libevent@0x5580a0a576e8 | libevent_realloc: new ptr-libevent@0x5580a0b5dc78 size 256 | libevent_malloc: new ptr-libevent@0x5580a0b5dda8 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:20874) using fork+execve | forked child 20874 | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | pluto_sd: executing action action: reloading(4), status 0 listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 Kernel supports NIC esp-hw-offload adding interface eth1/eth1 (esp-hw-offload not supported by kernel) 192.1.2.45:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth1/eth1 192.1.2.45:4500 adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.0.1.254:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth0/eth0 192.0.1.254:4500 adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface lo/lo 127.0.0.1:4500 | no interfaces to sort | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e388 | libevent_malloc: new ptr-libevent@0x5580a0b52438 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b5e3f8 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 22 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e438 | libevent_malloc: new ptr-libevent@0x5580a0af8bd8 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b5e4a8 size 16 | setup callback for interface lo 127.0.0.1:500 fd 21 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e4e8 | libevent_malloc: new ptr-libevent@0x5580a0af84a8 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b5e558 size 16 | setup callback for interface eth0 192.0.1.254:4500 fd 20 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e598 | libevent_malloc: new ptr-libevent@0x5580a0af7d78 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b5e608 size 16 | setup callback for interface eth0 192.0.1.254:500 fd 19 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e648 | libevent_malloc: new ptr-libevent@0x5580a0af7e78 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b5e6b8 size 16 | setup callback for interface eth1 192.1.2.45:4500 fd 18 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e6f8 | libevent_malloc: new ptr-libevent@0x5580a0af7f28 size 128 | libevent_malloc: new ptr-libevent@0x5580a0b5e768 size 16 | setup callback for interface eth1 192.1.2.45:500 fd 17 | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 loaded private key for keyid: PKK_RSA:AQOm9dY/4 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | pluto_sd: executing action action: ready(5), status 0 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.535 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | pluto_sd: executing action action: reloading(4), status 0 listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 | no interfaces to sort | libevent_free: release ptr-libevent@0x5580a0b52438 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e388 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e388 | libevent_malloc: new ptr-libevent@0x5580a0b52438 size 128 | setup callback for interface lo 127.0.0.1:4500 fd 22 | libevent_free: release ptr-libevent@0x5580a0af8bd8 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e438 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e438 | libevent_malloc: new ptr-libevent@0x5580a0af8bd8 size 128 | setup callback for interface lo 127.0.0.1:500 fd 21 | libevent_free: release ptr-libevent@0x5580a0af84a8 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e4e8 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e4e8 | libevent_malloc: new ptr-libevent@0x5580a0af84a8 size 128 | setup callback for interface eth0 192.0.1.254:4500 fd 20 | libevent_free: release ptr-libevent@0x5580a0af7d78 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e598 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e598 | libevent_malloc: new ptr-libevent@0x5580a0af7d78 size 128 | setup callback for interface eth0 192.0.1.254:500 fd 19 | libevent_free: release ptr-libevent@0x5580a0af7e78 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e648 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e648 | libevent_malloc: new ptr-libevent@0x5580a0af7e78 size 128 | setup callback for interface eth1 192.1.2.45:4500 fd 18 | libevent_free: release ptr-libevent@0x5580a0af7f28 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e6f8 | add_fd_read_event_handler: new ethX-pe@0x5580a0b5e6f8 | libevent_malloc: new ptr-libevent@0x5580a0af7f28 size 128 | setup callback for interface eth1 192.1.2.45:500 fd 17 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 loaded private key for keyid: PKK_RSA:AQOm9dY/4 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | pluto_sd: executing action action: ready(5), status 0 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.289 milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 20874 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0128 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection westnet-eastnet-ikev2 with policy ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | ike (phase1) algorithm values: AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31, AES_CBC_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp= | ESP/AH string values: AES_GCM_16_256-NONE, AES_GCM_16_128-NONE, AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128, AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128 | ASCII to DN <= "C=CH, O=strongSwan, CN=strongWest" | ASCII to DN => 30 37 31 0b 30 09 06 03 55 04 06 13 02 43 48 31 | ASCII to DN => 13 30 11 06 03 55 04 0a 13 0a 73 74 72 6f 6e 67 | ASCII to DN => 53 77 61 6e 31 13 30 11 06 03 55 04 03 13 0a 73 | ASCII to DN => 74 72 6f 6e 67 57 65 73 74 | loading left certificate 'strongWest' pubkey | pub 04 45 a3 10 94 e8 cb 81 e6 de 68 55 25 aa 65 95 | pub 7d 8a f1 82 b0 3e bb 2a 76 7e 76 35 d6 45 ef 7a | pub 37 e3 80 b3 41 a3 d8 8b 9b 45 d0 c3 23 63 51 d3 | pub 20 12 f0 5a 79 7a 04 97 7f 10 40 49 0c de 0c 76 | pub 5c 80 fe 48 01 f9 f0 36 ce 72 ff 64 36 21 22 77 | pub db ed 26 02 35 cc f3 82 33 b0 86 49 30 7b 96 5b | pub c2 | ecParams 06 05 2b 81 04 00 22 | keyid 04 45 a3 10 94 e8 cb 81 e6 | computed ecdsa CKAID | eb 4f f8 7f 1e 19 5d 07 21 6f 1d 63 72 32 5f 39 | 2f 73 83 41 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x5580a0b61d88 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x5580a0b61d38 | pub 04 45 a3 10 94 e8 cb 81 e6 de 68 55 25 aa 65 95 | pub 7d 8a f1 82 b0 3e bb 2a 76 7e 76 35 d6 45 ef 7a | pub 37 e3 80 b3 41 a3 d8 8b 9b 45 d0 c3 23 63 51 d3 | pub 20 12 f0 5a 79 7a 04 97 7f 10 40 49 0c de 0c 76 | pub 5c 80 fe 48 01 f9 f0 36 ce 72 ff 64 36 21 22 77 | pub db ed 26 02 35 cc f3 82 33 b0 86 49 30 7b 96 5b | pub c2 | ecParams 06 05 2b 81 04 00 22 | keyid 04 45 a3 10 94 e8 cb 81 e6 | computed ecdsa CKAID | eb 4f f8 7f 1e 19 5d 07 21 6f 1d 63 72 32 5f 39 | 2f 73 83 41 | pub 04 45 a3 10 94 e8 cb 81 e6 de 68 55 25 aa 65 95 | pub 7d 8a f1 82 b0 3e bb 2a 76 7e 76 35 d6 45 ef 7a | pub 37 e3 80 b3 41 a3 d8 8b 9b 45 d0 c3 23 63 51 d3 | pub 20 12 f0 5a 79 7a 04 97 7f 10 40 49 0c de 0c 76 | pub 5c 80 fe 48 01 f9 f0 36 ce 72 ff 64 36 21 22 77 | pub db ed 26 02 35 cc f3 82 33 b0 86 49 30 7b 96 5b | pub c2 | ecParams 06 05 2b 81 04 00 22 | keyid 04 45 a3 10 94 e8 cb 81 e6 | computed ecdsa CKAID | eb 4f f8 7f 1e 19 5d 07 21 6f 1d 63 72 32 5f 39 | 2f 73 83 41 | unreference key: 0x5580a0b61dd8 C=CH, O=strongSwan, CN=strongWest cnt 1-- | pub 04 45 a3 10 94 e8 cb 81 e6 de 68 55 25 aa 65 95 | pub 7d 8a f1 82 b0 3e bb 2a 76 7e 76 35 d6 45 ef 7a | pub 37 e3 80 b3 41 a3 d8 8b 9b 45 d0 c3 23 63 51 d3 | pub 20 12 f0 5a 79 7a 04 97 7f 10 40 49 0c de 0c 76 | pub 5c 80 fe 48 01 f9 f0 36 ce 72 ff 64 36 21 22 77 | pub db ed 26 02 35 cc f3 82 33 b0 86 49 30 7b 96 5b | pub c2 | ecParams 06 05 2b 81 04 00 22 | keyid 04 45 a3 10 94 e8 cb 81 e6 | computed ecdsa CKAID | eb 4f f8 7f 1e 19 5d 07 21 6f 1d 63 72 32 5f 39 | 2f 73 83 41 | certs and keys locked by 'lsw_add_ecdsa_secret' | certs and keys unlocked by 'lsw_add_ecdsa_secret' | counting wild cards for C=CH, O=strongSwan, CN=strongWest is 0 | ASCII to DN <= "C=CH, O=strongSwan, CN=strongEast" | ASCII to DN => 30 37 31 0b 30 09 06 03 55 04 06 13 02 43 48 31 | ASCII to DN => 13 30 11 06 03 55 04 0a 13 0a 73 74 72 6f 6e 67 | ASCII to DN => 53 77 61 6e 31 13 30 11 06 03 55 04 03 13 0a 73 | ASCII to DN => 74 72 6f 6e 67 45 61 73 74 | counting wild cards for C=CH, O=strongSwan, CN=strongEast is 0 | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | new hp@0x5580a0b61dd8 added connection description "westnet-eastnet-ikev2" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.1.0/24===192.1.2.45<192.1.2.45>[C=CH, O=strongSwan, CN=strongWest]...192.1.2.23<192.1.2.23>[C=CH, O=strongSwan, CN=strongEast]===192.0.2.0/24 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.854 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | old debugging base+cpu-usage + none | base debugging = base+cpu-usage | old impairing none + suppress-retransmits | base impairing = suppress-retransmits | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0342 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | dup_any(fd@16) -> fd@23 (in whack_process() at rcv_whack.c:590) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "westnet-eastnet-ikev2" (in initiate_a_connection() at initiate.c:186) | connection 'westnet-eastnet-ikev2' +POLICY_UP | dup_any(fd@23) -> fd@24 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | creating state object #1 at 0x5580a0b652e8 | State DB: adding IKEv2 state #1 in UNDEFINED | pstats #1 ikev2.ike started | Message ID: init #1: msgid=0 lastack=4294967295 nextuse=0 lastrecv=4294967295 lastreplied=0 | parent state #1: UNDEFINED(ignore) => PARENT_I0(ignore) | Message ID: init_ike #1; ike: initiator.sent=0->-1 initiator.recv=0->-1 responder.sent=0->-1 responder.recv=0->-1 wip.initiator=0->-1 wip.responder=0->-1 | suspend processing: connection "westnet-eastnet-ikev2" (in ikev2_parent_outI1() at ikev2_parent.c:535) | start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:535) | dup_any(fd@24) -> fd@25 (in ikev2_parent_outI1() at ikev2_parent.c:551) | Queuing pending IPsec SA negotiating with 192.1.2.23 "westnet-eastnet-ikev2" IKE SA #1 "westnet-eastnet-ikev2" "westnet-eastnet-ikev2" #1: initiating v2 parent SA | constructing local IKE proposals for westnet-eastnet-ikev2 (IKE SA initiator selecting KE) | converting ike_info AES_GCM_16_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_GCM_16_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_CBC_256-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | converting ike_info AES_CBC_128-HMAC_SHA2_512+HMAC_SHA2_256-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 "westnet-eastnet-ikev2": constructed local IKE proposals for westnet-eastnet-ikev2 (IKE SA initiator selecting KE): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | adding ikev2_outI1 KE work-order 1 for state #1 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5580a0b64e48 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5580a0b61918 size 128 | #1 spent 0.145 milliseconds in ikev2_parent_outI1() | processing: RESET whack log_fd (was fd@16) (in ikev2_parent_outI1() at ikev2_parent.c:610) | crypto helper 1 resuming | crypto helper 1 starting work-order 1 for state #1 | RESET processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:610) | crypto helper 1 doing build KE and nonce (ikev2_outI1 KE); request ID 1 | RESET processing: connection "westnet-eastnet-ikev2" (in ikev2_parent_outI1() at ikev2_parent.c:610) | processing: STOP connection NULL (in initiate_a_connection() at initiate.c:349) | close_any(fd@23) (in initiate_connection() at initiate.c:372) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.22 milliseconds in whack | crypto helper 1 finished build KE and nonce (ikev2_outI1 KE); request ID 1 time elapsed 0.001032 seconds | (#1) spent 1.04 milliseconds in crypto helper computing work-order 1: ikev2_outI1 KE (pcr) | crypto helper 1 sending results from work-order 1 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f62b8002888 size 128 | crypto helper 1 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 1 replies to request ID 1 | calling continuation function 0x55809fea8630 | ikev2_parent_outI1_continue for #1 | **emit ISAKMP Message: | initiator cookie: | e3 51 4d 89 0d d4 ea 56 | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | using existing local IKE proposals for connection westnet-eastnet-ikev2 (IKE SA initiator emitting local proposals): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | Emitting ikev2_proposals ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discarding INTEG=NONE | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 11 (0xb) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding INTEG=NONE | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding INTEG=NONE | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 2 (0x2) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 11 (0xb) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding INTEG=NONE | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 3 (0x3) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 13 (0xd) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 116 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 4 (0x4) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 13 (0xd) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 116 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 436 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x 1e 87 b6 9a 48 e4 14 43 9c 76 2d 2e e7 c4 b8 7d | ikev2 g^x 7d 99 ea d8 89 02 18 16 7a 5a 7c b0 48 9b b9 45 | ikev2 g^x 24 84 15 f3 3b df a9 3f 7b 90 02 b7 ac 28 d5 73 | ikev2 g^x a7 d0 32 66 0f 42 d4 94 df ac ce f7 be 1c fa 4f | ikev2 g^x 3b e3 5d e9 52 59 d8 15 dd 15 fb e5 26 ce 54 98 | ikev2 g^x d8 d1 af 25 2f 50 6f ca d6 6c 07 66 4e 69 c9 ca | ikev2 g^x 31 73 e3 2f 94 a8 e4 44 fa cb 75 70 25 4b dd bc | ikev2 g^x c6 8b 69 77 59 02 d2 89 ce 44 e3 db 35 8d 17 c7 | ikev2 g^x 65 6a 31 86 7b fa b3 40 36 ae be 0d 2c d4 3e c9 | ikev2 g^x 9b fe 77 74 e6 de ba 96 76 a3 10 31 3c 31 7d e4 | ikev2 g^x 92 40 0f 0d ea 36 f4 7d d8 41 03 f0 a2 e0 bc ce | ikev2 g^x a4 ab f8 34 4f 38 24 10 32 d2 dd 92 67 da df df | ikev2 g^x bb 2a a8 67 11 9b ea 5c 14 b6 62 f1 4d 5d 8f e3 | ikev2 g^x 58 c7 4d be 0b e9 45 b1 4d ff 5e 13 a4 e0 a4 72 | ikev2 g^x 5c 8a 56 51 aa 7b 8c 51 28 c7 80 3d fd 12 3c 3e | ikev2 g^x 67 0c b7 9c 87 82 54 30 17 58 77 04 4c fc 9c 92 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | next payload chain: ignoring supplied 'IKEv2 Nonce Payload'.'next payload type' value 41:ISAKMP_NEXT_v2N | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce 6a fc 58 2a d5 37 f6 cb 9a 03 a6 6b b6 25 f6 2d | IKEv2 nonce ac 50 b1 3a 47 a8 97 16 18 c9 eb 2b 9e 96 93 35 | emitting length of IKEv2 Nonce Payload: 36 | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_AUTH_HASH_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_AUTH_HASH_SHA2_384 | 00 03 | emitting length of IKEv2 Notify Payload: 10 | NAT-Traversal support [enabled] add v2N payloads. | natd_hash: rcookie is zero | natd_hash: hasher=0x55809ff7e7a0(20) | natd_hash: icookie= e3 51 4d 89 0d d4 ea 56 | natd_hash: rcookie= 00 00 00 00 00 00 00 00 | natd_hash: ip= c0 01 02 2d | natd_hash: port= 01 f4 | natd_hash: hash= 38 ae e7 d8 3e f8 40 4c d7 81 e8 8f ed 58 11 86 | natd_hash: hash= c3 ab fa fa | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data 38 ae e7 d8 3e f8 40 4c d7 81 e8 8f ed 58 11 86 | Notify data c3 ab fa fa | emitting length of IKEv2 Notify Payload: 28 | natd_hash: rcookie is zero | natd_hash: hasher=0x55809ff7e7a0(20) | natd_hash: icookie= e3 51 4d 89 0d d4 ea 56 | natd_hash: rcookie= 00 00 00 00 00 00 00 00 | natd_hash: ip= c0 01 02 17 | natd_hash: port= 01 f4 | natd_hash: hash= 32 c6 cc 1a e8 20 d1 71 75 da ed dd 82 6f 9f 7f | natd_hash: hash= d0 b6 72 40 | Adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data 32 c6 cc 1a e8 20 d1 71 75 da ed dd 82 6f 9f 7f | Notify data d0 b6 72 40 | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 838 | stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ikev2_parent_outI1_common() at ikev2_parent.c:817) | start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3376) | #1 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK | IKEv2: transition from state STATE_PARENT_I0 to state STATE_PARENT_I1 | parent state #1: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) | Message ID: updating counters for #1 to 4294967295 after switching state | Message ID: IKE #1 skipping update_recv as MD is fake | Message ID: sent #1 request 0; ike: initiator.sent=-1->0 initiator.recv=-1 responder.sent=-1 responder.recv=-1 wip.initiator=-1->0 wip.responder=-1 "westnet-eastnet-ikev2" #1: STATE_PARENT_I1: sent v2I1, expected v2R1 | sending V2 reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 838 bytes for STATE_PARENT_I0 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | e3 51 4d 89 0d d4 ea 56 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 03 46 22 00 01 b4 | 02 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 14 | 80 0e 01 00 03 00 00 08 02 00 00 07 03 00 00 08 | 02 00 00 05 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 02 00 00 64 02 01 00 0b 03 00 00 0c | 01 00 00 14 80 0e 00 80 03 00 00 08 02 00 00 07 | 03 00 00 08 02 00 00 05 03 00 00 08 04 00 00 0e | 03 00 00 08 04 00 00 0f 03 00 00 08 04 00 00 10 | 03 00 00 08 04 00 00 12 03 00 00 08 04 00 00 13 | 03 00 00 08 04 00 00 14 03 00 00 08 04 00 00 15 | 00 00 00 08 04 00 00 1f 02 00 00 74 03 01 00 0d | 03 00 00 0c 01 00 00 0c 80 0e 01 00 03 00 00 08 | 02 00 00 07 03 00 00 08 02 00 00 05 03 00 00 08 | 03 00 00 0e 03 00 00 08 03 00 00 0c 03 00 00 08 | 04 00 00 0e 03 00 00 08 04 00 00 0f 03 00 00 08 | 04 00 00 10 03 00 00 08 04 00 00 12 03 00 00 08 | 04 00 00 13 03 00 00 08 04 00 00 14 03 00 00 08 | 04 00 00 15 00 00 00 08 04 00 00 1f 00 00 00 74 | 04 01 00 0d 03 00 00 0c 01 00 00 0c 80 0e 00 80 | 03 00 00 08 02 00 00 07 03 00 00 08 02 00 00 05 | 03 00 00 08 03 00 00 0e 03 00 00 08 03 00 00 0c | 03 00 00 08 04 00 00 0e 03 00 00 08 04 00 00 0f | 03 00 00 08 04 00 00 10 03 00 00 08 04 00 00 12 | 03 00 00 08 04 00 00 13 03 00 00 08 04 00 00 14 | 03 00 00 08 04 00 00 15 00 00 00 08 04 00 00 1f | 28 00 01 08 00 0e 00 00 1e 87 b6 9a 48 e4 14 43 | 9c 76 2d 2e e7 c4 b8 7d 7d 99 ea d8 89 02 18 16 | 7a 5a 7c b0 48 9b b9 45 24 84 15 f3 3b df a9 3f | 7b 90 02 b7 ac 28 d5 73 a7 d0 32 66 0f 42 d4 94 | df ac ce f7 be 1c fa 4f 3b e3 5d e9 52 59 d8 15 | dd 15 fb e5 26 ce 54 98 d8 d1 af 25 2f 50 6f ca | d6 6c 07 66 4e 69 c9 ca 31 73 e3 2f 94 a8 e4 44 | fa cb 75 70 25 4b dd bc c6 8b 69 77 59 02 d2 89 | ce 44 e3 db 35 8d 17 c7 65 6a 31 86 7b fa b3 40 | 36 ae be 0d 2c d4 3e c9 9b fe 77 74 e6 de ba 96 | 76 a3 10 31 3c 31 7d e4 92 40 0f 0d ea 36 f4 7d | d8 41 03 f0 a2 e0 bc ce a4 ab f8 34 4f 38 24 10 | 32 d2 dd 92 67 da df df bb 2a a8 67 11 9b ea 5c | 14 b6 62 f1 4d 5d 8f e3 58 c7 4d be 0b e9 45 b1 | 4d ff 5e 13 a4 e0 a4 72 5c 8a 56 51 aa 7b 8c 51 | 28 c7 80 3d fd 12 3c 3e 67 0c b7 9c 87 82 54 30 | 17 58 77 04 4c fc 9c 92 29 00 00 24 6a fc 58 2a | d5 37 f6 cb 9a 03 a6 6b b6 25 f6 2d ac 50 b1 3a | 47 a8 97 16 18 c9 eb 2b 9e 96 93 35 29 00 00 08 | 00 00 40 2e 29 00 00 0a 00 00 40 2f 00 03 29 00 | 00 1c 00 00 40 04 38 ae e7 d8 3e f8 40 4c d7 81 | e8 8f ed 58 11 86 c3 ab fa fa 00 00 00 1c 00 00 | 40 05 32 c6 cc 1a e8 20 d1 71 75 da ed dd 82 6f | 9f 7f d0 b6 72 40 | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5580a0b61918 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5580a0b64e48 | success_v2_state_transition scheduling EVENT_RETRANSMIT of c->r_interval=500ms "westnet-eastnet-ikev2" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5580a0b64e48 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5580a0b64f28 size 128 | #1 STATE_PARENT_I1: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 49630.893095 | resume sending helper answer for #1 suppresed complete_v2_state_transition() and stole MD | #1 spent 1.37 milliseconds in resume sending helper answer | stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f62b8002888 | spent 0.0031 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 442 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | e3 51 4d 89 0d d4 ea 56 b4 10 ea a2 a1 9d 88 3f | 21 20 22 20 00 00 00 00 00 00 01 ba 22 00 00 28 | 00 00 00 24 01 01 00 03 03 00 00 0c 01 00 00 14 | 80 0e 01 00 03 00 00 08 02 00 00 07 00 00 00 08 | 04 00 00 0e 28 00 01 08 00 0e 00 00 a9 2e 71 05 | 45 72 aa ed 60 0f be 04 55 90 69 cf 9f d6 62 98 | f7 aa 47 23 ff 75 b6 fb 65 98 82 72 7c d0 ed db | 74 be 87 47 be 4a b0 f7 8c 2c f1 63 f9 7b 62 89 | d1 c8 3f 77 ab f3 61 57 2a bf 24 f8 a7 5d fd 1d | 92 92 c2 82 56 a5 dc 06 2c e4 04 e7 2d 91 96 30 | f6 fd f7 7e 2f db c6 3e 04 6b ba 2f dc 21 15 fa | 1d cb 33 6e 71 97 14 9a d1 a4 6b 42 7c 09 55 3d | bc c6 fb 83 8d 0d c2 bd bc 5f b8 7b c2 fb e8 67 | 55 92 32 ca 9a f3 dd fe 86 ef a2 19 aa 7b 76 21 | 7e 07 bf a0 cd 9f 5c 2a 75 23 26 20 61 29 0a 83 | 94 e4 24 76 e7 18 e3 a2 4b 7b d3 e7 b4 a9 1d f8 | 64 39 e9 26 8e 90 80 47 21 d6 b9 10 b4 47 b6 49 | 91 ff 51 c9 be b1 dc 19 44 89 45 75 04 b2 f0 97 | c2 1d c5 5c 80 4e 06 55 36 1b e2 7d d0 90 73 09 | d4 6c ee 78 57 89 23 0f ba 5d f2 bf 81 e7 2a 77 | 76 00 9e 60 79 df 5c 26 78 a4 75 48 29 00 00 24 | 6a e5 18 89 4d 38 8c b5 06 d2 d7 94 ba cc a3 bd | 70 1e fb ff 3d 86 47 55 80 8d 0d 90 48 39 6e 2a | 29 00 00 08 00 00 40 2e 29 00 00 0a 00 00 40 2f | 00 03 29 00 00 1c 00 00 40 04 af e9 c2 04 cc d9 | b3 14 0a eb 52 bc a0 8e a8 ea 0d 6a d7 ad 00 00 | 00 1c 00 00 40 05 9c a4 2e 7b ad 6c 76 ae e7 5e | 0a 3d de f2 ff 94 11 6c 1f 3a | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | e3 51 4d 89 0d d4 ea 56 | responder cookie: | b4 10 ea a2 a1 9d 88 3f | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (0x0) | length: 442 (0x1ba) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response | State DB: found IKEv2 state #1 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) | start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:2016) | [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:2062) | #1 is idle | #1 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 40 (0x28) | processing payload: ISAKMP_NEXT_v2SA (len=36) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (0x108) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (0x24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (0x8) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 10 (0xa) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=2) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (0x1c) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (0x1c) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | State DB: re-hashing IKEv2 state #1 IKE SPIi and SPI[ir] | #1 in state PARENT_I1: sent v2I1, expected v2R1 | selected state microcode Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH | Now let's proceed with state specific processing | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | ikev2 parent inR1: calculating g^{xy} in order to send I2 | using existing local IKE proposals for connection westnet-eastnet-ikev2 (IKE SA initiator accepting remote proposal): 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 2:IKE:ENCR=AES_GCM_C_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=NONE;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 3:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 4:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA2_512,HMAC_SHA2_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=MODP2048,MODP3072,MODP4096,MODP8192,ECP_256,ECP_384,ECP_521,CURVE25519 | Comparing remote proposals against IKE initiator (accepting) 4 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 2 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+DH; optional: INTEG | local proposal 2 type ENCR has 1 transforms | local proposal 2 type PRF has 2 transforms | local proposal 2 type INTEG has 1 transforms | local proposal 2 type DH has 8 transforms | local proposal 2 type ESN has 0 transforms | local proposal 2 transforms: required: ENCR+PRF+DH; optional: INTEG | local proposal 3 type ENCR has 1 transforms | local proposal 3 type PRF has 2 transforms | local proposal 3 type INTEG has 2 transforms | local proposal 3 type DH has 8 transforms | local proposal 3 type ESN has 0 transforms | local proposal 3 transforms: required: ENCR+PRF+INTEG+DH; optional: none | local proposal 4 type ENCR has 1 transforms | local proposal 4 type PRF has 2 transforms | local proposal 4 type INTEG has 2 transforms | local proposal 4 type DH has 8 transforms | local proposal 4 type ESN has 0 transforms | local proposal 4 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 36 (0x24) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (0x0) | # transforms: 3 (0x3) | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 4 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (0xc) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | remote proposal 1 transform 0 (ENCR=AES_GCM_C_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (0x8) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA2_512 (0x7) | remote proposal 1 transform 1 (PRF=HMAC_SHA2_512) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (0x8) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 2 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | remote proposal 1 proposed transforms: ENCR+PRF+DH; matched: ENCR+PRF+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+DH transforms to local proposal 1; required: ENCR+PRF+DH; optional: INTEG; matched: ENCR+PRF+DH | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:IKE:ENCR=AES_GCM_C_256;PRF=HMAC_SHA2_512;DH=MODP2048[first-match] | converting proposal to internal trans attrs | natd_hash: hasher=0x55809ff7e7a0(20) | natd_hash: icookie= e3 51 4d 89 0d d4 ea 56 | natd_hash: rcookie= b4 10 ea a2 a1 9d 88 3f | natd_hash: ip= c0 01 02 2d | natd_hash: port= 01 f4 | natd_hash: hash= 9c a4 2e 7b ad 6c 76 ae e7 5e 0a 3d de f2 ff 94 | natd_hash: hash= 11 6c 1f 3a | natd_hash: hasher=0x55809ff7e7a0(20) | natd_hash: icookie= e3 51 4d 89 0d d4 ea 56 | natd_hash: rcookie= b4 10 ea a2 a1 9d 88 3f | natd_hash: ip= c0 01 02 17 | natd_hash: port= 01 f4 | natd_hash: hash= af e9 c2 04 cc d9 b3 14 0a eb 52 bc a0 8e a8 ea | natd_hash: hash= 0d 6a d7 ad | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA2_512 integ=NONE cipherkey=AES_GCM_16 | adding ikev2_inR1outI2 KE work-order 2 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_PARENT_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x5580a0b64f28 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5580a0b64e48 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5580a0b64e48 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x7f62b8002888 size 128 | #1 spent 0.157 milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH in ikev2_process_state_packet() | [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3376) | #1 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND | suspending state #1 and saving MD | crypto helper 0 resuming | crypto helper 0 starting work-order 2 for state #1 | #1 is busy; has a suspended MD | crypto helper 0 doing compute dh (V2) (ikev2_inR1outI2 KE); request ID 2 | [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in log_stf_suspend() at ikev2.c:3266) | "westnet-eastnet-ikev2" #1 complete v2 state STATE_PARENT_I1 transition with STF_SUSPEND suspended from complete_v2_state_transition:3448 | stop processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.4 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.41 milliseconds in comm_handle_cb() reading and processing packet | calculating skeyseed using prf=sha2_512 integ=none cipherkey-size=32 salt-size=4 | crypto helper 0 finished compute dh (V2) (ikev2_inR1outI2 KE); request ID 2 time elapsed 0.001366 seconds | (#1) spent 1.37 milliseconds in crypto helper computing work-order 2: ikev2_inR1outI2 KE (pcr) | crypto helper 0 sending results from work-order 2 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f62b0000f48 size 128 | crypto helper 0 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 2 | calling continuation function 0x55809fea8630 | ikev2_parent_inR1outI2_continue for #1: calculating g^{xy}, sending I2 | creating state object #2 at 0x5580a0b699a8 | State DB: adding IKEv2 state #2 in UNDEFINED | pstats #2 ikev2.child started | duplicating state object #1 "westnet-eastnet-ikev2" as #2 for IPSEC SA | #2 setting local endpoint to 192.1.2.45:500 from #1.st_localport (in duplicate_state() at state.c:1481) | Message ID: init_child #1.#2; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1; child: wip.initiator=0->-1 wip.responder=0->-1 | Message ID: switch-from #1 response 0; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1 wip.initiator=0->-1 wip.responder=-1 | Message ID: switch-to #1.#2 response 0; ike: initiator.sent=0 initiator.recv=-1 responder.sent=-1 responder.recv=-1; child: wip.initiator=-1->0 wip.responder=-1 | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7f62b8002888 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5580a0b64e48 | event_schedule: new EVENT_SA_REPLACE-pe@0x5580a0b64e48 | inserting event EVENT_SA_REPLACE, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x7f62b8002888 size 128 | parent state #1: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) | **emit ISAKMP Message: | initiator cookie: | e3 51 4d 89 0d d4 ea 56 | responder cookie: | b4 10 ea a2 a1 9d 88 3f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 8 zero bytes of IV into IKEv2 Encryption Payload | IKEv2 CERT: send a certificate? | IKEv2 CERT: OK to send a certificate (always) | IDr payload will be sent | ****emit IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_DER_ASN1_DN (0x9) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' | emitting 57 raw bytes of my identity into IKEv2 Identification - Initiator - Payload | my identity 30 37 31 0b 30 09 06 03 55 04 06 13 02 43 48 31 | my identity 13 30 11 06 03 55 04 0a 13 0a 73 74 72 6f 6e 67 | my identity 53 77 61 6e 31 13 30 11 06 03 55 04 03 13 0a 73 | my identity 74 72 6f 6e 67 57 65 73 74 | emitting length of IKEv2 Identification - Initiator - Payload: 65 | Sending [CERT] of certificate: CN=strongWest,O=strongSwan,C=CH | ****emit IKEv2 Certificate Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ikev2 cert encoding: CERT_X509_SIGNATURE (0x4) | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Certificate Payload (37:ISAKMP_NEXT_v2CERT) | next payload chain: saving location 'IKEv2 Certificate Payload'.'next payload type' in 'reply packet' | emitting 519 raw bytes of CERT into IKEv2 Certificate Payload | CERT 30 82 02 03 30 82 01 89 a0 03 02 01 02 02 08 22 | CERT 37 92 2c 9e ca b5 3b 30 0a 06 08 2a 86 48 ce 3d | CERT 04 03 03 30 3a 31 0b 30 09 06 03 55 04 06 13 02 | CERT 43 48 31 13 30 11 06 03 55 04 0a 13 0a 73 74 72 | CERT 6f 6e 67 53 77 61 6e 31 16 30 14 06 03 55 04 03 | CERT 13 0d 73 74 72 6f 6e 67 53 77 61 6e 20 43 41 30 | CERT 1e 17 0d 31 39 30 39 31 36 31 39 34 35 34 34 5a | CERT 17 0d 32 32 30 39 31 35 31 39 34 35 34 34 5a 30 | CERT 37 31 0b 30 09 06 03 55 04 06 13 02 43 48 31 13 | CERT 30 11 06 03 55 04 0a 13 0a 73 74 72 6f 6e 67 53 | CERT 77 61 6e 31 13 30 11 06 03 55 04 03 13 0a 73 74 | CERT 72 6f 6e 67 57 65 73 74 30 76 30 10 06 07 2a 86 | CERT 48 ce 3d 02 01 06 05 2b 81 04 00 22 03 62 00 04 | CERT 45 a3 10 94 e8 cb 81 e6 de 68 55 25 aa 65 95 7d | CERT 8a f1 82 b0 3e bb 2a 76 7e 76 35 d6 45 ef 7a 37 | CERT e3 80 b3 41 a3 d8 8b 9b 45 d0 c3 23 63 51 d3 20 | CERT 12 f0 5a 79 7a 04 97 7f 10 40 49 0c de 0c 76 5c | CERT 80 fe 48 01 f9 f0 36 ce 72 ff 64 36 21 22 77 db | CERT ed 26 02 35 cc f3 82 33 b0 86 49 30 7b 96 5b c2 | CERT a3 5f 30 5d 30 1f 06 03 55 1d 23 04 18 30 16 80 | CERT 14 d7 ca e0 a4 20 b3 4c e3 a4 68 0c f0 d1 a6 1d | CERT 5e 96 dc cb 73 30 25 06 03 55 1d 11 04 1e 30 1c | CERT 82 1a 77 65 73 74 2e 74 65 73 74 69 6e 67 2e 6c | CERT 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 13 06 03 | CERT 55 1d 25 04 0c 30 0a 06 08 2b 06 01 05 05 07 03 | CERT 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 03 68 00 | CERT 30 65 02 31 00 9d e7 73 1b 9a bc be e4 b7 db 6d | CERT 1e 21 ab 40 22 ad e3 7f f6 1c 8b d1 8e 4f 20 83 | CERT 78 0f 09 b5 ac 0e 75 e5 32 09 e5 b4 82 50 cc e3 | CERT d4 c8 23 c1 a6 02 30 4e 0b dd 6f d5 91 88 9c 2a | CERT 33 13 3c 03 e7 27 17 a7 67 97 f9 7d eb 77 15 1f | CERT 0e c6 0b fe 51 2a 23 73 dc de 7b 71 8d 5f 94 88 | CERT 0c 40 dd 59 69 19 ed | emitting length of IKEv2 Certificate Payload: 524 | IKEv2 CERTREQ: send a cert request? | IKEv2 CERTREQ: policy does not have RSASIG: ECDSA | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | ID type: ID_DER_ASN1_DN (0x9) | next payload chain: ignoring supplied 'IKEv2 Identification - Responder - Payload'.'next payload type' value 39:ISAKMP_NEXT_v2AUTH | next payload chain: setting previous 'IKEv2 Certificate Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 57 raw bytes of IDr into IKEv2 Identification - Responder - Payload | IDr 30 37 31 0b 30 09 06 03 55 04 06 13 02 43 48 31 | IDr 13 30 11 06 03 55 04 0a 13 0a 73 74 72 6f 6e 67 | IDr 53 77 61 6e 31 13 30 11 06 03 55 04 03 13 0a 73 | IDr 74 72 6f 6e 67 45 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 65 | not sending INITIAL_CONTACT | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emitting 13 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier | 0c 30 0a 06 08 2a 86 48 ce 3d 04 03 03 | started looking for secret for C=CH, O=strongSwan, CN=strongWest->C=CH, O=strongSwan, CN=strongEast of kind PKK_ECDSA | pub 04 45 a3 10 94 e8 cb 81 e6 de 68 55 25 aa 65 95 | pub 7d 8a f1 82 b0 3e bb 2a 76 7e 76 35 d6 45 ef 7a | pub 37 e3 80 b3 41 a3 d8 8b 9b 45 d0 c3 23 63 51 d3 | pub 20 12 f0 5a 79 7a 04 97 7f 10 40 49 0c de 0c 76 | pub 5c 80 fe 48 01 f9 f0 36 ce 72 ff 64 36 21 22 77 | pub db ed 26 02 35 cc f3 82 33 b0 86 49 30 7b 96 5b | pub c2 | ecParams 06 05 2b 81 04 00 22 | keyid 04 45 a3 10 94 e8 cb 81 e6 | computed ecdsa CKAID | eb 4f f8 7f 1e 19 5d 07 21 6f 1d 63 72 32 5f 39 | 2f 73 83 41 | searching for certificate PKK_ECDSA:\004E\243\020\224\350\313\201\346 vs PKK_ECDSA:BEWjEJToy | CKAID matched cert strongWest | got cert form ckaid (SECERR: 35 (0x23): Certificate extension not found.) | #1 spent 3.01 milliseconds in ikev2_calculate_ecdsa_hash() calling sign_hash_ECDSA() | 103-byte DER encoded ECDSA signature: siBuffer: 30 65 02 31 00 ffffff8a 03 ffffff94 ffffffd1 fffffff5 ffffffee ffffff80 ffffff8f 33 ffffffd5 6c 6e 4a ffffffd4 ffffffad 06 fffffffc 4b ffffff9c 4c 6f 6c 0a 1f ffffffb2 ffffffb4 fffffff4 fffffff5 2d 46 ffffffe7 ffffffe3 ffffff85 ffffffaf 3c ffffffc7 3e 40 28 ffffff85 ffffff9d 5a 0e 78 11 02 72 01 02 30 30 33 ffffff93 ffffffd5 7e 49 67 ffffffa8 3f fffffff0 2b 6f 41 ffffffa0 ffffffb2 1d fffffff1 ffffffaa ffffff8f 2a 2e 70 ffffffaa ffffffe0 ffffffb9 36 19 ffffff98 5e 5e ffffffaf ffffffc6 03 ffffffc4 69 ffffff8a 74 ffffff92 5d ffffffcd ffffffa7 4e ffffffca 37 ffffff8a 45 ffffffd7 76 | emitting 103 raw bytes of ecdsa signature into IKEv2 Authentication Payload | ecdsa signature 30 65 02 31 00 8a 03 94 d1 f5 ee 80 8f 33 d5 6c | ecdsa signature 6e 4a d4 ad 06 fc 4b 9c 4c 6f 6c 0a 1f b2 b4 f4 | ecdsa signature f5 2d 46 e7 e3 85 af 3c c7 3e 40 28 85 9d 5a 0e | ecdsa signature 78 11 02 72 01 02 30 30 33 93 d5 7e 49 67 a8 3f | ecdsa signature f0 2b 6f 41 a0 b2 1d f1 aa 8f 2a 2e 70 aa e0 b9 | ecdsa signature 36 19 98 5e 5e af c6 03 c4 69 8a 74 92 5d cd a7 | ecdsa signature 4e ca 37 8a 45 d7 76 | emitting length of IKEv2 Authentication Payload: 124 | getting first pending from state #1 | netlink_get_spi: allocated 0xe3498e53 for esp.0@192.1.2.45 | constructing ESP/AH proposals with all DH removed for westnet-eastnet-ikev2 (IKE SA initiator emitting ESP/AH proposals) | converting proposal AES_GCM_16_256-NONE to ikev2 ... | ... ikev2_proposal: 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED | converting proposal AES_GCM_16_128-NONE to ikev2 ... | ... ikev2_proposal: 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED | converting proposal AES_CBC_256-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ... | ... ikev2_proposal: 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED | converting proposal AES_CBC_128-HMAC_SHA2_512_256+HMAC_SHA2_256_128 to ikev2 ... | ... ikev2_proposal: 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED "westnet-eastnet-ikev2": constructed local ESP/AH proposals for westnet-eastnet-ikev2 (IKE SA initiator emitting ESP/AH proposals): 1:ESP:ENCR=AES_GCM_C_256;INTEG=NONE;DH=NONE;ESN=DISABLED 2:ESP:ENCR=AES_GCM_C_128;INTEG=NONE;DH=NONE;ESN=DISABLED 3:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED 4:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256,HMAC_SHA2_256_128;DH=NONE;ESN=DISABLED | Emitting ikev2_proposals ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discarding INTEG=NONE | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 1 (0x1) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 2 (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi e3 49 8e 53 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | discarding INTEG=NONE | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 32 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding INTEG=NONE | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 2 (0x2) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 2 (0x2) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi e3 49 8e 53 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_GCM_C (0x14) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | discarding INTEG=NONE | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 32 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_NON_LAST (0x2) | prop #: 3 (0x3) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 4 (0x4) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi e3 49 8e 53 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 48 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | discarding DH=NONE | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 4 (0x4) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (0x4) | # transforms: 4 (0x4) | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is v2_PROPOSAL_NON_LAST (0x2) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi e3 49 8e 53 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discarding DH=NONE | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 48 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 164 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (0x1) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: 0 (0x0) | start port: 0 (0x0) | end port: 65535 (0xffff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (0x1) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: 0 (0x0) | start port: 0 (0x0) | end port: 65535 (0xffff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE | Initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 1019 | emitting length of ISAKMP Message: 1047 | **parse ISAKMP Message: | initiator cookie: | e3 51 4d 89 0d d4 ea 56 | responder cookie: | b4 10 ea a2 a1 9d 88 3f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | length: 1047 (0x417) | **parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 1019 (0x3fb) | **emit ISAKMP Message: | initiator cookie: | e3 51 4d 89 0d d4 ea 56 | responder cookie: | b4 10 ea a2 a1 9d 88 3f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | fragment number: 1 (0x1) | total fragments: 3 (0x3) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 478 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment 25 00 00 41 09 00 00 00 30 37 31 0b 30 09 06 03 | cleartext fragment 55 04 06 13 02 43 48 31 13 30 11 06 03 55 04 0a | cleartext fragment 13 0a 73 74 72 6f 6e 67 53 77 61 6e 31 13 30 11 | cleartext fragment 06 03 55 04 03 13 0a 73 74 72 6f 6e 67 57 65 73 | cleartext fragment 74 24 00 02 0c 04 30 82 02 03 30 82 01 89 a0 03 | cleartext fragment 02 01 02 02 08 22 37 92 2c 9e ca b5 3b 30 0a 06 | cleartext fragment 08 2a 86 48 ce 3d 04 03 03 30 3a 31 0b 30 09 06 | cleartext fragment 03 55 04 06 13 02 43 48 31 13 30 11 06 03 55 04 | cleartext fragment 0a 13 0a 73 74 72 6f 6e 67 53 77 61 6e 31 16 30 | cleartext fragment 14 06 03 55 04 03 13 0d 73 74 72 6f 6e 67 53 77 | cleartext fragment 61 6e 20 43 41 30 1e 17 0d 31 39 30 39 31 36 31 | cleartext fragment 39 34 35 34 34 5a 17 0d 32 32 30 39 31 35 31 39 | cleartext fragment 34 35 34 34 5a 30 37 31 0b 30 09 06 03 55 04 06 | cleartext fragment 13 02 43 48 31 13 30 11 06 03 55 04 0a 13 0a 73 | cleartext fragment 74 72 6f 6e 67 53 77 61 6e 31 13 30 11 06 03 55 | cleartext fragment 04 03 13 0a 73 74 72 6f 6e 67 57 65 73 74 30 76 | cleartext fragment 30 10 06 07 2a 86 48 ce 3d 02 01 06 05 2b 81 04 | cleartext fragment 00 22 03 62 00 04 45 a3 10 94 e8 cb 81 e6 de 68 | cleartext fragment 55 25 aa 65 95 7d 8a f1 82 b0 3e bb 2a 76 7e 76 | cleartext fragment 35 d6 45 ef 7a 37 e3 80 b3 41 a3 d8 8b 9b 45 d0 | cleartext fragment c3 23 63 51 d3 20 12 f0 5a 79 7a 04 97 7f 10 40 | cleartext fragment 49 0c de 0c 76 5c 80 fe 48 01 f9 f0 36 ce 72 ff | cleartext fragment 64 36 21 22 77 db ed 26 02 35 cc f3 82 33 b0 86 | cleartext fragment 49 30 7b 96 5b c2 a3 5f 30 5d 30 1f 06 03 55 1d | cleartext fragment 23 04 18 30 16 80 14 d7 ca e0 a4 20 b3 4c e3 a4 | cleartext fragment 68 0c f0 d1 a6 1d 5e 96 dc cb 73 30 25 06 03 55 | cleartext fragment 1d 11 04 1e 30 1c 82 1a 77 65 73 74 2e 74 65 73 | cleartext fragment 74 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e 6f | cleartext fragment 72 67 30 13 06 03 55 1d 25 04 0c 30 0a 06 08 2b | cleartext fragment 06 01 05 05 07 03 01 30 0a 06 08 2a 86 48 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 511 | emitting length of ISAKMP Message: 539 | **emit ISAKMP Message: | initiator cookie: | e3 51 4d 89 0d d4 ea 56 | responder cookie: | b4 10 ea a2 a1 9d 88 3f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 2 (0x2) | total fragments: 3 (0x3) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 478 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment ce 3d 04 03 03 03 68 00 30 65 02 31 00 9d e7 73 | cleartext fragment 1b 9a bc be e4 b7 db 6d 1e 21 ab 40 22 ad e3 7f | cleartext fragment f6 1c 8b d1 8e 4f 20 83 78 0f 09 b5 ac 0e 75 e5 | cleartext fragment 32 09 e5 b4 82 50 cc e3 d4 c8 23 c1 a6 02 30 4e | cleartext fragment 0b dd 6f d5 91 88 9c 2a 33 13 3c 03 e7 27 17 a7 | cleartext fragment 67 97 f9 7d eb 77 15 1f 0e c6 0b fe 51 2a 23 73 | cleartext fragment dc de 7b 71 8d 5f 94 88 0c 40 dd 59 69 19 ed 27 | cleartext fragment 00 00 41 09 00 00 00 30 37 31 0b 30 09 06 03 55 | cleartext fragment 04 06 13 02 43 48 31 13 30 11 06 03 55 04 0a 13 | cleartext fragment 0a 73 74 72 6f 6e 67 53 77 61 6e 31 13 30 11 06 | cleartext fragment 03 55 04 03 13 0a 73 74 72 6f 6e 67 45 61 73 74 | cleartext fragment 21 00 00 7c 0e 00 00 00 0c 30 0a 06 08 2a 86 48 | cleartext fragment ce 3d 04 03 03 30 65 02 31 00 8a 03 94 d1 f5 ee | cleartext fragment 80 8f 33 d5 6c 6e 4a d4 ad 06 fc 4b 9c 4c 6f 6c | cleartext fragment 0a 1f b2 b4 f4 f5 2d 46 e7 e3 85 af 3c c7 3e 40 | cleartext fragment 28 85 9d 5a 0e 78 11 02 72 01 02 30 30 33 93 d5 | cleartext fragment 7e 49 67 a8 3f f0 2b 6f 41 a0 b2 1d f1 aa 8f 2a | cleartext fragment 2e 70 aa e0 b9 36 19 98 5e 5e af c6 03 c4 69 8a | cleartext fragment 74 92 5d cd a7 4e ca 37 8a 45 d7 76 2c 00 00 a4 | cleartext fragment 02 00 00 20 01 03 04 02 e3 49 8e 53 03 00 00 0c | cleartext fragment 01 00 00 14 80 0e 01 00 00 00 00 08 05 00 00 00 | cleartext fragment 02 00 00 20 02 03 04 02 e3 49 8e 53 03 00 00 0c | cleartext fragment 01 00 00 14 80 0e 00 80 00 00 00 08 05 00 00 00 | cleartext fragment 02 00 00 30 03 03 04 04 e3 49 8e 53 03 00 00 0c | cleartext fragment 01 00 00 0c 80 0e 01 00 03 00 00 08 03 00 00 0e | cleartext fragment 03 00 00 08 03 00 00 0c 00 00 00 08 05 00 00 00 | cleartext fragment 00 00 00 30 04 03 04 04 e3 49 8e 53 03 00 00 0c | cleartext fragment 01 00 00 0c 80 0e 00 80 03 00 00 08 03 00 00 0e | cleartext fragment 03 00 00 08 03 00 00 0c 00 00 00 08 05 00 00 00 | cleartext fragment 2d 00 00 18 01 00 00 00 07 00 00 10 00 00 | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 511 | emitting length of ISAKMP Message: 539 | **emit ISAKMP Message: | initiator cookie: | e3 51 4d 89 0d d4 ea 56 | responder cookie: | b4 10 ea a2 a1 9d 88 3f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (0x1) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | fragment number: 3 (0x3) | total fragments: 3 (0x3) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 0:ISAKMP_NEXT_v2NONE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 8 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 34 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment ff ff c0 00 01 00 c0 00 01 ff 00 00 00 18 01 00 | cleartext fragment 00 00 07 00 00 10 00 00 ff ff c0 00 02 00 c0 00 | cleartext fragment 02 ff | adding 1 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 67 | emitting length of ISAKMP Message: 95 | suspend processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3376) | start processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3376) | #2 complete_v2_state_transition() md.from_state=PARENT_I1 md.svm.state[from]=PARENT_I1 UNDEFINED->PARENT_I2 with status STF_OK | IKEv2: transition from state STATE_PARENT_I1 to state STATE_PARENT_I2 | child state #2: UNDEFINED(ignore) => PARENT_I2(open IKE SA) | Message ID: updating counters for #2 to 0 after switching state | Message ID: recv #1.#2 response 0; ike: initiator.sent=0 initiator.recv=-1->0 responder.sent=-1 responder.recv=-1; child: wip.initiator=0->-1 wip.responder=-1 | Message ID: sent #1.#2 request 1; ike: initiator.sent=0->1 initiator.recv=0 responder.sent=-1 responder.recv=-1; child: wip.initiator=-1->1 wip.responder=-1 "westnet-eastnet-ikev2" #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048} | sending V2 reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending fragments ... | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | e3 51 4d 89 0d d4 ea 56 b4 10 ea a2 a1 9d 88 3f | 35 20 23 08 00 00 00 01 00 00 02 1b 23 00 01 ff | 00 01 00 03 1c f4 95 00 df c2 9d 7c 9e af 9f ac | fc 49 fb 41 cd 51 ef 89 31 2c 38 57 af b7 5b 95 | 5d 05 49 03 e8 de 0b d0 e2 ae 94 e2 28 dd f0 47 | 65 d8 0b d5 96 37 f3 62 e0 72 76 6c 07 0d 0e d4 | d1 47 c8 12 53 9a 0a 86 2a fb a7 45 2e ca b6 6e | cf 46 6a 39 cb b0 fa f4 9d 0b cb 2b 95 ca bf 6b | 36 c6 88 6a 69 ad 89 43 17 53 58 aa 22 89 ae 1e | af bf 09 d4 07 69 8e b5 a2 a0 8a 34 90 5b e5 fc | 68 72 de 3f c8 0a 8e 22 0f 46 f4 7c 89 6f 5f 20 | 84 1d 30 22 be ea a9 90 ba 05 84 b6 a1 5b db 7b | 8d 02 30 7f f3 13 d6 bf c7 db 1c 4e 02 a8 09 79 | 8b 67 cf 06 3c 44 61 33 00 0f 35 a1 eb d0 05 2c | 33 87 db a1 da ba 12 07 7b 7b 3d b9 89 d2 8f 2e | 4e d8 b0 a2 c5 71 08 74 88 6d d6 30 d1 2b a3 96 | fd 97 cb 77 dd 0e 6c 08 b8 44 1f ba 44 9a 6c 8e | 09 28 91 c6 16 ea fd 57 8f 6b 74 a7 03 07 e2 d3 | d8 93 99 d7 ac e0 d9 7f 43 54 05 b3 82 41 74 99 | 66 4e 41 79 29 bb ce a0 b7 de 1b b0 cd fe 8c 29 | da 56 25 2d 8a dc af 2d eb b3 5d d8 6b 15 91 20 | 45 f7 27 b7 cb 47 d6 87 65 3d 1f 8b 7b d8 a5 ed | a0 87 ff bb e6 fa 2e 40 16 f8 c2 90 10 03 27 65 | 15 6d fa ac 36 c0 55 14 26 e1 42 9d d3 b5 01 94 | 2d 01 35 be cb af 47 91 47 fa 17 45 0c 07 ee c3 | b9 f6 ff 3c 84 cb 12 26 1d 29 b0 6c 26 7c 54 94 | ec 9f 3b 6b 72 f3 9c c1 9a cd c5 0a fd 85 ca 9d | 53 bb b7 d5 be c8 e1 08 9e 7b d1 ef 8c ba a3 61 | 58 ae 1e 01 74 53 e7 fd 7c c5 71 82 31 57 f4 a3 | 96 81 fa c7 35 9a bd 29 e9 1a 5c cb 57 0f 94 d4 | 53 48 bf ad 38 d8 78 3e a1 ff 71 f2 09 7a 65 1c | 21 15 fa 98 61 16 d0 a4 b0 4c 10 9d 7c e3 be 24 | f4 94 b5 fb 2c d7 b2 6d f5 b2 87 a1 c0 45 a0 b8 | c0 10 90 03 6c 47 93 05 3d eb cf | sending 539 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | e3 51 4d 89 0d d4 ea 56 b4 10 ea a2 a1 9d 88 3f | 35 20 23 08 00 00 00 01 00 00 02 1b 00 00 01 ff | 00 02 00 03 bb ca 59 f4 13 39 28 8b 53 7f 01 39 | 40 e0 7d 85 92 48 b2 dd a9 49 d5 7e b5 dc 18 79 | 1f 91 ae 82 9a 8e ec 75 8c 5d 76 ab f3 92 0c eb | 32 21 c0 fb c6 15 06 50 d4 39 be 60 04 6e e3 47 | 48 cd ff 55 08 c9 d6 7f 27 6a d3 54 21 37 b2 5f | 76 53 ca a0 01 be 1e 11 99 61 16 39 14 9c 64 49 | 24 c7 a2 36 f6 c8 18 24 67 23 7f 10 49 b1 de 49 | 72 35 40 0d 57 8f 43 6d de 4f f8 5e 74 54 4c af | e9 06 a9 63 ec 7b de c4 66 0a 7e 32 37 19 e3 c7 | e5 1b 2f df 5c d5 4b 0f 30 97 20 3e 08 85 d8 82 | 89 6f d8 6d 58 95 dc 9c 11 b9 10 4a 23 e7 99 6c | de 75 45 84 e7 88 f4 94 89 69 b7 fb 0f 49 09 7a | 7e 28 50 0b a4 2f 68 19 80 cc 8a 43 d7 22 70 3d | c6 ed dd 5b c7 ec be 07 25 58 cd f3 32 30 9c d0 | 00 2c 1e 2a 21 96 e4 0c 0d 50 9f ec a6 4c 09 7a | 8c 58 d5 96 ab 9b d1 86 71 58 60 d4 b1 d2 b9 d5 | c3 7e 42 55 19 a4 b7 0a f2 ba 04 c6 7d 49 5a 12 | 91 f6 3e 92 7d 5e 30 91 9f 3e 14 e9 6e cd 2b dd | 88 c7 75 95 eb 25 6d b0 67 c2 17 c3 c4 44 ec ac | 1e 5d 90 ba 75 91 a4 76 ed 56 c3 81 bf db 0a 87 | 5b e2 db 7f d8 c5 2e 7d 6f 21 80 c4 a8 c2 a4 b0 | a3 5f 59 05 ac 63 80 2a 3f ea 07 aa 21 a3 2d ae | ba 8e 59 aa ed 4b 26 b3 a9 73 e2 f5 73 4c cc c9 | f1 ea e7 cd 7e d6 1d 97 38 b3 bd 89 2f df dd 06 | eb 5d 34 72 0a 27 58 aa 3d 50 59 34 a1 cd f6 13 | 8b 2f ac 06 7e 6d c3 1c 97 de c1 3a 67 27 87 f7 | 6e 75 dc f0 a4 c4 b6 22 5e 82 6b 96 1b 2a f2 d8 | 53 f2 f3 ea e2 fd 33 ce f2 c7 33 69 2e 74 8e f6 | b0 b0 5b 7b de 6f 5f 03 86 df 36 b1 4d b5 b6 18 | 0f f0 fb 87 5b 87 c4 b7 6f 9e 1f 1f 95 c7 39 b6 | dd 34 82 b0 88 72 d7 f1 5b bb ea 12 d8 f1 73 da | 68 ba ec cd 5e 8d 8d eb 68 eb e4 | sending 95 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | e3 51 4d 89 0d d4 ea 56 b4 10 ea a2 a1 9d 88 3f | 35 20 23 08 00 00 00 01 00 00 00 5f 00 00 00 43 | 00 03 00 03 e5 e3 5d 63 50 a7 6b e4 ee 9f 52 0a | d4 3f d0 dd 68 12 0a bf fb 1d f1 96 98 dc 73 43 | 5f e3 85 d8 ac bf 23 e5 75 7a 77 11 73 c6 48 e4 | 7b df 62 88 c0 c1 87 47 37 6b c2 a8 0d 9b d0 | sent 3 fragments | success_v2_state_transition scheduling EVENT_RETRANSMIT of c->r_interval=500ms "westnet-eastnet-ikev2" #2: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5580a0b3ac88 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x5580a0b6ed98 size 128 | #2 STATE_PARENT_I2: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 49630.902119 | resume sending helper answer for #1 suppresed complete_v2_state_transition() | #1 spent 4.23 milliseconds in resume sending helper answer | stop processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f62b0000f48 | spent 0.00296 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 65 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | e3 51 4d 89 0d d4 ea 56 b4 10 ea a2 a1 9d 88 3f | 2e 20 23 20 00 00 00 01 00 00 00 41 29 00 00 25 | 45 94 a4 dd 1e 3c 4f bd 03 a4 a4 ed a9 55 04 66 | 52 f8 b3 fb fb a6 01 2e 1f dd e8 62 de 2d 4a ea | 87 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | e3 51 4d 89 0d d4 ea 56 | responder cookie: | b4 10 ea a2 a1 9d 88 3f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (0x1) | length: 65 (0x41) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) | start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:2016) | State DB: found IKEv2 state #2 in PARENT_I2 (find_v2_sa_by_initiator_wip) | suspend processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:2062) | start processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:2062) | #2 is idle | #2 idle | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 37 (0x25) | processing payload: ISAKMP_NEXT_v2SK (len=33) | #2 in state PARENT_I2: sent v2I2, expected v2R2 | #2 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2N) | **parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 8 (0x8) | Protocol ID: PROTO_v2_RESERVED (0x0) | SPI size: 0 (0x0) | Notify Message Type: v2N_AUTHENTICATION_FAILED (0x18) | processing payload: ISAKMP_NEXT_v2N (len=0) | selected state microcode Initiator: process AUTHENTICATION_FAILED AUTH notification | Now let's proceed with state specific processing | calling processor Initiator: process AUTHENTICATION_FAILED AUTH notification "westnet-eastnet-ikev2" #2: IKE SA authentication request rejected by peer: AUTHENTICATION_FAILED | pstats #1 ikev2.ike failed auth-failed "westnet-eastnet-ikev2" #2: scheduling retry attempt 1 of an unlimited number, but releasing whack | release_pending_whacks: state #2 fd@25 .st_dev=9 .st_ino=3414992 | close_any(fd@25) (in release_whack() at state.c:654) | close_any(fd@24) (in release_whack() at state.c:654) | release_pending_whacks: IKE SA #1 fd@-1 has pending CHILD SA with socket fd@25 | libevent_free: release ptr-libevent@0x5580a0b6ed98 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5580a0b3ac88 | event_schedule: new EVENT_RETRANSMIT-pe@0x5580a0b3ac88 | inserting event EVENT_RETRANSMIT, timeout in 59.99603 seconds for #2 | libevent_malloc: new ptr-libevent@0x7f62b0000f48 size 128 "westnet-eastnet-ikev2" #2: STATE_PARENT_I2: suppressing retransmits; will wait 59.99603 seconds for retry | #2 spent 0.0646 milliseconds in processing: Initiator: process AUTHENTICATION_FAILED AUTH notification in ikev2_process_state_packet() | [RE]START processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3376) | #2 complete_v2_state_transition() PARENT_I2->PARENT_I2 with status STF_IGNORE | stop processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:2018) | #1 spent 0.246 milliseconds in ikev2_process_packet() | stop processing: from 192.1.2.23:500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.261 milliseconds in comm_handle_cb() reading and processing packet | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | FOR_EACH_STATE_... in show_traffic_status (sort_states) | FOR_EACH_STATE_... in sort_states | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0362 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.116 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "westnet-eastnet-ikev2" (in terminate_a_connection() at terminate.c:69) "westnet-eastnet-ikev2": terminating SAs using this connection | connection 'westnet-eastnet-ikev2' -POLICY_UP | close_any(fd@25) Errno 9: Bad file descriptor (in delete_pending() at pending.c:244) | removing pending policy for no connection {0x5580a0a4e898} | connection not shared - terminating IKE and IPsec SA | Deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #2 | suspend processing: connection "westnet-eastnet-ikev2" (in foreach_state_by_connection_func_delete() at state.c:1310) | start processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #2 ikev2.child deleted other | #2 spent 0.0646 milliseconds in total | [RE]START processing: state #2 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in delete_state() at state.c:879) "westnet-eastnet-ikev2" #2: deleting state (STATE_PARENT_I2) aged 13.442s and NOT sending notification | child state #2: PARENT_I2(open IKE SA) => delete | child state #2: PARENT_I2(open IKE SA) => CHILDSA_DEL(informational) | state #2 requesting EVENT_RETRANSMIT to be deleted | #2 STATE_CHILDSA_DEL: retransmits: cleared | libevent_free: release ptr-libevent@0x7f62b0000f48 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5580a0b3ac88 | priority calculation of connection "westnet-eastnet-ikev2" is 0xfe7e7 | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => unk255.10000@192.1.2.45 (raw_eroute) | raw_eroute result=success | stop processing: connection "westnet-eastnet-ikev2" (BACKGROUND) (in update_state_connection() at connections.c:4037) | start processing: connection NULL (in update_state_connection() at connections.c:4038) | in connection_discard for connection westnet-eastnet-ikev2 | State DB: deleting IKEv2 state #2 in CHILDSA_DEL | child state #2: CHILDSA_DEL(informational) => UNDEFINED(ignore) | stop processing: state #2 from 192.1.2.23:500 (in delete_state() at state.c:1143) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | state #1 | start processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1310) | pstats #1 ikev2.ike deleted auth-failed | #1 spent 8.79 milliseconds in total | [RE]START processing: state #1 connection "westnet-eastnet-ikev2" from 192.1.2.23:500 (in delete_state() at state.c:879) "westnet-eastnet-ikev2" #1: deleting state (STATE_PARENT_I2) aged 13.450s and NOT sending notification | parent state #1: PARENT_I2(open IKE SA) => delete | state #1 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x7f62b8002888 | free_event_entry: release EVENT_SA_REPLACE-pe@0x5580a0b64e48 | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-ikev2 | State DB: deleting IKEv2 state #1 in PARENT_I2 | parent state #1: PARENT_I2(open IKE SA) => UNDEFINED(ignore) | stop processing: state #1 from 192.1.2.23:500 (in delete_state() at state.c:1143) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1312) | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | processing: STOP connection NULL (in terminate_a_connection() at terminate.c:87) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "westnet-eastnet-ikev2" (in delete_connection() at connections.c:189) | Deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | free hp@0x5580a0b61dd8 | flush revival: connection 'westnet-eastnet-ikev2' wasn't on the list | stop processing: connection "westnet-eastnet-ikev2" (in discard_connection() at connections.c:249) | FOR_EACH_CONNECTION_... in conn_by_name | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.248 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) shutting down | processing: RESET whack log_fd (was fd@16) (in exit_pluto() at plutomain.c:1825) | pluto_sd: executing action action: stopping(6), status 0 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' | unreference key: 0x5580a0b649e8 C=CH, O=strongSwan, CN=strongWest cnt 1-- | unreference key: 0x5580a0b64758 @west.testing.libreswan.org cnt 1-- | crl fetch request list locked by 'free_crl_fetch' | crl fetch request list unlocked by 'free_crl_fetch' shutting down interface lo/lo 127.0.0.1:4500 shutting down interface lo/lo 127.0.0.1:500 shutting down interface eth0/eth0 192.0.1.254:4500 shutting down interface eth0/eth0 192.0.1.254:500 shutting down interface eth1/eth1 192.1.2.45:4500 shutting down interface eth1/eth1 192.1.2.45:500 | FOR_EACH_STATE_... in delete_states_dead_interfaces | libevent_free: release ptr-libevent@0x5580a0b52438 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e388 | libevent_free: release ptr-libevent@0x5580a0af8bd8 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e438 | libevent_free: release ptr-libevent@0x5580a0af84a8 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e4e8 | libevent_free: release ptr-libevent@0x5580a0af7d78 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e598 | libevent_free: release ptr-libevent@0x5580a0af7e78 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e648 | libevent_free: release ptr-libevent@0x5580a0af7f28 | free_event_entry: release EVENT_NULL-pe@0x5580a0b5e6f8 | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | libevent_free: release ptr-libevent@0x5580a0b524e8 | free_event_entry: release EVENT_NULL-pe@0x5580a0b46618 | libevent_free: release ptr-libevent@0x5580a0af8b28 | free_event_entry: release EVENT_NULL-pe@0x5580a0b46178 | libevent_free: release ptr-libevent@0x5580a0b3f258 | free_event_entry: release EVENT_NULL-pe@0x5580a0b00208 | global timer EVENT_REINIT_SECRET uninitialized | global timer EVENT_SHUNT_SCAN uninitialized | global timer EVENT_PENDING_DDNS uninitialized | global timer EVENT_PENDING_PHASE2 uninitialized | global timer EVENT_CHECK_CRLS uninitialized | global timer EVENT_REVIVE_CONNS uninitialized | global timer EVENT_FREE_ROOT_CERTS uninitialized | global timer EVENT_RESET_LOG_RATE_LIMIT uninitialized | global timer EVENT_NAT_T_KEEPALIVE uninitialized | libevent_free: release ptr-libevent@0x5580a0b45818 | signal event handler PLUTO_SIGCHLD uninstalled | libevent_free: release ptr-libevent@0x5580a0b5da58 | signal event handler PLUTO_SIGTERM uninstalled | libevent_free: release ptr-libevent@0x5580a0b5db68 | signal event handler PLUTO_SIGHUP uninstalled | libevent_free: release ptr-libevent@0x5580a0b5dda8 | signal event handler PLUTO_SIGSYS uninstalled | releasing event base | libevent_free: release ptr-libevent@0x5580a0b5dc78 | libevent_free: release ptr-libevent@0x5580a0a825c8 | libevent_free: release ptr-libevent@0x5580a0b40ac8 | libevent_free: release ptr-libevent@0x5580a0b06758 | libevent_free: release ptr-libevent@0x5580a0b40a88 | libevent_free: release ptr-libevent@0x5580a0b5d828 | libevent_free: release ptr-libevent@0x5580a0b5d9d8 | libevent_free: release ptr-libevent@0x5580a0b40b18 | libevent_free: release ptr-libevent@0x5580a0b461e8 | libevent_free: release ptr-libevent@0x5580a0b45e48 | libevent_free: release ptr-libevent@0x5580a0b5e768 | libevent_free: release ptr-libevent@0x5580a0b5e6b8 | libevent_free: release ptr-libevent@0x5580a0b5e608 | libevent_free: release ptr-libevent@0x5580a0b5e558 | libevent_free: release ptr-libevent@0x5580a0b5e4a8 | libevent_free: release ptr-libevent@0x5580a0b5e3f8 | libevent_free: release ptr-libevent@0x5580a0a81ad8 | libevent_free: release ptr-libevent@0x5580a0b5db28 | libevent_free: release ptr-libevent@0x5580a0b5da18 | libevent_free: release ptr-libevent@0x5580a0b5d998 | libevent_free: release ptr-libevent@0x5580a0b5dc38 | libevent_free: release ptr-libevent@0x5580a0b5d868 | libevent_free: release ptr-libevent@0x5580a0b06358 | libevent_free: release ptr-libevent@0x5580a0b062f8 | libevent_free: release ptr-libevent@0x5580a0a81e48 | releasing global libevent data | libevent_free: release ptr-libevent@0x5580a0b064d8 | libevent_free: release ptr-libevent@0x5580a0b06458 | libevent_free: release ptr-libevent@0x5580a0b063d8 leak: 5 * ecParams, item size: 7 leak detective found 5 leaks, total size 7