FIPS Product: YES FIPS Kernel: NO FIPS Mode: NO NSS DB directory: sql:/etc/ipsec.d Initializing NSS Opening NSS database "sql:/etc/ipsec.d" read-only NSS initialized NSS crypto library initialized FIPS HMAC integrity support [enabled] FIPS mode disabled for pluto daemon FIPS HMAC integrity verification self-test FAILED libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v3.28-827-gc9aa82b8a6-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC SYSTEMD_WATCHDOG FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:18460 core dump dir: /run/pluto secrets file: /etc/ipsec.secrets leak-detective disabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: new ptr-libevent@0x5649e58ed0f0 size 40 | libevent_malloc: new ptr-libevent@0x5649e58ed120 size 40 | libevent_malloc: new ptr-libevent@0x5649e58ee8b0 size 40 | creating event base | libevent_malloc: new ptr-libevent@0x5649e58ee870 size 56 | libevent_malloc: new ptr-libevent@0x5649e58ee8e0 size 664 | libevent_malloc: new ptr-libevent@0x5649e58eeb80 size 24 | libevent_malloc: new ptr-libevent@0x5649e58a80a0 size 384 | libevent_malloc: new ptr-libevent@0x5649e58eeba0 size 16 | libevent_malloc: new ptr-libevent@0x5649e58eebc0 size 40 | libevent_malloc: new ptr-libevent@0x5649e58eebf0 size 48 | libevent_realloc: new ptr-libevent@0x5649e58eec30 size 256 | libevent_malloc: new ptr-libevent@0x5649e58eed40 size 16 | libevent_free: release ptr-libevent@0x5649e58ee870 | libevent initialized | libevent_realloc: new ptr-libevent@0x5649e58eed60 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm, aes_ccm_c AES_CCM_12 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_b AES_CCM_8 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_a 3DES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS [*192] 3des CAMELLIA_CTR IKEv1: ESP IKEv2: ESP {256,192,*128} CAMELLIA_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} camellia AES_GCM_16 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm, aes_gcm_c AES_GCM_12 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_b AES_GCM_8 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_a AES_CTR IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aesctr AES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aes SERPENT_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} serpent TWOFISH_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} twofish TWOFISH_SSH IKEv1: IKE IKEv2: IKE ESP {256,192,*128} twofish_cbc_ssh NULL_AUTH_AES_GMAC IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_gmac NULL IKEv1: ESP IKEv2: ESP [] CHACHA20_POLY1305 IKEv1: IKEv2: IKE ESP [*256] chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: SHA1 IKEv1: IKE IKEv2: FIPS sha SHA2_256 IKEv1: IKE IKEv2: FIPS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: FIPS sha384 SHA2_512 IKEv1: IKE IKEv2: FIPS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 crypto helpers started thread for crypto helper 0 started thread for crypto helper 1 started thread for crypto helper 2 started thread for crypto helper 3 started thread for crypto helper 4 started thread for crypto helper 5 started thread for crypto helper 6 | checking IKEv1 state table | MAIN_R0: category: half-open IKE SA flags: 0: | -> MAIN_R1 EVENT_SO_DISCARD | MAIN_I1: category: half-open IKE SA flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT | MAIN_R1: category: open IKE SA flags: 200: | -> MAIN_R2 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_I2: category: open IKE SA flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_R2: category: open IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | -> MAIN_R3 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_I3: category: open IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | -> MAIN_I4 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_R3: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | MAIN_I4: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | AGGR_R0: category: half-open IKE SA flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD | AGGR_I1: category: half-open IKE SA flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE | -> AGGR_I2 EVENT_SA_REPLACE | AGGR_R1: category: open IKE SA flags: 200: | -> AGGR_R2 EVENT_SA_REPLACE | -> AGGR_R2 EVENT_SA_REPLACE | AGGR_I2: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | AGGR_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | QUICK_R0: category: established CHILD SA flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT | QUICK_I1: category: established CHILD SA flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE | QUICK_R1: category: established CHILD SA flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE | QUICK_I2: category: established CHILD SA flags: 200: | -> UNDEFINED EVENT_NULL | QUICK_R2: category: established CHILD SA flags: 0: | -> UNDEFINED EVENT_NULL | INFO: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | INFO_PROTECTED: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | XAUTH_R0: category: established IKE SA flags: 0: | -> XAUTH_R1 EVENT_NULL | XAUTH_R1: category: established IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | MODE_CFG_R0: category: informational flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE | MODE_CFG_R1: category: established IKE SA flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE | MODE_CFG_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | MODE_CFG_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | XAUTH_I0: category: established IKE SA flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT | XAUTH_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT | checking IKEv2 state table | PARENT_I0: category: ignore flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA flags: 0: | -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH) | PARENT_I2: category: open IKE SA flags: 0: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_I3: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_RETAIN (I3: Informational Request) | -> PARENT_I3 EVENT_RETAIN (I3: Informational Response) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response) | PARENT_R0: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED)) | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request) | PARENT_R2: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request) | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response) | V2_CREATE_I0: category: established IKE SA flags: 0: | -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | V2_CREATE_I: category: established IKE SA flags: 0: | -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_IKE_I0: category: established IKE SA flags: 0: | -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_REKEY_CHILD_I0: category: established IKE SA flags: 0: | -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_REKEY_CHILD_I: category: established IKE SA flags: 0: | V2_CREATE_R: category: established IKE SA flags: 0: | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request) | V2_REKEY_IKE_R: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_R: category: established IKE SA flags: 0: | V2_IPSEC_I: category: established CHILD SA flags: 0: | V2_IPSEC_R: category: established CHILD SA flags: 0: | IKESA_DEL: category: established IKE SA flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational flags: 0: | starting up helper thread 0 | status value returned by setting the priority of this thread (crypto helper 0) 22 Using Linux XFRM/NETKEY IPsec interface code on 5.2.11+ | starting up helper thread 3 | status value returned by setting the priority of this thread (crypto helper 3) 22 | crypto helper 0 waiting (nothing to do) | crypto helper 3 waiting (nothing to do) | starting up helper thread 4 | status value returned by setting the priority of this thread (crypto helper 4) 22 | crypto helper 4 waiting (nothing to do) | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding SERPENT_CBC to kernel algorithm db | adding TWOFISH_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | starting up helper thread 1 | status value returned by setting the priority of this thread (crypto helper 1) 22 | crypto helper 1 waiting (nothing to do) | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | starting up helper thread 2 | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | starting up helper thread 5 | status value returned by setting the priority of this thread (crypto helper 5) 22 | crypto helper 5 waiting (nothing to do) | starting up helper thread 6 | setup kernel fd callback | status value returned by setting the priority of this thread (crypto helper 2) 22 | crypto helper 2 waiting (nothing to do) | add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x5649e58f9550 | status value returned by setting the priority of this thread (crypto helper 6) 22 | libevent_malloc: new ptr-libevent@0x5649e5900590 size 128 | libevent_malloc: new ptr-libevent@0x5649e58f4790 size 16 | add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x5649e58f39d0 | libevent_malloc: new ptr-libevent@0x5649e5900620 size 128 | libevent_malloc: new ptr-libevent@0x5649e58eef70 size 16 | global one-shot timer EVENT_CHECK_CRLS initialized selinux support is enabled. systemd watchdog not enabled - not sending watchdog keepalives | unbound context created - setting debug level to 5 | crypto helper 6 waiting (nothing to do) | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | Loading dnssec root key from:/var/lib/unbound/root.key | No additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x5649e58f4850 | libevent_malloc: new ptr-libevent@0x5649e590abb0 size 128 | libevent_malloc: new ptr-libevent@0x5649e590ac40 size 16 | libevent_realloc: new ptr-libevent@0x5649e590ac60 size 256 | libevent_malloc: new ptr-libevent@0x5649e590ad70 size 8 | libevent_realloc: new ptr-libevent@0x5649e58ff890 size 144 | libevent_malloc: new ptr-libevent@0x5649e590ad90 size 152 | libevent_malloc: new ptr-libevent@0x5649e590ae30 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: new ptr-libevent@0x5649e590ae50 size 8 | libevent_malloc: new ptr-libevent@0x5649e590ae70 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: new ptr-libevent@0x5649e590af10 size 8 | libevent_malloc: new ptr-libevent@0x5649e590af30 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: new ptr-libevent@0x5649e590afd0 size 8 | libevent_realloc: release ptr-libevent@0x5649e58ff890 | libevent_realloc: new ptr-libevent@0x5649e590aff0 size 256 | libevent_malloc: new ptr-libevent@0x5649e58ff890 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:18616) using fork+execve | forked child 18616 | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | pluto_sd: executing action action: reloading(4), status 0 listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 Kernel supports NIC esp-hw-offload adding interface eth1/eth1 (esp-hw-offload not supported by kernel) 192.1.2.45:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth1/eth1 192.1.2.45:4500 adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.0.1.254:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth0/eth0 192.0.1.254:4500 adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface lo/lo 127.0.0.1:4500 | no interfaces to sort | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | add_fd_read_event_handler: new ethX-pe@0x5649e590b3d0 | libevent_malloc: new ptr-libevent@0x5649e590b410 size 128 | libevent_malloc: new ptr-libevent@0x5649e590b4a0 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 22 | add_fd_read_event_handler: new ethX-pe@0x5649e590b4c0 | libevent_malloc: new ptr-libevent@0x5649e590b500 size 128 | libevent_malloc: new ptr-libevent@0x5649e590b590 size 16 | setup callback for interface lo 127.0.0.1:500 fd 21 | add_fd_read_event_handler: new ethX-pe@0x5649e590b5b0 | libevent_malloc: new ptr-libevent@0x5649e590b5f0 size 128 | libevent_malloc: new ptr-libevent@0x5649e590b680 size 16 | setup callback for interface eth0 192.0.1.254:4500 fd 20 | add_fd_read_event_handler: new ethX-pe@0x5649e590b6a0 | libevent_malloc: new ptr-libevent@0x5649e590b6e0 size 128 | libevent_malloc: new ptr-libevent@0x5649e590b770 size 16 | setup callback for interface eth0 192.0.1.254:500 fd 19 | add_fd_read_event_handler: new ethX-pe@0x5649e590b790 | libevent_malloc: new ptr-libevent@0x5649e590b7d0 size 128 | libevent_malloc: new ptr-libevent@0x5649e590b860 size 16 | setup callback for interface eth1 192.1.2.45:4500 fd 18 | add_fd_read_event_handler: new ethX-pe@0x5649e590b880 | libevent_malloc: new ptr-libevent@0x5649e590b8c0 size 128 | libevent_malloc: new ptr-libevent@0x5649e590b950 size 16 | setup callback for interface eth1 192.1.2.45:500 fd 17 | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 loaded private key for keyid: PKK_RSA:AQOm9dY/4 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | pluto_sd: executing action action: ready(5), status 0 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.682 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | pluto_sd: executing action action: reloading(4), status 0 listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 | no interfaces to sort | libevent_free: release ptr-libevent@0x5649e590b410 | free_event_entry: release EVENT_NULL-pe@0x5649e590b3d0 | add_fd_read_event_handler: new ethX-pe@0x5649e590b3d0 | libevent_malloc: new ptr-libevent@0x5649e590b410 size 128 | setup callback for interface lo 127.0.0.1:4500 fd 22 | libevent_free: release ptr-libevent@0x5649e590b500 | free_event_entry: release EVENT_NULL-pe@0x5649e590b4c0 | add_fd_read_event_handler: new ethX-pe@0x5649e590b4c0 | libevent_malloc: new ptr-libevent@0x5649e590b500 size 128 | setup callback for interface lo 127.0.0.1:500 fd 21 | libevent_free: release ptr-libevent@0x5649e590b5f0 | free_event_entry: release EVENT_NULL-pe@0x5649e590b5b0 | add_fd_read_event_handler: new ethX-pe@0x5649e590b5b0 | libevent_malloc: new ptr-libevent@0x5649e590b5f0 size 128 | setup callback for interface eth0 192.0.1.254:4500 fd 20 | libevent_free: release ptr-libevent@0x5649e590b6e0 | free_event_entry: release EVENT_NULL-pe@0x5649e590b6a0 | add_fd_read_event_handler: new ethX-pe@0x5649e590b6a0 | libevent_malloc: new ptr-libevent@0x5649e590b6e0 size 128 | setup callback for interface eth0 192.0.1.254:500 fd 19 | libevent_free: release ptr-libevent@0x5649e590b7d0 | free_event_entry: release EVENT_NULL-pe@0x5649e590b790 | add_fd_read_event_handler: new ethX-pe@0x5649e590b790 | libevent_malloc: new ptr-libevent@0x5649e590b7d0 size 128 | setup callback for interface eth1 192.1.2.45:4500 fd 18 | libevent_free: release ptr-libevent@0x5649e590b8c0 | free_event_entry: release EVENT_NULL-pe@0x5649e590b880 | add_fd_read_event_handler: new ethX-pe@0x5649e590b880 | libevent_malloc: new ptr-libevent@0x5649e590b8c0 size 128 | setup callback for interface eth1 192.1.2.45:500 fd 17 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | computed rsa CKAID 7f 0f 03 50 loaded private key for keyid: PKK_RSA:AQOm9dY/4 | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | pluto_sd: executing action action: ready(5), status 0 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.335 milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 18616 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0171 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | old debugging base+cpu-usage + none | base debugging = base+cpu-usage | old impairing none + delete-on-retransmit | base impairing = delete-on-retransmit | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0489 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection nss-cert with policy ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | setting ID to ID_DER_ASN1_DN: 'E=user-signedbyother@testing.libreswan.org,CN=signedbyother.other.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA' | loading left certificate 'signedbyother' pubkey | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x5649e590d240 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x5649e590d320 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x5649e590d2b0 | unreference key: 0x5649e590c930 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.other.libreswan.org, E=user-signedbyother@testing.libreswan.org cnt 1-- | certs and keys locked by 'lsw_add_rsa_secret' | certs and keys unlocked by 'lsw_add_rsa_secret' | counting wild cards for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.other.libreswan.org, E=user-signedbyother@testing.libreswan.org is 0 | ASCII to DN <= "C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org" | ASCII to DN => 30 81 ac 31 0b 30 09 06 03 55 04 06 13 02 43 41 | ASCII to DN => 31 10 30 0e 06 03 55 04 08 13 07 4f 6e 74 61 72 | ASCII to DN => 69 6f 31 10 30 0e 06 03 55 04 07 13 07 54 6f 72 | ASCII to DN => 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 13 09 4c | ASCII to DN => 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | ASCII to DN => 0b 13 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | ASCII to DN => 6e 74 31 25 30 23 06 03 55 04 03 13 1c 4c 69 62 | ASCII to DN => 72 65 73 77 61 6e 20 74 65 73 74 20 43 41 20 66 | ASCII to DN => 6f 72 20 6d 61 69 6e 63 61 31 24 30 22 06 09 2a | ASCII to DN => 86 48 86 f7 0d 01 09 01 16 15 74 65 73 74 69 6e | ASCII to DN => 67 40 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 | counting wild cards for %fromcert is 0 | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | new hp@0x5649e58ed040 added connection description "nss-cert" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.0.1.254/32===192.1.2.45<192.1.2.45>[C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.other.libreswan.org, E=user-signedbyother@testing.libreswan.org]...192.1.2.23<192.1.2.23>[%fromcert]===192.0.2.254/32 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.35 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_STATE_... in show_states_status (sort_states) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.325 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | old debugging base+cpu-usage + none | base debugging = base+cpu-usage | old impairing delete-on-retransmit + suppress-retransmits | base impairing = delete-on-retransmit+suppress-retransmits | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0484 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | dup_any(fd@16) -> fd@23 (in whack_process() at rcv_whack.c:590) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "nss-cert" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'nss-cert' +POLICY_UP | dup_any(fd@23) -> fd@24 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | creating state object #1 at 0x5649e5911830 | State DB: adding IKEv1 state #1 in UNDEFINED | pstats #1 ikev1.isakmp started | suspend processing: connection "nss-cert" (in main_outI1() at ikev1_main.c:118) | start processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in main_outI1() at ikev1_main.c:118) | parent state #1: UNDEFINED(ignore) => MAIN_I1(half-open IKE SA) | dup_any(fd@24) -> fd@25 (in main_outI1() at ikev1_main.c:123) | Queuing pending IPsec SA negotiating with 192.1.2.23 "nss-cert" IKE SA #1 "nss-cert" "nss-cert" #1: initiating Main Mode | **emit ISAKMP Message: | initiator cookie: | 56 c8 37 d2 a4 f6 ee cd | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 1:ISAKMP_NEXT_SA | no specific IKE algorithms specified - using defaults | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() returning 0x5649e5912490 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 18 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 18 (0x12) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 1 (0x1) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 2 (0x2) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 3 (0x3) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 4 (0x4) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 5 (0x5) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 6 (0x6) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 7 (0x7) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 8 (0x8) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 9 (0x9) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 10 (0xa) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 11 (0xb) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 12 (0xc) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 13 (0xd) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 14 (0xe) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 15 (0xf) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 16 (0x10) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP transform number: 17 (0x11) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | emitting length of ISAKMP Proposal Payload: 632 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 644 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | out_vid(): sending [FRAGMENTATION] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [Dead Peer Detection] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 | emitting length of ISAKMP Vendor ID Payload: 20 | nat add vid | sending draft and RFC NATT VIDs | out_vid(): sending [RFC 3947] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | emitting length of ISAKMP Vendor ID Payload: 20 | skipping VID_NATT_RFC | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-03] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02_n] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 | emitting length of ISAKMP Vendor ID Payload: 20 | no IKEv1 message padding required | emitting length of ISAKMP Message: 792 | sending 792 bytes for reply packet for main_outI1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 56 c8 37 d2 a4 f6 ee cd 00 00 00 00 00 00 00 00 | 01 10 02 00 00 00 00 00 00 00 03 18 0d 00 02 84 | 00 00 00 01 00 00 00 01 00 00 02 78 00 01 00 12 | 03 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 00 03 80 04 00 0e | 80 0e 01 00 03 00 00 24 01 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 04 80 03 00 03 | 80 04 00 0e 80 0e 00 80 03 00 00 24 02 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 06 | 80 03 00 03 80 04 00 0e 80 0e 01 00 03 00 00 24 | 03 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 06 80 03 00 03 80 04 00 0e 80 0e 00 80 | 03 00 00 24 04 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 02 80 03 00 03 80 04 00 0e | 80 0e 01 00 03 00 00 24 05 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 02 80 03 00 03 | 80 04 00 0e 80 0e 00 80 03 00 00 24 06 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 04 | 80 03 00 03 80 04 00 05 80 0e 01 00 03 00 00 24 | 07 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 04 80 03 00 03 80 04 00 05 80 0e 00 80 | 03 00 00 24 08 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 06 80 03 00 03 80 04 00 05 | 80 0e 01 00 03 00 00 24 09 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 06 80 03 00 03 | 80 04 00 05 80 0e 00 80 03 00 00 24 0a 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 02 | 80 03 00 03 80 04 00 05 80 0e 01 00 03 00 00 24 | 0b 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 02 80 03 00 03 80 04 00 05 80 0e 00 80 | 03 00 00 20 0c 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 00 03 80 04 00 0e | 03 00 00 20 0d 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 00 03 80 04 00 0e | 03 00 00 20 0e 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 0e | 03 00 00 20 0f 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 00 03 80 04 00 05 | 03 00 00 20 10 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 00 03 80 04 00 05 | 00 00 00 20 11 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 00 03 80 04 00 05 | 0d 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 de 7f | 00 d6 c2 d3 0d 00 00 14 af ca d7 13 68 a1 f1 c9 | 6b 86 96 fc 77 57 01 00 0d 00 00 14 4a 13 1c 81 | 07 03 58 45 5c 57 28 f2 0e 95 45 2f 0d 00 00 14 | 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5 | ec 42 7b 1f 00 00 00 14 cd 60 46 43 35 df 21 f8 | 7c fd b2 fc 68 b6 a4 48 "nss-cert" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5649e5910b90 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5649e590d3b0 size 128 | #1 STATE_MAIN_I1: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50119.276817 | #1 spent 1.58 milliseconds in main_outI1() | stop processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in main_outI1() at ikev1_main.c:228) | resume processing: connection "nss-cert" (in main_outI1() at ikev1_main.c:228) | stop processing: connection "nss-cert" (in initiate_a_connection() at initiate.c:349) | close_any(fd@23) (in initiate_connection() at initiate.c:372) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.65 milliseconds in whack | spent 0.00221 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 144 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | 56 c8 37 d2 a4 f6 ee cd c7 84 9d a8 f1 72 07 42 | 01 10 02 00 00 00 00 00 00 00 00 90 0d 00 00 38 | 00 00 00 01 00 00 00 01 00 00 00 2c 00 01 00 01 | 00 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 00 03 80 04 00 0e | 80 0e 01 00 0d 00 00 14 40 48 b7 d5 6e bc e8 85 | 25 e7 de 7f 00 d6 c2 d3 0d 00 00 14 af ca d7 13 | 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 00 00 00 14 | 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 56 c8 37 d2 a4 f6 ee cd | responder cookie: | c7 84 9d a8 f1 72 07 42 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 144 (0x90) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: IKEv1 state not found (find_state_ikev1) | State DB: found IKEv1 state #1 in MAIN_I1 (find_state_ikev1_init) | start processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1435) | #1 is idle | #1 idle | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x2 opt: 0x2080 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 20 (0x14) | message 'main_inR1_outI2' HASH payload not checked early | received Vendor ID payload [FRAGMENTATION] | received Vendor ID payload [Dead Peer Detection] | quirks.qnat_traversal_vid set to=117 [RFC 3947] | received Vendor ID payload [RFC 3947] | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 1 (0x1) | *****parse ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 3 (0x3) | [3 is OAKLEY_RSA_SIG] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | OAKLEY proposal verified unconditionally; no alg_info to check against | Oakley Transform 0 accepted | sender checking NAT-T: enabled; VID 117 | returning NAT-T method NAT_TRAVERSAL_METHOD_IETF_RFC | enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal) | adding outI2 KE work-order 1 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x5649e590d3b0 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5649e5910b90 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x5649e5910b90 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5649e590d3b0 size 128 | crypto helper 0 resuming | complete v1 state transition with STF_SUSPEND | crypto helper 0 starting work-order 1 for state #1 | [RE]START processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2624) | suspending state #1 and saving MD | #1 is busy; has a suspended MD | #1 spent 0.134 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | crypto helper 0 doing build KE and nonce (outI2 KE); request ID 1 | stop processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.275 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 0 finished build KE and nonce (outI2 KE); request ID 1 time elapsed 0.00104 seconds | (#1) spent 1.04 milliseconds in crypto helper computing work-order 1: outI2 KE (pcr) | crypto helper 0 sending results from work-order 1 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f5df4006900 size 128 | crypto helper 0 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 1 | calling continuation function 0x5649e38ae630 | main_inR1_outI2_continue for #1: calculated ke+nonce, sending I2 | **emit ISAKMP Message: | initiator cookie: | 56 c8 37 d2 a4 f6 ee cd | responder cookie: | c7 84 9d a8 f1 72 07 42 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value b9 45 e2 a2 da f5 18 d1 75 ad 00 8e f9 b6 af a7 | keyex value 6c 3a 20 d9 dd b3 55 0b bf c3 b0 f5 03 3a 7c 04 | keyex value fb a2 ac 59 66 07 86 9f d7 29 7e 89 ff 48 08 f8 | keyex value db b3 93 9e c4 93 d7 6e 2e be a8 ab c2 ad 08 cd | keyex value c6 41 42 af c3 32 8b a2 7a b8 e2 a6 cf 9e 92 6d | keyex value 97 70 f3 90 1a 3b 9c 5f cd c0 81 51 2d f6 7b ed | keyex value 80 06 fe 20 ec 48 7f 6c ec 35 0d 4c 5c 4f 88 d4 | keyex value ba b5 1a 7a 8e 30 fa 95 ad 84 31 50 85 e0 5a 3e | keyex value 8b 4b 12 fc e7 f8 29 fe 08 08 5b 66 61 68 5e 78 | keyex value bc 08 d3 c4 cb 71 d9 16 e1 71 94 7a d9 c7 ff d7 | keyex value 9f 8e 44 fd f3 02 ee a4 40 17 77 1a 91 7c 43 b1 | keyex value ae af 4b e7 c3 53 cd e1 9f fe 81 79 00 2a d7 dc | keyex value ba 24 cc 5e 89 09 be 0e 30 0e 4b df 2e 51 94 35 | keyex value 1a 2d 1d b5 82 fa e8 af 7d ce 29 07 f3 8d 08 45 | keyex value 0d 17 93 fc b7 5f 26 0e f1 88 ad 5d 6a 1a c2 75 | keyex value 6c 88 76 fb 79 07 37 5f 52 a1 02 20 2e 59 f5 ac | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni 6a ec 28 57 8d 20 3c 46 55 55 b2 7e 1c 66 25 59 | Ni 19 01 a3 d4 24 cf 72 3b ba cf ca 9a f7 ba 28 d9 | emitting length of ISAKMP Nonce Payload: 36 | NAT-T checking st_nat_traversal | NAT-T found (implies NAT_T_WITH_NATD) | sending NAT-D payloads | natd_hash: hasher=0x5649e3984c40(32) | natd_hash: icookie= 56 c8 37 d2 a4 f6 ee cd | natd_hash: rcookie= c7 84 9d a8 f1 72 07 42 | natd_hash: ip= c0 01 02 17 | natd_hash: port= 01 f4 | natd_hash: hash= dc 4e af 02 be f2 5b a4 89 f4 1f 0c 3f 80 3e 00 | natd_hash: hash= bc 52 94 12 82 0b c2 23 63 73 4b b8 2a a7 81 d1 | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | next payload chain: ignoring supplied 'ISAKMP NAT-D Payload'.'next payload type' value 20:ISAKMP_NEXT_NATD_RFC | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D dc 4e af 02 be f2 5b a4 89 f4 1f 0c 3f 80 3e 00 | NAT-D bc 52 94 12 82 0b c2 23 63 73 4b b8 2a a7 81 d1 | emitting length of ISAKMP NAT-D Payload: 36 | natd_hash: hasher=0x5649e3984c40(32) | natd_hash: icookie= 56 c8 37 d2 a4 f6 ee cd | natd_hash: rcookie= c7 84 9d a8 f1 72 07 42 | natd_hash: ip= c0 01 02 2d | natd_hash: port= 01 f4 | natd_hash: hash= 69 a3 8f a6 57 ac cb c6 2a c5 41 50 ed ab 9f 17 | natd_hash: hash= 92 cc 8f 63 8c db 17 e8 db cf d4 72 7a bd 2c 46 | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP NAT-D Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 69 a3 8f a6 57 ac cb c6 2a c5 41 50 ed ab 9f 17 | NAT-D 92 cc 8f 63 8c db 17 e8 db cf d4 72 7a bd 2c 46 | emitting length of ISAKMP NAT-D Payload: 36 | no IKEv1 message padding required | emitting length of ISAKMP Message: 396 | State DB: re-hashing IKEv1 state #1 IKE SPIi and SPI[ir] | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #1 is idle | doing_xauth:no, t_xauth_client_done:no | peer supports fragmentation | peer supports DPD | IKEv1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 | parent state #1: MAIN_I1(half-open IKE SA) => MAIN_I2(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5649e590d3b0 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x5649e5910b90 | sending reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 396 bytes for STATE_MAIN_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 56 c8 37 d2 a4 f6 ee cd c7 84 9d a8 f1 72 07 42 | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | b9 45 e2 a2 da f5 18 d1 75 ad 00 8e f9 b6 af a7 | 6c 3a 20 d9 dd b3 55 0b bf c3 b0 f5 03 3a 7c 04 | fb a2 ac 59 66 07 86 9f d7 29 7e 89 ff 48 08 f8 | db b3 93 9e c4 93 d7 6e 2e be a8 ab c2 ad 08 cd | c6 41 42 af c3 32 8b a2 7a b8 e2 a6 cf 9e 92 6d | 97 70 f3 90 1a 3b 9c 5f cd c0 81 51 2d f6 7b ed | 80 06 fe 20 ec 48 7f 6c ec 35 0d 4c 5c 4f 88 d4 | ba b5 1a 7a 8e 30 fa 95 ad 84 31 50 85 e0 5a 3e | 8b 4b 12 fc e7 f8 29 fe 08 08 5b 66 61 68 5e 78 | bc 08 d3 c4 cb 71 d9 16 e1 71 94 7a d9 c7 ff d7 | 9f 8e 44 fd f3 02 ee a4 40 17 77 1a 91 7c 43 b1 | ae af 4b e7 c3 53 cd e1 9f fe 81 79 00 2a d7 dc | ba 24 cc 5e 89 09 be 0e 30 0e 4b df 2e 51 94 35 | 1a 2d 1d b5 82 fa e8 af 7d ce 29 07 f3 8d 08 45 | 0d 17 93 fc b7 5f 26 0e f1 88 ad 5d 6a 1a c2 75 | 6c 88 76 fb 79 07 37 5f 52 a1 02 20 2e 59 f5 ac | 14 00 00 24 6a ec 28 57 8d 20 3c 46 55 55 b2 7e | 1c 66 25 59 19 01 a3 d4 24 cf 72 3b ba cf ca 9a | f7 ba 28 d9 14 00 00 24 dc 4e af 02 be f2 5b a4 | 89 f4 1f 0c 3f 80 3e 00 bc 52 94 12 82 0b c2 23 | 63 73 4b b8 2a a7 81 d1 00 00 00 24 69 a3 8f a6 | 57 ac cb c6 2a c5 41 50 ed ab 9f 17 92 cc 8f 63 | 8c db 17 e8 db cf d4 72 7a bd 2c 46 | !event_already_set at reschedule "nss-cert" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5649e5910b90 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5649e590d3b0 size 128 | #1 STATE_MAIN_I2: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50119.279535 "nss-cert" #1: STATE_MAIN_I2: sent MI2, expecting MR2 | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 0.374 milliseconds in resume sending helper answer | stop processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f5df4006900 | spent 0.00298 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 576 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | 56 c8 37 d2 a4 f6 ee cd c7 84 9d a8 f1 72 07 42 | 04 10 02 00 00 00 00 00 00 00 02 40 0a 00 01 04 | 92 b3 9d 84 1d 73 7e cd 02 55 d9 8b a3 29 2f da | 6c 9a 0a e4 68 16 8f b5 28 52 44 e6 f5 35 65 57 | da 28 c7 a1 96 f7 fd 17 51 8e cf 68 d1 86 73 1e | 84 32 19 52 e6 4c 3f e8 6d 3c 58 28 66 75 c4 a9 | 47 8c a1 43 a6 40 f8 19 30 e2 7a 22 bd 74 67 69 | bb 71 82 3a e9 fd d2 53 9b e6 2d 04 3d e8 23 09 | 9b 04 bd 84 59 de 97 fb 18 77 19 df f1 d7 1f 00 | 18 21 67 07 95 95 6f 5c cd a8 c1 11 13 a1 d8 76 | 83 45 6b 31 d1 dd bd 00 46 04 8d 4e 23 73 28 8c | bd 80 a6 79 d1 df f3 09 09 0a 82 2f f9 4a 64 52 | 33 a2 72 46 aa 78 b2 5d 30 68 dc 6a 8b 4f 8d b3 | 40 02 0b 0c e7 d3 fc a2 a2 ae fd 8c 60 90 40 8f | e8 90 78 13 51 33 61 4a 04 d8 8e d8 6a 83 7c cc | a6 94 31 85 db cd 21 ad 16 d2 b6 71 2b 5e 5d 60 | c1 55 b9 a0 76 b1 07 8c fb 2e 54 fe c2 de 7d 9d | e4 56 27 5f e4 90 f9 39 67 cc 03 2a c2 97 db 07 | 07 00 00 24 13 81 9f 93 f5 8e 94 87 3e 30 9f 3f | aa 69 83 e5 8a fb 39 88 60 29 ee 24 14 20 49 e7 | 22 6c 37 a8 14 00 00 b4 04 30 81 ac 31 0b 30 09 | 06 03 55 04 06 13 02 43 41 31 10 30 0e 06 03 55 | 04 08 13 07 4f 6e 74 61 72 69 6f 31 10 30 0e 06 | 03 55 04 07 13 07 54 6f 72 6f 6e 74 6f 31 12 30 | 10 06 03 55 04 0a 13 09 4c 69 62 72 65 73 77 61 | 6e 31 18 30 16 06 03 55 04 0b 13 0f 54 65 73 74 | 20 44 65 70 61 72 74 6d 65 6e 74 31 25 30 23 06 | 03 55 04 03 13 1c 4c 69 62 72 65 73 77 61 6e 20 | 74 65 73 74 20 43 41 20 66 6f 72 20 6d 61 69 6e | 63 61 31 24 30 22 06 09 2a 86 48 86 f7 0d 01 09 | 01 16 15 74 65 73 74 69 6e 67 40 6c 69 62 72 65 | 73 77 61 6e 2e 6f 72 67 14 00 00 24 69 a3 8f a6 | 57 ac cb c6 2a c5 41 50 ed ab 9f 17 92 cc 8f 63 | 8c db 17 e8 db cf d4 72 7a bd 2c 46 00 00 00 24 | dc 4e af 02 be f2 5b a4 89 f4 1f 0c 3f 80 3e 00 | bc 52 94 12 82 0b c2 23 63 73 4b b8 2a a7 81 d1 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 56 c8 37 d2 a4 f6 ee cd | responder cookie: | c7 84 9d a8 f1 72 07 42 | next payload type: ISAKMP_NEXT_KE (0x4) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 576 (0x240) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_I2 (find_state_ikev1) | start processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1435) | #1 is idle | #1 idle | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x410 opt: 0x102080 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 260 (0x104) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x102080 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_CR (0x7) | length: 36 (0x24) | got payload 0x80 (ISAKMP_NEXT_CR) needed: 0x0 opt: 0x102080 | ***parse ISAKMP Certificate RequestPayload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 180 (0xb4) | cert type: CERT_X509_SIGNATURE (0x4) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | message 'main_inR2_outI3' HASH payload not checked early | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.other.libreswan.org, E=user-signedbyother@testing.libreswan.org->%fromcert of kind PKK_PSK | actually looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.other.libreswan.org, E=user-signedbyother@testing.libreswan.org->%fromcert of kind PKK_PSK | line 0: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.other.libreswan.org, E=user-signedbyother@testing.libreswan.org) to type PKK_RSA | line 1: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.other.libreswan.org, E=user-signedbyother@testing.libreswan.org) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding aggr outR1 DH work-order 2 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I2: retransmits: cleared | libevent_free: release ptr-libevent@0x5649e590d3b0 | free_event_entry: release EVENT_RETRANSMIT-pe@0x5649e5910b90 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7f5df4002b20 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5649e590d3b0 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2624) | suspending state #1 and saving MD | #1 is busy; has a suspended MD | #1 spent 0.0857 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.295 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 3 resuming | crypto helper 3 starting work-order 2 for state #1 | crypto helper 3 doing compute dh+iv (V1 Phase 1) (aggr outR1 DH); request ID 2 | crypto helper 3 finished compute dh+iv (V1 Phase 1) (aggr outR1 DH); request ID 2 time elapsed 0.001173 seconds | (#1) spent 1.18 milliseconds in crypto helper computing work-order 2: aggr outR1 DH (pcr) | crypto helper 3 sending results from work-order 2 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7f5dec004f00 size 128 | crypto helper 3 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 3 replies to request ID 2 | calling continuation function 0x5649e38ae630 | main_inR2_outI3_cryptotail for #1: calculated DH, sending R1 | **emit ISAKMP Message: | initiator cookie: | 56 c8 37 d2 a4 f6 ee cd | responder cookie: | c7 84 9d a8 f1 72 07 42 | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 5:ISAKMP_NEXT_ID | CR 30 81 ac 31 0b 30 09 06 03 55 04 06 13 02 43 41 | CR 31 10 30 0e 06 03 55 04 08 13 07 4f 6e 74 61 72 | CR 69 6f 31 10 30 0e 06 03 55 04 07 13 07 54 6f 72 | CR 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 13 09 4c | CR 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | CR 0b 13 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | CR 6e 74 31 25 30 23 06 03 55 04 03 13 1c 4c 69 62 | CR 72 65 73 77 61 6e 20 74 65 73 74 20 43 41 20 66 | CR 6f 72 20 6d 61 69 6e 63 61 31 24 30 22 06 09 2a | CR 86 48 86 f7 0d 01 09 01 16 15 74 65 73 74 69 6e | CR 67 40 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 | requested CA: 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | thinking about whether to send my certificate: | I have RSA key: OAKLEY_RSA_SIG cert.type: CERT_X509_SIGNATURE | sendcert: CERT_ALWAYSSEND and I did get a certificate request | so send cert. | I am sending a certificate request | I will NOT send an initial contact payload | init checking NAT-T: enabled; RFC 3947 (NAT-Traversal) | natd_hash: hasher=0x5649e3984c40(32) | natd_hash: icookie= 56 c8 37 d2 a4 f6 ee cd | natd_hash: rcookie= c7 84 9d a8 f1 72 07 42 | natd_hash: ip= c0 01 02 2d | natd_hash: port= 01 f4 | natd_hash: hash= 69 a3 8f a6 57 ac cb c6 2a c5 41 50 ed ab 9f 17 | natd_hash: hash= 92 cc 8f 63 8c db 17 e8 db cf d4 72 7a bd 2c 46 | natd_hash: hasher=0x5649e3984c40(32) | natd_hash: icookie= 56 c8 37 d2 a4 f6 ee cd | natd_hash: rcookie= c7 84 9d a8 f1 72 07 42 | natd_hash: ip= c0 01 02 17 | natd_hash: port= 01 f4 | natd_hash: hash= dc 4e af 02 be f2 5b a4 89 f4 1f 0c 3f 80 3e 00 | natd_hash: hash= bc 52 94 12 82 0b c2 23 63 73 4b b8 2a a7 81 d1 | expected NAT-D(me): 69 a3 8f a6 57 ac cb c6 2a c5 41 50 ed ab 9f 17 | expected NAT-D(me): 92 cc 8f 63 8c db 17 e8 db cf d4 72 7a bd 2c 46 | expected NAT-D(him): | dc 4e af 02 be f2 5b a4 89 f4 1f 0c 3f 80 3e 00 | bc 52 94 12 82 0b c2 23 63 73 4b b8 2a a7 81 d1 | received NAT-D: 69 a3 8f a6 57 ac cb c6 2a c5 41 50 ed ab 9f 17 | received NAT-D: 92 cc 8f 63 8c db 17 e8 db cf d4 72 7a bd 2c 46 | received NAT-D: dc 4e af 02 be f2 5b a4 89 f4 1f 0c 3f 80 3e 00 | received NAT-D: bc 52 94 12 82 0b c2 23 63 73 4b b8 2a a7 81 d1 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: no NAT detected | NAT_T_WITH_KA detected | global one-shot timer EVENT_NAT_T_KEEPALIVE scheduled in 20 seconds | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_CERT (0x6) | ID type: ID_DER_ASN1_DN (0x9) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 6:ISAKMP_NEXT_CERT | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 199 raw bytes of my identity into ISAKMP Identification Payload (IPsec DOI) | my identity 30 81 c4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | my identity 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | my identity 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | my identity 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | my identity 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | my identity 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | my identity 6e 74 31 2a 30 28 06 03 55 04 03 0c 21 73 69 67 | my identity 6e 65 64 62 79 6f 74 68 65 72 2e 6f 74 68 65 72 | my identity 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 31 37 | my identity 30 35 06 09 2a 86 48 86 f7 0d 01 09 01 16 28 75 | my identity 73 65 72 2d 73 69 67 6e 65 64 62 79 6f 74 68 65 | my identity 72 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | my identity 77 61 6e 2e 6f 72 67 | emitting length of ISAKMP Identification Payload (IPsec DOI): 207 "nss-cert" #1: I am sending my cert | ***emit ISAKMP Certificate Payload: | next payload type: ISAKMP_NEXT_CR (0x7) | cert encoding: CERT_X509_SIGNATURE (0x4) | next payload chain: ignoring supplied 'ISAKMP Certificate Payload'.'next payload type' value 7:ISAKMP_NEXT_CR | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Certificate Payload (6:ISAKMP_NEXT_CERT) | next payload chain: saving location 'ISAKMP Certificate Payload'.'next payload type' in 'reply packet' | emitting 1248 raw bytes of CERT into ISAKMP Certificate Payload | CERT 30 82 04 dc 30 82 04 45 a0 03 02 01 02 02 01 34 | CERT 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 | CERT 81 ad 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 | CERT 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 69 | CERT 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 6f | CERT 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c 69 | CERT 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 0b | CERT 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 6e | CERT 74 31 26 30 24 06 03 55 04 03 0c 1d 4c 69 62 72 | CERT 65 73 77 61 6e 20 74 65 73 74 20 43 41 20 66 6f | CERT 72 20 6f 74 68 65 72 63 61 31 24 30 22 06 09 2a | CERT 86 48 86 f7 0d 01 09 01 16 15 74 65 73 74 69 6e | CERT 67 40 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 | CERT 22 18 0f 32 30 31 39 30 39 31 35 31 39 34 34 35 | CERT 39 5a 18 0f 32 30 32 32 30 39 31 34 31 39 34 34 | CERT 35 39 5a 30 81 c4 31 0b 30 09 06 03 55 04 06 13 | CERT 02 43 41 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e | CERT 74 61 72 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 | CERT 54 6f 72 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a | CERT 0c 09 4c 69 62 72 65 73 77 61 6e 31 18 30 16 06 | CERT 03 55 04 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 | CERT 74 6d 65 6e 74 31 2a 30 28 06 03 55 04 03 0c 21 | CERT 73 69 67 6e 65 64 62 79 6f 74 68 65 72 2e 6f 74 | CERT 68 65 72 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 | CERT 67 31 37 30 35 06 09 2a 86 48 86 f7 0d 01 09 01 | CERT 16 28 75 73 65 72 2d 73 69 67 6e 65 64 62 79 6f | CERT 74 68 65 72 40 74 65 73 74 69 6e 67 2e 6c 69 62 | CERT 72 65 73 77 61 6e 2e 6f 72 67 30 82 01 a2 30 0d | CERT 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 | CERT 8f 00 30 82 01 8a 02 82 01 81 00 a0 8f 69 8c 90 | CERT 70 77 95 e5 f3 1e 5c 3c 69 3c 95 56 42 53 7a 90 | CERT 74 53 e3 fc 0f f1 0c 75 48 30 91 94 be 8b 43 59 | CERT 4d c5 81 44 28 f7 50 cc 42 2a ab cc 2a 1a eb 3b | CERT a0 81 5e 48 37 65 b4 5b 84 b1 27 06 ae ae 99 c1 | CERT d3 25 74 66 86 f3 31 f9 ee b4 96 4b 14 d5 db 2d | CERT 6a 92 27 e7 9d f4 b6 5b 32 25 04 f3 cf 95 ba 8a | CERT 55 20 61 78 63 ed 04 13 35 95 95 ed 69 4d d1 9e | CERT 17 f9 0c f2 c8 85 9b 34 7c 2e 44 b7 be 40 e0 0a | CERT 9d 93 b5 f8 b5 78 bf 7e 9c 6a fb f7 2f 23 a4 9a | CERT ad 17 bc c0 65 26 5b 53 23 cd 26 72 1b f0 08 ee | CERT 0d ee d4 82 ad fc ac 3d bf 23 b6 d0 db 09 4d 5c | CERT 53 ff 1e b9 f9 a2 e7 3a 84 90 9f 21 f0 ff 07 ac | CERT 6b e9 13 fe da 94 3a 0b f9 1c 53 21 bd 23 95 7b | CERT 96 fa 29 a7 f4 26 67 9f 8e b6 38 45 23 a3 2d 67 | CERT 2d 65 da 5c 9f fe 7e e5 09 9e 9d 21 df ec 0a a7 | CERT 99 d5 79 9a 05 c0 f9 ea bf 42 de 25 ca ba 53 17 | CERT eb 74 70 1d ef ee b5 b8 3b 1e 3c 07 6b f9 14 bf | CERT 91 e8 35 ca ee 5a 8e 12 91 4a 10 c8 bb ea 4a b9 | CERT c4 d8 a6 1a 1e d5 ee 94 b6 0d f9 49 fb 35 0d 60 | CERT 84 49 46 f0 2e 65 98 95 57 07 67 17 79 da 00 3e | CERT cf c7 88 68 b4 44 dc 30 fb 5f 46 44 21 5d 76 ef | CERT 8d 56 72 c7 f5 56 73 9b e3 5b 40 29 76 d6 71 ea | CERT f2 c1 08 3b c0 d1 0a 5b 19 f5 da d9 fc 0a 87 2e | CERT 9f ce c7 94 26 72 a9 95 7b 3e 37 02 03 01 00 01 | CERT a3 81 ea 30 81 e7 30 09 06 03 55 1d 13 04 02 30 | CERT 00 30 2c 06 03 55 1d 11 04 25 30 23 82 21 73 69 | CERT 67 6e 65 64 62 79 6f 74 68 65 72 2e 6f 74 68 65 | CERT 72 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 | CERT 0b 06 03 55 1d 0f 04 04 03 02 07 80 30 1d 06 03 | CERT 55 1d 25 04 16 30 14 06 08 2b 06 01 05 05 07 03 | CERT 01 06 08 2b 06 01 05 05 07 03 02 30 41 06 08 2b | CERT 06 01 05 05 07 01 01 04 35 30 33 30 31 06 08 2b | CERT 06 01 05 05 07 30 01 86 25 68 74 74 70 3a 2f 2f | CERT 6e 69 63 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 | CERT 65 73 77 61 6e 2e 6f 72 67 3a 32 35 36 30 30 3d | CERT 06 03 55 1d 1f 04 36 30 34 30 32 a0 30 a0 2e 86 | CERT 2c 68 74 74 70 3a 2f 2f 6e 69 63 2e 74 65 73 74 | CERT 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e 2e 6f 72 | CERT 67 2f 72 65 76 6f 6b 65 64 2e 63 72 6c 30 0d 06 | CERT 09 2a 86 48 86 f7 0d 01 01 0b 05 00 03 81 81 00 | CERT 4c b0 f9 3a 21 03 67 e6 ff 6e e9 fe 8e 06 72 4d | CERT 32 34 ce 65 93 f2 af cc c3 df 71 dc 05 05 74 50 | CERT 26 ef 75 da fb 77 43 f0 c5 b3 09 ba 33 53 c2 b5 | CERT f0 fa bc 86 1d fb c3 59 e5 cb 5c 53 7f 4b 13 72 | CERT a0 0f 33 6f 01 a7 18 98 2b c1 3c b7 75 8b 92 27 | CERT 54 3f 7c d1 09 16 76 d2 01 42 86 ca 9a a6 cb de | CERT 74 32 37 c0 94 d9 fd b2 8d 3f f8 76 5b 46 07 79 | CERT aa 96 0d ac aa 8a 91 fa f1 12 dc ea 9e cc 1a 90 | emitting length of ISAKMP Certificate Payload: 1253 "nss-cert" #1: I am sending a certificate request | ***emit ISAKMP Certificate RequestPayload: | next payload type: ISAKMP_NEXT_SIG (0x9) | cert type: CERT_X509_SIGNATURE (0x4) | next payload chain: ignoring supplied 'ISAKMP Certificate RequestPayload'.'next payload type' value 9:ISAKMP_NEXT_SIG | next payload chain: setting previous 'ISAKMP Certificate Payload'.'next payload type' to current ISAKMP Certificate RequestPayload (7:ISAKMP_NEXT_CR) | next payload chain: saving location 'ISAKMP Certificate RequestPayload'.'next payload type' in 'reply packet' | emitting 175 raw bytes of CA into ISAKMP Certificate RequestPayload | CA 30 81 ac 31 0b 30 09 06 03 55 04 06 13 02 43 41 | CA 31 10 30 0e 06 03 55 04 08 13 07 4f 6e 74 61 72 | CA 69 6f 31 10 30 0e 06 03 55 04 07 13 07 54 6f 72 | CA 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 13 09 4c | CA 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | CA 0b 13 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | CA 6e 74 31 25 30 23 06 03 55 04 03 13 1c 4c 69 62 | CA 72 65 73 77 61 6e 20 74 65 73 74 20 43 41 20 66 | CA 6f 72 20 6d 61 69 6e 63 61 31 24 30 22 06 09 2a | CA 86 48 86 f7 0d 01 09 01 16 15 74 65 73 74 69 6e | CA 67 40 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 | emitting length of ISAKMP Certificate RequestPayload: 180 | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=signedbyother.other.libreswan.org, E=user-signedbyother@testing.libreswan.org->%fromcert of kind PKK_RSA | searching for certificate PKK_RSA:AwEAAaCPa vs PKK_RSA:AwEAAaCPa | ***emit ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Certificate RequestPayload'.'next payload type' to current ISAKMP Signature Payload (9:ISAKMP_NEXT_SIG) | next payload chain: saving location 'ISAKMP Signature Payload'.'next payload type' in 'reply packet' | emitting 384 raw bytes of SIG_I into ISAKMP Signature Payload | SIG_I 62 8e de cd 8c 35 45 4d 1c c3 25 ad 5f a4 45 43 | SIG_I 35 53 d2 77 43 2f 7e 6c 10 39 29 1c df e3 8c 02 | SIG_I 14 4e 64 1a 89 51 ce 61 d7 96 35 e0 a6 b1 14 b9 | SIG_I 53 4f 9b 23 90 eb dc 94 d6 f3 20 03 5e 7b 16 e5 | SIG_I 00 74 bd c9 68 e6 b1 af 85 46 b7 5f d0 3e a3 67 | SIG_I 13 91 ae 64 9e 47 0d eb 20 21 52 b7 3d 11 b3 f9 | SIG_I ee 68 5d 68 b4 c8 29 87 50 d8 55 dd a1 e4 20 35 | SIG_I 6e 8f 16 45 8f 39 61 63 8f 1e 2c d7 98 12 19 11 | SIG_I a5 ac ad 78 39 9e b1 6a 85 35 9e bc f3 83 36 7b | SIG_I ce fd 99 fe df 22 60 70 41 bd 67 a7 d5 a4 12 d4 | SIG_I 0e ec 9e 16 77 9f 4a 13 79 cd 9f 7d 37 00 d7 fa | SIG_I cf a8 e0 6b 8b b3 39 4f 93 b0 2c f1 7a 39 05 e4 | SIG_I f1 6e 44 eb d4 25 21 56 2c d5 55 21 50 d6 dd 9a | SIG_I 4a 9d e0 f3 e3 a0 c3 18 fd ef 1f 32 38 6e 10 6d | SIG_I 18 f5 83 5c a0 92 25 da da 48 7a 4a cc 52 70 25 | SIG_I 3b 36 1e 47 37 fc 42 7b ab 26 08 32 ad a7 c5 aa | SIG_I de 3c 5d 2e 8e 81 f0 93 2a d5 6a 57 4a 0d 46 7b | SIG_I 79 8f 7d 18 27 b8 d2 a1 f4 22 45 c9 38 6e 73 8a | SIG_I ac e9 31 15 ea 31 b8 68 a2 d7 b7 a8 c5 b3 25 bc | SIG_I 07 e2 a1 2b 33 f9 1b d2 04 9e 00 ef a5 48 94 fb | SIG_I cf e3 97 4c 60 66 56 8e 11 db 0a bd a4 4f 75 0f | SIG_I 23 1f 4c cb 65 19 40 15 f8 4d 88 59 d7 de 2d b1 | SIG_I 55 4a 60 ed e6 e0 b0 cd 01 54 65 48 12 1e d7 fa | SIG_I 61 51 df 68 57 09 f3 2c 59 52 2b 94 46 0f 09 63 | emitting length of ISAKMP Signature Payload: 388 | Not sending INITIAL_CONTACT | emitting 4 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 2060 | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #1 is idle | doing_xauth:no, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 | parent state #1: MAIN_I2(open IKE SA) => MAIN_I3(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5649e590d3b0 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7f5df4002b20 | sending reply packet to 192.1.2.23:500 (from 192.1.2.45:500) | sending 2060 bytes for STATE_MAIN_I2 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 (using #1) | 56 c8 37 d2 a4 f6 ee cd c7 84 9d a8 f1 72 07 42 | 05 10 02 01 00 00 00 00 00 00 08 0c 46 81 1e 63 | 3a 30 0f be 05 35 b9 32 95 65 5d bb 64 13 a9 24 | 6d 69 19 b2 1c 91 e9 9b 53 6d 95 0b 43 75 6d d9 | c2 b5 d5 40 0d 38 8a 06 15 9c 98 fb 2e 6f 0d 35 | 07 53 df e1 46 0e 96 4c 6e 35 37 f2 2e f6 2d 67 | 6f fd 28 65 70 a3 0b e4 92 da f7 7c 28 88 50 7d | 18 7b bf b8 42 bc 74 99 31 c9 f3 93 1c e8 f6 11 | b7 a7 de 39 1f 25 bb 8b af 17 da 2d e6 b1 5c 6d | d4 ef 3f 79 c5 57 23 8d 37 c4 94 b1 34 42 5b 04 | 4c 6f cd 06 07 ce bd 82 82 39 91 a4 7b 28 42 fe | 52 a2 d6 3f e0 43 f4 1e b4 17 54 ff ed 9b 56 db | 8a 44 09 61 3b e6 9c eb 84 43 b9 31 21 ab 88 80 | 11 98 e8 03 73 62 3d e4 e9 45 f8 a5 99 e3 a8 9b | 25 80 93 78 43 0d 19 93 31 da 48 a7 44 a0 d8 12 | 15 23 32 f2 6e 97 8a 0c b1 9a 11 46 01 d3 c5 4d | 0d 44 92 9c 01 f7 b7 08 fa ee a3 52 90 b1 da c1 | 3f 75 fa 66 8c b7 00 9c be 6a e9 e6 00 a0 45 47 | a1 16 6d 4d f3 28 d7 5b 87 27 19 54 a2 d8 3a c5 | 99 f5 0c cc 68 85 c5 28 9f 56 0b eb 3d be e3 e6 | 0c ba 9c d4 bb a7 06 d3 09 28 23 bd 9d bc fe b0 | 67 fd f4 2a db 1a 06 4c 34 6d 51 fe ee c0 a1 93 | ca 07 00 bb b3 eb 2b ae 18 1c bb cd 0e d8 cb c9 | e9 16 27 74 7e 46 f3 bd 4a 31 4a c2 7e 43 47 56 | 34 19 e1 bc d1 17 7d ab 6e 8d b3 e4 03 48 9d b9 | f6 82 ed b0 33 66 14 c8 ff d2 58 b5 37 03 f9 ea | e8 d7 cc 8a 57 7f 79 7b 9a 5a 3b f6 f7 b4 fc 7c | 2d 30 05 5e 0a 8f 58 e8 8d ce 69 9e af bc c4 ca | 22 92 87 a0 02 f9 35 f9 00 cf 65 f9 00 42 90 a4 | 62 13 3b b5 63 01 97 93 a9 9c ca 8f 46 13 97 2b | 51 c8 4b 7e 7b 1d cd 69 5b c4 00 fa 0d 42 52 a6 | 3e 83 a2 e6 80 33 f0 18 85 ea a8 e3 15 45 83 56 | cc d6 a6 79 71 29 01 f8 94 62 5d 34 8d 2a 55 fc | 9c ec 2c 7e fc c3 aa e1 f7 83 cc 2b 88 9a 24 3c | 27 4d 93 00 30 a9 c4 69 77 80 98 a4 4a f7 34 16 | 39 11 ac 4c 1f ad 67 d5 2c 1f 53 4f 3e 9d 73 f6 | 55 d2 08 bc 6e bb be f1 aa 56 53 73 6d ab c8 81 | 15 77 f8 f6 09 39 ff b6 95 3b 56 90 8b 41 94 11 | 07 11 75 b5 45 f1 b1 90 40 2d eb 8e 99 9c 25 8f | c7 ba f1 4a a4 2f 76 17 13 50 d5 cf 29 50 f7 a4 | 0e 77 6f 7e e9 bf 1b 69 41 86 57 30 30 fb 09 ea | d8 98 14 15 ff 82 46 2b 4e 93 f7 a4 e2 ab c4 0d | e0 98 6d 23 63 c6 34 a0 9e 71 99 bf c7 e3 fa ee | 99 e9 77 c9 a6 f3 61 36 07 1c 2c 2a cf dd 35 87 | c3 9c 3d 5f 95 20 36 4b a2 2f 7d 77 91 63 d6 7c | 96 ee a4 f5 29 6b ba e6 42 75 3f 74 b9 5d 7f 35 | 11 a9 99 46 4d c6 4c b3 79 04 22 b6 04 4c e5 a8 | be 7c 46 fb 4f d2 69 38 3d 5a 92 8d a4 08 41 02 | 91 48 29 bc a0 a1 4b a5 1a 52 a5 2a 80 e1 03 15 | 7f 4c e1 8d 97 11 08 25 3c a2 2d 4d 81 5c d8 02 | 56 ab 7e 97 55 f6 b8 93 9a 1e 9f 09 e2 3b 60 15 | 76 06 7b 1d 61 5b 3d 66 39 32 3f b0 dd 4a 99 53 | 29 bd 06 4f 64 e3 55 45 a3 2f dc 1a 99 1d 25 a3 | 4b 51 1d dd 7f 5a 3f 96 9e 9d 5c 33 9a c7 4d 67 | 51 b1 76 d4 3f 05 06 f2 b0 5a b7 9b 99 d6 e5 72 | 19 b2 b4 c8 0c 3a 48 51 e8 69 13 cc ca 37 68 b4 | ad 41 55 76 e1 18 79 8e 76 bc 35 b3 03 e2 bb 92 | a3 b0 96 87 ce 51 86 b3 7e 43 b9 0e 41 8e ca b5 | dc e0 49 ee 23 36 78 23 5e a2 9b 32 12 11 79 27 | 93 43 dd cb a2 64 6a db cb 8a 2d 21 83 e2 46 97 | eb ff 24 95 43 2e 59 f0 65 7e b4 d9 79 65 70 e7 | c9 69 e6 ed 48 7a ba 5c 33 77 fd 0d ae 8d 16 50 | 9a 4a 71 3a d4 5f 0f c0 d6 c1 08 5d 52 cb 2e d9 | e6 9e 74 01 f3 5e 22 5b 6c f2 eb 26 0e 0e 25 81 | f5 d7 c5 fa 9b 0b b7 40 58 1e c4 c2 fe ad dd 71 | 24 fe bf f4 29 2b bb 48 a9 0e 1f 98 09 00 5e 40 | 62 3d 4c 3d b6 6b 3b 34 bc c4 55 61 9a e3 91 d8 | 4a b3 93 14 cb ad da 76 ee c4 25 b4 26 bf e0 95 | 16 38 02 7b d8 73 5b 90 7c cc 20 c0 dd 70 ca 7b | f3 a6 dc 08 45 5b fd e2 3d 86 8a d1 eb 7e 97 86 | f2 91 71 4d 99 df eb 1b 10 f8 7d 68 7f 4e c6 05 | 18 74 b0 f3 e1 8c 56 7a c4 b1 6b b2 4a cc 06 bb | ac 7f 2f e9 42 2a 93 1f ad f6 4d 9a d6 d5 a5 39 | 29 1e 02 20 97 d5 ed db 05 33 d5 ea 1b e0 40 99 | c7 70 6b 45 47 a2 2b 71 40 74 8c 91 86 a9 98 98 | c2 6d 4e 63 b1 26 97 3f df 1c 9d 3d 32 b4 3c 59 | 1c 2e 66 40 6a f0 51 7a e1 58 da 6e d9 37 7b fd | 91 7a 58 ff 15 0b 77 33 3e 95 44 95 3e 86 ab 59 | 15 8a 54 61 94 65 bf c3 bb 28 e5 e2 3b f7 8c 6f | e7 f0 7e 5b ec b7 a4 ac 43 6a 5d f6 f1 79 e7 24 | a8 dd 03 8e 98 ad b4 e5 e8 33 ac b0 65 07 82 63 | d3 28 82 70 c5 7d 39 e6 e3 15 d2 10 c2 c6 0c f5 | b4 3b ad ec d9 60 12 ba 26 d8 7b ca de a9 f9 15 | 13 68 e2 2d ec 0d 27 ba 06 5b 83 8f 13 3d 95 ec | e7 b3 f5 50 4a df c7 5f 72 58 3f 0d 2a 75 ae 03 | ab b1 81 29 f6 2a 75 b9 5a fa b9 c9 1e 15 be e4 | 10 2c 01 89 19 79 cd 03 7a 67 06 21 56 91 65 57 | 41 66 3b e5 a0 a5 6f 34 54 56 1a b5 ba 87 f5 c4 | a7 c5 9c 16 f3 65 7a f8 f7 cc 71 07 55 75 3a ae | 4f a0 3c 86 09 20 0c 4a 21 38 bb 91 0b 1a c8 10 | f4 9c 81 6c 77 b6 26 95 7e 84 3b 8b 1d df 44 95 | 8d c4 d4 51 de 0e d0 66 fb 89 ef ef 6a 3b 96 b9 | 18 d7 01 ea b6 42 62 e1 f7 30 c2 a4 15 cd 4a 05 | 7b 8d 85 b7 a2 f0 3f d0 d2 90 ce 3c d4 1a fc 16 | 25 2a 64 e1 fc e3 0f df 46 b2 3f 77 b1 8c 30 4a | 41 e3 b4 6b 35 7e a2 73 dc 51 9e f4 e5 c4 1e a2 | d5 af 09 f7 b6 61 c4 b8 e6 81 17 f1 85 7f 30 e5 | 03 31 76 53 d0 df 66 a3 31 61 61 04 a9 c1 e5 5b | 04 f1 2d ea e4 bd 4f 7e 5e 9a 9b 06 dc af aa af | f5 34 2c ea c8 5e e1 92 49 b4 c4 fe 13 09 79 23 | 8d 79 9f 4c 6b 1f 22 e1 ea 4a 87 3a b8 dd c3 b2 | 1d e0 07 db d0 79 7e 38 6c eb 37 19 57 6e 61 ae | 5c 0e c2 2b 0d b7 05 4d 5c 06 4c 9f 72 13 ad c7 | 9d ee a4 9f 74 0d 94 12 1c 1e 64 31 60 c1 ba 5b | be 9e f5 6b ca e1 02 85 b2 f7 23 fa 5e 1b 7b d9 | 1a 69 a9 7b c2 c4 bc 34 0b 3c 46 f9 5c 2f c8 ca | c6 85 0c c4 0b 5b 27 9f 36 16 3f f8 04 9f 90 f4 | b9 9a 68 7e 2f fa b6 7f 8d ad 4c e4 ad f6 ec b6 | 0f c1 91 24 34 b2 6f 73 e5 dc 48 72 ae cc 12 72 | 79 f4 c3 e6 51 8f c4 8f 20 0a 04 3c fb cc 65 f7 | d8 68 35 83 73 01 e6 83 51 10 6a b7 04 2f e6 e6 | fb 29 9a 90 ee 1b e3 19 1f 0a c0 d9 8f 58 d5 97 | ec af 80 bf 91 25 74 85 6a af e8 c1 e3 17 eb 5d | c1 17 0d ab ab ce e8 9d e2 04 9d a6 eb 42 9c 9c | a5 18 5d f4 49 87 b4 5b 48 da da 83 c2 04 bc 7d | 0a 56 70 9b ca 57 5c 2e 5a b7 c0 4c 6d ae 04 5c | e4 dc 47 26 48 e3 3b 00 d8 d9 8b 33 a9 95 2b 41 | 8b 75 96 9b 3a 26 15 0e ed 4d 97 38 69 85 31 05 | cb 5c 1c df f8 fa 74 4e f6 2f fe b3 17 93 b8 04 | c5 32 b8 c9 4a dd c5 d7 a8 46 94 e0 b0 7f 3e 59 | 92 b8 2e 86 23 94 d0 aa 1a 8e c4 a1 6b 33 63 3b | 37 4b a8 7f 00 fa 33 d7 a4 a8 1c 31 35 33 07 aa | 45 77 a2 66 15 58 81 1b 8d e7 4e 53 1d 70 2c f3 | 6f 28 0c d8 ea 26 54 0c 48 aa e2 b6 22 34 5a 00 | 79 a1 eb 9f a0 51 35 40 22 18 d6 b1 f7 6d 5f 93 | eb 01 68 c4 32 6d 39 53 94 30 98 c5 3b f7 ce 3e | 6e ea 0b de 2e 69 d4 50 92 e6 63 30 ce 98 f6 5f | af 48 33 a0 b8 3b 80 ae fc 70 77 ae 68 32 9f bc | c2 b2 a0 bc 6a 4b 5a ed c2 ee 3c 93 | !event_already_set at reschedule "nss-cert" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: new EVENT_RETRANSMIT-pe@0x5649e5910a50 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x5649e590d3b0 size 128 | #1 STATE_MAIN_I3: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50119.300291 "nss-cert" #1: STATE_MAIN_I3: sent MI3, expecting MR3 | modecfg pull: noquirk policy:push not-client | phase 1 is done, looking for phase 2 to unpend | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 9.82 milliseconds in resume sending helper answer | stop processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7f5dec004f00 | spent 0.00194 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 76 bytes from 192.1.2.23:500 on eth1 (192.1.2.45:500) | 56 c8 37 d2 a4 f6 ee cd c7 84 9d a8 f1 72 07 42 | 08 10 05 01 c4 42 b2 6c 00 00 00 4c b4 32 b1 39 | aa 0b 50 7f c5 29 c6 27 65 5b 31 3c 9b f2 b6 85 | e3 97 58 04 88 e2 c3 18 06 e9 a8 64 e2 79 24 86 | 98 cf cc 7a 20 89 2d b6 66 bb d4 2c | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | 56 c8 37 d2 a4 f6 ee cd | responder cookie: | c7 84 9d a8 f1 72 07 42 | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3292705388 (0xc442b26c) | length: 76 (0x4c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I3 | State DB: found IKEv1 state #1 in MAIN_I3 (find_v1_info_state) | start processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1455) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_N (0xb) | length: 36 (0x24) | got payload 0x800 (ISAKMP_NEXT_N) needed: 0x0 opt: 0x0 | ***parse ISAKMP Notification Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 12 (0xc) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 1 (0x1) | SPI size: 0 (0x0) | Notify Message Type: INVALID_ID_INFORMATION (0x12) | informational HASH(1): | 48 9a 56 c7 69 55 4d 2b f8 7e 2d bf 16 53 8d e7 | d2 2f d0 b0 a7 e5 7b 53 59 d1 34 dd ef 01 fe 39 | received 'informational' message HASH(1) data ok "nss-cert" #1: ignoring informational payload INVALID_ID_INFORMATION, msgid=00000000, length=12 | ISAKMP Notification Payload | 00 00 00 0c 00 00 00 01 01 00 00 12 | info: | processing informational INVALID_ID_INFORMATION (18) "nss-cert" #1: received and ignored notification payload: INVALID_ID_INFORMATION | complete v1 state transition with STF_IGNORE | #1 spent 0.0113 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.174 milliseconds in comm_handle_cb() reading and processing packet | processing global timer EVENT_SHUNT_SCAN | expiring aged bare shunts from shunt table | spent 0.00313 milliseconds in global timer EVENT_SHUNT_SCAN | processing global timer EVENT_NAT_T_KEEPALIVE | FOR_EACH_STATE_... in nat_traversal_ka_event (for_each_state) | start processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in for_each_state() at state.c:1572) | not behind NAT: no NAT-T KEEP-ALIVE required for conn nss-cert | stop processing: state #1 connection "nss-cert" from 192.1.2.23:500 (in for_each_state() at state.c:1574) | spent 0.0187 milliseconds in global timer EVENT_NAT_T_KEEPALIVE