FIPS Product: YES FIPS Kernel: NO FIPS Mode: NO NSS DB directory: sql:/etc/ipsec.d Initializing NSS Opening NSS database "sql:/etc/ipsec.d" read-only NSS initialized NSS crypto library initialized FIPS HMAC integrity support [enabled] FIPS mode disabled for pluto daemon FIPS HMAC integrity verification self-test FAILED libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v3.28-827-gc9aa82b8a6-master-s2 XFRM(netkey) esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) DNSSEC SYSTEMD_WATCHDOG FIPS_CHECK LABELED_IPSEC SECCOMP LIBCAP_NG LINUX_AUDIT XAUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:26481 core dump dir: /tmp secrets file: /etc/ipsec.secrets leak-detective disabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: new ptr-libevent@0x5597040792a0 size 40 | libevent_malloc: new ptr-libevent@0x5597040792d0 size 40 | libevent_malloc: new ptr-libevent@0x55970407aa30 size 40 | creating event base | libevent_malloc: new ptr-libevent@0x55970407a9f0 size 56 | libevent_malloc: new ptr-libevent@0x55970407aa60 size 664 | libevent_malloc: new ptr-libevent@0x55970407ad00 size 24 | libevent_malloc: new ptr-libevent@0x559704034290 size 384 | libevent_malloc: new ptr-libevent@0x55970407ad20 size 16 | libevent_malloc: new ptr-libevent@0x55970407ad40 size 40 | libevent_malloc: new ptr-libevent@0x55970407ad70 size 48 | libevent_realloc: new ptr-libevent@0x55970407adb0 size 256 | libevent_malloc: new ptr-libevent@0x55970407aec0 size 16 | libevent_free: release ptr-libevent@0x55970407a9f0 | libevent initialized | libevent_realloc: new ptr-libevent@0x55970407aee0 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm, aes_ccm_c AES_CCM_12 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_b AES_CCM_8 IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_ccm_a 3DES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS [*192] 3des CAMELLIA_CTR IKEv1: ESP IKEv2: ESP {256,192,*128} CAMELLIA_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} camellia AES_GCM_16 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm, aes_gcm_c AES_GCM_12 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_b AES_GCM_8 IKEv1: ESP IKEv2: IKE ESP FIPS {256,192,*128} aes_gcm_a AES_CTR IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aesctr AES_CBC IKEv1: IKE ESP IKEv2: IKE ESP FIPS {256,192,*128} aes SERPENT_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} serpent TWOFISH_CBC IKEv1: IKE ESP IKEv2: IKE ESP {256,192,*128} twofish TWOFISH_SSH IKEv1: IKE IKEv2: IKE ESP {256,192,*128} twofish_cbc_ssh NULL_AUTH_AES_GMAC IKEv1: ESP IKEv2: ESP FIPS {256,192,*128} aes_gmac NULL IKEv1: ESP IKEv2: ESP [] CHACHA20_POLY1305 IKEv1: IKEv2: IKE ESP [*256] chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: SHA1 IKEv1: IKE IKEv2: FIPS sha SHA2_256 IKEv1: IKE IKEv2: FIPS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: FIPS sha384 SHA2_512 IKEv1: IKE IKEv2: FIPS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case #1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case #2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case #3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case #4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case #5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case #6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case #7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 crypto helpers started thread for crypto helper 0 started thread for crypto helper 1 started thread for crypto helper 2 started thread for crypto helper 3 started thread for crypto helper 4 started thread for crypto helper 5 started thread for crypto helper 6 | checking IKEv1 state table | MAIN_R0: category: half-open IKE SA flags: 0: | -> MAIN_R1 EVENT_SO_DISCARD | MAIN_I1: category: half-open IKE SA flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT | MAIN_R1: category: open IKE SA flags: 200: | -> MAIN_R2 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_I2: category: open IKE SA flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | -> UNDEFINED EVENT_RETRANSMIT | MAIN_R2: category: open IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | -> MAIN_R3 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_I3: category: open IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | -> MAIN_I4 EVENT_SA_REPLACE | -> UNDEFINED EVENT_SA_REPLACE | MAIN_R3: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | MAIN_I4: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | AGGR_R0: category: half-open IKE SA flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD | AGGR_I1: category: half-open IKE SA flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE | -> AGGR_I2 EVENT_SA_REPLACE | AGGR_R1: category: open IKE SA flags: 200: | -> AGGR_R2 EVENT_SA_REPLACE | -> AGGR_R2 EVENT_SA_REPLACE | AGGR_I2: category: established IKE SA flags: 200: | -> UNDEFINED EVENT_NULL | AGGR_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | QUICK_R0: category: established CHILD SA flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT | QUICK_I1: category: established CHILD SA flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE | QUICK_R1: category: established CHILD SA flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE | QUICK_I2: category: established CHILD SA flags: 200: | -> UNDEFINED EVENT_NULL | QUICK_R2: category: established CHILD SA flags: 0: | -> UNDEFINED EVENT_NULL | INFO: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | INFO_PROTECTED: category: informational flags: 0: | -> UNDEFINED EVENT_NULL | XAUTH_R0: category: established IKE SA flags: 0: | -> XAUTH_R1 EVENT_NULL | XAUTH_R1: category: established IKE SA flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE | MODE_CFG_R0: category: informational flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE | MODE_CFG_R1: category: established IKE SA flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE | MODE_CFG_R2: category: established IKE SA flags: 0: | -> UNDEFINED EVENT_NULL | MODE_CFG_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE | XAUTH_I0: category: established IKE SA flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT | XAUTH_I1: category: established IKE SA flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT | checking IKEv2 state table | PARENT_I0: category: ignore flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA flags: 0: | -> PARENT_I1 EVENT_RETAIN send-request (Initiator: process SA_INIT reply notification) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH) | PARENT_I2: category: open IKE SA flags: 0: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | starting up helper thread 6 | starting up helper thread 0 | status value returned by setting the priority of this thread (crypto helper 6) 22 | starting up helper thread 3 | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> V2_IPSEC_I EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_I3: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_RETAIN (I3: Informational Request) | -> PARENT_I3 EVENT_RETAIN (I3: Informational Response) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Request) | -> PARENT_I3 EVENT_RETAIN (I3: INFORMATIONAL Response) | PARENT_R0: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-request (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request (no SKEYSEED)) | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Responder: process IKE_AUTH request) | PARENT_R2: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Request) | -> PARENT_R2 EVENT_RETAIN (R2: process Informational Response) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Request) | -> PARENT_R2 EVENT_RETAIN (R2: process INFORMATIONAL Response) | V2_CREATE_I0: category: established IKE SA flags: 0: | -> V2_CREATE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | V2_CREATE_I: category: established IKE SA flags: 0: | -> V2_IPSEC_I EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_IKE_I0: category: established IKE SA flags: 0: | -> V2_REKEY_IKE_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I: category: established IKE SA flags: 0: | -> PARENT_I3 EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_REKEY_CHILD_I0: category: established IKE SA flags: 0: | -> V2_REKEY_CHILD_I EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_REKEY_CHILD_I: category: established IKE SA flags: 0: | V2_CREATE_R: category: established IKE SA flags: 0: | -> V2_IPSEC_R EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IPsec SA Request) | V2_REKEY_IKE_R: category: established IKE SA flags: 0: | -> PARENT_R2 EVENT_SA_REPLACE send-request (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_R: category: established IKE SA flags: 0: | V2_IPSEC_I: category: established CHILD SA flags: 0: | V2_IPSEC_R: category: established CHILD SA flags: 0: | IKESA_DEL: category: established IKE SA flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational flags: 0: Using Linux XFRM/NETKEY IPsec interface code on 5.2.11+ | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding SERPENT_CBC to kernel algorithm db | adding TWOFISH_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: new KERNEL_XRM_FD-pe@0x5597040856d0 | libevent_malloc: new ptr-libevent@0x55970408c7a0 size 128 | libevent_malloc: new ptr-libevent@0x559704085630 size 16 | add_fd_read_event_handler: new KERNEL_ROUTE_FD-pe@0x55970407fb80 | libevent_malloc: new ptr-libevent@0x55970408c830 size 128 | libevent_malloc: new ptr-libevent@0x559704085610 size 16 | global one-shot timer EVENT_CHECK_CRLS initialized selinux support is enabled. systemd watchdog not enabled - not sending watchdog keepalives | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | Loading dnssec root key from:/var/lib/unbound/root.key | No additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: new PLUTO_CTL_FD-pe@0x55970407f940 | libevent_malloc: new ptr-libevent@0x559704096db0 size 128 | libevent_malloc: new ptr-libevent@0x559704096e40 size 16 | libevent_realloc: new ptr-libevent@0x559704096e60 size 256 | libevent_malloc: new ptr-libevent@0x559704096f70 size 8 | libevent_realloc: new ptr-libevent@0x55970408baa0 size 144 | libevent_malloc: new ptr-libevent@0x559704096f90 size 152 | libevent_malloc: new ptr-libevent@0x559704097030 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: new ptr-libevent@0x559704097050 size 8 | libevent_malloc: new ptr-libevent@0x559704097070 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: new ptr-libevent@0x559704097110 size 8 | libevent_malloc: new ptr-libevent@0x559704097130 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: new ptr-libevent@0x5597040971d0 size 8 | libevent_realloc: release ptr-libevent@0x55970408baa0 | libevent_realloc: new ptr-libevent@0x5597040971f0 size 256 | libevent_malloc: new ptr-libevent@0x55970408baa0 size 152 | signal event handler PLUTO_SIGSYS installed | status value returned by setting the priority of this thread (crypto helper 0) 22 | status value returned by setting the priority of this thread (crypto helper 3) 22 | starting up helper thread 1 | starting up helper thread 4 | status value returned by setting the priority of this thread (crypto helper 1) 22 | status value returned by setting the priority of this thread (crypto helper 4) 22 | created addconn helper (pid:26647) using fork+execve | forked child 26647 | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | pluto_sd: executing action action: reloading(4), status 0 listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.3.254 | Inspecting interface eth1 | found eth1 with address 192.1.3.33 Kernel supports NIC esp-hw-offload adding interface eth1/eth1 (esp-hw-offload not supported by kernel) 192.1.3.33:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth1/eth1 192.1.3.33:4500 adding interface eth0/eth0 (esp-hw-offload not supported by kernel) 192.0.3.254:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface eth0/eth0 192.0.3.254:4500 adding interface lo/lo (esp-hw-offload not supported by kernel) 127.0.0.1:500 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 adding interface lo/lo 127.0.0.1:4500 | no interfaces to sort | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | add_fd_read_event_handler: new ethX-pe@0x559704080a40 | libevent_malloc: new ptr-libevent@0x5597040975d0 size 128 | libevent_malloc: new ptr-libevent@0x559704097660 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 22 | add_fd_read_event_handler: new ethX-pe@0x559704097680 | libevent_malloc: new ptr-libevent@0x5597040976c0 size 128 | libevent_malloc: new ptr-libevent@0x559704097750 size 16 | setup callback for interface lo 127.0.0.1:500 fd 21 | add_fd_read_event_handler: new ethX-pe@0x559704097770 | libevent_malloc: new ptr-libevent@0x5597040977b0 size 128 | libevent_malloc: new ptr-libevent@0x559704097840 size 16 | setup callback for interface eth0 192.0.3.254:4500 fd 20 | add_fd_read_event_handler: new ethX-pe@0x559704097860 | libevent_malloc: new ptr-libevent@0x5597040978a0 size 128 | libevent_malloc: new ptr-libevent@0x559704097930 size 16 | setup callback for interface eth0 192.0.3.254:500 fd 19 | add_fd_read_event_handler: new ethX-pe@0x559704097950 | libevent_malloc: new ptr-libevent@0x559704097990 size 128 | libevent_malloc: new ptr-libevent@0x559704097a20 size 16 | setup callback for interface eth1 192.1.3.33:4500 fd 18 | add_fd_read_event_handler: new ethX-pe@0x559704097a40 | libevent_malloc: new ptr-libevent@0x559704097a80 size 128 | libevent_malloc: new ptr-libevent@0x559704097b10 size 16 | setup callback for interface eth1 192.1.3.33:500 fd 17 | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f | computed rsa CKAID 88 aa 7c 5d loaded private key for keyid: PKK_RSA:AQPl33O2P | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | pluto_sd: executing action action: ready(5), status 0 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.543 milliseconds in whack | crypto helper 6 waiting (nothing to do) | starting up helper thread 2 | crypto helper 0 waiting (nothing to do) | crypto helper 3 waiting (nothing to do) | crypto helper 1 waiting (nothing to do) | crypto helper 4 waiting (nothing to do) | status value returned by setting the priority of this thread (crypto helper 2) 22 | crypto helper 2 waiting (nothing to do) | starting up helper thread 5 | status value returned by setting the priority of this thread (crypto helper 5) 22 | crypto helper 5 waiting (nothing to do) | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | pluto_sd: executing action action: reloading(4), status 0 listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.3.254 | Inspecting interface eth1 | found eth1 with address 192.1.3.33 | no interfaces to sort | libevent_free: release ptr-libevent@0x5597040975d0 | free_event_entry: release EVENT_NULL-pe@0x559704080a40 | add_fd_read_event_handler: new ethX-pe@0x559704080a40 | libevent_malloc: new ptr-libevent@0x5597040975d0 size 128 | setup callback for interface lo 127.0.0.1:4500 fd 22 | libevent_free: release ptr-libevent@0x5597040976c0 | free_event_entry: release EVENT_NULL-pe@0x559704097680 | add_fd_read_event_handler: new ethX-pe@0x559704097680 | libevent_malloc: new ptr-libevent@0x5597040976c0 size 128 | setup callback for interface lo 127.0.0.1:500 fd 21 | libevent_free: release ptr-libevent@0x5597040977b0 | free_event_entry: release EVENT_NULL-pe@0x559704097770 | add_fd_read_event_handler: new ethX-pe@0x559704097770 | libevent_malloc: new ptr-libevent@0x5597040977b0 size 128 | setup callback for interface eth0 192.0.3.254:4500 fd 20 | libevent_free: release ptr-libevent@0x5597040978a0 | free_event_entry: release EVENT_NULL-pe@0x559704097860 | add_fd_read_event_handler: new ethX-pe@0x559704097860 | libevent_malloc: new ptr-libevent@0x5597040978a0 size 128 | setup callback for interface eth0 192.0.3.254:500 fd 19 | libevent_free: release ptr-libevent@0x559704097990 | free_event_entry: release EVENT_NULL-pe@0x559704097950 | add_fd_read_event_handler: new ethX-pe@0x559704097950 | libevent_malloc: new ptr-libevent@0x559704097990 size 128 | setup callback for interface eth1 192.1.3.33:4500 fd 18 | libevent_free: release ptr-libevent@0x559704097a80 | free_event_entry: release EVENT_NULL-pe@0x559704097a40 | add_fd_read_event_handler: new ethX-pe@0x559704097a40 | libevent_malloc: new ptr-libevent@0x559704097a80 size 128 | setup callback for interface eth1 192.1.3.33:500 fd 17 | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" | saving Modulus | saving PublicExponent | ignoring PrivateExponent | ignoring Prime1 | ignoring Prime2 | ignoring Exponent1 | ignoring Exponent2 | ignoring Coefficient | ignoring CKAIDNSS | computed rsa CKAID 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f | computed rsa CKAID 88 aa 7c 5d loaded private key for keyid: PKK_RSA:AQPl33O2P | certs and keys locked by 'process_secret' | certs and keys unlocked by 'process_secret' | pluto_sd: executing action action: ready(5), status 0 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.311 milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 26647 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0146 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | Added new connection north-east with policy ENCRYPT+TUNNEL+PFS+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | No AUTH policy was set - defaulting to RSASIG | setting ID to ID_DER_ASN1_DN: 'E=user-north@testing.libreswan.org,CN=north.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA' | loading left certificate 'north' pubkey | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55970409c1a0 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55970409c170 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x559704098820 | unreference key: 0x5597040988d0 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org cnt 1-- | certs and keys locked by 'lsw_add_rsa_secret' | certs and keys unlocked by 'lsw_add_rsa_secret' | counting wild cards for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org is 0 | counting wild cards for %fromcert is 0 | connect_to_host_pair: 192.1.3.33:500 192.1.2.23:500 -> hp@(nil): none | new hp@0x5597040791f0 added connection description "north-east" | ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ENCRYPT+TUNNEL+PFS+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO | 192.1.3.33[C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org,+MC+XC+S=C]---192.1.3.254...192.1.2.23<192.1.2.23>[%fromcert,MS+XS+S=C]===192.0.2.0/24 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.08 milliseconds in whack | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | dup_any(fd@16) -> fd@23 (in whack_process() at rcv_whack.c:590) | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "north-east" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'north-east' +POLICY_UP | dup_any(fd@23) -> fd@24 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | creating state object #1 at 0x55970409d950 | State DB: adding IKEv1 state #1 in UNDEFINED | pstats #1 ikev1.isakmp started | suspend processing: connection "north-east" (in main_outI1() at ikev1_main.c:118) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in main_outI1() at ikev1_main.c:118) | parent state #1: UNDEFINED(ignore) => MAIN_I1(half-open IKE SA) | dup_any(fd@24) -> fd@25 (in main_outI1() at ikev1_main.c:123) | Queuing pending IPsec SA negotiating with 192.1.2.23 "north-east" IKE SA #1 "north-east" "north-east" #1: initiating Main Mode | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 1:ISAKMP_NEXT_SA | no specific IKE algorithms specified - using defaults | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() returning 0x55970409e510 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 18 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 18 (0x12) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 1 (0x1) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 2 (0x2) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 3 (0x3) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 4 (0x4) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 5 (0x5) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 6 (0x6) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 7 (0x7) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 8 (0x8) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 9 (0x9) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 10 (0xa) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 11 (0xb) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 12 (0xc) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 13 (0xd) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 14 (0xe) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 15 (0xf) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 16 (0x10) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP transform number: 17 (0x11) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | emitting length of ISAKMP Proposal Payload: 632 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 644 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | out_vid(): sending [FRAGMENTATION] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [XAUTH] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 8 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 09 00 26 89 df d6 b7 12 | emitting length of ISAKMP Vendor ID Payload: 12 | out_vid(): sending [Dead Peer Detection] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 | emitting length of ISAKMP Vendor ID Payload: 20 | nat add vid | sending draft and RFC NATT VIDs | out_vid(): sending [RFC 3947] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | emitting length of ISAKMP Vendor ID Payload: 20 | skipping VID_NATT_RFC | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-03] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02_n] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 | emitting length of ISAKMP Vendor ID Payload: 20 | no IKEv1 message padding required | emitting length of ISAKMP Message: 804 | sending 804 bytes for reply packet for main_outI1 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | d7 c3 67 fd 1f db d7 0a 00 00 00 00 00 00 00 00 | 01 10 02 00 00 00 00 00 00 00 03 24 0d 00 02 84 | 00 00 00 01 00 00 00 01 00 00 02 78 00 01 00 12 | 03 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 fd ed 80 04 00 0e | 80 0e 01 00 03 00 00 24 01 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 04 80 03 fd ed | 80 04 00 0e 80 0e 00 80 03 00 00 24 02 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 06 | 80 03 fd ed 80 04 00 0e 80 0e 01 00 03 00 00 24 | 03 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 06 80 03 fd ed 80 04 00 0e 80 0e 00 80 | 03 00 00 24 04 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 02 80 03 fd ed 80 04 00 0e | 80 0e 01 00 03 00 00 24 05 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 02 80 03 fd ed | 80 04 00 0e 80 0e 00 80 03 00 00 24 06 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 04 | 80 03 fd ed 80 04 00 05 80 0e 01 00 03 00 00 24 | 07 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 04 80 03 fd ed 80 04 00 05 80 0e 00 80 | 03 00 00 24 08 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 06 80 03 fd ed 80 04 00 05 | 80 0e 01 00 03 00 00 24 09 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 06 80 03 fd ed | 80 04 00 05 80 0e 00 80 03 00 00 24 0a 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 02 | 80 03 fd ed 80 04 00 05 80 0e 01 00 03 00 00 24 | 0b 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 02 80 03 fd ed 80 04 00 05 80 0e 00 80 | 03 00 00 20 0c 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 fd ed 80 04 00 0e | 03 00 00 20 0d 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 fd ed 80 04 00 0e | 03 00 00 20 0e 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 fd ed 80 04 00 0e | 03 00 00 20 0f 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 fd ed 80 04 00 05 | 03 00 00 20 10 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 fd ed 80 04 00 05 | 00 00 00 20 11 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 fd ed 80 04 00 05 | 0d 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 de 7f | 00 d6 c2 d3 0d 00 00 0c 09 00 26 89 df d6 b7 12 | 0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc | 77 57 01 00 0d 00 00 14 4a 13 1c 81 07 03 58 45 | 5c 57 28 f2 0e 95 45 2f 0d 00 00 14 7d 94 19 a6 | 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14 | 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | 00 00 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc | 68 b6 a4 48 | event_schedule: new EVENT_RETRANSMIT-pe@0x55970409c910 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | #1 STATE_MAIN_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50029.199624 | #1 spent 1.6 milliseconds in main_outI1() | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in main_outI1() at ikev1_main.c:228) | resume processing: connection "north-east" (in main_outI1() at ikev1_main.c:228) | stop processing: connection "north-east" (in initiate_a_connection() at initiate.c:349) | close_any(fd@23) (in initiate_connection() at initiate.c:372) | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 1.65 milliseconds in whack | spent 0.00217 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 156 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 01 10 02 00 00 00 00 00 00 00 00 9c 0d 00 00 38 | 00 00 00 01 00 00 00 01 00 00 00 2c 00 01 00 01 | 00 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 fd ed 80 04 00 0e | 80 0e 01 00 0d 00 00 14 40 48 b7 d5 6e bc e8 85 | 25 e7 de 7f 00 d6 c2 d3 0d 00 00 0c 09 00 26 89 | df d6 b7 12 0d 00 00 14 af ca d7 13 68 a1 f1 c9 | 6b 86 96 fc 77 57 01 00 00 00 00 14 4a 13 1c 81 | 07 03 58 45 5c 57 28 f2 0e 95 45 2f | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 156 (0x9c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: IKEv1 state not found (find_state_ikev1) | State DB: found IKEv1 state #1 in MAIN_I1 (find_state_ikev1_init) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1435) | #1 is idle | #1 idle | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x2 opt: 0x2080 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 12 (0xc) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | length: 20 (0x14) | got payload 0x2000 (ISAKMP_NEXT_VID) needed: 0x0 opt: 0x2080 | ***parse ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 20 (0x14) | message 'main_inR1_outI2' HASH payload not checked early | received Vendor ID payload [FRAGMENTATION] | received Vendor ID payload [XAUTH] | received Vendor ID payload [Dead Peer Detection] | quirks.qnat_traversal_vid set to=117 [RFC 3947] | received Vendor ID payload [RFC 3947] | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 1 (0x1) | *****parse ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | OAKLEY proposal verified unconditionally; no alg_info to check against | Oakley Transform 0 accepted | sender checking NAT-T: enabled; VID 117 | returning NAT-T method NAT_TRAVERSAL_METHOD_IETF_RFC | enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal) | adding outI2 KE work-order 1 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_RETRANSMIT-pe@0x55970409c910 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x55970409c910 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | complete v1 state transition with STF_SUSPEND | crypto helper 6 resuming | crypto helper 6 starting work-order 1 for state #1 | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2624) | crypto helper 6 doing build KE and nonce (outI2 KE); request ID 1 | suspending state #1 and saving MD | #1 is busy; has a suspended MD | #1 spent 0.139 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.29 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 6 finished build KE and nonce (outI2 KE); request ID 1 time elapsed 0.00102 seconds | (#1) spent 1.03 milliseconds in crypto helper computing work-order 1: outI2 KE (pcr) | crypto helper 6 sending results from work-order 1 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7efc88006900 size 128 | crypto helper 6 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 6 replies to request ID 1 | calling continuation function 0x559703870630 | main_inR1_outI2_continue for #1: calculated ke+nonce, sending I2 | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 56 93 4e fa eb 67 f1 6b c3 dc a5 23 8e 0d 10 d4 | keyex value 13 9a 96 1c af b3 0e 62 63 cf ab 8b 48 43 3e 30 | keyex value 9f 12 a0 bf a4 b4 32 f2 4b 12 8b 9a 6f 7a 46 a7 | keyex value 62 be 3a ce 08 ed a5 48 4e ee 48 aa 21 a7 64 ed | keyex value 26 87 58 18 76 2b 2a be 31 2d 5a e0 f4 bd e2 91 | keyex value d9 6d 88 d6 c5 ac 9a 8c b0 74 f2 de 3b a3 12 23 | keyex value 68 6a 0f 69 36 e9 96 af f5 4f 92 8e a1 fe 99 47 | keyex value 1e 75 bb 6e ce 52 3b dc ce cc 6f 4c c1 bd 29 19 | keyex value 7c c9 71 9e 81 44 f7 1d c0 31 8f 33 cf dc 5d 72 | keyex value d5 4c 1e a9 ef b2 60 2b c9 f8 21 b1 59 5e e7 01 | keyex value 2f df 82 9e 88 b6 9a 41 64 1d 16 f9 f6 fc 8c 59 | keyex value ec 7f 97 21 da 5e 59 fc 29 fc 02 ec 5e 9a 05 83 | keyex value 83 e0 76 9c 8e 11 06 3a a6 9d e2 25 09 4f 3f a7 | keyex value b0 4a 46 ec 2e 8c 11 12 84 0a e4 56 d9 05 f6 cf | keyex value 71 c8 58 5c d6 e7 db 37 f6 10 d4 b9 bd 48 a0 ec | keyex value 00 16 55 ec 08 96 36 c3 e1 15 9e 8d 5b 06 41 e2 | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni b7 c4 27 95 6d 84 de 23 25 4f db ec 4a f9 80 d9 | Ni d8 f0 42 6d 22 f5 71 17 87 05 3e 01 1e 26 38 ac | emitting length of ISAKMP Nonce Payload: 36 | NAT-T checking st_nat_traversal | NAT-T found (implies NAT_T_WITH_NATD) | sending NAT-D payloads | natd_hash: hasher=0x559703946c40(32) | natd_hash: icookie= d7 c3 67 fd 1f db d7 0a | natd_hash: rcookie= 8d 23 19 4a f7 36 c9 8f | natd_hash: ip= c0 01 02 17 | natd_hash: port= 01 f4 | natd_hash: hash= 30 60 ea d2 2f d1 ad 93 0b 51 f5 0e bb 3d e9 4e | natd_hash: hash= ec da 2a ce c8 12 28 d7 44 61 25 e8 b6 ec b7 04 | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | next payload chain: ignoring supplied 'ISAKMP NAT-D Payload'.'next payload type' value 20:ISAKMP_NEXT_NATD_RFC | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 30 60 ea d2 2f d1 ad 93 0b 51 f5 0e bb 3d e9 4e | NAT-D ec da 2a ce c8 12 28 d7 44 61 25 e8 b6 ec b7 04 | emitting length of ISAKMP NAT-D Payload: 36 | natd_hash: hasher=0x559703946c40(32) | natd_hash: icookie= d7 c3 67 fd 1f db d7 0a | natd_hash: rcookie= 8d 23 19 4a f7 36 c9 8f | natd_hash: ip= c0 01 03 21 | natd_hash: port= 01 f4 | natd_hash: hash= 62 3d 9a 67 d2 12 b4 9e a9 b1 fe 71 dc 31 3d f5 | natd_hash: hash= 03 eb 10 40 e9 9f 0a 70 d9 46 58 c3 65 a7 09 df | ***emit ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP NAT-D Payload'.'next payload type' to current ISAKMP NAT-D Payload (20:ISAKMP_NEXT_NATD_RFC) | next payload chain: saving location 'ISAKMP NAT-D Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload | NAT-D 62 3d 9a 67 d2 12 b4 9e a9 b1 fe 71 dc 31 3d f5 | NAT-D 03 eb 10 40 e9 9f 0a 70 d9 46 58 c3 65 a7 09 df | emitting length of ISAKMP NAT-D Payload: 36 | no IKEv1 message padding required | emitting length of ISAKMP Message: 396 | State DB: re-hashing IKEv1 state #1 IKE SPIi and SPI[ir] | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #1 is idle | doing_xauth:yes, t_xauth_client_done:no | peer supports fragmentation | peer supports DPD | IKEv1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 | parent state #1: MAIN_I1(half-open IKE SA) => MAIN_I2(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x55970409c910 | sending reply packet to 192.1.2.23:500 (from 192.1.3.33:500) | sending 396 bytes for STATE_MAIN_I1 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | 56 93 4e fa eb 67 f1 6b c3 dc a5 23 8e 0d 10 d4 | 13 9a 96 1c af b3 0e 62 63 cf ab 8b 48 43 3e 30 | 9f 12 a0 bf a4 b4 32 f2 4b 12 8b 9a 6f 7a 46 a7 | 62 be 3a ce 08 ed a5 48 4e ee 48 aa 21 a7 64 ed | 26 87 58 18 76 2b 2a be 31 2d 5a e0 f4 bd e2 91 | d9 6d 88 d6 c5 ac 9a 8c b0 74 f2 de 3b a3 12 23 | 68 6a 0f 69 36 e9 96 af f5 4f 92 8e a1 fe 99 47 | 1e 75 bb 6e ce 52 3b dc ce cc 6f 4c c1 bd 29 19 | 7c c9 71 9e 81 44 f7 1d c0 31 8f 33 cf dc 5d 72 | d5 4c 1e a9 ef b2 60 2b c9 f8 21 b1 59 5e e7 01 | 2f df 82 9e 88 b6 9a 41 64 1d 16 f9 f6 fc 8c 59 | ec 7f 97 21 da 5e 59 fc 29 fc 02 ec 5e 9a 05 83 | 83 e0 76 9c 8e 11 06 3a a6 9d e2 25 09 4f 3f a7 | b0 4a 46 ec 2e 8c 11 12 84 0a e4 56 d9 05 f6 cf | 71 c8 58 5c d6 e7 db 37 f6 10 d4 b9 bd 48 a0 ec | 00 16 55 ec 08 96 36 c3 e1 15 9e 8d 5b 06 41 e2 | 14 00 00 24 b7 c4 27 95 6d 84 de 23 25 4f db ec | 4a f9 80 d9 d8 f0 42 6d 22 f5 71 17 87 05 3e 01 | 1e 26 38 ac 14 00 00 24 30 60 ea d2 2f d1 ad 93 | 0b 51 f5 0e bb 3d e9 4e ec da 2a ce c8 12 28 d7 | 44 61 25 e8 b6 ec b7 04 00 00 00 24 62 3d 9a 67 | d2 12 b4 9e a9 b1 fe 71 dc 31 3d f5 03 eb 10 40 | e9 9f 0a 70 d9 46 58 c3 65 a7 09 df | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x55970409c910 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | #1 STATE_MAIN_I2: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50029.202851 "north-east" #1: STATE_MAIN_I2: sent MI2, expecting MR2 | XAUTH client is not yet authenticated | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 0.3 milliseconds in resume sending helper answer | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7efc88006900 | spent 0.00182 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 396 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 04 10 02 00 00 00 00 00 00 00 01 8c 0a 00 01 04 | 43 9a 3c 06 ef 38 46 42 d2 b2 fb 5c c6 af ba 3b | eb 98 95 37 50 d0 1a 5e 6c 0d 24 85 34 62 6e 53 | f9 5b 01 7b 1b 2f d5 63 0d 40 44 bf d4 aa e2 ac | fb 99 92 2c 36 27 19 1a 9c 88 1d be eb 84 96 79 | 91 04 a4 19 a6 ba 4d ac 45 83 bf aa 18 e0 bb 77 | e4 97 5d 01 0a c3 35 d7 a3 fa 46 5f 1b ba e1 b7 | 26 50 5b db 8e e1 1e a1 f8 d9 31 4e 33 b3 3d ad | 35 aa cf e4 04 e1 3d 4a f7 1e 89 bd 49 02 61 d3 | 9f d3 f8 34 b9 bb 21 a5 c3 da 07 a4 df e5 4c f5 | 6c f1 3d 33 b6 a6 b5 48 0e 51 24 20 24 63 1d 28 | 5c 31 10 73 43 dd ae 7c 30 60 c7 07 e4 62 6e af | 0a dc a3 b6 87 5a 1e df d3 cb 10 fe 11 56 28 70 | 6b 8e 58 ed ff 06 59 3e 21 8d 09 d3 cf 9e b4 fe | 1b a8 ea ce c6 84 34 74 6d d5 8a df 91 0e 9f fc | e8 a7 18 e3 82 2b c8 4b 14 3e 75 13 1b 5f 74 80 | 20 88 40 af 4d f8 11 6d b8 cb 11 52 75 b5 0f 6f | 14 00 00 24 c2 b8 08 31 ef ac 5b 79 1e 30 25 d1 | b0 5e 66 20 31 f0 ca 76 b4 7b 2b 4f 73 2a 20 f2 | 4a 72 0c e4 14 00 00 24 62 3d 9a 67 d2 12 b4 9e | a9 b1 fe 71 dc 31 3d f5 03 eb 10 40 e9 9f 0a 70 | d9 46 58 c3 65 a7 09 df 00 00 00 24 30 60 ea d2 | 2f d1 ad 93 0b 51 f5 0e bb 3d e9 4e ec da 2a ce | c8 12 28 d7 44 61 25 e8 b6 ec b7 04 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_KE (0x4) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | length: 396 (0x18c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_I2 (find_state_ikev1) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1435) | #1 is idle | #1 idle | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x410 opt: 0x102080 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 260 (0x104) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x102080 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14) | length: 36 (0x24) | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0 opt: 0x102080 | ***parse ISAKMP NAT-D Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 36 (0x24) | message 'main_inR2_outI3' HASH payload not checked early | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org->%fromcert of kind PKK_PSK | actually looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org->%fromcert of kind PKK_PSK | line 0: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org) to type PKK_RSA | line 1: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding aggr outR1 DH work-order 2 for state #1 | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I2: retransmits: cleared | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_RETRANSMIT-pe@0x55970409c910 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7efc88002b20 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2624) | suspending state #1 and saving MD | #1 is busy; has a suspended MD | #1 spent 0.0666 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.206 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 0 resuming | crypto helper 0 starting work-order 2 for state #1 | crypto helper 0 doing compute dh+iv (V1 Phase 1) (aggr outR1 DH); request ID 2 | crypto helper 0 finished compute dh+iv (V1 Phase 1) (aggr outR1 DH); request ID 2 time elapsed 0.001178 seconds | (#1) spent 1.18 milliseconds in crypto helper computing work-order 2: aggr outR1 DH (pcr) | crypto helper 0 sending results from work-order 2 for state #1 to event queue | scheduling resume sending helper answer for #1 | libevent_malloc: new ptr-libevent@0x7efc80004f00 size 128 | crypto helper 0 waiting (nothing to do) | processing resume sending helper answer for #1 | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 0 replies to request ID 2 | calling continuation function 0x559703870630 | main_inR2_outI3_cryptotail for #1: calculated DH, sending R1 | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 5:ISAKMP_NEXT_ID | thinking about whether to send my certificate: | I have RSA key: OAKLEY_RSA_SIG cert.type: CERT_X509_SIGNATURE | sendcert: CERT_ALWAYSSEND and I did not get a certificate request | so send cert. | I am sending a certificate request | I will NOT send an initial contact payload | init checking NAT-T: enabled; RFC 3947 (NAT-Traversal) | natd_hash: hasher=0x559703946c40(32) | natd_hash: icookie= d7 c3 67 fd 1f db d7 0a | natd_hash: rcookie= 8d 23 19 4a f7 36 c9 8f | natd_hash: ip= c0 01 03 21 | natd_hash: port= 01 f4 | natd_hash: hash= 62 3d 9a 67 d2 12 b4 9e a9 b1 fe 71 dc 31 3d f5 | natd_hash: hash= 03 eb 10 40 e9 9f 0a 70 d9 46 58 c3 65 a7 09 df | natd_hash: hasher=0x559703946c40(32) | natd_hash: icookie= d7 c3 67 fd 1f db d7 0a | natd_hash: rcookie= 8d 23 19 4a f7 36 c9 8f | natd_hash: ip= c0 01 02 17 | natd_hash: port= 01 f4 | natd_hash: hash= 30 60 ea d2 2f d1 ad 93 0b 51 f5 0e bb 3d e9 4e | natd_hash: hash= ec da 2a ce c8 12 28 d7 44 61 25 e8 b6 ec b7 04 | expected NAT-D(me): 62 3d 9a 67 d2 12 b4 9e a9 b1 fe 71 dc 31 3d f5 | expected NAT-D(me): 03 eb 10 40 e9 9f 0a 70 d9 46 58 c3 65 a7 09 df | expected NAT-D(him): | 30 60 ea d2 2f d1 ad 93 0b 51 f5 0e bb 3d e9 4e | ec da 2a ce c8 12 28 d7 44 61 25 e8 b6 ec b7 04 | received NAT-D: 62 3d 9a 67 d2 12 b4 9e a9 b1 fe 71 dc 31 3d f5 | received NAT-D: 03 eb 10 40 e9 9f 0a 70 d9 46 58 c3 65 a7 09 df | received NAT-D: 30 60 ea d2 2f d1 ad 93 0b 51 f5 0e bb 3d e9 4e | received NAT-D: ec da 2a ce c8 12 28 d7 44 61 25 e8 b6 ec b7 04 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: no NAT detected | NAT_T_WITH_KA detected | global one-shot timer EVENT_NAT_T_KEEPALIVE scheduled in 20 seconds | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_CERT (0x6) | ID type: ID_DER_ASN1_DN (0x9) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 6:ISAKMP_NEXT_CERT | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 185 raw bytes of my identity into ISAKMP Identification Payload (IPsec DOI) | my identity 30 81 b6 31 0b 30 09 06 03 55 04 06 13 02 43 41 | my identity 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | my identity 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | my identity 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | my identity 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | my identity 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | my identity 6e 74 31 24 30 22 06 03 55 04 03 0c 1b 6e 6f 72 | my identity 74 68 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 | my identity 73 77 61 6e 2e 6f 72 67 31 2f 30 2d 06 09 2a 86 | my identity 48 86 f7 0d 01 09 01 16 20 75 73 65 72 2d 6e 6f | my identity 72 74 68 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 | my identity 65 73 77 61 6e 2e 6f 72 67 | emitting length of ISAKMP Identification Payload (IPsec DOI): 193 "north-east" #1: I am sending my cert | ***emit ISAKMP Certificate Payload: | next payload type: ISAKMP_NEXT_CR (0x7) | cert encoding: CERT_X509_SIGNATURE (0x4) | next payload chain: ignoring supplied 'ISAKMP Certificate Payload'.'next payload type' value 7:ISAKMP_NEXT_CR | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Certificate Payload (6:ISAKMP_NEXT_CERT) | next payload chain: saving location 'ISAKMP Certificate Payload'.'next payload type' in 'reply packet' | emitting 1227 raw bytes of CERT into ISAKMP Certificate Payload | CERT 30 82 04 c7 30 82 04 30 a0 03 02 01 02 02 01 06 | CERT 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 | CERT 81 ac 31 0b 30 09 06 03 55 04 06 13 02 43 41 31 | CERT 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 69 | CERT 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 6f | CERT 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c 69 | CERT 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 0b | CERT 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 6e | CERT 74 31 25 30 23 06 03 55 04 03 0c 1c 4c 69 62 72 | CERT 65 73 77 61 6e 20 74 65 73 74 20 43 41 20 66 6f | CERT 72 20 6d 61 69 6e 63 61 31 24 30 22 06 09 2a 86 | CERT 48 86 f7 0d 01 09 01 16 15 74 65 73 74 69 6e 67 | CERT 40 6c 69 62 72 65 73 77 61 6e 2e 6f 72 67 30 22 | CERT 18 0f 32 30 31 39 30 39 31 35 31 39 34 34 35 39 | CERT 5a 18 0f 32 30 32 32 30 39 31 34 31 39 34 34 35 | CERT 39 5a 30 81 b6 31 0b 30 09 06 03 55 04 06 13 02 | CERT 43 41 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 | CERT 61 72 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 | CERT 6f 72 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c | CERT 09 4c 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 | CERT 55 04 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 | CERT 6d 65 6e 74 31 24 30 22 06 03 55 04 03 0c 1b 6e | CERT 6f 72 74 68 2e 74 65 73 74 69 6e 67 2e 6c 69 62 | CERT 72 65 73 77 61 6e 2e 6f 72 67 31 2f 30 2d 06 09 | CERT 2a 86 48 86 f7 0d 01 09 01 16 20 75 73 65 72 2d | CERT 6e 6f 72 74 68 40 74 65 73 74 69 6e 67 2e 6c 69 | CERT 62 72 65 73 77 61 6e 2e 6f 72 67 30 82 01 a2 30 | CERT 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 | CERT 01 8f 00 30 82 01 8a 02 82 01 81 00 ba c2 12 92 | CERT f3 67 1c ca 50 e4 11 97 bd e2 74 f8 2d a7 50 1c | CERT 73 d5 23 89 43 a9 58 74 05 29 97 ee a9 71 9c 8d | CERT 92 44 52 90 56 aa 55 a8 8c 69 5e 32 49 62 fb 18 | CERT 4f f0 e2 24 38 f0 a3 3c 7d 95 a9 03 66 29 11 c0 | CERT f2 0c e3 de a1 62 78 96 0e ff d1 f8 93 ac b7 cf | CERT 52 33 01 71 ef 46 ad ad d4 46 f5 e0 c5 e5 57 42 | CERT 2f 10 0e 27 24 45 5e d0 bd 90 32 70 b9 bb 27 2a | CERT 4c 93 a8 87 8c f0 61 5d d9 74 91 04 d9 e9 5b e5 | CERT 31 9c ca e0 5b 2c 3b 17 be 1a c9 1c 28 62 24 3c | CERT e4 eb d0 1a e4 e3 c4 61 b6 9d 1a a9 39 6a b0 92 | CERT a6 69 2c 19 b1 57 75 2b a8 1b ac 95 2b 35 5a 2f | CERT 1f 33 eb 9a 50 d0 4d fa 7a 05 9b 59 44 7d ba a6 | CERT 91 64 c9 4d 4a 01 39 e3 83 11 04 e9 b5 b3 9d 19 | CERT 1b 35 86 8a e9 e4 8b 28 e9 57 06 58 e2 cb a6 24 | CERT 35 73 37 7c 05 25 07 5f b6 df 3f 8b ab 5f e7 e4 | CERT 38 d2 69 f6 1f 68 e9 7b 4f 2f fd 11 62 0e 47 ee | CERT 67 3b 0e 71 d8 9a 35 1b e4 4f 56 64 fd c1 66 02 | CERT 69 2e 08 ac e7 43 ca 55 47 97 ae 83 19 50 e4 9d | CERT c7 a6 5c 9b 93 22 54 6f 02 4b 75 00 cf 67 e3 e2 | CERT 07 7c d8 47 8f c1 09 83 cc 70 94 fa 6c 74 c8 55 | CERT 7b 96 2c c1 85 f1 02 98 cd 1d be 85 5c 10 80 dd | CERT bb 89 44 4b 94 fa 5e 56 5c 67 0e 2e c6 62 69 d4 | CERT de 0e 97 31 ed 00 10 7b 83 dc 75 e4 12 fb 00 15 | CERT eb 5d e4 85 6b 0d 07 4b e6 db 86 31 02 03 01 00 | CERT 01 a3 81 e4 30 81 e1 30 09 06 03 55 1d 13 04 02 | CERT 30 00 30 26 06 03 55 1d 11 04 1f 30 1d 82 1b 6e | CERT 6f 72 74 68 2e 74 65 73 74 69 6e 67 2e 6c 69 62 | CERT 72 65 73 77 61 6e 2e 6f 72 67 30 0b 06 03 55 1d | CERT 0f 04 04 03 02 07 80 30 1d 06 03 55 1d 25 04 16 | CERT 30 14 06 08 2b 06 01 05 05 07 03 01 06 08 2b 06 | CERT 01 05 05 07 03 02 30 41 06 08 2b 06 01 05 05 07 | CERT 01 01 04 35 30 33 30 31 06 08 2b 06 01 05 05 07 | CERT 30 01 86 25 68 74 74 70 3a 2f 2f 6e 69 63 2e 74 | CERT 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 77 61 6e | CERT 2e 6f 72 67 3a 32 35 36 30 30 3d 06 03 55 1d 1f | CERT 04 36 30 34 30 32 a0 30 a0 2e 86 2c 68 74 74 70 | CERT 3a 2f 2f 6e 69 63 2e 74 65 73 74 69 6e 67 2e 6c | CERT 69 62 72 65 73 77 61 6e 2e 6f 72 67 2f 72 65 76 | CERT 6f 6b 65 64 2e 63 72 6c 30 0d 06 09 2a 86 48 86 | CERT f7 0d 01 01 0b 05 00 03 81 81 00 c0 be 88 d3 94 | CERT e8 3a e9 d3 b3 fd ed 79 1d 46 48 36 a3 2a 00 15 | CERT 9e 62 f1 22 44 4c 58 20 2e de 7d 7f 95 09 d5 bd | CERT 95 29 e4 f8 99 e3 8f c0 67 b4 eb f6 4b a3 4e 69 | CERT 48 de 1c 93 9f 22 c8 b7 ca bb e8 0c af 7e 5a cd | CERT 90 0c b9 e5 4b 4a de cc c3 7c ea e6 3f 96 0c b5 | CERT dc 5f 88 2d e7 e2 cc f5 f3 90 76 dc b3 05 1d 01 | CERT 60 24 b8 8c a2 f7 26 17 04 4f 25 15 bc 7f 1c ff | CERT 4a f7 81 eb 12 63 8b 11 8c 53 ba | emitting length of ISAKMP Certificate Payload: 1232 "north-east" #1: I am sending a certificate request | ***emit ISAKMP Certificate RequestPayload: | next payload type: ISAKMP_NEXT_SIG (0x9) | cert type: CERT_X509_SIGNATURE (0x4) | next payload chain: ignoring supplied 'ISAKMP Certificate RequestPayload'.'next payload type' value 9:ISAKMP_NEXT_SIG | next payload chain: setting previous 'ISAKMP Certificate Payload'.'next payload type' to current ISAKMP Certificate RequestPayload (7:ISAKMP_NEXT_CR) | next payload chain: saving location 'ISAKMP Certificate RequestPayload'.'next payload type' in 'reply packet' | emitting length of ISAKMP Certificate RequestPayload: 5 | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org->%fromcert of kind PKK_RSA | searching for certificate PKK_RSA:AwEAAbrCE vs PKK_RSA:AwEAAbrCE | ***emit ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Certificate RequestPayload'.'next payload type' to current ISAKMP Signature Payload (9:ISAKMP_NEXT_SIG) | next payload chain: saving location 'ISAKMP Signature Payload'.'next payload type' in 'reply packet' | emitting 384 raw bytes of SIG_I into ISAKMP Signature Payload | SIG_I 83 32 ce 6d d4 ac 80 e3 4c 30 99 1b 24 b9 79 db | SIG_I 2f 7f 05 fc 4c 1a e2 b9 2b 02 ed 67 30 ff e6 45 | SIG_I d1 66 20 2d 4c 61 ec 01 4c 5a 86 cf 33 a7 f8 0d | SIG_I e8 ff 1b 6b 20 1f ca c3 52 96 65 14 1e 22 06 b9 | SIG_I 78 09 1c db 57 80 80 02 63 2b 26 28 fc 08 d8 de | SIG_I e2 72 f6 eb 30 cb c9 ee 9c 37 df e3 5a 8e 48 d1 | SIG_I d0 49 36 e8 c4 88 dc 49 46 c9 9f 6f 2f 9d 2d 9f | SIG_I fc 74 8d 41 d2 c3 8c 11 90 cb 4c 8f 06 48 19 15 | SIG_I ed 91 09 ae 32 1f f2 13 f3 b2 f8 63 ee b8 8a 68 | SIG_I 93 0e fc 31 b8 9c a2 54 cd 88 8c 7d 74 2d b2 2f | SIG_I ee 03 c7 f6 ad 7a 12 0d 15 fb 2f 76 6a 72 2d 3c | SIG_I 2d 14 c2 04 68 0f 5f e1 64 78 a3 7e 82 18 e1 33 | SIG_I 1b fc e3 71 68 ee 8e 6b 52 2a 92 6c 49 68 25 af | SIG_I d2 d7 69 97 e5 32 cf a6 93 ad 4e 1d 3f 29 8a 58 | SIG_I 6b c2 1a 0e ab 67 46 36 aa 71 63 6a 51 59 a0 18 | SIG_I 06 0e 41 a2 94 ec 49 8a 36 cb 5f d0 ed 95 7b 57 | SIG_I ca b7 8d 3b 3a ba 6e bf 96 99 aa 85 48 11 26 2e | SIG_I 0d 73 72 c9 72 3e 7e 26 34 11 c0 05 96 cf 66 6c | SIG_I c1 57 45 d4 c1 10 9e 61 5e b8 03 dc f2 0a f4 84 | SIG_I d4 6c 82 27 5c 59 e0 db 15 09 a8 47 29 2d f7 df | SIG_I 1c 95 b4 c9 34 71 a1 fa 5a 64 6e 7a a4 1d 5f a1 | SIG_I 21 4c 79 cb 6f 4e d0 43 eb 32 e9 ad bc cf 82 38 | SIG_I bd 04 e5 c8 8b 0b 48 91 cd 3d 8f 63 89 ea ab 52 | SIG_I 32 cb 56 d3 85 06 af 0a cf 61 23 c5 22 e5 a3 52 | emitting length of ISAKMP Signature Payload: 388 | Not sending INITIAL_CONTACT | emitting 6 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 1852 | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #1 is idle | doing_xauth:yes, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 | parent state #1: MAIN_I2(open IKE SA) => MAIN_I3(open IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7efc88002b20 | sending reply packet to 192.1.2.23:500 (from 192.1.3.33:500) | sending 1852 bytes for STATE_MAIN_I2 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 05 10 02 01 00 00 00 00 00 00 07 3c 72 6f 32 b6 | 7e a9 c5 8f 7c ca a9 72 f9 ff 8e bd d0 2a ae 5c | e0 a2 c6 88 50 34 cf 60 5b 16 2e c9 20 d3 e1 1f | 9f 52 b4 51 ef 0d 13 17 60 65 f2 9b a2 43 b7 0c | e2 bc 28 3b 9a 49 e9 ba 2a 58 00 dc ee 27 58 eb | 2e 1b 09 d7 7b 04 93 6d 00 df 7d 45 12 cc 03 7f | 03 81 65 f8 73 04 8a f5 28 99 4b c2 32 64 31 46 | e9 37 55 82 9e 73 ce 62 31 b3 3c bb 0a 75 4c 1d | a2 47 f1 45 e6 90 48 a6 4b 2c d5 b8 e2 52 00 01 | 16 7d 8e 14 6f c3 d0 3f 9e c6 3a 1e 76 fd 06 f9 | d8 86 5d ba 09 17 2b 34 18 78 4e 7d ad f7 c3 6e | 47 04 2d 5c bf af 99 02 33 e5 e6 a8 b3 ce a5 f3 | 1d 5b 76 d4 19 f2 18 5f 39 f3 9b dd 7c 56 30 35 | ad 15 3a 56 73 ad e0 64 45 d8 a8 23 a8 be 57 61 | 0e fd a4 67 27 b2 c6 2b 11 52 ee 0b 45 0b 55 df | 3c d6 f5 04 f9 47 5a 65 5d db 8f a8 1d ee f8 77 | 26 84 79 1a a2 36 7d ac d3 cc 45 de 98 3d 93 62 | 32 e2 05 6d 87 46 3e 8f dc 31 54 be 9c f5 e3 bc | 54 14 78 d5 23 1f cd ec a9 4f 17 d8 4c d1 22 d9 | 44 95 59 1d f6 e6 7f 08 3a bf 83 10 d2 9e 1c 0e | d9 46 4a a3 48 ae 27 30 75 fc e7 24 f1 77 04 ae | f5 ed da b3 bc ab 6b 00 96 55 8c ab ea 2e e8 bd | 0d 10 9d 82 0a 9f 3e c4 a1 f2 ad 06 1a cf 84 fb | 42 bf 1b cf c0 74 b9 e0 a4 7d 0d 72 b5 76 11 03 | 3f 9e 49 9c 5b 9d ef c3 f0 3b 2a b4 50 df 7e f5 | bc eb 28 1c 73 57 4d bc 49 d0 18 7c 43 5a 00 7a | 17 f5 6a c1 cd 67 9f a9 75 3a 89 0c 4c 07 97 79 | 69 64 35 fa f3 c4 f0 6a 7c a8 96 dd 4b 69 69 66 | 88 61 04 bf 04 b7 67 c8 6c d8 94 d1 84 33 9b 81 | d0 b0 d0 8f e2 d1 a2 62 07 e1 23 c3 30 18 a8 ee | ad 0c bf 52 be 4a 79 33 31 fa 93 41 be 53 bc ce | 3b f7 89 43 20 69 6d bb de ae 18 42 46 d2 34 87 | 8d 9b de a3 bb 58 4b b4 61 b5 d6 ab f8 af 40 cc | 64 90 2b 33 80 29 2b 6e 35 8f 9b 53 30 09 0e 30 | 09 30 9b 1a b9 6d d9 c3 2c f5 65 68 c4 4f ed 15 | 8a 8c 24 a5 a1 d3 f0 d0 2d 57 16 ad f6 d9 1b 24 | 28 d5 dd 69 1b 7b ba 7c 17 27 73 42 82 18 71 92 | e3 41 9f a6 8a da 72 52 f2 8e dd ac ab 25 1a 57 | 2d c1 ea 51 97 64 66 c5 a2 70 a6 47 97 a2 c6 77 | 37 08 95 11 33 21 ec 12 aa da 42 67 70 1b db 6d | ec 4f d5 50 04 76 48 16 7a 81 21 8a 8a b9 17 81 | 2f 41 a5 bb bc ff 2e 98 26 3a 19 bb 0f 93 e1 77 | 83 28 80 e6 64 97 d9 76 bc 3b 9b 18 9c 9a 22 57 | e3 74 f1 54 fc 10 5c 52 4f fd 5e 0e 75 52 84 08 | 4c b4 78 db f8 25 c3 8e 18 53 59 96 cf 3c 1f 6c | 83 59 e2 57 a3 4b c9 90 1a e6 0f a9 bf 09 5d 5f | 5b 92 37 a9 14 30 c7 96 82 9b ba 71 f4 3f c2 67 | 44 ab c2 08 aa 6e 36 b1 25 c6 50 56 43 bf fd 0a | 94 a3 28 1f b0 0d ca c0 5f 0c 45 b9 2a b6 36 ce | 91 ac 8c f1 bc 79 ad 04 6b 15 38 b5 cd 52 54 42 | c9 d3 81 fb bb 53 26 db 76 49 ee f5 99 50 83 3d | 45 23 0f cc fc 07 b0 84 27 e7 18 c6 b2 62 d5 1e | 5c 88 52 26 a8 ed 55 5e ec 61 71 e5 29 25 cb 60 | 96 f3 cb 6f 69 f7 fc c1 69 d0 ff b5 ad 81 0b 80 | c2 f9 c5 30 e5 a2 78 eb d7 83 f7 cb 4d ca 24 a2 | 92 5b af 32 c0 aa 32 07 ec 95 11 54 5f 5f 95 33 | da 02 3e 7a b9 a7 3b 78 9d d0 bf 2e 66 49 b8 f8 | e9 e6 bd a3 dd 52 f8 9e 6c 85 96 0c e4 ce 0d 3f | 7c 0d 3f 8d 15 4e 60 af bb 7c f2 cd b6 ae 6b b2 | 30 4d e7 ae 9a 25 1c 06 d5 c9 0c 08 e2 6b 7f c7 | d7 05 0b 31 af 84 66 8c 80 dd c5 90 0c fa 55 0f | 86 1a 78 12 65 10 86 e8 09 ae 1f c3 2e 7d 51 db | 37 60 fb 00 55 f8 03 af 3f 18 af fc 5d 33 4f 87 | 1e 5f db 81 bc 49 5e bf 4c 9d d3 6d fb c2 5f ce | 60 5b e3 18 c9 ab 7f 1b bc 12 0a 4b 5a 89 ef 3b | 24 c2 78 5f 73 ed f2 94 10 89 88 64 05 87 d5 e1 | a0 d5 60 35 4c bc 97 da d4 fb dc ba 2f b5 d2 82 | 48 82 2e 4e f9 43 9e 59 85 87 d5 6e 8c 44 f7 71 | 0c a1 f8 de 44 46 75 46 8a ff 09 06 83 b9 aa fd | 5e 95 ec 4f 97 c3 d2 45 99 43 ab f6 a6 4c c4 a2 | 79 aa 3d 7f b2 dc eb 36 59 9f 3a 1b ab b4 3a eb | 5f 48 a5 15 8c 1c 3b 76 52 d6 ca 86 21 e3 c6 f6 | 51 a1 d4 16 5e ce 69 ec 13 38 99 d2 90 95 79 05 | 51 05 3f a0 9b b8 2f 81 22 cb 7c a9 77 08 3d 6c | a8 38 ea 71 10 2b 43 80 f2 80 08 65 22 a4 d4 85 | 65 c0 19 0f d1 9b f6 a0 57 19 26 75 18 6a 19 b8 | fe 65 68 e4 6e ab 2a af 8a 6a 03 ec d4 d3 dd d5 | 01 d8 1b 92 1b d0 dc aa 34 b5 6c 0c f0 c9 43 0e | fe e8 96 90 8a 9f e7 c1 9d c5 87 ad f2 cb eb e7 | 50 7f f3 0b d1 a8 14 47 aa 7c 65 82 f7 bc e4 5a | ad ac 20 35 23 d1 39 4d 7a 34 a1 87 a5 73 47 65 | 80 e0 f6 6b f0 5b 68 fd 3e 36 63 73 08 76 90 9d | 22 0d 6e 4e 03 1f 34 53 8c c9 c0 1e 08 5f 53 3e | 15 e4 bf de 41 ca 97 a4 d5 ca 20 b5 5a 56 1d 2c | a7 ae 78 74 ef 0c 48 4c 8f d7 b1 27 a2 b4 eb d0 | 2c a7 fc fe a9 17 1d f5 86 3e 68 f4 f1 df 25 3b | a4 c5 ba b5 92 c1 ca 59 7e d7 57 69 a2 3d f8 f6 | 33 67 5d da fc 78 50 36 68 d5 c3 30 a6 b0 c8 36 | 3a 30 14 ee 76 05 c8 8a 2f bf 7e 06 16 ea 8f b4 | 6a 1a 4a 17 3a 0d ea 6d 8e 5c ad f0 b8 89 fd 66 | 9f 2a 85 5c 7b 14 04 84 e1 3c 51 79 1a f2 9d b6 | f4 d9 f9 9d 37 37 f6 cd 53 da 3d 01 96 85 85 4c | 1d 38 86 52 c7 96 d0 c0 6e a8 5c 30 eb cd 76 06 | 7d d6 50 ce f8 19 d4 ac 78 0c b8 00 b3 17 70 90 | 2e 3a a6 b2 39 02 ea 17 d0 ba 71 bd 02 b7 78 65 | fc 3b 56 f1 c8 e5 ed 25 f7 30 53 7b 47 86 38 47 | 0a 1b 82 78 52 ac 9b 0c d4 c3 7c 7f d0 3d ad c8 | 44 1d 3b b1 fa 0c 85 26 a7 3b 05 83 1a 27 0e 81 | cd ce 8c a4 61 11 09 af 1a eb a1 5c 50 44 7d 1b | 50 ad 0f 6e f5 d2 53 7f 40 2a 02 71 c2 19 20 62 | 17 22 69 82 79 71 57 bf 4b d1 dc ce 98 51 58 4c | 83 4f 94 c3 01 c9 90 9b 31 f7 54 10 38 1d d3 be | f2 a4 3c 94 32 89 1c 1a 02 b9 14 e9 3b 6b d4 97 | 00 2e 25 c5 ff 4f 56 97 54 25 a8 c7 d0 5a 2e 67 | 81 4b c8 d1 f2 7a ef 66 7e e8 97 ec 3f b6 2f 46 | b4 4d b2 ec 53 c6 62 dd 11 44 13 ea 54 71 5d 58 | 11 8f 08 ed 75 eb 76 f1 12 e3 99 c4 57 0e cf db | 72 27 59 f7 a3 29 bf 1e 6a 71 d2 fa 77 8a bb 4c | 4c 61 63 0b 58 5d 18 da b0 28 85 d2 1d 4e aa 5c | ac b1 54 0a 05 ae 9d bf af 61 69 d0 ba 5a 52 12 | c7 46 de c2 90 21 a0 f0 67 44 f6 7e 2e ec 05 ce | 8f db 6c e2 2a 26 31 75 ef c7 01 40 c8 2a 59 8e | ca cc 3d 2b 37 21 17 dc 08 4c 69 0b c5 01 03 1e | 9a 44 8c df 7e c8 fd 24 25 18 47 fe ed cb 6c 8d | 00 39 36 34 39 d3 b5 1d 5c ce 86 52 | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x55970409e530 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | #1 STATE_MAIN_I3: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50029.231084 "north-east" #1: STATE_MAIN_I3: sent MI3, expecting MR3 | XAUTH client is not yet authenticated | resume sending helper answer for #1 suppresed complete_v1_state_transition() | #1 spent 10.7 milliseconds in resume sending helper answer | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7efc80004f00 | spent 0.00248 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 1884 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 05 10 02 01 00 00 00 00 00 00 07 5c 19 dd 3b ce | 64 ba 99 5d 68 e1 31 57 d2 b8 a4 06 a2 a3 a9 a5 | c1 4e 7e 2b 3b 33 2f cb 9c 24 f4 39 cd 1d 87 6b | 02 ac c1 e5 f5 e1 2d f9 a2 6c 24 62 8e b7 34 28 | 12 2d 35 af 8e 49 55 1b da 7b ae 40 a3 7c 50 15 | b5 68 f3 92 6e d5 10 b6 23 66 ea 55 f2 80 76 47 | ba 75 f9 16 85 33 ed b6 8b ca 1f a2 28 e9 67 59 | fd cd b7 a3 82 3b 83 aa 91 3c b8 cb 5f 26 f0 74 | 92 25 cd 4d 38 33 84 df b5 c1 b9 4c b5 6e 20 c8 | d5 91 e8 2a c3 a6 24 13 a6 53 af 5f 53 88 38 15 | fc fa 4b dd 97 e2 81 0a 8f d4 b8 2b c3 68 c9 02 | e2 47 89 a8 05 ad 47 a3 3d 36 3e 69 da 95 23 20 | be 9e 21 1f f3 12 d6 fa 53 0a 18 2a 8a 0b 81 75 | e2 51 98 0e b9 a7 08 b3 c5 29 21 de 8b 33 64 83 | cf 0e 4b 89 98 da 13 bd 30 a2 21 d2 97 51 d9 20 | 32 51 fe 68 2d 31 d0 82 73 c4 3a 21 2e b0 f9 e5 | 91 b9 b6 35 82 f4 8e ba 54 ff 54 17 df 8f c2 32 | 1e 91 ce dc e6 2f a4 78 21 c1 a4 30 3b 71 49 f1 | 88 cd f9 85 a7 6e 46 41 58 49 da e6 98 d4 b2 ee | 83 17 71 e8 6f f0 3c d7 9a f7 73 c5 7e 3d 1d 2f | 90 dc 39 3b b3 49 9e 13 69 c5 25 ce cb f3 68 35 | 9d 12 97 8d a3 a2 98 13 aa ab 7d 5d e5 c5 b2 76 | a4 1a d0 ef 88 30 47 d1 4f b5 28 db 1a 0e c2 a8 | ad 97 44 cf 77 73 85 85 ab ba c6 41 35 46 e7 c8 | fc 23 d5 30 78 89 f9 a6 fe 16 ab ae 59 a6 d8 17 | 25 7f 60 de 43 3d d5 13 5d ef 20 95 66 e2 95 c1 | 66 65 76 e5 78 43 0a 7f e0 a9 2b 15 12 33 9f b3 | 65 03 6d 8d 9d a6 a8 10 2f 65 26 7d 03 ae 32 56 | 44 b3 c9 c5 d1 7e 12 1b fc 5e 99 d1 e8 06 04 bb | f4 ea fd f7 fb 84 d2 64 be a7 ba aa 18 66 71 f1 | 1a c6 d2 ae fe 43 93 bc 43 a6 51 54 78 44 cc 49 | c8 a3 e5 f3 c6 80 a6 66 30 7c 10 dc d1 4b ab c6 | 78 54 6f 80 07 1e 58 41 eb 5f 7d a2 48 4d 29 40 | 64 ed a2 7a 19 43 f3 45 3f 7e 7e 53 b4 f7 cb 4f | 2b 5a 16 d6 3b d2 93 fd 02 fe 36 08 0b 80 a5 66 | 3c af a8 5a dd 38 7c a5 24 c4 2e 34 16 e8 1b 1f | 34 72 96 c9 02 38 25 b8 80 e5 be a1 4b 85 36 e0 | 78 07 12 bc ad 97 0c 78 ed 16 0d e8 cf 55 c0 08 | f1 57 5f 4b 15 c5 ed 9d 84 91 3b f6 ef 8d 98 f4 | 01 7b 33 0f da 22 1d 42 ac 90 d1 02 d7 9f 1b 7d | 65 94 86 3c a2 95 b2 15 66 1c 5b 3c 99 3f 2b 6f | 60 2e 54 2a c2 06 12 55 e5 2d 47 ea e7 07 c4 aa | ba 6f 46 7d 57 e8 33 90 88 00 ad 73 be 79 73 9d | 83 58 56 cd f4 83 51 03 22 0e 87 7c f6 a3 62 82 | f4 6d 42 d0 fc 6b dc 47 15 ae ea be 6c 5a ff 7d | b4 17 5f 75 7e b0 d1 bf 94 dc 37 d7 55 20 dd 5a | c1 cb 94 02 78 a1 5f b0 77 2d cd c5 88 ed 25 5c | 6a 67 0b 25 20 b3 83 84 e0 dd 20 19 a2 31 47 7c | 0f 25 13 5e 14 6e 86 e2 e9 44 cf 96 f4 d0 d9 f0 | 9a 39 12 e0 03 90 82 17 67 63 54 16 e6 8c 25 f6 | 91 bc dd 3f 52 ac c8 39 1c 58 48 a0 6a 72 0d 32 | 87 5c fc 74 42 f3 c6 a0 92 16 35 26 e1 eb 0e 92 | 71 39 bb a2 9d 14 21 ef 23 ed c2 7e 0a 2f 8e c6 | ba 2e ea ec e3 c9 fa 66 66 42 af 60 31 51 e2 e6 | ec e0 89 fd 15 fb c6 d9 d1 15 c2 35 df b7 38 d7 | 16 af f2 3d 18 aa de 8b 91 ef d1 e5 e5 d9 51 db | 14 31 fa a5 19 aa d9 94 33 3b 82 ee f9 87 90 3c | 70 7b 5d e9 8f fa 3f 8e 00 2e cd ee aa 31 d2 d9 | 54 d8 f8 8e 84 d2 e0 98 6b d2 5d 3b 63 a3 a7 76 | 77 06 8a 50 1d b4 38 af 5b 15 27 e5 89 58 9a 33 | e7 c5 a9 67 c0 30 05 4b 4a fa 90 bb eb 99 ff 81 | 38 a8 67 ba af 33 0e 32 da ae 73 62 59 f8 01 43 | a3 50 51 46 fa 50 e3 c4 cf d0 da 77 d8 27 19 13 | d7 69 9f 2c a4 c8 5e fc a0 61 0e 2d 3f ed 68 0b | cd c3 d0 c3 20 d3 ff 33 75 89 3b 9b 1e 20 2a 9e | 5d 92 b2 ab 8f 1f 8a 2f 83 37 e1 94 c0 d1 9e 5e | 29 ca 6f 27 e1 e4 c6 12 2e bf af b0 3c e1 de 2a | 30 d9 21 7d 9c f6 02 67 30 26 28 90 53 d3 f9 05 | ef 4f 76 2b e1 ed 13 ca 36 f4 29 47 b6 81 98 b6 | 25 f2 03 97 73 82 e3 3b 67 78 b7 02 bc d6 40 62 | d1 c1 7a 7b ea 4b ae f7 6d 8d d4 59 7e 23 e6 22 | e0 92 c0 c7 41 2c 02 18 ff 45 d1 0b fd 53 8a d9 | bf 4d 8b 8b e2 af fd 6d 07 b6 40 45 5f 3b 3d 84 | c3 e3 44 13 98 81 15 d5 00 8e 76 42 db da 3f 5d | ee 4b 83 c2 95 08 47 b2 b4 db 35 1f 1d 6d be 1c | 06 62 7a ee 97 fe 6b 2f 1d d0 9a 14 3b e0 96 56 | f4 48 95 9b 8c 56 ab 15 3a c9 da e9 d6 1c f1 ec | 03 c9 97 8c 91 60 91 a3 fb ed 06 90 c3 b1 2d b9 | ba d2 c1 8d e6 8e 39 11 70 db 43 b0 4b e4 f4 95 | 2a 72 21 a4 62 23 2a e6 1b 1b c9 23 30 b9 74 7e | f6 f3 06 9f 01 a9 35 44 7e 3d 60 21 6c fa 9b e9 | a1 de da 59 80 1d d3 32 3e 48 a0 48 85 52 6d 11 | ca 07 bf 58 ad 37 61 c5 39 45 f6 dd c9 6f 2c be | 82 fd 47 fe f1 c4 43 65 4f 81 5e 64 f6 60 36 03 | 26 ae 1f ef d6 49 ea 84 00 a8 07 86 0e f3 f1 b0 | 95 8c 46 4b 37 39 6b 63 e5 e0 07 8f 4a 74 06 cb | ca 0d 17 91 c1 3b 2e bc 12 93 07 a6 dd 44 fa e4 | 51 ca 7a b6 ec b7 62 ab 85 47 29 26 8e 98 18 d1 | 0d 82 f4 a0 76 b5 f6 25 95 71 62 f1 a4 22 9d 72 | 0e 67 86 b7 71 4b 97 88 97 f3 8f d8 d4 0d a2 57 | 93 0f 2a 37 40 77 07 65 5b a5 cc 60 a6 d1 de ea | 61 99 ee 2a 54 2d f5 19 c0 47 9e 4a 5d aa 64 a3 | d1 d5 c5 7a be ef 92 a9 e4 5e 8b 10 47 fc 95 3f | dd 6a a9 bd 0f e8 ee 9e ea 6f ed 97 89 d3 01 28 | 50 72 a8 31 e3 de 38 8e e7 00 f3 41 0e dd fd 19 | 8d ad 49 35 f0 14 32 34 72 32 e2 5a b9 68 13 df | e4 0c d4 0e ee ca 5f 50 34 f5 1b c6 79 a0 39 bf | a5 13 ae 4f 91 fd c5 08 43 c6 1f a7 7e cb b4 98 | 3d 54 c4 ab 00 f0 89 31 7b 1c d0 36 ea a3 42 89 | e5 8e 66 3d 7e f4 0a 30 b6 57 59 39 83 4b 67 ec | a9 21 e6 32 3c 6d 3f 8d 06 6b 8e 3c 9c 2d 1b eb | 60 b5 bc b1 d7 cf 63 29 f3 3a 32 99 d4 26 5c 88 | c3 b0 84 61 dc 47 f3 3c d2 51 c2 14 3a 91 2a cc | 4a 11 76 65 51 83 38 c3 4a 62 6d 3f 32 99 2d cb | 84 f1 1b 4e 57 fe 39 f5 89 ba d4 d1 73 23 cc 88 | de b9 91 7b b2 8b b7 d2 6d 38 1f f5 2d d0 07 98 | 38 74 56 65 55 d6 8c 1c 5f 4c 4f 66 74 94 a8 b9 | eb 94 fd de 69 18 7b 6d fa bc 4c 37 9e 1f cf cc | b8 eb 1d b4 16 e7 dd e2 fc 29 8f bd 7c 6b ab 96 | 01 fc 6d 95 21 f6 ba ea af 6a af 91 88 fe 50 63 | 0f a2 be d1 47 0e 5c aa 32 5e a1 b2 fb 85 83 96 | 8c a2 0c 6a b8 9b 53 26 69 f5 ab 7b e3 40 4f e3 | 1b b6 48 f2 5e fa ef 10 1c 4b 0b d4 56 c6 d0 24 | 75 4f 63 bc 12 bb e7 5d fc aa 7d fc 5e 17 79 74 | 52 9e b4 31 0c ac e4 c0 62 18 19 b7 cb 55 e2 74 | 3e 3e 05 c0 53 45 0d 2b d8 9e 3a 2b da 9a b2 05 | 60 a0 ff 78 60 0e 01 4f 59 87 2f f6 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_ID (0x5) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 0 (0x0) | length: 1884 (0x75c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2) | State DB: found IKEv1 state #1 in MAIN_I3 (find_state_ikev1) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1435) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x220 opt: 0x20c0 | ***parse ISAKMP Identification Payload: | next payload type: ISAKMP_NEXT_CERT (0x6) | length: 191 (0xbf) | ID type: ID_DER_ASN1_DN (0x9) | DOI specific A: 0 (0x0) | DOI specific B: 0 (0x0) | obj: 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | obj: 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | obj: 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | obj: 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | obj: 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | obj: 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | obj: 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 65 61 73 | obj: 74 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | obj: 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a 86 48 | obj: 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 65 61 73 | obj: 74 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | obj: 77 61 6e 2e 6f 72 67 | got payload 0x40 (ISAKMP_NEXT_CERT) needed: 0x200 opt: 0x20c0 | ***parse ISAKMP Certificate Payload: | next payload type: ISAKMP_NEXT_SIG (0x9) | length: 1265 (0x4f1) | cert encoding: CERT_X509_SIGNATURE (0x4) | got payload 0x200 (ISAKMP_NEXT_SIG) needed: 0x200 opt: 0x20c0 | ***parse ISAKMP Signature Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 388 (0x184) | removing 12 bytes of padding | message 'main_inR3' HASH payload not checked early | DER ASN1 DN: 30 81 b4 31 0b 30 09 06 03 55 04 06 13 02 43 41 | DER ASN1 DN: 31 10 30 0e 06 03 55 04 08 0c 07 4f 6e 74 61 72 | DER ASN1 DN: 69 6f 31 10 30 0e 06 03 55 04 07 0c 07 54 6f 72 | DER ASN1 DN: 6f 6e 74 6f 31 12 30 10 06 03 55 04 0a 0c 09 4c | DER ASN1 DN: 69 62 72 65 73 77 61 6e 31 18 30 16 06 03 55 04 | DER ASN1 DN: 0b 0c 0f 54 65 73 74 20 44 65 70 61 72 74 6d 65 | DER ASN1 DN: 6e 74 31 23 30 21 06 03 55 04 03 0c 1a 65 61 73 | DER ASN1 DN: 74 2e 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | DER ASN1 DN: 77 61 6e 2e 6f 72 67 31 2e 30 2c 06 09 2a 86 48 | DER ASN1 DN: 86 f7 0d 01 09 01 16 1f 75 73 65 72 2d 65 61 73 | DER ASN1 DN: 74 40 74 65 73 74 69 6e 67 2e 6c 69 62 72 65 73 | DER ASN1 DN: 77 61 6e 2e 6f 72 67 "north-east" #1: Peer ID is ID_DER_ASN1_DN: 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | global one-shot timer EVENT_FREE_ROOT_CERTS scheduled in 300 seconds loading root certificate cache | spent 4.18 milliseconds in get_root_certs() calling PK11_ListCertsInSlot() | spent 0.0244 milliseconds in get_root_certs() filtering CAs | #1 spent 4.23 milliseconds in find_and_verify_certs() calling get_root_certs() | checking for known CERT payloads | saving certificate of type 'X509_SIGNATURE' | decoded cert: E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | #1 spent 0.604 milliseconds in find_and_verify_certs() calling decode_cert_payloads() | cert_issuer_has_current_crl: looking for a CRL issued by E=testing@libreswan.org,CN=Libreswan test CA for mainca,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | #1 spent 0.0361 milliseconds in find_and_verify_certs() calling crl_update_check() | missing or expired CRL | crl_strict: 0, ocsp: 0, ocsp_strict: 0, ocsp_post: 0 | verify_end_cert trying profile IPsec | certificate is valid (profile IPsec) | #1 spent 0.136 milliseconds in find_and_verify_certs() calling verify_end_cert() "north-east" #1: certificate verified OK: E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55970409e5e0 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55970409e610 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x559704097d40 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x55970409c170 | get_pluto_gn_from_nss_cert: allocated pluto_gn 0x559704098ac0 | unreference key: 0x5597040a9f50 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 1-- | #1 spent 0.307 milliseconds in decode_certs() calling add_pubkey_from_nss_cert() | #1 spent 5.35 milliseconds in decode_certs() | ID_DER_ASN1_DN 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' needs further ID comparison against 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | ID_DER_ASN1_DN 'E=user-east@testing.libreswan.org,CN=east.testing.libreswan.org,OU=Test Department,O=Libreswan,L=Toronto,ST=Ontario,C=CA' matched our ID 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | SAN ID matched, updating that.cert | X509: CERT and ID matches current connection | required RSA CA is '%any' | checking RSA keyid 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' for match with 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' | trusted_ca_nss: trustee A = 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | RSA key issuer CA is 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org' | an RSA Sig check passed with *AwEAAbANn [remote certificates] | #1 spent 0.166 milliseconds in try_all_keys() trying a pubkey "north-east" #1: Authenticated using RSA | FOR_EACH_CONNECTION_... in ISAKMP_SA_established | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #1 is idle | doing_xauth:yes, t_xauth_client_done:no | IKEv1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 | parent state #1: MAIN_I3(open IKE SA) => MAIN_I4(established IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I4: retransmits: cleared | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_RETRANSMIT-pe@0x55970409e530 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x55970409e7f0 | inserting event EVENT_SA_REPLACE, timeout in 2607 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | pstats #1 ikev1.isakmp established "north-east" #1: STATE_MAIN_I4: ISAKMP SA established {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | XAUTH client is not yet authenticated | #1 spent 5.83 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 6.17 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00276 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 06 01 0b 2c 16 5b 00 00 00 5c 6b a4 a9 30 | 14 ac c3 ab 66 4e 51 50 06 e8 ce 56 eb 6d 26 3e | 40 2f 0b 87 27 ba 29 53 da 11 03 56 53 aa df 8c | 9a 38 19 5b 76 5b 6a d7 57 ef 5e ec 85 8b 0d c3 | 94 94 60 e4 b7 15 01 a4 69 b5 e9 0d | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 187438683 (0xb2c165b) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6) | peer and cookies match on #1; msgid=0b2c165b st_msgid=00000000 st_msgid_phase15=00000000 | State DB: IKEv1 state not found (find_v1_info_state) | No appropriate Mode Config state yet. See if we have a Main Mode state | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1654) | processing received isakmp_xchg_type ISAKMP_XCHG_MODE_CFG. | this is a xauthclient modecfgclient | call init_phase2_iv | set from_state to STATE_MAIN_I4 this is xauthclient and IS_PHASE1() is TRUE | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x4100 opt: 0x2000 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_MODECFG (0xe) | length: 36 (0x24) | got payload 0x4000 (ISAKMP_NEXT_MODECFG) needed: 0x4000 opt: 0x2000 | ***parse ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | Attr Msg Type: ISAKMP_CFG_REQUEST (0x1) | Identifier: 0 (0x0) | removing 12 bytes of padding | xauth_inI0 HASH(1): | 03 01 d3 87 c2 aa 9d 5c b4 c8 07 d5 6f ba c7 4c | 24 9d 33 02 c7 ac 99 4d e4 4f 64 1a b3 9e b3 bb | received 'xauth_inI0' message HASH(1) data ok | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 187438683 (0xb2c165b) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 8:ISAKMP_NEXT_HASH | arrived in xauth_inI0 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: XAUTH-USER-NAME (0x4089) | length/value: 0 (0x0) | Received Cisco XAUTH username | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: XAUTH-USER-PASSWORD (0x408a) | length/value: 0 (0x0) | Received Cisco XAUTH password | XAUTH: Username or password request received | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | Attr Msg Type: ISAKMP_CFG_REPLY (0x2) | Identifier: 0 (0x0) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Mode Attribute (14:ISAKMP_NEXT_MODECFG) | next payload chain: saving location 'ISAKMP Mode Attribute'.'next payload type' in 'reply packet' | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: XAUTH-USER-NAME (0x4089) | prompting for Username: | emitting 6 raw bytes of XAUTH username into ISAKMP ModeCfg attribute | XAUTH username 78 6e 6f 72 74 68 | emitting length of ISAKMP ModeCfg attribute: 6 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: XAUTH-USER-PASSWORD (0x408a) | started looking for xauth secret for xnorth | line 0: key type PKK_XAUTH(@xnorth) to type PKK_RSA | line 1: key type PKK_XAUTH(@xnorth) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | looked up username=xnorth, got=(nil) | prompting for Password: | emitting 8 raw bytes of XAUTH password into ISAKMP ModeCfg attribute | XAUTH password 75 73 65 31 70 61 73 73 | emitting length of ISAKMP ModeCfg attribute: 8 | emitting length of ISAKMP Mode Attribute: 30 "north-east" #1: XAUTH: Answering XAUTH challenge with user='xnorth' | XAUTH: client response HASH(1): | e2 db 05 7d c0 6b 18 5e e5 8e 5f ce 39 d4 e8 15 | ac 48 f1 e8 b4 14 c0 dd 49 9b 17 24 a8 10 f6 14 | padding IKEv1 message with 2 bytes | emitting 2 zero bytes of message padding into ISAKMP Message | emitting length of ISAKMP Message: 96 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 108 | xauth_inI0(STF_OK) | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #1 is idle | doing_xauth:yes, t_xauth_client_done:no | IKEv1: transition from state STATE_XAUTH_I0 to state STATE_XAUTH_I1 | parent state #1: MAIN_I4(established IKE SA) => XAUTH_I1(established IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_SA_REPLACE-pe@0x55970409e7f0 | sending reply packet to 192.1.2.23:500 (from 192.1.3.33:500) | sending 108 bytes for STATE_XAUTH_I0 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 06 01 0b 2c 16 5b 00 00 00 6c 79 bc 44 01 | 44 63 50 b4 b3 af 85 38 5b 08 34 05 2f ba 9e ca | 07 06 51 f5 0f 07 86 39 1c 97 cd 46 3b f3 b0 89 | 27 34 ea 96 1c 13 f7 47 eb 72 6d 18 05 0e 41 fc | 2e f4 9d a4 8a f8 5b 18 05 ed 07 75 da 94 fe b7 | 19 4b 6e f7 d2 40 1e 02 27 a4 a5 d5 | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x55970409e7f0 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | #1 STATE_XAUTH_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50029.326069 | pstats #1 ikev1.isakmp established "north-east" #1: STATE_XAUTH_I1: XAUTH client - possibly awaiting CFG_set {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | XAUTH client is not yet authenticated | #1 spent 0.283 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.455 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00178 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 76 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 06 01 c0 93 5c 8f 00 00 00 4c 3a fe 19 28 | 53 b9 cd a0 7e 79 13 d2 cf d1 89 21 7f 01 38 63 | e4 ef 64 41 7c 49 b3 8e 5f e7 20 65 52 4a f3 8d | 3f 27 65 fd c3 7e da 0e 82 1f 95 e5 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3230882959 (0xc0935c8f) | length: 76 (0x4c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6) | peer and cookies match on #1; msgid=c0935c8f st_msgid=00000000 st_msgid_phase15=00000000 | State DB: IKEv1 state not found (find_v1_info_state) | No appropriate Mode Config state yet. See if we have a Main Mode state | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_XAUTH_I1 | State DB: found IKEv1 state #1 in XAUTH_I1 (find_v1_info_state) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1654) | processing received isakmp_xchg_type ISAKMP_XCHG_MODE_CFG. | this is a xauthclient modecfgclient | call init_phase2_iv | set from_state to STATE_XAUTH_I1 this is xauthclient and state == STATE_XAUTH_I1 | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x4100 opt: 0x2000 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_MODECFG (0xe) | length: 36 (0x24) | got payload 0x4000 (ISAKMP_NEXT_MODECFG) needed: 0x4000 opt: 0x2000 | ***parse ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 12 (0xc) | Attr Msg Type: ISAKMP_CFG_SET (0x3) | Identifier: 0 (0x0) | xauth_inI0 HASH(1): | e2 01 f7 72 21 f5 51 1e 10 3a 7e 3b 41 56 10 51 | 2a e2 f7 b7 b6 0d 60 e1 30 ef 62 4b 93 61 5c a2 | received 'xauth_inI0' message HASH(1) data ok | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3230882959 (0xc0935c8f) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 8:ISAKMP_NEXT_HASH | arrived in xauth_inI0 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: AF+XAUTH-STATUS (0xc08f) | length/value: 1 (0x1) | Received Cisco XAUTH status: OK | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | Attr Msg Type: ISAKMP_CFG_ACK (0x4) | Identifier: 0 (0x0) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Mode Attribute (14:ISAKMP_NEXT_MODECFG) | next payload chain: saving location 'ISAKMP Mode Attribute'.'next payload type' in 'reply packet' | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: AF+XAUTH-STATUS (0xc08f) | length/value: 1 (0x1) | no IKEv1 message padding required | emitting length of ISAKMP Mode Attribute: 12 | XAUTH: ack status HASH(1): | d0 42 34 ac 57 22 27 39 63 27 ac 8d 67 59 e1 fb | 78 15 10 d2 81 9d 1b ba 60 d3 18 c6 a7 a1 f5 b9 | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 "north-east" #1: XAUTH: Successfully Authenticated | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #1 is idle | doing_xauth:no, t_xauth_client_done:yes | IKEv1: transition from state STATE_XAUTH_I0 to state STATE_XAUTH_I1 | event_already_set, deleting event | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_XAUTH_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_RETRANSMIT-pe@0x55970409e7f0 | sending reply packet to 192.1.2.23:500 (from 192.1.3.33:500) | sending 76 bytes for STATE_XAUTH_I0 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 06 01 c0 93 5c 8f 00 00 00 4c f0 46 9a 58 | 07 a0 b8 e2 51 c0 db 83 df 94 8c 4c 06 a5 1c 20 | d6 5c b5 4e 4f 27 06 27 98 d0 16 10 5a aa 91 4f | 6d 6a 15 64 17 b2 c1 6d 9c 3c 9e d6 | !event_already_set at reschedule | event_schedule: new EVENT_RETRANSMIT-pe@0x55970409e7f0 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | #1 STATE_XAUTH_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50029.326638 | pstats #1 ikev1.isakmp established "north-east" #1: STATE_XAUTH_I1: XAUTH client - possibly awaiting CFG_set {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | modecfg pull: noquirk policy:pull modecfg-client | modecfg client is starting due to policy "north-east" #1: modecfg: Sending IP request (MODECFG_I1) | parent state #1: XAUTH_I1(established IKE SA) => MODE_CFG_I1(established IKE SA) | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3182273297 (0xbdada311) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'xauth_buf' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | Attr Msg Type: ISAKMP_CFG_REQUEST (0x1) | Identifier: 0 (0x0) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Mode Attribute (14:ISAKMP_NEXT_MODECFG) | next payload chain: saving location 'ISAKMP Mode Attribute'.'next payload type' in 'xauth_buf' | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_ADDRESS (0x1) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_NETMASK (0x2) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_DNS (0x3) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: MODECFG_BANNER (0x7000) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: MODECFG_DOMAIN (0x7002) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | ****emit ISAKMP ModeCfg attribute: | ModeCfg attr type: CISCO_SPLIT_INC (0x7004) | length/value: 0 (0x0) | emitting length of ISAKMP ModeCfg attribute: 0 | no IKEv1 message padding required | emitting length of ISAKMP Mode Attribute: 32 | XAUTH: mode config request HASH(1): | 89 a4 f6 81 1f e3 0a 1e e5 1b d7 da e4 8f 9c 7e | 1d 4d a0 81 6d 6c d2 1f 38 85 36 fb ed 2e 1d 26 | no IKEv1 message padding required | emitting length of ISAKMP Message: 96 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 108 | sending 108 bytes for modecfg: req through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 06 01 bd ad a3 11 00 00 00 6c f2 84 30 b2 | 25 8d 22 1b 80 e2 4f 50 33 ea 4d d4 2c 20 75 b5 | 4b 30 43 eb ad 53 5f db 7f 97 e6 2f 7a e0 6f ed | 4e 55 c4 70 39 d5 52 56 d0 b5 c0 9b 36 af ec 79 | 45 3e cb db ca 0b 48 04 fc ce f3 50 33 9d 20 e4 | ad c3 91 dc bc 6e 4e 3c 51 68 41 5f | #1 spent 0.351 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.499 milliseconds in comm_handle_cb() reading and processing packet | spent 0.00197 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 124 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 06 01 bd ad a3 11 00 00 00 7c 67 87 28 bf | ad 2a d5 64 39 04 05 76 db 47 71 7b d1 48 85 f7 | 35 a0 5e 8d ee 1b a7 8d 11 65 48 52 30 d1 50 eb | 7d 0b 38 38 47 e5 3a 06 35 28 04 ff 51 e8 d5 42 | 6c 9c 85 66 a9 92 81 af e1 e3 ec cc 6b 9f 92 7f | 8e b1 ab df 85 40 53 39 21 98 e0 f5 d1 0b 4f c6 | 58 1e af 86 18 00 6c fb 7f 71 2d 52 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3182273297 (0xbdada311) | length: 124 (0x7c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6) | peer and cookies match on #1; msgid=bdada311 st_msgid=00000000 st_msgid_phase15=bdada311 | p15 state object #1 found, in STATE_MODE_CFG_I1 | State DB: found IKEv1 state #1 in MODE_CFG_I1 (find_v1_info_state) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1778) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x4100 opt: 0x2000 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_MODECFG (0xe) | length: 36 (0x24) | got payload 0x4000 (ISAKMP_NEXT_MODECFG) needed: 0x4000 opt: 0x2000 | ***parse ISAKMP Mode Attribute: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 60 (0x3c) | Attr Msg Type: ISAKMP_CFG_REPLY (0x2) | Identifier: 0 (0x0) | modecfg_inR1 HASH(1): | a7 93 0c ba ce 02 91 b2 7b 2c 2f 08 88 26 41 4c | ba f7 97 94 97 e1 50 e4 c6 8d ad 11 a7 1a d9 4a | received 'modecfg_inR1' message HASH(1) data ok | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_MODE_CFG (0x6) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3182273297 (0xbdada311) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 8:ISAKMP_NEXT_HASH | modecfg_inR1: received mode cfg reply | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_ADDRESS (0x1) | length/value: 4 (0x4) | parsing 4 raw bytes of ISAKMP ModeCfg attribute into addr | addr c0 00 02 64 "north-east" #1: Received IPv4 address: 192.0.2.100/32 | setting ip source address to 192.0.2.100/32 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_NETMASK (0x2) | length/value: 4 (0x4) | parsing 4 raw bytes of ISAKMP ModeCfg attribute into addr | addr ff ff ff 00 | Received IP4 NETMASK 255.255.255.0 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_DNS (0x3) | length/value: 4 (0x4) | parsing 4 raw bytes of ISAKMP ModeCfg attribute into addr | addr 01 02 03 04 "north-east" #1: Received DNS server 1.2.3.4 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: INTERNAL_IP4_DNS (0x3) | length/value: 4 (0x4) | parsing 4 raw bytes of ISAKMP ModeCfg attribute into addr | addr 05 06 07 08 "north-east" #1: Received DNS server 5.6.7.8 | ****parse ISAKMP ModeCfg attribute: | ModeCfg attr type: CISCO_SPLIT_INC (0x7004) | length/value: 14 (0xe) | *****parse CISCO split item: | IPv4 address: c0 00 02 00 | IPv4 mask: ff ff ff 00 "north-east" #1: Received subnet 192.0.2.0/24 "north-east" #1: Subnet 192.0.2.0/24 already has an spd_route - ignoring | modecfg_inR1(STF_OK) | complete v1 state transition with STF_OK | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #1 is idle | doing_xauth:no, t_xauth_client_done:yes | IKEv1: transition from state STATE_MODE_CFG_I1 to state STATE_MAIN_I4 | parent state #1: MODE_CFG_I1(established IKE SA) => MAIN_I4(established IKE SA) | event_already_set, deleting event | state #1 requesting EVENT_RETRANSMIT to be deleted | #1 STATE_MAIN_I4: retransmits: cleared | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_RETRANSMIT-pe@0x55970409e7f0 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x55970409e7f0 | inserting event EVENT_SA_REPLACE, timeout in 3330 seconds for #1 | libevent_malloc: new ptr-libevent@0x55970409c1d0 size 128 | pstats #1 ikev1.isakmp established "north-east" #1: STATE_MAIN_I4: ISAKMP SA established {auth=RSA_SIG cipher=AES_CBC_256 integ=HMAC_SHA2_256 group=MODP2048} | DPD: dpd_init() called on ISAKMP SA | DPD: Peer supports Dead Peer Detection | DPD: not initializing DPD because DPD is disabled locally | modecfg pull: noquirk policy:pull modecfg-client | phase 1 is done, looking for phase 2 to unpend | unpending state #1 | creating state object #2 at 0x5597040a2b70 | State DB: adding IKEv1 state #2 in UNDEFINED | pstats #2 ikev1.ipsec started | duplicating state object #1 "north-east" as #2 for IPSEC SA | #2 setting local endpoint to 192.1.3.33:500 from #1.st_localport (in duplicate_state() at state.c:1481) | suspend processing: state #1 connection "north-east" from 192.1.2.23:500 (in quick_outI1() at ikev1_quick.c:683) | start processing: state #2 connection "north-east" from 192.1.2.23:500 (in quick_outI1() at ikev1_quick.c:683) | child state #2: UNDEFINED(ignore) => QUICK_I1(established CHILD SA) "north-east" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO {using isakmp#1 msgid:e4bcde29 proposal=defaults pfsgroup=MODP2048} | adding quick_outI1 KE work-order 3 for state #2 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x55970409c850 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x559704074bf0 size 128 | libevent_realloc: release ptr-libevent@0x55970407aee0 | libevent_realloc: new ptr-libevent@0x5597040981d0 size 128 | stop processing: state #2 connection "north-east" from 192.1.2.23:500 (in quick_outI1() at ikev1_quick.c:762) | crypto helper 3 resuming | resume processing: state #1 connection "north-east" from 192.1.2.23:500 (in quick_outI1() at ikev1_quick.c:762) | crypto helper 3 starting work-order 3 for state #2 | unqueuing pending Quick Mode with 192.1.2.23 "north-east" | crypto helper 3 doing build KE and nonce (quick_outI1 KE); request ID 3 | removing pending policy for no connection {0x559704040410} | close_any(fd@24) (in release_whack() at state.c:654) | #1 spent 0.261 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.403 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 3 finished build KE and nonce (quick_outI1 KE); request ID 3 time elapsed 0.000588 seconds | (#2) spent 0.569 milliseconds in crypto helper computing work-order 3: quick_outI1 KE (pcr) | crypto helper 3 sending results from work-order 3 for state #2 to event queue | scheduling resume sending helper answer for #2 | libevent_malloc: new ptr-libevent@0x7efc84007fa0 size 128 | crypto helper 3 waiting (nothing to do) | processing resume sending helper answer for #2 | start processing: state #2 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 3 replies to request ID 3 | calling continuation function 0x559703870630 | quick_outI1_continue for #2: calculated ke+nonce, sending I1 | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3837582889 (0xe4bcde29) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | emitting quick defaults using policy none | empty esp_info, returning defaults for ENCRYPT | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 10:ISAKMP_NEXT_NONCE | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 2 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 2 (0x2) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | netlink_get_spi: allocated 0x136faf63 for esp.0@192.1.3.33 | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload | SPI 13 6f af 63 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_T (0x3) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ESP): 32 | *****emit ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ESP transform number: 1 (0x1) | ESP transform ID: ESP_3DES (0x3) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******emit ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | emitting length of ISAKMP Transform Payload (ESP): 28 | emitting length of ISAKMP Proposal Payload: 72 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ESP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 84 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | ***emit ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | next payload chain: ignoring supplied 'ISAKMP Nonce Payload'.'next payload type' value 4:ISAKMP_NEXT_KE | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Nonce Payload (10:ISAKMP_NEXT_NONCE) | next payload chain: saving location 'ISAKMP Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of Ni into ISAKMP Nonce Payload | Ni 45 51 9d aa 5f c3 11 ae 73 85 e1 65 7d 9d 0c 15 | Ni d3 13 f1 16 bf 1a 6b f4 47 af 0d 20 35 37 fa 99 | emitting length of ISAKMP Nonce Payload: 36 | ***emit ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | next payload chain: ignoring supplied 'ISAKMP Key Exchange Payload'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Nonce Payload'.'next payload type' to current ISAKMP Key Exchange Payload (4:ISAKMP_NEXT_KE) | next payload chain: saving location 'ISAKMP Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of keyex value into ISAKMP Key Exchange Payload | keyex value 82 3c be 85 36 27 84 53 e6 74 ea f4 66 36 65 4c | keyex value 88 47 2c 27 ac 55 6e 47 b8 b9 68 9c 3b d5 13 6e | keyex value 35 95 0e f5 5c a0 f5 90 b3 cd 1e 24 f0 39 3b ef | keyex value 49 a7 f7 31 2c 12 99 71 2b c4 63 42 e2 61 4e 16 | keyex value b0 46 67 b0 56 df e2 fb 39 9a a8 72 89 8f aa 4f | keyex value f7 cf 33 f0 3d bb 9d 1f ec ca 1e e4 42 3a a7 2d | keyex value f2 57 ff 74 a9 6d 7e 60 c2 c1 c7 43 3f 1d 20 b5 | keyex value fc 9a 95 28 3e ce 7e d0 22 7c de c4 c4 a6 c3 89 | keyex value b0 9b 91 df 1a 06 48 ab 06 04 aa 10 40 f1 7a 0d | keyex value 01 cb 81 8c 44 41 94 1c 62 9d 00 31 ec df 89 fc | keyex value 2f eb 61 2f c7 6a 97 32 12 7d 83 c6 37 73 7f d8 | keyex value 87 de a8 d2 ed e4 16 4a 52 4c 18 c3 e9 4c b0 3d | keyex value 51 67 d5 03 df fd dd b3 9c c7 9a 19 d5 d0 f1 2c | keyex value 11 7d fc d5 f2 b1 81 14 24 d4 a4 a6 b0 8b be dc | keyex value 8d f1 bd ab 53 28 40 9b f4 9a 2d d9 41 7a 88 ef | keyex value 10 1a 7e a5 0b 9a cb b1 07 54 29 83 92 86 72 fa | emitting length of ISAKMP Key Exchange Payload: 260 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | ID type: ID_IPV4_ADDR (0x1) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: ignoring supplied 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' value 5:ISAKMP_NEXT_ID | next payload chain: setting previous 'ISAKMP Key Exchange Payload'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 02 64 | emitting length of ISAKMP Identification Payload (IPsec DOI): 12 | ***emit ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | next payload chain: setting previous 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' to current ISAKMP Identification Payload (IPsec DOI) (5:ISAKMP_NEXT_ID) | next payload chain: saving location 'ISAKMP Identification Payload (IPsec DOI)'.'next payload type' in 'reply packet' | emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI) | client network c0 00 02 00 | emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI) | client mask ff ff ff 00 | emitting length of ISAKMP Identification Payload (IPsec DOI): 16 | outI1 HASH(1): | 54 ac 92 44 2d c1 23 a9 fc 40 87 4c 05 98 72 05 | c9 17 d1 80 0f 1a f6 9d dd f5 51 cd da 7a 92 d3 | emitting 4 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 476 | sending 476 bytes for reply packet from quick_outI1 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #2) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 20 01 e4 bc de 29 00 00 01 dc 8c 8a d2 1d | bd ae 8b 93 07 b7 97 45 33 75 50 83 ff 18 67 a2 | 70 dd 61 29 e3 fd 94 5f 59 47 a4 10 42 31 fb c9 | 95 93 d4 c0 a0 e7 07 1d 4e f9 9c d1 6c 25 aa fa | ab 10 70 c5 e2 5f c7 bd 6e 64 d7 b5 46 9d 6f 0f | 6b 7b f7 c2 dd bd fe b5 26 2f 3e cd 7c 58 c1 b2 | 0d 97 19 ea e5 96 0f 67 dd 8a 84 ca 44 22 29 df | 65 46 03 28 a9 2c cd bd da a1 f7 3a 8f c5 f0 2c | ac 14 8e d5 9e f8 17 22 77 2e 73 b1 12 e4 36 4a | e2 06 b0 08 5a 40 ec 80 32 03 0d 2e dd f3 69 b8 | d0 14 d8 e4 68 92 a8 bf c4 95 1c b6 62 52 d2 a9 | 41 21 a2 5d ac c9 c2 57 66 32 e9 69 5a 87 31 1f | 7b f6 18 ee fc 12 24 94 7d b4 7a f2 94 62 f0 cd | 96 53 f9 9b e7 ef 04 ca 41 f7 d4 13 e4 5e 88 b0 | 52 a7 51 d0 2c e8 08 d8 ee af 2c 0e 00 74 fa 29 | aa 11 f1 78 e7 c8 51 cf c9 26 d8 33 04 30 84 4f | 31 14 1d c5 60 08 45 51 21 cd 02 3a ba ef ef e2 | 6f aa 61 b8 49 95 d0 f4 0d c3 62 5e 65 b6 16 2b | c2 3c 36 e4 8e 24 c5 d7 16 7b 98 a2 03 13 f6 8d | 01 c9 59 70 17 8b e4 4b 90 77 3d fb b2 25 58 f0 | 38 dd cc 88 b1 1a 2a fc a2 a8 85 3c d1 55 04 ff | 3b 81 06 34 86 ce 60 e7 e7 46 d8 e1 9f ee a3 07 | 12 ce d4 c1 41 49 2a 1c 39 3d 53 3c 81 91 76 17 | 1c dc dc 0b 72 a0 26 31 a0 76 18 ad a7 61 15 09 | ee 60 ad 9a 1b 1b c6 78 42 ef 45 22 8c a1 c3 a2 | e5 f7 31 e5 6d 0e 86 38 38 9d 7c bc 75 cf aa 4f | 81 bf fc 0b 69 49 63 90 63 41 32 69 72 31 af e0 | e9 02 6d 8f 2c 52 c3 7c 13 4d d1 a8 f5 8a dd 8e | 31 4f a3 3d 5f e6 f6 0e 51 72 b3 35 | state #2 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x559704074bf0 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x55970409c850 | event_schedule: new EVENT_RETRANSMIT-pe@0x55970409c850 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #2 | libevent_malloc: new ptr-libevent@0x5597040bad30 size 128 | #2 STATE_QUICK_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50029.328676 | resume sending helper answer for #2 suppresed complete_v1_state_transition() | #2 spent 0.472 milliseconds in resume sending helper answer | stop processing: state #2 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7efc84007fa0 | spent 0.00294 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 444 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 20 01 e4 bc de 29 00 00 01 bc a9 bc 94 df | b4 05 72 3c d4 79 12 3b 18 91 c9 36 37 c0 bf 93 | 2e 2b 45 5e 4d 6e 4c fd 4c 76 86 f6 b6 1e f8 c8 | 21 18 36 4a e6 c0 db 8b 65 d1 96 3b 90 3b 08 63 | ed 55 08 78 50 d9 10 a7 9c ee 3e 8b f0 4d 81 97 | 43 dd ba ce 87 09 eb 11 70 a2 5e 47 c0 36 8a 18 | 63 b8 9c 69 a5 24 e8 02 2f 11 62 10 1e f9 09 ec | 46 5f ea e0 62 68 ce 64 07 b6 2b 6b 60 e6 82 65 | c9 35 7d 7a 06 0d 53 82 48 b2 dc 14 36 2d 4b be | 49 3b e2 df a4 1e 8d 91 c4 f5 c1 ea e2 c7 de a0 | 68 87 cb 3f 1c e3 fb 61 57 13 ad c9 c4 a0 98 fb | eb 47 c9 9e cc ce 18 84 f1 c0 0c 44 c4 e7 ac 96 | 32 4e 97 51 f9 56 b8 ed 26 dd 98 97 67 c1 6e 42 | aa ce 6a e1 ca 01 2e 19 61 b8 8a 3c 0e e3 06 04 | 9a 13 e4 7e e7 df 8d 0c 1c db c9 b4 4a d8 2c e9 | 22 f4 e8 f9 d1 0c 7a 3a cb b8 6c 5e eb b9 3f c6 | 6e 19 d2 58 44 72 32 a5 40 7b f2 91 74 aa 15 59 | ad 73 44 6f 3b 89 96 55 76 f3 dc d5 5a 91 f8 f3 | d8 de 0c 4f 40 09 60 d8 18 99 cf 98 0e 98 e4 55 | b2 04 d6 da d2 24 ce dc 49 4e 4d 3b 06 02 a6 cc | 66 96 04 42 63 04 51 82 20 72 f6 4b a5 02 80 f6 | 45 14 94 87 81 ee 51 de 10 d0 8c b3 53 ea 31 de | c1 4d 78 dd 27 85 94 76 1c f6 c1 fd 73 c5 62 c0 | 39 21 fe 8e d6 12 04 dc e7 50 86 aa 7f fc 56 72 | 48 d8 fa 9d 38 9f cf 59 b9 cc 82 f8 ba bf 42 ab | c5 3e be bd 95 a2 85 f8 d4 94 a5 05 41 e3 cf d9 | 81 4f 14 d0 3e d5 2c a6 da 0a 13 64 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3837582889 (0xe4bcde29) | length: 444 (0x1bc) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32) | State DB: found IKEv1 state #2 in QUICK_I1 (find_state_ikev1) | start processing: state #2 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1609) | #2 is idle | #2 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502 opt: 0x200030 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_SA (0x1) | length: 36 (0x24) | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402 opt: 0x200030 | ***parse ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_NONCE (0xa) | length: 56 (0x38) | DOI: ISAKMP_DOI_IPSEC (0x1) | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400 opt: 0x200030 | ***parse ISAKMP Nonce Payload: | next payload type: ISAKMP_NEXT_KE (0x4) | length: 36 (0x24) | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Key Exchange Payload: | next payload type: ISAKMP_NEXT_ID (0x5) | length: 260 (0x104) | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_ID (0x5) | length: 12 (0xc) | ID type: ID_IPV4_ADDR (0x1) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 64 | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0 opt: 0x200030 | ***parse ISAKMP Identification Payload (IPsec DOI): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | ID type: ID_IPV4_ADDR_SUBNET (0x4) | Protocol ID: 0 (0x0) | port: 0 (0x0) | obj: c0 00 02 00 ff ff ff 00 | quick_inR1_outI2 HASH(2): | 4d 9e 3b 9f 35 1e 28 c8 bc 8b de 1f 2c c2 5e 3c | 19 33 1e 65 8d ce 03 eb f5 85 0e 71 65 c5 65 70 | received 'quick_inR1_outI2' message HASH(2) data ok | ****parse IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ****parse ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 44 (0x2c) | proposal number: 0 (0x0) | protocol ID: PROTO_IPSEC_ESP (0x3) | SPI size: 4 (0x4) | number of transforms: 1 (0x1) | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI | SPI ce 54 5c 1a | *****parse ISAKMP Transform Payload (ESP): | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 32 (0x20) | ESP transform number: 0 (0x0) | ESP transform ID: ESP_AES (0xc) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+GROUP_DESCRIPTION (0x8003) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+ENCAPSULATION_MODE (0x8004) | length/value: 1 (0x1) | [1 is ENCAPSULATION_MODE_TUNNEL] | NAT-T non-encap: Installing IPsec SA without ENCAP, st->hidden_variables.st_nat_traversal is none | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_TYPE (0x8001) | length/value: 1 (0x1) | [1 is SA_LIFE_TYPE_SECONDS] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+SA_LIFE_DURATION (variable length) (0x8002) | length/value: 28800 (0x7080) | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+AUTH_ALGORITHM (0x8005) | length/value: 2 (0x2) | [2 is AUTH_ALGORITHM_HMAC_SHA1] | ******parse ISAKMP IPsec DOI attribute: | af+type: AF+KEY_LENGTH (0x8006) | length/value: 128 (0x80) | ESP IPsec Transform verified unconditionally; no alg_info to check against | started looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org->C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org of kind PKK_PSK | actually looking for secret for C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org->C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org of kind PKK_PSK | line 0: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org) to type PKK_RSA | line 1: key type PKK_PSK(C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org) to type PKK_RSA | concluding with best_match=000 best=(nil) (lineno=-1) | no PreShared Key Found | adding quick outI2 DH work-order 4 for state #2 | state #2 requesting EVENT_RETRANSMIT to be deleted | #2 STATE_QUICK_I1: retransmits: cleared | libevent_free: release ptr-libevent@0x5597040bad30 | free_event_entry: release EVENT_RETRANSMIT-pe@0x55970409c850 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x55970409c850 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 | libevent_malloc: new ptr-libevent@0x5597040bad30 size 128 | complete v1 state transition with STF_SUSPEND | [RE]START processing: state #2 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2624) | suspending state #2 and saving MD | #2 is busy; has a suspended MD | crypto helper 1 resuming | crypto helper 1 starting work-order 4 for state #2 | #2 spent 0.186 milliseconds in process_packet_tail() | crypto helper 1 doing compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 4 | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #2 connection "north-east" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.413 milliseconds in comm_handle_cb() reading and processing packet | crypto helper 1 finished compute dh (V1 Phase 2 PFS) (quick outI2 DH); request ID 4 time elapsed 0.000546 seconds | (#2) spent 0.547 milliseconds in crypto helper computing work-order 4: quick outI2 DH (pcr) | crypto helper 1 sending results from work-order 4 for state #2 to event queue | scheduling resume sending helper answer for #2 | libevent_malloc: new ptr-libevent@0x7efc78001ef0 size 128 | crypto helper 1 waiting (nothing to do) | processing resume sending helper answer for #2 | start processing: state #2 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 1 replies to request ID 4 | calling continuation function 0x559703870630 | quick_inR1_outI2_continue for #2: calculated ke+nonce, calculating DH | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_QUICK (0x20) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 3837582889 (0xe4bcde29) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 64 | our client is 192.0.2.100/32 | our client protocol/port is 0/0 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID address | ID address c0 00 02 00 | parsing 4 raw bytes of ISAKMP Identification Payload (IPsec DOI) into ID mask | ID mask ff ff ff 00 | peer client is subnet 192.0.2.0/24 | peer client protocol/port is 0/0 | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'reply packet' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | quick_inR1_outI2 HASH(3): | a8 3a 73 79 83 f0 0d f6 25 a3 a5 2c 8b a9 35 cf | c6 e7 83 a2 f5 53 8e d9 69 e3 b5 08 ee d9 75 5d | compute_proto_keymat: needed_len (after ESP enc)=16 | compute_proto_keymat: needed_len (after ESP auth)=36 | install_ipsec_sa() for #2: inbound and outbound | could_route called for north-east (kind=CK_PERMANENT) | FOR_EACH_CONNECTION_... in route_owner | conn north-east mark 0/00000000, 0/00000000 vs | conn north-east mark 0/00000000, 0/00000000 | route owner of "north-east" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'north-east' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.ce545c1a@192.1.2.23 included non-error error | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'north-east' not available on interface eth1 | netlink: enabling tunnel mode | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.136faf63@192.1.3.33 included non-error error | priority calculation of connection "north-east" is 0xfdfe7 | add inbound eroute 192.0.2.0/24:0 --0-> 192.0.2.100/32:0 => tun.10000@192.1.3.33 (raw_eroute) | IPsec Sa SPD priority set to 1040359 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #2: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn north-east mark 0/00000000, 0/00000000 vs | conn north-east mark 0/00000000, 0/00000000 | route owner of "north-east" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: north-east (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #2 | priority calculation of connection "north-east" is 0xfdfe7 | eroute_connection add eroute 192.0.2.100/32:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23 (raw_eroute) | IPsec Sa SPD priority set to 1040359 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' | popen cmd is 1373 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east' PLUTO_I: | cmd( 80):NTERFACE='eth1' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.33' PLUTO_MY_ID=': | cmd( 160):C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.l: | cmd( 240):ibreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/3: | cmd( 320):2' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUT: | cmd( 400):O_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' P: | cmd( 480):LUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, : | cmd( 560):OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan: | cmd( 640):.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_P: | cmd( 720):EER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUT: | cmd( 800):O_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+EN: | cmd( 880):CRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ES: | cmd( 960):N_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0: | cmd(1040): PLUTO_USERNAME='xnorth' PLUTO_MY_SOURCEIP='192.0.2.100' PLUTO_IS_PEER_CISCO='0': | cmd(1120): PLUTO_PEER_DNS_INFO='1.2.3.4 5.6.7.8' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANN: | cmd(1200):ER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI_IFAC: | cmd(1280):E='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xce545c1a SPI_OUT=0x136faf63 ipsec: | cmd(1360): _updown 2>&1: "north-east" #2: up-client output: updating resolvconf | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_ | popen cmd is 1378 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east' PL: | cmd( 80):UTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.33' PLUTO_MY: | cmd( 160):_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.test: | cmd( 240):ing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.: | cmd( 320):100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255': | cmd( 400): PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='E: | cmd( 480):SP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libres: | cmd( 560):wan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libr: | cmd( 640):eswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PL: | cmd( 720):UTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0': | cmd( 800): PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSAS: | cmd( 880):IG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALL: | cmd( 960):OW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAI: | cmd(1040):LED=0 PLUTO_USERNAME='xnorth' PLUTO_MY_SOURCEIP='192.0.2.100' PLUTO_IS_PEER_CISC: | cmd(1120):O='0' PLUTO_PEER_DNS_INFO='1.2.3.4 5.6.7.8' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER: | cmd(1200):_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI: | cmd(1280):_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xce545c1a SPI_OUT=0x136faf63 : | cmd(1360):ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERM | popen cmd is 1376 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east' PLUT: | cmd( 80):O_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.33' PLUTO_MY_I: | cmd( 160):D='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testin: | cmd( 240):g.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.10: | cmd( 320):0/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' P: | cmd( 400):LUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP: | cmd( 480):' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswa: | cmd( 560):n, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libres: | cmd( 640):wan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUT: | cmd( 720):O_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' P: | cmd( 800):LUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG: | cmd( 880):+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW: | cmd( 960):+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILE: | cmd(1040):D=0 PLUTO_USERNAME='xnorth' PLUTO_MY_SOURCEIP='192.0.2.100' PLUTO_IS_PEER_CISCO=: | cmd(1120):'0' PLUTO_PEER_DNS_INFO='1.2.3.4 5.6.7.8' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_B: | cmd(1200):ANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED='0' VTI_I: | cmd(1280):FACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xce545c1a SPI_OUT=0x136faf63 ip: | cmd(1360):sec _updown 2>&1: "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. "north-east" #2: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "north-east", setting eroute_owner {spd=0x5597040983c0,sr=0x5597040983c0} to #2 (was #0) (newest_ipsec_sa=#0) | #1 spent 1.22 milliseconds in install_ipsec_sa() | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 76 | inR1_outI2: instance north-east[0], setting IKEv1 newest_ipsec_sa to #2 (was #0) (spd.eroute=#2) cloned from #1 | DPD: dpd_init() called on IPsec SA | DPD: Peer does not support Dead Peer Detection | complete v1 state transition with STF_OK | [RE]START processing: state #2 connection "north-east" from 192.1.2.23:500 (in complete_v1_state_transition() at ikev1.c:2649) | #2 is idle | doing_xauth:no, t_xauth_client_done:yes | IKEv1: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2 | child state #2: QUICK_I1(established CHILD SA) => QUICK_I2(established CHILD SA) | event_already_set, deleting event | state #2 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x5597040bad30 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x55970409c850 | sending reply packet to 192.1.2.23:500 (from 192.1.3.33:500) | sending 76 bytes for STATE_QUICK_I1 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #2) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 20 01 e4 bc de 29 00 00 00 4c a6 82 02 f6 | f7 54 d6 61 d7 86 49 0c e9 17 d1 cc dd 5e 40 e4 | 98 bc d7 fb 3d 76 59 86 61 c7 66 62 21 3f ee 92 | 7a e7 f7 35 13 23 2d fe 79 4b cf 47 | !event_already_set at reschedule | event_schedule: new EVENT_SA_REPLACE-pe@0x55970409c850 | inserting event EVENT_SA_REPLACE, timeout in 28048 seconds for #2 | libevent_malloc: new ptr-libevent@0x5597040bad30 size 128 | pstats #2 ikev1.ipsec established | NAT-T: encaps is 'auto' "north-east" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xce545c1a <0x136faf63 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive username=xnorth} | modecfg pull: noquirk policy:pull modecfg-client | phase 1 is done, looking for phase 2 to unpend | close_any(fd@25) (in release_whack() at state.c:654) | resume sending helper answer for #2 suppresed complete_v1_state_transition() | #2 spent 1.51 milliseconds in resume sending helper answer | stop processing: state #2 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7efc78001ef0 | kernel_process_msg_cb process netlink message | netlink_get: XFRM_MSG_DELPOLICY message | xfrm netlink address change RTM_NEWADDR msg len 76 | XFRM RTM_NEWADDR 192.0.2.100 IFA_LOCAL | FOR_EACH_STATE_... in record_newaddr (for_each_state) | start processing: state #2 connection "north-east" from 192.1.2.23:500 (in for_each_state() at state.c:1572) | stop processing: state #2 connection "north-east" from 192.1.2.23:500 (in for_each_state() at state.c:1574) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in for_each_state() at state.c:1572) | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in for_each_state() at state.c:1574) | IKEv2 received address RTM_NEWADDR type 3 | IKEv2 received address RTM_NEWADDR type 8 | IKEv2 received address RTM_NEWADDR type 6 | netlink_get: XFRM_MSG_EXPIRE message | netlink_get: XFRM_MSG_EXPIRE message | spent 0.0385 milliseconds in kernel message | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00408 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00272 milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00555 milliseconds in signal handler PLUTO_SIGCHLD | accept(whackctlfd, (struct sockaddr *)&whackaddr, &whackaddrlen) -> fd@16 (in whack_handle() at rcv_whack.c:721) | FOR_EACH_STATE_... in show_traffic_status (sort_states) | FOR_EACH_STATE_... in sort_states | get_sa_info esp.136faf63@192.1.3.33 | get_sa_info esp.ce545c1a@192.1.2.23 | close_any(fd@16) (in whack_process() at rcv_whack.c:700) | spent 0.0646 milliseconds in whack | spent 0.00295 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 05 01 46 7f 07 e1 00 00 00 5c c0 2c d0 a3 | 79 b8 f0 cb 30 b9 fa e2 95 48 1c da fd 1b 6c f3 | 0c de 96 68 bc b3 3a 41 24 3f 26 44 ed e3 a8 23 | 6b ec c6 c6 19 f2 e1 1d 14 40 60 1d 2f 0f a8 d6 | 6a 15 3f 55 4e 13 1b e0 14 d7 b6 76 | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1182730209 (0x467f07e1) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #2; msgid=00000000 st_msgid=e4bcde29 st_msgid_phase15=00000000 | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1455) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 16 (0x10) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | removing 12 bytes of padding | informational HASH(1): | f4 ca e4 16 5d 56 2c a3 02 97 55 4f 7b af 50 0d | be 88 19 ff b3 85 0b d6 dc dd e1 48 6d 55 e7 d9 | received 'informational' message HASH(1) data ok | parsing 4 raw bytes of ISAKMP Delete Payload into SPI | SPI ce 54 5c 1a | FOR_EACH_STATE_... in find_phase2_state_to_delete | start processing: connection "north-east" (BACKGROUND) (in accept_delete() at ikev1_main.c:2506) "north-east" #1: received Delete SA payload: replace IPsec State #2 now | state #2 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x5597040bad30 | free_event_entry: release EVENT_SA_REPLACE-pe@0x55970409c850 | event_schedule: new EVENT_SA_REPLACE-pe@0x55970409c850 | inserting event EVENT_SA_REPLACE, timeout in 0 seconds for #2 | libevent_malloc: new ptr-libevent@0x5597040bad30 size 128 | stop processing: connection "north-east" (BACKGROUND) (in accept_delete() at ikev1_main.c:2550) | del: | complete v1 state transition with STF_IGNORE | #1 spent 0.00341 milliseconds in process_packet_tail() | stop processing: from 192.1.2.23:500 (BACKGROUND) (in process_md() at demux.c:380) | stop processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.193 milliseconds in comm_handle_cb() reading and processing packet | timer_event_cb: processing event@0x55970409c850 | handling event EVENT_SA_REPLACE for child state #2 | start processing: state #2 connection "north-east" from 192.1.2.23:500 (in timer_event_cb() at timer.c:250) | picked newest_ipsec_sa #2 for #2 | replacing stale IPsec SA | dup_any(fd@-1) -> fd@-1 (in ipsecdoi_replace() at ipsec_doi.c:351) | FOR_EACH_STATE_... in find_phase1_state | creating state object #3 at 0x5597040b3cf0 | State DB: adding IKEv1 state #3 in UNDEFINED | pstats #3 ikev1.ipsec started | duplicating state object #1 "north-east" as #3 for IPSEC SA | #3 setting local endpoint to 192.1.3.33:500 from #1.st_localport (in duplicate_state() at state.c:1481) | suspend processing: state #2 connection "north-east" from 192.1.2.23:500 (in quick_outI1() at ikev1_quick.c:683) | start processing: state #3 connection "north-east" from 192.1.2.23:500 (in quick_outI1() at ikev1_quick.c:683) | child state #3: UNDEFINED(ignore) => QUICK_I1(established CHILD SA) "north-east" #3: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO to replace #2 {using isakmp#1 msgid:0ff14016 proposal=defaults pfsgroup=MODP2048} | adding quick_outI1 KE work-order 5 for state #3 | event_schedule: new EVENT_CRYPTO_TIMEOUT-pe@0x7efc840041c0 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: new ptr-libevent@0x7efc78001ef0 size 128 | stop processing: state #3 connection "north-east" from 192.1.2.23:500 (in quick_outI1() at ikev1_quick.c:762) | crypto helper 4 resuming | resume processing: state #2 connection "north-east" from 192.1.2.23:500 (in quick_outI1() at ikev1_quick.c:762) | event_schedule: new EVENT_SA_EXPIRE-pe@0x55970409c790 | inserting event EVENT_SA_EXPIRE, timeout in 0 seconds for #2 | libevent_malloc: new ptr-libevent@0x5597040b85a0 size 128 | libevent_free: release ptr-libevent@0x5597040bad30 | free_event_entry: release EVENT_SA_REPLACE-pe@0x55970409c850 | #2 spent 0.11 milliseconds in timer_event_cb() EVENT_SA_REPLACE | stop processing: state #2 connection "north-east" from 192.1.2.23:500 (in timer_event_cb() at timer.c:557) | timer_event_cb: processing event@0x55970409c790 | handling event EVENT_SA_EXPIRE for child state #2 | start processing: state #2 connection "north-east" from 192.1.2.23:500 (in timer_event_cb() at timer.c:250) | picked newest_ipsec_sa #2 for #2 | un-established partial CHILD SA timeout (SA expired) | pstats #2 ikev1.ipsec re-failed exchange-timeout | pstats #2 ikev1.ipsec deleted completed | [RE]START processing: state #2 connection "north-east" from 192.1.2.23:500 (in delete_state() at state.c:879) "north-east" #2: deleting state (STATE_QUICK_I2) aged 9.914s and sending notification | child state #2: QUICK_I2(established CHILD SA) => delete | get_sa_info esp.ce545c1a@192.1.2.23 | get_sa_info esp.136faf63@192.1.3.33 "north-east" #2: ESP traffic information: in=336B out=336B XAUTHuser=xnorth | #2 send IKEv1 delete notification for STATE_QUICK_I2 | FOR_EACH_STATE_... in find_phase1_state | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1973938878 (0x75a7eabe) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 3 (0x3) | SPI size: 4 (0x4) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload | delete payload 13 6f af 63 | emitting length of ISAKMP Delete Payload: 16 | send delete HASH(1): | 80 ee f1 c2 80 17 97 c7 43 b6 76 fa 5d 2e 3d 86 | 6b b6 79 6b d5 4b a8 66 16 1e e6 ef 0c ea c2 a9 | emitting 12 zero bytes of encryption padding into ISAKMP Message | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 05 01 75 a7 ea be 00 00 00 5c f9 1b ce 2a | 7c 5e 27 7a bf 8c 50 dc 49 c7 49 ea 41 1f 44 82 | 03 10 56 44 12 93 10 1b 00 5c c8 96 92 76 0d 7d | 76 92 4f be 32 34 3f 2c ed 26 d5 c6 e8 92 0b d2 | 44 de 86 22 68 dc 54 32 e7 1d 3b 0d | running updown command "ipsec _updown" for verb down | command executing down-client | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east' PLUTO_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1569051382' PLUTO_CONN_POLICY='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW+ESN_NO' PLUTO_CONN_KIND=' | popen cmd is 1384 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-east' PLUTO: | cmd( 80):_INTERFACE='eth1' PLUTO_NEXT_HOP='192.1.3.254' PLUTO_ME='192.1.3.33' PLUTO_MY_ID: | cmd( 160):='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=north.testing: | cmd( 240):.libreswan.org, E=user-north@testing.libreswan.org' PLUTO_MY_CLIENT='192.0.2.100: | cmd( 320):/32' PLUTO_MY_CLIENT_NET='192.0.2.100' PLUTO_MY_CLIENT_MASK='255.255.255.255' PL: | cmd( 400):UTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP': | cmd( 480): PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='C=CA, ST=Ontario, L=Toronto, O=Libreswan: | cmd( 560):, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libresw: | cmd( 640):an.org' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO: | cmd( 720):_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PL: | cmd( 800):UTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1569051382' PLUTO_CONN_POLICY: | cmd( 880):='RSASIG+ENCRYPT+TUNNEL+PFS+UP+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FR: | cmd( 960):AG_ALLOW+ESN_NO' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAU: | cmd(1040):TH_FAILED=0 PLUTO_USERNAME='xnorth' PLUTO_MY_SOURCEIP='192.0.2.100' PLUTO_IS_PEE: | cmd(1120):R_CISCO='0' PLUTO_PEER_DNS_INFO='1.2.3.4 5.6.7.8' PLUTO_PEER_DOMAIN_INFO='' PLUT: | cmd(1200):O_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='1' PLUTO_NM_CONFIGURED=': | cmd(1280):0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xce545c1a SPI_OUT=0x136: | cmd(1360):faf63 ipsec _updown 2>&1: | crypto helper 4 starting work-order 5 for state #3 | crypto helper 4 doing build KE and nonce (quick_outI1 KE); request ID 5 | crypto helper 4 finished build KE and nonce (quick_outI1 KE); request ID 5 time elapsed 0.000722 seconds | (#3) spent 0.706 milliseconds in crypto helper computing work-order 5: quick_outI1 KE (pcr) | crypto helper 4 sending results from work-order 5 for state #3 to event queue | scheduling resume sending helper answer for #3 | libevent_malloc: new ptr-libevent@0x7efc7c006900 size 128 | crypto helper 4 waiting (nothing to do) "north-east" #2: down-client output: restoring resolvconf | shunt_eroute() called for connection 'north-east' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.2.100/32:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.2.100/32:0 dest 192.0.2.0/24:0 | priority calculation of connection "north-east" is 0xfdfe7 | IPsec Sa SPD priority set to 1040359 | delete esp.ce545c1a@192.1.2.23 | netlink response for Del SA esp.ce545c1a@192.1.2.23 included non-error error | priority calculation of connection "north-east" is 0xfdfe7 | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.2.100/32:0 => unk255.10000@192.1.3.33 (raw_eroute) | raw_eroute result=success | delete esp.136faf63@192.1.3.33 | netlink response for Del SA esp.136faf63@192.1.3.33 included non-error error | in connection_discard for connection north-east | State DB: deleting IKEv1 state #2 in QUICK_I2 | child state #2: QUICK_I2(established CHILD SA) => UNDEFINED(ignore) | stop processing: state #2 from 192.1.2.23:500 (in delete_state() at state.c:1143) | libevent_free: release ptr-libevent@0x5597040b85a0 | free_event_entry: release EVENT_SA_EXPIRE-pe@0x55970409c790 | in statetime_stop() and could not find #2 | processing: STOP state #0 (in timer_event_cb() at timer.c:557) | spent 0.00234 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | *received 92 bytes from 192.1.2.23:500 on eth1 (192.1.3.33:500) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 05 01 51 0f ea fd 00 00 00 5c 46 c7 68 7f | 09 31 e1 af ce 9e ea a9 e6 94 58 34 b3 97 73 72 | d8 4a 5c a0 a4 56 be 81 79 e7 14 f2 8b a4 c8 42 | de f5 22 07 2f cc aa 6b 2e 1e 62 9e 9b 8f 96 73 | a2 51 6f b4 d2 0b 93 d0 9d 98 f5 7f | start processing: from 192.1.2.23:500 (in process_md() at demux.c:378) | **parse ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_HASH (0x8) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 1359997693 (0x510feafd) | length: 92 (0x5c) | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5) | peer and cookies match on #3; msgid=00000000 st_msgid=0ff14016 st_msgid_phase15=00000000 | peer and cookies match on #1; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000 | p15 state object #1 found, in STATE_MAIN_I4 | State DB: found IKEv1 state #1 in MAIN_I4 (find_v1_info_state) | start processing: state #1 connection "north-east" from 192.1.2.23:500 (in process_v1_packet() at ikev1.c:1455) | #1 is idle | #1 idle | received encrypted packet from 192.1.2.23:500 | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100 opt: 0x0 | ***parse ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_D (0xc) | length: 36 (0x24) | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0 opt: 0x0 | ***parse ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | length: 28 (0x1c) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 1 (0x1) | SPI size: 16 (0x10) | number of SPIs: 1 (0x1) | informational HASH(1): | f0 9d 12 cd 83 b3 8c 44 36 d6 67 e3 3b 9a d9 18 | 2b 07 d0 a5 89 13 d2 f9 85 50 61 99 d8 12 a7 30 | received 'informational' message HASH(1) data ok | parsing 8 raw bytes of ISAKMP Delete Payload into iCookie | iCookie d7 c3 67 fd 1f db d7 0a | parsing 8 raw bytes of ISAKMP Delete Payload into rCookie | rCookie 8d 23 19 4a f7 36 c9 8f | State DB: found IKEv1 state #1 in MAIN_I4 (find_state_ikev1) | del: "north-east" #1: received Delete SA payload: self-deleting ISAKMP State #1 | pstats #1 ikev1.isakmp deleted completed | [RE]START processing: state #1 connection "north-east" from 192.1.2.23:500 (in delete_state() at state.c:879) "north-east" #1: deleting state (STATE_MAIN_I4) aged 10.222s and sending notification | parent state #1: MAIN_I4(established IKE SA) => delete | #1 send IKEv1 delete notification for STATE_MAIN_I4 | **emit ISAKMP Message: | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_INFO (0x5) | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1) | Message ID: 2503381568 (0x95369240) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit ISAKMP Hash Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Hash Payload (8:ISAKMP_NEXT_HASH) | next payload chain: saving location 'ISAKMP Hash Payload'.'next payload type' in 'delete msg' | emitting 32 zero bytes of HASH DATA into ISAKMP Hash Payload | emitting length of ISAKMP Hash Payload: 36 | ***emit ISAKMP Delete Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | DOI: ISAKMP_DOI_IPSEC (0x1) | protocol ID: 1 (0x1) | SPI size: 16 (0x10) | number of SPIs: 1 (0x1) | next payload chain: setting previous 'ISAKMP Hash Payload'.'next payload type' to current ISAKMP Delete Payload (12:ISAKMP_NEXT_D) | next payload chain: saving location 'ISAKMP Delete Payload'.'next payload type' in 'delete msg' | emitting 8 raw bytes of initiator SPI into ISAKMP Delete Payload | initiator SPI d7 c3 67 fd 1f db d7 0a | emitting 8 raw bytes of responder SPI into ISAKMP Delete Payload | responder SPI 8d 23 19 4a f7 36 c9 8f | emitting length of ISAKMP Delete Payload: 28 | send delete HASH(1): | dc ce 99 7f 6f 06 a7 a3 d1 f5 10 ac c4 01 c7 ae | 48 5f 22 bb 7f 74 bd b8 02 4e e4 e2 77 e8 66 dc | no IKEv1 message padding required | emitting length of ISAKMP Message: 92 | sending 92 bytes for delete notify through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #1) | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 05 01 95 36 92 40 00 00 00 5c fc b6 91 4a | 8b 59 ab e6 1e 1c 16 8b cf 4c e3 7d e2 96 bc ab | 15 15 36 7d 00 c0 ad 77 be b2 8f ef fa 68 c6 05 | 01 99 a7 c1 08 62 bc 06 6a 96 47 54 99 76 d3 d1 | 96 0d 20 35 1d 22 55 33 07 fe ff 3b | state #1 requesting EVENT_SA_REPLACE to be deleted | libevent_free: release ptr-libevent@0x55970409c1d0 | free_event_entry: release EVENT_SA_REPLACE-pe@0x55970409e7f0 "north-east" #1: reschedule pending child #3 STATE_QUICK_I1 of connection "north-east" - the parent is going away | state #3 requesting EVENT_CRYPTO_TIMEOUT to be deleted | libevent_free: release ptr-libevent@0x7efc78001ef0 | free_event_entry: release EVENT_CRYPTO_TIMEOUT-pe@0x7efc840041c0 | event_schedule: new EVENT_SA_REPLACE-pe@0x55970409e7f0 | inserting event EVENT_SA_REPLACE, timeout in 0 seconds for #3 | libevent_malloc: new ptr-libevent@0x7efc78001ef0 size 128 | State DB: IKEv1 state not found (flush_incomplete_children) | picked newest_isakmp_sa #0 for #1 "north-east" #1: deleting IKE SA for connection 'north-east' but connection is supposed to remain up; schedule EVENT_REVIVE_CONNS | add revival: connection 'north-east' added to the list and scheduled for 0 seconds | global one-shot timer EVENT_REVIVE_CONNS scheduled in 0 seconds | in connection_discard for connection north-east | State DB: deleting IKEv1 state #1 in MAIN_I4 | parent state #1: MAIN_I4(established IKE SA) => UNDEFINED(ignore) | unreference key: 0x5597040b7690 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 2-- | stop processing: state #1 from 192.1.2.23:500 (in delete_state() at state.c:1143) | unreference key: 0x5597040b7690 C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org cnt 1-- | unreference key: 0x5597040a5570 user-east@testing.libreswan.org cnt 1-- | unreference key: 0x5597040a1430 @east.testing.libreswan.org cnt 1-- | unreference key: 0x5597040a9df0 east@testing.libreswan.org cnt 1-- | unreference key: 0x559704074950 192.1.2.23 cnt 1-- | in statetime_start() with no state | complete v1 state transition with STF_IGNORE | stop processing: from 192.1.2.23:500 (in process_md() at demux.c:380) | processing: STOP state #0 (in process_md() at demux.c:382) | processing: STOP connection NULL (in process_md() at demux.c:383) | spent 0.531 milliseconds in comm_handle_cb() reading and processing packet | processing resume sending helper answer for #3 | start processing: state #3 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:797) | crypto helper 4 replies to request ID 5 | calling continuation function 0x559703870630 | work-order 5 state #3 crypto result suppressed | resume sending helper answer for #3 suppresed complete_v1_state_transition() | #3 spent 0.0188 milliseconds in resume sending helper answer | stop processing: state #3 connection "north-east" from 192.1.2.23:500 (in resume_handler() at server.c:833) | libevent_free: release ptr-libevent@0x7efc7c006900 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00462 milliseconds in signal handler PLUTO_SIGCHLD recvmsg: received truncated IKE packet (MSG_TRUNC) | **parse ISAKMP Message (raw): | initiator cookie: | d7 c3 67 fd 1f db d7 0a | responder cookie: | 8d 23 19 4a f7 36 c9 8f | next payload type: 8 (0x8) | ISAKMP version: 16 (0x10) | exchange type: 5 (0x5) | flags: 1 (0x1) | Message ID: 2503381568 (0x95369240) | length: 92 (0x5c) | State DB: found IKEv1 state #3 in QUICK_I1 (find_likely_sender) | MSG_ERRQUEUE packet matches IKEv1 SA #3 | rejected packet: | d7 c3 67 fd 1f db d7 0a 8d 23 19 4a f7 36 c9 8f | 08 10 05 01 95 36 92 40 00 00 00 5c fc b6 91 4a | 8b 59 ab e6 1e 1c 16 8b cf 4c e3 7d e2 96 bc ab | 15 15 36 7d 00 c0 ad 77 | control: | 1c 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | 18 25 00 00 00 00 00 00 c0 01 03 21 97 55 00 00 | 30 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 | 6f 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 | 02 00 00 00 c0 01 02 17 00 00 00 00 00 00 00 00 | name: | 02 00 01 f4 c0 01 02 17 00 00 00 00 00 00 00 00 "north-east" #3: ERROR: asynchronous network error report on eth1 (192.1.3.33:500) for message to 192.1.2.23 port 500, complainant 192.1.2.23: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)] | spent 0.0698 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | timer_event_cb: processing event@0x55970409e7f0 | handling event EVENT_SA_REPLACE for child state #3 | start processing: state #3 connection "north-east" from 192.1.2.23:500 (in timer_event_cb() at timer.c:250) | picked newest_ipsec_sa #0 for #3 | replacing stale IPsec SA | dup_any(fd@-1) -> fd@-1 (in ipsecdoi_replace() at ipsec_doi.c:351) | FOR_EACH_STATE_... in find_phase1_state | creating state object #4 at 0x5597040a2b70 | State DB: adding IKEv1 state #4 in UNDEFINED | pstats #4 ikev1.isakmp started | suspend processing: state #3 connection "north-east" from 192.1.2.23:500 (in main_outI1() at ikev1_main.c:118) | start processing: state #4 connection "north-east" from 192.1.2.23:500 (in main_outI1() at ikev1_main.c:118) | parent state #4: UNDEFINED(ignore) => MAIN_I1(half-open IKE SA) | dup_any(fd@-1) -> fd@-1 (in main_outI1() at ikev1_main.c:123) | Queuing pending IPsec SA negotiating with 192.1.2.23 "north-east" IKE SA #4 "north-east" "north-east" #4: initiating Main Mode | **emit ISAKMP Message: | initiator cookie: | 7f 4f 0a ce e9 72 38 6d | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_SA (0x1) | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10) | exchange type: ISAKMP_XCHG_IDPROT (0x2) | flags: none (0x0) | Message ID: 0 (0x0) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | next payload chain: ignoring supplied 'ISAKMP Message'.'next payload type' value 1:ISAKMP_NEXT_SA | no specific IKE algorithms specified - using defaults | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=aes=7 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP2048=14 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_256=4 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha2_512=6 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() processing ealg=3des_cbc=5 halg=sha=2 modp=MODP1536=5 eklen=0 | oakley_alg_makedb() returning 0x5597040a6c60 | ***emit ISAKMP Security Association Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | DOI: ISAKMP_DOI_IPSEC (0x1) | next payload chain: ignoring supplied 'ISAKMP Security Association Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current ISAKMP Security Association Payload (1:ISAKMP_NEXT_SA) | next payload chain: saving location 'ISAKMP Security Association Payload'.'next payload type' in 'reply packet' | ****emit IPsec DOI SIT: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1) | ikev1_out_sa pcn: 0 has 1 valid proposals | ikev1_out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 18 | ****emit ISAKMP Proposal Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | proposal number: 0 (0x0) | protocol ID: PROTO_ISAKMP (0x1) | SPI size: 0 (0x0) | number of transforms: 18 (0x12) | last substructure: saving location 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 0 (0x0) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 1 (0x1) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 2 (0x2) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 3 (0x3) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 4 (0x4) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 5 (0x5) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 6 (0x6) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 7 (0x7) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 8 (0x8) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 9 (0x9) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 10 (0xa) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 256 (0x100) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 11 (0xb) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 7 (0x7) | [7 is OAKLEY_AES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_KEY_LENGTH (0x800e) | length/value: 128 (0x80) | emitting length of ISAKMP Transform Payload (ISAKMP): 36 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 12 (0xc) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 13 (0xd) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 14 (0xe) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 14 (0xe) | [14 is OAKLEY_GROUP_MODP2048] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 15 (0xf) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 4 (0x4) | [4 is OAKLEY_SHA2_256] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_T (0x3) | ISAKMP transform number: 16 (0x10) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 6 (0x6) | [6 is OAKLEY_SHA2_512] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | *****emit ISAKMP Transform Payload (ISAKMP): | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP transform number: 17 (0x11) | ISAKMP transform ID: KEY_IKE (0x1) | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is ISAKMP_NEXT_T (0x3) | last substructure: saving location 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_TYPE (0x800b) | length/value: 1 (0x1) | [1 is OAKLEY_LIFE_SECONDS] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_LIFE_DURATION (variable length) (0x800c) | length/value: 3600 (0xe10) | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_ENCRYPTION_ALGORITHM (0x8001) | length/value: 5 (0x5) | [5 is OAKLEY_3DES_CBC] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_HASH_ALGORITHM (0x8002) | length/value: 2 (0x2) | [2 is OAKLEY_SHA1] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_AUTHENTICATION_METHOD (0x8003) | length/value: 65005 (0xfded) | [65005 is XAUTHInitRSA] | ******emit ISAKMP Oakley attribute: | af+type: AF+OAKLEY_GROUP_DESCRIPTION (0x8004) | length/value: 5 (0x5) | [5 is OAKLEY_GROUP_MODP1536] | emitting length of ISAKMP Transform Payload (ISAKMP): 32 | emitting length of ISAKMP Proposal Payload: 632 | last substructure: checking 'ISAKMP Proposal Payload'.'ISAKMP Transform Payload (ISAKMP)'.'next payload type' is 0 | emitting length of ISAKMP Security Association Payload: 644 | last substructure: checking 'ISAKMP Security Association Payload'.'ISAKMP Proposal Payload'.'next payload type' is 0 | out_vid(): sending [FRAGMENTATION] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Security Association Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 40 48 b7 d5 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [XAUTH] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 8 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 09 00 26 89 df d6 b7 12 | emitting length of ISAKMP Vendor ID Payload: 12 | out_vid(): sending [Dead Peer Detection] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00 | emitting length of ISAKMP Vendor ID Payload: 20 | nat add vid | sending draft and RFC NATT VIDs | out_vid(): sending [RFC 3947] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f | emitting length of ISAKMP Vendor ID Payload: 20 | skipping VID_NATT_RFC | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-03] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 7d 94 19 a6 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02_n] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_VID (0xd) | next payload chain: ignoring supplied 'ISAKMP Vendor ID Payload'.'next payload type' value 13:ISAKMP_NEXT_VID | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | emitting length of ISAKMP Vendor ID Payload: 20 | out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02] | ***emit ISAKMP Vendor ID Payload: | next payload type: ISAKMP_NEXT_NONE (0x0) | next payload chain: setting previous 'ISAKMP Vendor ID Payload'.'next payload type' to current ISAKMP Vendor ID Payload (13:ISAKMP_NEXT_VID) | next payload chain: saving location 'ISAKMP Vendor ID Payload'.'next payload type' in 'reply packet' | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload | V_ID cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48 | emitting length of ISAKMP Vendor ID Payload: 20 | no IKEv1 message padding required | emitting length of ISAKMP Message: 804 | sending 804 bytes for reply packet for main_outI1 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 (using #4) | 7f 4f 0a ce e9 72 38 6d 00 00 00 00 00 00 00 00 | 01 10 02 00 00 00 00 00 00 00 03 24 0d 00 02 84 | 00 00 00 01 00 00 00 01 00 00 02 78 00 01 00 12 | 03 00 00 24 00 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 04 80 03 fd ed 80 04 00 0e | 80 0e 01 00 03 00 00 24 01 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 04 80 03 fd ed | 80 04 00 0e 80 0e 00 80 03 00 00 24 02 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 06 | 80 03 fd ed 80 04 00 0e 80 0e 01 00 03 00 00 24 | 03 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 06 80 03 fd ed 80 04 00 0e 80 0e 00 80 | 03 00 00 24 04 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 02 80 03 fd ed 80 04 00 0e | 80 0e 01 00 03 00 00 24 05 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 02 80 03 fd ed | 80 04 00 0e 80 0e 00 80 03 00 00 24 06 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 04 | 80 03 fd ed 80 04 00 05 80 0e 01 00 03 00 00 24 | 07 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 04 80 03 fd ed 80 04 00 05 80 0e 00 80 | 03 00 00 24 08 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 07 80 02 00 06 80 03 fd ed 80 04 00 05 | 80 0e 01 00 03 00 00 24 09 01 00 00 80 0b 00 01 | 80 0c 0e 10 80 01 00 07 80 02 00 06 80 03 fd ed | 80 04 00 05 80 0e 00 80 03 00 00 24 0a 01 00 00 | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 02 00 02 | 80 03 fd ed 80 04 00 05 80 0e 01 00 03 00 00 24 | 0b 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07 | 80 02 00 02 80 03 fd ed 80 04 00 05 80 0e 00 80 | 03 00 00 20 0c 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 fd ed 80 04 00 0e | 03 00 00 20 0d 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 fd ed 80 04 00 0e | 03 00 00 20 0e 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 fd ed 80 04 00 0e | 03 00 00 20 0f 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 04 80 03 fd ed 80 04 00 05 | 03 00 00 20 10 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 06 80 03 fd ed 80 04 00 05 | 00 00 00 20 11 01 00 00 80 0b 00 01 80 0c 0e 10 | 80 01 00 05 80 02 00 02 80 03 fd ed 80 04 00 05 | 0d 00 00 14 40 48 b7 d5 6e bc e8 85 25 e7 de 7f | 00 d6 c2 d3 0d 00 00 0c 09 00 26 89 df d6 b7 12 | 0d 00 00 14 af ca d7 13 68 a1 f1 c9 6b 86 96 fc | 77 57 01 00 0d 00 00 14 4a 13 1c 81 07 03 58 45 | 5c 57 28 f2 0e 95 45 2f 0d 00 00 14 7d 94 19 a6 | 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14 | 90 cb 80 91 3e bb 69 6e 08 63 81 b5 ec 42 7b 1f | 00 00 00 14 cd 60 46 43 35 df 21 f8 7c fd b2 fc | 68 b6 a4 48 | event_schedule: new EVENT_RETRANSMIT-pe@0x559704098a80 | inserting event EVENT_RETRANSMIT, timeout in 15 seconds for #4 | libevent_malloc: new ptr-libevent@0x7efc7c006900 size 128 | #4 STATE_MAIN_I1: retransmits: first event in 15 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 50039.422457 | #4 spent 1.64 milliseconds in main_outI1() | stop processing: state #4 connection "north-east" from 192.1.2.23:500 (in main_outI1() at ikev1_main.c:228) | event_schedule: new EVENT_SA_EXPIRE-pe@0x55970409c6d0 | inserting event EVENT_SA_EXPIRE, timeout in 0 seconds for #3 | libevent_malloc: new ptr-libevent@0x7efc80004f00 size 128 | libevent_free: release ptr-libevent@0x7efc78001ef0 | free_event_entry: release EVENT_SA_REPLACE-pe@0x55970409e7f0 | #3 spent 1.67 milliseconds in timer_event_cb() EVENT_SA_REPLACE | processing: STOP state #0 (in timer_event_cb() at timer.c:557) | processing global timer EVENT_REVIVE_CONNS Initiating connection north-east which received a Delete/Notify but must remain up per local policy | FOR_EACH_CONNECTION_... in conn_by_name | start processing: connection "north-east" (in initiate_a_connection() at initiate.c:186) | empty esp_info, returning defaults for ENCRYPT | connection 'north-east' +POLICY_UP | dup_any(fd@-1) -> fd@-1 (in initiate_a_connection() at initiate.c:342) | FOR_EACH_STATE_... in find_phase1_state | Ignored already queued up pending IPsec SA negotiation with 192.1.2.23 "north-east" | stop processing: connection "north-east" (in initiate_a_connection() at initiate.c:349) | spent 0.0313 milliseconds in global timer EVENT_REVIVE_CONNS recvmsg: received truncated IKE packet (MSG_TRUNC) | **parse ISAKMP Message (raw): | initiator cookie: | 7f 4f 0a ce e9 72 38 6d | responder cookie: | 00 00 00 00 00 00 00 00 | next payload type: 1 (0x1) | ISAKMP version: 16 (0x10) | exchange type: 2 (0x2) | flags: 0 (0x0) | Message ID: 0 (0x0) | length: 804 (0x324) | State DB: found IKEv1 state #4 in MAIN_I1 (find_likely_sender) | MSG_ERRQUEUE packet matches IKEv1 SA #4 | rejected packet: | 7f 4f 0a ce e9 72 38 6d 00 00 00 00 00 00 00 00 | 01 10 02 00 00 00 00 00 00 00 03 24 0d 00 02 84 | 00 00 00 01 00 00 00 01 00 00 02 78 00 01 00 12 | 03 00 00 24 00 01 00 00 | control: | 1c 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 | 18 25 00 00 00 00 00 00 c0 01 03 21 fd 7f 00 00 | 30 00 00 00 00 00 00 00 00 00 00 00 0b 00 00 00 | 6f 00 00 00 02 03 03 00 00 00 00 00 00 00 00 00 | 02 00 00 00 c0 01 02 17 00 00 00 00 00 00 00 00 | name: | 02 00 01 f4 c0 01 02 17 00 00 00 00 00 00 00 00 "north-east" #4: ERROR: asynchronous network error report on eth1 (192.1.3.33:500) for message to 192.1.2.23 port 500, complainant 192.1.2.23: Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)] | spent 0.0611 milliseconds in comm_handle_cb() calling check_incoming_msg_errqueue() | timer_event_cb: processing event@0x55970409c6d0 | handling event EVENT_SA_EXPIRE for child state #3 | start processing: state #3 connection "north-east" from 192.1.2.23:500 (in timer_event_cb() at timer.c:250) | picked newest_ipsec_sa #0 for #3 | un-established partial CHILD SA timeout (SA expired) | pstats #3 ikev1.ipsec failed exchange-timeout | pstats #3 ikev1.ipsec deleted exchange-timeout | [RE]START processing: state #3 connection "north-east" from 192.1.2.23:500 (in delete_state() at state.c:879) "north-east" #3: deleting state (STATE_QUICK_I1) aged 0.180s and NOT sending notification | child state #3: QUICK_I1(established CHILD SA) => delete | child state #3: QUICK_I1(established CHILD SA) => CHILDSA_DEL(informational) | priority calculation of connection "north-east" is 0xfdfe7 | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.2.100/32:0 => unk255.10000@192.1.3.33 (raw_eroute) | raw_eroute result=success | in connection_discard for connection north-east | State DB: deleting IKEv1 state #3 in CHILDSA_DEL | child state #3: CHILDSA_DEL(informational) => UNDEFINED(ignore) | stop processing: state #3 from 192.1.2.23:500 (in delete_state() at state.c:1143) | libevent_free: release ptr-libevent@0x7efc80004f00 | free_event_entry: release EVENT_SA_EXPIRE-pe@0x55970409c6d0 | in statetime_stop() and could not find #3 | processing: STOP state #0 (in timer_event_cb() at timer.c:557)