Oct 31 15:24:53.281022: | newref logger@0x559bbaafcb70(0->1) (in main() at plutomain.c:1591) Oct 31 15:24:53.281078: | delref logger@0x559bbaafcb70(1->0) (in main() at plutomain.c:1592) Oct 31 15:24:53.281083: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:53.281085: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:53.281087: NSS DB directory: sql:/var/lib/ipsec/nss Oct 31 15:24:53.281223: Initializing NSS Oct 31 15:24:53.281229: Opening NSS database "sql:/var/lib/ipsec/nss" read-only Oct 31 15:24:53.313771: FIPS Mode: NO Oct 31 15:24:53.313788: NSS crypto library initialized Oct 31 15:24:53.313815: FIPS mode disabled for pluto daemon Oct 31 15:24:53.313818: FIPS HMAC integrity support [disabled] Oct 31 15:24:53.313896: libcap-ng support [enabled] Oct 31 15:24:53.313904: Linux audit support [enabled] Oct 31 15:24:53.313925: Linux audit activated Oct 31 15:24:53.313930: Starting Pluto (Libreswan Version v4.1-88-gf1d1933837ef-main IKEv2 IKEv1 XFRM(netkey) XFRMI esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) (NSS-PRF) DNSSEC LABELED_IPSEC (SELINUX) SECCOMP LIBCAP_NG LINUX_AUDIT AUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:2152099 Oct 31 15:24:53.313932: core dump dir: /tmp Oct 31 15:24:53.313934: secrets file: /etc/ipsec.secrets Oct 31 15:24:53.313936: leak-detective disabled Oct 31 15:24:53.313938: NSS crypto [enabled] Oct 31 15:24:53.313940: XAUTH PAM support [enabled] Oct 31 15:24:53.314024: | libevent is using pluto's memory allocator Oct 31 15:24:53.314032: Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) Oct 31 15:24:53.314047: | libevent_malloc: newref ptr-libevent@0x559bbabae550 size 40 Oct 31 15:24:53.314051: | libevent_malloc: newref ptr-libevent@0x559bbabae580 size 40 Oct 31 15:24:53.314055: | libevent_malloc: newref ptr-libevent@0x559bbabafc50 size 40 Oct 31 15:24:53.314057: | creating event base Oct 31 15:24:53.314060: | libevent_malloc: newref ptr-libevent@0x559bbabafc80 size 56 Oct 31 15:24:53.314063: | libevent_malloc: newref ptr-libevent@0x559bbabafcc0 size 664 Oct 31 15:24:53.314074: | libevent_malloc: newref ptr-libevent@0x559bbabae2e0 size 24 Oct 31 15:24:53.314076: | libevent_malloc: newref ptr-libevent@0x559bbab76770 size 384 Oct 31 15:24:53.314087: | libevent_malloc: newref ptr-libevent@0x559bbabae3b0 size 16 Oct 31 15:24:53.314089: | libevent_malloc: newref ptr-libevent@0x559bbabaff60 size 40 Oct 31 15:24:53.314092: | libevent_malloc: newref ptr-libevent@0x559bbabaff90 size 48 Oct 31 15:24:53.314099: | libevent_realloc: newref ptr-libevent@0x559bbabaffd0 size 256 Oct 31 15:24:53.314102: | libevent_malloc: newref ptr-libevent@0x559bbabae480 size 16 Oct 31 15:24:53.314107: | libevent_free: delref ptr-libevent@0x559bbabafc80 Oct 31 15:24:53.314109: | libevent initialized Oct 31 15:24:53.314114: | libevent_realloc: newref ptr-libevent@0x559bbabb00e0 size 64 Oct 31 15:24:53.314118: | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds Oct 31 15:24:53.314124: | init_nat_traversal() initialized with keep_alive=0s Oct 31 15:24:53.314126: NAT-Traversal support [enabled] Oct 31 15:24:53.314129: | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized Oct 31 15:24:53.314133: | global one-shot timer EVENT_FREE_ROOT_CERTS initialized Oct 31 15:24:53.314137: | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds Oct 31 15:24:53.314149: | checking IKEv1 state table Oct 31 15:24:53.314155: | MAIN_R0: category: half-open IKE SA; flags: 0: Oct 31 15:24:53.314158: | -> MAIN_R1 EVENT_SO_DISCARD (main_inI1_outR1) Oct 31 15:24:53.314162: | MAIN_I1: category: half-open IKE SA; flags: 0: Oct 31 15:24:53.314164: | -> MAIN_I2 EVENT_RETRANSMIT (main_inR1_outI2) Oct 31 15:24:53.314167: | MAIN_R1: category: open IKE SA; flags: 0: Oct 31 15:24:53.314170: | -> MAIN_R2 EVENT_RETRANSMIT (main_inI2_outR2) Oct 31 15:24:53.314172: | -> MAIN_R1 EVENT_RETRANSMIT (unexpected) Oct 31 15:24:53.314175: | -> MAIN_R1 EVENT_RETRANSMIT (unexpected) Oct 31 15:24:53.314177: | MAIN_I2: category: open IKE SA; flags: 0: Oct 31 15:24:53.314185: | -> MAIN_I3 EVENT_RETRANSMIT (main_inR2_outI3) Oct 31 15:24:53.314188: | -> MAIN_I2 EVENT_RETRANSMIT (unexpected) Oct 31 15:24:53.314190: | -> MAIN_I2 EVENT_RETRANSMIT (unexpected) Oct 31 15:24:53.314193: | MAIN_R2: category: open IKE SA; flags: 0: Oct 31 15:24:53.314196: | -> MAIN_R3 EVENT_SA_REPLACE (main_inI3_outR3) Oct 31 15:24:53.314202: | -> MAIN_R3 EVENT_SA_REPLACE (main_inI3_outR3) Oct 31 15:24:53.314207: | -> MAIN_R2 EVENT_SA_REPLACE (unexpected) Oct 31 15:24:53.314210: | MAIN_I3: category: open IKE SA; flags: 0: Oct 31 15:24:53.314212: | -> MAIN_I4 EVENT_SA_REPLACE (main_inR3) Oct 31 15:24:53.314215: | -> MAIN_I4 EVENT_SA_REPLACE (main_inR3) Oct 31 15:24:53.314217: | -> MAIN_I3 EVENT_SA_REPLACE (unexpected) Oct 31 15:24:53.314220: | MAIN_R3: category: established IKE SA; flags: 0: Oct 31 15:24:53.314222: | -> MAIN_R3 EVENT_NULL (unexpected) Oct 31 15:24:53.314225: | MAIN_I4: category: established IKE SA; flags: 0: Oct 31 15:24:53.314227: | -> MAIN_I4 EVENT_NULL (unexpected) Oct 31 15:24:53.314230: | AGGR_R0: category: half-open IKE SA; flags: 0: Oct 31 15:24:53.314233: | -> AGGR_R1 EVENT_SO_DISCARD (aggr_inI1_outR1) Oct 31 15:24:53.314235: | AGGR_I1: category: half-open IKE SA; flags: 0: Oct 31 15:24:53.314238: | -> AGGR_I2 EVENT_SA_REPLACE (aggr_inR1_outI2) Oct 31 15:24:53.314240: | -> AGGR_I2 EVENT_SA_REPLACE (aggr_inR1_outI2) Oct 31 15:24:53.314243: | AGGR_R1: category: open IKE SA; flags: 0: Oct 31 15:24:53.314245: | -> AGGR_R2 EVENT_SA_REPLACE (aggr_inI2) Oct 31 15:24:53.314248: | -> AGGR_R2 EVENT_SA_REPLACE (aggr_inI2) Oct 31 15:24:53.314250: | AGGR_I2: category: established IKE SA; flags: 0: Oct 31 15:24:53.314253: | -> AGGR_I2 EVENT_NULL (unexpected) Oct 31 15:24:53.314256: | AGGR_R2: category: established IKE SA; flags: 0: Oct 31 15:24:53.314258: | -> AGGR_R2 EVENT_NULL (unexpected) Oct 31 15:24:53.314261: | QUICK_R0: category: established CHILD SA; flags: 0: Oct 31 15:24:53.314263: | -> QUICK_R1 EVENT_RETRANSMIT (quick_inI1_outR1) Oct 31 15:24:53.314266: | QUICK_I1: category: established CHILD SA; flags: 0: Oct 31 15:24:53.314268: | -> QUICK_I2 EVENT_SA_REPLACE (quick_inR1_outI2) Oct 31 15:24:53.314271: | QUICK_R1: category: established CHILD SA; flags: 0: Oct 31 15:24:53.314274: | -> QUICK_R2 EVENT_SA_REPLACE (quick_inI2) Oct 31 15:24:53.314277: | QUICK_I2: category: established CHILD SA; flags: 0: Oct 31 15:24:53.314279: | -> QUICK_I2 EVENT_NULL (unexpected) Oct 31 15:24:53.314282: | QUICK_R2: category: established CHILD SA; flags: 0: Oct 31 15:24:53.314284: | -> QUICK_R2 EVENT_NULL (unexpected) Oct 31 15:24:53.314287: | INFO: category: informational; flags: 0: Oct 31 15:24:53.314289: | -> INFO EVENT_NULL (informational) Oct 31 15:24:53.314292: | INFO_PROTECTED: category: informational; flags: 0: Oct 31 15:24:53.314294: | -> INFO_PROTECTED EVENT_NULL (informational) Oct 31 15:24:53.314297: | XAUTH_R0: category: established IKE SA; flags: 0: Oct 31 15:24:53.314300: | -> XAUTH_R1 EVENT_NULL (xauth_inR0) Oct 31 15:24:53.314303: | XAUTH_R1: category: established IKE SA; flags: 0: Oct 31 15:24:53.314305: | -> MAIN_R3 EVENT_SA_REPLACE (xauth_inR1) Oct 31 15:24:53.314308: | MODE_CFG_R0: category: informational; flags: 0: Oct 31 15:24:53.314310: | -> MODE_CFG_R1 EVENT_SA_REPLACE (modecfg_inR0) Oct 31 15:24:53.314313: | MODE_CFG_R1: category: established IKE SA; flags: 0: Oct 31 15:24:53.314315: | -> MODE_CFG_R2 EVENT_SA_REPLACE (modecfg_inR1) Oct 31 15:24:53.314318: | MODE_CFG_R2: category: established IKE SA; flags: 0: Oct 31 15:24:53.314321: | -> MODE_CFG_R2 EVENT_NULL (unexpected) Oct 31 15:24:53.314323: | MODE_CFG_I1: category: established IKE SA; flags: 0: Oct 31 15:24:53.314326: | -> MAIN_I4 EVENT_SA_REPLACE (modecfg_inR1) Oct 31 15:24:53.314329: | XAUTH_I0: category: established IKE SA; flags: 0: Oct 31 15:24:53.314331: | -> XAUTH_I1 EVENT_RETRANSMIT (xauth_inI0) Oct 31 15:24:53.314336: | XAUTH_I1: category: established IKE SA; flags: 0: Oct 31 15:24:53.314338: | -> MAIN_I4 EVENT_RETRANSMIT (xauth_inI1) Oct 31 15:24:53.314344: | checking IKEv2 state table Oct 31 15:24:53.314351: | V2_REKEY_IKE_I0: category: established IKE SA; flags: 0: Oct 31 15:24:53.314354: | -> V2_REKEY_IKE_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) Oct 31 15:24:53.314358: | V2_REKEY_CHILD_I0: category: established IKE SA; flags: 0: Oct 31 15:24:53.314361: | -> V2_REKEY_CHILD_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) Oct 31 15:24:53.314364: | V2_NEW_CHILD_I0: category: established IKE SA; flags: 0: Oct 31 15:24:53.314366: | -> V2_NEW_CHILD_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) Oct 31 15:24:53.314369: | PARENT_I0: category: ignore; flags: 0: Oct 31 15:24:53.314372: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) Oct 31 15:24:53.314375: | PARENT_I1: category: half-open IKE SA; flags: 0: Oct 31 15:24:53.314377: | -> PARENT_I0 EVENT_SO_DISCARD (received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added) Oct 31 15:24:53.314384: | -> PARENT_I0 EVENT_SO_DISCARD (received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload) Oct 31 15:24:53.314386: | -> IKESA_DEL EVENT_v2_REDIRECT (received REDIRECT notify response; resending IKE_SA_INIT request to new destination) Oct 31 15:24:53.314389: | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE) Oct 31 15:24:53.314392: | PARENT_I2: category: open IKE SA; flags: 0: Oct 31 15:24:53.314395: | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_INTERMEDIATE reply, initiate IKE_AUTH or IKE_INTERMEDIATE) Oct 31 15:24:53.314832: | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) Oct 31 15:24:53.314836: | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) Oct 31 15:24:53.314839: | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) Oct 31 15:24:53.314841: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) Oct 31 15:24:53.314843: | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) Oct 31 15:24:53.314846: | PARENT_R0: category: half-open IKE SA; flags: 0: Oct 31 15:24:53.314849: | -> PARENT_R1 EVENT_SO_DISCARD send-response (Respond to IKE_SA_INIT) Oct 31 15:24:53.314852: | PARENT_R1: category: half-open IKE SA; flags: 0: Oct 31 15:24:53.314854: | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_AUTH request (no SKEYSEED)) Oct 31 15:24:53.314856: | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_INTERMEDIATE request (no SKEYSEED)) Oct 31 15:24:53.314858: | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_INTERMEDIATE request (with SKEYSEED)) Oct 31 15:24:53.314860: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Responder: process IKE_AUTH request) Oct 31 15:24:53.314863: | V2_REKEY_IKE_R0: category: established IKE SA; flags: 0: Oct 31 15:24:53.314865: | -> ESTABLISHED_IKE_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA IKE Rekey) Oct 31 15:24:53.314868: | V2_REKEY_IKE_I1: category: established IKE SA; flags: 0: Oct 31 15:24:53.314871: | -> ESTABLISHED_IKE_SA EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) Oct 31 15:24:53.314874: | V2_NEW_CHILD_I1: category: established IKE SA; flags: 0: Oct 31 15:24:53.314876: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) Oct 31 15:24:53.314879: | V2_REKEY_CHILD_R0: category: established IKE SA; flags: 0: Oct 31 15:24:53.314882: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA rekey CHILD SA request) Oct 31 15:24:53.314885: | V2_NEW_CHILD_R0: category: established IKE SA; flags: 0: Oct 31 15:24:53.314893: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA IPsec SA Request) Oct 31 15:24:53.314896: | ESTABLISHED_IKE_SA: category: established IKE SA; flags: 0: Oct 31 15:24:53.314899: | -> ESTABLISHED_IKE_SA EVENT_RETAIN send-response (Informational Request (liveness probe)) Oct 31 15:24:53.314901: | -> ESTABLISHED_IKE_SA EVENT_RETAIN (Informational Response (liveness probe)) Oct 31 15:24:53.314904: | -> ESTABLISHED_IKE_SA EVENT_RETAIN send-response (Informational Request) Oct 31 15:24:53.314906: | -> ESTABLISHED_IKE_SA EVENT_RETAIN (Informational Response) Oct 31 15:24:53.314909: | IKESA_DEL: category: established IKE SA; flags: 0: Oct 31 15:24:53.314911: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) Oct 31 15:24:53.314913: | CHILDSA_DEL: category: informational; flags: 0: Oct 31 15:24:53.314916: | -> CHILDSA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) Oct 31 15:24:53.314920: | global one-shot timer EVENT_REVIVE_CONNS initialized Oct 31 15:24:53.314923: | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds Oct 31 15:24:53.314926: | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Oct 31 15:24:53.315086: Encryption algorithms: Oct 31 15:24:53.315095: AES_CCM_16 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm, aes_ccm_c Oct 31 15:24:53.315101: AES_CCM_12 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm_b Oct 31 15:24:53.315105: AES_CCM_8 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm_a Oct 31 15:24:53.315110: 3DES_CBC [*192] IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CBC) 3des Oct 31 15:24:53.315114: CAMELLIA_CTR {256,192,*128} IKEv1: ESP IKEv2: ESP Oct 31 15:24:53.315119: CAMELLIA_CBC {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP NSS(CBC) camellia Oct 31 15:24:53.315124: AES_GCM_16 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm, aes_gcm_c Oct 31 15:24:53.315129: AES_GCM_12 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm_b Oct 31 15:24:53.315134: AES_GCM_8 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm_a Oct 31 15:24:53.315138: AES_CTR {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CTR) aesctr Oct 31 15:24:53.315143: AES_CBC {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CBC) aes Oct 31 15:24:53.315147: NULL_AUTH_AES_GMAC {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_gmac Oct 31 15:24:53.315151: NULL [] IKEv1: ESP IKEv2: ESP Oct 31 15:24:53.315155: CHACHA20_POLY1305 [*256] IKEv1: IKEv2: IKE ESP NSS(AEAD) chacha20poly1305 Oct 31 15:24:53.315158: Hash algorithms: Oct 31 15:24:53.315161: MD5 IKEv1: IKE IKEv2: NSS Oct 31 15:24:53.315165: SHA1 IKEv1: IKE IKEv2: IKE FIPS NSS sha Oct 31 15:24:53.315169: SHA2_256 IKEv1: IKE IKEv2: IKE FIPS NSS sha2, sha256 Oct 31 15:24:53.315173: SHA2_384 IKEv1: IKE IKEv2: IKE FIPS NSS sha384 Oct 31 15:24:53.315176: SHA2_512 IKEv1: IKE IKEv2: IKE FIPS NSS sha512 Oct 31 15:24:53.315178: PRF algorithms: Oct 31 15:24:53.315182: HMAC_MD5 IKEv1: IKE IKEv2: IKE native(HMAC) md5 Oct 31 15:24:53.315186: HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS NSS sha, sha1 Oct 31 15:24:53.315190: HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS NSS sha2, sha256, sha2_256 Oct 31 15:24:53.315202: HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS NSS sha384, sha2_384 Oct 31 15:24:53.315209: HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS NSS sha512, sha2_512 Oct 31 15:24:53.315214: AES_XCBC IKEv1: IKEv2: IKE native(XCBC) aes128_xcbc Oct 31 15:24:53.315216: Integrity algorithms: Oct 31 15:24:53.315221: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH native(HMAC) md5, hmac_md5 Oct 31 15:24:53.315226: HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha, sha1, sha1_96, hmac_sha1 Oct 31 15:24:53.315230: HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha512, sha2_512, sha2_512_256, hmac_sha2_512 Oct 31 15:24:53.315235: HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha384, sha2_384, sha2_384_192, hmac_sha2_384 Oct 31 15:24:53.315240: HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 Oct 31 15:24:53.315243: HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH Oct 31 15:24:53.315248: AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH native(XCBC) aes_xcbc, aes128_xcbc, aes128_xcbc_96 Oct 31 15:24:53.315252: AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac Oct 31 15:24:53.315256: NONE IKEv1: ESP IKEv2: IKE ESP FIPS null Oct 31 15:24:53.315258: DH algorithms: Oct 31 15:24:53.315262: NONE IKEv1: IKEv2: IKE ESP AH FIPS NSS(MODP) null, dh0 Oct 31 15:24:53.315265: MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH NSS(MODP) dh5 Oct 31 15:24:53.315269: MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh14 Oct 31 15:24:53.315272: MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh15 Oct 31 15:24:53.315275: MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh16 Oct 31 15:24:53.315279: MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh17 Oct 31 15:24:53.315282: MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh18 Oct 31 15:24:53.315286: DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_256, ecp256 Oct 31 15:24:53.315290: DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_384, ecp384 Oct 31 15:24:53.315295: DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_521, ecp521 Oct 31 15:24:53.315298: DH31 IKEv1: IKE IKEv2: IKE ESP AH NSS(ECP) curve25519 Oct 31 15:24:53.315301: testing CAMELLIA_CBC: Oct 31 15:24:53.315303: Camellia: 16 bytes with 128-bit key Oct 31 15:24:53.315377: Camellia: 16 bytes with 128-bit key Oct 31 15:24:53.315411: Camellia: 16 bytes with 256-bit key Oct 31 15:24:53.315503: Camellia: 16 bytes with 256-bit key Oct 31 15:24:53.315542: testing AES_GCM_16: Oct 31 15:24:53.315546: empty string Oct 31 15:24:53.315576: one block Oct 31 15:24:53.315604: two blocks Oct 31 15:24:53.315634: two blocks with associated data Oct 31 15:24:53.315664: testing AES_CTR: Oct 31 15:24:53.315667: Encrypting 16 octets using AES-CTR with 128-bit key Oct 31 15:24:53.315701: Encrypting 32 octets using AES-CTR with 128-bit key Oct 31 15:24:53.315734: Encrypting 36 octets using AES-CTR with 128-bit key Oct 31 15:24:53.315768: Encrypting 16 octets using AES-CTR with 192-bit key Oct 31 15:24:53.315803: Encrypting 32 octets using AES-CTR with 192-bit key Oct 31 15:24:53.315837: Encrypting 36 octets using AES-CTR with 192-bit key Oct 31 15:24:53.315871: Encrypting 16 octets using AES-CTR with 256-bit key Oct 31 15:24:53.315901: Encrypting 32 octets using AES-CTR with 256-bit key Oct 31 15:24:53.315935: Encrypting 36 octets using AES-CTR with 256-bit key Oct 31 15:24:53.315968: testing AES_CBC: Oct 31 15:24:53.315971: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Oct 31 15:24:53.316000: Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Oct 31 15:24:53.316035: Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Oct 31 15:24:53.316070: Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key Oct 31 15:24:53.316114: testing AES_XCBC: Oct 31 15:24:53.316117: RFC 3566 Test Case 1: AES-XCBC-MAC-96 with 0-byte input Oct 31 15:24:53.316257: RFC 3566 Test Case 2: AES-XCBC-MAC-96 with 3-byte input Oct 31 15:24:53.316384: RFC 3566 Test Case 3: AES-XCBC-MAC-96 with 16-byte input Oct 31 15:24:53.316556: RFC 3566 Test Case 4: AES-XCBC-MAC-96 with 20-byte input Oct 31 15:24:53.316689: RFC 3566 Test Case 5: AES-XCBC-MAC-96 with 32-byte input Oct 31 15:24:53.316823: RFC 3566 Test Case 6: AES-XCBC-MAC-96 with 34-byte input Oct 31 15:24:53.316953: RFC 3566 Test Case 7: AES-XCBC-MAC-96 with 1000-byte input Oct 31 15:24:53.317217: RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) Oct 31 15:24:53.317339: RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) Oct 31 15:24:53.317461: RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) Oct 31 15:24:53.317726: testing HMAC_MD5: Oct 31 15:24:53.317731: RFC 2104: MD5_HMAC test 1 Oct 31 15:24:53.317889: RFC 2104: MD5_HMAC test 2 Oct 31 15:24:53.318019: RFC 2104: MD5_HMAC test 3 Oct 31 15:24:53.318173: 8 CPU cores online Oct 31 15:24:53.318178: starting up 7 helper threads Oct 31 15:24:53.318215: started thread for helper 0 Oct 31 15:24:53.318238: started thread for helper 1 Oct 31 15:24:53.318259: started thread for helper 2 Oct 31 15:24:53.318279: started thread for helper 3 Oct 31 15:24:53.318297: started thread for helper 4 Oct 31 15:24:53.318315: started thread for helper 5 Oct 31 15:24:53.318336: started thread for helper 6 Oct 31 15:24:53.318359: Using Linux XFRM/NETKEY IPsec kernel support code on 5.8.15-201.fc32.x86_64 Oct 31 15:24:53.318387: | starting helper thread 1 Oct 31 15:24:53.318394: seccomp security disabled for crypto helper 1 Oct 31 15:24:53.318401: | status value returned by setting the priority of this helper thread 1: 22 Oct 31 15:24:53.318405: | helper thread 1 has nothing to do Oct 31 15:24:53.318412: | Hard-wiring algorithms Oct 31 15:24:53.318416: | adding AES_CCM_16 to kernel algorithm db Oct 31 15:24:53.318422: | adding AES_CCM_12 to kernel algorithm db Oct 31 15:24:53.318424: | adding AES_CCM_8 to kernel algorithm db Oct 31 15:24:53.318427: | adding 3DES_CBC to kernel algorithm db Oct 31 15:24:53.318429: | adding CAMELLIA_CBC to kernel algorithm db Oct 31 15:24:53.318431: | adding AES_GCM_16 to kernel algorithm db Oct 31 15:24:53.318433: | adding AES_GCM_12 to kernel algorithm db Oct 31 15:24:53.318435: | adding AES_GCM_8 to kernel algorithm db Oct 31 15:24:53.318437: | adding AES_CTR to kernel algorithm db Oct 31 15:24:53.318439: | adding AES_CBC to kernel algorithm db Oct 31 15:24:53.318442: | adding NULL_AUTH_AES_GMAC to kernel algorithm db Oct 31 15:24:53.318444: | adding NULL to kernel algorithm db Oct 31 15:24:53.318446: | adding CHACHA20_POLY1305 to kernel algorithm db Oct 31 15:24:53.318449: | adding HMAC_MD5_96 to kernel algorithm db Oct 31 15:24:53.318451: | adding HMAC_SHA1_96 to kernel algorithm db Oct 31 15:24:53.318453: | adding HMAC_SHA2_512_256 to kernel algorithm db Oct 31 15:24:53.318455: | adding HMAC_SHA2_384_192 to kernel algorithm db Oct 31 15:24:53.318457: | adding HMAC_SHA2_256_128 to kernel algorithm db Oct 31 15:24:53.318460: | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db Oct 31 15:24:53.318465: | adding AES_XCBC_96 to kernel algorithm db Oct 31 15:24:53.318467: | adding AES_CMAC_96 to kernel algorithm db Oct 31 15:24:53.318470: | adding NONE to kernel algorithm db Oct 31 15:24:53.318511: | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes Oct 31 15:24:53.318516: | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds Oct 31 15:24:53.318519: | setup kernel fd callback Oct 31 15:24:53.318522: | add_fd_read_event_handler: newref KERNEL_XRM_FD-pe@0x559bbabb9110 Oct 31 15:24:53.318526: | libevent_malloc: newref ptr-libevent@0x559bbabbcc90 size 128 Oct 31 15:24:53.318529: | libevent_malloc: newref ptr-libevent@0x559bbabb3f60 size 16 Oct 31 15:24:53.318534: | add_fd_read_event_handler: newref KERNEL_ROUTE_FD-pe@0x559bbabb5c40 Oct 31 15:24:53.318536: | libevent_malloc: newref ptr-libevent@0x559bbabbd940 size 128 Oct 31 15:24:53.318539: | libevent_malloc: newref ptr-libevent@0x559bbabb3f40 size 16 Oct 31 15:24:53.318728: | global one-shot timer EVENT_CHECK_CRLS initialized Oct 31 15:24:53.318751: SELinux support is enabled in PERMISSIVE mode. Oct 31 15:24:53.318923: | unbound context created - setting debug level to 5 Oct 31 15:24:53.318952: | /etc/hosts lookups activated Oct 31 15:24:53.318963: | /etc/resolv.conf usage activated Oct 31 15:24:53.319008: | outgoing-port-avoid set 0-65535 Oct 31 15:24:53.319030: | outgoing-port-permit set 32768-60999 Oct 31 15:24:53.319033: | loading dnssec root key from:/var/lib/unbound/root.key Oct 31 15:24:53.319035: | no additional dnssec trust anchors defined via dnssec-trusted= option Oct 31 15:24:53.319038: | Setting up events, loop start Oct 31 15:24:53.319041: | add_fd_read_event_handler: newref PLUTO_CTL_FD-pe@0x559bbabbff90 Oct 31 15:24:53.319043: | libevent_malloc: newref ptr-libevent@0x559bbabbd9d0 size 128 Oct 31 15:24:53.319046: | libevent_malloc: newref ptr-libevent@0x559bbabbffd0 size 16 Oct 31 15:24:53.319052: | libevent_realloc: newref ptr-libevent@0x559bbabbfff0 size 256 Oct 31 15:24:53.319054: | libevent_malloc: newref ptr-libevent@0x559bbabc0100 size 8 Oct 31 15:24:53.319057: | libevent_realloc: newref ptr-libevent@0x559bbabb3320 size 144 Oct 31 15:24:53.319059: | libevent_malloc: newref ptr-libevent@0x559bbabc0120 size 152 Oct 31 15:24:53.319062: | libevent_malloc: newref ptr-libevent@0x559bbabc01c0 size 16 Oct 31 15:24:53.319066: | signal event handler PLUTO_SIGCHLD installed Oct 31 15:24:53.319069: | libevent_malloc: newref ptr-libevent@0x559bbabc01e0 size 8 Oct 31 15:24:53.319071: | libevent_malloc: newref ptr-libevent@0x559bbabc0200 size 152 Oct 31 15:24:53.319074: | signal event handler PLUTO_SIGTERM installed Oct 31 15:24:53.319076: | libevent_malloc: newref ptr-libevent@0x559bbabc02a0 size 8 Oct 31 15:24:53.319079: | libevent_malloc: newref ptr-libevent@0x559bbabc02c0 size 152 Oct 31 15:24:53.319081: | signal event handler PLUTO_SIGHUP installed Oct 31 15:24:53.319083: | libevent_malloc: newref ptr-libevent@0x559bbabc0360 size 8 Oct 31 15:24:53.319086: | libevent_realloc: delref ptr-libevent@0x559bbabb3320 Oct 31 15:24:53.319088: | libevent_realloc: newref ptr-libevent@0x559bbabc0380 size 256 Oct 31 15:24:53.319090: | libevent_malloc: newref ptr-libevent@0x559bbabb3320 size 152 Oct 31 15:24:53.319093: | signal event handler PLUTO_SIGSYS installed Oct 31 15:24:53.319388: | created addconn helper (pid:2152146) using fork+execve Oct 31 15:24:53.319407: | forked child 2152146 Oct 31 15:24:53.319415: seccomp security disabled Oct 31 15:24:53.319437: | starting helper thread 7 Oct 31 15:24:53.319440: seccomp security disabled for crypto helper 7 Oct 31 15:24:53.319443: | status value returned by setting the priority of this helper thread 7: 22 Oct 31 15:24:53.319448: | helper thread 7 has nothing to do Oct 31 15:24:53.319458: | starting helper thread 6 Oct 31 15:24:53.319461: seccomp security disabled for crypto helper 6 Oct 31 15:24:53.319464: | status value returned by setting the priority of this helper thread 6: 22 Oct 31 15:24:53.319466: | helper thread 6 has nothing to do Oct 31 15:24:53.319477: | starting helper thread 2 Oct 31 15:24:53.319483: seccomp security disabled for crypto helper 2 Oct 31 15:24:53.319486: | status value returned by setting the priority of this helper thread 2: 22 Oct 31 15:24:53.319488: | helper thread 2 has nothing to do Oct 31 15:24:53.320236: | starting helper thread 5 Oct 31 15:24:53.320246: seccomp security disabled for crypto helper 5 Oct 31 15:24:53.320250: | status value returned by setting the priority of this helper thread 5: 22 Oct 31 15:24:53.320253: | helper thread 5 has nothing to do Oct 31 15:24:53.320238: | starting helper thread 4 Oct 31 15:24:53.321237: seccomp security disabled for crypto helper 4 Oct 31 15:24:53.321244: | status value returned by setting the priority of this helper thread 4: 22 Oct 31 15:24:53.321247: | helper thread 4 has nothing to do Oct 31 15:24:53.322257: | starting helper thread 3 Oct 31 15:24:53.322270: seccomp security disabled for crypto helper 3 Oct 31 15:24:53.322276: | status value returned by setting the priority of this helper thread 3: 22 Oct 31 15:24:53.322279: | helper thread 3 has nothing to do Oct 31 15:24:53.327233: | newref struct fd@0x559bbabc0500(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.327247: | fd_accept: new fd-fd@0x559bbabc0500 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.327267: | whack: listen Oct 31 15:24:53.327271: listening for IKE messages Oct 31 15:24:53.327373: | Inspecting interface lo Oct 31 15:24:53.327380: | found lo with address 127.0.0.1 Oct 31 15:24:53.327384: | Inspecting interface eth0 Oct 31 15:24:53.327389: | found eth0 with address 192.0.3.254 Oct 31 15:24:53.327393: | Inspecting interface eth1 Oct 31 15:24:53.327397: | found eth1 with address 192.1.3.33 Oct 31 15:24:53.327406: | newref struct iface_dev@0x559bbabc0960(0->1) (in add_iface_dev() at iface.c:67) Oct 31 15:24:53.327424: Kernel supports NIC esp-hw-offload Oct 31 15:24:53.327431: | iface: marking eth1 add Oct 31 15:24:53.327435: | newref struct iface_dev@0x559bbabc0a30(0->1) (in add_iface_dev() at iface.c:67) Oct 31 15:24:53.327438: | iface: marking eth0 add Oct 31 15:24:53.327441: | newref struct iface_dev@0x559bbabc0ac0(0->1) (in add_iface_dev() at iface.c:67) Oct 31 15:24:53.327445: | iface: marking lo add Oct 31 15:24:53.327514: | no interfaces to sort Oct 31 15:24:53.327531: | MSG_ERRQUEUE enabled on fd 18 Oct 31 15:24:53.327544: | addref ifd@0x559bbabc0960(1->2) (in bind_iface_port() at iface.c:237) Oct 31 15:24:53.327551: adding UDP interface eth1 192.1.3.33:500 Oct 31 15:24:53.327570: | MSG_ERRQUEUE enabled on fd 19 Oct 31 15:24:53.327614: | NAT-Traversal: Trying sockopt style NAT-T Oct 31 15:24:53.327618: | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 Oct 31 15:24:53.327621: | addref ifd@0x559bbabc0960(2->3) (in bind_iface_port() at iface.c:237) Oct 31 15:24:53.327625: adding UDP interface eth1 192.1.3.33:4500 Oct 31 15:24:53.327638: | MSG_ERRQUEUE enabled on fd 20 Oct 31 15:24:53.327646: | addref ifd@0x559bbabc0a30(1->2) (in bind_iface_port() at iface.c:237) Oct 31 15:24:53.327650: adding UDP interface eth0 192.0.3.254:500 Oct 31 15:24:53.327663: | MSG_ERRQUEUE enabled on fd 21 Oct 31 15:24:53.327669: | NAT-Traversal: Trying sockopt style NAT-T Oct 31 15:24:53.327672: | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 Oct 31 15:24:53.327675: | addref ifd@0x559bbabc0a30(2->3) (in bind_iface_port() at iface.c:237) Oct 31 15:24:53.327678: adding UDP interface eth0 192.0.3.254:4500 Oct 31 15:24:53.327690: | MSG_ERRQUEUE enabled on fd 22 Oct 31 15:24:53.327699: | addref ifd@0x559bbabc0ac0(1->2) (in bind_iface_port() at iface.c:237) Oct 31 15:24:53.327702: adding UDP interface lo 127.0.0.1:500 Oct 31 15:24:53.327714: | MSG_ERRQUEUE enabled on fd 23 Oct 31 15:24:53.327720: | NAT-Traversal: Trying sockopt style NAT-T Oct 31 15:24:53.327723: | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 Oct 31 15:24:53.327726: | addref ifd@0x559bbabc0ac0(2->3) (in bind_iface_port() at iface.c:237) Oct 31 15:24:53.327730: adding UDP interface lo 127.0.0.1:4500 Oct 31 15:24:53.327738: | updating interfaces - listing interfaces that are going down Oct 31 15:24:53.327740: | updating interfaces - checking orientation Oct 31 15:24:53.327743: | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations Oct 31 15:24:53.327763: | libevent_malloc: newref ptr-libevent@0x559bbabc12f0 size 128 Oct 31 15:24:53.327768: | libevent_malloc: newref ptr-libevent@0x559bbabc0f30 size 16 Oct 31 15:24:53.327777: | setup callback for interface lo 127.0.0.1:4500 fd 23 on UDP Oct 31 15:24:53.327779: | libevent_malloc: newref ptr-libevent@0x559bbabc1380 size 128 Oct 31 15:24:53.327782: | libevent_malloc: newref ptr-libevent@0x559bbabc1410 size 16 Oct 31 15:24:53.327786: | setup callback for interface lo 127.0.0.1:500 fd 22 on UDP Oct 31 15:24:53.327788: | libevent_malloc: newref ptr-libevent@0x559bbabc1430 size 128 Oct 31 15:24:53.327791: | libevent_malloc: newref ptr-libevent@0x559bbabc14c0 size 16 Oct 31 15:24:53.327795: | setup callback for interface eth0 192.0.3.254:4500 fd 21 on UDP Oct 31 15:24:53.327797: | libevent_malloc: newref ptr-libevent@0x559bbabc14e0 size 128 Oct 31 15:24:53.327799: | libevent_malloc: newref ptr-libevent@0x559bbabc1570 size 16 Oct 31 15:24:53.327803: | setup callback for interface eth0 192.0.3.254:500 fd 20 on UDP Oct 31 15:24:53.327806: | libevent_malloc: newref ptr-libevent@0x559bbabc1590 size 128 Oct 31 15:24:53.327808: | libevent_malloc: newref ptr-libevent@0x559bbabc1620 size 16 Oct 31 15:24:53.327813: | setup callback for interface eth1 192.1.3.33:4500 fd 19 on UDP Oct 31 15:24:53.327816: | libevent_malloc: newref ptr-libevent@0x559bbabc1640 size 128 Oct 31 15:24:53.327818: | libevent_malloc: newref ptr-libevent@0x559bbabc16d0 size 16 Oct 31 15:24:53.327822: | setup callback for interface eth1 192.1.3.33:500 fd 18 on UDP Oct 31 15:24:53.332336: | no stale xfrmi interface 'ipsec1' found Oct 31 15:24:53.332355: | certs and keys locked by 'free_preshared_secrets' Oct 31 15:24:53.332358: | certs and keys unlocked by 'free_preshared_secrets' Oct 31 15:24:53.332386: loading secrets from "/etc/ipsec.secrets" Oct 31 15:24:53.332427: no secrets filename matched "/etc/ipsec.d/*.secrets" Oct 31 15:24:53.332438: | old food groups: Oct 31 15:24:53.332441: | new food groups: Oct 31 15:24:53.332447: | delref fd@0x559bbabc0500(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.332453: | freeref fd-fd@0x559bbabc0500 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.332460: | spent 1.09 (5.24) milliseconds in whack Oct 31 15:24:53.332905: | processing signal PLUTO_SIGCHLD Oct 31 15:24:53.332919: | waitpid returned pid 2152146 (exited with status 0) Oct 31 15:24:53.332923: | reaped addconn helper child (status 0) Oct 31 15:24:53.332927: | waitpid returned ECHILD (no child processes left) Oct 31 15:24:53.332932: | spent 0.0199 (0.0198) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:24:53.354791: | newref struct fd@0x559bbabc0520(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.354807: | fd_accept: new fd-fd@0x559bbabc0520 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.354819: | whack: options (impair|debug) Oct 31 15:24:53.354825: | old debugging base+cpu-usage + none Oct 31 15:24:53.354828: | new debugging = base+cpu-usage Oct 31 15:24:53.354835: | delref fd@0x559bbabc0520(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.354841: | freeref fd-fd@0x559bbabc0520 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.354850: | spent 0.0668 (0.0663) milliseconds in whack Oct 31 15:24:53.729905: | newref struct fd@0x559bbabc0540(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.729921: | fd_accept: new fd-fd@0x559bbabc0540 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.729931: | whack: delete 'north-eastnets/0x1' Oct 31 15:24:53.729934: | FOR_EACH_CONNECTION_... in conn_by_name Oct 31 15:24:53.729936: | FOR_EACH_CONNECTION_... in foreach_connection_by_alias Oct 31 15:24:53.729937: | FOR_EACH_CONNECTION_... in conn_by_name Oct 31 15:24:53.729939: | FOR_EACH_CONNECTION_... in foreach_connection_by_alias Oct 31 15:24:53.729944: | whack: connection 'north-eastnets/0x1' Oct 31 15:24:53.729947: | addref fd@0x559bbabc0540(1->2) (in string_logger() at log.c:838) Oct 31 15:24:53.729952: | newref string logger@0x559bbabb4330(0->1) (in add_connection() at connections.c:1998) Oct 31 15:24:53.729955: | Connection DB: adding connection "north-eastnets/0x1" $1 Oct 31 15:24:53.729959: | FOR_EACH_CONNECTION_... in conn_by_name Oct 31 15:24:53.729968: | added new connection north-eastnets/0x1 with policy RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 Oct 31 15:24:53.729990: | ike (phase1) algorithm values: AES_CBC_256-HMAC_SHA2_256-MODP2048 Oct 31 15:24:53.729992: | from whack: got --esp=aes128-sha2_512;modp3072 Oct 31 15:24:53.730005: | ESP/AH string values: AES_CBC_128-HMAC_SHA2_512_256-MODP3072 Oct 31 15:24:53.730042: | computed rsa CKAID Oct 31 15:24:53.730044: | 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f Oct 31 15:24:53.730046: | 88 aa 7c 5d Oct 31 15:24:53.730051: | keyid: *AQPl33O2P Oct 31 15:24:53.730053: | size: 274 Oct 31 15:24:53.730054: | n Oct 31 15:24:53.730055: | e5 df 73 b6 3e d5 36 a8 f1 3d 0d d3 02 ab 7f ec Oct 31 15:24:53.730057: | 4c 9e 8b 0e 0e d2 cf 0f 59 bf 6d 88 21 86 93 9e Oct 31 15:24:53.730058: | 10 34 af 2d cf b3 7e eb e5 b2 24 b2 a5 b0 01 03 Oct 31 15:24:53.730060: | 7d b5 96 ad 66 ee 48 c2 28 d9 9a 76 36 a9 10 84 Oct 31 15:24:53.730061: | b5 09 8f 17 4f 65 ce d8 2f 8e 78 80 8a 87 f4 6b Oct 31 15:24:53.730062: | 98 d9 91 94 6b 52 15 5b 9c 47 12 be d8 6f 25 b4 Oct 31 15:24:53.730064: | 65 38 7e e4 8d c7 f0 58 d3 9f 69 14 cc 3e c8 16 Oct 31 15:24:53.730065: | 1f af bb 5d 93 2b 33 39 0e 94 55 81 f4 b3 cc 92 Oct 31 15:24:53.730066: | 58 6e 4a 5a 4e c3 76 ab 04 2e 11 08 06 55 13 0f Oct 31 15:24:53.730068: | 02 6c dd d1 bc c0 b8 8d 65 f5 97 ed fc 18 39 f9 Oct 31 15:24:53.730069: | 55 ab fa 0d c5 49 99 7f 1b cf c3 de 99 7d 9e ca Oct 31 15:24:53.730070: | 6f 9e 14 d6 5a ff de d6 4f 57 6a 83 ab 51 ba 64 Oct 31 15:24:53.730072: | 74 e0 22 e9 9a c5 10 71 bb d4 eb a4 99 28 9c 85 Oct 31 15:24:53.730073: | 0e 31 ea cc ab ef 98 84 3f 59 c1 75 aa b3 61 eb Oct 31 15:24:53.730074: | 61 8c 58 a5 92 25 84 ad c7 79 f3 87 d0 c7 83 c2 Oct 31 15:24:53.730076: | d6 8a fe 26 9d 2a ff b1 dd 9b 89 21 7c ca f5 38 Oct 31 15:24:53.730077: | 2d 3f 64 0c 41 9c 34 e9 b2 55 0f 82 1a b3 c7 5e Oct 31 15:24:53.730078: | a5 99 Oct 31 15:24:53.730080: | e Oct 31 15:24:53.730081: | 03 Oct 31 15:24:53.730082: | CKAID Oct 31 15:24:53.730084: | 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f Oct 31 15:24:53.730085: | 88 aa 7c 5d Oct 31 15:24:53.730089: | saving left CKAID 905dfca10868747c6f20d31b2d204b8f88aa7c5d extracted from raw RSA public key Oct 31 15:24:53.730222: | loaded private key matching CKAID 905dfca10868747c6f20d31b2d204b8f88aa7c5d Oct 31 15:24:53.730474: | copying key using reference slot Oct 31 15:24:53.731794: | certs and keys locked by 'lsw_add_rsa_secret' Oct 31 15:24:53.731803: | certs and keys unlocked by 'lsw_add_rsa_secret' Oct 31 15:24:53.731813: | spent 1.71 (1.72) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID Oct 31 15:24:53.731821: connection "north-eastnets/0x1": loaded private key matching left CKAID 905dfca10868747c6f20d31b2d204b8f88aa7c5d Oct 31 15:24:53.731824: | counting wild cards for @north is 0 Oct 31 15:24:53.731844: | computed rsa CKAID Oct 31 15:24:53.731847: | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 Oct 31 15:24:53.731849: | 8a 82 25 f1 Oct 31 15:24:53.731854: | keyid: *AQO9bJbr3 Oct 31 15:24:53.731856: | size: 274 Oct 31 15:24:53.731858: | n Oct 31 15:24:53.731860: | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 Oct 31 15:24:53.731862: | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a Oct 31 15:24:53.731864: | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca Oct 31 15:24:53.731865: | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 Oct 31 15:24:53.731867: | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 Oct 31 15:24:53.731873: | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd Oct 31 15:24:53.731875: | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 Oct 31 15:24:53.731877: | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 Oct 31 15:24:53.731879: | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 Oct 31 15:24:53.731880: | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 Oct 31 15:24:53.731882: | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 Oct 31 15:24:53.731884: | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 Oct 31 15:24:53.731885: | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 Oct 31 15:24:53.731887: | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 Oct 31 15:24:53.731889: | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc Oct 31 15:24:53.731890: | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f Oct 31 15:24:53.731892: | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 Oct 31 15:24:53.731894: | 48 ef Oct 31 15:24:53.731896: | e Oct 31 15:24:53.731897: | 03 Oct 31 15:24:53.731899: | CKAID Oct 31 15:24:53.731901: | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 Oct 31 15:24:53.731903: | 8a 82 25 f1 Oct 31 15:24:53.731907: | saving right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 extracted from raw RSA public key Oct 31 15:24:53.731911: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:53.731956: | spent 0.0423 (0.0422) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID Oct 31 15:24:53.731964: | no private key matching right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1: can't find the private key matching the NSS CKAID Oct 31 15:24:53.731967: | counting wild cards for @east is 0 Oct 31 15:24:53.731972: | updating connection from left.host_addr Oct 31 15:24:53.731976: | right host_nexthop 192.1.3.33 Oct 31 15:24:53.731979: | left host_port 500 Oct 31 15:24:53.731981: | updating connection from right.host_addr Oct 31 15:24:53.731985: | left host_nexthop 192.1.2.23 Oct 31 15:24:53.731987: | right host_port 500 Oct 31 15:24:53.731993: | orienting north-eastnets/0x1 Oct 31 15:24:53.731998: | north-eastnets/0x1 doesn't match 127.0.0.1:4500 at all Oct 31 15:24:53.732002: | north-eastnets/0x1 doesn't match 127.0.0.1:500 at all Oct 31 15:24:53.732006: | north-eastnets/0x1 doesn't match 192.0.3.254:4500 at all Oct 31 15:24:53.732010: | north-eastnets/0x1 doesn't match 192.0.3.254:500 at all Oct 31 15:24:53.732014: | north-eastnets/0x1 doesn't match 192.1.3.33:4500 at all Oct 31 15:24:53.732017: | oriented north-eastnets/0x1's this Oct 31 15:24:53.732022: | connect_to_host_pair: 192.1.3.33:500 192.1.2.23:500 -> hp@(nil): none Oct 31 15:24:53.732028: | newref hp@0x559bbabc22f0(0->1) (in connect_to_host_pair() at hostpair.c:290) Oct 31 15:24:53.732031: added IKEv2 connection "north-eastnets/0x1" Oct 31 15:24:53.732042: | ike_life: 3600; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 Oct 31 15:24:53.732049: | 192.0.3.0/24===192.1.3.33<192.1.3.33>[@north]...192.1.2.23<192.1.2.23>[@east]===192.0.2.0/24 Oct 31 15:24:53.732051: | delref logger@0x559bbabb4330(1->0) (in add_connection() at connections.c:2026) Oct 31 15:24:53.732053: | delref fd@0x559bbabc0540(2->1) (in free_logger() at log.c:853) Oct 31 15:24:53.732056: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:53.732060: | delref fd@0x559bbabc0540(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.732068: | freeref fd-fd@0x559bbabc0540 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.732072: | spent 2.17 (2.18) milliseconds in whack Oct 31 15:24:53.732113: | newref struct fd@0x559bbabc3dc0(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.732116: | fd_accept: new fd-fd@0x559bbabc3dc0 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.732122: | whack: key Oct 31 15:24:53.732125: add keyid @north Oct 31 15:24:53.732127: | 01 03 e5 df 73 b6 3e d5 36 a8 f1 3d 0d d3 02 ab Oct 31 15:24:53.732131: | 7f ec 4c 9e 8b 0e 0e d2 cf 0f 59 bf 6d 88 21 86 Oct 31 15:24:53.732132: | 93 9e 10 34 af 2d cf b3 7e eb e5 b2 24 b2 a5 b0 Oct 31 15:24:53.732134: | 01 03 7d b5 96 ad 66 ee 48 c2 28 d9 9a 76 36 a9 Oct 31 15:24:53.732135: | 10 84 b5 09 8f 17 4f 65 ce d8 2f 8e 78 80 8a 87 Oct 31 15:24:53.732136: | f4 6b 98 d9 91 94 6b 52 15 5b 9c 47 12 be d8 6f Oct 31 15:24:53.732138: | 25 b4 65 38 7e e4 8d c7 f0 58 d3 9f 69 14 cc 3e Oct 31 15:24:53.732139: | c8 16 1f af bb 5d 93 2b 33 39 0e 94 55 81 f4 b3 Oct 31 15:24:53.732140: | cc 92 58 6e 4a 5a 4e c3 76 ab 04 2e 11 08 06 55 Oct 31 15:24:53.732142: | 13 0f 02 6c dd d1 bc c0 b8 8d 65 f5 97 ed fc 18 Oct 31 15:24:53.732143: | 39 f9 55 ab fa 0d c5 49 99 7f 1b cf c3 de 99 7d Oct 31 15:24:53.732144: | 9e ca 6f 9e 14 d6 5a ff de d6 4f 57 6a 83 ab 51 Oct 31 15:24:53.732146: | ba 64 74 e0 22 e9 9a c5 10 71 bb d4 eb a4 99 28 Oct 31 15:24:53.732147: | 9c 85 0e 31 ea cc ab ef 98 84 3f 59 c1 75 aa b3 Oct 31 15:24:53.732148: | 61 eb 61 8c 58 a5 92 25 84 ad c7 79 f3 87 d0 c7 Oct 31 15:24:53.732150: | 83 c2 d6 8a fe 26 9d 2a ff b1 dd 9b 89 21 7c ca Oct 31 15:24:53.732151: | f5 38 2d 3f 64 0c 41 9c 34 e9 b2 55 0f 82 1a b3 Oct 31 15:24:53.732152: | c7 5e a5 99 Oct 31 15:24:53.732160: | computed rsa CKAID Oct 31 15:24:53.732162: | 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f Oct 31 15:24:53.732163: | 88 aa 7c 5d Oct 31 15:24:53.732166: | keyid: *AQPl33O2P Oct 31 15:24:53.732168: | size: 274 Oct 31 15:24:53.732169: | n Oct 31 15:24:53.732171: | e5 df 73 b6 3e d5 36 a8 f1 3d 0d d3 02 ab 7f ec Oct 31 15:24:53.732172: | 4c 9e 8b 0e 0e d2 cf 0f 59 bf 6d 88 21 86 93 9e Oct 31 15:24:53.732173: | 10 34 af 2d cf b3 7e eb e5 b2 24 b2 a5 b0 01 03 Oct 31 15:24:53.732175: | 7d b5 96 ad 66 ee 48 c2 28 d9 9a 76 36 a9 10 84 Oct 31 15:24:53.732176: | b5 09 8f 17 4f 65 ce d8 2f 8e 78 80 8a 87 f4 6b Oct 31 15:24:53.732177: | 98 d9 91 94 6b 52 15 5b 9c 47 12 be d8 6f 25 b4 Oct 31 15:24:53.732179: | 65 38 7e e4 8d c7 f0 58 d3 9f 69 14 cc 3e c8 16 Oct 31 15:24:53.732180: | 1f af bb 5d 93 2b 33 39 0e 94 55 81 f4 b3 cc 92 Oct 31 15:24:53.732181: | 58 6e 4a 5a 4e c3 76 ab 04 2e 11 08 06 55 13 0f Oct 31 15:24:53.732183: | 02 6c dd d1 bc c0 b8 8d 65 f5 97 ed fc 18 39 f9 Oct 31 15:24:53.732184: | 55 ab fa 0d c5 49 99 7f 1b cf c3 de 99 7d 9e ca Oct 31 15:24:53.732185: | 6f 9e 14 d6 5a ff de d6 4f 57 6a 83 ab 51 ba 64 Oct 31 15:24:53.732187: | 74 e0 22 e9 9a c5 10 71 bb d4 eb a4 99 28 9c 85 Oct 31 15:24:53.732188: | 0e 31 ea cc ab ef 98 84 3f 59 c1 75 aa b3 61 eb Oct 31 15:24:53.732189: | 61 8c 58 a5 92 25 84 ad c7 79 f3 87 d0 c7 83 c2 Oct 31 15:24:53.732191: | d6 8a fe 26 9d 2a ff b1 dd 9b 89 21 7c ca f5 38 Oct 31 15:24:53.732192: | 2d 3f 64 0c 41 9c 34 e9 b2 55 0f 82 1a b3 c7 5e Oct 31 15:24:53.732193: | a5 99 Oct 31 15:24:53.732195: | e Oct 31 15:24:53.732196: | 03 Oct 31 15:24:53.732197: | CKAID Oct 31 15:24:53.732208: | 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f Oct 31 15:24:53.732210: | 88 aa 7c 5d Oct 31 15:24:53.732213: | newref struct pubkey@0x559bbabc67a0(0->1) (in add_public_key() at secrets.c:1716) Oct 31 15:24:53.732216: | addref pk@0x559bbabc67a0(1->2) (in add_public_key() at secrets.c:1718) Oct 31 15:24:53.732219: | delref pkp@0x559bbabc67a0(2->1) (in key_add_request() at rcv_whack.c:341) Oct 31 15:24:53.732222: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:53.732224: | matched Oct 31 15:24:53.732226: | secrets entry for ckaid already exists Oct 31 15:24:53.732231: | spent 0.00722 (0.00708) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID Oct 31 15:24:53.732234: | delref fd@0x559bbabc3dc0(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.732240: | freeref fd-fd@0x559bbabc3dc0 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.732243: | spent 0.131 (0.136) milliseconds in whack Oct 31 15:24:53.732271: | newref struct fd@0x559bbabc2370(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.732276: | fd_accept: new fd-fd@0x559bbabc2370 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.732282: | whack: key Oct 31 15:24:53.732285: add keyid @east Oct 31 15:24:53.732286: | 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b Oct 31 15:24:53.732288: | e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 Oct 31 15:24:53.732289: | 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c Oct 31 15:24:53.732290: | 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 Oct 31 15:24:53.732292: | 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d Oct 31 15:24:53.732293: | d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 Oct 31 15:24:53.732294: | 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce Oct 31 15:24:53.732296: | 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e Oct 31 15:24:53.732297: | bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d Oct 31 15:24:53.732298: | ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce Oct 31 15:24:53.732300: | e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a Oct 31 15:24:53.732301: | 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 Oct 31 15:24:53.732302: | 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 Oct 31 15:24:53.732304: | 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 Oct 31 15:24:53.732305: | d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c Oct 31 15:24:53.732306: | 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 Oct 31 15:24:53.732308: | 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 Oct 31 15:24:53.732309: | 51 51 48 ef Oct 31 15:24:53.732316: | computed rsa CKAID Oct 31 15:24:53.732318: | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 Oct 31 15:24:53.732319: | 8a 82 25 f1 Oct 31 15:24:53.732324: | keyid: *AQO9bJbr3 Oct 31 15:24:53.732329: | size: 274 Oct 31 15:24:53.732332: | n Oct 31 15:24:53.732334: | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 Oct 31 15:24:53.732337: | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a Oct 31 15:24:53.732339: | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca Oct 31 15:24:53.732341: | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 Oct 31 15:24:53.732344: | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 Oct 31 15:24:53.732346: | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd Oct 31 15:24:53.732348: | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 Oct 31 15:24:53.732351: | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 Oct 31 15:24:53.732353: | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 Oct 31 15:24:53.732356: | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 Oct 31 15:24:53.732358: | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 Oct 31 15:24:53.732360: | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 Oct 31 15:24:53.732363: | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 Oct 31 15:24:53.732365: | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 Oct 31 15:24:53.732368: | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc Oct 31 15:24:53.732370: | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f Oct 31 15:24:53.732372: | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 Oct 31 15:24:53.732374: | 48 ef Oct 31 15:24:53.732375: | e Oct 31 15:24:53.732376: | 03 Oct 31 15:24:53.732378: | CKAID Oct 31 15:24:53.732379: | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 Oct 31 15:24:53.732380: | 8a 82 25 f1 Oct 31 15:24:53.732383: | newref struct pubkey@0x559bbabc68b0(0->1) (in add_public_key() at secrets.c:1716) Oct 31 15:24:53.732385: | addref pk@0x559bbabc68b0(1->2) (in add_public_key() at secrets.c:1718) Oct 31 15:24:53.732387: | delref pkp@0x559bbabc68b0(2->1) (in key_add_request() at rcv_whack.c:341) Oct 31 15:24:53.732389: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:53.732424: | spent 0.0336 (0.0336) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID Oct 31 15:24:53.732430: | no private key: can't find the private key matching the NSS CKAID Oct 31 15:24:53.732438: | delref fd@0x559bbabc2370(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.732446: | freeref fd-fd@0x559bbabc2370 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.732452: | spent 0.183 (0.184) milliseconds in whack Oct 31 15:24:53.732499: | newref struct fd@0x559bbabc3850(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.732505: | fd_accept: new fd-fd@0x559bbabc3850 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.732515: | whack: delete 'north-eastnets/0x2' Oct 31 15:24:53.732521: | FOR_EACH_CONNECTION_... in conn_by_name Oct 31 15:24:53.732523: | FOR_EACH_CONNECTION_... in foreach_connection_by_alias Oct 31 15:24:53.732525: | FOR_EACH_CONNECTION_... in conn_by_name Oct 31 15:24:53.732526: | FOR_EACH_CONNECTION_... in foreach_connection_by_alias Oct 31 15:24:53.732528: | whack: connection 'north-eastnets/0x2' Oct 31 15:24:53.732530: | addref fd@0x559bbabc3850(1->2) (in string_logger() at log.c:838) Oct 31 15:24:53.732532: | newref string logger@0x559bbabc4050(0->1) (in add_connection() at connections.c:1998) Oct 31 15:24:53.732534: | Connection DB: adding connection "north-eastnets/0x2" $2 Oct 31 15:24:53.732538: | FOR_EACH_CONNECTION_... in conn_by_name Oct 31 15:24:53.732543: | added new connection north-eastnets/0x2 with policy RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 Oct 31 15:24:53.732563: | ike (phase1) algorithm values: AES_CBC_256-HMAC_SHA2_256-MODP2048 Oct 31 15:24:53.732565: | from whack: got --esp=aes128-sha2_512;modp3072 Oct 31 15:24:53.732577: | ESP/AH string values: AES_CBC_128-HMAC_SHA2_512_256-MODP3072 Oct 31 15:24:53.732590: | computed rsa CKAID Oct 31 15:24:53.732592: | 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f Oct 31 15:24:53.732593: | 88 aa 7c 5d Oct 31 15:24:53.732596: | keyid: *AQPl33O2P Oct 31 15:24:53.732598: | size: 274 Oct 31 15:24:53.732599: | n Oct 31 15:24:53.732601: | e5 df 73 b6 3e d5 36 a8 f1 3d 0d d3 02 ab 7f ec Oct 31 15:24:53.732602: | 4c 9e 8b 0e 0e d2 cf 0f 59 bf 6d 88 21 86 93 9e Oct 31 15:24:53.732603: | 10 34 af 2d cf b3 7e eb e5 b2 24 b2 a5 b0 01 03 Oct 31 15:24:53.732605: | 7d b5 96 ad 66 ee 48 c2 28 d9 9a 76 36 a9 10 84 Oct 31 15:24:53.732606: | b5 09 8f 17 4f 65 ce d8 2f 8e 78 80 8a 87 f4 6b Oct 31 15:24:53.732607: | 98 d9 91 94 6b 52 15 5b 9c 47 12 be d8 6f 25 b4 Oct 31 15:24:53.732609: | 65 38 7e e4 8d c7 f0 58 d3 9f 69 14 cc 3e c8 16 Oct 31 15:24:53.732610: | 1f af bb 5d 93 2b 33 39 0e 94 55 81 f4 b3 cc 92 Oct 31 15:24:53.732611: | 58 6e 4a 5a 4e c3 76 ab 04 2e 11 08 06 55 13 0f Oct 31 15:24:53.732613: | 02 6c dd d1 bc c0 b8 8d 65 f5 97 ed fc 18 39 f9 Oct 31 15:24:53.732614: | 55 ab fa 0d c5 49 99 7f 1b cf c3 de 99 7d 9e ca Oct 31 15:24:53.732615: | 6f 9e 14 d6 5a ff de d6 4f 57 6a 83 ab 51 ba 64 Oct 31 15:24:53.732617: | 74 e0 22 e9 9a c5 10 71 bb d4 eb a4 99 28 9c 85 Oct 31 15:24:53.732618: | 0e 31 ea cc ab ef 98 84 3f 59 c1 75 aa b3 61 eb Oct 31 15:24:53.732619: | 61 8c 58 a5 92 25 84 ad c7 79 f3 87 d0 c7 83 c2 Oct 31 15:24:53.732621: | d6 8a fe 26 9d 2a ff b1 dd 9b 89 21 7c ca f5 38 Oct 31 15:24:53.732622: | 2d 3f 64 0c 41 9c 34 e9 b2 55 0f 82 1a b3 c7 5e Oct 31 15:24:53.732623: | a5 99 Oct 31 15:24:53.732625: | e Oct 31 15:24:53.732626: | 03 Oct 31 15:24:53.732627: | CKAID Oct 31 15:24:53.732629: | 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f Oct 31 15:24:53.732630: | 88 aa 7c 5d Oct 31 15:24:53.732634: | saving left CKAID 905dfca10868747c6f20d31b2d204b8f88aa7c5d extracted from raw RSA public key Oct 31 15:24:53.732637: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:53.732638: | matched Oct 31 15:24:53.732639: | secrets entry for ckaid already exists Oct 31 15:24:53.732643: | spent 0.00521 (0.00497) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID Oct 31 15:24:53.732645: | counting wild cards for @north is 0 Oct 31 15:24:53.732654: | computed rsa CKAID Oct 31 15:24:53.732656: | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 Oct 31 15:24:53.732659: | 8a 82 25 f1 Oct 31 15:24:53.732662: | keyid: *AQO9bJbr3 Oct 31 15:24:53.732664: | size: 274 Oct 31 15:24:53.732665: | n Oct 31 15:24:53.732666: | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 Oct 31 15:24:53.732668: | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a Oct 31 15:24:53.732669: | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca Oct 31 15:24:53.732671: | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 Oct 31 15:24:53.732672: | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 Oct 31 15:24:53.732673: | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd Oct 31 15:24:53.732675: | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 Oct 31 15:24:53.732676: | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 Oct 31 15:24:53.732677: | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 Oct 31 15:24:53.732679: | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 Oct 31 15:24:53.732680: | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 Oct 31 15:24:53.732681: | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 Oct 31 15:24:53.732683: | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 Oct 31 15:24:53.732684: | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 Oct 31 15:24:53.732685: | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc Oct 31 15:24:53.732687: | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f Oct 31 15:24:53.732688: | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 Oct 31 15:24:53.732689: | 48 ef Oct 31 15:24:53.732690: | e Oct 31 15:24:53.732692: | 03 Oct 31 15:24:53.732693: | CKAID Oct 31 15:24:53.732694: | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 Oct 31 15:24:53.732696: | 8a 82 25 f1 Oct 31 15:24:53.732699: | saving right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 extracted from raw RSA public key Oct 31 15:24:53.732701: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:53.732735: | spent 0.0319 (0.032) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID Oct 31 15:24:53.732740: | no private key matching right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1: can't find the private key matching the NSS CKAID Oct 31 15:24:53.732741: | counting wild cards for @east is 0 Oct 31 15:24:53.732744: | updating connection from left.host_addr Oct 31 15:24:53.732746: | right host_nexthop 192.1.3.33 Oct 31 15:24:53.732750: | left host_port 500 Oct 31 15:24:53.732754: | updating connection from right.host_addr Oct 31 15:24:53.732758: | left host_nexthop 192.1.2.23 Oct 31 15:24:53.732760: | right host_port 500 Oct 31 15:24:53.732762: | orienting north-eastnets/0x2 Oct 31 15:24:53.732766: | north-eastnets/0x2 doesn't match 127.0.0.1:4500 at all Oct 31 15:24:53.732769: | north-eastnets/0x2 doesn't match 127.0.0.1:500 at all Oct 31 15:24:53.732772: | north-eastnets/0x2 doesn't match 192.0.3.254:4500 at all Oct 31 15:24:53.732776: | north-eastnets/0x2 doesn't match 192.0.3.254:500 at all Oct 31 15:24:53.732779: | north-eastnets/0x2 doesn't match 192.1.3.33:4500 at all Oct 31 15:24:53.732781: | oriented north-eastnets/0x2's this Oct 31 15:24:53.732786: | find_host_pair: comparing 192.1.3.33:500 to 192.1.2.23:500 but ignoring ports Oct 31 15:24:53.732790: | connect_to_host_pair: 192.1.3.33:500 192.1.2.23:500 -> hp@0x559bbabc22f0: north-eastnets/0x1 Oct 31 15:24:53.732793: added IKEv2 connection "north-eastnets/0x2" Oct 31 15:24:53.732803: | ike_life: 3600; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 Oct 31 15:24:53.732813: | 192.0.3.0/24===192.1.3.33<192.1.3.33>[@north]...192.1.2.23<192.1.2.23>[@east]===192.0.22.0/24 Oct 31 15:24:53.732816: | delref logger@0x559bbabc4050(1->0) (in add_connection() at connections.c:2026) Oct 31 15:24:53.732819: | delref fd@0x559bbabc3850(2->1) (in free_logger() at log.c:853) Oct 31 15:24:53.732821: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:53.732824: | delref fd@0x559bbabc3850(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.732835: | freeref fd-fd@0x559bbabc3850 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.732840: | spent 0.344 (0.347) milliseconds in whack Oct 31 15:24:53.732886: | newref struct fd@0x559bbabc3930(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.732890: | fd_accept: new fd-fd@0x559bbabc3930 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.732897: | whack: key Oct 31 15:24:53.732900: | delref pkp@0x559bbabc67a0(1->0) (in free_public_keyentry() at secrets.c:1591) Oct 31 15:24:53.732902: add keyid @north Oct 31 15:24:53.732904: | 01 03 e5 df 73 b6 3e d5 36 a8 f1 3d 0d d3 02 ab Oct 31 15:24:53.732906: | 7f ec 4c 9e 8b 0e 0e d2 cf 0f 59 bf 6d 88 21 86 Oct 31 15:24:53.732907: | 93 9e 10 34 af 2d cf b3 7e eb e5 b2 24 b2 a5 b0 Oct 31 15:24:53.732908: | 01 03 7d b5 96 ad 66 ee 48 c2 28 d9 9a 76 36 a9 Oct 31 15:24:53.732910: | 10 84 b5 09 8f 17 4f 65 ce d8 2f 8e 78 80 8a 87 Oct 31 15:24:53.732911: | f4 6b 98 d9 91 94 6b 52 15 5b 9c 47 12 be d8 6f Oct 31 15:24:53.732912: | 25 b4 65 38 7e e4 8d c7 f0 58 d3 9f 69 14 cc 3e Oct 31 15:24:53.732914: | c8 16 1f af bb 5d 93 2b 33 39 0e 94 55 81 f4 b3 Oct 31 15:24:53.732915: | cc 92 58 6e 4a 5a 4e c3 76 ab 04 2e 11 08 06 55 Oct 31 15:24:53.732916: | 13 0f 02 6c dd d1 bc c0 b8 8d 65 f5 97 ed fc 18 Oct 31 15:24:53.732918: | 39 f9 55 ab fa 0d c5 49 99 7f 1b cf c3 de 99 7d Oct 31 15:24:53.732919: | 9e ca 6f 9e 14 d6 5a ff de d6 4f 57 6a 83 ab 51 Oct 31 15:24:53.732920: | ba 64 74 e0 22 e9 9a c5 10 71 bb d4 eb a4 99 28 Oct 31 15:24:53.732922: | 9c 85 0e 31 ea cc ab ef 98 84 3f 59 c1 75 aa b3 Oct 31 15:24:53.732923: | 61 eb 61 8c 58 a5 92 25 84 ad c7 79 f3 87 d0 c7 Oct 31 15:24:53.732924: | 83 c2 d6 8a fe 26 9d 2a ff b1 dd 9b 89 21 7c ca Oct 31 15:24:53.732926: | f5 38 2d 3f 64 0c 41 9c 34 e9 b2 55 0f 82 1a b3 Oct 31 15:24:53.732927: | c7 5e a5 99 Oct 31 15:24:53.732933: | computed rsa CKAID Oct 31 15:24:53.732935: | 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f Oct 31 15:24:53.732936: | 88 aa 7c 5d Oct 31 15:24:53.732939: | keyid: *AQPl33O2P Oct 31 15:24:53.732941: | size: 274 Oct 31 15:24:53.732942: | n Oct 31 15:24:53.732944: | e5 df 73 b6 3e d5 36 a8 f1 3d 0d d3 02 ab 7f ec Oct 31 15:24:53.732945: | 4c 9e 8b 0e 0e d2 cf 0f 59 bf 6d 88 21 86 93 9e Oct 31 15:24:53.732946: | 10 34 af 2d cf b3 7e eb e5 b2 24 b2 a5 b0 01 03 Oct 31 15:24:53.732948: | 7d b5 96 ad 66 ee 48 c2 28 d9 9a 76 36 a9 10 84 Oct 31 15:24:53.732949: | b5 09 8f 17 4f 65 ce d8 2f 8e 78 80 8a 87 f4 6b Oct 31 15:24:53.732950: | 98 d9 91 94 6b 52 15 5b 9c 47 12 be d8 6f 25 b4 Oct 31 15:24:53.732952: | 65 38 7e e4 8d c7 f0 58 d3 9f 69 14 cc 3e c8 16 Oct 31 15:24:53.732953: | 1f af bb 5d 93 2b 33 39 0e 94 55 81 f4 b3 cc 92 Oct 31 15:24:53.732954: | 58 6e 4a 5a 4e c3 76 ab 04 2e 11 08 06 55 13 0f Oct 31 15:24:53.732956: | 02 6c dd d1 bc c0 b8 8d 65 f5 97 ed fc 18 39 f9 Oct 31 15:24:53.732957: | 55 ab fa 0d c5 49 99 7f 1b cf c3 de 99 7d 9e ca Oct 31 15:24:53.732958: | 6f 9e 14 d6 5a ff de d6 4f 57 6a 83 ab 51 ba 64 Oct 31 15:24:53.732960: | 74 e0 22 e9 9a c5 10 71 bb d4 eb a4 99 28 9c 85 Oct 31 15:24:53.732961: | 0e 31 ea cc ab ef 98 84 3f 59 c1 75 aa b3 61 eb Oct 31 15:24:53.732962: | 61 8c 58 a5 92 25 84 ad c7 79 f3 87 d0 c7 83 c2 Oct 31 15:24:53.732963: | d6 8a fe 26 9d 2a ff b1 dd 9b 89 21 7c ca f5 38 Oct 31 15:24:53.732965: | 2d 3f 64 0c 41 9c 34 e9 b2 55 0f 82 1a b3 c7 5e Oct 31 15:24:53.732966: | a5 99 Oct 31 15:24:53.732967: | e Oct 31 15:24:53.732969: | 03 Oct 31 15:24:53.732970: | CKAID Oct 31 15:24:53.732971: | 90 5d fc a1 08 68 74 7c 6f 20 d3 1b 2d 20 4b 8f Oct 31 15:24:53.732973: | 88 aa 7c 5d Oct 31 15:24:53.732975: | newref struct pubkey@0x559bbabc6ba0(0->1) (in add_public_key() at secrets.c:1716) Oct 31 15:24:53.732977: | addref pk@0x559bbabc6ba0(1->2) (in add_public_key() at secrets.c:1718) Oct 31 15:24:53.732978: | delref pkp@0x559bbabc6ba0(2->1) (in key_add_request() at rcv_whack.c:341) Oct 31 15:24:53.732987: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:53.732988: | matched Oct 31 15:24:53.732990: | secrets entry for ckaid already exists Oct 31 15:24:53.732993: | spent 0.0054 (0.00529) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID Oct 31 15:24:53.732995: | delref fd@0x559bbabc3930(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.733000: | freeref fd-fd@0x559bbabc3930 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.733003: | spent 0.122 (0.122) milliseconds in whack Oct 31 15:24:53.733041: | newref struct fd@0x559bbabc6c90(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.733044: | fd_accept: new fd-fd@0x559bbabc6c90 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.733051: | whack: key Oct 31 15:24:53.733055: | delref pkp@0x559bbabc68b0(1->0) (in free_public_keyentry() at secrets.c:1591) Oct 31 15:24:53.733058: add keyid @east Oct 31 15:24:53.733060: | 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b Oct 31 15:24:53.733062: | e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 Oct 31 15:24:53.733064: | 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c Oct 31 15:24:53.733066: | 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 Oct 31 15:24:53.733068: | 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d Oct 31 15:24:53.733070: | d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 Oct 31 15:24:53.733072: | 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce Oct 31 15:24:53.733074: | 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e Oct 31 15:24:53.733076: | bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d Oct 31 15:24:53.733078: | ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce Oct 31 15:24:53.733080: | e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a Oct 31 15:24:53.733082: | 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 Oct 31 15:24:53.733084: | 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 Oct 31 15:24:53.733086: | 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 Oct 31 15:24:53.733088: | d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c Oct 31 15:24:53.733090: | 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 Oct 31 15:24:53.733091: | 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 Oct 31 15:24:53.733093: | 51 51 48 ef Oct 31 15:24:53.733101: | computed rsa CKAID Oct 31 15:24:53.733103: | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 Oct 31 15:24:53.733105: | 8a 82 25 f1 Oct 31 15:24:53.733109: | keyid: *AQO9bJbr3 Oct 31 15:24:53.733112: | size: 274 Oct 31 15:24:53.733113: | n Oct 31 15:24:53.733115: | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 Oct 31 15:24:53.733117: | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a Oct 31 15:24:53.733119: | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca Oct 31 15:24:53.733121: | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 Oct 31 15:24:53.733123: | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 Oct 31 15:24:53.733125: | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd Oct 31 15:24:53.733127: | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 Oct 31 15:24:53.733129: | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 Oct 31 15:24:53.733131: | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 Oct 31 15:24:53.733133: | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 Oct 31 15:24:53.733135: | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 Oct 31 15:24:53.733137: | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 Oct 31 15:24:53.733138: | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 Oct 31 15:24:53.733139: | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 Oct 31 15:24:53.733141: | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc Oct 31 15:24:53.733142: | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f Oct 31 15:24:53.733143: | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 Oct 31 15:24:53.733145: | 48 ef Oct 31 15:24:53.733146: | e Oct 31 15:24:53.733147: | 03 Oct 31 15:24:53.733149: | CKAID Oct 31 15:24:53.733151: | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 Oct 31 15:24:53.733153: | 8a 82 25 f1 Oct 31 15:24:53.733155: | newref struct pubkey@0x559bbabc5ab0(0->1) (in add_public_key() at secrets.c:1716) Oct 31 15:24:53.733157: | addref pk@0x559bbabc5ab0(1->2) (in add_public_key() at secrets.c:1718) Oct 31 15:24:53.733159: | delref pkp@0x559bbabc5ab0(2->1) (in key_add_request() at rcv_whack.c:341) Oct 31 15:24:53.733161: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:53.733195: | spent 0.0322 (0.0322) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID Oct 31 15:24:53.733202: | no private key: can't find the private key matching the NSS CKAID Oct 31 15:24:53.733210: | delref fd@0x559bbabc6c90(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.733217: | freeref fd-fd@0x559bbabc6c90 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.733221: | spent 0.182 (0.184) milliseconds in whack Oct 31 15:24:53.794880: | newref struct fd@0x559bbabc6aa0(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.794892: | fd_accept: new fd-fd@0x559bbabc6aa0 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:24:53.794905: | whack: initiate Oct 31 15:24:53.794910: | FOR_EACH_CONNECTION_... in conn_by_name Oct 31 15:24:53.794913: initiating all conns with alias='north-eastnets' Oct 31 15:24:53.794921: | FOR_EACH_CONNECTION_... in foreach_connection_by_alias Oct 31 15:24:53.794927: | connection 'north-eastnets/0x2' +POLICY_UP Oct 31 15:24:53.794929: | FOR_EACH_STATE_... in find_phase1_state Oct 31 15:24:53.794946: | newref alloc logger@0x559bbabb4330(0->1) (in new_state() at state.c:576) Oct 31 15:24:53.794949: | addref fd@0x559bbabc6aa0(1->2) (in new_state() at state.c:577) Oct 31 15:24:53.794951: | creating state object #1 at 0x559bbabc6f40 Oct 31 15:24:53.794954: | State DB: adding IKEv2 state #1 in UNDEFINED Oct 31 15:24:53.794963: | pstats #1 ikev2.ike started Oct 31 15:24:53.794966: | parent state #1: UNDEFINED(ignore) => PARENT_I0(ignore) Oct 31 15:24:53.794975: | #1.st_v2_transition NULL -> PARENT_I0->PARENT_I1 (in new_v2_ike_state() at state.c:620) Oct 31 15:24:53.794982: | Message ID: IKE #1 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744568.227774 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744568.227774 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 Oct 31 15:24:53.794987: | orienting north-eastnets/0x2 Oct 31 15:24:53.794992: | north-eastnets/0x2 doesn't match 127.0.0.1:4500 at all Oct 31 15:24:53.794995: | north-eastnets/0x2 doesn't match 127.0.0.1:500 at all Oct 31 15:24:53.794997: | north-eastnets/0x2 doesn't match 192.0.3.254:4500 at all Oct 31 15:24:53.795000: | north-eastnets/0x2 doesn't match 192.0.3.254:500 at all Oct 31 15:24:53.795003: | north-eastnets/0x2 doesn't match 192.1.3.33:4500 at all Oct 31 15:24:53.795005: | oriented north-eastnets/0x2's this Oct 31 15:24:53.795011: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:544) Oct 31 15:24:53.795015: | addref fd@0x559bbabc6aa0(2->3) (in add_pending() at pending.c:86) Oct 31 15:24:53.795018: | queuing pending IPsec SA negotiating with 192.1.2.23 IKE SA #1 "north-eastnets/0x2" Oct 31 15:24:53.795021: "north-eastnets/0x2" #1: initiating IKEv2 connection Oct 31 15:24:53.795027: | constructing local IKE proposals for north-eastnets/0x2 (IKE SA initiator selecting KE) Oct 31 15:24:53.795032: | converting ike_info AES_CBC_256-HMAC_SHA2_256-MODP2048 to ikev2 ... Oct 31 15:24:53.795038: | ... ikev2_proposal: 1:IKE=AES_CBC_256-HMAC_SHA2_256-HMAC_SHA2_256_128-MODP2048 Oct 31 15:24:53.795040: "north-eastnets/0x2": local IKE proposals (IKE SA initiator selecting KE): Oct 31 15:24:53.795043: "north-eastnets/0x2": 1:IKE=AES_CBC_256-HMAC_SHA2_256-HMAC_SHA2_256_128-MODP2048 Oct 31 15:24:53.795050: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:53.795052: | addref fd@0x559bbabc6aa0(3->4) (in clone_logger() at log.c:810) Oct 31 15:24:53.795057: | newref clone logger@0x559bbabc4000(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:53.795059: | job 1 for #1: ikev2_outI1 KE (build KE and nonce): adding job to queue Oct 31 15:24:53.795061: | state #1 has no .st_event to delete Oct 31 15:24:53.795064: | #1 STATE_PARENT_I0: retransmits: cleared Oct 31 15:24:53.795066: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc32a0 Oct 31 15:24:53.795068: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 Oct 31 15:24:53.795071: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:24:53.795085: | #1 spent 0.155 (0.155) milliseconds in ikev2_parent_outI1() Oct 31 15:24:53.795089: | RESET processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:640) Oct 31 15:24:53.795092: | connection 'north-eastnets/0x1' +POLICY_UP Oct 31 15:24:53.795094: | FOR_EACH_STATE_... in find_phase1_state Oct 31 15:24:53.795098: | addref fd@0x559bbabc6aa0(4->5) (in add_pending() at pending.c:86) Oct 31 15:24:53.795093: | job 1 for #1: ikev2_outI1 KE (build KE and nonce): helper 1 starting job Oct 31 15:24:53.795108: | helper 1 is pausing for 1 seconds Oct 31 15:24:53.795101: "north-eastnets/0x1": queuing pending IPsec SA negotiating with 192.1.2.23 IKE SA #1 "north-eastnets/0x2" Oct 31 15:24:53.795129: | delref fd@0x559bbabc6aa0(5->4) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:24:53.795137: | spent 0.262 (0.267) milliseconds in whack Oct 31 15:24:54.031661: | spent 0.016 (0.0158) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:54.031735: | newref struct msg_digest@0x559bbabc87a0(0->1) (in read_message() at demux.c:103) Oct 31 15:24:54.031752: | newref alloc logger@0x559bbabb4380(0->1) (in read_message() at demux.c:103) Oct 31 15:24:54.031772: | *received 454 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:54.031781: | 39 a0 1b dc 13 1c ca 88 00 00 00 00 00 00 00 00 Oct 31 15:24:54.031788: | 21 20 22 08 00 00 00 00 00 00 01 c6 22 00 00 30 Oct 31 15:24:54.031795: | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c Oct 31 15:24:54.031802: | 80 0e 01 00 03 00 00 08 02 00 00 05 03 00 00 08 Oct 31 15:24:54.031808: | 03 00 00 0c 00 00 00 08 04 00 00 0e 28 00 01 08 Oct 31 15:24:54.031815: | 00 0e 00 00 4d 61 7b 57 e1 81 0e 19 19 c6 60 c2 Oct 31 15:24:54.031821: | 33 11 15 27 af 1f 43 c6 47 c6 90 fb 8e 36 6a e6 Oct 31 15:24:54.031829: | 01 7a 68 13 a6 0f 4f 11 44 30 90 26 67 bb c1 41 Oct 31 15:24:54.031838: | 13 28 ed e4 9a 1c 19 15 00 38 ce ac 46 e1 5e c0 Oct 31 15:24:54.031847: | 3a df a2 c4 90 f6 81 e1 c7 76 92 8e b3 2c 2d dc Oct 31 15:24:54.031857: | 03 a0 f5 64 6f 7e f3 12 8e 35 37 23 55 cb 8a 39 Oct 31 15:24:54.031866: | 2a 19 d4 0c aa 76 62 c6 cf 31 56 f2 8d 74 95 69 Oct 31 15:24:54.031875: | ef 73 86 32 ab ac 85 f5 67 fd ac d4 2d a2 ac 56 Oct 31 15:24:54.031884: | 85 ad c0 52 fa e9 02 38 3c 15 0a 11 67 eb 19 bf Oct 31 15:24:54.031893: | 42 61 c5 2f 60 4b b3 7c b1 0c 84 32 8c ba 37 8a Oct 31 15:24:54.031903: | 26 ce 65 60 25 af e5 6a c1 b0 64 87 b1 52 82 25 Oct 31 15:24:54.031913: | d8 df 8d ce ff 58 e4 ed 4e 0e 0e 18 d6 c2 8b 83 Oct 31 15:24:54.031923: | 5f 9e e7 6c a8 20 db c4 45 a6 a5 a4 b1 3f 02 f2 Oct 31 15:24:54.031933: | 5c 3f 68 d2 a4 4b 45 53 07 d6 a3 e5 b4 cb 84 27 Oct 31 15:24:54.031942: | 08 c4 aa 12 8f b5 12 b3 e2 e7 9e 5a 95 63 7b cd Oct 31 15:24:54.031952: | ee 06 bb b8 3d 64 fb ae cd cb 32 5b e3 0f fe af Oct 31 15:24:54.031961: | 7c d0 04 f5 29 00 00 24 c7 ab 3b 55 7c 29 81 36 Oct 31 15:24:54.031971: | e6 d7 1d ae c2 f5 a4 e1 50 94 30 d9 d7 92 32 e4 Oct 31 15:24:54.031982: | 77 14 37 1c 49 21 53 05 29 00 00 08 00 00 40 2e Oct 31 15:24:54.031992: | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 Oct 31 15:24:54.032001: | 00 1c 00 00 40 04 cd 8a 01 4e 16 66 df c8 51 92 Oct 31 15:24:54.032011: | 76 15 da 6e eb 50 cc 6f 43 f4 00 00 00 1c 00 00 Oct 31 15:24:54.032030: | 40 05 e1 ba 35 f4 2b e6 f9 be 8d f6 29 bc 76 66 Oct 31 15:24:54.032040: | 3e 05 93 21 9a 9a Oct 31 15:24:54.032070: | **parse ISAKMP Message: Oct 31 15:24:54.032094: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:54.032114: | responder SPI: 00 00 00 00 00 00 00 00 Oct 31 15:24:54.032126: | next payload type: ISAKMP_NEXT_v2SA (0x21) Oct 31 15:24:54.032139: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:54.032150: | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) Oct 31 15:24:54.032169: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:54.032186: | Message ID: 0 (00 00 00 00) Oct 31 15:24:54.032221: | length: 454 (00 00 01 c6) Oct 31 15:24:54.032247: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) Oct 31 15:24:54.032263: | I am the IKE SA Original Responder receiving an IKEv2 IKE_SA_INIT request Oct 31 15:24:54.032278: | State DB: IKEv2 state not found (find_v2_ike_sa_by_initiator_spi) Oct 31 15:24:54.032293: | Now let's proceed with payload (ISAKMP_NEXT_v2SA) Oct 31 15:24:54.032308: | ***parse IKEv2 Security Association Payload: Oct 31 15:24:54.032321: | next payload type: ISAKMP_NEXT_v2KE (0x22) Oct 31 15:24:54.032332: | flags: none (0x0) Oct 31 15:24:54.032364: | length: 48 (00 30) Oct 31 15:24:54.032394: | processing payload: ISAKMP_NEXT_v2SA (len=44) Oct 31 15:24:54.032410: | Now let's proceed with payload (ISAKMP_NEXT_v2KE) Oct 31 15:24:54.032428: | ***parse IKEv2 Key Exchange Payload: Oct 31 15:24:54.032441: | next payload type: ISAKMP_NEXT_v2Ni (0x28) Oct 31 15:24:54.032455: | flags: none (0x0) Oct 31 15:24:54.032472: | length: 264 (01 08) Oct 31 15:24:54.032487: | DH group: OAKLEY_GROUP_MODP2048 (0xe) Oct 31 15:24:54.032501: | processing payload: ISAKMP_NEXT_v2KE (len=256) Oct 31 15:24:54.032514: | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) Oct 31 15:24:54.032529: | ***parse IKEv2 Nonce Payload: Oct 31 15:24:54.032542: | next payload type: ISAKMP_NEXT_v2N (0x29) Oct 31 15:24:54.032555: | flags: none (0x0) Oct 31 15:24:54.032572: | length: 36 (00 24) Oct 31 15:24:54.032600: | processing payload: ISAKMP_NEXT_v2Ni (len=32) Oct 31 15:24:54.032616: | Now let's proceed with payload (ISAKMP_NEXT_v2N) Oct 31 15:24:54.032631: | ***parse IKEv2 Notify Payload: Oct 31 15:24:54.032643: | next payload type: ISAKMP_NEXT_v2N (0x29) Oct 31 15:24:54.032654: | flags: none (0x0) Oct 31 15:24:54.032670: | length: 8 (00 08) Oct 31 15:24:54.032683: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.032697: | SPI size: 0 (00) Oct 31 15:24:54.032709: | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) Oct 31 15:24:54.032722: | processing payload: ISAKMP_NEXT_v2N (len=0) Oct 31 15:24:54.032734: | Now let's proceed with payload (ISAKMP_NEXT_v2N) Oct 31 15:24:54.032749: | ***parse IKEv2 Notify Payload: Oct 31 15:24:54.032761: | next payload type: ISAKMP_NEXT_v2N (0x29) Oct 31 15:24:54.032773: | flags: none (0x0) Oct 31 15:24:54.032789: | length: 14 (00 0e) Oct 31 15:24:54.032801: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.032815: | SPI size: 0 (00) Oct 31 15:24:54.032827: | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) Oct 31 15:24:54.032840: | processing payload: ISAKMP_NEXT_v2N (len=6) Oct 31 15:24:54.032852: | Now let's proceed with payload (ISAKMP_NEXT_v2N) Oct 31 15:24:54.032865: | ***parse IKEv2 Notify Payload: Oct 31 15:24:54.032878: | next payload type: ISAKMP_NEXT_v2N (0x29) Oct 31 15:24:54.032890: | flags: none (0x0) Oct 31 15:24:54.032904: | length: 28 (00 1c) Oct 31 15:24:54.032917: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.032930: | SPI size: 0 (00) Oct 31 15:24:54.032943: | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) Oct 31 15:24:54.032955: | processing payload: ISAKMP_NEXT_v2N (len=20) Oct 31 15:24:54.032967: | Now let's proceed with payload (ISAKMP_NEXT_v2N) Oct 31 15:24:54.032981: | ***parse IKEv2 Notify Payload: Oct 31 15:24:54.032993: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.033015: | flags: none (0x0) Oct 31 15:24:54.033032: | length: 28 (00 1c) Oct 31 15:24:54.033045: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.033059: | SPI size: 0 (00) Oct 31 15:24:54.033071: | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) Oct 31 15:24:54.033083: | processing payload: ISAKMP_NEXT_v2N (len=20) Oct 31 15:24:54.033097: | DDOS disabled and no cookie sent, continuing Oct 31 15:24:54.033110: | looking for message matching transition from STATE_PARENT_R0 Oct 31 15:24:54.033121: | trying Respond to IKE_SA_INIT Oct 31 15:24:54.033133: | matched unencrypted message Oct 31 15:24:54.033164: | find_host_connection local=192.1.3.33:500 remote=192.1.2.23:500 policy=ECDSA+IKEV2_ALLOW but ignoring ports Oct 31 15:24:54.033194: | find_host_pair: comparing 192.1.3.33:500 to 192.1.2.23:500 but ignoring ports Oct 31 15:24:54.033243: | find_next_host_connection policy=ECDSA+IKEV2_ALLOW Oct 31 15:24:54.033261: | found policy = RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 (north-eastnets/0x2) Oct 31 15:24:54.033274: | find_next_host_connection returns "north-eastnets/0x2" Oct 31 15:24:54.033286: | find_next_host_connection policy=ECDSA+IKEV2_ALLOW Oct 31 15:24:54.033301: | found policy = RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 (north-eastnets/0x1) Oct 31 15:24:54.033314: | find_next_host_connection returns "north-eastnets/0x1" Oct 31 15:24:54.033326: | find_next_host_connection policy=ECDSA+IKEV2_ALLOW Oct 31 15:24:54.033337: | find_next_host_connection returns Oct 31 15:24:54.033353: | found connection: "north-eastnets/0x2" with policy ECDSA+IKEV2_ALLOW Oct 31 15:24:54.033435: | newref alloc logger@0x559bbabb43d0(0->1) (in new_state() at state.c:576) Oct 31 15:24:54.033453: | addref fd@NULL (in new_state() at state.c:577) Oct 31 15:24:54.033467: | creating state object #2 at 0x559bbabc9f80 Oct 31 15:24:54.033480: | State DB: adding IKEv2 state #2 in UNDEFINED Oct 31 15:24:54.033519: | pstats #2 ikev2.ike started Oct 31 15:24:54.033536: | parent state #2: UNDEFINED(ignore) => PARENT_R0(half-open IKE SA) Oct 31 15:24:54.033555: | #2.st_v2_transition NULL -> PARENT_R0->PARENT_R1 (in new_v2_ike_state() at state.c:620) Oct 31 15:24:54.033598: | Message ID: IKE #2 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744568.466363 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744568.466363 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 Oct 31 15:24:54.033616: | orienting north-eastnets/0x2 Oct 31 15:24:54.033637: | north-eastnets/0x2 doesn't match 127.0.0.1:4500 at all Oct 31 15:24:54.033655: | north-eastnets/0x2 doesn't match 127.0.0.1:500 at all Oct 31 15:24:54.033670: | north-eastnets/0x2 doesn't match 192.0.3.254:4500 at all Oct 31 15:24:54.033685: | north-eastnets/0x2 doesn't match 192.0.3.254:500 at all Oct 31 15:24:54.033702: | north-eastnets/0x2 doesn't match 192.1.3.33:4500 at all Oct 31 15:24:54.033714: | oriented north-eastnets/0x2's this Oct 31 15:24:54.033739: | #2 spent 2.09 (2.12) milliseconds Oct 31 15:24:54.033763: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1758) Oct 31 15:24:54.033793: | Message ID: IKE #2 responder starting message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.466363 ike.wip.initiator=-1 ike.wip.responder=-1->0 Oct 31 15:24:54.033806: | calling processor Respond to IKE_SA_INIT Oct 31 15:24:54.033827: | #2 spent 2.18 (2.21) milliseconds Oct 31 15:24:54.033853: | #2 updating local interface from 192.1.3.33:500 to 192.1.3.33:500 using md->iface (in update_ike_endpoints() at state.c:2631) Oct 31 15:24:54.033879: | using existing local IKE proposals for connection north-eastnets/0x2 (IKE SA responder matching remote proposals): 1:IKE=AES_CBC_256-HMAC_SHA2_256-HMAC_SHA2_256_128-MODP2048 Oct 31 15:24:54.033904: | comparing remote proposals against IKE responder 1 local proposals Oct 31 15:24:54.033922: | local proposal 1 type ENCR has 1 transforms Oct 31 15:24:54.033934: | local proposal 1 type PRF has 1 transforms Oct 31 15:24:54.033945: | local proposal 1 type INTEG has 1 transforms Oct 31 15:24:54.033956: | local proposal 1 type DH has 1 transforms Oct 31 15:24:54.033967: | local proposal 1 type ESN has 0 transforms Oct 31 15:24:54.033983: | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none Oct 31 15:24:54.033999: | ****parse IKEv2 Proposal Substructure Payload: Oct 31 15:24:54.034011: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:54.034027: | length: 44 (00 2c) Oct 31 15:24:54.034037: | prop #: 1 (01) Oct 31 15:24:54.034045: | proto ID: IKEv2_SEC_PROTO_IKE (0x1) Oct 31 15:24:54.034053: | spi size: 0 (00) Oct 31 15:24:54.034062: | # transforms: 4 (04) Oct 31 15:24:54.034073: | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals Oct 31 15:24:54.034082: | *****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:54.034090: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.034099: | length: 12 (00 0c) Oct 31 15:24:54.034106: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:54.034114: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:54.034122: | ******parse IKEv2 Attribute Substructure Payload: Oct 31 15:24:54.034130: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:54.034140: | length/value: 256 (01 00) Oct 31 15:24:54.034153: | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 Oct 31 15:24:54.034165: | *****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:54.034177: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.034189: | length: 8 (00 08) Oct 31 15:24:54.034214: | IKEv2 transform type: TRANS_TYPE_PRF (0x2) Oct 31 15:24:54.034239: | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) Oct 31 15:24:54.034256: | remote proposal 1 transform 1 (PRF=HMAC_SHA2_256) matches local proposal 1 type 2 (PRF) transform 0 Oct 31 15:24:54.034269: | *****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:54.034280: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.034294: | length: 8 (00 08) Oct 31 15:24:54.034305: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:54.034315: | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) Oct 31 15:24:54.034331: | remote proposal 1 transform 2 (INTEG=HMAC_SHA2_256_128) matches local proposal 1 type 3 (INTEG) transform 0 Oct 31 15:24:54.034344: | *****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:54.034356: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:54.034369: | length: 8 (00 08) Oct 31 15:24:54.034380: | IKEv2 transform type: TRANS_TYPE_DH (0x4) Oct 31 15:24:54.034391: | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) Oct 31 15:24:54.034405: | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 Oct 31 15:24:54.034422: | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none Oct 31 15:24:54.034436: | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH Oct 31 15:24:54.034444: | remote proposal 1 matches local proposal 1 Oct 31 15:24:54.034463: "north-eastnets/0x2" #2: proposal 1:IKE=AES_CBC_256-HMAC_SHA2_256-HMAC_SHA2_256_128-MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_256;INTEG=HMAC_SHA2_256_128;DH=MODP2048[first-match] Oct 31 15:24:54.034477: | accepted IKE proposal ikev2_proposal: 1:IKE=AES_CBC_256-HMAC_SHA2_256-HMAC_SHA2_256_128-MODP2048 Oct 31 15:24:54.034485: | converting proposal to internal trans attrs Oct 31 15:24:54.034500: | nat: IKE.SPIr is zero Oct 31 15:24:54.034540: | natd_hash: hasher=0x559bb90d5f80(20) Oct 31 15:24:54.034556: | natd_hash: icookie= Oct 31 15:24:54.034563: | 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:54.034570: | natd_hash: rcookie= Oct 31 15:24:54.034576: | 00 00 00 00 00 00 00 00 Oct 31 15:24:54.034583: | natd_hash: ip= Oct 31 15:24:54.034590: | c0 01 03 21 Oct 31 15:24:54.034596: | natd_hash: port= Oct 31 15:24:54.034603: | 01 f4 Oct 31 15:24:54.034609: | natd_hash: hash= Oct 31 15:24:54.034617: | e1 ba 35 f4 2b e6 f9 be 8d f6 29 bc 76 66 3e 05 Oct 31 15:24:54.034624: | 93 21 9a 9a Oct 31 15:24:54.034630: | nat: IKE.SPIr is zero Oct 31 15:24:54.034647: | natd_hash: hasher=0x559bb90d5f80(20) Oct 31 15:24:54.034654: | natd_hash: icookie= Oct 31 15:24:54.034661: | 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:54.034667: | natd_hash: rcookie= Oct 31 15:24:54.034674: | 00 00 00 00 00 00 00 00 Oct 31 15:24:54.034680: | natd_hash: ip= Oct 31 15:24:54.034687: | c0 01 02 17 Oct 31 15:24:54.034693: | natd_hash: port= Oct 31 15:24:54.034700: | 01 f4 Oct 31 15:24:54.034706: | natd_hash: hash= Oct 31 15:24:54.034713: | cd 8a 01 4e 16 66 df c8 51 92 76 15 da 6e eb 50 Oct 31 15:24:54.034720: | cc 6f 43 f4 Oct 31 15:24:54.034728: | NAT_TRAVERSAL encaps using auto-detect Oct 31 15:24:54.034734: | NAT_TRAVERSAL this end is NOT behind NAT Oct 31 15:24:54.034741: | NAT_TRAVERSAL that end is NOT behind NAT Oct 31 15:24:54.034751: | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 Oct 31 15:24:54.034760: | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) Oct 31 15:24:54.034767: | hash algorithm identifier (network ordered) Oct 31 15:24:54.034773: | 00 02 Oct 31 15:24:54.034780: | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy Oct 31 15:24:54.034788: | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) Oct 31 15:24:54.034794: | hash algorithm identifier (network ordered) Oct 31 15:24:54.034801: | 00 03 Oct 31 15:24:54.034807: | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy Oct 31 15:24:54.034814: | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) Oct 31 15:24:54.034821: | hash algorithm identifier (network ordered) Oct 31 15:24:54.034827: | 00 04 Oct 31 15:24:54.034834: | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy Oct 31 15:24:54.034858: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:54.034865: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:24:54.034876: | newref clone logger@0x559bbabb42e0(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:54.034884: | job 2 for #2: ikev2_inI1outR1 KE (build KE and nonce): adding job to queue Oct 31 15:24:54.034892: | state #2 has no .st_event to delete Oct 31 15:24:54.034901: | #2 STATE_PARENT_R0: retransmits: cleared Oct 31 15:24:54.034909: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3410 Oct 31 15:24:54.034919: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 Oct 31 15:24:54.034928: | libevent_malloc: newref ptr-libevent@0x559bbabc3340 size 128 Oct 31 15:24:54.034969: | #2 spent 1.13 (1.14) milliseconds in processing: Respond to IKE_SA_INIT in v2_dispatch() Oct 31 15:24:54.034989: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:54.035005: | job 2 for #2: ikev2_inI1outR1 KE (build KE and nonce): helper 7 starting job Oct 31 15:24:54.035023: | #2 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_SUSPEND Oct 31 15:24:54.035056: | helper 7 is pausing for 1 seconds Oct 31 15:24:54.035086: | suspending state #2 and saving MD 0x559bbabc87a0 Oct 31 15:24:54.035140: | addref md@0x559bbabc87a0(1->2) (in complete_v2_state_transition() at ikev2.c:3485) Oct 31 15:24:54.035155: | #2 is busy; has suspended MD 0x559bbabc87a0 Oct 31 15:24:54.035181: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1760) Oct 31 15:24:54.035261: | #2 spent 3.52 (3.59) milliseconds in ikev2_process_packet() Oct 31 15:24:54.035290: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:54.035300: | delref mdp@0x559bbabc87a0(2->1) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:54.035315: | spent 3.58 (3.71) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:54.796397: | "north-eastnets/0x2" #1: spent 1.2 (1e+03) milliseconds in helper 1 processing job 1 for state #1: ikev2_outI1 KE (pcr) Oct 31 15:24:54.796411: | job 1 for #1: ikev2_outI1 KE (build KE and nonce): helper thread 1 sending result back to state Oct 31 15:24:54.796415: | scheduling resume sending helper answer back to state for #1 Oct 31 15:24:54.796419: | libevent_malloc: newref ptr-libevent@0x7f32c8002790 size 128 Oct 31 15:24:54.796431: | helper thread 1 has nothing to do Oct 31 15:24:54.796444: | processing resume sending helper answer back to state for #1 Oct 31 15:24:54.796454: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:54.796459: | unsuspending #1 MD (nil) Oct 31 15:24:54.796462: | job 1 for #1: ikev2_outI1 KE (build KE and nonce): processing response from helper 1 Oct 31 15:24:54.796464: | job 1 for #1: ikev2_outI1 KE (build KE and nonce): calling continuation function 0x559bb8fe3fe7 Oct 31 15:24:54.796468: | ikev2_parent_outI1_continue() for #1 STATE_PARENT_I0 Oct 31 15:24:54.796472: | DH secret MODP2048@0x7f32c8002b70: transferring ownership from helper KE to state #1 Oct 31 15:24:54.796502: | opening output PBS reply packet Oct 31 15:24:54.796506: | **emit ISAKMP Message: Oct 31 15:24:54.796512: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:24:54.796516: | responder SPI: 00 00 00 00 00 00 00 00 Oct 31 15:24:54.796519: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:24:54.796522: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:54.796525: | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) Oct 31 15:24:54.796528: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:54.796531: | Message ID: 0 (00 00 00 00) Oct 31 15:24:54.796534: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:24:54.796543: | using existing local IKE proposals for connection north-eastnets/0x2 (IKE SA initiator emitting local proposals): 1:IKE=AES_CBC_256-HMAC_SHA2_256-HMAC_SHA2_256_128-MODP2048 Oct 31 15:24:54.796546: | Emitting ikev2_proposals ... Oct 31 15:24:54.796549: | ***emit IKEv2 Security Association Payload: Oct 31 15:24:54.796552: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.796554: | flags: none (0x0) Oct 31 15:24:54.796557: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) Oct 31 15:24:54.796559: | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' Oct 31 15:24:54.796564: | ****emit IKEv2 Proposal Substructure Payload: Oct 31 15:24:54.796566: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:54.796568: | prop #: 1 (01) Oct 31 15:24:54.796569: | proto ID: IKEv2_SEC_PROTO_IKE (0x1) Oct 31 15:24:54.796571: | spi size: 0 (00) Oct 31 15:24:54.796574: | # transforms: 4 (04) Oct 31 15:24:54.796576: | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' Oct 31 15:24:54.796583: | *****emit IKEv2 Transform Substructure Payload: Oct 31 15:24:54.796586: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.796588: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:54.796591: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:54.796594: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:54.796597: | ******emit IKEv2 Attribute Substructure Payload: Oct 31 15:24:54.796599: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:54.796606: | length/value: 256 (01 00) Oct 31 15:24:54.796609: | emitting length of IKEv2 Transform Substructure Payload: 12 Oct 31 15:24:54.796612: | *****emit IKEv2 Transform Substructure Payload: Oct 31 15:24:54.796615: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.796618: | IKEv2 transform type: TRANS_TYPE_PRF (0x2) Oct 31 15:24:54.796620: | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) Oct 31 15:24:54.796624: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.796626: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:54.796629: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:54.796631: | *****emit IKEv2 Transform Substructure Payload: Oct 31 15:24:54.796632: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.796634: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:54.796635: | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) Oct 31 15:24:54.796637: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.796638: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:54.796640: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:54.796641: | *****emit IKEv2 Transform Substructure Payload: Oct 31 15:24:54.796643: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:54.796644: | IKEv2 transform type: TRANS_TYPE_DH (0x4) Oct 31 15:24:54.796646: | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) Oct 31 15:24:54.796647: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.796649: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:54.796650: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:54.796652: | emitting length of IKEv2 Proposal Substructure Payload: 44 Oct 31 15:24:54.796653: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 Oct 31 15:24:54.796655: | emitting length of IKEv2 Security Association Payload: 48 Oct 31 15:24:54.796656: | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 Oct 31 15:24:54.796658: | ***emit IKEv2 Key Exchange Payload: Oct 31 15:24:54.796659: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.796661: | flags: none (0x0) Oct 31 15:24:54.796662: | DH group: OAKLEY_GROUP_MODP2048 (0xe) Oct 31 15:24:54.796664: | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) Oct 31 15:24:54.796665: | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' Oct 31 15:24:54.796668: | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload Oct 31 15:24:54.796669: | ikev2 g^x: Oct 31 15:24:54.796672: | dd 22 5b 2d 0f 1c fd dc 7b 30 39 c8 2b f3 39 c4 Oct 31 15:24:54.796676: | b2 d0 da 68 a0 b5 20 fe b7 a8 07 3e 0b de 79 2d Oct 31 15:24:54.796680: | 75 90 8a 7f 53 d2 d6 d1 01 f1 27 0e f5 36 66 28 Oct 31 15:24:54.796682: | be 89 94 35 91 04 fa 3c ef 43 e4 d0 f4 7e 92 8d Oct 31 15:24:54.796684: | 9b 53 15 3e 98 9a 30 81 e0 8f ff 4d d3 ee 0b 5e Oct 31 15:24:54.796686: | c8 f2 ca b7 25 57 66 5c ad cd bc 39 cf 6e 66 5b Oct 31 15:24:54.796689: | 15 3e 52 6a 00 cf ec 67 c9 5e 14 64 b5 77 4f 61 Oct 31 15:24:54.796693: | 46 f6 7a c1 33 4a 98 00 a2 4d 5e 15 ee a6 fe 0a Oct 31 15:24:54.796696: | e2 52 2b a3 e1 7c 2c 2f e4 fb 98 8c bb 03 cf dd Oct 31 15:24:54.796698: | d9 c9 ee 2a 63 e8 19 42 17 b4 18 6c ac 41 a9 9c Oct 31 15:24:54.796700: | ab 14 c8 65 c6 be fa d1 d1 7c af 1e 42 c8 d7 d8 Oct 31 15:24:54.796703: | 4f 06 a4 f4 57 e8 cb 51 4f 23 cf fc 83 f5 f6 ae Oct 31 15:24:54.796705: | 4f 9e c2 d7 e8 4b 74 b7 6b 68 ef a4 56 70 04 c3 Oct 31 15:24:54.796708: | 27 49 5b 73 35 8b 8c 6b 17 61 18 b6 17 f9 13 48 Oct 31 15:24:54.796710: | a9 0a be 43 a9 2c 29 db 60 3e 9d 16 b0 f4 0e 78 Oct 31 15:24:54.796712: | fe bb 09 33 ac 6a bd 9f a9 28 81 1f 28 4b 68 1c Oct 31 15:24:54.796715: | emitting length of IKEv2 Key Exchange Payload: 264 Oct 31 15:24:54.796718: | ***emit IKEv2 Nonce Payload: Oct 31 15:24:54.796721: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.796724: | flags: none (0x0) Oct 31 15:24:54.796726: | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) Oct 31 15:24:54.796728: | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' Oct 31 15:24:54.796730: | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload Oct 31 15:24:54.796731: | IKEv2 nonce: Oct 31 15:24:54.796733: | d4 54 5e 5f 6b 55 c1 ba f6 b1 b0 fd 37 92 8f 1c Oct 31 15:24:54.796734: | f9 e6 1d af 21 b5 a0 d1 03 1a 6f 08 51 6c 51 d2 Oct 31 15:24:54.796736: | emitting length of IKEv2 Nonce Payload: 36 Oct 31 15:24:54.796737: | adding a v2N Payload Oct 31 15:24:54.796739: | ***emit IKEv2 Notify Payload: Oct 31 15:24:54.796740: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.796742: | flags: none (0x0) Oct 31 15:24:54.796743: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.796745: | SPI size: 0 (00) Oct 31 15:24:54.796747: | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) Oct 31 15:24:54.796749: | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) Oct 31 15:24:54.796750: | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' Oct 31 15:24:54.796752: | emitting length of IKEv2 Notify Payload: 8 Oct 31 15:24:54.796754: | adding a v2N Payload Oct 31 15:24:54.796755: | ***emit IKEv2 Notify Payload: Oct 31 15:24:54.796756: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.796758: | flags: none (0x0) Oct 31 15:24:54.796759: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.796761: | SPI size: 0 (00) Oct 31 15:24:54.796762: | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) Oct 31 15:24:54.796764: | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) Oct 31 15:24:54.796765: | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' Oct 31 15:24:54.796767: | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload Oct 31 15:24:54.796769: | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 Oct 31 15:24:54.796771: | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload Oct 31 15:24:54.796772: | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 Oct 31 15:24:54.796774: | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload Oct 31 15:24:54.796775: | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 Oct 31 15:24:54.796777: | emitting length of IKEv2 Notify Payload: 14 Oct 31 15:24:54.796779: | NAT-Traversal support [enabled] add v2N payloads. Oct 31 15:24:54.796780: | nat: IKE.SPIr is zero Oct 31 15:24:54.796790: | natd_hash: hasher=0x559bb90d5f80(20) Oct 31 15:24:54.796791: | natd_hash: icookie= Oct 31 15:24:54.796793: | 2f db aa cf a4 4d 20 39 Oct 31 15:24:54.796796: | natd_hash: rcookie= Oct 31 15:24:54.796797: | 00 00 00 00 00 00 00 00 Oct 31 15:24:54.796798: | natd_hash: ip= Oct 31 15:24:54.796800: | c0 01 03 21 Oct 31 15:24:54.796801: | natd_hash: port= Oct 31 15:24:54.796802: | 01 f4 Oct 31 15:24:54.796804: | natd_hash: hash= Oct 31 15:24:54.796805: | 40 11 51 9b d0 4f 43 2a 8c 95 98 f6 5c 37 a3 12 Oct 31 15:24:54.796807: | 2e 60 9a 1e Oct 31 15:24:54.796808: | adding a v2N Payload Oct 31 15:24:54.796809: | ***emit IKEv2 Notify Payload: Oct 31 15:24:54.796811: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.796812: | flags: none (0x0) Oct 31 15:24:54.796814: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.796815: | SPI size: 0 (00) Oct 31 15:24:54.796817: | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) Oct 31 15:24:54.796818: | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) Oct 31 15:24:54.796820: | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' Oct 31 15:24:54.796822: | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload Oct 31 15:24:54.796823: | Notify data: Oct 31 15:24:54.796825: | 40 11 51 9b d0 4f 43 2a 8c 95 98 f6 5c 37 a3 12 Oct 31 15:24:54.796826: | 2e 60 9a 1e Oct 31 15:24:54.796827: | emitting length of IKEv2 Notify Payload: 28 Oct 31 15:24:54.796829: | nat: IKE.SPIr is zero Oct 31 15:24:54.796832: | natd_hash: hasher=0x559bb90d5f80(20) Oct 31 15:24:54.796834: | natd_hash: icookie= Oct 31 15:24:54.796835: | 2f db aa cf a4 4d 20 39 Oct 31 15:24:54.796836: | natd_hash: rcookie= Oct 31 15:24:54.796838: | 00 00 00 00 00 00 00 00 Oct 31 15:24:54.796839: | natd_hash: ip= Oct 31 15:24:54.796840: | c0 01 02 17 Oct 31 15:24:54.796842: | natd_hash: port= Oct 31 15:24:54.796843: | 01 f4 Oct 31 15:24:54.796844: | natd_hash: hash= Oct 31 15:24:54.796846: | ba e7 12 8f 9f 7b d4 70 60 7f 1e bc 2a 73 9c 9d Oct 31 15:24:54.796847: | 98 8b 88 df Oct 31 15:24:54.796848: | adding a v2N Payload Oct 31 15:24:54.796850: | ***emit IKEv2 Notify Payload: Oct 31 15:24:54.796851: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.796852: | flags: none (0x0) Oct 31 15:24:54.796854: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.796855: | SPI size: 0 (00) Oct 31 15:24:54.796857: | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) Oct 31 15:24:54.796858: | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) Oct 31 15:24:54.796860: | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' Oct 31 15:24:54.796862: | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload Oct 31 15:24:54.796863: | Notify data: Oct 31 15:24:54.796864: | ba e7 12 8f 9f 7b d4 70 60 7f 1e bc 2a 73 9c 9d Oct 31 15:24:54.796866: | 98 8b 88 df Oct 31 15:24:54.796867: | emitting length of IKEv2 Notify Payload: 28 Oct 31 15:24:54.796868: | emitting length of ISAKMP Message: 454 Oct 31 15:24:54.796873: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:54.796876: | #1 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK Oct 31 15:24:54.796878: | transitioning from state STATE_PARENT_I0 to state STATE_PARENT_I1 Oct 31 15:24:54.796880: | Message ID: updating counters for #1 Oct 31 15:24:54.796882: | Message ID: IKE #1 skipping update_recv as MD is fake Oct 31 15:24:54.796887: | Message ID: IKE #1 scheduling EVENT_RETRANSMIT: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744568.227774 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=0 ike.wip.responder=-1 Oct 31 15:24:54.796889: | event_schedule: newref EVENT_RETRANSMIT-pe@0x559bbabc3500 Oct 31 15:24:54.796891: | inserting event EVENT_RETRANSMIT, timeout in 0.05 seconds for #1 Oct 31 15:24:54.796894: | libevent_malloc: newref ptr-libevent@0x559bbabc3470 size 128 Oct 31 15:24:54.796897: | #1 STATE_PARENT_I0: retransmits: first event in 0.05 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744569.229685 Oct 31 15:24:54.796901: | Message ID: IKE #1 updating initiator sent message request 0: ike.initiator.sent=-1->0 ike.initiator.recv=-1 ike.initiator.last_contact=744568.227774 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1->0 ike.wip.responder=-1 Oct 31 15:24:54.796905: | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744568.227774 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=0 ike.wip.responder=-1 Oct 31 15:24:54.796907: | parent state #1: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) Oct 31 15:24:54.796909: | announcing the state transition Oct 31 15:24:54.796912: "north-eastnets/0x2" #1: sent IKE_SA_INIT request Oct 31 15:24:54.796928: | sending 454 bytes for STATE_PARENT_I0 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #1) Oct 31 15:24:54.796930: | 2f db aa cf a4 4d 20 39 00 00 00 00 00 00 00 00 Oct 31 15:24:54.796931: | 21 20 22 08 00 00 00 00 00 00 01 c6 22 00 00 30 Oct 31 15:24:54.796933: | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c Oct 31 15:24:54.796934: | 80 0e 01 00 03 00 00 08 02 00 00 05 03 00 00 08 Oct 31 15:24:54.796935: | 03 00 00 0c 00 00 00 08 04 00 00 0e 28 00 01 08 Oct 31 15:24:54.796937: | 00 0e 00 00 dd 22 5b 2d 0f 1c fd dc 7b 30 39 c8 Oct 31 15:24:54.796938: | 2b f3 39 c4 b2 d0 da 68 a0 b5 20 fe b7 a8 07 3e Oct 31 15:24:54.796939: | 0b de 79 2d 75 90 8a 7f 53 d2 d6 d1 01 f1 27 0e Oct 31 15:24:54.796941: | f5 36 66 28 be 89 94 35 91 04 fa 3c ef 43 e4 d0 Oct 31 15:24:54.796942: | f4 7e 92 8d 9b 53 15 3e 98 9a 30 81 e0 8f ff 4d Oct 31 15:24:54.796943: | d3 ee 0b 5e c8 f2 ca b7 25 57 66 5c ad cd bc 39 Oct 31 15:24:54.796945: | cf 6e 66 5b 15 3e 52 6a 00 cf ec 67 c9 5e 14 64 Oct 31 15:24:54.796946: | b5 77 4f 61 46 f6 7a c1 33 4a 98 00 a2 4d 5e 15 Oct 31 15:24:54.796947: | ee a6 fe 0a e2 52 2b a3 e1 7c 2c 2f e4 fb 98 8c Oct 31 15:24:54.796949: | bb 03 cf dd d9 c9 ee 2a 63 e8 19 42 17 b4 18 6c Oct 31 15:24:54.796950: | ac 41 a9 9c ab 14 c8 65 c6 be fa d1 d1 7c af 1e Oct 31 15:24:54.796951: | 42 c8 d7 d8 4f 06 a4 f4 57 e8 cb 51 4f 23 cf fc Oct 31 15:24:54.796953: | 83 f5 f6 ae 4f 9e c2 d7 e8 4b 74 b7 6b 68 ef a4 Oct 31 15:24:54.796954: | 56 70 04 c3 27 49 5b 73 35 8b 8c 6b 17 61 18 b6 Oct 31 15:24:54.796955: | 17 f9 13 48 a9 0a be 43 a9 2c 29 db 60 3e 9d 16 Oct 31 15:24:54.796957: | b0 f4 0e 78 fe bb 09 33 ac 6a bd 9f a9 28 81 1f Oct 31 15:24:54.796958: | 28 4b 68 1c 29 00 00 24 d4 54 5e 5f 6b 55 c1 ba Oct 31 15:24:54.796959: | f6 b1 b0 fd 37 92 8f 1c f9 e6 1d af 21 b5 a0 d1 Oct 31 15:24:54.796961: | 03 1a 6f 08 51 6c 51 d2 29 00 00 08 00 00 40 2e Oct 31 15:24:54.796962: | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 Oct 31 15:24:54.796963: | 00 1c 00 00 40 04 40 11 51 9b d0 4f 43 2a 8c 95 Oct 31 15:24:54.796965: | 98 f6 5c 37 a3 12 2e 60 9a 1e 00 00 00 1c 00 00 Oct 31 15:24:54.796966: | 40 05 ba e7 12 8f 9f 7b d4 70 60 7f 1e bc 2a 73 Oct 31 15:24:54.796967: | 9c 9d 98 8b 88 df Oct 31 15:24:54.797004: | sent 1 messages Oct 31 15:24:54.797006: | checking that a retransmit timeout_event was already Oct 31 15:24:54.797008: | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:54.797011: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:24:54.797013: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc32a0 Oct 31 15:24:54.797016: | delref logger@0x559bbabc4000(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:54.797018: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:54.797019: | delref fd@0x559bbabc6aa0(4->3) (in free_logger() at log.c:854) Oct 31 15:24:54.797024: | resume sending helper answer back to state for #1 suppresed complete_v2_state_transition() Oct 31 15:24:54.797026: | delref mdp@NULL (in resume_handler() at server.c:743) Oct 31 15:24:54.797030: | #1 spent 0.55 (0.571) milliseconds in resume sending helper answer back to state Oct 31 15:24:54.797033: | stop processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:54.797035: | libevent_free: delref ptr-libevent@0x7f32c8002790 Oct 31 15:24:54.799452: | spent 0.0021 (0.00209) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:54.799472: | newref struct msg_digest@0x559bbabcb9d0(0->1) (in read_message() at demux.c:103) Oct 31 15:24:54.799475: | newref alloc logger@0x559bbabc4000(0->1) (in read_message() at demux.c:103) Oct 31 15:24:54.799479: | *received 454 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:54.799481: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:54.799482: | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 Oct 31 15:24:54.799484: | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c Oct 31 15:24:54.799485: | 80 0e 01 00 03 00 00 08 02 00 00 05 03 00 00 08 Oct 31 15:24:54.799486: | 03 00 00 0c 00 00 00 08 04 00 00 0e 28 00 01 08 Oct 31 15:24:54.799488: | 00 0e 00 00 02 9c d5 f6 7c 65 ce 83 31 ff 86 fe Oct 31 15:24:54.799489: | 8f 24 c5 b6 5b 01 4a 2d a5 39 6c df d2 57 1f bf Oct 31 15:24:54.799490: | 5d 0a df 48 57 fc c5 47 86 93 5e b3 d8 a1 40 21 Oct 31 15:24:54.799492: | d6 5a 07 b7 ae a0 3b 51 cf 8a ab e2 21 be 1f eb Oct 31 15:24:54.799493: | ad d5 9f 7d 6c bf 2f 2a 0d e6 c4 f7 24 63 89 1a Oct 31 15:24:54.799494: | 9c c9 10 e2 fd 86 89 8b d5 0e b6 03 87 aa bc e5 Oct 31 15:24:54.799496: | 44 94 7e a8 38 2e 16 6d c9 c5 20 83 28 b8 e8 04 Oct 31 15:24:54.799497: | 0f fd 1a b1 65 d9 f6 cc b6 40 9c 54 d1 3c a0 45 Oct 31 15:24:54.799498: | 91 66 be f2 c3 db 56 3f a5 8e 9e 9d 70 5a 9b 2d Oct 31 15:24:54.799500: | 0d 31 c8 c7 1f 6a 69 3f 6b f8 a4 3b 12 88 66 13 Oct 31 15:24:54.799514: | 5b ad 56 f1 aa 9f 5b f5 e4 fd 15 01 ab ff b0 85 Oct 31 15:24:54.799515: | 99 a0 25 fe 19 52 3f 23 1f fd ee ed dd 43 74 74 Oct 31 15:24:54.799516: | 92 32 32 27 86 ac ad 43 6c fd bd a7 6a ea 12 44 Oct 31 15:24:54.799518: | 43 24 c8 34 95 d3 9d c9 83 d5 31 63 18 c2 07 cd Oct 31 15:24:54.799519: | 47 53 d7 b4 d0 d1 c8 d1 4f 6f 92 74 4a 29 e4 bf Oct 31 15:24:54.799520: | 94 27 bc dc 25 d1 c7 52 6b 50 ca 35 83 ed 15 18 Oct 31 15:24:54.799534: | 34 d4 bf f0 29 00 00 24 80 50 16 df 8e d4 42 f2 Oct 31 15:24:54.799536: | bb fc 32 4f 6c 52 f1 fb cf dd d2 e9 ef ee aa b7 Oct 31 15:24:54.799537: | fd 8b de 34 11 dd 8b 6b 29 00 00 08 00 00 40 2e Oct 31 15:24:54.799539: | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 Oct 31 15:24:54.799540: | 00 1c 00 00 40 04 7e 01 17 ef c3 bc 71 48 04 d4 Oct 31 15:24:54.799541: | c3 47 3c 99 74 03 53 3e 8f f5 00 00 00 1c 00 00 Oct 31 15:24:54.799543: | 40 05 de 43 10 52 23 d1 e0 ef e7 e2 e8 e2 50 78 Oct 31 15:24:54.799544: | 49 4c f1 88 c1 48 Oct 31 15:24:54.799547: | **parse ISAKMP Message: Oct 31 15:24:54.799550: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:24:54.799553: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:54.799555: | next payload type: ISAKMP_NEXT_v2SA (0x21) Oct 31 15:24:54.799556: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:54.799558: | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) Oct 31 15:24:54.799559: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:24:54.799562: | Message ID: 0 (00 00 00 00) Oct 31 15:24:54.799564: | length: 454 (00 00 01 c6) Oct 31 15:24:54.799566: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) Oct 31 15:24:54.799568: | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response Oct 31 15:24:54.799574: | State DB: found IKEv2 state #1 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) Oct 31 15:24:54.799576: | #1 is idle Oct 31 15:24:54.799577: | #1 idle Oct 31 15:24:54.799578: | unpacking clear payloads Oct 31 15:24:54.799580: | Now let's proceed with payload (ISAKMP_NEXT_v2SA) Oct 31 15:24:54.799582: | ***parse IKEv2 Security Association Payload: Oct 31 15:24:54.799584: | next payload type: ISAKMP_NEXT_v2KE (0x22) Oct 31 15:24:54.799585: | flags: none (0x0) Oct 31 15:24:54.799587: | length: 48 (00 30) Oct 31 15:24:54.799589: | processing payload: ISAKMP_NEXT_v2SA (len=44) Oct 31 15:24:54.799590: | Now let's proceed with payload (ISAKMP_NEXT_v2KE) Oct 31 15:24:54.799592: | ***parse IKEv2 Key Exchange Payload: Oct 31 15:24:54.799594: | next payload type: ISAKMP_NEXT_v2Ni (0x28) Oct 31 15:24:54.799595: | flags: none (0x0) Oct 31 15:24:54.799597: | length: 264 (01 08) Oct 31 15:24:54.799598: | DH group: OAKLEY_GROUP_MODP2048 (0xe) Oct 31 15:24:54.799600: | processing payload: ISAKMP_NEXT_v2KE (len=256) Oct 31 15:24:54.799601: | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) Oct 31 15:24:54.799603: | ***parse IKEv2 Nonce Payload: Oct 31 15:24:54.799604: | next payload type: ISAKMP_NEXT_v2N (0x29) Oct 31 15:24:54.799606: | flags: none (0x0) Oct 31 15:24:54.799607: | length: 36 (00 24) Oct 31 15:24:54.799609: | processing payload: ISAKMP_NEXT_v2Ni (len=32) Oct 31 15:24:54.799610: | Now let's proceed with payload (ISAKMP_NEXT_v2N) Oct 31 15:24:54.799612: | ***parse IKEv2 Notify Payload: Oct 31 15:24:54.799613: | next payload type: ISAKMP_NEXT_v2N (0x29) Oct 31 15:24:54.799615: | flags: none (0x0) Oct 31 15:24:54.799617: | length: 8 (00 08) Oct 31 15:24:54.799618: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.799620: | SPI size: 0 (00) Oct 31 15:24:54.799622: | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) Oct 31 15:24:54.799623: | processing payload: ISAKMP_NEXT_v2N (len=0) Oct 31 15:24:54.799625: | Now let's proceed with payload (ISAKMP_NEXT_v2N) Oct 31 15:24:54.799627: | ***parse IKEv2 Notify Payload: Oct 31 15:24:54.799628: | next payload type: ISAKMP_NEXT_v2N (0x29) Oct 31 15:24:54.799629: | flags: none (0x0) Oct 31 15:24:54.799631: | length: 14 (00 0e) Oct 31 15:24:54.799632: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.799634: | SPI size: 0 (00) Oct 31 15:24:54.799636: | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) Oct 31 15:24:54.799637: | processing payload: ISAKMP_NEXT_v2N (len=6) Oct 31 15:24:54.799638: | Now let's proceed with payload (ISAKMP_NEXT_v2N) Oct 31 15:24:54.799640: | ***parse IKEv2 Notify Payload: Oct 31 15:24:54.799641: | next payload type: ISAKMP_NEXT_v2N (0x29) Oct 31 15:24:54.799643: | flags: none (0x0) Oct 31 15:24:54.799644: | length: 28 (00 1c) Oct 31 15:24:54.799646: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.799647: | SPI size: 0 (00) Oct 31 15:24:54.799649: | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) Oct 31 15:24:54.799650: | processing payload: ISAKMP_NEXT_v2N (len=20) Oct 31 15:24:54.799652: | Now let's proceed with payload (ISAKMP_NEXT_v2N) Oct 31 15:24:54.799653: | ***parse IKEv2 Notify Payload: Oct 31 15:24:54.799655: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:54.799656: | flags: none (0x0) Oct 31 15:24:54.799662: | length: 28 (00 1c) Oct 31 15:24:54.799667: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:54.799671: | SPI size: 0 (00) Oct 31 15:24:54.799674: | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) Oct 31 15:24:54.799677: | processing payload: ISAKMP_NEXT_v2N (len=20) Oct 31 15:24:54.799679: | looking for message matching transition from STATE_PARENT_I1 Oct 31 15:24:54.799682: | trying received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added Oct 31 15:24:54.799685: | message has errors Oct 31 15:24:54.799687: | trying received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload Oct 31 15:24:54.799691: | message has errors Oct 31 15:24:54.799694: | trying received REDIRECT notify response; resending IKE_SA_INIT request to new destination Oct 31 15:24:54.799696: | message has errors Oct 31 15:24:54.799699: | trying Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE Oct 31 15:24:54.799701: | matched unencrypted message Oct 31 15:24:54.799709: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1848) Oct 31 15:24:54.799713: | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE Oct 31 15:24:54.799716: | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) Oct 31 15:24:54.799717: | hash algorithm identifier (network ordered) Oct 31 15:24:54.799719: | 00 02 Oct 31 15:24:54.799720: | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy Oct 31 15:24:54.799722: | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) Oct 31 15:24:54.799723: | hash algorithm identifier (network ordered) Oct 31 15:24:54.799724: | 00 03 Oct 31 15:24:54.799725: | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy Oct 31 15:24:54.799727: | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) Oct 31 15:24:54.799728: | hash algorithm identifier (network ordered) Oct 31 15:24:54.799729: | 00 04 Oct 31 15:24:54.799731: | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy Oct 31 15:24:54.799732: | ikev2 parent inR1: calculating g^{xy} in order to send I2 Oct 31 15:24:54.799737: | using existing local IKE proposals for connection north-eastnets/0x2 (IKE SA initiator accepting remote proposal): 1:IKE=AES_CBC_256-HMAC_SHA2_256-HMAC_SHA2_256_128-MODP2048 Oct 31 15:24:54.799739: | comparing remote proposals against IKE initiator (accepting) 1 local proposals Oct 31 15:24:54.799742: | local proposal 1 type ENCR has 1 transforms Oct 31 15:24:54.799743: | local proposal 1 type PRF has 1 transforms Oct 31 15:24:54.799745: | local proposal 1 type INTEG has 1 transforms Oct 31 15:24:54.799746: | local proposal 1 type DH has 1 transforms Oct 31 15:24:54.799748: | local proposal 1 type ESN has 0 transforms Oct 31 15:24:54.799750: | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none Oct 31 15:24:54.799752: | ****parse IKEv2 Proposal Substructure Payload: Oct 31 15:24:54.799754: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:54.799756: | length: 44 (00 2c) Oct 31 15:24:54.799761: | prop #: 1 (01) Oct 31 15:24:54.799763: | proto ID: IKEv2_SEC_PROTO_IKE (0x1) Oct 31 15:24:54.799765: | spi size: 0 (00) Oct 31 15:24:54.799766: | # transforms: 4 (04) Oct 31 15:24:54.799769: | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals Oct 31 15:24:54.799784: | *****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:54.799785: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.799787: | length: 12 (00 0c) Oct 31 15:24:54.799788: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:54.799790: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:54.799791: | ******parse IKEv2 Attribute Substructure Payload: Oct 31 15:24:54.799808: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:54.799810: | length/value: 256 (01 00) Oct 31 15:24:54.799813: | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 Oct 31 15:24:54.799814: | *****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:54.799816: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.799818: | length: 8 (00 08) Oct 31 15:24:54.799819: | IKEv2 transform type: TRANS_TYPE_PRF (0x2) Oct 31 15:24:54.799820: | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) Oct 31 15:24:54.799823: | remote proposal 1 transform 1 (PRF=HMAC_SHA2_256) matches local proposal 1 type 2 (PRF) transform 0 Oct 31 15:24:54.799826: | *****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:54.799827: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:54.799829: | length: 8 (00 08) Oct 31 15:24:54.799830: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:54.799832: | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) Oct 31 15:24:54.799834: | remote proposal 1 transform 2 (INTEG=HMAC_SHA2_256_128) matches local proposal 1 type 3 (INTEG) transform 0 Oct 31 15:24:54.799835: | *****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:54.799837: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:54.799838: | length: 8 (00 08) Oct 31 15:24:54.799840: | IKEv2 transform type: TRANS_TYPE_DH (0x4) Oct 31 15:24:54.799841: | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) Oct 31 15:24:54.799843: | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 Oct 31 15:24:54.799846: | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none Oct 31 15:24:54.799849: | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH Oct 31 15:24:54.799850: | remote proposal 1 matches local proposal 1 Oct 31 15:24:54.799852: | remote accepted the proposal 1:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA2_256;INTEG=HMAC_SHA2_256_128;DH=MODP2048[first-match] Oct 31 15:24:54.799854: | converting proposal to internal trans attrs Oct 31 15:24:54.799869: | natd_hash: hasher=0x559bb90d5f80(20) Oct 31 15:24:54.799870: | natd_hash: icookie= Oct 31 15:24:54.799872: | 2f db aa cf a4 4d 20 39 Oct 31 15:24:54.799886: | natd_hash: rcookie= Oct 31 15:24:54.799887: | 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:54.799889: | natd_hash: ip= Oct 31 15:24:54.799890: | c0 01 03 21 Oct 31 15:24:54.799891: | natd_hash: port= Oct 31 15:24:54.799892: | 01 f4 Oct 31 15:24:54.799894: | natd_hash: hash= Oct 31 15:24:54.799895: | de 43 10 52 23 d1 e0 ef e7 e2 e8 e2 50 78 49 4c Oct 31 15:24:54.799896: | f1 88 c1 48 Oct 31 15:24:54.799900: | natd_hash: hasher=0x559bb90d5f80(20) Oct 31 15:24:54.799901: | natd_hash: icookie= Oct 31 15:24:54.799903: | 2f db aa cf a4 4d 20 39 Oct 31 15:24:54.799904: | natd_hash: rcookie= Oct 31 15:24:54.799905: | 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:54.799906: | natd_hash: ip= Oct 31 15:24:54.799908: | c0 01 02 17 Oct 31 15:24:54.799909: | natd_hash: port= Oct 31 15:24:54.799910: | 01 f4 Oct 31 15:24:54.799911: | natd_hash: hash= Oct 31 15:24:54.799913: | 7e 01 17 ef c3 bc 71 48 04 d4 c3 47 3c 99 74 03 Oct 31 15:24:54.799914: | 53 3e 8f f5 Oct 31 15:24:54.799916: | NAT_TRAVERSAL encaps using auto-detect Oct 31 15:24:54.799917: | NAT_TRAVERSAL this end is NOT behind NAT Oct 31 15:24:54.799918: | NAT_TRAVERSAL that end is NOT behind NAT Oct 31 15:24:54.799920: | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 Oct 31 15:24:54.799923: | offloading IKEv2 SKEYSEED using prf=HMAC_SHA2_256 integ=HMAC_SHA2_256_128 cipherkey=AES_CBC Oct 31 15:24:54.799925: | DH secret MODP2048@0x7f32c8002b70: transferring ownership from state #1 to helper IKEv2 DH Oct 31 15:24:54.799928: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:54.799930: | addref fd@0x559bbabc6aa0(3->4) (in clone_logger() at log.c:810) Oct 31 15:24:54.799932: | newref clone logger@0x559bbabb4290(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:54.799933: | job 3 for #1: ikev2_inR1outI2 KE (compute dh (V2)): adding job to queue Oct 31 15:24:54.799935: | state #1 has no .st_event to delete Oct 31 15:24:54.799937: | #1 requesting EVENT_RETRANSMIT-pe@0x559bbabc3500 be deleted Oct 31 15:24:54.799939: | libevent_free: delref ptr-libevent@0x559bbabc3470 Oct 31 15:24:54.799940: | free_event_entry: delref EVENT_RETRANSMIT-pe@0x559bbabc3500 Oct 31 15:24:54.799942: | #1 STATE_PARENT_I1: retransmits: cleared Oct 31 15:24:54.799944: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3500 Oct 31 15:24:54.799946: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 Oct 31 15:24:54.799948: | libevent_malloc: newref ptr-libevent@0x559bbabc3470 size 128 Oct 31 15:24:54.799973: | #1 spent 0.25 (0.255) milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE in v2_dispatch() Oct 31 15:24:54.799976: | job 3 for #1: ikev2_inR1outI2 KE (compute dh (V2)): helper 6 starting job Oct 31 15:24:54.799980: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:54.799981: | helper 6 is pausing for 1 seconds Oct 31 15:24:54.799986: | #1 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 Oct 31 15:24:54.799996: | suspending state #1 and saving MD 0x559bbabcb9d0 Oct 31 15:24:54.799999: | addref md@0x559bbabcb9d0(1->2) (in complete_v2_state_transition() at ikev2.c:3485) Oct 31 15:24:54.800000: | #1 is busy; has suspended MD 0x559bbabcb9d0 Oct 31 15:24:54.800003: | stop processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1850) Oct 31 15:24:54.800007: | #1 spent 0.553 (0.561) milliseconds in ikev2_process_packet() Oct 31 15:24:54.800009: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:54.800011: | delref mdp@0x559bbabcb9d0(2->1) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:54.800014: | spent 0.56 (0.568) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:55.036620: | "north-eastnets/0x2" #2: spent 1.49 (1e+03) milliseconds in helper 7 processing job 2 for state #2: ikev2_inI1outR1 KE (pcr) Oct 31 15:24:55.036634: | job 2 for #2: ikev2_inI1outR1 KE (build KE and nonce): helper thread 7 sending result back to state Oct 31 15:24:55.036638: | scheduling resume sending helper answer back to state for #2 Oct 31 15:24:55.036642: | libevent_malloc: newref ptr-libevent@0x7f32c0002790 size 128 Oct 31 15:24:55.036653: | helper thread 7 has nothing to do Oct 31 15:24:55.036663: | processing resume sending helper answer back to state for #2 Oct 31 15:24:55.036675: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:55.036679: | unsuspending #2 MD 0x559bbabc87a0 Oct 31 15:24:55.036681: | job 2 for #2: ikev2_inI1outR1 KE (build KE and nonce): processing response from helper 7 Oct 31 15:24:55.036683: | job 2 for #2: ikev2_inI1outR1 KE (build KE and nonce): calling continuation function 0x559bb8fe3fe7 Oct 31 15:24:55.036685: | ikev2_parent_inI1outR1_continue() for #2 STATE_PARENT_R0: calculated ke+nonce, sending R1 Oct 31 15:24:55.036690: | opening output PBS reply packet Oct 31 15:24:55.036693: | **emit ISAKMP Message: Oct 31 15:24:55.036696: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.036698: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.036700: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:24:55.036702: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:55.036704: | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) Oct 31 15:24:55.036705: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:24:55.036708: | Message ID: 0 (00 00 00 00) Oct 31 15:24:55.036710: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:24:55.036713: | emitting ikev2_proposal ... Oct 31 15:24:55.036718: | ***emit IKEv2 Security Association Payload: Oct 31 15:24:55.036722: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:55.036724: | flags: none (0x0) Oct 31 15:24:55.036727: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) Oct 31 15:24:55.036730: | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' Oct 31 15:24:55.036735: | ****emit IKEv2 Proposal Substructure Payload: Oct 31 15:24:55.036738: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:55.036744: | prop #: 1 (01) Oct 31 15:24:55.036747: | proto ID: IKEv2_SEC_PROTO_IKE (0x1) Oct 31 15:24:55.036750: | spi size: 0 (00) Oct 31 15:24:55.036753: | # transforms: 4 (04) Oct 31 15:24:55.036756: | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' Oct 31 15:24:55.036760: | *****emit IKEv2 Transform Substructure Payload: Oct 31 15:24:55.036763: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:55.036765: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:55.036768: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:55.036770: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:55.036772: | ******emit IKEv2 Attribute Substructure Payload: Oct 31 15:24:55.036774: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:55.036776: | length/value: 256 (01 00) Oct 31 15:24:55.036778: | emitting length of IKEv2 Transform Substructure Payload: 12 Oct 31 15:24:55.036780: | *****emit IKEv2 Transform Substructure Payload: Oct 31 15:24:55.036781: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:55.036783: | IKEv2 transform type: TRANS_TYPE_PRF (0x2) Oct 31 15:24:55.036784: | IKEv2 transform ID: PRF_HMAC_SHA2_256 (0x5) Oct 31 15:24:55.036786: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:55.036787: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:55.036789: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:55.036791: | *****emit IKEv2 Transform Substructure Payload: Oct 31 15:24:55.036792: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:55.036794: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:55.036795: | IKEv2 transform ID: AUTH_HMAC_SHA2_256_128 (0xc) Oct 31 15:24:55.036797: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:55.036798: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:55.036800: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:55.036801: | *****emit IKEv2 Transform Substructure Payload: Oct 31 15:24:55.036803: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:55.036804: | IKEv2 transform type: TRANS_TYPE_DH (0x4) Oct 31 15:24:55.036806: | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) Oct 31 15:24:55.036807: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:55.036809: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:55.036810: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:55.036812: | emitting length of IKEv2 Proposal Substructure Payload: 44 Oct 31 15:24:55.036813: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 Oct 31 15:24:55.036815: | emitting length of IKEv2 Security Association Payload: 48 Oct 31 15:24:55.036816: | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 Oct 31 15:24:55.036819: | DH secret MODP2048@0x7f32c0002b70: transferring ownership from helper KE to state #2 Oct 31 15:24:55.036821: | ***emit IKEv2 Key Exchange Payload: Oct 31 15:24:55.036823: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:55.036824: | flags: none (0x0) Oct 31 15:24:55.036827: | DH group: OAKLEY_GROUP_MODP2048 (0xe) Oct 31 15:24:55.036829: | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) Oct 31 15:24:55.036830: | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' Oct 31 15:24:55.036833: | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload Oct 31 15:24:55.036834: | ikev2 g^x: Oct 31 15:24:55.036836: | b6 16 05 74 7e 43 a9 e3 db 50 ab 7a 2a a5 91 88 Oct 31 15:24:55.036837: | 04 a8 b4 c9 f3 60 45 16 a7 30 ee b0 bf 2c f4 61 Oct 31 15:24:55.036839: | db f1 b7 73 ef bf fe 50 b2 ab 13 b6 27 1c ba 93 Oct 31 15:24:55.036840: | c1 82 13 09 80 cf 9c bf d2 43 fc 91 f0 86 68 01 Oct 31 15:24:55.036846: | b6 9c 4d e5 87 0a e4 3d c6 3c 01 1e b4 71 66 80 Oct 31 15:24:55.036847: | b7 ec 29 4e 7b 0c 2c c1 92 52 7b f8 8d ea e0 a1 Oct 31 15:24:55.036849: | a2 f7 07 92 d4 34 3e 11 79 5e ea e3 cf da 34 b7 Oct 31 15:24:55.036850: | f6 49 79 75 9c 2b 7c c2 94 66 2d 6b 83 b4 bb 76 Oct 31 15:24:55.036851: | a9 85 fc 9c 08 00 4e d2 bf b5 a6 83 3e 4a de b9 Oct 31 15:24:55.036853: | 9c 69 23 8f 04 69 a4 84 5b d0 c9 47 4e 33 c9 91 Oct 31 15:24:55.036854: | ab 61 7a ab a5 65 08 4d 99 dd cc df 8e ac f5 7d Oct 31 15:24:55.036855: | 1d 76 17 c6 ff fd 69 4a fe 29 09 80 8e 83 59 a9 Oct 31 15:24:55.036857: | 58 a1 35 c8 3e e1 b4 5c 9f 41 a9 ad d7 21 93 b0 Oct 31 15:24:55.036858: | cb d0 e9 66 57 13 e6 b1 1c 32 d8 01 ec c2 94 6a Oct 31 15:24:55.036859: | b4 0e 73 a6 73 fb f5 62 01 ea e6 bd c4 0b a8 c8 Oct 31 15:24:55.036861: | 21 df 8d 2f 7a fb 45 a7 b7 fd 94 1a 0c 3e c7 b7 Oct 31 15:24:55.036862: | emitting length of IKEv2 Key Exchange Payload: 264 Oct 31 15:24:55.036864: | ***emit IKEv2 Nonce Payload: Oct 31 15:24:55.036866: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:55.036867: | flags: none (0x0) Oct 31 15:24:55.036869: | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) Oct 31 15:24:55.036870: | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' Oct 31 15:24:55.036872: | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload Oct 31 15:24:55.036873: | IKEv2 nonce: Oct 31 15:24:55.036875: | 1d 53 54 71 c2 1a 8c 37 92 34 4d 0c a0 91 d6 19 Oct 31 15:24:55.036877: | 7a c0 f5 9f 6e 33 e4 ea ee 0c 32 f7 6e 21 91 b7 Oct 31 15:24:55.036882: | emitting length of IKEv2 Nonce Payload: 36 Oct 31 15:24:55.036886: | adding a v2N Payload Oct 31 15:24:55.036889: | ***emit IKEv2 Notify Payload: Oct 31 15:24:55.036892: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:55.036894: | flags: none (0x0) Oct 31 15:24:55.036897: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:55.036900: | SPI size: 0 (00) Oct 31 15:24:55.036902: | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) Oct 31 15:24:55.036905: | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) Oct 31 15:24:55.036907: | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' Oct 31 15:24:55.036910: | emitting length of IKEv2 Notify Payload: 8 Oct 31 15:24:55.036913: | adding a v2N Payload Oct 31 15:24:55.036915: | ***emit IKEv2 Notify Payload: Oct 31 15:24:55.036918: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:55.036921: | flags: none (0x0) Oct 31 15:24:55.036924: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:55.036927: | SPI size: 0 (00) Oct 31 15:24:55.036930: | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) Oct 31 15:24:55.036932: | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) Oct 31 15:24:55.036935: | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' Oct 31 15:24:55.036939: | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload Oct 31 15:24:55.036941: | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 Oct 31 15:24:55.036942: | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload Oct 31 15:24:55.036944: | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 Oct 31 15:24:55.036945: | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload Oct 31 15:24:55.036947: | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 Oct 31 15:24:55.036948: | emitting length of IKEv2 Notify Payload: 14 Oct 31 15:24:55.036950: | NAT-Traversal support [enabled] add v2N payloads. Oct 31 15:24:55.036961: | natd_hash: hasher=0x559bb90d5f80(20) Oct 31 15:24:55.036963: | natd_hash: icookie= Oct 31 15:24:55.036964: | 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.036966: | natd_hash: rcookie= Oct 31 15:24:55.036967: | 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.036968: | natd_hash: ip= Oct 31 15:24:55.036970: | c0 01 03 21 Oct 31 15:24:55.036971: | natd_hash: port= Oct 31 15:24:55.036973: | 01 f4 Oct 31 15:24:55.036974: | natd_hash: hash= Oct 31 15:24:55.036975: | 5f f7 1d 21 b4 bb 4a 39 1b 35 9e 2a 9e 08 8f 78 Oct 31 15:24:55.036977: | 26 df d5 d3 Oct 31 15:24:55.036978: | adding a v2N Payload Oct 31 15:24:55.036980: | ***emit IKEv2 Notify Payload: Oct 31 15:24:55.036981: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:55.036983: | flags: none (0x0) Oct 31 15:24:55.036984: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:55.036986: | SPI size: 0 (00) Oct 31 15:24:55.036988: | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) Oct 31 15:24:55.036989: | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) Oct 31 15:24:55.036991: | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' Oct 31 15:24:55.036993: | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload Oct 31 15:24:55.036994: | Notify data: Oct 31 15:24:55.036996: | 5f f7 1d 21 b4 bb 4a 39 1b 35 9e 2a 9e 08 8f 78 Oct 31 15:24:55.036997: | 26 df d5 d3 Oct 31 15:24:55.036999: | emitting length of IKEv2 Notify Payload: 28 Oct 31 15:24:55.037009: | natd_hash: hasher=0x559bb90d5f80(20) Oct 31 15:24:55.037013: | natd_hash: icookie= Oct 31 15:24:55.037016: | 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.037018: | natd_hash: rcookie= Oct 31 15:24:55.037020: | 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.037022: | natd_hash: ip= Oct 31 15:24:55.037025: | c0 01 02 17 Oct 31 15:24:55.037027: | natd_hash: port= Oct 31 15:24:55.037029: | 01 f4 Oct 31 15:24:55.037031: | natd_hash: hash= Oct 31 15:24:55.037034: | 4f cc 52 e4 75 bd ec 54 ec 5b 5a f7 90 d3 b7 5a Oct 31 15:24:55.037036: | 9e 35 b6 27 Oct 31 15:24:55.037039: | adding a v2N Payload Oct 31 15:24:55.037041: | ***emit IKEv2 Notify Payload: Oct 31 15:24:55.037044: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:55.037047: | flags: none (0x0) Oct 31 15:24:55.037050: | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) Oct 31 15:24:55.037053: | SPI size: 0 (00) Oct 31 15:24:55.037055: | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) Oct 31 15:24:55.037057: | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) Oct 31 15:24:55.037059: | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' Oct 31 15:24:55.037061: | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload Oct 31 15:24:55.037062: | Notify data: Oct 31 15:24:55.037064: | 4f cc 52 e4 75 bd ec 54 ec 5b 5a f7 90 d3 b7 5a Oct 31 15:24:55.037065: | 9e 35 b6 27 Oct 31 15:24:55.037067: | emitting length of IKEv2 Notify Payload: 28 Oct 31 15:24:55.037070: | emitting length of ISAKMP Message: 454 Oct 31 15:24:55.037075: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:55.037079: | #2 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_OK Oct 31 15:24:55.037081: | transitioning from state STATE_PARENT_R0 to state STATE_PARENT_R1 Oct 31 15:24:55.037082: | Message ID: updating counters for #2 Oct 31 15:24:55.037088: | Message ID: IKE #2 updating responder received message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=-1 ike.responder.recv=-1->0 ike.responder.last_contact=744568.466363->744569.46988 ike.wip.initiator=-1 ike.wip.responder=0->-1 Oct 31 15:24:55.037092: | Message ID: IKE #2 updating responder sent message response 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=-1->0 ike.responder.recv=0 ike.responder.last_contact=744569.46988 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:55.037095: | Message ID: IKE #2 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744569.46988 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:55.037098: | parent state #2: PARENT_R0(half-open IKE SA) => PARENT_R1(half-open IKE SA) Oct 31 15:24:55.037100: | announcing the state transition Oct 31 15:24:55.037103: "north-eastnets/0x2" #2: sent IKE_SA_INIT reply {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA2_256_128 prf=HMAC_SHA2_256 group=MODP2048} Oct 31 15:24:55.037109: | sending 454 bytes for STATE_PARENT_R0 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #2) Oct 31 15:24:55.037111: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.037112: | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 Oct 31 15:24:55.037113: | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c Oct 31 15:24:55.037115: | 80 0e 01 00 03 00 00 08 02 00 00 05 03 00 00 08 Oct 31 15:24:55.037116: | 03 00 00 0c 00 00 00 08 04 00 00 0e 28 00 01 08 Oct 31 15:24:55.037118: | 00 0e 00 00 b6 16 05 74 7e 43 a9 e3 db 50 ab 7a Oct 31 15:24:55.037119: | 2a a5 91 88 04 a8 b4 c9 f3 60 45 16 a7 30 ee b0 Oct 31 15:24:55.037120: | bf 2c f4 61 db f1 b7 73 ef bf fe 50 b2 ab 13 b6 Oct 31 15:24:55.037122: | 27 1c ba 93 c1 82 13 09 80 cf 9c bf d2 43 fc 91 Oct 31 15:24:55.037123: | f0 86 68 01 b6 9c 4d e5 87 0a e4 3d c6 3c 01 1e Oct 31 15:24:55.037124: | b4 71 66 80 b7 ec 29 4e 7b 0c 2c c1 92 52 7b f8 Oct 31 15:24:55.037126: | 8d ea e0 a1 a2 f7 07 92 d4 34 3e 11 79 5e ea e3 Oct 31 15:24:55.037127: | cf da 34 b7 f6 49 79 75 9c 2b 7c c2 94 66 2d 6b Oct 31 15:24:55.037128: | 83 b4 bb 76 a9 85 fc 9c 08 00 4e d2 bf b5 a6 83 Oct 31 15:24:55.037130: | 3e 4a de b9 9c 69 23 8f 04 69 a4 84 5b d0 c9 47 Oct 31 15:24:55.037131: | 4e 33 c9 91 ab 61 7a ab a5 65 08 4d 99 dd cc df Oct 31 15:24:55.037133: | 8e ac f5 7d 1d 76 17 c6 ff fd 69 4a fe 29 09 80 Oct 31 15:24:55.037134: | 8e 83 59 a9 58 a1 35 c8 3e e1 b4 5c 9f 41 a9 ad Oct 31 15:24:55.037135: | d7 21 93 b0 cb d0 e9 66 57 13 e6 b1 1c 32 d8 01 Oct 31 15:24:55.037137: | ec c2 94 6a b4 0e 73 a6 73 fb f5 62 01 ea e6 bd Oct 31 15:24:55.037138: | c4 0b a8 c8 21 df 8d 2f 7a fb 45 a7 b7 fd 94 1a Oct 31 15:24:55.037139: | 0c 3e c7 b7 29 00 00 24 1d 53 54 71 c2 1a 8c 37 Oct 31 15:24:55.037141: | 92 34 4d 0c a0 91 d6 19 7a c0 f5 9f 6e 33 e4 ea Oct 31 15:24:55.037142: | ee 0c 32 f7 6e 21 91 b7 29 00 00 08 00 00 40 2e Oct 31 15:24:55.037143: | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 Oct 31 15:24:55.037145: | 00 1c 00 00 40 04 5f f7 1d 21 b4 bb 4a 39 1b 35 Oct 31 15:24:55.037146: | 9e 2a 9e 08 8f 78 26 df d5 d3 00 00 00 1c 00 00 Oct 31 15:24:55.037147: | 40 05 4f cc 52 e4 75 bd ec 54 ec 5b 5a f7 90 d3 Oct 31 15:24:55.037149: | b7 5a 9e 35 b6 27 Oct 31 15:24:55.037195: | sent 1 messages Oct 31 15:24:55.037209: | state #2 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:55.037214: | libevent_free: delref ptr-libevent@0x559bbabc3340 Oct 31 15:24:55.037216: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3410 Oct 31 15:24:55.037220: | event_schedule: newref EVENT_SO_DISCARD-pe@0x559bbabc3410 Oct 31 15:24:55.037222: | inserting event EVENT_SO_DISCARD, timeout in 200 seconds for #2 Oct 31 15:24:55.037225: | libevent_malloc: newref ptr-libevent@0x559bbabc3340 size 128 Oct 31 15:24:55.037229: | delref logger@0x559bbabb42e0(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:55.037232: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:55.037234: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:55.037237: | resume sending helper answer back to state for #2 suppresed complete_v2_state_transition() Oct 31 15:24:55.037240: | delref mdp@0x559bbabc87a0(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:55.037244: | delref logger@0x559bbabb4380(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:55.037246: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:55.037249: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:55.037256: | #2 spent 0.544 (0.575) milliseconds in resume sending helper answer back to state Oct 31 15:24:55.037262: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:55.037266: | libevent_free: delref ptr-libevent@0x7f32c0002790 Oct 31 15:24:55.047293: | spent 0.00296 (0.00421) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:55.047313: | newref struct msg_digest@0x559bbabc8750(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.047318: | newref alloc logger@0x559bbabb4380(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.047325: | *received 548 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:55.047328: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.047330: | 35 20 23 08 00 00 00 01 00 00 02 24 23 00 02 08 Oct 31 15:24:55.047332: | 00 01 00 01 51 47 8a 54 1a 62 45 4b e2 33 f5 e6 Oct 31 15:24:55.047333: | 07 59 aa 45 48 e1 67 61 6e fb 6b ce 70 34 57 8d Oct 31 15:24:55.047334: | 6e ea 6a d4 0b f3 e0 f5 98 59 57 3e f9 42 cc 3a Oct 31 15:24:55.047336: | 28 d9 64 9b 41 d1 c3 4b 53 60 b5 bb 93 89 90 80 Oct 31 15:24:55.047337: | 68 9c c3 62 c8 e0 68 fa 62 29 ca cd b5 d1 28 fb Oct 31 15:24:55.047338: | 6c e3 4f 54 0c 6a b4 37 2a ac f6 6f 70 51 62 ed Oct 31 15:24:55.047340: | 63 d6 47 7e fc cf d6 c1 8a e5 c8 56 38 65 1d 90 Oct 31 15:24:55.047341: | 87 2d ef 93 98 1f 86 b4 5b 33 c7 36 d5 2a d9 8a Oct 31 15:24:55.047342: | db b2 23 7e 4a c9 7b 33 20 48 19 ac 22 e1 0d e8 Oct 31 15:24:55.047344: | e6 39 e7 5b 2c 9e 09 82 85 91 44 92 3c d1 c2 c7 Oct 31 15:24:55.047345: | 78 bd 40 2d b6 a3 20 ce 1e 89 d4 f0 7c 2b 32 e1 Oct 31 15:24:55.047346: | 98 93 17 f7 83 f5 3b fa 4d 94 49 09 7d 05 6d d5 Oct 31 15:24:55.047348: | c6 b9 c1 79 de 80 91 fa 45 be de 89 11 b3 ef 52 Oct 31 15:24:55.047349: | cc 24 53 4f e0 f8 d1 e4 33 e9 b4 21 ea 2a 8e d1 Oct 31 15:24:55.047350: | 6d 5a 29 b7 9f 5a 12 78 cc db 08 f6 a7 b9 a4 c2 Oct 31 15:24:55.047352: | f8 50 39 ad c2 ff cd ef 98 a6 c2 89 e5 bf 22 5c Oct 31 15:24:55.047353: | df f8 62 60 a3 08 1d a8 11 92 8a 26 0a 8b 00 6f Oct 31 15:24:55.047354: | 73 9d 43 ad 3d 7e 89 c2 04 55 c8 50 b1 cd 37 db Oct 31 15:24:55.047356: | 79 4e 98 75 10 75 78 be a3 8a 87 2b 90 30 f2 3b Oct 31 15:24:55.047357: | 0b b5 6a d0 8b fa 70 bf de 71 14 4a 4c d2 fb cf Oct 31 15:24:55.047358: | 33 a5 67 af ad 10 98 99 05 49 83 61 a2 0d 52 9d Oct 31 15:24:55.047360: | da 43 b6 45 2a 02 dc 67 52 55 08 c2 e7 2f 2b e4 Oct 31 15:24:55.047361: | 14 e3 0b 40 93 b0 84 6e 48 f4 a7 1d f8 49 56 e8 Oct 31 15:24:55.047363: | 33 0d ab 8f 70 68 2b 54 f6 92 20 65 11 85 e4 b0 Oct 31 15:24:55.047366: | 13 3b 8f e3 3b 16 7f b5 47 0f f2 28 94 ad 0f ee Oct 31 15:24:55.047368: | 09 a2 b0 f4 6f 1b db 64 ea 0b c9 b5 04 22 06 bb Oct 31 15:24:55.047369: | 94 92 7f f0 49 d3 4f d8 a5 d3 cd c0 d0 02 40 7f Oct 31 15:24:55.047370: | 9b 35 d0 3c 0d 32 1c 85 94 f2 43 b2 a7 8f f3 8d Oct 31 15:24:55.047372: | 60 e4 00 97 9a 93 2e 1b 7d 20 7f a6 f5 46 18 e0 Oct 31 15:24:55.047373: | d3 ea 15 2d df d4 b0 1e 00 28 f5 21 6a ff e3 65 Oct 31 15:24:55.047374: | 75 88 24 35 6f af bf af 82 b2 ca 2c 47 4e eb 6c Oct 31 15:24:55.047376: | be 7e f8 35 fc f7 02 9f 36 04 d0 a1 7f be 36 ac Oct 31 15:24:55.047377: | d6 9b 12 d3 Oct 31 15:24:55.047381: | **parse ISAKMP Message: Oct 31 15:24:55.047383: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.047386: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.047388: | next payload type: ISAKMP_NEXT_v2SKF (0x35) Oct 31 15:24:55.047390: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:55.047391: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:55.047393: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:55.047395: | Message ID: 1 (00 00 00 01) Oct 31 15:24:55.047398: | length: 548 (00 00 02 24) Oct 31 15:24:55.047399: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) Oct 31 15:24:55.047402: | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request Oct 31 15:24:55.047405: | State DB: found IKEv2 state #2 in PARENT_R1 (find_v2_ike_sa) Oct 31 15:24:55.047410: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:55.047413: | #2 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 Oct 31 15:24:55.047414: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:24:55.047416: | #2 is idle Oct 31 15:24:55.047421: | Message ID: IKE #2 not a duplicate - message request 1 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744569.46988 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:55.047424: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:24:55.047426: | unpacking clear payload Oct 31 15:24:55.047427: | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) Oct 31 15:24:55.047430: | ***parse IKEv2 Encrypted Fragment: Oct 31 15:24:55.047431: | next payload type: ISAKMP_NEXT_v2IDi (0x23) Oct 31 15:24:55.047433: | flags: none (0x0) Oct 31 15:24:55.047435: | length: 520 (02 08) Oct 31 15:24:55.047437: | fragment number: 1 (00 01) Oct 31 15:24:55.047439: | total fragments: 1 (00 01) Oct 31 15:24:55.047440: | processing payload: ISAKMP_NEXT_v2SKF (len=512) Oct 31 15:24:55.047442: | #2 in state PARENT_R1: sent IKE_SA_INIT reply Oct 31 15:24:55.047445: | received IKE encrypted fragment number '1', total number '1', next payload '35' Oct 31 15:24:55.047447: | selected state microcode Responder: process IKE_AUTH request (no SKEYSEED) Oct 31 15:24:55.047449: | calling processor Responder: process IKE_AUTH request (no SKEYSEED) Oct 31 15:24:55.047456: | ikev2 parent ikev2_ike_sa_process_auth_request_no_skeyid(): calculating g^{xy} in order to decrypt I2 Oct 31 15:24:55.047460: | offloading IKEv2 SKEYSEED using prf=HMAC_SHA2_256 integ=HMAC_SHA2_256_128 cipherkey=AES_CBC Oct 31 15:24:55.047463: | DH secret MODP2048@0x7f32c0002b70: transferring ownership from state #2 to helper IKEv2 DH Oct 31 15:24:55.047465: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:55.047467: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:24:55.047469: | newref clone logger@0x559bbabb42e0(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:55.047471: | job 4 for #2: ikev2_inI2outR2 KE (compute dh (V2)): adding job to queue Oct 31 15:24:55.047473: | state #2 deleting .st_event EVENT_SO_DISCARD Oct 31 15:24:55.047476: | libevent_free: delref ptr-libevent@0x559bbabc3340 Oct 31 15:24:55.047479: | free_event_entry: delref EVENT_SO_DISCARD-pe@0x559bbabc3410 Oct 31 15:24:55.047481: | #2 STATE_PARENT_R1: retransmits: cleared Oct 31 15:24:55.047482: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3410 Oct 31 15:24:55.047484: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 Oct 31 15:24:55.047486: | libevent_malloc: newref ptr-libevent@0x559bbabc3340 size 128 Oct 31 15:24:55.047494: | #2 spent 0.0417 (0.0417) milliseconds in processing: Responder: process IKE_AUTH request (no SKEYSEED) in v2_dispatch() Oct 31 15:24:55.047497: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:55.047500: | #2 complete_v2_state_transition() PARENT_R1->PARENT_R1 with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 Oct 31 15:24:55.047502: | suspending state #2 and saving MD 0x559bbabc8750 Oct 31 15:24:55.047501: | job 4 for #2: ikev2_inI2outR2 KE (compute dh (V2)): helper 2 starting job Oct 31 15:24:55.047505: | addref md@0x559bbabc8750(1->2) (in complete_v2_state_transition() at ikev2.c:3485) Oct 31 15:24:55.047517: | #2 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:55.047513: | helper 2 is pausing for 1 seconds Oct 31 15:24:55.047522: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:55.047535: | #2 spent 0.242 (0.251) milliseconds in ikev2_process_packet() Oct 31 15:24:55.047537: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:55.047539: | delref mdp@0x559bbabc8750(2->1) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.047541: | spent 0.249 (0.258) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:55.097565: | spent 0.00283 (0.00281) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:55.097591: | newref struct msg_digest@0x559bbabceb40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.097597: | newref alloc logger@0x559bbabb3560(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.097604: | *received 548 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:55.097608: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.097610: | 35 20 23 08 00 00 00 01 00 00 02 24 23 00 02 08 Oct 31 15:24:55.097612: | 00 01 00 01 51 47 8a 54 1a 62 45 4b e2 33 f5 e6 Oct 31 15:24:55.097615: | 07 59 aa 45 48 e1 67 61 6e fb 6b ce 70 34 57 8d Oct 31 15:24:55.097617: | 6e ea 6a d4 0b f3 e0 f5 98 59 57 3e f9 42 cc 3a Oct 31 15:24:55.097619: | 28 d9 64 9b 41 d1 c3 4b 53 60 b5 bb 93 89 90 80 Oct 31 15:24:55.097621: | 68 9c c3 62 c8 e0 68 fa 62 29 ca cd b5 d1 28 fb Oct 31 15:24:55.097623: | 6c e3 4f 54 0c 6a b4 37 2a ac f6 6f 70 51 62 ed Oct 31 15:24:55.097625: | 63 d6 47 7e fc cf d6 c1 8a e5 c8 56 38 65 1d 90 Oct 31 15:24:55.097628: | 87 2d ef 93 98 1f 86 b4 5b 33 c7 36 d5 2a d9 8a Oct 31 15:24:55.097630: | db b2 23 7e 4a c9 7b 33 20 48 19 ac 22 e1 0d e8 Oct 31 15:24:55.097639: | e6 39 e7 5b 2c 9e 09 82 85 91 44 92 3c d1 c2 c7 Oct 31 15:24:55.097642: | 78 bd 40 2d b6 a3 20 ce 1e 89 d4 f0 7c 2b 32 e1 Oct 31 15:24:55.097644: | 98 93 17 f7 83 f5 3b fa 4d 94 49 09 7d 05 6d d5 Oct 31 15:24:55.097646: | c6 b9 c1 79 de 80 91 fa 45 be de 89 11 b3 ef 52 Oct 31 15:24:55.097649: | cc 24 53 4f e0 f8 d1 e4 33 e9 b4 21 ea 2a 8e d1 Oct 31 15:24:55.097652: | 6d 5a 29 b7 9f 5a 12 78 cc db 08 f6 a7 b9 a4 c2 Oct 31 15:24:55.097654: | f8 50 39 ad c2 ff cd ef 98 a6 c2 89 e5 bf 22 5c Oct 31 15:24:55.097656: | df f8 62 60 a3 08 1d a8 11 92 8a 26 0a 8b 00 6f Oct 31 15:24:55.097658: | 73 9d 43 ad 3d 7e 89 c2 04 55 c8 50 b1 cd 37 db Oct 31 15:24:55.097660: | 79 4e 98 75 10 75 78 be a3 8a 87 2b 90 30 f2 3b Oct 31 15:24:55.097663: | 0b b5 6a d0 8b fa 70 bf de 71 14 4a 4c d2 fb cf Oct 31 15:24:55.097665: | 33 a5 67 af ad 10 98 99 05 49 83 61 a2 0d 52 9d Oct 31 15:24:55.097670: | da 43 b6 45 2a 02 dc 67 52 55 08 c2 e7 2f 2b e4 Oct 31 15:24:55.097672: | 14 e3 0b 40 93 b0 84 6e 48 f4 a7 1d f8 49 56 e8 Oct 31 15:24:55.097675: | 33 0d ab 8f 70 68 2b 54 f6 92 20 65 11 85 e4 b0 Oct 31 15:24:55.097677: | 13 3b 8f e3 3b 16 7f b5 47 0f f2 28 94 ad 0f ee Oct 31 15:24:55.097679: | 09 a2 b0 f4 6f 1b db 64 ea 0b c9 b5 04 22 06 bb Oct 31 15:24:55.097681: | 94 92 7f f0 49 d3 4f d8 a5 d3 cd c0 d0 02 40 7f Oct 31 15:24:55.097683: | 9b 35 d0 3c 0d 32 1c 85 94 f2 43 b2 a7 8f f3 8d Oct 31 15:24:55.097685: | 60 e4 00 97 9a 93 2e 1b 7d 20 7f a6 f5 46 18 e0 Oct 31 15:24:55.097700: | d3 ea 15 2d df d4 b0 1e 00 28 f5 21 6a ff e3 65 Oct 31 15:24:55.097703: | 75 88 24 35 6f af bf af 82 b2 ca 2c 47 4e eb 6c Oct 31 15:24:55.097705: | be 7e f8 35 fc f7 02 9f 36 04 d0 a1 7f be 36 ac Oct 31 15:24:55.097707: | d6 9b 12 d3 Oct 31 15:24:55.097712: | **parse ISAKMP Message: Oct 31 15:24:55.097717: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.097722: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.097725: | next payload type: ISAKMP_NEXT_v2SKF (0x35) Oct 31 15:24:55.097728: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:55.097730: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:55.097733: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:55.097737: | Message ID: 1 (00 00 00 01) Oct 31 15:24:55.097741: | length: 548 (00 00 02 24) Oct 31 15:24:55.097743: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) Oct 31 15:24:55.097747: | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request Oct 31 15:24:55.097752: | State DB: found IKEv2 state #2 in PARENT_R1 (find_v2_ike_sa) Oct 31 15:24:55.097760: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:55.097764: | #2 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 Oct 31 15:24:55.097767: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:24:55.097769: | #2 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:55.097773: "north-eastnets/0x2" #2: discarding packet received during asynchronous work (DNS or crypto) in STATE_PARENT_R1 Oct 31 15:24:55.097778: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:55.097785: | #2 spent 0.222 (0.227) milliseconds in ikev2_process_packet() Oct 31 15:24:55.097788: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:55.097791: | delref mdp@0x559bbabceb40(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.097794: | delref logger@0x559bbabb3560(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.097797: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:55.097799: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:55.097804: | spent 0.243 (0.248) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:55.148924: | spent 0.00259 (0.00255) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:55.148943: | newref struct msg_digest@0x559bbabceb40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.148948: | newref alloc logger@0x559bbabb3560(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.148956: | *received 548 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:55.148959: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.148961: | 35 20 23 08 00 00 00 01 00 00 02 24 23 00 02 08 Oct 31 15:24:55.148964: | 00 01 00 01 51 47 8a 54 1a 62 45 4b e2 33 f5 e6 Oct 31 15:24:55.148966: | 07 59 aa 45 48 e1 67 61 6e fb 6b ce 70 34 57 8d Oct 31 15:24:55.148968: | 6e ea 6a d4 0b f3 e0 f5 98 59 57 3e f9 42 cc 3a Oct 31 15:24:55.148970: | 28 d9 64 9b 41 d1 c3 4b 53 60 b5 bb 93 89 90 80 Oct 31 15:24:55.148971: | 68 9c c3 62 c8 e0 68 fa 62 29 ca cd b5 d1 28 fb Oct 31 15:24:55.148972: | 6c e3 4f 54 0c 6a b4 37 2a ac f6 6f 70 51 62 ed Oct 31 15:24:55.148976: | 63 d6 47 7e fc cf d6 c1 8a e5 c8 56 38 65 1d 90 Oct 31 15:24:55.148977: | 87 2d ef 93 98 1f 86 b4 5b 33 c7 36 d5 2a d9 8a Oct 31 15:24:55.148981: | db b2 23 7e 4a c9 7b 33 20 48 19 ac 22 e1 0d e8 Oct 31 15:24:55.148985: | e6 39 e7 5b 2c 9e 09 82 85 91 44 92 3c d1 c2 c7 Oct 31 15:24:55.148987: | 78 bd 40 2d b6 a3 20 ce 1e 89 d4 f0 7c 2b 32 e1 Oct 31 15:24:55.148989: | 98 93 17 f7 83 f5 3b fa 4d 94 49 09 7d 05 6d d5 Oct 31 15:24:55.148991: | c6 b9 c1 79 de 80 91 fa 45 be de 89 11 b3 ef 52 Oct 31 15:24:55.148994: | cc 24 53 4f e0 f8 d1 e4 33 e9 b4 21 ea 2a 8e d1 Oct 31 15:24:55.148996: | 6d 5a 29 b7 9f 5a 12 78 cc db 08 f6 a7 b9 a4 c2 Oct 31 15:24:55.148998: | f8 50 39 ad c2 ff cd ef 98 a6 c2 89 e5 bf 22 5c Oct 31 15:24:55.149000: | df f8 62 60 a3 08 1d a8 11 92 8a 26 0a 8b 00 6f Oct 31 15:24:55.149002: | 73 9d 43 ad 3d 7e 89 c2 04 55 c8 50 b1 cd 37 db Oct 31 15:24:55.149005: | 79 4e 98 75 10 75 78 be a3 8a 87 2b 90 30 f2 3b Oct 31 15:24:55.149007: | 0b b5 6a d0 8b fa 70 bf de 71 14 4a 4c d2 fb cf Oct 31 15:24:55.149009: | 33 a5 67 af ad 10 98 99 05 49 83 61 a2 0d 52 9d Oct 31 15:24:55.149011: | da 43 b6 45 2a 02 dc 67 52 55 08 c2 e7 2f 2b e4 Oct 31 15:24:55.149014: | 14 e3 0b 40 93 b0 84 6e 48 f4 a7 1d f8 49 56 e8 Oct 31 15:24:55.149016: | 33 0d ab 8f 70 68 2b 54 f6 92 20 65 11 85 e4 b0 Oct 31 15:24:55.149018: | 13 3b 8f e3 3b 16 7f b5 47 0f f2 28 94 ad 0f ee Oct 31 15:24:55.149021: | 09 a2 b0 f4 6f 1b db 64 ea 0b c9 b5 04 22 06 bb Oct 31 15:24:55.149023: | 94 92 7f f0 49 d3 4f d8 a5 d3 cd c0 d0 02 40 7f Oct 31 15:24:55.149026: | 9b 35 d0 3c 0d 32 1c 85 94 f2 43 b2 a7 8f f3 8d Oct 31 15:24:55.149028: | 60 e4 00 97 9a 93 2e 1b 7d 20 7f a6 f5 46 18 e0 Oct 31 15:24:55.149030: | d3 ea 15 2d df d4 b0 1e 00 28 f5 21 6a ff e3 65 Oct 31 15:24:55.149033: | 75 88 24 35 6f af bf af 82 b2 ca 2c 47 4e eb 6c Oct 31 15:24:55.149035: | be 7e f8 35 fc f7 02 9f 36 04 d0 a1 7f be 36 ac Oct 31 15:24:55.149037: | d6 9b 12 d3 Oct 31 15:24:55.149041: | **parse ISAKMP Message: Oct 31 15:24:55.149044: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.149047: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.149049: | next payload type: ISAKMP_NEXT_v2SKF (0x35) Oct 31 15:24:55.149050: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:55.149052: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:55.149054: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:55.149056: | Message ID: 1 (00 00 00 01) Oct 31 15:24:55.149059: | length: 548 (00 00 02 24) Oct 31 15:24:55.149061: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) Oct 31 15:24:55.149063: | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request Oct 31 15:24:55.149067: | State DB: found IKEv2 state #2 in PARENT_R1 (find_v2_ike_sa) Oct 31 15:24:55.149072: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:55.149074: | #2 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 Oct 31 15:24:55.149076: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:24:55.149078: | #2 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:55.149081: "north-eastnets/0x2" #2: discarding packet received during asynchronous work (DNS or crypto) in STATE_PARENT_R1 Oct 31 15:24:55.149084: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:55.149088: | #2 spent 0.174 (0.172) milliseconds in ikev2_process_packet() Oct 31 15:24:55.149090: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:55.149092: | delref mdp@0x559bbabceb40(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.149094: | delref logger@0x559bbabb3560(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.149095: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:55.149098: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:55.149102: | spent 0.188 (0.187) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:55.250452: | spent 0.00272 (0.00272) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:55.250472: | newref struct msg_digest@0x559bbabceb40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.250475: | newref alloc logger@0x559bbabb3560(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.250481: | *received 548 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:55.250483: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.250485: | 35 20 23 08 00 00 00 01 00 00 02 24 23 00 02 08 Oct 31 15:24:55.250486: | 00 01 00 01 51 47 8a 54 1a 62 45 4b e2 33 f5 e6 Oct 31 15:24:55.250488: | 07 59 aa 45 48 e1 67 61 6e fb 6b ce 70 34 57 8d Oct 31 15:24:55.250490: | 6e ea 6a d4 0b f3 e0 f5 98 59 57 3e f9 42 cc 3a Oct 31 15:24:55.250491: | 28 d9 64 9b 41 d1 c3 4b 53 60 b5 bb 93 89 90 80 Oct 31 15:24:55.250493: | 68 9c c3 62 c8 e0 68 fa 62 29 ca cd b5 d1 28 fb Oct 31 15:24:55.250494: | 6c e3 4f 54 0c 6a b4 37 2a ac f6 6f 70 51 62 ed Oct 31 15:24:55.250496: | 63 d6 47 7e fc cf d6 c1 8a e5 c8 56 38 65 1d 90 Oct 31 15:24:55.250497: | 87 2d ef 93 98 1f 86 b4 5b 33 c7 36 d5 2a d9 8a Oct 31 15:24:55.250499: | db b2 23 7e 4a c9 7b 33 20 48 19 ac 22 e1 0d e8 Oct 31 15:24:55.250501: | e6 39 e7 5b 2c 9e 09 82 85 91 44 92 3c d1 c2 c7 Oct 31 15:24:55.250502: | 78 bd 40 2d b6 a3 20 ce 1e 89 d4 f0 7c 2b 32 e1 Oct 31 15:24:55.250504: | 98 93 17 f7 83 f5 3b fa 4d 94 49 09 7d 05 6d d5 Oct 31 15:24:55.250505: | c6 b9 c1 79 de 80 91 fa 45 be de 89 11 b3 ef 52 Oct 31 15:24:55.250507: | cc 24 53 4f e0 f8 d1 e4 33 e9 b4 21 ea 2a 8e d1 Oct 31 15:24:55.250509: | 6d 5a 29 b7 9f 5a 12 78 cc db 08 f6 a7 b9 a4 c2 Oct 31 15:24:55.250510: | f8 50 39 ad c2 ff cd ef 98 a6 c2 89 e5 bf 22 5c Oct 31 15:24:55.250512: | df f8 62 60 a3 08 1d a8 11 92 8a 26 0a 8b 00 6f Oct 31 15:24:55.250513: | 73 9d 43 ad 3d 7e 89 c2 04 55 c8 50 b1 cd 37 db Oct 31 15:24:55.250515: | 79 4e 98 75 10 75 78 be a3 8a 87 2b 90 30 f2 3b Oct 31 15:24:55.250516: | 0b b5 6a d0 8b fa 70 bf de 71 14 4a 4c d2 fb cf Oct 31 15:24:55.250518: | 33 a5 67 af ad 10 98 99 05 49 83 61 a2 0d 52 9d Oct 31 15:24:55.250520: | da 43 b6 45 2a 02 dc 67 52 55 08 c2 e7 2f 2b e4 Oct 31 15:24:55.250521: | 14 e3 0b 40 93 b0 84 6e 48 f4 a7 1d f8 49 56 e8 Oct 31 15:24:55.250523: | 33 0d ab 8f 70 68 2b 54 f6 92 20 65 11 85 e4 b0 Oct 31 15:24:55.250524: | 13 3b 8f e3 3b 16 7f b5 47 0f f2 28 94 ad 0f ee Oct 31 15:24:55.250526: | 09 a2 b0 f4 6f 1b db 64 ea 0b c9 b5 04 22 06 bb Oct 31 15:24:55.250527: | 94 92 7f f0 49 d3 4f d8 a5 d3 cd c0 d0 02 40 7f Oct 31 15:24:55.250529: | 9b 35 d0 3c 0d 32 1c 85 94 f2 43 b2 a7 8f f3 8d Oct 31 15:24:55.250531: | 60 e4 00 97 9a 93 2e 1b 7d 20 7f a6 f5 46 18 e0 Oct 31 15:24:55.250532: | d3 ea 15 2d df d4 b0 1e 00 28 f5 21 6a ff e3 65 Oct 31 15:24:55.250534: | 75 88 24 35 6f af bf af 82 b2 ca 2c 47 4e eb 6c Oct 31 15:24:55.250535: | be 7e f8 35 fc f7 02 9f 36 04 d0 a1 7f be 36 ac Oct 31 15:24:55.250537: | d6 9b 12 d3 Oct 31 15:24:55.250541: | **parse ISAKMP Message: Oct 31 15:24:55.250545: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.250548: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.250550: | next payload type: ISAKMP_NEXT_v2SKF (0x35) Oct 31 15:24:55.250552: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:55.250554: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:55.250556: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:55.250559: | Message ID: 1 (00 00 00 01) Oct 31 15:24:55.250562: | length: 548 (00 00 02 24) Oct 31 15:24:55.250564: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) Oct 31 15:24:55.250567: | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request Oct 31 15:24:55.250574: | State DB: found IKEv2 state #2 in PARENT_R1 (find_v2_ike_sa) Oct 31 15:24:55.250580: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:55.250582: | #2 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 Oct 31 15:24:55.250585: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:24:55.250587: | #2 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:55.250590: "north-eastnets/0x2" #2: discarding packet received during asynchronous work (DNS or crypto) in STATE_PARENT_R1 Oct 31 15:24:55.250593: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:55.250598: | #2 spent 0.154 (0.154) milliseconds in ikev2_process_packet() Oct 31 15:24:55.250600: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:55.250602: | delref mdp@0x559bbabceb40(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.250604: | delref logger@0x559bbabb3560(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.250606: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:55.250608: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:55.250612: | spent 0.169 (0.168) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:55.450917: | spent 0.00282 (0.00287) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:55.450936: | newref struct msg_digest@0x559bbabceb40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.450940: | newref alloc logger@0x559bbabb3560(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.450946: | *received 548 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:55.450948: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.450950: | 35 20 23 08 00 00 00 01 00 00 02 24 23 00 02 08 Oct 31 15:24:55.450952: | 00 01 00 01 51 47 8a 54 1a 62 45 4b e2 33 f5 e6 Oct 31 15:24:55.450953: | 07 59 aa 45 48 e1 67 61 6e fb 6b ce 70 34 57 8d Oct 31 15:24:55.450955: | 6e ea 6a d4 0b f3 e0 f5 98 59 57 3e f9 42 cc 3a Oct 31 15:24:55.450957: | 28 d9 64 9b 41 d1 c3 4b 53 60 b5 bb 93 89 90 80 Oct 31 15:24:55.450959: | 68 9c c3 62 c8 e0 68 fa 62 29 ca cd b5 d1 28 fb Oct 31 15:24:55.450960: | 6c e3 4f 54 0c 6a b4 37 2a ac f6 6f 70 51 62 ed Oct 31 15:24:55.450962: | 63 d6 47 7e fc cf d6 c1 8a e5 c8 56 38 65 1d 90 Oct 31 15:24:55.450964: | 87 2d ef 93 98 1f 86 b4 5b 33 c7 36 d5 2a d9 8a Oct 31 15:24:55.450966: | db b2 23 7e 4a c9 7b 33 20 48 19 ac 22 e1 0d e8 Oct 31 15:24:55.450967: | e6 39 e7 5b 2c 9e 09 82 85 91 44 92 3c d1 c2 c7 Oct 31 15:24:55.450969: | 78 bd 40 2d b6 a3 20 ce 1e 89 d4 f0 7c 2b 32 e1 Oct 31 15:24:55.450971: | 98 93 17 f7 83 f5 3b fa 4d 94 49 09 7d 05 6d d5 Oct 31 15:24:55.450973: | c6 b9 c1 79 de 80 91 fa 45 be de 89 11 b3 ef 52 Oct 31 15:24:55.450974: | cc 24 53 4f e0 f8 d1 e4 33 e9 b4 21 ea 2a 8e d1 Oct 31 15:24:55.450976: | 6d 5a 29 b7 9f 5a 12 78 cc db 08 f6 a7 b9 a4 c2 Oct 31 15:24:55.450978: | f8 50 39 ad c2 ff cd ef 98 a6 c2 89 e5 bf 22 5c Oct 31 15:24:55.450980: | df f8 62 60 a3 08 1d a8 11 92 8a 26 0a 8b 00 6f Oct 31 15:24:55.450981: | 73 9d 43 ad 3d 7e 89 c2 04 55 c8 50 b1 cd 37 db Oct 31 15:24:55.450983: | 79 4e 98 75 10 75 78 be a3 8a 87 2b 90 30 f2 3b Oct 31 15:24:55.450985: | 0b b5 6a d0 8b fa 70 bf de 71 14 4a 4c d2 fb cf Oct 31 15:24:55.450987: | 33 a5 67 af ad 10 98 99 05 49 83 61 a2 0d 52 9d Oct 31 15:24:55.450988: | da 43 b6 45 2a 02 dc 67 52 55 08 c2 e7 2f 2b e4 Oct 31 15:24:55.450990: | 14 e3 0b 40 93 b0 84 6e 48 f4 a7 1d f8 49 56 e8 Oct 31 15:24:55.450992: | 33 0d ab 8f 70 68 2b 54 f6 92 20 65 11 85 e4 b0 Oct 31 15:24:55.450994: | 13 3b 8f e3 3b 16 7f b5 47 0f f2 28 94 ad 0f ee Oct 31 15:24:55.450995: | 09 a2 b0 f4 6f 1b db 64 ea 0b c9 b5 04 22 06 bb Oct 31 15:24:55.450999: | 94 92 7f f0 49 d3 4f d8 a5 d3 cd c0 d0 02 40 7f Oct 31 15:24:55.451001: | 9b 35 d0 3c 0d 32 1c 85 94 f2 43 b2 a7 8f f3 8d Oct 31 15:24:55.451003: | 60 e4 00 97 9a 93 2e 1b 7d 20 7f a6 f5 46 18 e0 Oct 31 15:24:55.451005: | d3 ea 15 2d df d4 b0 1e 00 28 f5 21 6a ff e3 65 Oct 31 15:24:55.451007: | 75 88 24 35 6f af bf af 82 b2 ca 2c 47 4e eb 6c Oct 31 15:24:55.451008: | be 7e f8 35 fc f7 02 9f 36 04 d0 a1 7f be 36 ac Oct 31 15:24:55.451010: | d6 9b 12 d3 Oct 31 15:24:55.451015: | **parse ISAKMP Message: Oct 31 15:24:55.451019: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.451022: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.451024: | next payload type: ISAKMP_NEXT_v2SKF (0x35) Oct 31 15:24:55.451026: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:55.451028: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:55.451031: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:55.451034: | Message ID: 1 (00 00 00 01) Oct 31 15:24:55.451037: | length: 548 (00 00 02 24) Oct 31 15:24:55.451039: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) Oct 31 15:24:55.451042: | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request Oct 31 15:24:55.451046: | State DB: found IKEv2 state #2 in PARENT_R1 (find_v2_ike_sa) Oct 31 15:24:55.451052: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:55.451055: | #2 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 Oct 31 15:24:55.451057: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:24:55.451059: | #2 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:55.451062: "north-eastnets/0x2" #2: discarding packet received during asynchronous work (DNS or crypto) in STATE_PARENT_R1 Oct 31 15:24:55.451066: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:55.451071: | #2 spent 0.163 (0.163) milliseconds in ikev2_process_packet() Oct 31 15:24:55.451073: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:55.451076: | delref mdp@0x559bbabceb40(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.451078: | delref logger@0x559bbabb3560(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.451080: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:55.451082: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:55.451086: | spent 0.179 (0.178) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:55.800727: | calculating skeyseed using prf=HMAC_SHA2_256 integ=HMAC_SHA2_256_128 cipherkey-size=32 salt-size=0 Oct 31 15:24:55.800886: | "north-eastnets/0x2" #1: spent 0.828 (1e+03) milliseconds in helper 6 processing job 3 for state #1: ikev2_inR1outI2 KE (pcr) Oct 31 15:24:55.800894: | job 3 for #1: ikev2_inR1outI2 KE (compute dh (V2)): helper thread 6 sending result back to state Oct 31 15:24:55.800898: | scheduling resume sending helper answer back to state for #1 Oct 31 15:24:55.800902: | libevent_malloc: newref ptr-libevent@0x7f32c4011d50 size 128 Oct 31 15:24:55.800911: | helper thread 6 has nothing to do Oct 31 15:24:55.800922: | processing resume sending helper answer back to state for #1 Oct 31 15:24:55.800940: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:55.800945: | unsuspending #1 MD 0x559bbabcb9d0 Oct 31 15:24:55.800949: | job 3 for #1: ikev2_inR1outI2 KE (compute dh (V2)): processing response from helper 6 Oct 31 15:24:55.800952: | job 3 for #1: ikev2_inR1outI2 KE (compute dh (V2)): calling continuation function 0x559bb8fe3fe7 Oct 31 15:24:55.800955: | ikev2_parent_inR1outI2_continue() for #1 STATE_PARENT_I1: g^{xy} calculated, sending I2 Oct 31 15:24:55.800959: | DH secret MODP2048@0x7f32c8002b70: transferring ownership from helper IKEv2 DH to state #1 Oct 31 15:24:55.800969: | State DB: re-hashing IKEv2 state #1 IKE SPIi and SPI[ir] Oct 31 15:24:55.800994: | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 Oct 31 15:24:55.801011: | get_connection_private_key() using CKAID 905dfca10868747c6f20d31b2d204b8f88aa7c5d to find private key for @north->@east of kind RSA Oct 31 15:24:55.801013: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:55.801015: | matched Oct 31 15:24:55.801016: | secrets entry for ckaid already exists Oct 31 15:24:55.801018: | connection north-eastnets/0x2's RSA private key found in NSS DB using CKAID Oct 31 15:24:55.801022: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:55.801024: | addref fd@0x559bbabc6aa0(4->5) (in clone_logger() at log.c:810) Oct 31 15:24:55.801026: | newref clone logger@0x559bbabb3560(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:55.801028: | job 5 for #1: computing responder signature (signature): adding job to queue Oct 31 15:24:55.801030: | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:55.801037: | libevent_free: delref ptr-libevent@0x559bbabc3470 Oct 31 15:24:55.801039: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3500 Oct 31 15:24:55.801041: | #1 STATE_PARENT_I1: retransmits: cleared Oct 31 15:24:55.801043: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3500 Oct 31 15:24:55.801045: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 Oct 31 15:24:55.801049: | libevent_malloc: newref ptr-libevent@0x559bbabc3470 size 128 Oct 31 15:24:55.801062: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:55.801067: | #1 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 Oct 31 15:24:55.801070: | suspending state #1 and saving MD 0x559bbabcb9d0 Oct 31 15:24:55.801074: | addref md@0x559bbabcb9d0(1->2) (in complete_v2_state_transition() at ikev2.c:3485) Oct 31 15:24:55.801076: | #1 is busy; has suspended MD 0x559bbabcb9d0 Oct 31 15:24:55.801079: | delref logger@0x559bbabb4290(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:55.801082: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:55.801085: | delref fd@0x559bbabc6aa0(5->4) (in free_logger() at log.c:854) Oct 31 15:24:55.801089: | resume sending helper answer back to state for #1 suppresed complete_v2_state_transition() Oct 31 15:24:55.801092: | delref mdp@0x559bbabcb9d0(2->1) (in resume_handler() at server.c:743) Oct 31 15:24:55.801098: | #1 spent 0.148 (0.152) milliseconds in resume sending helper answer back to state Oct 31 15:24:55.801103: | stop processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:55.801106: | libevent_free: delref ptr-libevent@0x7f32c4011d50 Oct 31 15:24:55.801105: | job 5 for #1: computing responder signature (signature): helper 5 starting job Oct 31 15:24:55.801115: | helper 5 is pausing for 1 seconds Oct 31 15:24:55.851561: | spent 0.00258 (0.00254) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:55.851586: | newref struct msg_digest@0x559bbabd0550(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.851591: | newref alloc logger@0x559bbabb4290(0->1) (in read_message() at demux.c:103) Oct 31 15:24:55.851598: | *received 548 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:55.851601: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.851604: | 35 20 23 08 00 00 00 01 00 00 02 24 23 00 02 08 Oct 31 15:24:55.851606: | 00 01 00 01 51 47 8a 54 1a 62 45 4b e2 33 f5 e6 Oct 31 15:24:55.851609: | 07 59 aa 45 48 e1 67 61 6e fb 6b ce 70 34 57 8d Oct 31 15:24:55.851611: | 6e ea 6a d4 0b f3 e0 f5 98 59 57 3e f9 42 cc 3a Oct 31 15:24:55.851614: | 28 d9 64 9b 41 d1 c3 4b 53 60 b5 bb 93 89 90 80 Oct 31 15:24:55.851616: | 68 9c c3 62 c8 e0 68 fa 62 29 ca cd b5 d1 28 fb Oct 31 15:24:55.851618: | 6c e3 4f 54 0c 6a b4 37 2a ac f6 6f 70 51 62 ed Oct 31 15:24:55.851627: | 63 d6 47 7e fc cf d6 c1 8a e5 c8 56 38 65 1d 90 Oct 31 15:24:55.851629: | 87 2d ef 93 98 1f 86 b4 5b 33 c7 36 d5 2a d9 8a Oct 31 15:24:55.851630: | db b2 23 7e 4a c9 7b 33 20 48 19 ac 22 e1 0d e8 Oct 31 15:24:55.851632: | e6 39 e7 5b 2c 9e 09 82 85 91 44 92 3c d1 c2 c7 Oct 31 15:24:55.851633: | 78 bd 40 2d b6 a3 20 ce 1e 89 d4 f0 7c 2b 32 e1 Oct 31 15:24:55.851634: | 98 93 17 f7 83 f5 3b fa 4d 94 49 09 7d 05 6d d5 Oct 31 15:24:55.851636: | c6 b9 c1 79 de 80 91 fa 45 be de 89 11 b3 ef 52 Oct 31 15:24:55.851637: | cc 24 53 4f e0 f8 d1 e4 33 e9 b4 21 ea 2a 8e d1 Oct 31 15:24:55.851638: | 6d 5a 29 b7 9f 5a 12 78 cc db 08 f6 a7 b9 a4 c2 Oct 31 15:24:55.851640: | f8 50 39 ad c2 ff cd ef 98 a6 c2 89 e5 bf 22 5c Oct 31 15:24:55.851641: | df f8 62 60 a3 08 1d a8 11 92 8a 26 0a 8b 00 6f Oct 31 15:24:55.851642: | 73 9d 43 ad 3d 7e 89 c2 04 55 c8 50 b1 cd 37 db Oct 31 15:24:55.851644: | 79 4e 98 75 10 75 78 be a3 8a 87 2b 90 30 f2 3b Oct 31 15:24:55.851645: | 0b b5 6a d0 8b fa 70 bf de 71 14 4a 4c d2 fb cf Oct 31 15:24:55.851647: | 33 a5 67 af ad 10 98 99 05 49 83 61 a2 0d 52 9d Oct 31 15:24:55.851648: | da 43 b6 45 2a 02 dc 67 52 55 08 c2 e7 2f 2b e4 Oct 31 15:24:55.851649: | 14 e3 0b 40 93 b0 84 6e 48 f4 a7 1d f8 49 56 e8 Oct 31 15:24:55.851651: | 33 0d ab 8f 70 68 2b 54 f6 92 20 65 11 85 e4 b0 Oct 31 15:24:55.851652: | 13 3b 8f e3 3b 16 7f b5 47 0f f2 28 94 ad 0f ee Oct 31 15:24:55.851653: | 09 a2 b0 f4 6f 1b db 64 ea 0b c9 b5 04 22 06 bb Oct 31 15:24:55.851655: | 94 92 7f f0 49 d3 4f d8 a5 d3 cd c0 d0 02 40 7f Oct 31 15:24:55.851656: | 9b 35 d0 3c 0d 32 1c 85 94 f2 43 b2 a7 8f f3 8d Oct 31 15:24:55.851657: | 60 e4 00 97 9a 93 2e 1b 7d 20 7f a6 f5 46 18 e0 Oct 31 15:24:55.851659: | d3 ea 15 2d df d4 b0 1e 00 28 f5 21 6a ff e3 65 Oct 31 15:24:55.851660: | 75 88 24 35 6f af bf af 82 b2 ca 2c 47 4e eb 6c Oct 31 15:24:55.851661: | be 7e f8 35 fc f7 02 9f 36 04 d0 a1 7f be 36 ac Oct 31 15:24:55.851663: | d6 9b 12 d3 Oct 31 15:24:55.851667: | **parse ISAKMP Message: Oct 31 15:24:55.851670: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:55.851673: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:55.851675: | next payload type: ISAKMP_NEXT_v2SKF (0x35) Oct 31 15:24:55.851676: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:55.851678: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:55.851680: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:55.851683: | Message ID: 1 (00 00 00 01) Oct 31 15:24:55.851685: | length: 548 (00 00 02 24) Oct 31 15:24:55.851687: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) Oct 31 15:24:55.851690: | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request Oct 31 15:24:55.851693: | State DB: found IKEv2 state #2 in PARENT_R1 (find_v2_ike_sa) Oct 31 15:24:55.851698: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:55.851700: | #2 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 Oct 31 15:24:55.851702: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:24:55.851704: | #2 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:55.851707: "north-eastnets/0x2" #2: discarding packet received during asynchronous work (DNS or crypto) in STATE_PARENT_R1 Oct 31 15:24:55.851710: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:55.851714: | #2 spent 0.157 (0.16) milliseconds in ikev2_process_packet() Oct 31 15:24:55.851716: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:55.851718: | delref mdp@0x559bbabd0550(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.851720: | delref logger@0x559bbabb4290(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:55.851721: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:55.851724: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:55.851728: | spent 0.171 (0.174) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:56.048205: | calculating skeyseed using prf=HMAC_SHA2_256 integ=HMAC_SHA2_256_128 cipherkey-size=32 salt-size=0 Oct 31 15:24:56.048316: | "north-eastnets/0x2" #2: spent 0.753 (1e+03) milliseconds in helper 2 processing job 4 for state #2: ikev2_inI2outR2 KE (pcr) Oct 31 15:24:56.048320: | job 4 for #2: ikev2_inI2outR2 KE (compute dh (V2)): helper thread 2 sending result back to state Oct 31 15:24:56.048323: | scheduling resume sending helper answer back to state for #2 Oct 31 15:24:56.048326: | libevent_malloc: newref ptr-libevent@0x7f32b8010fa0 size 128 Oct 31 15:24:56.048334: | helper thread 2 has nothing to do Oct 31 15:24:56.048345: | processing resume sending helper answer back to state for #2 Oct 31 15:24:56.048356: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:56.048360: | unsuspending #2 MD 0x559bbabc8750 Oct 31 15:24:56.048363: | job 4 for #2: ikev2_inI2outR2 KE (compute dh (V2)): processing response from helper 2 Oct 31 15:24:56.048365: | job 4 for #2: ikev2_inI2outR2 KE (compute dh (V2)): calling continuation function 0x559bb8fe3fe7 Oct 31 15:24:56.048367: | ikev2_ike_sa_process_auth_request_no_skeyid_continue() for #2 STATE_PARENT_R1: calculating g^{xy}, sending R2 Oct 31 15:24:56.048370: | DH secret MODP2048@0x7f32c0002b70: transferring ownership from helper IKEv2 DH to state #2 Oct 31 15:24:56.048373: | #2 in state PARENT_R1: sent IKE_SA_INIT reply Oct 31 15:24:56.048375: | already have all fragments, skipping fragment collection Oct 31 15:24:56.048377: | already have all fragments, skipping fragment collection Oct 31 15:24:56.048402: | authenticator matched Oct 31 15:24:56.048412: | #2 ikev2 ISAKMP_v2_IKE_AUTH decrypt success Oct 31 15:24:56.048414: | Now let's proceed with payload (ISAKMP_NEXT_v2IDi) Oct 31 15:24:56.048418: | **parse IKEv2 Identification - Initiator - Payload: Oct 31 15:24:56.048420: | next payload type: ISAKMP_NEXT_v2IDr (0x24) Oct 31 15:24:56.048422: | flags: none (0x0) Oct 31 15:24:56.048424: | length: 12 (00 0c) Oct 31 15:24:56.048426: | ID type: ID_FQDN (0x2) Oct 31 15:24:56.048429: | reserved: 00 00 00 Oct 31 15:24:56.048430: | processing payload: ISAKMP_NEXT_v2IDi (len=4) Oct 31 15:24:56.048432: | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) Oct 31 15:24:56.048434: | **parse IKEv2 Identification - Responder - Payload: Oct 31 15:24:56.048435: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) Oct 31 15:24:56.048437: | flags: none (0x0) Oct 31 15:24:56.048439: | length: 13 (00 0d) Oct 31 15:24:56.048441: | ID type: ID_FQDN (0x2) Oct 31 15:24:56.048443: | reserved: 00 00 00 Oct 31 15:24:56.048444: | processing payload: ISAKMP_NEXT_v2IDr (len=5) Oct 31 15:24:56.048446: | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) Oct 31 15:24:56.048448: | **parse IKEv2 Authentication Payload: Oct 31 15:24:56.048449: | next payload type: ISAKMP_NEXT_v2SA (0x21) Oct 31 15:24:56.048451: | flags: none (0x0) Oct 31 15:24:56.048453: | length: 350 (01 5e) Oct 31 15:24:56.048455: | auth method: IKEv2_AUTH_DIGSIG (0xe) Oct 31 15:24:56.048456: | processing payload: ISAKMP_NEXT_v2AUTH (len=342) Oct 31 15:24:56.048458: | Now let's proceed with payload (ISAKMP_NEXT_v2SA) Oct 31 15:24:56.048460: | **parse IKEv2 Security Association Payload: Oct 31 15:24:56.048461: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) Oct 31 15:24:56.048463: | flags: none (0x0) Oct 31 15:24:56.048465: | length: 44 (00 2c) Oct 31 15:24:56.048466: | processing payload: ISAKMP_NEXT_v2SA (len=40) Oct 31 15:24:56.048468: | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) Oct 31 15:24:56.048470: | **parse IKEv2 Traffic Selector - Initiator - Payload: Oct 31 15:24:56.048471: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) Oct 31 15:24:56.048473: | flags: none (0x0) Oct 31 15:24:56.048475: | length: 24 (00 18) Oct 31 15:24:56.048481: | number of TS: 1 (01) Oct 31 15:24:56.048483: | processing payload: ISAKMP_NEXT_v2TSi (len=16) Oct 31 15:24:56.048485: | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) Oct 31 15:24:56.048486: | **parse IKEv2 Traffic Selector - Responder - Payload: Oct 31 15:24:56.048488: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.048492: | flags: none (0x0) Oct 31 15:24:56.048495: | length: 24 (00 18) Oct 31 15:24:56.048496: | number of TS: 1 (01) Oct 31 15:24:56.048498: | processing payload: ISAKMP_NEXT_v2TSr (len=16) Oct 31 15:24:56.048500: | selected state microcode Responder: process IKE_AUTH request Oct 31 15:24:56.048505: | Message ID: IKE #2 responder starting message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744569.46988 ike.wip.initiator=-1 ike.wip.responder=-1->1 Oct 31 15:24:56.048507: | calling processor Responder: process IKE_AUTH request Oct 31 15:24:56.048513: "north-eastnets/0x2" #2: processing decrypted IKE_AUTH request: SK{IDi,IDr,AUTH,SA,TSi,TSr} Oct 31 15:24:56.048515: | no certs to decode Oct 31 15:24:56.048520: | #2 updating local interface from 192.1.3.33:500 to 192.1.3.33:500 using md->iface (in update_ike_endpoints() at state.c:2631) Oct 31 15:24:56.048522: | received IDr payload - extracting our alleged ID Oct 31 15:24:56.048525: | refine_host_connection for IKEv2: starting with "north-eastnets/0x2" Oct 31 15:24:56.048528: | match_id a=@east Oct 31 15:24:56.048529: | b=@east Oct 31 15:24:56.048531: | results matched Oct 31 15:24:56.048534: | refine_host_connection: checking "north-eastnets/0x2" against "north-eastnets/0x2", best=(none) with match=1(id=1(0)/ca=1(0)/reqca=1(0)) Oct 31 15:24:56.048535: | warning: not switching back to template of current instance Oct 31 15:24:56.048537: | peer expects us to be @north (ID_FQDN) according to its IDr payload Oct 31 15:24:56.048539: | this connection's local id is @north (ID_FQDN) Oct 31 15:24:56.048541: | refine_host_connection: checked "north-eastnets/0x2" against "north-eastnets/0x2", now for see if best Oct 31 15:24:56.048546: | get_connection_private_key() using CKAID 905dfca10868747c6f20d31b2d204b8f88aa7c5d to find private key for @north->@east of kind RSA Oct 31 15:24:56.048548: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:56.048550: | matched Oct 31 15:24:56.048551: | secrets entry for ckaid already exists Oct 31 15:24:56.048553: | connection north-eastnets/0x2's RSA private key found in NSS DB using CKAID Oct 31 15:24:56.048554: | returning because exact peer id match Oct 31 15:24:56.048556: | offered CA: '%none' Oct 31 15:24:56.048559: "north-eastnets/0x2" #2: IKEv2 mode peer ID is ID_FQDN: '@east' Oct 31 15:24:56.048574: | verifying AUTH payload Oct 31 15:24:56.048577: | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 Oct 31 15:24:56.048579: | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo Oct 31 15:24:56.048581: | ASN.1 blob for hash algo Oct 31 15:24:56.048582: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 Oct 31 15:24:56.048584: | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 Oct 31 15:24:56.048585: | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 Oct 31 15:24:56.048587: | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 Oct 31 15:24:56.048588: | 03 02 01 40 Oct 31 15:24:56.048600: | required RSA CA is '%any' Oct 31 15:24:56.048602: | trying all remote certificates public keys for RSA key that matches ID: @east Oct 31 15:24:56.048604: | trying all preloaded keys public keys for RSA key that matches ID: @east Oct 31 15:24:56.048606: | trying '@east' issued by CA '%any' Oct 31 15:24:56.048608: | NSS RSA: verifying that decrypted signature matches hash: Oct 31 15:24:56.048610: | f1 6e 77 c4 13 e5 42 9f 26 76 a1 e8 b0 22 a5 4e Oct 31 15:24:56.048611: | 43 18 b1 88 94 d2 2c 7d 68 e0 63 41 33 d0 dd 05 Oct 31 15:24:56.048613: | cb 75 88 b3 6b 36 78 aa e7 41 b2 44 83 bc 10 a8 Oct 31 15:24:56.048616: | 71 cb 04 91 b6 fd 27 5a c7 ed 2d e0 e8 af f9 ec Oct 31 15:24:56.048663: | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) Oct 31 15:24:56.048667: | addref pk@0x559bbabc5ab0(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) Oct 31 15:24:56.048669: | an RSA Sig check passed with *AQO9bJbr3 [preloaded keys] Oct 31 15:24:56.048673: | #2 spent 0.0633 (0.0633) milliseconds in try_all_keys() trying a pubkey Oct 31 15:24:56.048676: "north-eastnets/0x2" #2: authenticated using RSA with SHA2_512 Oct 31 15:24:56.048679: | #2 spent 0.0871 (0.087) milliseconds in ikev2_verify_rsa_hash() Oct 31 15:24:56.048691: | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 Oct 31 15:24:56.048701: | get_connection_private_key() using CKAID 905dfca10868747c6f20d31b2d204b8f88aa7c5d to find private key for @north->@east of kind RSA Oct 31 15:24:56.048702: | trying secret PKK_RSA:AQPl33O2P Oct 31 15:24:56.048704: | matched Oct 31 15:24:56.048705: | secrets entry for ckaid already exists Oct 31 15:24:56.048707: | connection north-eastnets/0x2's RSA private key found in NSS DB using CKAID Oct 31 15:24:56.048710: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:56.048712: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:24:56.048714: | newref clone logger@0x559bbabc9f30(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:56.048715: | job 6 for #2: computing responder signature (signature): adding job to queue Oct 31 15:24:56.048717: | state #2 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:56.048720: | libevent_free: delref ptr-libevent@0x559bbabc3340 Oct 31 15:24:56.048722: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3410 Oct 31 15:24:56.048724: | #2 STATE_PARENT_R1: retransmits: cleared Oct 31 15:24:56.048726: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3410 Oct 31 15:24:56.048728: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #2 Oct 31 15:24:56.048729: | libevent_malloc: newref ptr-libevent@0x559bbabc3340 size 128 Oct 31 15:24:56.048735: | ikev2_parent_inI2outR2_continue_tail returned STF_SUSPEND Oct 31 15:24:56.048739: | #2 spent 0.226 (0.228) milliseconds in processing: Responder: process IKE_AUTH request in v2_dispatch() Oct 31 15:24:56.048743: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:56.048746: | #2 complete_v2_state_transition() PARENT_R1->ESTABLISHED_CHILD_SA with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 Oct 31 15:24:56.048748: | suspending state #2 and saving MD 0x559bbabc8750 Oct 31 15:24:56.048750: | addref md@0x559bbabc8750(1->2) (in complete_v2_state_transition() at ikev2.c:3485) Oct 31 15:24:56.048751: | #2 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:56.048753: | delref logger@0x559bbabb42e0(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:56.048755: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:56.048756: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:56.048758: | resume sending helper answer back to state for #2 suppresed complete_v2_state_transition() Oct 31 15:24:56.048760: | delref mdp@0x559bbabc8750(2->1) (in resume_handler() at server.c:743) Oct 31 15:24:56.048763: | #2 spent 0.395 (0.403) milliseconds in resume sending helper answer back to state Oct 31 15:24:56.048766: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:56.048768: | libevent_free: delref ptr-libevent@0x7f32b8010fa0 Oct 31 15:24:56.048772: | job 6 for #2: computing responder signature (signature): helper 4 starting job Oct 31 15:24:56.048778: | helper 4 is pausing for 1 seconds Oct 31 15:24:56.652576: | spent 0.00375 (0.0037) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:56.652601: | newref struct msg_digest@0x559bbabd1130(0->1) (in read_message() at demux.c:103) Oct 31 15:24:56.652607: | newref alloc logger@0x559bbabb42e0(0->1) (in read_message() at demux.c:103) Oct 31 15:24:56.652620: | *received 548 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:56.652624: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:56.652627: | 35 20 23 08 00 00 00 01 00 00 02 24 23 00 02 08 Oct 31 15:24:56.652631: | 00 01 00 01 51 47 8a 54 1a 62 45 4b e2 33 f5 e6 Oct 31 15:24:56.652635: | 07 59 aa 45 48 e1 67 61 6e fb 6b ce 70 34 57 8d Oct 31 15:24:56.652638: | 6e ea 6a d4 0b f3 e0 f5 98 59 57 3e f9 42 cc 3a Oct 31 15:24:56.652642: | 28 d9 64 9b 41 d1 c3 4b 53 60 b5 bb 93 89 90 80 Oct 31 15:24:56.652645: | 68 9c c3 62 c8 e0 68 fa 62 29 ca cd b5 d1 28 fb Oct 31 15:24:56.652648: | 6c e3 4f 54 0c 6a b4 37 2a ac f6 6f 70 51 62 ed Oct 31 15:24:56.652651: | 63 d6 47 7e fc cf d6 c1 8a e5 c8 56 38 65 1d 90 Oct 31 15:24:56.652655: | 87 2d ef 93 98 1f 86 b4 5b 33 c7 36 d5 2a d9 8a Oct 31 15:24:56.652658: | db b2 23 7e 4a c9 7b 33 20 48 19 ac 22 e1 0d e8 Oct 31 15:24:56.652662: | e6 39 e7 5b 2c 9e 09 82 85 91 44 92 3c d1 c2 c7 Oct 31 15:24:56.652665: | 78 bd 40 2d b6 a3 20 ce 1e 89 d4 f0 7c 2b 32 e1 Oct 31 15:24:56.652668: | 98 93 17 f7 83 f5 3b fa 4d 94 49 09 7d 05 6d d5 Oct 31 15:24:56.652672: | c6 b9 c1 79 de 80 91 fa 45 be de 89 11 b3 ef 52 Oct 31 15:24:56.652675: | cc 24 53 4f e0 f8 d1 e4 33 e9 b4 21 ea 2a 8e d1 Oct 31 15:24:56.652679: | 6d 5a 29 b7 9f 5a 12 78 cc db 08 f6 a7 b9 a4 c2 Oct 31 15:24:56.652682: | f8 50 39 ad c2 ff cd ef 98 a6 c2 89 e5 bf 22 5c Oct 31 15:24:56.652685: | df f8 62 60 a3 08 1d a8 11 92 8a 26 0a 8b 00 6f Oct 31 15:24:56.652689: | 73 9d 43 ad 3d 7e 89 c2 04 55 c8 50 b1 cd 37 db Oct 31 15:24:56.652692: | 79 4e 98 75 10 75 78 be a3 8a 87 2b 90 30 f2 3b Oct 31 15:24:56.652695: | 0b b5 6a d0 8b fa 70 bf de 71 14 4a 4c d2 fb cf Oct 31 15:24:56.652699: | 33 a5 67 af ad 10 98 99 05 49 83 61 a2 0d 52 9d Oct 31 15:24:56.652702: | da 43 b6 45 2a 02 dc 67 52 55 08 c2 e7 2f 2b e4 Oct 31 15:24:56.652705: | 14 e3 0b 40 93 b0 84 6e 48 f4 a7 1d f8 49 56 e8 Oct 31 15:24:56.652709: | 33 0d ab 8f 70 68 2b 54 f6 92 20 65 11 85 e4 b0 Oct 31 15:24:56.652712: | 13 3b 8f e3 3b 16 7f b5 47 0f f2 28 94 ad 0f ee Oct 31 15:24:56.652716: | 09 a2 b0 f4 6f 1b db 64 ea 0b c9 b5 04 22 06 bb Oct 31 15:24:56.652719: | 94 92 7f f0 49 d3 4f d8 a5 d3 cd c0 d0 02 40 7f Oct 31 15:24:56.652723: | 9b 35 d0 3c 0d 32 1c 85 94 f2 43 b2 a7 8f f3 8d Oct 31 15:24:56.652726: | 60 e4 00 97 9a 93 2e 1b 7d 20 7f a6 f5 46 18 e0 Oct 31 15:24:56.652729: | d3 ea 15 2d df d4 b0 1e 00 28 f5 21 6a ff e3 65 Oct 31 15:24:56.652733: | 75 88 24 35 6f af bf af 82 b2 ca 2c 47 4e eb 6c Oct 31 15:24:56.652736: | be 7e f8 35 fc f7 02 9f 36 04 d0 a1 7f be 36 ac Oct 31 15:24:56.652739: | d6 9b 12 d3 Oct 31 15:24:56.652747: | **parse ISAKMP Message: Oct 31 15:24:56.652754: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:56.652761: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:56.652765: | next payload type: ISAKMP_NEXT_v2SKF (0x35) Oct 31 15:24:56.652769: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:56.652773: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:56.652778: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:56.652784: | Message ID: 1 (00 00 00 01) Oct 31 15:24:56.652789: | length: 548 (00 00 02 24) Oct 31 15:24:56.652794: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) Oct 31 15:24:56.652800: | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request Oct 31 15:24:56.652807: | State DB: found IKEv2 state #2 in PARENT_R1 (find_v2_ike_sa) Oct 31 15:24:56.652818: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:56.652823: | #2 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 Oct 31 15:24:56.652827: | #2 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:56.652833: "north-eastnets/0x2" #2: discarding packet received during asynchronous work (DNS or crypto) in STATE_PARENT_R1 Oct 31 15:24:56.652844: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:56.652853: | #2 spent 0.287 (0.286) milliseconds in ikev2_process_packet() Oct 31 15:24:56.652858: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:56.652863: | delref mdp@0x559bbabd1130(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:56.652868: | delref logger@0x559bbabb42e0(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:56.652872: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:56.652876: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:56.652883: | spent 0.318 (0.317) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:56.801185: | hash to sign Oct 31 15:24:56.801207: | 8a c1 31 df 80 f6 6b 2e 8a 90 be d9 25 a6 6f 2c Oct 31 15:24:56.801213: | e4 bd 09 15 71 a1 3f f9 65 74 85 75 c8 26 d4 84 Oct 31 15:24:56.801217: | 58 71 a3 9a d6 a8 84 c9 0b 3b 41 3c 07 6f 3d 22 Oct 31 15:24:56.801219: | fd be 73 7e 8a 23 53 4c 26 dc 8a 5e 10 3d 31 43 Oct 31 15:24:56.801224: | RSA_sign_hash: Started using NSS Oct 31 15:24:56.811454: | RSA_sign_hash: Ended using NSS Oct 31 15:24:56.811488: | "north-eastnets/0x2" #1: spent 10.1 (10.3) milliseconds in v2_auth_signature() calling sign_hash() Oct 31 15:24:56.811497: | "north-eastnets/0x2" #1: spent 10.2 (10.3) milliseconds in v2_auth_signature() Oct 31 15:24:56.811506: | "north-eastnets/0x2" #1: spent 10.2 (1.01e+03) milliseconds in helper 5 processing job 5 for state #1: computing responder signature (signature) Oct 31 15:24:56.811510: | job 5 for #1: computing responder signature (signature): helper thread 5 sending result back to state Oct 31 15:24:56.811515: | scheduling resume sending helper answer back to state for #1 Oct 31 15:24:56.811521: | libevent_malloc: newref ptr-libevent@0x7f32bc000c80 size 128 Oct 31 15:24:56.811535: | helper thread 5 has nothing to do Oct 31 15:24:56.811580: | processing resume sending helper answer back to state for #1 Oct 31 15:24:56.811595: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:56.811600: | unsuspending #1 MD 0x559bbabcb9d0 Oct 31 15:24:56.811603: | job 5 for #1: computing responder signature (signature): processing response from helper 5 Oct 31 15:24:56.811606: | job 5 for #1: computing responder signature (signature): calling continuation function 0x559bb8f1277f Oct 31 15:24:56.811612: | newref alloc logger@0x559bbabb42e0(0->1) (in new_state() at state.c:576) Oct 31 15:24:56.811615: | addref fd@0x559bbabc6aa0(4->5) (in new_state() at state.c:577) Oct 31 15:24:56.811618: | creating state object #3 at 0x559bbabd1130 Oct 31 15:24:56.811621: | State DB: adding IKEv2 state #3 in UNDEFINED Oct 31 15:24:56.811626: | pstats #3 ikev2.child started Oct 31 15:24:56.811629: | duplicating state object #1 "north-eastnets/0x2" as #3 for IPSEC SA Oct 31 15:24:56.811634: | #3 setting local endpoint to 192.1.3.33:500 from #1.st_localport (in duplicate_state() at state.c:1581) Oct 31 15:24:56.811643: | Message ID: CHILD #1.#3 initializing (CHILD SA): ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744568.227774 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=0->-1 child.wip.responder=0->-1 Oct 31 15:24:56.811647: | child state #3: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_I0(ignore) Oct 31 15:24:56.811651: | #3.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) Oct 31 15:24:56.811657: | Message ID: IKE #1 switching from IKE SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744568.227774 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=0->-1 ike.wip.responder=-1 Oct 31 15:24:56.811662: | Message ID: CHILD #1.#3 switching to CHILD SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744568.227774 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1->0 child.wip.responder=-1 Oct 31 15:24:56.811670: | switching IKEv2 MD.ST from IKE #1 PARENT_I1 to CHILD #3 V2_IKE_AUTH_CHILD_I0 (in ikev2_parent_inR1outI2_auth_signature_continue() at ikev2_parent.c:2155) Oct 31 15:24:56.811673: | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:56.811677: | libevent_free: delref ptr-libevent@0x559bbabc3470 Oct 31 15:24:56.811679: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3500 Oct 31 15:24:56.811682: | #1 STATE_PARENT_I1: retransmits: cleared Oct 31 15:24:56.811685: | event_schedule: newref EVENT_SA_REPLACE-pe@0x559bbabc3500 Oct 31 15:24:56.811688: | inserting event EVENT_SA_REPLACE, timeout in 120 seconds for #1 Oct 31 15:24:56.811690: | libevent_malloc: newref ptr-libevent@0x559bbabc3470 size 128 Oct 31 15:24:56.811694: | parent state #1: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) Oct 31 15:24:56.811700: | opening output PBS reply packet Oct 31 15:24:56.811703: | **emit ISAKMP Message: Oct 31 15:24:56.811707: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:24:56.811711: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:56.811714: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:24:56.811716: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:56.811719: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:56.811721: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:56.811725: | Message ID: 1 (00 00 00 01) Oct 31 15:24:56.811728: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:24:56.811731: | ***emit IKEv2 Encryption Payload: Oct 31 15:24:56.811734: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.811736: | flags: none (0x0) Oct 31 15:24:56.811739: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:24:56.811741: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' Oct 31 15:24:56.811744: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:24:56.811755: | IKEv2 CERT: send a certificate? Oct 31 15:24:56.811758: | IKEv2 CERT: no certificate to send Oct 31 15:24:56.811760: | IDr payload will be sent Oct 31 15:24:56.811763: | ****emit IKEv2 Identification - Initiator - Payload: Oct 31 15:24:56.811765: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.811767: | flags: none (0x0) Oct 31 15:24:56.811770: | ID type: ID_FQDN (0x2) Oct 31 15:24:56.811773: | reserved: 00 00 00 Oct 31 15:24:56.811775: | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) Oct 31 15:24:56.811778: | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:56.811781: | emitting 5 raw bytes of my identity into IKEv2 Identification - Initiator - Payload Oct 31 15:24:56.811784: | my identity: 6e 6f 72 74 68 Oct 31 15:24:56.811786: | emitting length of IKEv2 Identification - Initiator - Payload: 13 Oct 31 15:24:56.811789: | ****emit IKEv2 Identification - Responder - Payload: Oct 31 15:24:56.811791: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.811793: | flags: none (0x0) Oct 31 15:24:56.811795: | ID type: ID_FQDN (0x2) Oct 31 15:24:56.811798: | reserved: 00 00 00 Oct 31 15:24:56.811801: | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) Oct 31 15:24:56.811803: | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:56.811807: | emitting 4 raw bytes of their IDr into IKEv2 Identification - Responder - Payload Oct 31 15:24:56.811810: | their IDr: 65 61 73 74 Oct 31 15:24:56.811812: | emitting length of IKEv2 Identification - Responder - Payload: 12 Oct 31 15:24:56.811814: | not sending INITIAL_CONTACT Oct 31 15:24:56.811817: | ****emit IKEv2 Authentication Payload: Oct 31 15:24:56.811819: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.811821: | flags: none (0x0) Oct 31 15:24:56.811824: | auth method: IKEv2_AUTH_DIGSIG (0xe) Oct 31 15:24:56.811826: | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) Oct 31 15:24:56.811828: | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' Oct 31 15:24:56.811831: | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 Oct 31 15:24:56.811833: | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload Oct 31 15:24:56.811835: | OID of ASN.1 Algorithm Identifier: Oct 31 15:24:56.811838: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 Oct 31 15:24:56.811840: | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 Oct 31 15:24:56.811842: | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 Oct 31 15:24:56.811844: | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 Oct 31 15:24:56.811846: | 03 02 01 40 Oct 31 15:24:56.811849: | emitting 274 raw bytes of signature into IKEv2 Authentication Payload Oct 31 15:24:56.811851: | signature: Oct 31 15:24:56.811853: | 52 3b 4c ed 93 00 72 5d e2 09 32 d0 a4 4c a6 96 Oct 31 15:24:56.811855: | 07 39 e4 23 ab fa 17 8d 1b eb 58 b1 0f 69 40 81 Oct 31 15:24:56.811857: | b8 6e b1 51 72 03 8b e3 43 1f 8e 71 cb 73 d6 af Oct 31 15:24:56.811859: | 2c ea 33 6b b8 e3 36 f2 6c 28 9a a0 5f 2a b0 fc Oct 31 15:24:56.811861: | f9 b4 de 59 c6 04 f3 22 11 a9 cf 10 84 bf 6c 62 Oct 31 15:24:56.811863: | 3c 49 35 d1 3b 64 e5 91 fb c8 e5 01 fc 8e e3 57 Oct 31 15:24:56.811865: | db 35 f4 15 56 a9 58 2e 09 2e 49 a2 e5 c2 8f 66 Oct 31 15:24:56.811867: | 2d 7a b5 e5 c2 cd ae 53 35 a7 99 0c 01 51 62 a7 Oct 31 15:24:56.811869: | a1 ab 16 6c cb 6c 7e 40 cf 9e ba 7e dd b4 dd 59 Oct 31 15:24:56.811871: | de 24 69 25 e5 19 91 ee 8d 68 96 5e 2d de d9 70 Oct 31 15:24:56.811873: | 39 03 ab 9e 62 9a 4b 64 b3 95 de d1 65 54 3c d1 Oct 31 15:24:56.811875: | 02 19 2d 3f 7a 89 a6 34 75 24 93 d5 70 1c ed 13 Oct 31 15:24:56.811877: | 0d ab 5c 78 d4 21 12 3f 41 e9 6e 79 ab d4 5f 40 Oct 31 15:24:56.811879: | 92 6e 63 8d 9a fb 8f 46 b1 06 4a 6c 4f d6 0b a1 Oct 31 15:24:56.811881: | 8c 10 a6 04 a4 a2 b1 84 d6 56 b2 75 3c 62 73 aa Oct 31 15:24:56.811883: | 4c bf 89 be ed e3 3b 84 bd 73 00 af 05 cd e1 65 Oct 31 15:24:56.811885: | ce 1f b0 8f e9 d2 55 a0 e3 0c 01 c9 65 44 5e 7d Oct 31 15:24:56.811887: | 4f a5 Oct 31 15:24:56.811889: | emitting length of IKEv2 Authentication Payload: 350 Oct 31 15:24:56.811891: | getting first pending from state #1 Oct 31 15:24:56.811895: | delref fd@0x559bbabc6aa0(5->4) (in first_pending() at pending.c:318) Oct 31 15:24:56.811897: | addref fd@0x559bbabc6aa0(4->5) (in first_pending() at pending.c:319) Oct 31 15:24:56.811900: | Switching Child connection for #3 to "north-eastnets/0x1" from "north-eastnets/0x2" Oct 31 15:24:56.811906: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:24:56.811926: | netlink_get_spi: allocated 0x1e003267 for esp.0@192.1.3.33 Oct 31 15:24:56.811929: | constructing ESP/AH proposals with all DH removed for north-eastnets/0x1 (IKE SA initiator emitting ESP/AH proposals) Oct 31 15:24:56.811935: | converting proposal AES_CBC_128-HMAC_SHA2_512_256-MODP3072 to ikev2 ... Oct 31 15:24:56.811942: | ... ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-NONE-DISABLED Oct 31 15:24:56.811945: "north-eastnets/0x1": local ESP/AH proposals (IKE SA initiator emitting ESP/AH proposals): Oct 31 15:24:56.811949: "north-eastnets/0x1": 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-NONE-DISABLED Oct 31 15:24:56.811953: | Emitting ikev2_proposals ... Oct 31 15:24:56.811955: | ****emit IKEv2 Security Association Payload: Oct 31 15:24:56.811957: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.811960: | flags: none (0x0) Oct 31 15:24:56.811962: | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) Oct 31 15:24:56.811964: | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' Oct 31 15:24:56.811968: | discard DH=NONE when counting transforms (multiple 0; allow single 0) Oct 31 15:24:56.811971: | *****emit IKEv2 Proposal Substructure Payload: Oct 31 15:24:56.811973: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:56.811976: | prop #: 1 (01) Oct 31 15:24:56.811978: | proto ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:24:56.811980: | spi size: 4 (04) Oct 31 15:24:56.811983: | # transforms: 3 (03) Oct 31 15:24:56.811985: | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' Oct 31 15:24:56.811988: | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload Oct 31 15:24:56.811991: | our spi: 1e 00 32 67 Oct 31 15:24:56.811993: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:56.811995: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:56.811997: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:56.812000: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:56.812002: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:56.812004: | *******emit IKEv2 Attribute Substructure Payload: Oct 31 15:24:56.812007: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:56.812009: | length/value: 128 (00 80) Oct 31 15:24:56.812012: | emitting length of IKEv2 Transform Substructure Payload: 12 Oct 31 15:24:56.812014: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:56.812016: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:56.812018: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:56.812020: | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) Oct 31 15:24:56.812023: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:56.812025: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:56.812027: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:56.812030: | discard DH=NONE when emitting proposal (multiple 0; allow single 0) Oct 31 15:24:56.812032: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:56.812034: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:56.812036: | IKEv2 transform type: TRANS_TYPE_ESN (0x5) Oct 31 15:24:56.812038: | IKEv2 transform ID: ESN_DISABLED (0x0) Oct 31 15:24:56.812040: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:56.812042: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:56.812044: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:56.812046: | emitting length of IKEv2 Proposal Substructure Payload: 40 Oct 31 15:24:56.812048: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 Oct 31 15:24:56.812050: | emitting length of IKEv2 Security Association Payload: 44 Oct 31 15:24:56.812052: | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 Oct 31 15:24:56.812058: | ****emit IKEv2 Traffic Selector - Initiator - Payload: Oct 31 15:24:56.812060: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.812063: | flags: none (0x0) Oct 31 15:24:56.812067: | number of TS: 1 (01) Oct 31 15:24:56.812070: | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) Oct 31 15:24:56.812074: | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:56.812078: | *****emit IKEv2 Traffic Selector: Oct 31 15:24:56.812081: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:56.812093: | IP Protocol ID: ALL (0x0) Oct 31 15:24:56.812097: | start port: 0 (00 00) Oct 31 15:24:56.812102: | end port: 65535 (ff ff) Oct 31 15:24:56.812107: | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector Oct 31 15:24:56.812112: | IP start: c0 00 03 00 Oct 31 15:24:56.812116: | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector Oct 31 15:24:56.812121: | IP end: c0 00 03 ff Oct 31 15:24:56.812125: | emitting length of IKEv2 Traffic Selector: 16 Oct 31 15:24:56.812128: | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 Oct 31 15:24:56.812130: | ****emit IKEv2 Traffic Selector - Responder - Payload: Oct 31 15:24:56.812133: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.812135: | flags: none (0x0) Oct 31 15:24:56.812137: | number of TS: 1 (01) Oct 31 15:24:56.812139: | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) Oct 31 15:24:56.812141: | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:56.812144: | *****emit IKEv2 Traffic Selector: Oct 31 15:24:56.812146: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:56.812148: | IP Protocol ID: ALL (0x0) Oct 31 15:24:56.812150: | start port: 0 (00 00) Oct 31 15:24:56.812153: | end port: 65535 (ff ff) Oct 31 15:24:56.812155: | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector Oct 31 15:24:56.812158: | IP start: c0 00 02 00 Oct 31 15:24:56.812160: | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector Oct 31 15:24:56.812162: | IP end: c0 00 02 ff Oct 31 15:24:56.812164: | emitting length of IKEv2 Traffic Selector: 16 Oct 31 15:24:56.812166: | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 Oct 31 15:24:56.812169: | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE Oct 31 15:24:56.812176: | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED Oct 31 15:24:56.812178: | adding 13 bytes of padding (including 1 byte padding-length) Oct 31 15:24:56.812181: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812183: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812185: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812188: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812190: | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812192: | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812194: | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812196: | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812213: | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812220: | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812222: | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812226: | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812228: | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:56.812231: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:24:56.812233: | emitting length of IKEv2 Encryption Payload: 516 Oct 31 15:24:56.812235: | emitting length of ISAKMP Message: 544 Oct 31 15:24:56.812240: | **parse ISAKMP Message: Oct 31 15:24:56.812244: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:24:56.812247: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:56.812249: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:56.812251: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:56.812253: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:56.812255: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:56.812258: | Message ID: 1 (00 00 00 01) Oct 31 15:24:56.812261: | length: 544 (00 00 02 20) Oct 31 15:24:56.812264: | **parse IKEv2 Encryption Payload: Oct 31 15:24:56.812266: | next payload type: ISAKMP_NEXT_v2IDi (0x23) Oct 31 15:24:56.812268: | flags: none (0x0) Oct 31 15:24:56.812270: | length: 516 (02 04) Oct 31 15:24:56.812273: | opening output PBS reply frag packet Oct 31 15:24:56.812275: | **emit ISAKMP Message: Oct 31 15:24:56.812278: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:24:56.812281: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:56.812283: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:24:56.812285: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:56.812287: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:56.812289: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:56.812292: | Message ID: 1 (00 00 00 01) Oct 31 15:24:56.812294: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:24:56.812297: | ***emit IKEv2 Encrypted Fragment: Oct 31 15:24:56.812299: | next payload type: ISAKMP_NEXT_v2IDi (0x23) Oct 31 15:24:56.812301: | flags: none (0x0) Oct 31 15:24:56.812303: | fragment number: 1 (00 01) Oct 31 15:24:56.812306: | total fragments: 1 (00 01) Oct 31 15:24:56.812308: | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi Oct 31 15:24:56.812310: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) Oct 31 15:24:56.812312: | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' Oct 31 15:24:56.812315: | emitting 16 zero bytes of IV into IKEv2 Encrypted Fragment Oct 31 15:24:56.812319: | emitting 467 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment Oct 31 15:24:56.812321: | cleartext fragment: Oct 31 15:24:56.812323: | 24 00 00 0d 02 00 00 00 6e 6f 72 74 68 27 00 00 Oct 31 15:24:56.812325: | 0c 02 00 00 00 65 61 73 74 21 00 01 5e 0e 00 00 Oct 31 15:24:56.812327: | 00 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 Oct 31 15:24:56.812329: | 34 a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 Oct 31 15:24:56.812331: | 05 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 Oct 31 15:24:56.812333: | 08 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 Oct 31 15:24:56.812334: | a2 03 02 01 40 52 3b 4c ed 93 00 72 5d e2 09 32 Oct 31 15:24:56.812336: | d0 a4 4c a6 96 07 39 e4 23 ab fa 17 8d 1b eb 58 Oct 31 15:24:56.812338: | b1 0f 69 40 81 b8 6e b1 51 72 03 8b e3 43 1f 8e Oct 31 15:24:56.812340: | 71 cb 73 d6 af 2c ea 33 6b b8 e3 36 f2 6c 28 9a Oct 31 15:24:56.812342: | a0 5f 2a b0 fc f9 b4 de 59 c6 04 f3 22 11 a9 cf Oct 31 15:24:56.812344: | 10 84 bf 6c 62 3c 49 35 d1 3b 64 e5 91 fb c8 e5 Oct 31 15:24:56.812346: | 01 fc 8e e3 57 db 35 f4 15 56 a9 58 2e 09 2e 49 Oct 31 15:24:56.812348: | a2 e5 c2 8f 66 2d 7a b5 e5 c2 cd ae 53 35 a7 99 Oct 31 15:24:56.812354: | 0c 01 51 62 a7 a1 ab 16 6c cb 6c 7e 40 cf 9e ba Oct 31 15:24:56.812356: | 7e dd b4 dd 59 de 24 69 25 e5 19 91 ee 8d 68 96 Oct 31 15:24:56.812358: | 5e 2d de d9 70 39 03 ab 9e 62 9a 4b 64 b3 95 de Oct 31 15:24:56.812360: | d1 65 54 3c d1 02 19 2d 3f 7a 89 a6 34 75 24 93 Oct 31 15:24:56.812362: | d5 70 1c ed 13 0d ab 5c 78 d4 21 12 3f 41 e9 6e Oct 31 15:24:56.812363: | 79 ab d4 5f 40 92 6e 63 8d 9a fb 8f 46 b1 06 4a Oct 31 15:24:56.812365: | 6c 4f d6 0b a1 8c 10 a6 04 a4 a2 b1 84 d6 56 b2 Oct 31 15:24:56.812367: | 75 3c 62 73 aa 4c bf 89 be ed e3 3b 84 bd 73 00 Oct 31 15:24:56.812369: | af 05 cd e1 65 ce 1f b0 8f e9 d2 55 a0 e3 0c 01 Oct 31 15:24:56.812371: | c9 65 44 5e 7d 4f a5 2c 00 00 2c 00 00 00 28 01 Oct 31 15:24:56.812373: | 03 04 03 1e 00 32 67 03 00 00 0c 01 00 00 0c 80 Oct 31 15:24:56.812375: | 0e 00 80 03 00 00 08 03 00 00 0e 00 00 00 08 05 Oct 31 15:24:56.812377: | 00 00 00 2d 00 00 18 01 00 00 00 07 00 00 10 00 Oct 31 15:24:56.812378: | 00 ff ff c0 00 03 00 c0 00 03 ff 00 00 00 18 01 Oct 31 15:24:56.812386: | 00 00 00 07 00 00 10 00 00 ff ff c0 00 02 00 c0 Oct 31 15:24:56.812388: | 00 02 ff Oct 31 15:24:56.812390: | adding 13 bytes of padding (including 1 byte padding-length) Oct 31 15:24:56.812392: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812395: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812397: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812399: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812401: | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812403: | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812405: | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812407: | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812409: | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812411: | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812413: | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812415: | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812418: | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encrypted Fragment Oct 31 15:24:56.812420: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment Oct 31 15:24:56.812422: | emitting length of IKEv2 Encrypted Fragment: 520 Oct 31 15:24:56.812424: | emitting length of ISAKMP Message: 548 Oct 31 15:24:56.812462: | recording fragment 1 Oct 31 15:24:56.812472: | delref logger@0x559bbabb3560(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:56.812474: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:56.812477: | delref fd@0x559bbabc6aa0(5->4) (in free_logger() at log.c:854) Oct 31 15:24:56.812479: | XXX: resume sending helper answer back to state for #1 switched MD.ST to #3 Oct 31 15:24:56.812485: | suspend processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:56.812489: | start processing: state #3 connection "north-eastnets/0x1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:56.812492: | #3 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_I0 PARENT_I1->PARENT_I2 with status STF_OK; .st_v2_transition=NULL Oct 31 15:24:56.812495: | transitioning from state STATE_PARENT_I1 to state STATE_PARENT_I2 Oct 31 15:24:56.812497: | Message ID: updating counters for #3 Oct 31 15:24:56.812503: | Message ID: CHILD #1.#3 XXX: no EVENT_RETRANSMIT to clear; suspect IKE->CHILD switch: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744568.227774 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:56.812511: | Message ID: CHILD #1.#3 updating initiator received message response 0: ike.initiator.sent=0 ike.initiator.recv=-1->0 ike.initiator.last_contact=744568.227774->744571.245296 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=0->-1 child.wip.responder=-1 Oct 31 15:24:56.812516: | Message ID: CHILD #1.#3 scheduling EVENT_RETRANSMIT: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744571.245296 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=1 child.wip.responder=-1 Oct 31 15:24:56.812519: | event_schedule: newref EVENT_RETRANSMIT-pe@0x559bbabc32a0 Oct 31 15:24:56.812522: | inserting event EVENT_RETRANSMIT, timeout in 0.05 seconds for #3 Oct 31 15:24:56.812524: | libevent_malloc: newref ptr-libevent@0x7f32b8010fa0 size 128 Oct 31 15:24:56.812529: | #3 STATE_V2_IKE_AUTH_CHILD_I0: retransmits: first event in 0.05 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744571.245315 Oct 31 15:24:56.812539: | Message ID: CHILD #1.#3 updating initiator sent message request 1: ike.initiator.sent=0->1 ike.initiator.recv=0 ike.initiator.last_contact=744571.245296 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1->1 child.wip.responder=-1 Oct 31 15:24:56.812552: | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744571.245296 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:56.812558: | child state #3: V2_IKE_AUTH_CHILD_I0(ignore) => PARENT_I2(open IKE SA) Oct 31 15:24:56.812562: | announcing the state transition Oct 31 15:24:56.812568: "north-eastnets/0x2" #1: sent IKE_AUTH request {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA2_256_128 prf=HMAC_SHA2_256 group=MODP2048} Oct 31 15:24:56.812587: | sending 548 bytes for STATE_PARENT_I1 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #1) Oct 31 15:24:56.812591: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:56.812594: | 35 20 23 08 00 00 00 01 00 00 02 24 23 00 02 08 Oct 31 15:24:56.812596: | 00 01 00 01 b4 e9 4a 6b 25 f3 3e b6 84 24 3c 3e Oct 31 15:24:56.812599: | 04 13 8e 03 e1 21 e8 bf 73 ab fa 8d 3f 55 ef 27 Oct 31 15:24:56.812602: | 81 21 97 64 87 4c 42 91 f2 22 55 88 15 53 38 c3 Oct 31 15:24:56.812604: | 6c 96 30 8e 37 2e 95 d4 94 7d 23 38 c2 7c 8e 9f Oct 31 15:24:56.812606: | d6 15 e9 3e 3f f6 3a 98 63 b3 c4 9c 29 3f e7 c8 Oct 31 15:24:56.812609: | 7f c6 82 4b 6e a5 71 10 f3 f5 ad 40 36 06 c6 cf Oct 31 15:24:56.812611: | 21 89 f0 56 c3 a9 d5 02 f7 30 68 80 49 75 83 c4 Oct 31 15:24:56.812614: | d5 e6 95 21 15 17 c1 a6 1e 8e 94 df 0d 8f fd 39 Oct 31 15:24:56.812616: | 75 28 54 06 58 ad 60 7f 7e 10 05 d0 aa bf 1a e9 Oct 31 15:24:56.812619: | 0f 84 1f 85 42 35 53 01 b4 be 79 f4 03 2d fd 39 Oct 31 15:24:56.812622: | 67 53 01 9e a9 e4 bb 81 02 b9 1b ad 8b ac 09 4d Oct 31 15:24:56.812625: | 8f e7 48 c2 43 a5 82 53 3f 0b 0d e6 a8 1d c8 77 Oct 31 15:24:56.812627: | 5b ba 01 44 b1 c0 45 a1 05 c5 cf 4c 19 7d 9d fc Oct 31 15:24:56.812629: | 65 f6 1b 3e 43 b4 a7 0b 47 f4 f7 39 5c 3a f8 ef Oct 31 15:24:56.812632: | 9d 64 74 6c 9a 94 7e aa d8 c6 eb b0 a8 73 5d 5e Oct 31 15:24:56.812634: | be fc 89 3c 2e fe 5b 18 8a b3 f7 e6 f1 d7 dd 9d Oct 31 15:24:56.812636: | c9 09 fc d3 10 f8 89 0f b0 22 80 10 b6 5b 69 c7 Oct 31 15:24:56.812639: | 87 25 a0 5f 6a 12 44 d5 3b 3a 61 d5 fb d2 a7 da Oct 31 15:24:56.812641: | 89 75 bc a4 60 4c aa da 23 1b 99 e0 6f 45 5f 3c Oct 31 15:24:56.812646: | f4 1c 02 4f 14 2e d4 47 83 96 05 6f f2 6a 45 fb Oct 31 15:24:56.812649: | 49 1f eb 39 0a 89 58 b0 ef bc 91 a7 fc 02 78 cd Oct 31 15:24:56.812651: | bf 2f bf e9 d9 cc 57 77 89 e4 0e 62 b9 1a d6 1d Oct 31 15:24:56.812653: | 31 ed 5f 3d e3 22 db 83 d2 40 75 8a 44 f6 42 01 Oct 31 15:24:56.812656: | f8 1a b3 8e 94 f4 8a a9 b2 af 84 1d 56 20 89 40 Oct 31 15:24:56.812658: | dc b1 b6 dc ab dd 80 4b df cb 5f 65 ca fb 37 1c Oct 31 15:24:56.812661: | ad 91 09 1e b1 d0 bf 8b 98 77 de 3f 8e 4f db 16 Oct 31 15:24:56.812664: | e0 a4 0b c6 0b 80 5b 0c 28 79 85 20 23 b1 2b ef Oct 31 15:24:56.812667: | 61 1c 39 53 ba 0e a6 f2 e9 e9 70 54 ec 19 78 db Oct 31 15:24:56.812670: | e6 4c 70 a0 2d ab 1f 87 55 ec 71 96 3c 38 6f 6c Oct 31 15:24:56.812672: | 39 95 27 fd b3 4a 57 da 94 d7 11 2e 35 45 e6 2a Oct 31 15:24:56.812675: | 9d ea 2f 2c 16 e1 c9 6d 49 c9 d9 4d ab c3 70 1b Oct 31 15:24:56.812678: | ef c2 d0 35 59 2b 0a ef 96 f2 75 08 98 cf c8 af Oct 31 15:24:56.812680: | ee 19 40 17 Oct 31 15:24:56.812727: | sent 1 messages Oct 31 15:24:56.812733: | checking that a retransmit timeout_event was already Oct 31 15:24:56.812737: | state #3 has no .st_event to delete Oct 31 15:24:56.812742: | delref mdp@0x559bbabcb9d0(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:56.812747: | delref logger@0x559bbabc4000(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:56.812751: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:56.812753: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:56.812760: | #1 spent 1.1 (1.16) milliseconds in resume sending helper answer back to state Oct 31 15:24:56.812765: | stop processing: state #3 connection "north-eastnets/0x1" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:56.812768: | libevent_free: delref ptr-libevent@0x7f32bc000c80 Oct 31 15:24:56.835887: | spent 0.00345 (0.00342) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:56.835910: | newref struct msg_digest@0x559bbabcb9d0(0->1) (in read_message() at demux.c:103) Oct 31 15:24:56.835915: | newref alloc logger@0x559bbabc4000(0->1) (in read_message() at demux.c:103) Oct 31 15:24:56.835924: | *received 528 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:56.835929: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:56.835932: | 2e 20 23 20 00 00 00 01 00 00 02 10 24 00 01 f4 Oct 31 15:24:56.835935: | 49 c8 ed e9 33 1f 19 7e 39 e2 a2 c9 a2 39 d1 e0 Oct 31 15:24:56.835937: | 29 be 16 35 8d d9 db bb 8b d7 67 c5 a4 cc e2 75 Oct 31 15:24:56.835941: | 98 a7 a5 0f 0c bc 26 b0 62 93 af 5e 27 b1 96 26 Oct 31 15:24:56.835944: | 2a 49 1e 18 69 9b 7c c1 c7 db 3b 9a b7 d7 9e 80 Oct 31 15:24:56.835947: | ff f0 30 92 5e 46 1b 73 7e a2 43 2e 71 b4 b0 42 Oct 31 15:24:56.835950: | fe 8d f9 73 c8 47 9b 54 a7 d6 e2 e9 ff 0e 73 74 Oct 31 15:24:56.835953: | a6 1b 01 23 b7 c0 7c b1 a2 89 8e 14 23 be 67 cd Oct 31 15:24:56.835956: | 4f ab b4 30 e8 de e0 38 02 23 21 00 af 9c 83 76 Oct 31 15:24:56.835958: | 59 1b b1 e6 b1 42 58 bf c4 5a 43 c1 02 8e c2 59 Oct 31 15:24:56.835961: | c3 44 79 a6 ca fb af 00 19 1a e4 a2 9a 3a 67 55 Oct 31 15:24:56.835964: | b7 27 75 b0 4d ed ee d5 fb ff 34 45 98 66 91 6f Oct 31 15:24:56.835967: | e8 a3 13 74 48 75 c8 b9 e2 31 4e e8 f2 81 d9 f3 Oct 31 15:24:56.835970: | 38 52 ba d0 cf 35 93 c4 ae 1f 8e 8a 81 4d 35 dd Oct 31 15:24:56.835974: | f1 c9 9c 41 a9 44 30 37 e3 8c d2 d4 92 a8 27 1f Oct 31 15:24:56.835977: | 2b 8a 52 65 1f 4d 58 07 4f 49 13 ae aa a9 4c b3 Oct 31 15:24:56.835980: | f7 1a 01 31 4a da 1c 80 f5 f1 f1 35 21 bd 82 b5 Oct 31 15:24:56.835983: | af fc d4 9e 9d bd ae 52 8f ec 4b 81 fa 3e 7a e7 Oct 31 15:24:56.835986: | a3 6e 2c a4 8d c7 1a eb 2d b0 67 bf 9c 52 35 55 Oct 31 15:24:56.835989: | 5f 78 f0 d8 9c 10 17 9e dc 53 62 ff 53 15 81 0c Oct 31 15:24:56.835992: | 95 63 a8 d5 ea 5c 27 a0 64 3c c2 46 a9 cb 49 a6 Oct 31 15:24:56.835995: | 7f f3 5b 76 77 02 80 20 d8 07 52 99 34 46 a6 5b Oct 31 15:24:56.835999: | 34 91 2b 60 30 68 7b a6 cc d0 94 7c 50 87 76 5e Oct 31 15:24:56.836001: | f8 60 8b 1b 89 a2 21 aa b3 fe 8c 40 c9 48 3f 1c Oct 31 15:24:56.836003: | f7 35 d7 4a cb 1f d4 e3 00 9f 93 df 4a 6c eb a3 Oct 31 15:24:56.836005: | b7 2a 33 68 7f 96 8f b1 57 d4 7c 32 b7 d3 99 a3 Oct 31 15:24:56.836007: | c2 43 9e cd 63 a6 68 9c 29 59 db 49 48 7b 0d 82 Oct 31 15:24:56.836009: | 2c cb 0d 4e 59 9b 28 5d ae ac c7 0a 12 0f 89 d8 Oct 31 15:24:56.836011: | 63 4b 4e dc 47 66 a9 06 58 bf 6e 68 16 57 f1 3c Oct 31 15:24:56.836013: | d7 de 84 d2 b8 8c 92 ef e8 77 91 9e 33 ea 84 f4 Oct 31 15:24:56.836014: | 0d 7f 08 32 f9 28 cf 45 47 e4 3b a3 92 72 b7 f2 Oct 31 15:24:56.836016: | d2 2b 06 49 e0 6d d2 d1 60 81 60 29 a3 4d ec c9 Oct 31 15:24:56.836022: | **parse ISAKMP Message: Oct 31 15:24:56.836027: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:24:56.836030: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:56.836033: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:56.836035: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:56.836037: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:56.836040: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:24:56.836044: | Message ID: 1 (00 00 00 01) Oct 31 15:24:56.836054: | length: 528 (00 00 02 10) Oct 31 15:24:56.836059: | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) Oct 31 15:24:56.836064: | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response Oct 31 15:24:56.836070: | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) Oct 31 15:24:56.836081: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:56.836086: | State DB: found IKEv2 state #3 in PARENT_I2 (find_v2_sa_by_initiator_wip) Oct 31 15:24:56.836091: | #3 is idle Oct 31 15:24:56.836095: | #3 idle Oct 31 15:24:56.836102: | suspend processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:24:56.836110: | start processing: state #3 connection "north-eastnets/0x1" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:24:56.836113: | unpacking clear payload Oct 31 15:24:56.836117: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:24:56.836121: | ***parse IKEv2 Encryption Payload: Oct 31 15:24:56.836123: | next payload type: ISAKMP_NEXT_v2IDr (0x24) Oct 31 15:24:56.836126: | flags: none (0x0) Oct 31 15:24:56.836128: | length: 500 (01 f4) Oct 31 15:24:56.836131: | processing payload: ISAKMP_NEXT_v2SK (len=496) Oct 31 15:24:56.836133: | #3 in state PARENT_I2: sent IKE_AUTH request Oct 31 15:24:56.836166: | authenticator matched Oct 31 15:24:56.836176: | #1 ikev2 ISAKMP_v2_IKE_AUTH decrypt success Oct 31 15:24:56.836179: | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) Oct 31 15:24:56.836182: | **parse IKEv2 Identification - Responder - Payload: Oct 31 15:24:56.836185: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) Oct 31 15:24:56.836187: | flags: none (0x0) Oct 31 15:24:56.836189: | length: 12 (00 0c) Oct 31 15:24:56.836192: | ID type: ID_FQDN (0x2) Oct 31 15:24:56.836194: | reserved: 00 00 00 Oct 31 15:24:56.836196: | processing payload: ISAKMP_NEXT_v2IDr (len=4) Oct 31 15:24:56.836210: | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) Oct 31 15:24:56.836218: | **parse IKEv2 Authentication Payload: Oct 31 15:24:56.836225: | next payload type: ISAKMP_NEXT_v2SA (0x21) Oct 31 15:24:56.836230: | flags: none (0x0) Oct 31 15:24:56.836234: | length: 350 (01 5e) Oct 31 15:24:56.836238: | auth method: IKEv2_AUTH_DIGSIG (0xe) Oct 31 15:24:56.836241: | processing payload: ISAKMP_NEXT_v2AUTH (len=342) Oct 31 15:24:56.836244: | Now let's proceed with payload (ISAKMP_NEXT_v2SA) Oct 31 15:24:56.836248: | **parse IKEv2 Security Association Payload: Oct 31 15:24:56.836252: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) Oct 31 15:24:56.836259: | flags: none (0x0) Oct 31 15:24:56.836263: | length: 44 (00 2c) Oct 31 15:24:56.836266: | processing payload: ISAKMP_NEXT_v2SA (len=40) Oct 31 15:24:56.836269: | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) Oct 31 15:24:56.836273: | **parse IKEv2 Traffic Selector - Initiator - Payload: Oct 31 15:24:56.836276: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) Oct 31 15:24:56.836279: | flags: none (0x0) Oct 31 15:24:56.836284: | length: 24 (00 18) Oct 31 15:24:56.836292: | number of TS: 1 (01) Oct 31 15:24:56.836296: | processing payload: ISAKMP_NEXT_v2TSi (len=16) Oct 31 15:24:56.836299: | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) Oct 31 15:24:56.836303: | **parse IKEv2 Traffic Selector - Responder - Payload: Oct 31 15:24:56.836307: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:56.836311: | flags: none (0x0) Oct 31 15:24:56.836315: | length: 24 (00 18) Oct 31 15:24:56.836319: | number of TS: 1 (01) Oct 31 15:24:56.836322: | processing payload: ISAKMP_NEXT_v2TSr (len=16) Oct 31 15:24:56.836327: | selected state microcode Initiator: process IKE_AUTH response Oct 31 15:24:56.836331: | calling processor Initiator: process IKE_AUTH response Oct 31 15:24:56.836336: | no certs to decode Oct 31 15:24:56.836344: | offered CA: '%none' Oct 31 15:24:56.836352: "north-eastnets/0x1" #3: IKEv2 mode peer ID is ID_FQDN: '@east' Oct 31 15:24:56.836396: | verifying AUTH payload Oct 31 15:24:56.836403: | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 Oct 31 15:24:56.836408: | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo Oct 31 15:24:56.836411: | ASN.1 blob for hash algo Oct 31 15:24:56.836414: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 Oct 31 15:24:56.836417: | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 Oct 31 15:24:56.836420: | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 Oct 31 15:24:56.836423: | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 Oct 31 15:24:56.836534: | 03 02 01 40 Oct 31 15:24:56.836565: | required RSA CA is '%any' Oct 31 15:24:56.836571: | trying all remote certificates public keys for RSA key that matches ID: @east Oct 31 15:24:56.836576: | trying all preloaded keys public keys for RSA key that matches ID: @east Oct 31 15:24:56.836581: | trying '@east' issued by CA '%any' Oct 31 15:24:56.836586: | NSS RSA: verifying that decrypted signature matches hash: Oct 31 15:24:56.836590: | 86 a0 e3 a7 f3 f7 d0 52 24 e3 11 92 91 75 46 99 Oct 31 15:24:56.836593: | ed 45 72 1f 06 fd bd 6a 9f e1 e8 60 9a 46 75 df Oct 31 15:24:56.836596: | ca 1d 59 1d 03 24 90 6b 3b f7 f8 eb 19 9b da 62 Oct 31 15:24:56.836599: | fd 76 6b d9 f5 1b f4 ff a5 ab 1c e2 22 24 dc 91 Oct 31 15:24:56.836686: | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) Oct 31 15:24:56.836695: | addref pk@0x559bbabc5ab0(2->3) (in try_RSA_signature_v2() at ikev2_rsa.c:171) Oct 31 15:24:56.836699: | an RSA Sig check passed with *AQO9bJbr3 [preloaded keys] Oct 31 15:24:56.836709: | #1 spent 0.119 (0.119) milliseconds in try_all_keys() trying a pubkey Oct 31 15:24:56.836715: "north-eastnets/0x2" #1: authenticated using RSA with SHA2_512 Oct 31 15:24:56.836731: | #1 spent 0.186 (0.185) milliseconds in ikev2_verify_rsa_hash() Oct 31 15:24:56.836738: | parent state #1: PARENT_I2(open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) Oct 31 15:24:56.836744: | #1 will start re-keying in 2607 seconds with margin of 993 seconds (attempting re-key) Oct 31 15:24:56.836748: | state #1 deleting .st_event EVENT_SA_REPLACE Oct 31 15:24:56.836753: | libevent_free: delref ptr-libevent@0x559bbabc3470 Oct 31 15:24:56.836757: | free_event_entry: delref EVENT_SA_REPLACE-pe@0x559bbabc3500 Oct 31 15:24:56.836761: | event_schedule: newref EVENT_SA_REKEY-pe@0x559bbabc3500 Oct 31 15:24:56.836765: | inserting event EVENT_SA_REKEY, timeout in 2607 seconds for #1 Oct 31 15:24:56.836769: | libevent_malloc: newref ptr-libevent@0x559bbabc3470 size 128 Oct 31 15:24:56.836875: | pstats #1 ikev2.ike established Oct 31 15:24:56.836885: | TSi: parsing 1 traffic selectors Oct 31 15:24:56.836891: | ***parse IKEv2 Traffic Selector: Oct 31 15:24:56.836895: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:56.836899: | IP Protocol ID: ALL (0x0) Oct 31 15:24:56.836904: | length: 16 (00 10) Oct 31 15:24:56.836908: | start port: 0 (00 00) Oct 31 15:24:56.836913: | end port: 65535 (ff ff) Oct 31 15:24:56.836917: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low Oct 31 15:24:56.836920: | TS low Oct 31 15:24:56.836923: | c0 00 03 00 Oct 31 15:24:56.836927: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high Oct 31 15:24:56.836931: | TS high Oct 31 15:24:56.836933: | c0 00 03 ff Oct 31 15:24:56.836937: | TSi: parsed 1 traffic selectors Oct 31 15:24:56.836940: | TSr: parsing 1 traffic selectors Oct 31 15:24:56.836944: | ***parse IKEv2 Traffic Selector: Oct 31 15:24:56.836948: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:56.836951: | IP Protocol ID: ALL (0x0) Oct 31 15:24:56.836956: | length: 16 (00 10) Oct 31 15:24:56.836960: | start port: 0 (00 00) Oct 31 15:24:56.836964: | end port: 65535 (ff ff) Oct 31 15:24:56.836968: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low Oct 31 15:24:56.836971: | TS low Oct 31 15:24:56.836975: | c0 00 02 00 Oct 31 15:24:56.836978: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high Oct 31 15:24:56.836981: | TS high Oct 31 15:24:56.836985: | c0 00 02 ff Oct 31 15:24:56.836988: | TSr: parsed 1 traffic selectors Oct 31 15:24:56.836998: | evaluating our conn="north-eastnets/0x1" I=192.0.3.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: Oct 31 15:24:56.837006: | TSi[0] .net=192.0.3.0-192.0.3.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:56.837017: | match address end->client=192.0.3.0/24 == TSi[0]net=192.0.3.0-192.0.3.255: YES fitness 32 Oct 31 15:24:56.837021: | narrow port end=0..65535 == TSi[0]=0..65535: 0 Oct 31 15:24:56.837025: | TSi[0] port match: YES fitness 65536 Oct 31 15:24:56.837029: | narrow protocol end=*0 == TSi[0]=*0: 0 Oct 31 15:24:56.837033: | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:56.837039: | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:56.837048: | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 Oct 31 15:24:56.837052: | narrow port end=0..65535 == TSr[0]=0..65535: 0 Oct 31 15:24:56.837056: | TSr[0] port match: YES fitness 65536 Oct 31 15:24:56.837059: | narrow protocol end=*0 == TSr[0]=*0: 0 Oct 31 15:24:56.837063: | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:56.837067: | best fit so far: TSi[0] TSr[0] Oct 31 15:24:56.837070: | found an acceptable TSi/TSr Traffic Selector Oct 31 15:24:56.837074: | printing contents struct traffic_selector Oct 31 15:24:56.837077: | ts_type: IKEv2_TS_IPV4_ADDR_RANGE Oct 31 15:24:56.837081: | ipprotoid: 0 Oct 31 15:24:56.837083: | port range: 0-65535 Oct 31 15:24:56.837093: | ip range: 192.0.3.0-192.0.3.255 Oct 31 15:24:56.837097: | printing contents struct traffic_selector Oct 31 15:24:56.837100: | ts_type: IKEv2_TS_IPV4_ADDR_RANGE Oct 31 15:24:56.837104: | ipprotoid: 0 Oct 31 15:24:56.837107: | port range: 0-65535 Oct 31 15:24:56.837113: | ip range: 192.0.2.0-192.0.2.255 Oct 31 15:24:56.837124: | using existing local ESP/AH proposals for north-eastnets/0x1 (IKE_AUTH initiator accepting remote ESP/AH proposal): 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-NONE-DISABLED Oct 31 15:24:56.837128: | comparing remote proposals against IKE_AUTH initiator accepting remote ESP/AH proposal 1 local proposals Oct 31 15:24:56.837135: | local proposal 1 type ENCR has 1 transforms Oct 31 15:24:56.837139: | local proposal 1 type PRF has 0 transforms Oct 31 15:24:56.837143: | local proposal 1 type INTEG has 1 transforms Oct 31 15:24:56.837147: | local proposal 1 type DH has 1 transforms Oct 31 15:24:56.837153: | local proposal 1 type ESN has 1 transforms Oct 31 15:24:56.837159: | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH Oct 31 15:24:56.837163: | ***parse IKEv2 Proposal Substructure Payload: Oct 31 15:24:56.837166: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:56.837169: | length: 40 (00 28) Oct 31 15:24:56.837171: | prop #: 1 (01) Oct 31 15:24:56.837173: | proto ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:24:56.837176: | spi size: 4 (04) Oct 31 15:24:56.837178: | # transforms: 3 (03) Oct 31 15:24:56.837181: | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI Oct 31 15:24:56.837183: | remote SPI Oct 31 15:24:56.837185: | 32 3e 8a 54 Oct 31 15:24:56.837188: | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals Oct 31 15:24:56.837190: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:56.837193: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:56.837195: | length: 12 (00 0c) Oct 31 15:24:56.837197: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:56.837224: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:56.837227: | *****parse IKEv2 Attribute Substructure Payload: Oct 31 15:24:56.837230: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:56.837232: | length/value: 128 (00 80) Oct 31 15:24:56.837237: | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 Oct 31 15:24:56.837239: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:56.837241: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:56.837244: | length: 8 (00 08) Oct 31 15:24:56.837246: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:56.837248: | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) Oct 31 15:24:56.837251: | remote proposal 1 transform 1 (INTEG=HMAC_SHA2_512_256) matches local proposal 1 type 3 (INTEG) transform 0 Oct 31 15:24:56.837253: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:56.837255: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:56.837258: | length: 8 (00 08) Oct 31 15:24:56.837260: | IKEv2 transform type: TRANS_TYPE_ESN (0x5) Oct 31 15:24:56.837262: | IKEv2 transform ID: ESN_DISABLED (0x0) Oct 31 15:24:56.837264: | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 Oct 31 15:24:56.837268: | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none Oct 31 15:24:56.837272: | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN Oct 31 15:24:56.837274: | remote proposal 1 matches local proposal 1 Oct 31 15:24:56.837277: | remote accepted the proposal 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256;ESN=DISABLED[first-match] Oct 31 15:24:56.837281: | IKE_AUTH initiator accepting remote ESP/AH proposal ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-DISABLED SPI=323e8a54 Oct 31 15:24:56.837283: | converting proposal to internal trans attrs Oct 31 15:24:56.837289: | integ=HMAC_SHA2_512_256: .key_size=64 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=80 Oct 31 15:24:56.837377: | install_ipsec_sa() for #3: inbound and outbound Oct 31 15:24:56.837385: | could_route called for north-eastnets/0x1; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 Oct 31 15:24:56.837390: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:24:56.837393: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:24:56.837396: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:24:56.837398: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:24:56.837400: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:24:56.837403: | route owner of "north-eastnets/0x1" unrouted: NULL; eroute owner: NULL Oct 31 15:24:56.837406: | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA2_512_256 Oct 31 15:24:56.837409: | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 Oct 31 15:24:56.837415: | st->st_esp.keymat_len=80 is encrypt_keymat_size=16 + integ_keymat_size=64 Oct 31 15:24:56.837419: | setting IPsec SA replay-window to 32 Oct 31 15:24:56.837422: | NIC esp-hw-offload not for connection 'north-eastnets/0x1' not available on interface eth1 Oct 31 15:24:56.837425: | netlink: enabling tunnel mode Oct 31 15:24:56.837427: | XFRM: adding IPsec SA with reqid 16389 Oct 31 15:24:56.837429: | netlink: setting IPsec SA replay-window to 32 using old-style req Oct 31 15:24:56.837431: | netlink: esp-hw-offload not set for IPsec SA Oct 31 15:24:56.837511: | netlink response for Add SA esp.323e8a54@192.1.2.23 included non-error error Oct 31 15:24:56.837520: | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 Oct 31 15:24:56.837524: | set up outgoing SA, ref=0/0 Oct 31 15:24:56.837529: | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA2_512_256 Oct 31 15:24:56.837533: | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 Oct 31 15:24:56.837537: | st->st_esp.keymat_len=80 is encrypt_keymat_size=16 + integ_keymat_size=64 Oct 31 15:24:56.837542: | setting IPsec SA replay-window to 32 Oct 31 15:24:56.837545: | NIC esp-hw-offload not for connection 'north-eastnets/0x1' not available on interface eth1 Oct 31 15:24:56.837547: | netlink: enabling tunnel mode Oct 31 15:24:56.837550: | XFRM: adding IPsec SA with reqid 16389 Oct 31 15:24:56.837552: | netlink: setting IPsec SA replay-window to 32 using old-style req Oct 31 15:24:56.837557: | netlink: esp-hw-offload not set for IPsec SA Oct 31 15:24:56.837614: | netlink response for Add SA esp.1e003267@192.1.3.33 included non-error error Oct 31 15:24:56.837621: | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 Oct 31 15:24:56.837625: | setup_half_ipsec_sa() is installing inbound eroute Oct 31 15:24:56.837627: | setup_half_ipsec_sa() before proto 50 Oct 31 15:24:56.837629: | setup_half_ipsec_sa() after proto 50 Oct 31 15:24:56.837631: | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) Oct 31 15:24:56.837634: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:24:56.837641: | add inbound eroute 192.0.2.0/24:0 --0-> 192.0.3.0/24:0 => tun.10000@192.1.3.33 using reqid 16389 (raw_eroute) proto=50 Oct 31 15:24:56.837644: | IPsec SA SPD priority set to 2084814 Oct 31 15:24:56.837679: | raw_eroute result=success Oct 31 15:24:56.837686: | set up incoming SA, ref=0/0 Oct 31 15:24:56.837691: | sr for #3: unrouted Oct 31 15:24:56.837695: | route_and_eroute() for proto 0, and source port 0 dest port 0 Oct 31 15:24:56.837698: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:24:56.837702: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:24:56.837706: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:24:56.837710: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:24:56.837714: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:24:56.837719: | route owner of "north-eastnets/0x1" unrouted: NULL; eroute owner: NULL Oct 31 15:24:56.837724: | route_and_eroute with c: north-eastnets/0x1 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #3 Oct 31 15:24:56.837729: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:24:56.837742: | eroute_connection add eroute 192.0.3.0/24:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23 using reqid 16389 (raw_eroute) proto=50 Oct 31 15:24:56.837748: | IPsec SA SPD priority set to 2084814 Oct 31 15:24:56.837769: | raw_eroute result=success Oct 31 15:24:56.837774: | running updown command "ipsec _updown" for verb up Oct 31 15:24:56.837778: | command executing up-client Oct 31 15:24:56.837785: | get_sa_info esp.323e8a54@192.1.2.23 Oct 31 15:24:56.837799: | get_sa_info esp.1e003267@192.1.3.33 Oct 31 15:24:56.837832: | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157896' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED=... Oct 31 15:24:56.837839: | popen cmd is 1140 chars long Oct 31 15:24:56.837842: | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x1': Oct 31 15:24:56.837844: | cmd( 80): PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_N: Oct 31 15:24:56.837846: | cmd( 160):EXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT=: Oct 31 15:24:56.837848: | cmd( 240):'192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255: Oct 31 15:24:56.837850: | cmd( 320):.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE: Oct 31 15:24:56.837851: | cmd( 400):='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.: Oct 31 15:24:56.837853: | cmd( 480):0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' P: Oct 31 15:24:56.837855: | cmd( 560):LUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' P: Oct 31 15:24:56.837857: | cmd( 640):LUTO_ADDTIME='1604157896' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+: Oct 31 15:24:56.837859: | cmd( 720):IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PL: Oct 31 15:24:56.837861: | cmd( 800):UTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS: Oct 31 15:24:56.837863: | cmd( 880):_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLU: Oct 31 15:24:56.837865: | cmd( 960):TO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' V: Oct 31 15:24:56.837867: | cmd(1040):TI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x323e8a54 SPI_OUT=0x1e00326: Oct 31 15:24:56.837869: | cmd(1120):7 ipsec _updown 2>&1: Oct 31 15:24:56.891840: | route_and_eroute: firewall_notified: true Oct 31 15:24:56.891855: | running updown command "ipsec _updown" for verb prepare Oct 31 15:24:56.891858: | command executing prepare-client Oct 31 15:24:56.891863: | get_sa_info esp.323e8a54@192.1.2.23 Oct 31 15:24:56.891875: | get_sa_info esp.1e003267@192.1.3.33 Oct 31 15:24:56.891900: | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157896' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_C... Oct 31 15:24:56.891902: | popen cmd is 1155 chars long Oct 31 15:24:56.891907: | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets: Oct 31 15:24:56.891909: | cmd( 80):/0x1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PL: Oct 31 15:24:56.891910: | cmd( 160):UTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CL: Oct 31 15:24:56.891912: | cmd( 240):IENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.25: Oct 31 15:24:56.891913: | cmd( 320):5.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA: Oct 31 15:24:56.891914: | cmd( 400):_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192: Oct 31 15:24:56.891916: | cmd( 480):.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255: Oct 31 15:24:56.891918: | cmd( 560):.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xf: Oct 31 15:24:56.891920: | cmd( 640):rm' PLUTO_ADDTIME='1604157896' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PF: Oct 31 15:24:56.891922: | cmd( 720):S+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANEN: Oct 31 15:24:56.891924: | cmd( 800):T' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEE: Oct 31 15:24:56.891926: | cmd( 880):R_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0: Oct 31 15:24:56.891930: | cmd( 960):' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='375480' PLUTO_OUTB: Oct 31 15:24:56.891934: | cmd(1040):YTES='375480' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x323e8a54 SP: Oct 31 15:24:56.891937: | cmd(1120):I_OUT=0x1e003267 ipsec _updown 2>&1: Oct 31 15:24:56.903668: | running updown command "ipsec _updown" for verb route Oct 31 15:24:56.903689: | command executing route-client Oct 31 15:24:56.903697: | get_sa_info esp.323e8a54@192.1.2.23 Oct 31 15:24:56.903714: | get_sa_info esp.1e003267@192.1.3.33 Oct 31 15:24:56.903758: | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157896' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFI... Oct 31 15:24:56.903763: | popen cmd is 1153 chars long Oct 31 15:24:56.903767: | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0: Oct 31 15:24:56.903770: | cmd( 80):x1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUT: Oct 31 15:24:56.903772: | cmd( 160):O_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIE: Oct 31 15:24:56.903775: | cmd( 240):NT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.: Oct 31 15:24:56.903777: | cmd( 320):255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_T: Oct 31 15:24:56.903780: | cmd( 400):YPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0: Oct 31 15:24:56.903782: | cmd( 480):.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0: Oct 31 15:24:56.903784: | cmd( 560):' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm: Oct 31 15:24:56.903805: | cmd( 640):' PLUTO_ADDTIME='1604157896' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+: Oct 31 15:24:56.903812: | cmd( 720):UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT': Oct 31 15:24:56.903815: | cmd( 800): PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_: Oct 31 15:24:56.903818: | cmd( 880):DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' : Oct 31 15:24:56.903820: | cmd( 960):PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='490644' PLUTO_OUTBYT: Oct 31 15:24:56.903822: | cmd(1040):ES='490728' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x323e8a54 SPI_: Oct 31 15:24:56.903825: | cmd(1120):OUT=0x1e003267 ipsec _updown 2>&1: Oct 31 15:24:56.919661: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920007: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920067: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920116: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920346: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920489: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920543: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920588: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920774: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.920882: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921031: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921084: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921131: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921267: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921371: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921508: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921558: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921605: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921797: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.921986: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.922036: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.922086: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.922312: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.922423: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.922685: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.922735: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.922969: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.923016: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.923060: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.923125: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.923171: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.923305: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.924448: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.924596: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.924646: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.924698: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.924714: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.924902: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.924950: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.924994: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.925122: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.925173: "north-eastnets/0x1" #3: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:56.946888: | route_and_eroute: instance "north-eastnets/0x1", setting eroute_owner {spd=0x559bbabc1d00,sr=0x559bbabc1d00} to #3 (was #0) (newest_ipsec_sa=#0) Oct 31 15:24:56.947129: | inR2: instance north-eastnets/0x1[0], setting IKEv2 newest_ipsec_sa to #3 (was #0) (spd.eroute=#3) cloned from #1 Oct 31 15:24:56.947145: | #3 spent 2.84 (111) milliseconds in processing: Initiator: process IKE_AUTH response in v2_dispatch() Oct 31 15:24:56.947154: | [RE]START processing: state #3 connection "north-eastnets/0x1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:56.947160: | #3 complete_v2_state_transition() PARENT_I2->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL Oct 31 15:24:56.947163: | transitioning from state STATE_PARENT_I2 to state STATE_V2_ESTABLISHED_CHILD_SA Oct 31 15:24:56.947166: | Message ID: updating counters for #3 Oct 31 15:24:56.947175: | Message ID: CHILD #1.#3 clearing EVENT_RETRANSMIT as response received: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744571.245296 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:56.947180: | #3 requesting EVENT_RETRANSMIT-pe@0x559bbabc32a0 be deleted Oct 31 15:24:56.947185: | libevent_free: delref ptr-libevent@0x7f32b8010fa0 Oct 31 15:24:56.947189: | free_event_entry: delref EVENT_RETRANSMIT-pe@0x559bbabc32a0 Oct 31 15:24:56.947192: | #3 STATE_PARENT_I2: retransmits: cleared Oct 31 15:24:56.947215: | Message ID: CHILD #1.#3 updating initiator received message response 1: ike.initiator.sent=1 ike.initiator.recv=0->1 ike.initiator.last_contact=744571.245296->744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=1->-1 child.wip.responder=-1 Oct 31 15:24:56.947225: | Message ID: CHILD #1.#3 skipping update_send as nothing to send: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:56.947232: | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:56.947236: | child state #3: PARENT_I2(open IKE SA) => ESTABLISHED_CHILD_SA(established CHILD SA) Oct 31 15:24:56.947240: | pstats #3 ikev2.child established Oct 31 15:24:56.947244: | announcing the state transition Oct 31 15:24:56.947253: "north-eastnets/0x1" #3: negotiated connection [192.0.3.0-192.0.3.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] Oct 31 15:24:56.947270: | NAT-T: encaps is 'auto' Oct 31 15:24:56.947277: "north-eastnets/0x1" #3: IPsec SA established tunnel mode {ESP=>0x323e8a54 <0x1e003267 xfrm=AES_CBC_128-HMAC_SHA2_512_256 NATOA=none NATD=none DPD=passive} Oct 31 15:24:56.947284: | releasing #3's fd-fd@0x559bbabc6aa0 because IKEv2 transitions finished Oct 31 15:24:56.947288: | delref fd@0x559bbabc6aa0(4->3) (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:56.947291: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:56.947293: | unpending #3's IKE SA #1 Oct 31 15:24:56.947296: | unpending state #1 connection "north-eastnets/0x1" Oct 31 15:24:56.947300: | delete from pending Child SA with 192.1.2.23 "north-eastnets/0x1" Oct 31 15:24:56.947304: | delref fd@0x559bbabc6aa0(3->2) (in delete_pending() at pending.c:218) Oct 31 15:24:56.947306: | removing pending policy for no connection {0x559bbabc32e0} Oct 31 15:24:56.947310: | FOR_EACH_STATE_... in find_pending_phase2 Oct 31 15:24:56.947316: | newref alloc logger@0x559bbabce5f0(0->1) (in new_state() at state.c:576) Oct 31 15:24:56.947320: | addref fd@0x559bbabc6aa0(2->3) (in new_state() at state.c:577) Oct 31 15:24:56.947323: | creating state object #4 at 0x559bbabcec90 Oct 31 15:24:56.947325: | State DB: adding IKEv2 state #4 in UNDEFINED Oct 31 15:24:56.947334: | pstats #4 ikev2.child started Oct 31 15:24:56.947338: | duplicating state object #1 "north-eastnets/0x2" as #4 for IPSEC SA Oct 31 15:24:56.947344: | #4 setting local endpoint to 192.1.3.33:500 from #1.st_localport (in duplicate_state() at state.c:1581) Oct 31 15:24:56.947353: | Message ID: CHILD #1.#4 initializing (CHILD SA): ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=0->-1 child.wip.responder=0->-1 Oct 31 15:24:56.947357: | child state #4: UNDEFINED(ignore) => V2_NEW_CHILD_I0(established IKE SA) Oct 31 15:24:56.947361: | #4.st_v2_transition NULL -> V2_NEW_CHILD_I0->V2_NEW_CHILD_I1 (in new_v2_child_state() at state.c:1666) Oct 31 15:24:56.947367: | suspend processing: state #3 connection "north-eastnets/0x1" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:5960) Oct 31 15:24:56.947371: | start processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:5960) Oct 31 15:24:56.947375: | create child proposal's DH changed from no-PFS to MODP2048, flushing Oct 31 15:24:56.947378: | constructing ESP/AH proposals with default DH MODP2048 for north-eastnets/0x2 (ESP/AH initiator emitting proposals) Oct 31 15:24:56.947384: | converting proposal AES_CBC_128-HMAC_SHA2_512_256-MODP3072 to ikev2 ... Oct 31 15:24:56.947392: | ... ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED Oct 31 15:24:56.947395: "north-eastnets/0x2": local ESP/AH proposals (ESP/AH initiator emitting proposals): Oct 31 15:24:56.947400: "north-eastnets/0x2": 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED Oct 31 15:24:56.947405: | #4 schedule initiate IPsec SA RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 using IKE# 1 pfs=MODP3072 Oct 31 15:24:56.947409: | event_schedule: newref EVENT_v2_INITIATE_CHILD-pe@0x559bbabcdb10 Oct 31 15:24:56.947412: | inserting event EVENT_v2_INITIATE_CHILD, timeout in 0 seconds for #4 Oct 31 15:24:56.947415: | libevent_malloc: newref ptr-libevent@0x7f32b8010fa0 size 128 Oct 31 15:24:56.947422: | RESET processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:6035) Oct 31 15:24:56.947426: | delete from pending Child SA with 192.1.2.23 "north-eastnets/0x2" Oct 31 15:24:56.947429: | delref fd@0x559bbabc6aa0(3->2) (in delete_pending() at pending.c:218) Oct 31 15:24:56.947432: | removing pending policy for no connection {0x559bbabc5bc0} Oct 31 15:24:56.947435: | releasing #1's fd-fd@0x559bbabc6aa0 because IKEv2 transitions finished so releaseing IKE SA Oct 31 15:24:56.947440: | delref fd@0x559bbabc6aa0(2->1) (in success_v2_state_transition() at ikev2.c:3222) Oct 31 15:24:56.947442: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) Oct 31 15:24:56.947446: | #3 will start re-keying in 28048 seconds with margin of 752 seconds (attempting re-key) Oct 31 15:24:56.947449: | state #3 has no .st_event to delete Oct 31 15:24:56.947452: | event_schedule: newref EVENT_SA_REKEY-pe@0x559bbab82b00 Oct 31 15:24:56.947455: | inserting event EVENT_SA_REKEY, timeout in 28048 seconds for #3 Oct 31 15:24:56.947458: | libevent_malloc: newref ptr-libevent@0x7f32c0002790 size 128 Oct 31 15:24:56.947461: | libevent_realloc: delref ptr-libevent@0x559bbabb00e0 Oct 31 15:24:56.947464: | libevent_realloc: newref ptr-libevent@0x559bbabc32a0 size 128 Oct 31 15:24:56.947467: | processing: STOP state #0 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:56.947473: | #1 spent 2.87 (111) milliseconds Oct 31 15:24:56.947477: | #1 spent 3.61 (112) milliseconds in ikev2_process_packet() Oct 31 15:24:56.947480: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:56.947483: | delref mdp@0x559bbabcb9d0(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:56.947486: | delref logger@0x559bbabc4000(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:56.947489: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:56.947491: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:56.947497: | spent 3.64 (112) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:56.947509: | timer_event_cb: processing event@0x559bbabcdb10 Oct 31 15:24:56.947513: | handling event EVENT_v2_INITIATE_CHILD for child state #4 Oct 31 15:24:56.947516: | libevent_free: delref ptr-libevent@0x7f32b8010fa0 Oct 31 15:24:56.947518: | free_event_entry: delref EVENT_v2_INITIATE_CHILD-pe@0x559bbabcdb10 Oct 31 15:24:56.947523: | start processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in timer_event_cb() at timer.c:188) Oct 31 15:24:56.947530: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:56.947534: | addref fd@0x559bbabc6aa0(1->2) (in clone_logger() at log.c:810) Oct 31 15:24:56.947536: | newref clone logger@0x559bbabc4000(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:56.947539: | job 7 for #4: Child Initiator KE and nonce ni (build KE and nonce): adding job to queue Oct 31 15:24:56.947542: | state #4 has no .st_event to delete Oct 31 15:24:56.947544: | #4 STATE_V2_NEW_CHILD_I0: retransmits: cleared Oct 31 15:24:56.947547: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabcdb10 Oct 31 15:24:56.947550: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #4 Oct 31 15:24:56.947552: | libevent_malloc: newref ptr-libevent@0x7f32b8010fa0 size 128 Oct 31 15:24:56.947563: | #4 spent 0.0517 (0.0517) milliseconds in timer_event_cb() EVENT_v2_INITIATE_CHILD Oct 31 15:24:56.947569: | stop processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in timer_event_cb() at timer.c:447) Oct 31 15:24:56.947574: | processing signal PLUTO_SIGCHLD Oct 31 15:24:56.947568: | job 7 for #4: Child Initiator KE and nonce ni (build KE and nonce): helper 3 starting job Oct 31 15:24:56.947583: | helper 3 is pausing for 1 seconds Oct 31 15:24:56.947579: | waitpid returned ECHILD (no child processes left) Oct 31 15:24:56.947595: | spent 0.00998 (0.016) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:24:56.947598: | processing signal PLUTO_SIGCHLD Oct 31 15:24:56.947601: | waitpid returned ECHILD (no child processes left) Oct 31 15:24:56.947606: | spent 0.00402 (0.00399) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:24:56.947609: | processing signal PLUTO_SIGCHLD Oct 31 15:24:56.947612: | waitpid returned ECHILD (no child processes left) Oct 31 15:24:56.947616: | spent 0.00329 (0.00326) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:24:57.048847: | hash to sign Oct 31 15:24:57.048866: | cd f9 3c 6a 0a 87 a9 d8 09 79 fe 96 15 23 82 4c Oct 31 15:24:57.048870: | a9 9f c0 ba 5e 96 33 98 3e c0 ab d5 18 b2 55 16 Oct 31 15:24:57.048877: | ee 1d 86 4a 5a 9c e4 70 13 4c d0 8a cc 38 0f 22 Oct 31 15:24:57.048879: | 0f ed b5 80 4c 67 fb bb 2c 64 49 10 ad c5 60 9c Oct 31 15:24:57.048883: | RSA_sign_hash: Started using NSS Oct 31 15:24:57.052647: | RSA_sign_hash: Ended using NSS Oct 31 15:24:57.052666: | "north-eastnets/0x2" #2: spent 3.57 (3.78) milliseconds in v2_auth_signature() calling sign_hash() Oct 31 15:24:57.052672: | "north-eastnets/0x2" #2: spent 3.62 (3.83) milliseconds in v2_auth_signature() Oct 31 15:24:57.052679: | "north-eastnets/0x2" #2: spent 3.65 (1e+03) milliseconds in helper 4 processing job 6 for state #2: computing responder signature (signature) Oct 31 15:24:57.052682: | job 6 for #2: computing responder signature (signature): helper thread 4 sending result back to state Oct 31 15:24:57.052686: | scheduling resume sending helper answer back to state for #2 Oct 31 15:24:57.052690: | libevent_malloc: newref ptr-libevent@0x7f32b0000c80 size 128 Oct 31 15:24:57.052702: | helper thread 4 has nothing to do Oct 31 15:24:57.052716: | processing resume sending helper answer back to state for #2 Oct 31 15:24:57.052726: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:57.052731: | unsuspending #2 MD 0x559bbabc8750 Oct 31 15:24:57.052734: | job 6 for #2: computing responder signature (signature): processing response from helper 4 Oct 31 15:24:57.052738: | job 6 for #2: computing responder signature (signature): calling continuation function 0x559bb8f1277f Oct 31 15:24:57.052742: | parent state #2: PARENT_R1(half-open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) Oct 31 15:24:57.052746: | #2 will start re-keying in 3330 seconds with margin of 270 seconds (attempting re-key) Oct 31 15:24:57.052749: | state #2 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:57.052753: | libevent_free: delref ptr-libevent@0x559bbabc3340 Oct 31 15:24:57.052756: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabc3410 Oct 31 15:24:57.052759: | event_schedule: newref EVENT_SA_REKEY-pe@0x559bbabc3410 Oct 31 15:24:57.052763: | inserting event EVENT_SA_REKEY, timeout in 3330 seconds for #2 Oct 31 15:24:57.052765: | libevent_malloc: newref ptr-libevent@0x559bbabc3340 size 128 Oct 31 15:24:57.052811: | pstats #2 ikev2.ike established Oct 31 15:24:57.052819: | opening output PBS reply packet Oct 31 15:24:57.052822: | **emit ISAKMP Message: Oct 31 15:24:57.052827: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:57.052831: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.052834: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:24:57.052838: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:57.052841: | exchange type: ISAKMP_v2_IKE_AUTH (0x23) Oct 31 15:24:57.052844: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:24:57.052848: | Message ID: 1 (00 00 00 01) Oct 31 15:24:57.052851: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:24:57.052855: | IKEv2 CERT: send a certificate? Oct 31 15:24:57.052857: | IKEv2 CERT: no certificate to send Oct 31 15:24:57.052860: | ***emit IKEv2 Encryption Payload: Oct 31 15:24:57.052863: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.052866: | flags: none (0x0) Oct 31 15:24:57.052869: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:24:57.052872: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.052876: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:24:57.052888: | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED Oct 31 15:24:57.052892: | ****emit IKEv2 Identification - Responder - Payload: Oct 31 15:24:57.052894: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.052897: | flags: none (0x0) Oct 31 15:24:57.052900: | ID type: ID_FQDN (0x2) Oct 31 15:24:57.052905: | reserved: 00 00 00 Oct 31 15:24:57.052909: | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) Oct 31 15:24:57.052911: | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.052915: | emitting 5 raw bytes of my identity into IKEv2 Identification - Responder - Payload Oct 31 15:24:57.052918: | my identity: 6e 6f 72 74 68 Oct 31 15:24:57.052921: | emitting length of IKEv2 Identification - Responder - Payload: 13 Oct 31 15:24:57.052923: | added IDr payload to packet Oct 31 15:24:57.052925: | CHILD SA proposals received Oct 31 15:24:57.052927: | going to assemble AUTH payload Oct 31 15:24:57.052930: | ****emit IKEv2 Authentication Payload: Oct 31 15:24:57.052933: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.052935: | flags: none (0x0) Oct 31 15:24:57.052938: | auth method: IKEv2_AUTH_DIGSIG (0xe) Oct 31 15:24:57.052941: | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) Oct 31 15:24:57.052943: | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.052946: | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 Oct 31 15:24:57.052949: | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload Oct 31 15:24:57.052951: | OID of ASN.1 Algorithm Identifier: Oct 31 15:24:57.052954: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 Oct 31 15:24:57.052956: | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 Oct 31 15:24:57.052958: | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 Oct 31 15:24:57.052960: | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 Oct 31 15:24:57.052963: | 03 02 01 40 Oct 31 15:24:57.052965: | emitting 274 raw bytes of signature into IKEv2 Authentication Payload Oct 31 15:24:57.052968: | signature: Oct 31 15:24:57.052970: | a8 b4 67 e1 ac d3 fe 2f 8c 8c f2 d8 ab be d5 ed Oct 31 15:24:57.052972: | a3 e6 be d2 8e 1f bd 25 ac e8 8b 71 f1 c0 e9 cc Oct 31 15:24:57.052974: | 6b 3f 4e 75 af 70 16 1b 5d cd 9a fe 1c b6 b1 23 Oct 31 15:24:57.052976: | c9 34 09 7b ad 4a f0 65 e2 76 a1 fc da a0 60 3e Oct 31 15:24:57.052979: | 25 d2 8b 67 c5 26 3f c0 91 b1 52 94 dd 2e 59 52 Oct 31 15:24:57.052981: | c1 c3 7e 45 94 8f 46 52 6a 79 2c 5a ef 4c 1e d2 Oct 31 15:24:57.052983: | 23 54 94 22 6f 63 6b 18 0a a6 cf e2 cd ed de 91 Oct 31 15:24:57.052985: | d9 9d 82 37 be ec 52 9a 5c b0 88 92 61 81 09 38 Oct 31 15:24:57.052988: | 1a 08 19 32 73 7c c4 a1 3d 64 99 cd 34 59 6b f2 Oct 31 15:24:57.052990: | 84 83 28 dd 77 0f 3f 5d 34 21 64 4f 3f bf f4 33 Oct 31 15:24:57.052992: | 14 0f 6c 73 c8 5b e1 3b e5 55 f8 13 ff 3d 5f b2 Oct 31 15:24:57.052994: | ff 85 66 e8 c4 a8 d2 81 4d 6d 35 5e 74 09 50 d1 Oct 31 15:24:57.052996: | c4 6f c5 a1 23 71 10 b8 24 03 05 f9 8f 9c 6a 35 Oct 31 15:24:57.052998: | d2 5b f4 f0 1a ed d6 26 95 34 b3 60 f7 e3 02 6c Oct 31 15:24:57.053000: | c7 8a 41 03 b8 92 4b f9 e6 8d 31 5a 75 d1 cd b9 Oct 31 15:24:57.053003: | c9 fe ed 9b 00 d3 af ed 3d 09 d4 0d bf 73 18 3a Oct 31 15:24:57.053005: | a7 cd d5 ff 5f 5e 07 d5 c4 c2 aa 72 8e 6d b6 0a Oct 31 15:24:57.053007: | bf 34 Oct 31 15:24:57.053009: | emitting length of IKEv2 Authentication Payload: 350 Oct 31 15:24:57.053015: | newref alloc logger@0x559bbabb00e0(0->1) (in new_state() at state.c:576) Oct 31 15:24:57.053018: | addref fd@NULL (in new_state() at state.c:577) Oct 31 15:24:57.053021: | creating state object #5 at 0x559bbabd3960 Oct 31 15:24:57.053024: | State DB: adding IKEv2 state #5 in UNDEFINED Oct 31 15:24:57.053032: | pstats #5 ikev2.child started Oct 31 15:24:57.053035: | duplicating state object #2 "north-eastnets/0x2" as #5 for IPSEC SA Oct 31 15:24:57.053041: | #5 setting local endpoint to 192.1.3.33:500 from #2.st_localport (in duplicate_state() at state.c:1581) Oct 31 15:24:57.053053: | Message ID: CHILD #2.#5 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744569.46988 child.wip.initiator=0->-1 child.wip.responder=0->-1 Oct 31 15:24:57.053057: | child state #5: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_R0(ignore) Oct 31 15:24:57.053061: | #5.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) Oct 31 15:24:57.053068: | Message ID: IKE #2 switching from IKE SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744569.46988 ike.wip.initiator=-1 ike.wip.responder=1->-1 Oct 31 15:24:57.053074: | Message ID: CHILD #2.#5 switching to CHILD SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744569.46988 child.wip.initiator=-1 child.wip.responder=-1->1 Oct 31 15:24:57.053078: | switching IKEv2 MD.ST from IKE #2 ESTABLISHED_IKE_SA to CHILD #5 V2_IKE_AUTH_CHILD_R0 (in ike_auth_child_responder() at ikev2_parent.c:3282) Oct 31 15:24:57.053082: | Child SA TS Request has child->sa == md->st; so using child connection Oct 31 15:24:57.053085: | TSi: parsing 1 traffic selectors Oct 31 15:24:57.053089: | ***parse IKEv2 Traffic Selector: Oct 31 15:24:57.053091: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:57.053094: | IP Protocol ID: ALL (0x0) Oct 31 15:24:57.053097: | length: 16 (00 10) Oct 31 15:24:57.053101: | start port: 0 (00 00) Oct 31 15:24:57.053104: | end port: 65535 (ff ff) Oct 31 15:24:57.053106: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low Oct 31 15:24:57.053109: | TS low Oct 31 15:24:57.053111: | c0 00 16 00 Oct 31 15:24:57.053113: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high Oct 31 15:24:57.053116: | TS high Oct 31 15:24:57.053119: | c0 00 16 ff Oct 31 15:24:57.053121: | TSi: parsed 1 traffic selectors Oct 31 15:24:57.053123: | TSr: parsing 1 traffic selectors Oct 31 15:24:57.053126: | ***parse IKEv2 Traffic Selector: Oct 31 15:24:57.053128: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:57.053131: | IP Protocol ID: ALL (0x0) Oct 31 15:24:57.053133: | length: 16 (00 10) Oct 31 15:24:57.053136: | start port: 0 (00 00) Oct 31 15:24:57.053139: | end port: 65535 (ff ff) Oct 31 15:24:57.053142: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low Oct 31 15:24:57.053144: | TS low Oct 31 15:24:57.053146: | c0 00 03 00 Oct 31 15:24:57.053148: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high Oct 31 15:24:57.053151: | TS high Oct 31 15:24:57.053153: | c0 00 03 ff Oct 31 15:24:57.053156: | TSr: parsed 1 traffic selectors Oct 31 15:24:57.053158: | looking for best SPD in current connection Oct 31 15:24:57.053164: | evaluating our conn="north-eastnets/0x2" I=192.0.22.0/24:0:0/0 R=192.0.3.0/24:0:0/0 to their: Oct 31 15:24:57.053170: | TSi[0] .net=192.0.22.0-192.0.22.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.053179: | match address end->client=192.0.22.0/24 == TSi[0]net=192.0.22.0-192.0.22.255: YES fitness 32 Oct 31 15:24:57.053183: | narrow port end=0..65535 == TSi[0]=0..65535: 0 Oct 31 15:24:57.053185: | TSi[0] port match: YES fitness 65536 Oct 31 15:24:57.053188: | narrow protocol end=*0 == TSi[0]=*0: 0 Oct 31 15:24:57.053192: | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:57.053196: | TSr[0] .net=192.0.3.0-192.0.3.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.053206: | match address end->client=192.0.3.0/24 == TSr[0]net=192.0.3.0-192.0.3.255: YES fitness 32 Oct 31 15:24:57.053212: | narrow port end=0..65535 == TSr[0]=0..65535: 0 Oct 31 15:24:57.053215: | TSr[0] port match: YES fitness 65536 Oct 31 15:24:57.053219: | narrow protocol end=*0 == TSr[0]=*0: 0 Oct 31 15:24:57.053222: | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:57.053225: | best fit so far: TSi[0] TSr[0] Oct 31 15:24:57.053228: | found better spd route for TSi[0],TSr[0] Oct 31 15:24:57.053230: | looking for better host pair Oct 31 15:24:57.053236: | find_host_pair: comparing 192.1.3.33:500 to 192.1.2.23:500 but ignoring ports Oct 31 15:24:57.053241: | checking hostpair 192.0.3.0/24:0 -> 192.0.22.0/24:0 is found Oct 31 15:24:57.053244: | investigating connection "north-eastnets/0x2" as a better match Oct 31 15:24:57.053247: | match_id a=@east Oct 31 15:24:57.053250: | b=@east Oct 31 15:24:57.053252: | results matched Oct 31 15:24:57.053258: | evaluating our conn="north-eastnets/0x2" I=192.0.22.0/24:0:0/0 R=192.0.3.0/24:0:0/0 to their: Oct 31 15:24:57.053263: | TSi[0] .net=192.0.22.0-192.0.22.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.053270: | match address end->client=192.0.22.0/24 == TSi[0]net=192.0.22.0-192.0.22.255: YES fitness 32 Oct 31 15:24:57.053273: | narrow port end=0..65535 == TSi[0]=0..65535: 0 Oct 31 15:24:57.053275: | TSi[0] port match: YES fitness 65536 Oct 31 15:24:57.053278: | narrow protocol end=*0 == TSi[0]=*0: 0 Oct 31 15:24:57.053280: | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:57.053285: | TSr[0] .net=192.0.3.0-192.0.3.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.053291: | match address end->client=192.0.3.0/24 == TSr[0]net=192.0.3.0-192.0.3.255: YES fitness 32 Oct 31 15:24:57.053295: | narrow port end=0..65535 == TSr[0]=0..65535: 0 Oct 31 15:24:57.053297: | TSr[0] port match: YES fitness 65536 Oct 31 15:24:57.053299: | narrow protocol end=*0 == TSr[0]=*0: 0 Oct 31 15:24:57.053302: | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:57.053304: | best fit so far: TSi[0] TSr[0] Oct 31 15:24:57.053307: | investigating connection "north-eastnets/0x1" as a better match Oct 31 15:24:57.053310: | match_id a=@east Oct 31 15:24:57.053312: | b=@east Oct 31 15:24:57.053314: | results matched Oct 31 15:24:57.053320: | evaluating our conn="north-eastnets/0x1" I=192.0.2.0/24:0:0/0 R=192.0.3.0/24:0:0/0 to their: Oct 31 15:24:57.053324: | TSi[0] .net=192.0.22.0-192.0.22.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.053331: | match address end->client=192.0.2.0/24 == TSi[0]net=192.0.22.0-192.0.22.255: NO Oct 31 15:24:57.053334: | did not find a better connection using host pair Oct 31 15:24:57.053337: | printing contents struct traffic_selector Oct 31 15:24:57.053339: | ts_type: IKEv2_TS_IPV4_ADDR_RANGE Oct 31 15:24:57.053342: | ipprotoid: 0 Oct 31 15:24:57.053344: | port range: 0-65535 Oct 31 15:24:57.053348: | ip range: 192.0.3.0-192.0.3.255 Oct 31 15:24:57.053350: | printing contents struct traffic_selector Oct 31 15:24:57.053352: | ts_type: IKEv2_TS_IPV4_ADDR_RANGE Oct 31 15:24:57.053355: | ipprotoid: 0 Oct 31 15:24:57.053357: | port range: 0-65535 Oct 31 15:24:57.053361: | ip range: 192.0.22.0-192.0.22.255 Oct 31 15:24:57.053365: | constructing ESP/AH proposals with all DH removed for north-eastnets/0x2 (IKE_AUTH responder matching remote ESP/AH proposals) Oct 31 15:24:57.053371: | converting proposal AES_CBC_128-HMAC_SHA2_512_256-MODP3072 to ikev2 ... Oct 31 15:24:57.053378: | ... ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-NONE-DISABLED Oct 31 15:24:57.053382: "north-eastnets/0x2": local ESP/AH proposals (IKE_AUTH responder matching remote ESP/AH proposals): Oct 31 15:24:57.053387: "north-eastnets/0x2": 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-NONE-DISABLED Oct 31 15:24:57.053390: | comparing remote proposals against IKE_AUTH responder matching remote ESP/AH proposals 1 local proposals Oct 31 15:24:57.053394: | local proposal 1 type ENCR has 1 transforms Oct 31 15:24:57.053397: | local proposal 1 type PRF has 0 transforms Oct 31 15:24:57.053401: | local proposal 1 type INTEG has 1 transforms Oct 31 15:24:57.053404: | local proposal 1 type DH has 1 transforms Oct 31 15:24:57.053406: | local proposal 1 type ESN has 1 transforms Oct 31 15:24:57.053409: | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH Oct 31 15:24:57.053413: | ***parse IKEv2 Proposal Substructure Payload: Oct 31 15:24:57.053415: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:57.053419: | length: 40 (00 28) Oct 31 15:24:57.053422: | prop #: 1 (01) Oct 31 15:24:57.053424: | proto ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:24:57.053427: | spi size: 4 (04) Oct 31 15:24:57.053429: | # transforms: 3 (03) Oct 31 15:24:57.053434: | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI Oct 31 15:24:57.053436: | remote SPI Oct 31 15:24:57.053438: | de 70 66 75 Oct 31 15:24:57.053441: | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals Oct 31 15:24:57.053444: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.053447: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.053449: | length: 12 (00 0c) Oct 31 15:24:57.053452: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:57.053454: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:57.053457: | *****parse IKEv2 Attribute Substructure Payload: Oct 31 15:24:57.053460: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:57.053463: | length/value: 128 (00 80) Oct 31 15:24:57.053468: | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 Oct 31 15:24:57.053471: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.053473: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.053476: | length: 8 (00 08) Oct 31 15:24:57.053479: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:57.053481: | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) Oct 31 15:24:57.053484: | remote proposal 1 transform 1 (INTEG=HMAC_SHA2_512_256) matches local proposal 1 type 3 (INTEG) transform 0 Oct 31 15:24:57.053487: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.053490: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:57.053492: | length: 8 (00 08) Oct 31 15:24:57.053495: | IKEv2 transform type: TRANS_TYPE_ESN (0x5) Oct 31 15:24:57.053497: | IKEv2 transform ID: ESN_DISABLED (0x0) Oct 31 15:24:57.053501: | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 Oct 31 15:24:57.053505: | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none Oct 31 15:24:57.053510: | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN Oct 31 15:24:57.053512: | remote proposal 1 matches local proposal 1 Oct 31 15:24:57.053518: "north-eastnets/0x2" #5: proposal 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-DISABLED SPI=de706675 chosen from remote proposals 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256;ESN=DISABLED[first-match] Oct 31 15:24:57.053524: | IKE_AUTH responder matching remote ESP/AH proposals ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-DISABLED SPI=de706675 Oct 31 15:24:57.053526: | converting proposal to internal trans attrs Oct 31 15:24:57.053546: | netlink_get_spi: allocated 0xf040d50e for esp.0@192.1.3.33 Oct 31 15:24:57.053550: | emitting ikev2_proposal ... Oct 31 15:24:57.053552: | ****emit IKEv2 Security Association Payload: Oct 31 15:24:57.053555: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.053557: | flags: none (0x0) Oct 31 15:24:57.053560: | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) Oct 31 15:24:57.053563: | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.053567: | *****emit IKEv2 Proposal Substructure Payload: Oct 31 15:24:57.053572: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:57.053575: | prop #: 1 (01) Oct 31 15:24:57.053577: | proto ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:24:57.053580: | spi size: 4 (04) Oct 31 15:24:57.053583: | # transforms: 3 (03) Oct 31 15:24:57.053585: | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' Oct 31 15:24:57.053589: | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload Oct 31 15:24:57.053592: | our spi: f0 40 d5 0e Oct 31 15:24:57.053595: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:57.053597: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.053599: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:57.053602: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:57.053604: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:57.053608: | *******emit IKEv2 Attribute Substructure Payload: Oct 31 15:24:57.053610: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:57.053613: | length/value: 128 (00 80) Oct 31 15:24:57.053616: | emitting length of IKEv2 Transform Substructure Payload: 12 Oct 31 15:24:57.053619: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:57.053621: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.053624: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:57.053626: | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) Oct 31 15:24:57.053629: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.053631: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:57.053634: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:57.053637: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:57.053639: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:57.053642: | IKEv2 transform type: TRANS_TYPE_ESN (0x5) Oct 31 15:24:57.053644: | IKEv2 transform ID: ESN_DISABLED (0x0) Oct 31 15:24:57.053647: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.053649: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:57.053652: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:57.053654: | emitting length of IKEv2 Proposal Substructure Payload: 40 Oct 31 15:24:57.053657: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 Oct 31 15:24:57.053659: | emitting length of IKEv2 Security Association Payload: 44 Oct 31 15:24:57.053661: | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 Oct 31 15:24:57.053664: | ****emit IKEv2 Traffic Selector - Initiator - Payload: Oct 31 15:24:57.053667: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.053669: | flags: none (0x0) Oct 31 15:24:57.053672: | number of TS: 1 (01) Oct 31 15:24:57.053675: | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) Oct 31 15:24:57.053678: | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.053681: | *****emit IKEv2 Traffic Selector: Oct 31 15:24:57.053683: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:57.053686: | IP Protocol ID: ALL (0x0) Oct 31 15:24:57.053690: | start port: 0 (00 00) Oct 31 15:24:57.053694: | end port: 65535 (ff ff) Oct 31 15:24:57.053697: | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector Oct 31 15:24:57.053700: | IP start: c0 00 16 00 Oct 31 15:24:57.053703: | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector Oct 31 15:24:57.053706: | IP end: c0 00 16 ff Oct 31 15:24:57.053708: | emitting length of IKEv2 Traffic Selector: 16 Oct 31 15:24:57.053710: | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 Oct 31 15:24:57.053713: | ****emit IKEv2 Traffic Selector - Responder - Payload: Oct 31 15:24:57.053716: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.053718: | flags: none (0x0) Oct 31 15:24:57.053721: | number of TS: 1 (01) Oct 31 15:24:57.053724: | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) Oct 31 15:24:57.053726: | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.053729: | *****emit IKEv2 Traffic Selector: Oct 31 15:24:57.053731: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:57.053733: | IP Protocol ID: ALL (0x0) Oct 31 15:24:57.053736: | start port: 0 (00 00) Oct 31 15:24:57.053739: | end port: 65535 (ff ff) Oct 31 15:24:57.053742: | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector Oct 31 15:24:57.053745: | IP start: c0 00 03 00 Oct 31 15:24:57.053748: | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector Oct 31 15:24:57.053751: | IP end: c0 00 03 ff Oct 31 15:24:57.053754: | emitting length of IKEv2 Traffic Selector: 16 Oct 31 15:24:57.053756: | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 Oct 31 15:24:57.053759: | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED Oct 31 15:24:57.053762: | integ=HMAC_SHA2_512_256: .key_size=64 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=80 Oct 31 15:24:57.053842: | FOR_EACH_CONNECTION_... in IKE_SA_established Oct 31 15:24:57.053848: | install_ipsec_sa() for #5: inbound and outbound Oct 31 15:24:57.053852: | could_route called for north-eastnets/0x2; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 Oct 31 15:24:57.053854: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:24:57.053857: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:24:57.053860: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:24:57.053863: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:24:57.053865: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:24:57.053868: | route owner of "north-eastnets/0x2" unrouted: NULL; eroute owner: NULL Oct 31 15:24:57.053873: | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA2_512_256 Oct 31 15:24:57.053876: | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 Oct 31 15:24:57.053879: | st->st_esp.keymat_len=80 is encrypt_keymat_size=16 + integ_keymat_size=64 Oct 31 15:24:57.053883: | setting IPsec SA replay-window to 32 Oct 31 15:24:57.053887: | NIC esp-hw-offload not for connection 'north-eastnets/0x2' not available on interface eth1 Oct 31 15:24:57.053890: | netlink: enabling tunnel mode Oct 31 15:24:57.053892: | XFRM: adding IPsec SA with reqid 16393 Oct 31 15:24:57.053894: | netlink: setting IPsec SA replay-window to 32 using old-style req Oct 31 15:24:57.053898: | netlink: esp-hw-offload not set for IPsec SA Oct 31 15:24:57.053957: | netlink response for Add SA esp.de706675@192.1.2.23 included non-error error Oct 31 15:24:57.053962: | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 Oct 31 15:24:57.053965: | set up outgoing SA, ref=0/0 Oct 31 15:24:57.053968: | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA2_512_256 Oct 31 15:24:57.053971: | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 Oct 31 15:24:57.053973: | st->st_esp.keymat_len=80 is encrypt_keymat_size=16 + integ_keymat_size=64 Oct 31 15:24:57.053981: | setting IPsec SA replay-window to 32 Oct 31 15:24:57.053984: | NIC esp-hw-offload not for connection 'north-eastnets/0x2' not available on interface eth1 Oct 31 15:24:57.053987: | netlink: enabling tunnel mode Oct 31 15:24:57.053990: | XFRM: adding IPsec SA with reqid 16393 Oct 31 15:24:57.053992: | netlink: setting IPsec SA replay-window to 32 using old-style req Oct 31 15:24:57.053994: | netlink: esp-hw-offload not set for IPsec SA Oct 31 15:24:57.054031: | netlink response for Add SA esp.f040d50e@192.1.3.33 included non-error error Oct 31 15:24:57.054036: | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 Oct 31 15:24:57.054038: | setup_half_ipsec_sa() is installing inbound eroute Oct 31 15:24:57.054041: | setup_half_ipsec_sa() before proto 50 Oct 31 15:24:57.054043: | setup_half_ipsec_sa() after proto 50 Oct 31 15:24:57.054046: | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) Oct 31 15:24:57.054049: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:24:57.054057: | add inbound eroute 192.0.22.0/24:0 --0-> 192.0.3.0/24:0 => tun.10000@192.1.3.33 using reqid 16393 (raw_eroute) proto=50 Oct 31 15:24:57.054061: | IPsec SA SPD priority set to 2084814 Oct 31 15:24:57.054087: | raw_eroute result=success Oct 31 15:24:57.054091: | set up incoming SA, ref=0/0 Oct 31 15:24:57.054094: | sr for #5: unrouted Oct 31 15:24:57.054096: | route_and_eroute() for proto 0, and source port 0 dest port 0 Oct 31 15:24:57.054099: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:24:57.054101: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:24:57.054104: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:24:57.054107: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:24:57.054109: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:24:57.054112: | route owner of "north-eastnets/0x2" unrouted: NULL; eroute owner: NULL Oct 31 15:24:57.054116: | route_and_eroute with c: north-eastnets/0x2 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #5 Oct 31 15:24:57.054119: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:24:57.054128: | eroute_connection add eroute 192.0.3.0/24:0 --0-> 192.0.22.0/24:0 => tun.0@192.1.2.23 using reqid 16393 (raw_eroute) proto=50 Oct 31 15:24:57.054131: | IPsec SA SPD priority set to 2084814 Oct 31 15:24:57.054144: | raw_eroute result=success Oct 31 15:24:57.054148: | running updown command "ipsec _updown" for verb up Oct 31 15:24:57.054151: | command executing up-client Oct 31 15:24:57.054155: | get_sa_info esp.de706675@192.1.2.23 Oct 31 15:24:57.054165: | get_sa_info esp.f040d50e@192.1.3.33 Oct 31 15:24:57.054202: | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157897' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURE... Oct 31 15:24:57.054209: | popen cmd is 1142 chars long Oct 31 15:24:57.054212: | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x2': Oct 31 15:24:57.054215: | cmd( 80): PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_N: Oct 31 15:24:57.054220: | cmd( 160):EXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT=: Oct 31 15:24:57.054222: | cmd( 240):'192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255: Oct 31 15:24:57.054224: | cmd( 320):.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE: Oct 31 15:24:57.054226: | cmd( 400):='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.22: Oct 31 15:24:57.054228: | cmd( 480):.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0': Oct 31 15:24:57.054231: | cmd( 560): PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm': Oct 31 15:24:57.054233: | cmd( 640): PLUTO_ADDTIME='1604157897' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+U: Oct 31 15:24:57.054235: | cmd( 720):P+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' : Oct 31 15:24:57.054237: | cmd( 800):PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_D: Oct 31 15:24:57.054240: | cmd( 880):NS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' P: Oct 31 15:24:57.054242: | cmd( 960):LUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0': Oct 31 15:24:57.054244: | cmd(1040): VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xde706675 SPI_OUT=0xf040d: Oct 31 15:24:57.054246: | cmd(1120):50e ipsec _updown 2>&1: Oct 31 15:24:57.064488: | route_and_eroute: firewall_notified: true Oct 31 15:24:57.064501: | running updown command "ipsec _updown" for verb prepare Oct 31 15:24:57.064506: | command executing prepare-client Oct 31 15:24:57.064513: | get_sa_info esp.de706675@192.1.2.23 Oct 31 15:24:57.064532: | get_sa_info esp.f040d50e@192.1.3.33 Oct 31 15:24:57.064570: | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157897' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM... Oct 31 15:24:57.064575: | popen cmd is 1149 chars long Oct 31 15:24:57.064578: | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets: Oct 31 15:24:57.064581: | cmd( 80):/0x2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PL: Oct 31 15:24:57.064583: | cmd( 160):UTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CL: Oct 31 15:24:57.064585: | cmd( 240):IENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.25: Oct 31 15:24:57.064587: | cmd( 320):5.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA: Oct 31 15:24:57.064590: | cmd( 400):_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192: Oct 31 15:24:57.064592: | cmd( 480):.0.22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.2: Oct 31 15:24:57.064594: | cmd( 560):55.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK=': Oct 31 15:24:57.064597: | cmd( 640):xfrm' PLUTO_ADDTIME='1604157897' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+: Oct 31 15:24:57.064599: | cmd( 720):PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMAN: Oct 31 15:24:57.064605: | cmd( 800):ENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_P: Oct 31 15:24:57.064607: | cmd( 880):EER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER=: Oct 31 15:24:57.064609: | cmd( 960):'0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTE: Oct 31 15:24:57.064612: | cmd(1040):S='168' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xde706675 SPI_OUT=: Oct 31 15:24:57.064614: | cmd(1120):0xf040d50e ipsec _updown 2>&1: Oct 31 15:24:57.073317: | running updown command "ipsec _updown" for verb route Oct 31 15:24:57.073327: | command executing route-client Oct 31 15:24:57.073334: | get_sa_info esp.de706675@192.1.2.23 Oct 31 15:24:57.073353: | get_sa_info esp.f040d50e@192.1.3.33 Oct 31 15:24:57.073391: | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157897' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CON... Oct 31 15:24:57.073395: | popen cmd is 1147 chars long Oct 31 15:24:57.073397: | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0: Oct 31 15:24:57.073400: | cmd( 80):x2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUT: Oct 31 15:24:57.073402: | cmd( 160):O_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIE: Oct 31 15:24:57.073405: | cmd( 240):NT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.: Oct 31 15:24:57.073407: | cmd( 320):255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_T: Oct 31 15:24:57.073409: | cmd( 400):YPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0: Oct 31 15:24:57.073411: | cmd( 480):.22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.255: Oct 31 15:24:57.073414: | cmd( 560):.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xf: Oct 31 15:24:57.073416: | cmd( 640):rm' PLUTO_ADDTIME='1604157897' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PF: Oct 31 15:24:57.073418: | cmd( 720):S+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANEN: Oct 31 15:24:57.073421: | cmd( 800):T' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEE: Oct 31 15:24:57.073423: | cmd( 880):R_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0: Oct 31 15:24:57.073425: | cmd( 960):' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES=: Oct 31 15:24:57.073428: | cmd(1040):'336' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xde706675 SPI_OUT=0x: Oct 31 15:24:57.073430: | cmd(1120):f040d50e ipsec _updown 2>&1: Oct 31 15:24:57.151839: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151852: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151856: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151860: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151866: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151869: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151875: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151878: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151881: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151884: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151888: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151903: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151913: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151927: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151939: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.151952: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152020: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152026: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152030: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152033: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152036: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152040: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152043: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152047: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152117: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152123: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152127: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152130: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.152133: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156302: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156318: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156543: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156928: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156938: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156952: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156965: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156980: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.156993: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.157005: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.157020: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.157031: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.157047: "north-eastnets/0x2" #2: route-client output: Error: Peer netns reference is invalid. Oct 31 15:24:57.174457: | route_and_eroute: instance "north-eastnets/0x2", setting eroute_owner {spd=0x559bbabc2640,sr=0x559bbabc2640} to #5 (was #0) (newest_ipsec_sa=#0) Oct 31 15:24:57.174537: | ISAKMP_v2_IKE_AUTH: instance north-eastnets/0x2[0], setting IKEv2 newest_ipsec_sa to #5 (was #0) (spd.eroute=#5) cloned from #2 Oct 31 15:24:57.174544: | adding 9 bytes of padding (including 1 byte padding-length) Oct 31 15:24:57.174549: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174551: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174554: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174556: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174559: | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174561: | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174564: | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174566: | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174569: | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.174572: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:24:57.174574: | emitting length of IKEv2 Encryption Payload: 500 Oct 31 15:24:57.174577: | emitting length of ISAKMP Message: 528 Oct 31 15:24:57.174632: | recording outgoing fragment failed Oct 31 15:24:57.174641: | delref logger@0x559bbabc9f30(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:57.174644: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:57.174647: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:57.174650: | XXX: resume sending helper answer back to state for #2 switched MD.ST to #5 Oct 31 15:24:57.174659: | suspend processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:57.174664: | start processing: state #5 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:57.174670: | #5 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_R0 PARENT_R1->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL Oct 31 15:24:57.174673: | transitioning from state STATE_PARENT_R1 to state STATE_V2_ESTABLISHED_CHILD_SA Oct 31 15:24:57.174676: | Message ID: updating counters for #5 Oct 31 15:24:57.174685: | Message ID: CHILD #2.#5 updating responder received message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=0 ike.responder.recv=0->1 ike.responder.last_contact=744569.46988->744571.607475 child.wip.initiator=-1 child.wip.responder=1->-1 Oct 31 15:24:57.174692: | Message ID: CHILD #2.#5 updating responder sent message response 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=0->1 ike.responder.recv=1 ike.responder.last_contact=744571.607475 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:57.174699: | Message ID: IKE #2 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744571.607475 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:57.174703: | child state #5: V2_IKE_AUTH_CHILD_R0(ignore) => ESTABLISHED_CHILD_SA(established CHILD SA) Oct 31 15:24:57.174706: | pstats #5 ikev2.child established Oct 31 15:24:57.174709: | announcing the state transition Oct 31 15:24:57.174718: "north-eastnets/0x2" #5: negotiated connection [192.0.3.0-192.0.3.255:0-65535 0] -> [192.0.22.0-192.0.22.255:0-65535 0] Oct 31 15:24:57.174727: | NAT-T: encaps is 'auto' Oct 31 15:24:57.174732: "north-eastnets/0x2" #5: IPsec SA established tunnel mode {ESP=>0xde706675 <0xf040d50e xfrm=AES_CBC_128-HMAC_SHA2_512_256 NATOA=none NATD=none DPD=passive} Oct 31 15:24:57.174740: | sending 528 bytes for STATE_PARENT_R1 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #2) Oct 31 15:24:57.174743: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.174746: | 2e 20 23 20 00 00 00 01 00 00 02 10 24 00 01 f4 Oct 31 15:24:57.174748: | 22 f4 ee c9 46 9f 12 7a 67 a4 0b 35 ac b5 30 7a Oct 31 15:24:57.174750: | 9d 58 89 1e fe ee 07 4a 66 07 97 55 25 6d bc ae Oct 31 15:24:57.174753: | e9 5e d0 6d 20 ee 5a cd 6a 56 44 f9 1a 83 4d 2f Oct 31 15:24:57.174755: | 41 7d ac 0a 7a ad a0 bd 54 d2 8d 53 6e ec 83 58 Oct 31 15:24:57.174757: | 07 c2 40 af cf 07 fa 3e f3 59 54 81 0b 8c ca ef Oct 31 15:24:57.174759: | 3d d9 19 24 66 5c d9 f2 28 bc b5 e6 b2 1f ea 10 Oct 31 15:24:57.174761: | 75 8a 73 6b 07 e9 bd 82 c1 ff 8a cb a5 64 f5 37 Oct 31 15:24:57.174763: | 61 c9 28 e4 e5 53 f1 ef c1 6b af ce a3 6c 3e af Oct 31 15:24:57.174765: | 28 bb b8 f3 68 da 73 b1 b5 b9 37 05 21 16 47 aa Oct 31 15:24:57.174767: | 62 15 22 de 0b e5 48 8c fa e7 60 6e 61 ad 71 28 Oct 31 15:24:57.174769: | 9e 74 9e 84 1c d2 f0 5f a0 3b dd d7 03 20 bc 40 Oct 31 15:24:57.174771: | af 1e cb c3 22 0b 47 9d 54 ec 7c 48 09 eb eb eb Oct 31 15:24:57.174773: | be 04 27 2e 26 dc df 69 5f 90 20 73 13 96 ce 91 Oct 31 15:24:57.174775: | d5 9e a7 41 a7 65 ed 65 75 b1 bc c3 8c b6 2f 35 Oct 31 15:24:57.174778: | 9f 10 c0 b2 7c 2e 87 b0 a7 e0 c0 58 b2 c1 b2 74 Oct 31 15:24:57.174780: | 02 15 7d 2d cb 9d 1d 65 38 ad 91 f9 ac f6 c1 f6 Oct 31 15:24:57.174782: | 44 10 08 dd 3a f5 72 d3 16 5f 80 e6 c4 13 09 fa Oct 31 15:24:57.174784: | 2d 3b 58 c0 c9 25 de b5 f9 b5 7b 1a 25 d1 01 05 Oct 31 15:24:57.174786: | 83 04 19 80 2e 8f 43 32 e5 f6 86 e3 3d 2a 46 69 Oct 31 15:24:57.174789: | 11 b9 70 0b 77 36 39 c6 1a b7 49 bb 98 6e b9 0a Oct 31 15:24:57.174791: | 62 07 3d 90 92 86 d7 09 ff 20 74 ec f8 8c b2 54 Oct 31 15:24:57.174793: | 17 23 f9 8c b4 3e 93 c9 60 e1 b6 67 c9 f7 b4 3e Oct 31 15:24:57.174795: | 6b bb c8 84 33 28 ac 21 8a 09 ad e2 43 46 60 f6 Oct 31 15:24:57.174797: | f0 df 41 27 28 96 58 8e 61 ea 7f a2 bf 8c 21 69 Oct 31 15:24:57.174799: | fa df c3 5a 80 fd 5c c6 10 e7 54 a7 9c 6f 1d 3f Oct 31 15:24:57.174801: | 16 8c 64 67 37 23 f0 6c 4a 1e 73 77 f8 17 83 ee Oct 31 15:24:57.174803: | 32 38 b7 cd e4 fe 05 b8 fa 41 53 7e 76 98 e6 12 Oct 31 15:24:57.174805: | 6c 63 df 87 3e 2e 60 99 dc ff ca f5 05 7d 93 be Oct 31 15:24:57.174807: | 1e a0 97 a0 96 ed 1f 56 f4 dd 82 5f a0 26 41 f3 Oct 31 15:24:57.174810: | b7 35 ee a0 30 33 09 5a a7 71 87 87 8e 9a 40 e8 Oct 31 15:24:57.174812: | ad 0c 82 c5 a1 80 20 07 7a 59 52 2f 91 1e 93 60 Oct 31 15:24:57.174842: | sent 1 messages Oct 31 15:24:57.174847: | releasing #5's fd-fd@(nil) because IKEv2 transitions finished Oct 31 15:24:57.174850: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:57.174852: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:57.174855: | unpending #5's IKE SA #2 Oct 31 15:24:57.174857: | unpending state #2 connection "north-eastnets/0x2" Oct 31 15:24:57.174860: | releasing #2's fd-fd@(nil) because IKEv2 transitions finished so releaseing IKE SA Oct 31 15:24:57.174863: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) Oct 31 15:24:57.174865: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) Oct 31 15:24:57.174869: | #5 will start re-keying in 28530 seconds with margin of 270 seconds (attempting re-key) Oct 31 15:24:57.174872: | state #5 has no .st_event to delete Oct 31 15:24:57.174875: | event_schedule: newref EVENT_SA_REKEY-pe@0x559bbab82620 Oct 31 15:24:57.174878: | inserting event EVENT_SA_REKEY, timeout in 28530 seconds for #5 Oct 31 15:24:57.174884: | libevent_malloc: newref ptr-libevent@0x7f32c8002790 size 128 Oct 31 15:24:57.174890: | delref mdp@0x559bbabc8750(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:57.174893: | delref logger@0x559bbabb4380(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:57.174896: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:57.174899: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:57.174906: | #2 spent 2.74 (122) milliseconds in resume sending helper answer back to state Oct 31 15:24:57.174912: | stop processing: state #5 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:57.174916: | libevent_free: delref ptr-libevent@0x7f32b0000c80 Oct 31 15:24:57.174926: | processing signal PLUTO_SIGCHLD Oct 31 15:24:57.174932: | waitpid returned ECHILD (no child processes left) Oct 31 15:24:57.174938: | spent 0.0061 (0.00592) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:24:57.174941: | processing signal PLUTO_SIGCHLD Oct 31 15:24:57.174944: | waitpid returned ECHILD (no child processes left) Oct 31 15:24:57.174948: | spent 0.00352 (0.0035) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:24:57.174950: | processing signal PLUTO_SIGCHLD Oct 31 15:24:57.174954: | waitpid returned ECHILD (no child processes left) Oct 31 15:24:57.174957: | spent 0.00349 (0.00348) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:24:57.306074: | spent 0.00236 (0.00239) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:57.306089: | newref struct msg_digest@0x559bbabc8750(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.306094: | newref alloc logger@0x559bbabb4380(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.306101: | *received 608 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:57.306104: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.306106: | 2e 20 24 08 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:57.306109: | 1f a3 e7 6b f5 b1 a5 39 6b e3 64 59 54 77 3e f7 Oct 31 15:24:57.306111: | 30 a8 e1 61 e7 3f 8b 1d db 22 32 b0 7c 90 e4 8a Oct 31 15:24:57.306113: | 9f ff a8 aa 6c 67 55 b3 68 47 eb 65 be e9 a3 75 Oct 31 15:24:57.306115: | b9 cb d3 4c 4e b8 e5 51 90 57 17 54 86 21 65 c4 Oct 31 15:24:57.306117: | 23 d5 38 05 d9 f1 a3 68 07 ef 4b 8a 83 db 8e 65 Oct 31 15:24:57.306119: | a8 89 5a 5f 59 03 7a b5 8d 27 9d 40 26 74 3d c2 Oct 31 15:24:57.306122: | 12 a2 73 62 04 87 fb ef 4b a0 08 22 b7 ac ac 10 Oct 31 15:24:57.306124: | 61 f4 9b 6e d3 28 b9 84 ac fd ef 0b 8a d0 fa 1a Oct 31 15:24:57.306126: | b5 a0 06 a1 91 78 af 6f 1f e7 63 d5 04 22 17 29 Oct 31 15:24:57.306128: | 60 24 2b 94 6d 86 81 00 64 1a cf 57 92 d1 7a f7 Oct 31 15:24:57.306130: | bc 9d 4a a2 d1 25 7d 7d 22 1a 23 1f d7 5b 6e b0 Oct 31 15:24:57.306132: | 5d 06 b1 45 db d0 47 50 0a 50 5c 47 b2 2c 59 ff Oct 31 15:24:57.306134: | e4 44 49 53 8c 06 ae de 57 73 0d 90 ba 50 42 fe Oct 31 15:24:57.306136: | 61 86 e0 23 40 7d ec 8c 78 ba f2 c4 81 f3 4a 4f Oct 31 15:24:57.306139: | ab 33 b6 02 19 f6 45 97 04 7f b5 01 b8 12 a1 cc Oct 31 15:24:57.306141: | a4 41 87 50 a4 ba ea 4d 39 96 3f c7 6d 5e 78 00 Oct 31 15:24:57.306143: | 7a e8 6d 68 ca 45 1c 7b 95 c4 ae cb eb b0 86 c0 Oct 31 15:24:57.306145: | ba 82 50 41 2c 92 2a 15 96 c4 d6 c6 27 74 6c 33 Oct 31 15:24:57.306147: | 5c 3b 07 7e 88 0e 9b 68 b8 70 e3 6c 9a d2 5c 8b Oct 31 15:24:57.306150: | 8a f5 ba 1d 10 9d 28 cc 22 22 2b dc e1 27 65 67 Oct 31 15:24:57.306152: | 4f 32 27 7e d9 b8 f1 04 0b 09 e7 c4 a6 86 bc fa Oct 31 15:24:57.306154: | ca 3c 05 e0 8b 96 43 c7 da 5a 36 3b 28 dc 64 bd Oct 31 15:24:57.306156: | 5e c6 61 85 f6 9f 21 ee 7b 28 e5 3c 45 2b 09 b6 Oct 31 15:24:57.306158: | ca ea f6 0a 3d e6 82 0f af 3b 19 92 c6 46 79 91 Oct 31 15:24:57.306160: | 34 b6 c0 6b 1b a6 a7 1d 7a 15 23 14 08 2c 64 b6 Oct 31 15:24:57.306163: | 3a ce a8 38 aa 47 b4 6d 7f d9 e4 f6 df 19 ef 45 Oct 31 15:24:57.306167: | 60 a0 41 a3 79 67 f0 d8 c9 93 ac 46 be ad 89 60 Oct 31 15:24:57.306169: | b5 1f df 65 0a 79 3e d6 15 e8 b8 71 0b 6e 7f 9f Oct 31 15:24:57.306171: | 99 ba db ad 52 94 d8 01 e8 11 02 0a f7 18 43 c5 Oct 31 15:24:57.306173: | 90 91 33 dd 75 ab ab e7 47 09 d0 aa 71 03 ad a7 Oct 31 15:24:57.306176: | 65 c1 7c 9d 97 28 6c 0b ee 0e 4c 83 c3 ca 34 91 Oct 31 15:24:57.306178: | 04 4b d2 4b 21 f4 1b 1e e8 47 1a 96 81 d2 87 07 Oct 31 15:24:57.306180: | 56 f4 6e b5 fe 2e 7c c5 d2 42 3f 21 17 2e 1c 1b Oct 31 15:24:57.306182: | 0f 54 cd f7 ce 37 ce ed 30 d1 3c 94 86 c3 f0 a2 Oct 31 15:24:57.306184: | ab d5 df 7b d2 1b 8c d9 b2 c6 64 4a 7f f9 80 84 Oct 31 15:24:57.306187: | 0d 30 0c 39 5b 76 ce 64 9c 54 ed dd 91 fe 98 51 Oct 31 15:24:57.306191: | **parse ISAKMP Message: Oct 31 15:24:57.306196: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:57.306203: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.306208: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:57.306211: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:57.306213: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:57.306216: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:57.306220: | Message ID: 2 (00 00 00 02) Oct 31 15:24:57.306223: | length: 608 (00 00 02 60) Oct 31 15:24:57.306227: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36) Oct 31 15:24:57.306231: | I am the IKE SA Original Responder receiving an IKEv2 CREATE_CHILD_SA request Oct 31 15:24:57.306235: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:24:57.306243: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:57.306246: | #2 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 Oct 31 15:24:57.306249: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:24:57.306252: | #2 is idle Oct 31 15:24:57.306258: | Message ID: IKE #2 not a duplicate - message request 2 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744571.607475 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:57.306264: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:24:57.306267: | unpacking clear payload Oct 31 15:24:57.306269: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:24:57.306273: | ***parse IKEv2 Encryption Payload: Oct 31 15:24:57.306276: | next payload type: ISAKMP_NEXT_v2SA (0x21) Oct 31 15:24:57.306278: | flags: none (0x0) Oct 31 15:24:57.306282: | length: 580 (02 44) Oct 31 15:24:57.306284: | processing payload: ISAKMP_NEXT_v2SK (len=576) Oct 31 15:24:57.306287: | #2 in state ESTABLISHED_IKE_SA: established IKE SA Oct 31 15:24:57.306319: | authenticator matched Oct 31 15:24:57.306331: | #2 ikev2 ISAKMP_v2_CREATE_CHILD_SA decrypt success Oct 31 15:24:57.306334: | Now let's proceed with payload (ISAKMP_NEXT_v2SA) Oct 31 15:24:57.306338: | **parse IKEv2 Security Association Payload: Oct 31 15:24:57.306341: | next payload type: ISAKMP_NEXT_v2Ni (0x28) Oct 31 15:24:57.306343: | flags: none (0x0) Oct 31 15:24:57.306346: | length: 52 (00 34) Oct 31 15:24:57.306349: | processing payload: ISAKMP_NEXT_v2SA (len=48) Oct 31 15:24:57.306351: | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) Oct 31 15:24:57.306354: | **parse IKEv2 Nonce Payload: Oct 31 15:24:57.306356: | next payload type: ISAKMP_NEXT_v2KE (0x22) Oct 31 15:24:57.306358: | flags: none (0x0) Oct 31 15:24:57.306361: | length: 36 (00 24) Oct 31 15:24:57.306364: | processing payload: ISAKMP_NEXT_v2Ni (len=32) Oct 31 15:24:57.306366: | Now let's proceed with payload (ISAKMP_NEXT_v2KE) Oct 31 15:24:57.306369: | **parse IKEv2 Key Exchange Payload: Oct 31 15:24:57.306371: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) Oct 31 15:24:57.306377: | flags: none (0x0) Oct 31 15:24:57.306380: | length: 392 (01 88) Oct 31 15:24:57.306382: | DH group: OAKLEY_GROUP_MODP3072 (0xf) Oct 31 15:24:57.306385: | processing payload: ISAKMP_NEXT_v2KE (len=384) Oct 31 15:24:57.306387: | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) Oct 31 15:24:57.306390: | **parse IKEv2 Traffic Selector - Initiator - Payload: Oct 31 15:24:57.306392: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) Oct 31 15:24:57.306395: | flags: none (0x0) Oct 31 15:24:57.306398: | length: 24 (00 18) Oct 31 15:24:57.306400: | number of TS: 1 (01) Oct 31 15:24:57.306403: | processing payload: ISAKMP_NEXT_v2TSi (len=16) Oct 31 15:24:57.306405: | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) Oct 31 15:24:57.306408: | **parse IKEv2 Traffic Selector - Responder - Payload: Oct 31 15:24:57.306410: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.306413: | flags: none (0x0) Oct 31 15:24:57.306416: | length: 24 (00 18) Oct 31 15:24:57.306419: | number of TS: 1 (01) Oct 31 15:24:57.306421: | processing payload: ISAKMP_NEXT_v2TSr (len=16) Oct 31 15:24:57.306424: | state #2 forced to match CREATE_CHILD_SA from STATE_V2_NEW_CHILD_R0->STATE_V2_ESTABLISHED_CHILD_SA by ignoring from state Oct 31 15:24:57.306427: | selected state microcode Respond to CREATE_CHILD_SA IPsec SA Request Oct 31 15:24:57.306433: | #2 updating local interface from 192.1.3.33:500 to 192.1.3.33:500 using md->iface (in update_ike_endpoints() at state.c:2631) Oct 31 15:24:57.306438: | newref alloc logger@0x559bbabc9f30(0->1) (in new_state() at state.c:576) Oct 31 15:24:57.306441: | addref fd@NULL (in new_state() at state.c:577) Oct 31 15:24:57.306444: | creating state object #6 at 0x559bbabd45e0 Oct 31 15:24:57.306446: | State DB: adding IKEv2 state #6 in UNDEFINED Oct 31 15:24:57.306452: | pstats #6 ikev2.child started Oct 31 15:24:57.306455: | duplicating state object #2 "north-eastnets/0x2" as #6 for IPSEC SA Oct 31 15:24:57.306461: | #6 setting local endpoint to 192.1.3.33:500 from #2.st_localport (in duplicate_state() at state.c:1581) Oct 31 15:24:57.306469: | Message ID: CHILD #2.#6 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744571.607475 child.wip.initiator=0->-1 child.wip.responder=0->-1 Oct 31 15:24:57.306472: | child state #6: UNDEFINED(ignore) => V2_NEW_CHILD_R0(established IKE SA) Oct 31 15:24:57.306477: | #6.st_v2_transition NULL -> V2_NEW_CHILD_R0->ESTABLISHED_CHILD_SA (in new_v2_child_state() at state.c:1666) Oct 31 15:24:57.306480: | "north-eastnets/0x2" #2 received Respond to CREATE_CHILD_SA IPsec SA Request CREATE_CHILD_SA Child "north-eastnets/0x2" #6 in STATE_V2_NEW_CHILD_R0 will process it further Oct 31 15:24:57.306483: | forcing ST #2 to CHILD #2.#6 in FSM processor Oct 31 15:24:57.306489: | Message ID: CHILD #2.#6 responder starting message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744571.607475 child.wip.initiator=-1 child.wip.responder=-1->2 Oct 31 15:24:57.306492: | calling processor Respond to CREATE_CHILD_SA IPsec SA Request Oct 31 15:24:57.306500: | using existing local ESP/AH proposals for north-eastnets/0x2 (CREATE_CHILD_SA responder matching remote ESP/AH proposals): 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED Oct 31 15:24:57.306503: | comparing remote proposals against CREATE_CHILD_SA responder matching remote ESP/AH proposals 1 local proposals Oct 31 15:24:57.306508: | local proposal 1 type ENCR has 1 transforms Oct 31 15:24:57.306510: | local proposal 1 type PRF has 0 transforms Oct 31 15:24:57.306512: | local proposal 1 type INTEG has 1 transforms Oct 31 15:24:57.306515: | local proposal 1 type DH has 1 transforms Oct 31 15:24:57.306517: | local proposal 1 type ESN has 1 transforms Oct 31 15:24:57.306521: | local proposal 1 transforms: required: ENCR+INTEG+DH+ESN; optional: none Oct 31 15:24:57.306527: | ***parse IKEv2 Proposal Substructure Payload: Oct 31 15:24:57.306529: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:57.306532: | length: 48 (00 30) Oct 31 15:24:57.306535: | prop #: 1 (01) Oct 31 15:24:57.306538: | proto ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:24:57.306540: | spi size: 4 (04) Oct 31 15:24:57.306543: | # transforms: 4 (04) Oct 31 15:24:57.306546: | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI Oct 31 15:24:57.306549: | remote SPI Oct 31 15:24:57.306551: | bd 68 e0 ed Oct 31 15:24:57.306554: | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals Oct 31 15:24:57.306557: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.306560: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.306563: | length: 12 (00 0c) Oct 31 15:24:57.306565: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:57.306568: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:57.306571: | *****parse IKEv2 Attribute Substructure Payload: Oct 31 15:24:57.306573: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:57.306576: | length/value: 128 (00 80) Oct 31 15:24:57.306580: | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 Oct 31 15:24:57.306583: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.306586: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.306589: | length: 8 (00 08) Oct 31 15:24:57.306591: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:57.306593: | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) Oct 31 15:24:57.306597: | remote proposal 1 transform 1 (INTEG=HMAC_SHA2_512_256) matches local proposal 1 type 3 (INTEG) transform 0 Oct 31 15:24:57.306600: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.306603: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.306606: | length: 8 (00 08) Oct 31 15:24:57.306608: | IKEv2 transform type: TRANS_TYPE_DH (0x4) Oct 31 15:24:57.306610: | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) Oct 31 15:24:57.306613: | remote proposal 1 transform 2 (DH=MODP3072) matches local proposal 1 type 4 (DH) transform 0 Oct 31 15:24:57.306616: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.306618: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:57.306621: | length: 8 (00 08) Oct 31 15:24:57.306624: | IKEv2 transform type: TRANS_TYPE_ESN (0x5) Oct 31 15:24:57.306626: | IKEv2 transform ID: ESN_DISABLED (0x0) Oct 31 15:24:57.306629: | remote proposal 1 transform 3 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 Oct 31 15:24:57.306633: | remote proposal 1 proposed transforms: ENCR+INTEG+DH+ESN; matched: ENCR+INTEG+DH+ESN; unmatched: none Oct 31 15:24:57.306639: | comparing remote proposal 1 containing ENCR+INTEG+DH+ESN transforms to local proposal 1; required: ENCR+INTEG+DH+ESN; optional: none; matched: ENCR+INTEG+DH+ESN Oct 31 15:24:57.306641: | remote proposal 1 matches local proposal 1 Oct 31 15:24:57.306648: "north-eastnets/0x2" #6: proposal 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED SPI=bd68e0ed chosen from remote proposals 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256;DH=MODP3072;ESN=DISABLED[first-match] Oct 31 15:24:57.306653: | CREATE_CHILD_SA responder matching remote ESP/AH proposals ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED SPI=bd68e0ed Oct 31 15:24:57.306656: | converting proposal to internal trans attrs Oct 31 15:24:57.306660: | updating #6's .st_oakley with preserved PRF, but why update? Oct 31 15:24:57.306664: | Child SA TS Request has child->sa == md->st; so using child connection Oct 31 15:24:57.306667: | TSi: parsing 1 traffic selectors Oct 31 15:24:57.306670: | ***parse IKEv2 Traffic Selector: Oct 31 15:24:57.306672: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:57.306675: | IP Protocol ID: ALL (0x0) Oct 31 15:24:57.306678: | length: 16 (00 10) Oct 31 15:24:57.306683: | start port: 0 (00 00) Oct 31 15:24:57.306686: | end port: 65535 (ff ff) Oct 31 15:24:57.306689: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low Oct 31 15:24:57.306691: | TS low Oct 31 15:24:57.306693: | c0 00 02 00 Oct 31 15:24:57.306696: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high Oct 31 15:24:57.306698: | TS high Oct 31 15:24:57.306700: | c0 00 02 ff Oct 31 15:24:57.306702: | TSi: parsed 1 traffic selectors Oct 31 15:24:57.306705: | TSr: parsing 1 traffic selectors Oct 31 15:24:57.306707: | ***parse IKEv2 Traffic Selector: Oct 31 15:24:57.306710: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:57.306713: | IP Protocol ID: ALL (0x0) Oct 31 15:24:57.306715: | length: 16 (00 10) Oct 31 15:24:57.306718: | start port: 0 (00 00) Oct 31 15:24:57.306721: | end port: 65535 (ff ff) Oct 31 15:24:57.306724: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low Oct 31 15:24:57.306726: | TS low Oct 31 15:24:57.306727: | c0 00 03 00 Oct 31 15:24:57.306730: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high Oct 31 15:24:57.306732: | TS high Oct 31 15:24:57.306734: | c0 00 03 ff Oct 31 15:24:57.306736: | TSr: parsed 1 traffic selectors Oct 31 15:24:57.306738: | looking for best SPD in current connection Oct 31 15:24:57.306745: | evaluating our conn="north-eastnets/0x2" I=192.0.22.0/24:0:0/0 R=192.0.3.0/24:0:0/0 to their: Oct 31 15:24:57.306751: | TSi[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.306758: | match address end->client=192.0.22.0/24 == TSi[0]net=192.0.2.0-192.0.2.255: NO Oct 31 15:24:57.306761: | looking for better host pair Oct 31 15:24:57.306767: | find_host_pair: comparing 192.1.3.33:500 to 192.1.2.23:500 but ignoring ports Oct 31 15:24:57.306773: | checking hostpair 192.0.3.0/24:0 -> 192.0.22.0/24:0 is found Oct 31 15:24:57.306775: | investigating connection "north-eastnets/0x2" as a better match Oct 31 15:24:57.306779: | match_id a=@east Oct 31 15:24:57.306781: | b=@east Oct 31 15:24:57.306783: | results matched Oct 31 15:24:57.306789: | evaluating our conn="north-eastnets/0x2" I=192.0.22.0/24:0:0/0 R=192.0.3.0/24:0:0/0 to their: Oct 31 15:24:57.306794: | TSi[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.306801: | match address end->client=192.0.22.0/24 == TSi[0]net=192.0.2.0-192.0.2.255: NO Oct 31 15:24:57.306803: | investigating connection "north-eastnets/0x1" as a better match Oct 31 15:24:57.306806: | match_id a=@east Oct 31 15:24:57.306808: | b=@east Oct 31 15:24:57.306810: | results matched Oct 31 15:24:57.306816: | evaluating our conn="north-eastnets/0x1" I=192.0.2.0/24:0:0/0 R=192.0.3.0/24:0:0/0 to their: Oct 31 15:24:57.306820: | TSi[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.306827: | match address end->client=192.0.2.0/24 == TSi[0]net=192.0.2.0-192.0.2.255: YES fitness 32 Oct 31 15:24:57.306831: | narrow port end=0..65535 == TSi[0]=0..65535: 0 Oct 31 15:24:57.306833: | TSi[0] port match: YES fitness 65536 Oct 31 15:24:57.306836: | narrow protocol end=*0 == TSi[0]=*0: 0 Oct 31 15:24:57.306839: | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:57.306844: | TSr[0] .net=192.0.3.0-192.0.3.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:57.306850: | match address end->client=192.0.3.0/24 == TSr[0]net=192.0.3.0-192.0.3.255: YES fitness 32 Oct 31 15:24:57.306853: | narrow port end=0..65535 == TSr[0]=0..65535: 0 Oct 31 15:24:57.306855: | TSr[0] port match: YES fitness 65536 Oct 31 15:24:57.306858: | narrow protocol end=*0 == TSr[0]=*0: 0 Oct 31 15:24:57.306861: | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:57.306864: | best fit so far: TSi[0] TSr[0] Oct 31 15:24:57.306866: | protocol fitness found better match d north-eastnets/0x1, TSi[0],TSr[0] Oct 31 15:24:57.306870: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:24:57.306875: | printing contents struct traffic_selector Oct 31 15:24:57.306877: | ts_type: IKEv2_TS_IPV4_ADDR_RANGE Oct 31 15:24:57.306880: | ipprotoid: 0 Oct 31 15:24:57.306882: | port range: 0-65535 Oct 31 15:24:57.306886: | ip range: 192.0.3.0-192.0.3.255 Oct 31 15:24:57.306888: | printing contents struct traffic_selector Oct 31 15:24:57.306890: | ts_type: IKEv2_TS_IPV4_ADDR_RANGE Oct 31 15:24:57.306892: | ipprotoid: 0 Oct 31 15:24:57.306895: | port range: 0-65535 Oct 31 15:24:57.306899: | ip range: 192.0.2.0-192.0.2.255 Oct 31 15:24:57.306904: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:57.306907: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:24:57.306910: | newref clone logger@0x559bbabcfa10(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:57.306913: | job 8 for #6: Child Responder KE and nonce nr (build KE and nonce): adding job to queue Oct 31 15:24:57.306915: | state #6 has no .st_event to delete Oct 31 15:24:57.306918: | #6 STATE_V2_NEW_CHILD_R0: retransmits: cleared Oct 31 15:24:57.306921: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbab12940 Oct 31 15:24:57.306924: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #6 Oct 31 15:24:57.306927: | libevent_malloc: newref ptr-libevent@0x7f32b0000c80 size 128 Oct 31 15:24:57.306939: | #6 spent 0.441 (0.441) milliseconds in processing: Respond to CREATE_CHILD_SA IPsec SA Request in v2_dispatch() Oct 31 15:24:57.306945: | suspend processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:57.306950: | start processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:57.306953: | #6 complete_v2_state_transition() V2_NEW_CHILD_R0->ESTABLISHED_CHILD_SA with status STF_SUSPEND Oct 31 15:24:57.306956: | suspending state #6 and saving MD 0x559bbabc8750 Oct 31 15:24:57.306959: | addref md@0x559bbabc8750(1->2) (in complete_v2_state_transition() at ikev2.c:3485) Oct 31 15:24:57.306961: | #6 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:57.306966: | stop processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:57.306971: | #2 spent 0.903 (0.905) milliseconds in ikev2_process_packet() Oct 31 15:24:57.306974: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:57.306977: | delref mdp@0x559bbabc8750(2->1) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.306981: | spent 0.914 (0.916) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:57.306993: | job 8 for #6: Child Responder KE and nonce nr (build KE and nonce): helper 1 starting job Oct 31 15:24:57.306996: | helper 1 is pausing for 1 seconds Oct 31 15:24:57.357468: | spent 0.0023 (0.00229) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:57.357490: | newref struct msg_digest@0x559bbabd5e40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.357494: | newref alloc logger@0x559bbabcdb50(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.357501: | *received 608 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:57.357505: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.357507: | 2e 20 24 08 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:57.357509: | 1f a3 e7 6b f5 b1 a5 39 6b e3 64 59 54 77 3e f7 Oct 31 15:24:57.357511: | 30 a8 e1 61 e7 3f 8b 1d db 22 32 b0 7c 90 e4 8a Oct 31 15:24:57.357514: | 9f ff a8 aa 6c 67 55 b3 68 47 eb 65 be e9 a3 75 Oct 31 15:24:57.357516: | b9 cb d3 4c 4e b8 e5 51 90 57 17 54 86 21 65 c4 Oct 31 15:24:57.357518: | 23 d5 38 05 d9 f1 a3 68 07 ef 4b 8a 83 db 8e 65 Oct 31 15:24:57.357520: | a8 89 5a 5f 59 03 7a b5 8d 27 9d 40 26 74 3d c2 Oct 31 15:24:57.357522: | 12 a2 73 62 04 87 fb ef 4b a0 08 22 b7 ac ac 10 Oct 31 15:24:57.357524: | 61 f4 9b 6e d3 28 b9 84 ac fd ef 0b 8a d0 fa 1a Oct 31 15:24:57.357528: | b5 a0 06 a1 91 78 af 6f 1f e7 63 d5 04 22 17 29 Oct 31 15:24:57.357530: | 60 24 2b 94 6d 86 81 00 64 1a cf 57 92 d1 7a f7 Oct 31 15:24:57.357533: | bc 9d 4a a2 d1 25 7d 7d 22 1a 23 1f d7 5b 6e b0 Oct 31 15:24:57.357535: | 5d 06 b1 45 db d0 47 50 0a 50 5c 47 b2 2c 59 ff Oct 31 15:24:57.357537: | e4 44 49 53 8c 06 ae de 57 73 0d 90 ba 50 42 fe Oct 31 15:24:57.357539: | 61 86 e0 23 40 7d ec 8c 78 ba f2 c4 81 f3 4a 4f Oct 31 15:24:57.357541: | ab 33 b6 02 19 f6 45 97 04 7f b5 01 b8 12 a1 cc Oct 31 15:24:57.357543: | a4 41 87 50 a4 ba ea 4d 39 96 3f c7 6d 5e 78 00 Oct 31 15:24:57.357546: | 7a e8 6d 68 ca 45 1c 7b 95 c4 ae cb eb b0 86 c0 Oct 31 15:24:57.357548: | ba 82 50 41 2c 92 2a 15 96 c4 d6 c6 27 74 6c 33 Oct 31 15:24:57.357550: | 5c 3b 07 7e 88 0e 9b 68 b8 70 e3 6c 9a d2 5c 8b Oct 31 15:24:57.357552: | 8a f5 ba 1d 10 9d 28 cc 22 22 2b dc e1 27 65 67 Oct 31 15:24:57.357554: | 4f 32 27 7e d9 b8 f1 04 0b 09 e7 c4 a6 86 bc fa Oct 31 15:24:57.357556: | ca 3c 05 e0 8b 96 43 c7 da 5a 36 3b 28 dc 64 bd Oct 31 15:24:57.357558: | 5e c6 61 85 f6 9f 21 ee 7b 28 e5 3c 45 2b 09 b6 Oct 31 15:24:57.357560: | ca ea f6 0a 3d e6 82 0f af 3b 19 92 c6 46 79 91 Oct 31 15:24:57.357563: | 34 b6 c0 6b 1b a6 a7 1d 7a 15 23 14 08 2c 64 b6 Oct 31 15:24:57.357565: | 3a ce a8 38 aa 47 b4 6d 7f d9 e4 f6 df 19 ef 45 Oct 31 15:24:57.357567: | 60 a0 41 a3 79 67 f0 d8 c9 93 ac 46 be ad 89 60 Oct 31 15:24:57.357569: | b5 1f df 65 0a 79 3e d6 15 e8 b8 71 0b 6e 7f 9f Oct 31 15:24:57.357571: | 99 ba db ad 52 94 d8 01 e8 11 02 0a f7 18 43 c5 Oct 31 15:24:57.357573: | 90 91 33 dd 75 ab ab e7 47 09 d0 aa 71 03 ad a7 Oct 31 15:24:57.357575: | 65 c1 7c 9d 97 28 6c 0b ee 0e 4c 83 c3 ca 34 91 Oct 31 15:24:57.357578: | 04 4b d2 4b 21 f4 1b 1e e8 47 1a 96 81 d2 87 07 Oct 31 15:24:57.357580: | 56 f4 6e b5 fe 2e 7c c5 d2 42 3f 21 17 2e 1c 1b Oct 31 15:24:57.357582: | 0f 54 cd f7 ce 37 ce ed 30 d1 3c 94 86 c3 f0 a2 Oct 31 15:24:57.357585: | ab d5 df 7b d2 1b 8c d9 b2 c6 64 4a 7f f9 80 84 Oct 31 15:24:57.357587: | 0d 30 0c 39 5b 76 ce 64 9c 54 ed dd 91 fe 98 51 Oct 31 15:24:57.357592: | **parse ISAKMP Message: Oct 31 15:24:57.357597: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:57.357601: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.357604: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:57.357607: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:57.357610: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:57.357612: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:57.357617: | Message ID: 2 (00 00 00 02) Oct 31 15:24:57.357621: | length: 608 (00 00 02 60) Oct 31 15:24:57.357624: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36) Oct 31 15:24:57.357627: | I am the IKE SA Original Responder receiving an IKEv2 CREATE_CHILD_SA request Oct 31 15:24:57.357633: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:24:57.357640: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:57.357644: | #2 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 Oct 31 15:24:57.357647: | State DB: found IKEv2 state #6 in V2_NEW_CHILD_R0 (find_v2_sa_by_responder_wip) Oct 31 15:24:57.357650: | #6 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:57.357654: "north-eastnets/0x1" #6: discarding packet received during asynchronous work (DNS or crypto) in STATE_V2_NEW_CHILD_R0 Oct 31 15:24:57.357660: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:57.357665: | #2 spent 0.205 (0.205) milliseconds in ikev2_process_packet() Oct 31 15:24:57.357668: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:57.357671: | delref mdp@0x559bbabd5e40(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.357676: | delref logger@0x559bbabcdb50(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.357679: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:57.357682: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:57.357686: | spent 0.227 (0.227) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:57.408837: | spent 0.00232 (0.00232) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:57.408854: | newref struct msg_digest@0x559bbabd5e40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.408858: | newref alloc logger@0x559bbabcdb50(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.408865: | *received 608 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:57.408868: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.408871: | 2e 20 24 08 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:57.408873: | 1f a3 e7 6b f5 b1 a5 39 6b e3 64 59 54 77 3e f7 Oct 31 15:24:57.408875: | 30 a8 e1 61 e7 3f 8b 1d db 22 32 b0 7c 90 e4 8a Oct 31 15:24:57.408877: | 9f ff a8 aa 6c 67 55 b3 68 47 eb 65 be e9 a3 75 Oct 31 15:24:57.408879: | b9 cb d3 4c 4e b8 e5 51 90 57 17 54 86 21 65 c4 Oct 31 15:24:57.408881: | 23 d5 38 05 d9 f1 a3 68 07 ef 4b 8a 83 db 8e 65 Oct 31 15:24:57.408883: | a8 89 5a 5f 59 03 7a b5 8d 27 9d 40 26 74 3d c2 Oct 31 15:24:57.408886: | 12 a2 73 62 04 87 fb ef 4b a0 08 22 b7 ac ac 10 Oct 31 15:24:57.408888: | 61 f4 9b 6e d3 28 b9 84 ac fd ef 0b 8a d0 fa 1a Oct 31 15:24:57.408890: | b5 a0 06 a1 91 78 af 6f 1f e7 63 d5 04 22 17 29 Oct 31 15:24:57.408892: | 60 24 2b 94 6d 86 81 00 64 1a cf 57 92 d1 7a f7 Oct 31 15:24:57.408894: | bc 9d 4a a2 d1 25 7d 7d 22 1a 23 1f d7 5b 6e b0 Oct 31 15:24:57.408896: | 5d 06 b1 45 db d0 47 50 0a 50 5c 47 b2 2c 59 ff Oct 31 15:24:57.408898: | e4 44 49 53 8c 06 ae de 57 73 0d 90 ba 50 42 fe Oct 31 15:24:57.408901: | 61 86 e0 23 40 7d ec 8c 78 ba f2 c4 81 f3 4a 4f Oct 31 15:24:57.408903: | ab 33 b6 02 19 f6 45 97 04 7f b5 01 b8 12 a1 cc Oct 31 15:24:57.408905: | a4 41 87 50 a4 ba ea 4d 39 96 3f c7 6d 5e 78 00 Oct 31 15:24:57.408908: | 7a e8 6d 68 ca 45 1c 7b 95 c4 ae cb eb b0 86 c0 Oct 31 15:24:57.408910: | ba 82 50 41 2c 92 2a 15 96 c4 d6 c6 27 74 6c 33 Oct 31 15:24:57.408912: | 5c 3b 07 7e 88 0e 9b 68 b8 70 e3 6c 9a d2 5c 8b Oct 31 15:24:57.408914: | 8a f5 ba 1d 10 9d 28 cc 22 22 2b dc e1 27 65 67 Oct 31 15:24:57.408916: | 4f 32 27 7e d9 b8 f1 04 0b 09 e7 c4 a6 86 bc fa Oct 31 15:24:57.408918: | ca 3c 05 e0 8b 96 43 c7 da 5a 36 3b 28 dc 64 bd Oct 31 15:24:57.408920: | 5e c6 61 85 f6 9f 21 ee 7b 28 e5 3c 45 2b 09 b6 Oct 31 15:24:57.408922: | ca ea f6 0a 3d e6 82 0f af 3b 19 92 c6 46 79 91 Oct 31 15:24:57.408924: | 34 b6 c0 6b 1b a6 a7 1d 7a 15 23 14 08 2c 64 b6 Oct 31 15:24:57.408926: | 3a ce a8 38 aa 47 b4 6d 7f d9 e4 f6 df 19 ef 45 Oct 31 15:24:57.408929: | 60 a0 41 a3 79 67 f0 d8 c9 93 ac 46 be ad 89 60 Oct 31 15:24:57.408931: | b5 1f df 65 0a 79 3e d6 15 e8 b8 71 0b 6e 7f 9f Oct 31 15:24:57.408933: | 99 ba db ad 52 94 d8 01 e8 11 02 0a f7 18 43 c5 Oct 31 15:24:57.408935: | 90 91 33 dd 75 ab ab e7 47 09 d0 aa 71 03 ad a7 Oct 31 15:24:57.408937: | 65 c1 7c 9d 97 28 6c 0b ee 0e 4c 83 c3 ca 34 91 Oct 31 15:24:57.408940: | 04 4b d2 4b 21 f4 1b 1e e8 47 1a 96 81 d2 87 07 Oct 31 15:24:57.408942: | 56 f4 6e b5 fe 2e 7c c5 d2 42 3f 21 17 2e 1c 1b Oct 31 15:24:57.408944: | 0f 54 cd f7 ce 37 ce ed 30 d1 3c 94 86 c3 f0 a2 Oct 31 15:24:57.408946: | ab d5 df 7b d2 1b 8c d9 b2 c6 64 4a 7f f9 80 84 Oct 31 15:24:57.408948: | 0d 30 0c 39 5b 76 ce 64 9c 54 ed dd 91 fe 98 51 Oct 31 15:24:57.408953: | **parse ISAKMP Message: Oct 31 15:24:57.408958: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:57.408962: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.408965: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:57.408968: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:57.408973: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:57.408976: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:57.408980: | Message ID: 2 (00 00 00 02) Oct 31 15:24:57.408983: | length: 608 (00 00 02 60) Oct 31 15:24:57.408986: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36) Oct 31 15:24:57.408990: | I am the IKE SA Original Responder receiving an IKEv2 CREATE_CHILD_SA request Oct 31 15:24:57.408994: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:24:57.409002: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:57.409005: | #2 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 Oct 31 15:24:57.409008: | State DB: found IKEv2 state #6 in V2_NEW_CHILD_R0 (find_v2_sa_by_responder_wip) Oct 31 15:24:57.409011: | #6 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:57.409015: "north-eastnets/0x1" #6: discarding packet received during asynchronous work (DNS or crypto) in STATE_V2_NEW_CHILD_R0 Oct 31 15:24:57.409020: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:57.409026: | #2 spent 0.196 (0.196) milliseconds in ikev2_process_packet() Oct 31 15:24:57.409029: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:57.409032: | delref mdp@0x559bbabd5e40(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.409035: | delref logger@0x559bbabcdb50(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.409038: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:57.409040: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:57.409045: | spent 0.215 (0.215) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:57.510258: | spent 0.00238 (0.0024) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:57.510274: | newref struct msg_digest@0x559bbabd5e40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.510279: | newref alloc logger@0x559bbabcdb50(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.510285: | *received 608 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:57.510288: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.510291: | 2e 20 24 08 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:57.510293: | 1f a3 e7 6b f5 b1 a5 39 6b e3 64 59 54 77 3e f7 Oct 31 15:24:57.510295: | 30 a8 e1 61 e7 3f 8b 1d db 22 32 b0 7c 90 e4 8a Oct 31 15:24:57.510297: | 9f ff a8 aa 6c 67 55 b3 68 47 eb 65 be e9 a3 75 Oct 31 15:24:57.510299: | b9 cb d3 4c 4e b8 e5 51 90 57 17 54 86 21 65 c4 Oct 31 15:24:57.510302: | 23 d5 38 05 d9 f1 a3 68 07 ef 4b 8a 83 db 8e 65 Oct 31 15:24:57.510304: | a8 89 5a 5f 59 03 7a b5 8d 27 9d 40 26 74 3d c2 Oct 31 15:24:57.510306: | 12 a2 73 62 04 87 fb ef 4b a0 08 22 b7 ac ac 10 Oct 31 15:24:57.510308: | 61 f4 9b 6e d3 28 b9 84 ac fd ef 0b 8a d0 fa 1a Oct 31 15:24:57.510310: | b5 a0 06 a1 91 78 af 6f 1f e7 63 d5 04 22 17 29 Oct 31 15:24:57.510312: | 60 24 2b 94 6d 86 81 00 64 1a cf 57 92 d1 7a f7 Oct 31 15:24:57.510314: | bc 9d 4a a2 d1 25 7d 7d 22 1a 23 1f d7 5b 6e b0 Oct 31 15:24:57.510317: | 5d 06 b1 45 db d0 47 50 0a 50 5c 47 b2 2c 59 ff Oct 31 15:24:57.510319: | e4 44 49 53 8c 06 ae de 57 73 0d 90 ba 50 42 fe Oct 31 15:24:57.510321: | 61 86 e0 23 40 7d ec 8c 78 ba f2 c4 81 f3 4a 4f Oct 31 15:24:57.510323: | ab 33 b6 02 19 f6 45 97 04 7f b5 01 b8 12 a1 cc Oct 31 15:24:57.510325: | a4 41 87 50 a4 ba ea 4d 39 96 3f c7 6d 5e 78 00 Oct 31 15:24:57.510327: | 7a e8 6d 68 ca 45 1c 7b 95 c4 ae cb eb b0 86 c0 Oct 31 15:24:57.510329: | ba 82 50 41 2c 92 2a 15 96 c4 d6 c6 27 74 6c 33 Oct 31 15:24:57.510331: | 5c 3b 07 7e 88 0e 9b 68 b8 70 e3 6c 9a d2 5c 8b Oct 31 15:24:57.510333: | 8a f5 ba 1d 10 9d 28 cc 22 22 2b dc e1 27 65 67 Oct 31 15:24:57.510338: | 4f 32 27 7e d9 b8 f1 04 0b 09 e7 c4 a6 86 bc fa Oct 31 15:24:57.510341: | ca 3c 05 e0 8b 96 43 c7 da 5a 36 3b 28 dc 64 bd Oct 31 15:24:57.510343: | 5e c6 61 85 f6 9f 21 ee 7b 28 e5 3c 45 2b 09 b6 Oct 31 15:24:57.510345: | ca ea f6 0a 3d e6 82 0f af 3b 19 92 c6 46 79 91 Oct 31 15:24:57.510347: | 34 b6 c0 6b 1b a6 a7 1d 7a 15 23 14 08 2c 64 b6 Oct 31 15:24:57.510349: | 3a ce a8 38 aa 47 b4 6d 7f d9 e4 f6 df 19 ef 45 Oct 31 15:24:57.510351: | 60 a0 41 a3 79 67 f0 d8 c9 93 ac 46 be ad 89 60 Oct 31 15:24:57.510353: | b5 1f df 65 0a 79 3e d6 15 e8 b8 71 0b 6e 7f 9f Oct 31 15:24:57.510355: | 99 ba db ad 52 94 d8 01 e8 11 02 0a f7 18 43 c5 Oct 31 15:24:57.510357: | 90 91 33 dd 75 ab ab e7 47 09 d0 aa 71 03 ad a7 Oct 31 15:24:57.510359: | 65 c1 7c 9d 97 28 6c 0b ee 0e 4c 83 c3 ca 34 91 Oct 31 15:24:57.510361: | 04 4b d2 4b 21 f4 1b 1e e8 47 1a 96 81 d2 87 07 Oct 31 15:24:57.510363: | 56 f4 6e b5 fe 2e 7c c5 d2 42 3f 21 17 2e 1c 1b Oct 31 15:24:57.510366: | 0f 54 cd f7 ce 37 ce ed 30 d1 3c 94 86 c3 f0 a2 Oct 31 15:24:57.510368: | ab d5 df 7b d2 1b 8c d9 b2 c6 64 4a 7f f9 80 84 Oct 31 15:24:57.510370: | 0d 30 0c 39 5b 76 ce 64 9c 54 ed dd 91 fe 98 51 Oct 31 15:24:57.510375: | **parse ISAKMP Message: Oct 31 15:24:57.510381: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:57.510385: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.510387: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:57.510390: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:57.510393: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:57.510395: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:57.510399: | Message ID: 2 (00 00 00 02) Oct 31 15:24:57.510403: | length: 608 (00 00 02 60) Oct 31 15:24:57.510406: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36) Oct 31 15:24:57.510410: | I am the IKE SA Original Responder receiving an IKEv2 CREATE_CHILD_SA request Oct 31 15:24:57.510415: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:24:57.510422: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:57.510426: | #2 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 Oct 31 15:24:57.510429: | State DB: found IKEv2 state #6 in V2_NEW_CHILD_R0 (find_v2_sa_by_responder_wip) Oct 31 15:24:57.510432: | #6 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:57.510435: "north-eastnets/0x1" #6: discarding packet received during asynchronous work (DNS or crypto) in STATE_V2_NEW_CHILD_R0 Oct 31 15:24:57.510441: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:57.510446: | #2 spent 0.195 (0.195) milliseconds in ikev2_process_packet() Oct 31 15:24:57.510450: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:57.510453: | delref mdp@0x559bbabd5e40(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.510456: | delref logger@0x559bbabcdb50(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.510458: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:57.510461: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:57.510465: | spent 0.215 (0.215) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:57.710730: | spent 0.00226 (0.00225) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:57.710747: | newref struct msg_digest@0x559bbabd5e40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.710751: | newref alloc logger@0x559bbabcdb50(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.710759: | *received 608 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:57.710762: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.710764: | 2e 20 24 08 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:57.710769: | 1f a3 e7 6b f5 b1 a5 39 6b e3 64 59 54 77 3e f7 Oct 31 15:24:57.710771: | 30 a8 e1 61 e7 3f 8b 1d db 22 32 b0 7c 90 e4 8a Oct 31 15:24:57.710773: | 9f ff a8 aa 6c 67 55 b3 68 47 eb 65 be e9 a3 75 Oct 31 15:24:57.710775: | b9 cb d3 4c 4e b8 e5 51 90 57 17 54 86 21 65 c4 Oct 31 15:24:57.710777: | 23 d5 38 05 d9 f1 a3 68 07 ef 4b 8a 83 db 8e 65 Oct 31 15:24:57.710779: | a8 89 5a 5f 59 03 7a b5 8d 27 9d 40 26 74 3d c2 Oct 31 15:24:57.710781: | 12 a2 73 62 04 87 fb ef 4b a0 08 22 b7 ac ac 10 Oct 31 15:24:57.710783: | 61 f4 9b 6e d3 28 b9 84 ac fd ef 0b 8a d0 fa 1a Oct 31 15:24:57.710786: | b5 a0 06 a1 91 78 af 6f 1f e7 63 d5 04 22 17 29 Oct 31 15:24:57.710788: | 60 24 2b 94 6d 86 81 00 64 1a cf 57 92 d1 7a f7 Oct 31 15:24:57.710790: | bc 9d 4a a2 d1 25 7d 7d 22 1a 23 1f d7 5b 6e b0 Oct 31 15:24:57.710792: | 5d 06 b1 45 db d0 47 50 0a 50 5c 47 b2 2c 59 ff Oct 31 15:24:57.710794: | e4 44 49 53 8c 06 ae de 57 73 0d 90 ba 50 42 fe Oct 31 15:24:57.710797: | 61 86 e0 23 40 7d ec 8c 78 ba f2 c4 81 f3 4a 4f Oct 31 15:24:57.710799: | ab 33 b6 02 19 f6 45 97 04 7f b5 01 b8 12 a1 cc Oct 31 15:24:57.710801: | a4 41 87 50 a4 ba ea 4d 39 96 3f c7 6d 5e 78 00 Oct 31 15:24:57.710803: | 7a e8 6d 68 ca 45 1c 7b 95 c4 ae cb eb b0 86 c0 Oct 31 15:24:57.710805: | ba 82 50 41 2c 92 2a 15 96 c4 d6 c6 27 74 6c 33 Oct 31 15:24:57.710807: | 5c 3b 07 7e 88 0e 9b 68 b8 70 e3 6c 9a d2 5c 8b Oct 31 15:24:57.710810: | 8a f5 ba 1d 10 9d 28 cc 22 22 2b dc e1 27 65 67 Oct 31 15:24:57.710812: | 4f 32 27 7e d9 b8 f1 04 0b 09 e7 c4 a6 86 bc fa Oct 31 15:24:57.710814: | ca 3c 05 e0 8b 96 43 c7 da 5a 36 3b 28 dc 64 bd Oct 31 15:24:57.710816: | 5e c6 61 85 f6 9f 21 ee 7b 28 e5 3c 45 2b 09 b6 Oct 31 15:24:57.710818: | ca ea f6 0a 3d e6 82 0f af 3b 19 92 c6 46 79 91 Oct 31 15:24:57.710820: | 34 b6 c0 6b 1b a6 a7 1d 7a 15 23 14 08 2c 64 b6 Oct 31 15:24:57.710822: | 3a ce a8 38 aa 47 b4 6d 7f d9 e4 f6 df 19 ef 45 Oct 31 15:24:57.710824: | 60 a0 41 a3 79 67 f0 d8 c9 93 ac 46 be ad 89 60 Oct 31 15:24:57.710826: | b5 1f df 65 0a 79 3e d6 15 e8 b8 71 0b 6e 7f 9f Oct 31 15:24:57.710829: | 99 ba db ad 52 94 d8 01 e8 11 02 0a f7 18 43 c5 Oct 31 15:24:57.710831: | 90 91 33 dd 75 ab ab e7 47 09 d0 aa 71 03 ad a7 Oct 31 15:24:57.710833: | 65 c1 7c 9d 97 28 6c 0b ee 0e 4c 83 c3 ca 34 91 Oct 31 15:24:57.710836: | 04 4b d2 4b 21 f4 1b 1e e8 47 1a 96 81 d2 87 07 Oct 31 15:24:57.710838: | 56 f4 6e b5 fe 2e 7c c5 d2 42 3f 21 17 2e 1c 1b Oct 31 15:24:57.710840: | 0f 54 cd f7 ce 37 ce ed 30 d1 3c 94 86 c3 f0 a2 Oct 31 15:24:57.710842: | ab d5 df 7b d2 1b 8c d9 b2 c6 64 4a 7f f9 80 84 Oct 31 15:24:57.710844: | 0d 30 0c 39 5b 76 ce 64 9c 54 ed dd 91 fe 98 51 Oct 31 15:24:57.710849: | **parse ISAKMP Message: Oct 31 15:24:57.710854: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:57.710858: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:57.710861: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:57.710864: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:57.710867: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:57.710870: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:57.710874: | Message ID: 2 (00 00 00 02) Oct 31 15:24:57.710878: | length: 608 (00 00 02 60) Oct 31 15:24:57.710881: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36) Oct 31 15:24:57.710885: | I am the IKE SA Original Responder receiving an IKEv2 CREATE_CHILD_SA request Oct 31 15:24:57.710889: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:24:57.710897: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:57.710900: | #2 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 Oct 31 15:24:57.710903: | State DB: found IKEv2 state #6 in V2_NEW_CHILD_R0 (find_v2_sa_by_responder_wip) Oct 31 15:24:57.710908: | #6 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:57.710912: "north-eastnets/0x1" #6: discarding packet received during asynchronous work (DNS or crypto) in STATE_V2_NEW_CHILD_R0 Oct 31 15:24:57.710917: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:57.710923: | #2 spent 0.201 (0.201) milliseconds in ikev2_process_packet() Oct 31 15:24:57.710926: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:57.710929: | delref mdp@0x559bbabd5e40(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.710932: | delref logger@0x559bbabcdb50(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.710935: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:57.710937: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:57.710942: | spent 0.22 (0.22) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:57.954037: | "north-eastnets/0x2" #4: spent 4.7 (1.01e+03) milliseconds in helper 3 processing job 7 for state #4: Child Initiator KE and nonce ni (pcr) Oct 31 15:24:57.954058: | job 7 for #4: Child Initiator KE and nonce ni (build KE and nonce): helper thread 3 sending result back to state Oct 31 15:24:57.954062: | scheduling resume sending helper answer back to state for #4 Oct 31 15:24:57.954066: | libevent_malloc: newref ptr-libevent@0x7f32b40018f0 size 128 Oct 31 15:24:57.954078: | helper thread 3 has nothing to do Oct 31 15:24:57.954098: | processing resume sending helper answer back to state for #4 Oct 31 15:24:57.954113: | start processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:57.954118: | unsuspending #4 MD (nil) Oct 31 15:24:57.954122: | job 7 for #4: Child Initiator KE and nonce ni (build KE and nonce): processing response from helper 3 Oct 31 15:24:57.954125: | job 7 for #4: Child Initiator KE and nonce ni (build KE and nonce): calling continuation function 0x559bb8fe3fe7 Oct 31 15:24:57.954129: | ikev2_child_outI_continue() for #4 STATE_V2_NEW_CHILD_I0 Oct 31 15:24:57.954133: | DH secret MODP3072@0x7f32b4004e80: transferring ownership from helper KE to state #4 Oct 31 15:24:57.954136: | adding CHILD SA #4 to IKE SA #1 message initiator queue Oct 31 15:24:57.954144: | Message ID: CHILD #1.#4 wakeing IKE SA for next initiator (unack 0): ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:57.954147: | scheduling callback v2_msgid_schedule_next_initiator (#1) Oct 31 15:24:57.954150: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:24:57.954157: | [RE]START processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:57.954162: | #4 complete_v2_state_transition() V2_NEW_CHILD_I0->V2_NEW_CHILD_I1 with status STF_SUSPEND Oct 31 15:24:57.954164: | no MD to suspend Oct 31 15:24:57.954168: | delref logger@0x559bbabc4000(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:57.954171: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:57.954174: | delref fd@0x559bbabc6aa0(2->1) (in free_logger() at log.c:854) Oct 31 15:24:57.954177: | resume sending helper answer back to state for #4 suppresed complete_v2_state_transition() Oct 31 15:24:57.954180: | delref mdp@NULL (in resume_handler() at server.c:743) Oct 31 15:24:57.954186: | #4 spent 0.0657 (0.0656) milliseconds in resume sending helper answer back to state Oct 31 15:24:57.954191: | stop processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:57.954195: | libevent_free: delref ptr-libevent@0x7f32b40018f0 Oct 31 15:24:57.954432: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:24:57.954441: | processing callback v2_msgid_schedule_next_initiator for #1 Oct 31 15:24:57.954452: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in callback_handler() at server.c:828) Oct 31 15:24:57.954459: | Message ID: CHILD #1.#4 resuming SA using IKE SA (unack 0): ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:57.954465: | suspend processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in initiate_next() at ikev2_msgid.c:675) Oct 31 15:24:57.954478: | start processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in initiate_next() at ikev2_msgid.c:675) Oct 31 15:24:57.954482: | unsuspending #4 MD (nil) Oct 31 15:24:57.954488: | opening output PBS reply packet Oct 31 15:24:57.954491: | **emit ISAKMP Message: Oct 31 15:24:57.954496: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:24:57.954500: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:57.954503: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:24:57.954506: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:57.954509: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:57.954512: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:57.954516: | Message ID: 2 (00 00 00 02) Oct 31 15:24:57.954520: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:24:57.954524: | ***emit IKEv2 Encryption Payload: Oct 31 15:24:57.954526: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.954529: | flags: none (0x0) Oct 31 15:24:57.954532: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:24:57.954534: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.954538: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:24:57.954561: | netlink_get_spi: allocated 0x8a51674e for esp.0@192.1.3.33 Oct 31 15:24:57.954566: | Emitting ikev2_proposals ... Oct 31 15:24:57.954568: | ****emit IKEv2 Security Association Payload: Oct 31 15:24:57.954571: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.954573: | flags: none (0x0) Oct 31 15:24:57.954576: | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) Oct 31 15:24:57.954579: | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.954583: | *****emit IKEv2 Proposal Substructure Payload: Oct 31 15:24:57.954586: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:57.954590: | prop #: 1 (01) Oct 31 15:24:57.954592: | proto ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:24:57.954595: | spi size: 4 (04) Oct 31 15:24:57.954598: | # transforms: 4 (04) Oct 31 15:24:57.954601: | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' Oct 31 15:24:57.954604: | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload Oct 31 15:24:57.954607: | our spi: 8a 51 67 4e Oct 31 15:24:57.954610: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:57.954613: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.954615: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:57.954618: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:57.954621: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:57.954624: | *******emit IKEv2 Attribute Substructure Payload: Oct 31 15:24:57.954627: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:57.954630: | length/value: 128 (00 80) Oct 31 15:24:57.954633: | emitting length of IKEv2 Transform Substructure Payload: 12 Oct 31 15:24:57.954636: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:57.954640: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.954643: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:57.954645: | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) Oct 31 15:24:57.954648: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.954651: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:57.954653: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:57.954656: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:57.954659: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.954661: | IKEv2 transform type: TRANS_TYPE_DH (0x4) Oct 31 15:24:57.954663: | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) Oct 31 15:24:57.954666: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.954668: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:57.954671: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:57.954673: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:57.954676: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:57.954678: | IKEv2 transform type: TRANS_TYPE_ESN (0x5) Oct 31 15:24:57.954680: | IKEv2 transform ID: ESN_DISABLED (0x0) Oct 31 15:24:57.954683: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.954685: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:57.954688: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:57.954690: | emitting length of IKEv2 Proposal Substructure Payload: 48 Oct 31 15:24:57.954692: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 Oct 31 15:24:57.954695: | emitting length of IKEv2 Security Association Payload: 52 Oct 31 15:24:57.954698: | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 Oct 31 15:24:57.954700: | ****emit IKEv2 Nonce Payload: Oct 31 15:24:57.954702: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.954705: | flags: none (0x0) Oct 31 15:24:57.954708: | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) Oct 31 15:24:57.954710: | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.954713: | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload Oct 31 15:24:57.954715: | IKEv2 nonce: Oct 31 15:24:57.954718: | 54 d2 a0 7d b7 36 22 14 5c 5b 07 6c 51 fd 36 7b Oct 31 15:24:57.954720: | b6 f1 e6 f2 cb b0 96 f4 75 4c 9e aa 91 86 a8 f9 Oct 31 15:24:57.954722: | emitting length of IKEv2 Nonce Payload: 36 Oct 31 15:24:57.954725: | ****emit IKEv2 Key Exchange Payload: Oct 31 15:24:57.954727: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.954730: | flags: none (0x0) Oct 31 15:24:57.954733: | DH group: OAKLEY_GROUP_MODP3072 (0xf) Oct 31 15:24:57.954735: | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) Oct 31 15:24:57.954738: | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.954741: | emitting 384 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload Oct 31 15:24:57.954745: | ikev2 g^x: Oct 31 15:24:57.954747: | b8 e1 35 6f 97 0c d2 64 bc ee ac 72 84 49 c6 74 Oct 31 15:24:57.954749: | 32 fd a4 98 f8 82 58 85 f8 09 5b 2b 59 99 8f 27 Oct 31 15:24:57.954751: | c4 e9 4f 2d b7 56 a4 bb a7 ff 2c ac f0 8a 31 3b Oct 31 15:24:57.954754: | 63 34 d7 77 bd 95 e7 c3 f9 4e 2b 89 19 06 17 b0 Oct 31 15:24:57.954756: | 5d 35 e2 00 6b a4 3f 8a ef a7 16 5f 75 ff d9 ea Oct 31 15:24:57.954758: | 3f 19 72 95 af c4 ce 3b 3a 14 28 aa 9e 04 ed d0 Oct 31 15:24:57.954760: | 1f 0e 00 d9 99 c2 75 66 cb ac 21 61 f1 10 23 85 Oct 31 15:24:57.954762: | 05 46 07 25 86 0f b1 44 f1 c8 3d b5 68 d1 cd 71 Oct 31 15:24:57.954764: | 21 52 95 23 33 b8 01 6a 62 2c 97 08 02 49 e9 2a Oct 31 15:24:57.954767: | 14 74 59 93 0c 8d 2f 3a 9c 59 ff fd 9f e4 d3 a3 Oct 31 15:24:57.954769: | e7 76 73 bc 26 ff f3 7b 5b 27 1a f5 38 ef 21 56 Oct 31 15:24:57.954771: | d6 b1 0a 4b cf 58 0b 9a 47 49 97 56 8e d6 0c f2 Oct 31 15:24:57.954773: | cb ce 91 a5 08 92 6f 3b 73 47 f7 19 f7 84 23 ae Oct 31 15:24:57.954775: | 52 c2 50 ad 2d b6 ef 88 e3 1a 86 de 2e 71 59 41 Oct 31 15:24:57.954777: | 1a b5 37 03 00 be ce 7f 96 6a 5e e0 a1 ef 16 22 Oct 31 15:24:57.954780: | 02 cd 6d e2 17 7f f4 46 00 7c 3e 1e 03 cd 28 54 Oct 31 15:24:57.954782: | 27 df 79 a8 14 2b 94 26 35 2b a3 60 5a ef 59 3d Oct 31 15:24:57.954784: | 66 34 af fc 07 9a 59 da c4 08 d3 15 2b 1b 58 ce Oct 31 15:24:57.954786: | 05 cc f8 42 04 51 90 8e 79 6d 6d d4 8f 65 ce 3c Oct 31 15:24:57.954788: | bd d0 60 f2 bc 3d 62 52 c9 f4 fe c1 59 39 ee 7e Oct 31 15:24:57.954790: | 3d 78 94 1f 0f 3f 9c ac 0c d0 e4 f0 e7 2e 9b 64 Oct 31 15:24:57.954792: | 93 b4 b3 8a 50 85 31 e9 f7 40 4a 52 57 89 d1 22 Oct 31 15:24:57.954794: | b0 9a 87 dc 42 2e 55 c3 c3 a9 4d 2f 92 93 dc 11 Oct 31 15:24:57.954796: | a3 34 08 6a 30 e5 3b 4f da 24 b4 a0 7a 62 ba b4 Oct 31 15:24:57.954799: | emitting length of IKEv2 Key Exchange Payload: 392 Oct 31 15:24:57.954804: | ****emit IKEv2 Traffic Selector - Initiator - Payload: Oct 31 15:24:57.954806: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.954809: | flags: none (0x0) Oct 31 15:24:57.954812: | number of TS: 1 (01) Oct 31 15:24:57.954814: | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) Oct 31 15:24:57.954817: | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.954820: | *****emit IKEv2 Traffic Selector: Oct 31 15:24:57.954822: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:57.954824: | IP Protocol ID: ALL (0x0) Oct 31 15:24:57.954827: | start port: 0 (00 00) Oct 31 15:24:57.954830: | end port: 65535 (ff ff) Oct 31 15:24:57.954834: | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector Oct 31 15:24:57.954837: | IP start: c0 00 03 00 Oct 31 15:24:57.954840: | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector Oct 31 15:24:57.954843: | IP end: c0 00 03 ff Oct 31 15:24:57.954846: | emitting length of IKEv2 Traffic Selector: 16 Oct 31 15:24:57.954848: | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 Oct 31 15:24:57.954851: | ****emit IKEv2 Traffic Selector - Responder - Payload: Oct 31 15:24:57.954853: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.954855: | flags: none (0x0) Oct 31 15:24:57.954858: | number of TS: 1 (01) Oct 31 15:24:57.954861: | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) Oct 31 15:24:57.954863: | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:57.954866: | *****emit IKEv2 Traffic Selector: Oct 31 15:24:57.954868: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:57.954872: | IP Protocol ID: ALL (0x0) Oct 31 15:24:57.954876: | start port: 0 (00 00) Oct 31 15:24:57.954879: | end port: 65535 (ff ff) Oct 31 15:24:57.954882: | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector Oct 31 15:24:57.954885: | IP start: c0 00 16 00 Oct 31 15:24:57.954887: | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector Oct 31 15:24:57.954890: | IP end: c0 00 16 ff Oct 31 15:24:57.954893: | emitting length of IKEv2 Traffic Selector: 16 Oct 31 15:24:57.954895: | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 Oct 31 15:24:57.954897: | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE Oct 31 15:24:57.954900: | adding 16 bytes of padding (including 1 byte padding-length) Oct 31 15:24:57.954903: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954906: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954908: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954911: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954914: | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954916: | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954918: | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954921: | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954923: | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954926: | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954928: | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954930: | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954933: | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954935: | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954938: | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954940: | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:57.954943: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:24:57.954946: | emitting length of IKEv2 Encryption Payload: 580 Oct 31 15:24:57.954949: | emitting length of ISAKMP Message: 608 Oct 31 15:24:57.955007: | [RE]START processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:57.955013: | #4 complete_v2_state_transition() V2_NEW_CHILD_I0->V2_NEW_CHILD_I1 with status STF_OK Oct 31 15:24:57.955016: | transitioning from state STATE_V2_NEW_CHILD_I0 to state STATE_V2_NEW_CHILD_I1 Oct 31 15:24:57.955019: | Message ID: updating counters for #4 Oct 31 15:24:57.955022: | Message ID: IKE #1 skipping update_recv as MD is fake Oct 31 15:24:57.955028: | Message ID: CHILD #1.#4 scheduling EVENT_RETRANSMIT: ike.initiator.sent=2 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=2 child.wip.responder=-1 Oct 31 15:24:57.955032: | event_schedule: newref EVENT_RETRANSMIT-pe@0x559bbabd0d80 Oct 31 15:24:57.955035: | inserting event EVENT_RETRANSMIT, timeout in 0.05 seconds for #4 Oct 31 15:24:57.955038: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:24:57.955042: | #4 STATE_V2_NEW_CHILD_I0: retransmits: first event in 0.05 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744572.387827 Oct 31 15:24:57.955049: | Message ID: CHILD #1.#4 updating initiator sent message request 2: ike.initiator.sent=1->2 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1->2 child.wip.responder=-1 Oct 31 15:24:57.955058: | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=2 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:57.955062: | child state #4: V2_NEW_CHILD_I0(established IKE SA) => V2_NEW_CHILD_I1(established IKE SA) Oct 31 15:24:57.955064: | announcing the state transition Oct 31 15:24:57.955068: "north-eastnets/0x2" #4: sent CREATE_CHILD_SA request for new IPsec SA Oct 31 15:24:57.955086: | sending 608 bytes for STATE_V2_NEW_CHILD_I0 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #1) Oct 31 15:24:57.955090: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:57.955092: | 2e 20 24 08 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:57.955094: | 4e 60 d7 06 01 7b ea 5d 2f 3c 19 39 d8 5e 5b 41 Oct 31 15:24:57.955097: | 8f 9b 04 10 51 84 3d 7d 82 9e 48 6b e1 19 ee e6 Oct 31 15:24:57.955099: | 52 75 e5 06 f5 77 c8 00 6b 79 22 7f c2 80 04 ec Oct 31 15:24:57.955101: | dd 5f e8 e2 a4 29 e9 6c 49 e9 0e 3c 77 b0 b8 fe Oct 31 15:24:57.955103: | db 3f 3a 9f 25 d6 d3 9f 9e 0c 92 69 df 8c 5f b6 Oct 31 15:24:57.955105: | 58 9c 1c de f7 e0 53 4b 16 e0 7b b4 9c 21 60 0d Oct 31 15:24:57.955107: | 3e 69 ad 66 cf f8 32 fc 9a cc fe 06 78 7e 20 e6 Oct 31 15:24:57.955109: | 52 ea 0f 54 c7 d2 06 81 8f 1d cc a3 1d c8 d6 79 Oct 31 15:24:57.955111: | 23 5c 8e 63 b9 0b ce 5b 41 d6 1d dd 1a a7 89 84 Oct 31 15:24:57.955113: | f0 8b 5b 6d c1 b2 8e 55 96 51 c3 79 3b 52 17 93 Oct 31 15:24:57.955115: | db ba 0a b5 a1 b5 84 68 89 22 7c 82 f4 02 0f ba Oct 31 15:24:57.955117: | 8d ae b0 17 b3 48 48 94 d6 cc 07 7d 47 32 09 2d Oct 31 15:24:57.955120: | ef 43 b3 43 d5 98 25 7d a6 8a b8 38 f4 93 1e aa Oct 31 15:24:57.955122: | e9 ce ff 9d 2c 15 bb 9a c8 f7 b3 b5 49 7c b7 a7 Oct 31 15:24:57.955124: | 28 8d 21 6c 41 45 27 9c 1f 9b e9 81 6d 53 04 05 Oct 31 15:24:57.955126: | 74 db bb 62 43 c9 7d f3 f1 77 67 46 e5 da af d8 Oct 31 15:24:57.955128: | ad 2a 3b b1 b7 bf 9a 43 63 bd f7 0b e3 fd c1 af Oct 31 15:24:57.955130: | 41 7b d8 9f 0a a8 64 11 d8 88 1e 85 20 6e 74 ff Oct 31 15:24:57.955132: | eb c3 47 b0 53 51 a7 91 87 a1 48 d1 4b 07 a4 e7 Oct 31 15:24:57.955134: | 4e 87 d0 d1 46 ee d1 aa 03 c7 bf 94 7d 38 eb cd Oct 31 15:24:57.955136: | 93 ad 5a 23 c8 b1 f1 05 de a2 39 92 bc e6 7b 22 Oct 31 15:24:57.955138: | 8b 1f 64 80 18 05 85 be 7d 80 0d e7 b3 6f 6b a3 Oct 31 15:24:57.955140: | 97 d4 f2 b4 b0 55 9a 06 6b 0c d6 e7 6a 8f 64 36 Oct 31 15:24:57.955141: | 60 fc 75 af 7b f5 81 94 f3 0b a2 af 6c 12 68 38 Oct 31 15:24:57.955143: | 10 47 2a 08 55 ce d5 7d e6 59 87 0c 07 e1 df f6 Oct 31 15:24:57.955145: | 2f 1b 76 0d 8d 15 a5 ee 6f 23 dd 11 1c 0b 34 79 Oct 31 15:24:57.955146: | 0b 5a 7c 86 65 e5 3e dc a4 0f ad f4 d8 a1 e5 35 Oct 31 15:24:57.955148: | 97 b6 f2 b8 29 94 86 9b e7 af 09 d3 f8 bc 4a 6c Oct 31 15:24:57.955150: | 1e 66 33 70 e0 a8 d6 3d a9 25 72 f9 a2 b7 5d 35 Oct 31 15:24:57.955151: | c5 a1 9a 4c d3 2e 3e c5 b8 46 ce da 30 e6 c8 6c Oct 31 15:24:57.955153: | 97 d2 8b 53 c3 04 f6 b5 75 8e 69 f5 5b 5f 59 be Oct 31 15:24:57.955155: | d9 53 25 a0 5b ca d0 94 40 65 ed a9 00 e2 a4 25 Oct 31 15:24:57.955157: | 9a f8 26 cb a6 e9 36 46 e7 05 35 a2 3e b2 f1 45 Oct 31 15:24:57.955159: | 1c a0 48 87 df 71 62 79 f8 36 9b 55 95 96 53 90 Oct 31 15:24:57.955161: | 5d 40 4f ed f0 23 35 7a 33 96 1e e3 87 49 31 7b Oct 31 15:24:57.955163: | 6e 57 f7 30 3e 43 ee cb f5 ef 76 45 8e bd 4a b1 Oct 31 15:24:57.955187: | sent 1 messages Oct 31 15:24:57.955191: | checking that a retransmit timeout_event was already Oct 31 15:24:57.955195: | state #4 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:57.955202: | libevent_free: delref ptr-libevent@0x7f32b8010fa0 Oct 31 15:24:57.955208: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabcdb10 Oct 31 15:24:57.955210: | delref mdp@NULL (in initiate_next() at ikev2_msgid.c:705) Oct 31 15:24:57.955215: | stop processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in initiate_next() at ikev2_msgid.c:707) Oct 31 15:24:57.955220: | resume processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in initiate_next() at ikev2_msgid.c:707) Oct 31 15:24:57.955224: | stop processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in callback_handler() at server.c:832) Oct 31 15:24:57.955229: | spent 0.75 (0.778) milliseconds in callback v2_msgid_schedule_next_initiator Oct 31 15:24:57.964724: | spent 0.00229 (0.0023) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:57.964739: | newref struct msg_digest@0x559bbabd5e40(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.964742: | newref alloc logger@0x559bbabc4000(0->1) (in read_message() at demux.c:103) Oct 31 15:24:57.964746: | *received 608 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:57.964748: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:57.964749: | 2e 20 24 20 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:57.964751: | 89 d8 e0 83 aa 28 dd e8 35 59 00 26 e4 5d 2b d4 Oct 31 15:24:57.964752: | 72 b5 18 77 00 3f 7c 1c e8 33 66 a9 70 b9 b9 4e Oct 31 15:24:57.964753: | e2 96 69 f6 e9 c5 ee 77 da 7b 66 e5 f1 29 a6 0d Oct 31 15:24:57.964755: | d6 12 fd bf 9a 9e a1 74 28 fc 93 fd d7 96 6f 2f Oct 31 15:24:57.964756: | 48 49 4c 46 7d 34 ce c1 64 39 b5 3b df dc 2f 93 Oct 31 15:24:57.964758: | b4 b9 93 85 0b 50 97 af 57 b9 5f 72 db c9 9e 15 Oct 31 15:24:57.964759: | 20 b0 2a 20 ba f9 94 8e a3 98 8b c6 2e 29 64 19 Oct 31 15:24:57.964760: | 12 25 d9 31 c1 94 fd 6b 50 cd b4 5c 4c 46 14 76 Oct 31 15:24:57.964762: | ee e7 df 1e d3 b7 08 a9 f3 87 7c 48 d5 c7 2d 24 Oct 31 15:24:57.964763: | 07 65 3a 50 67 2d f4 4b 23 38 b7 fc 4a 9c 25 a0 Oct 31 15:24:57.964764: | 4e 93 84 4a ae a7 55 d2 0e bf 7a f4 b6 4e 7a 0a Oct 31 15:24:57.964766: | 57 94 ab 72 95 2c 8d 40 b6 81 a6 db b9 18 72 19 Oct 31 15:24:57.964767: | 52 5a bf 5f ff f9 d9 f7 dc 21 84 ce 84 22 9a 44 Oct 31 15:24:57.964768: | cc b8 ca 9a 9a f2 a8 43 94 81 0f 16 c3 ce ce 7d Oct 31 15:24:57.964770: | ac 50 e3 82 23 bd dd 20 5e c2 f1 7c 4e ae 79 63 Oct 31 15:24:57.964771: | 88 ea d0 ca 87 57 7a 7f 46 16 24 93 2f 1f 3b e5 Oct 31 15:24:57.964772: | 68 d4 ff db 6d 4a 2e 14 31 ae 1b 09 42 6c 96 65 Oct 31 15:24:57.964774: | 86 05 05 dc 4d 7f ad 21 da c3 83 55 be 6e e2 19 Oct 31 15:24:57.964775: | 3f 8c 3c e1 83 85 01 24 ba 35 5c ed 3e 2b 02 a9 Oct 31 15:24:57.964776: | 25 9d 3a 5a 87 d6 1c 19 d4 1b 6b 97 cc 2c 1f 58 Oct 31 15:24:57.964778: | 86 ac b7 a2 e3 99 07 9d ed a1 f8 8c a4 c8 a1 85 Oct 31 15:24:57.964779: | 78 80 9c 56 5e 90 4b 6f e2 86 83 d2 f2 44 bd 86 Oct 31 15:24:57.964780: | 78 48 d8 bd 02 82 ba 17 2f 54 14 b3 01 86 b6 dd Oct 31 15:24:57.964790: | 5f de 0a ef 15 a6 0b d8 7b a0 1d 5a 03 b2 2c 89 Oct 31 15:24:57.964794: | 8d b7 d1 e3 ce 5f 24 22 45 f6 0c ef d0 c2 01 90 Oct 31 15:24:57.964796: | 1e a7 17 c8 5a ec 70 70 00 28 be ed ff fd d7 d1 Oct 31 15:24:57.964799: | 09 42 87 b7 64 e3 93 53 98 b7 fb 2e bb 31 7e 51 Oct 31 15:24:57.964801: | 24 61 91 61 44 d0 50 88 a5 89 0a 72 bc 15 0d b3 Oct 31 15:24:57.964803: | ac 94 d5 66 b9 65 66 88 de f0 8b 09 e6 72 35 65 Oct 31 15:24:57.964806: | e9 52 e4 55 ff 3d 56 ff 0a c0 65 22 9a f8 78 54 Oct 31 15:24:57.964808: | e3 76 be 9e 7d 33 8a 66 5f ad 07 c8 90 69 b8 e2 Oct 31 15:24:57.964810: | e0 82 0b 9c c9 d8 43 46 41 1e 88 4d 3c 93 f7 85 Oct 31 15:24:57.964812: | 6e 4a d9 5c 19 2a be e3 fc 32 23 eb bc eb ad e2 Oct 31 15:24:57.964815: | 2b 19 6c b8 49 f5 3e 83 ec e8 ac 99 a9 7a db d4 Oct 31 15:24:57.964820: | 24 06 76 90 9c a8 80 0a 62 0d 58 30 06 b2 90 11 Oct 31 15:24:57.964822: | 9b 6a 82 13 ed 0e 97 50 93 e6 01 40 e1 1c 7e e7 Oct 31 15:24:57.964827: | **parse ISAKMP Message: Oct 31 15:24:57.964832: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:24:57.964836: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:24:57.964838: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:57.964840: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:57.964842: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:57.964843: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:24:57.964846: | Message ID: 2 (00 00 00 02) Oct 31 15:24:57.964848: | length: 608 (00 00 02 60) Oct 31 15:24:57.964850: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36) Oct 31 15:24:57.964853: | I am the IKE SA Original Initiator receiving an IKEv2 CREATE_CHILD_SA response Oct 31 15:24:57.964908: | State DB: found IKEv2 state #1 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:24:57.964917: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:57.964920: | State DB: found IKEv2 state #4 in V2_NEW_CHILD_I1 (find_v2_sa_by_initiator_wip) Oct 31 15:24:57.964922: | #4 is idle Oct 31 15:24:57.964924: | #4 idle Oct 31 15:24:57.964927: | suspend processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:24:57.964930: | start processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:24:57.964932: | unpacking clear payload Oct 31 15:24:57.964934: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:24:57.964936: | ***parse IKEv2 Encryption Payload: Oct 31 15:24:57.964938: | next payload type: ISAKMP_NEXT_v2SA (0x21) Oct 31 15:24:57.964940: | flags: none (0x0) Oct 31 15:24:57.964942: | length: 580 (02 44) Oct 31 15:24:57.964944: | processing payload: ISAKMP_NEXT_v2SK (len=576) Oct 31 15:24:57.964946: | #4 in state V2_NEW_CHILD_I1: sent CREATE_CHILD_SA request for new IPsec SA Oct 31 15:24:57.964971: | authenticator matched Oct 31 15:24:57.964978: | #1 ikev2 ISAKMP_v2_CREATE_CHILD_SA decrypt success Oct 31 15:24:57.964980: | Now let's proceed with payload (ISAKMP_NEXT_v2SA) Oct 31 15:24:57.964982: | **parse IKEv2 Security Association Payload: Oct 31 15:24:57.964984: | next payload type: ISAKMP_NEXT_v2Ni (0x28) Oct 31 15:24:57.964989: | flags: none (0x0) Oct 31 15:24:57.964994: | length: 52 (00 34) Oct 31 15:24:57.964996: | processing payload: ISAKMP_NEXT_v2SA (len=48) Oct 31 15:24:57.964999: | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) Oct 31 15:24:57.965002: | **parse IKEv2 Nonce Payload: Oct 31 15:24:57.965004: | next payload type: ISAKMP_NEXT_v2KE (0x22) Oct 31 15:24:57.965007: | flags: none (0x0) Oct 31 15:24:57.965010: | length: 36 (00 24) Oct 31 15:24:57.965013: | processing payload: ISAKMP_NEXT_v2Ni (len=32) Oct 31 15:24:57.965015: | Now let's proceed with payload (ISAKMP_NEXT_v2KE) Oct 31 15:24:57.965019: | **parse IKEv2 Key Exchange Payload: Oct 31 15:24:57.965021: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) Oct 31 15:24:57.965024: | flags: none (0x0) Oct 31 15:24:57.965028: | length: 392 (01 88) Oct 31 15:24:57.965030: | DH group: OAKLEY_GROUP_MODP3072 (0xf) Oct 31 15:24:57.965033: | processing payload: ISAKMP_NEXT_v2KE (len=384) Oct 31 15:24:57.965035: | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) Oct 31 15:24:57.965036: | **parse IKEv2 Traffic Selector - Initiator - Payload: Oct 31 15:24:57.965038: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) Oct 31 15:24:57.965039: | flags: none (0x0) Oct 31 15:24:57.965041: | length: 24 (00 18) Oct 31 15:24:57.965043: | number of TS: 1 (01) Oct 31 15:24:57.965045: | processing payload: ISAKMP_NEXT_v2TSi (len=16) Oct 31 15:24:57.965046: | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) Oct 31 15:24:57.965050: | **parse IKEv2 Traffic Selector - Responder - Payload: Oct 31 15:24:57.965051: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:57.965053: | flags: none (0x0) Oct 31 15:24:57.965054: | length: 24 (00 18) Oct 31 15:24:57.965056: | number of TS: 1 (01) Oct 31 15:24:57.965061: | processing payload: ISAKMP_NEXT_v2TSr (len=16) Oct 31 15:24:57.965065: | selected state microcode Process CREATE_CHILD_SA IPsec SA Response Oct 31 15:24:57.965072: | #1 updating local interface from 192.1.3.33:500 to 192.1.3.33:500 using md->iface (in update_ike_endpoints() at state.c:2631) Oct 31 15:24:57.965075: | forcing ST #4 to CHILD #1.#4 in FSM processor Oct 31 15:24:57.965077: | calling processor Process CREATE_CHILD_SA IPsec SA Response Oct 31 15:24:57.965086: | using existing local ESP/AH proposals for north-eastnets/0x2 (CREATE_CHILD_SA initiator accepting remote ESP/AH proposal): 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED Oct 31 15:24:57.965090: | comparing remote proposals against CREATE_CHILD_SA initiator accepting remote ESP/AH proposal 1 local proposals Oct 31 15:24:57.965094: | local proposal 1 type ENCR has 1 transforms Oct 31 15:24:57.965097: | local proposal 1 type PRF has 0 transforms Oct 31 15:24:57.965100: | local proposal 1 type INTEG has 1 transforms Oct 31 15:24:57.965102: | local proposal 1 type DH has 1 transforms Oct 31 15:24:57.965105: | local proposal 1 type ESN has 1 transforms Oct 31 15:24:57.965108: | local proposal 1 transforms: required: ENCR+INTEG+DH+ESN; optional: none Oct 31 15:24:57.965111: | ***parse IKEv2 Proposal Substructure Payload: Oct 31 15:24:57.965112: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:57.965114: | length: 48 (00 30) Oct 31 15:24:57.965116: | prop #: 1 (01) Oct 31 15:24:57.965118: | proto ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:24:57.965120: | spi size: 4 (04) Oct 31 15:24:57.965121: | # transforms: 4 (04) Oct 31 15:24:57.965123: | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI Oct 31 15:24:57.965125: | remote SPI Oct 31 15:24:57.965127: | 98 b3 bf 89 Oct 31 15:24:57.965132: | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals Oct 31 15:24:57.965136: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.965139: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.965142: | length: 12 (00 0c) Oct 31 15:24:57.965145: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:57.965147: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:57.965150: | *****parse IKEv2 Attribute Substructure Payload: Oct 31 15:24:57.965153: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:57.965157: | length/value: 128 (00 80) Oct 31 15:24:57.965162: | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 Oct 31 15:24:57.965165: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.965168: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.965171: | length: 8 (00 08) Oct 31 15:24:57.965174: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:57.965176: | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) Oct 31 15:24:57.965178: | remote proposal 1 transform 1 (INTEG=HMAC_SHA2_512_256) matches local proposal 1 type 3 (INTEG) transform 0 Oct 31 15:24:57.965180: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.965181: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:57.965183: | length: 8 (00 08) Oct 31 15:24:57.965185: | IKEv2 transform type: TRANS_TYPE_DH (0x4) Oct 31 15:24:57.965186: | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) Oct 31 15:24:57.965188: | remote proposal 1 transform 2 (DH=MODP3072) matches local proposal 1 type 4 (DH) transform 0 Oct 31 15:24:57.965190: | ****parse IKEv2 Transform Substructure Payload: Oct 31 15:24:57.965192: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:57.965193: | length: 8 (00 08) Oct 31 15:24:57.965195: | IKEv2 transform type: TRANS_TYPE_ESN (0x5) Oct 31 15:24:57.965202: | IKEv2 transform ID: ESN_DISABLED (0x0) Oct 31 15:24:57.965208: | remote proposal 1 transform 3 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 Oct 31 15:24:57.965212: | remote proposal 1 proposed transforms: ENCR+INTEG+DH+ESN; matched: ENCR+INTEG+DH+ESN; unmatched: none Oct 31 15:24:57.965219: | comparing remote proposal 1 containing ENCR+INTEG+DH+ESN transforms to local proposal 1; required: ENCR+INTEG+DH+ESN; optional: none; matched: ENCR+INTEG+DH+ESN Oct 31 15:24:57.965223: | remote proposal 1 matches local proposal 1 Oct 31 15:24:57.965226: | remote accepted the proposal 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA2_512_256;DH=MODP3072;ESN=DISABLED[first-match] Oct 31 15:24:57.965231: | CREATE_CHILD_SA initiator accepting remote ESP/AH proposal ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED SPI=98b3bf89 Oct 31 15:24:57.965233: | converting proposal to internal trans attrs Oct 31 15:24:57.965238: | updating #4's .st_oakley with preserved PRF, but why update? Oct 31 15:24:57.965242: | DH secret MODP3072@0x7f32b4004e80: transferring ownership from state #4 to helper DH Oct 31 15:24:57.965247: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:57.965250: | addref fd@0x559bbabc6aa0(1->2) (in clone_logger() at log.c:810) Oct 31 15:24:57.965253: | newref clone logger@0x559bbabcdb50(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:57.965256: | job 9 for #4: ikev2 Child SA initiator pfs=yes (dh): adding job to queue Oct 31 15:24:57.965258: | state #4 has no .st_event to delete Oct 31 15:24:57.965261: | #4 requesting EVENT_RETRANSMIT-pe@0x559bbabd0d80 be deleted Oct 31 15:24:57.965265: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:24:57.965268: | free_event_entry: delref EVENT_RETRANSMIT-pe@0x559bbabd0d80 Oct 31 15:24:57.965270: | #4 STATE_V2_NEW_CHILD_I1: retransmits: cleared Oct 31 15:24:57.965273: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabd0d80 Oct 31 15:24:57.965276: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #4 Oct 31 15:24:57.965279: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:24:57.965291: | #4 spent 0.206 (0.209) milliseconds in processing: Process CREATE_CHILD_SA IPsec SA Response in v2_dispatch() Oct 31 15:24:57.965297: | [RE]START processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:57.965301: | #4 complete_v2_state_transition() V2_NEW_CHILD_I1->ESTABLISHED_CHILD_SA with status STF_SUSPEND; .st_v2_transition=V2_NEW_CHILD_I0->V2_NEW_CHILD_I1 Oct 31 15:24:57.965304: | suspending state #4 and saving MD 0x559bbabd5e40 Oct 31 15:24:57.965307: | addref md@0x559bbabd5e40(1->2) (in complete_v2_state_transition() at ikev2.c:3485) Oct 31 15:24:57.965309: | #4 is busy; has suspended MD 0x559bbabd5e40 Oct 31 15:24:57.965314: | stop processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:57.965319: | #1 spent 0.552 (0.6) milliseconds in ikev2_process_packet() Oct 31 15:24:57.965321: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:57.965324: | delref mdp@0x559bbabd5e40(2->1) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:57.965328: | spent 0.562 (0.61) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:57.965341: | job 9 for #4: ikev2 Child SA initiator pfs=yes (dh): helper 7 starting job Oct 31 15:24:57.965344: | helper 7 is pausing for 1 seconds Oct 31 15:24:58.114111: | spent 0.0026 (0.00255) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:58.114129: | newref struct msg_digest@0x559bbabd7620(0->1) (in read_message() at demux.c:103) Oct 31 15:24:58.114133: | newref alloc logger@0x559bbabb3560(0->1) (in read_message() at demux.c:103) Oct 31 15:24:58.114139: | *received 608 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:58.114141: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:58.114146: | 2e 20 24 08 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:58.114150: | 1f a3 e7 6b f5 b1 a5 39 6b e3 64 59 54 77 3e f7 Oct 31 15:24:58.114153: | 30 a8 e1 61 e7 3f 8b 1d db 22 32 b0 7c 90 e4 8a Oct 31 15:24:58.114155: | 9f ff a8 aa 6c 67 55 b3 68 47 eb 65 be e9 a3 75 Oct 31 15:24:58.114158: | b9 cb d3 4c 4e b8 e5 51 90 57 17 54 86 21 65 c4 Oct 31 15:24:58.114160: | 23 d5 38 05 d9 f1 a3 68 07 ef 4b 8a 83 db 8e 65 Oct 31 15:24:58.114163: | a8 89 5a 5f 59 03 7a b5 8d 27 9d 40 26 74 3d c2 Oct 31 15:24:58.114165: | 12 a2 73 62 04 87 fb ef 4b a0 08 22 b7 ac ac 10 Oct 31 15:24:58.114167: | 61 f4 9b 6e d3 28 b9 84 ac fd ef 0b 8a d0 fa 1a Oct 31 15:24:58.114170: | b5 a0 06 a1 91 78 af 6f 1f e7 63 d5 04 22 17 29 Oct 31 15:24:58.114172: | 60 24 2b 94 6d 86 81 00 64 1a cf 57 92 d1 7a f7 Oct 31 15:24:58.114175: | bc 9d 4a a2 d1 25 7d 7d 22 1a 23 1f d7 5b 6e b0 Oct 31 15:24:58.114177: | 5d 06 b1 45 db d0 47 50 0a 50 5c 47 b2 2c 59 ff Oct 31 15:24:58.114180: | e4 44 49 53 8c 06 ae de 57 73 0d 90 ba 50 42 fe Oct 31 15:24:58.114182: | 61 86 e0 23 40 7d ec 8c 78 ba f2 c4 81 f3 4a 4f Oct 31 15:24:58.114185: | ab 33 b6 02 19 f6 45 97 04 7f b5 01 b8 12 a1 cc Oct 31 15:24:58.114187: | a4 41 87 50 a4 ba ea 4d 39 96 3f c7 6d 5e 78 00 Oct 31 15:24:58.114190: | 7a e8 6d 68 ca 45 1c 7b 95 c4 ae cb eb b0 86 c0 Oct 31 15:24:58.114192: | ba 82 50 41 2c 92 2a 15 96 c4 d6 c6 27 74 6c 33 Oct 31 15:24:58.114193: | 5c 3b 07 7e 88 0e 9b 68 b8 70 e3 6c 9a d2 5c 8b Oct 31 15:24:58.114194: | 8a f5 ba 1d 10 9d 28 cc 22 22 2b dc e1 27 65 67 Oct 31 15:24:58.114196: | 4f 32 27 7e d9 b8 f1 04 0b 09 e7 c4 a6 86 bc fa Oct 31 15:24:58.114197: | ca 3c 05 e0 8b 96 43 c7 da 5a 36 3b 28 dc 64 bd Oct 31 15:24:58.114204: | 5e c6 61 85 f6 9f 21 ee 7b 28 e5 3c 45 2b 09 b6 Oct 31 15:24:58.114210: | ca ea f6 0a 3d e6 82 0f af 3b 19 92 c6 46 79 91 Oct 31 15:24:58.114212: | 34 b6 c0 6b 1b a6 a7 1d 7a 15 23 14 08 2c 64 b6 Oct 31 15:24:58.114214: | 3a ce a8 38 aa 47 b4 6d 7f d9 e4 f6 df 19 ef 45 Oct 31 15:24:58.114216: | 60 a0 41 a3 79 67 f0 d8 c9 93 ac 46 be ad 89 60 Oct 31 15:24:58.114218: | b5 1f df 65 0a 79 3e d6 15 e8 b8 71 0b 6e 7f 9f Oct 31 15:24:58.114220: | 99 ba db ad 52 94 d8 01 e8 11 02 0a f7 18 43 c5 Oct 31 15:24:58.114222: | 90 91 33 dd 75 ab ab e7 47 09 d0 aa 71 03 ad a7 Oct 31 15:24:58.114223: | 65 c1 7c 9d 97 28 6c 0b ee 0e 4c 83 c3 ca 34 91 Oct 31 15:24:58.114225: | 04 4b d2 4b 21 f4 1b 1e e8 47 1a 96 81 d2 87 07 Oct 31 15:24:58.114226: | 56 f4 6e b5 fe 2e 7c c5 d2 42 3f 21 17 2e 1c 1b Oct 31 15:24:58.114227: | 0f 54 cd f7 ce 37 ce ed 30 d1 3c 94 86 c3 f0 a2 Oct 31 15:24:58.114229: | ab d5 df 7b d2 1b 8c d9 b2 c6 64 4a 7f f9 80 84 Oct 31 15:24:58.114230: | 0d 30 0c 39 5b 76 ce 64 9c 54 ed dd 91 fe 98 51 Oct 31 15:24:58.114234: | **parse ISAKMP Message: Oct 31 15:24:58.114237: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:58.114240: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:58.114242: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:58.114244: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:58.114246: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:58.114248: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:58.114252: | Message ID: 2 (00 00 00 02) Oct 31 15:24:58.114255: | length: 608 (00 00 02 60) Oct 31 15:24:58.114257: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36) Oct 31 15:24:58.114261: | I am the IKE SA Original Responder receiving an IKEv2 CREATE_CHILD_SA request Oct 31 15:24:58.114265: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:24:58.114271: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:58.114273: | #2 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 Oct 31 15:24:58.114277: | State DB: found IKEv2 state #6 in V2_NEW_CHILD_R0 (find_v2_sa_by_responder_wip) Oct 31 15:24:58.114279: | #6 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:58.114282: "north-eastnets/0x1" #6: discarding packet received during asynchronous work (DNS or crypto) in STATE_V2_NEW_CHILD_R0 Oct 31 15:24:58.114285: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:58.114289: | #2 spent 0.184 (0.186) milliseconds in ikev2_process_packet() Oct 31 15:24:58.114291: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:58.114293: | delref mdp@0x559bbabd7620(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:58.114297: | delref logger@0x559bbabb3560(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:58.114302: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:58.114304: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:58.114310: | spent 0.204 (0.206) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:58.311532: | "north-eastnets/0x1" #6: spent 4.44 (1e+03) milliseconds in helper 1 processing job 8 for state #6: Child Responder KE and nonce nr (pcr) Oct 31 15:24:58.311552: | job 8 for #6: Child Responder KE and nonce nr (build KE and nonce): helper thread 1 sending result back to state Oct 31 15:24:58.311557: | scheduling resume sending helper answer back to state for #6 Oct 31 15:24:58.311561: | libevent_malloc: newref ptr-libevent@0x7f32c8008ff0 size 128 Oct 31 15:24:58.311573: | helper thread 1 has nothing to do Oct 31 15:24:58.311584: | processing resume sending helper answer back to state for #6 Oct 31 15:24:58.311601: | start processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:58.311607: | unsuspending #6 MD 0x559bbabc8750 Oct 31 15:24:58.311611: | job 8 for #6: Child Responder KE and nonce nr (build KE and nonce): processing response from helper 1 Oct 31 15:24:58.311614: | job 8 for #6: Child Responder KE and nonce nr (build KE and nonce): calling continuation function 0x559bb8fe3fe7 Oct 31 15:24:58.311617: | ikev2_child_inIoutR_continue() for #6 STATE_V2_NEW_CHILD_R0 Oct 31 15:24:58.311621: | DH secret MODP3072@0x7f32c8003bc0: transferring ownership from helper KE to state #6 Oct 31 15:24:58.311626: | DH secret MODP3072@0x7f32c8003bc0: transferring ownership from state #6 to helper DH Oct 31 15:24:58.311631: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:24:58.311634: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:24:58.311637: | newref clone logger@0x559bbabb3560(0->1) (in clone_logger() at log.c:817) Oct 31 15:24:58.311640: | job 10 for #6: DHv2 for child sa (dh): adding job to queue Oct 31 15:24:58.311643: | state #6 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:58.311647: | libevent_free: delref ptr-libevent@0x7f32b0000c80 Oct 31 15:24:58.311650: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbab12940 Oct 31 15:24:58.311653: | #6 STATE_V2_NEW_CHILD_R0: retransmits: cleared Oct 31 15:24:58.311656: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbab12940 Oct 31 15:24:58.311660: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #6 Oct 31 15:24:58.311662: | libevent_malloc: newref ptr-libevent@0x7f32b0000c80 size 128 Oct 31 15:24:58.311674: | [RE]START processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:58.311679: | #6 complete_v2_state_transition() V2_NEW_CHILD_R0->ESTABLISHED_CHILD_SA with status STF_SUSPEND Oct 31 15:24:58.311682: | suspending state #6 and saving MD 0x559bbabc8750 Oct 31 15:24:58.311685: | addref md@0x559bbabc8750(1->2) (in complete_v2_state_transition() at ikev2.c:3485) Oct 31 15:24:58.311688: | #6 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:58.311748: | job 10 for #6: DHv2 for child sa (dh): helper 6 starting job Oct 31 15:24:58.311754: | helper 6 is pausing for 1 seconds Oct 31 15:24:58.311816: | delref logger@0x559bbabcfa10(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:58.311821: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:58.311824: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:58.311828: | resume sending helper answer back to state for #6 suppresed complete_v2_state_transition() Oct 31 15:24:58.311832: | delref mdp@0x559bbabc8750(2->1) (in resume_handler() at server.c:743) Oct 31 15:24:58.311839: | #6 spent 0.111 (0.23) milliseconds in resume sending helper answer back to state Oct 31 15:24:58.311844: | stop processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:58.311848: | libevent_free: delref ptr-libevent@0x7f32c8008ff0 Oct 31 15:24:58.914503: | spent 0.00248 (0.0025) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:24:58.914525: | newref struct msg_digest@0x559bbabd9070(0->1) (in read_message() at demux.c:103) Oct 31 15:24:58.914530: | newref alloc logger@0x559bbabcfa10(0->1) (in read_message() at demux.c:103) Oct 31 15:24:58.914536: | *received 608 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:24:58.914539: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:58.914542: | 2e 20 24 08 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:58.914544: | 1f a3 e7 6b f5 b1 a5 39 6b e3 64 59 54 77 3e f7 Oct 31 15:24:58.914546: | 30 a8 e1 61 e7 3f 8b 1d db 22 32 b0 7c 90 e4 8a Oct 31 15:24:58.914548: | 9f ff a8 aa 6c 67 55 b3 68 47 eb 65 be e9 a3 75 Oct 31 15:24:58.914550: | b9 cb d3 4c 4e b8 e5 51 90 57 17 54 86 21 65 c4 Oct 31 15:24:58.914552: | 23 d5 38 05 d9 f1 a3 68 07 ef 4b 8a 83 db 8e 65 Oct 31 15:24:58.914555: | a8 89 5a 5f 59 03 7a b5 8d 27 9d 40 26 74 3d c2 Oct 31 15:24:58.914557: | 12 a2 73 62 04 87 fb ef 4b a0 08 22 b7 ac ac 10 Oct 31 15:24:58.914559: | 61 f4 9b 6e d3 28 b9 84 ac fd ef 0b 8a d0 fa 1a Oct 31 15:24:58.914561: | b5 a0 06 a1 91 78 af 6f 1f e7 63 d5 04 22 17 29 Oct 31 15:24:58.914563: | 60 24 2b 94 6d 86 81 00 64 1a cf 57 92 d1 7a f7 Oct 31 15:24:58.914565: | bc 9d 4a a2 d1 25 7d 7d 22 1a 23 1f d7 5b 6e b0 Oct 31 15:24:58.914568: | 5d 06 b1 45 db d0 47 50 0a 50 5c 47 b2 2c 59 ff Oct 31 15:24:58.914570: | e4 44 49 53 8c 06 ae de 57 73 0d 90 ba 50 42 fe Oct 31 15:24:58.914572: | 61 86 e0 23 40 7d ec 8c 78 ba f2 c4 81 f3 4a 4f Oct 31 15:24:58.914574: | ab 33 b6 02 19 f6 45 97 04 7f b5 01 b8 12 a1 cc Oct 31 15:24:58.914576: | a4 41 87 50 a4 ba ea 4d 39 96 3f c7 6d 5e 78 00 Oct 31 15:24:58.914578: | 7a e8 6d 68 ca 45 1c 7b 95 c4 ae cb eb b0 86 c0 Oct 31 15:24:58.914580: | ba 82 50 41 2c 92 2a 15 96 c4 d6 c6 27 74 6c 33 Oct 31 15:24:58.914582: | 5c 3b 07 7e 88 0e 9b 68 b8 70 e3 6c 9a d2 5c 8b Oct 31 15:24:58.914584: | 8a f5 ba 1d 10 9d 28 cc 22 22 2b dc e1 27 65 67 Oct 31 15:24:58.914586: | 4f 32 27 7e d9 b8 f1 04 0b 09 e7 c4 a6 86 bc fa Oct 31 15:24:58.914589: | ca 3c 05 e0 8b 96 43 c7 da 5a 36 3b 28 dc 64 bd Oct 31 15:24:58.914591: | 5e c6 61 85 f6 9f 21 ee 7b 28 e5 3c 45 2b 09 b6 Oct 31 15:24:58.914593: | ca ea f6 0a 3d e6 82 0f af 3b 19 92 c6 46 79 91 Oct 31 15:24:58.914595: | 34 b6 c0 6b 1b a6 a7 1d 7a 15 23 14 08 2c 64 b6 Oct 31 15:24:58.914597: | 3a ce a8 38 aa 47 b4 6d 7f d9 e4 f6 df 19 ef 45 Oct 31 15:24:58.914600: | 60 a0 41 a3 79 67 f0 d8 c9 93 ac 46 be ad 89 60 Oct 31 15:24:58.914602: | b5 1f df 65 0a 79 3e d6 15 e8 b8 71 0b 6e 7f 9f Oct 31 15:24:58.914604: | 99 ba db ad 52 94 d8 01 e8 11 02 0a f7 18 43 c5 Oct 31 15:24:58.914606: | 90 91 33 dd 75 ab ab e7 47 09 d0 aa 71 03 ad a7 Oct 31 15:24:58.914608: | 65 c1 7c 9d 97 28 6c 0b ee 0e 4c 83 c3 ca 34 91 Oct 31 15:24:58.914610: | 04 4b d2 4b 21 f4 1b 1e e8 47 1a 96 81 d2 87 07 Oct 31 15:24:58.914612: | 56 f4 6e b5 fe 2e 7c c5 d2 42 3f 21 17 2e 1c 1b Oct 31 15:24:58.914615: | 0f 54 cd f7 ce 37 ce ed 30 d1 3c 94 86 c3 f0 a2 Oct 31 15:24:58.914617: | ab d5 df 7b d2 1b 8c d9 b2 c6 64 4a 7f f9 80 84 Oct 31 15:24:58.914621: | 0d 30 0c 39 5b 76 ce 64 9c 54 ed dd 91 fe 98 51 Oct 31 15:24:58.914626: | **parse ISAKMP Message: Oct 31 15:24:58.914632: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:58.914636: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:58.914639: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:24:58.914642: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:58.914644: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:58.914647: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:24:58.914651: | Message ID: 2 (00 00 00 02) Oct 31 15:24:58.914655: | length: 608 (00 00 02 60) Oct 31 15:24:58.914658: | processing version=2.0 packet with exchange type=ISAKMP_v2_CREATE_CHILD_SA (36) Oct 31 15:24:58.914661: | I am the IKE SA Original Responder receiving an IKEv2 CREATE_CHILD_SA request Oct 31 15:24:58.914667: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:24:58.914675: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:24:58.914679: | #2 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 Oct 31 15:24:58.914682: | State DB: found IKEv2 state #6 in V2_NEW_CHILD_R0 (find_v2_sa_by_responder_wip) Oct 31 15:24:58.914686: | #6 is busy; has suspended MD 0x559bbabc8750 Oct 31 15:24:58.914689: "north-eastnets/0x1" #6: discarding packet received during asynchronous work (DNS or crypto) in STATE_V2_NEW_CHILD_R0 Oct 31 15:24:58.914695: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:24:58.914701: | #2 spent 0.205 (0.205) milliseconds in ikev2_process_packet() Oct 31 15:24:58.914704: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:24:58.914707: | delref mdp@0x559bbabd9070(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:58.914710: | delref logger@0x559bbabcfa10(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:24:58.914713: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:58.914715: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:58.914721: | spent 0.226 (0.225) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:24:58.967637: | "north-eastnets/0x2" #4: spent 2.2 (1e+03) milliseconds in helper 7 processing job 9 for state #4: ikev2 Child SA initiator pfs=yes (dh) Oct 31 15:24:58.967656: | job 9 for #4: ikev2 Child SA initiator pfs=yes (dh): helper thread 7 sending result back to state Oct 31 15:24:58.967661: | scheduling resume sending helper answer back to state for #4 Oct 31 15:24:58.967665: | libevent_malloc: newref ptr-libevent@0x7f32c0003b30 size 128 Oct 31 15:24:58.967677: | helper thread 7 has nothing to do Oct 31 15:24:58.967693: | processing resume sending helper answer back to state for #4 Oct 31 15:24:58.967702: | start processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:58.967707: | unsuspending #4 MD 0x559bbabd5e40 Oct 31 15:24:58.967711: | job 9 for #4: ikev2 Child SA initiator pfs=yes (dh): processing response from helper 7 Oct 31 15:24:58.967713: | job 9 for #4: ikev2 Child SA initiator pfs=yes (dh): calling continuation function 0x559bb8fe57cb Oct 31 15:24:58.967717: | DH secret MODP3072@0x7f32b4004e80: transferring ownership from helper IKEv2 DH to state #4 Oct 31 15:24:58.967720: | ikev2_child_inR_continue() for #4 STATE_V2_NEW_CHILD_I1 Oct 31 15:24:58.967725: | TSi: parsing 1 traffic selectors Oct 31 15:24:58.967730: | ***parse IKEv2 Traffic Selector: Oct 31 15:24:58.967734: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:58.967736: | IP Protocol ID: ALL (0x0) Oct 31 15:24:58.967741: | length: 16 (00 10) Oct 31 15:24:58.967744: | start port: 0 (00 00) Oct 31 15:24:58.967747: | end port: 65535 (ff ff) Oct 31 15:24:58.967750: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low Oct 31 15:24:58.967756: | TS low Oct 31 15:24:58.967758: | c0 00 03 00 Oct 31 15:24:58.967761: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high Oct 31 15:24:58.967764: | TS high Oct 31 15:24:58.967766: | c0 00 03 ff Oct 31 15:24:58.967768: | TSi: parsed 1 traffic selectors Oct 31 15:24:58.967770: | TSr: parsing 1 traffic selectors Oct 31 15:24:58.967773: | ***parse IKEv2 Traffic Selector: Oct 31 15:24:58.967776: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:58.967778: | IP Protocol ID: ALL (0x0) Oct 31 15:24:58.967781: | length: 16 (00 10) Oct 31 15:24:58.967784: | start port: 0 (00 00) Oct 31 15:24:58.967787: | end port: 65535 (ff ff) Oct 31 15:24:58.967789: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low Oct 31 15:24:58.967791: | TS low Oct 31 15:24:58.967793: | c0 00 16 00 Oct 31 15:24:58.967796: | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high Oct 31 15:24:58.967798: | TS high Oct 31 15:24:58.967800: | c0 00 16 ff Oct 31 15:24:58.967803: | TSr: parsed 1 traffic selectors Oct 31 15:24:58.967810: | evaluating our conn="north-eastnets/0x2" I=192.0.3.0/24:0:0/0 R=192.0.22.0/24:0:0/0 to their: Oct 31 15:24:58.967815: | TSi[0] .net=192.0.3.0-192.0.3.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:58.967823: | match address end->client=192.0.3.0/24 == TSi[0]net=192.0.3.0-192.0.3.255: YES fitness 32 Oct 31 15:24:58.967827: | narrow port end=0..65535 == TSi[0]=0..65535: 0 Oct 31 15:24:58.967830: | TSi[0] port match: YES fitness 65536 Oct 31 15:24:58.967833: | narrow protocol end=*0 == TSi[0]=*0: 0 Oct 31 15:24:58.967836: | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:58.967841: | TSr[0] .net=192.0.22.0-192.0.22.255 .iporotoid=0 .{start,end}port=0..65535 Oct 31 15:24:58.967848: | match address end->client=192.0.22.0/24 == TSr[0]net=192.0.22.0-192.0.22.255: YES fitness 32 Oct 31 15:24:58.967851: | narrow port end=0..65535 == TSr[0]=0..65535: 0 Oct 31 15:24:58.967853: | TSr[0] port match: YES fitness 65536 Oct 31 15:24:58.967855: | narrow protocol end=*0 == TSr[0]=*0: 0 Oct 31 15:24:58.967858: | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 Oct 31 15:24:58.967860: | best fit so far: TSi[0] TSr[0] Oct 31 15:24:58.967863: | found an acceptable TSi/TSr Traffic Selector Oct 31 15:24:58.967865: | printing contents struct traffic_selector Oct 31 15:24:58.967867: | ts_type: IKEv2_TS_IPV4_ADDR_RANGE Oct 31 15:24:58.967869: | ipprotoid: 0 Oct 31 15:24:58.967872: | port range: 0-65535 Oct 31 15:24:58.967876: | ip range: 192.0.3.0-192.0.3.255 Oct 31 15:24:58.967879: | printing contents struct traffic_selector Oct 31 15:24:58.967881: | ts_type: IKEv2_TS_IPV4_ADDR_RANGE Oct 31 15:24:58.967883: | ipprotoid: 0 Oct 31 15:24:58.967885: | port range: 0-65535 Oct 31 15:24:58.967889: | ip range: 192.0.22.0-192.0.22.255 Oct 31 15:24:58.967894: | integ=HMAC_SHA2_512_256: .key_size=64 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=80 Oct 31 15:24:58.967999: | install_ipsec_sa() for #4: inbound and outbound Oct 31 15:24:58.968004: | could_route called for north-eastnets/0x2; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 Oct 31 15:24:58.968007: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:24:58.968010: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:24:58.968013: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:24:58.968016: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:24:58.968019: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:24:58.968022: | route owner of "north-eastnets/0x2" erouted: self; eroute owner: self Oct 31 15:24:58.968026: | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA2_512_256 Oct 31 15:24:58.968030: | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 Oct 31 15:24:58.968032: | st->st_esp.keymat_len=80 is encrypt_keymat_size=16 + integ_keymat_size=64 Oct 31 15:24:58.968036: | setting IPsec SA replay-window to 32 Oct 31 15:24:58.968041: | NIC esp-hw-offload not for connection 'north-eastnets/0x2' not available on interface eth1 Oct 31 15:24:58.968045: | netlink: enabling tunnel mode Oct 31 15:24:58.968047: | XFRM: adding IPsec SA with reqid 16393 Oct 31 15:24:58.968049: | netlink: setting IPsec SA replay-window to 32 using old-style req Oct 31 15:24:58.968053: | netlink: esp-hw-offload not set for IPsec SA Oct 31 15:24:58.968125: | netlink response for Add SA esp.98b3bf89@192.1.2.23 included non-error error Oct 31 15:24:58.968131: | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#5 mode=1 Oct 31 15:24:58.968134: | set up outgoing SA, ref=0/0 Oct 31 15:24:58.968136: | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA2_512_256 Oct 31 15:24:58.968139: | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 Oct 31 15:24:58.968141: | st->st_esp.keymat_len=80 is encrypt_keymat_size=16 + integ_keymat_size=64 Oct 31 15:24:58.968145: | setting IPsec SA replay-window to 32 Oct 31 15:24:58.968148: | NIC esp-hw-offload not for connection 'north-eastnets/0x2' not available on interface eth1 Oct 31 15:24:58.968151: | netlink: enabling tunnel mode Oct 31 15:24:58.968153: | XFRM: adding IPsec SA with reqid 16393 Oct 31 15:24:58.968155: | netlink: setting IPsec SA replay-window to 32 using old-style req Oct 31 15:24:58.968158: | netlink: esp-hw-offload not set for IPsec SA Oct 31 15:24:58.968195: | netlink response for Add SA esp.8a51674e@192.1.3.33 included non-error error Oct 31 15:24:58.968208: | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#5 mode=1 Oct 31 15:24:58.968211: | set up incoming SA, ref=0/0 Oct 31 15:24:58.968213: | sr for #4: erouted Oct 31 15:24:58.968216: | route_and_eroute() for proto 0, and source port 0 dest port 0 Oct 31 15:24:58.968218: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:24:58.968221: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:24:58.968223: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:24:58.968226: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:24:58.968228: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:24:58.968231: | route owner of "north-eastnets/0x2" erouted: self; eroute owner: self Oct 31 15:24:58.968235: | route_and_eroute with c: north-eastnets/0x2 (next: none) ero:north-eastnets/0x2 esr:{(nil)} ro:north-eastnets/0x2 rosr:{(nil)} and state: #4 Oct 31 15:24:58.968237: | we are replacing an eroute Oct 31 15:24:58.968240: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:24:58.968251: | eroute_connection replace eroute 192.0.3.0/24:0 --0-> 192.0.22.0/24:0 => tun.0@192.1.2.23>tun.0@192.1.2.23 using reqid 16393 (raw_eroute) proto=50 Oct 31 15:24:58.968255: | IPsec SA SPD priority set to 2084814 Oct 31 15:24:58.968272: | raw_eroute result=success Oct 31 15:24:58.968276: | route_and_eroute: firewall_notified: true Oct 31 15:24:58.968279: | route_and_eroute: instance "north-eastnets/0x2", setting eroute_owner {spd=0x559bbabc2640,sr=0x559bbabc2640} to #4 (was #5) (newest_ipsec_sa=#5) Oct 31 15:24:58.968703: | inR2: instance north-eastnets/0x2[0], setting IKEv2 newest_ipsec_sa to #4 (was #5) (spd.eroute=#4) cloned from #1 Oct 31 15:24:58.968710: | delref logger@0x559bbabcdb50(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:58.968713: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:58.968717: | delref fd@0x559bbabc6aa0(2->1) (in free_logger() at log.c:854) Oct 31 15:24:58.968724: | [RE]START processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:58.968730: | #4 complete_v2_state_transition() V2_NEW_CHILD_I1->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=V2_NEW_CHILD_I0->V2_NEW_CHILD_I1 Oct 31 15:24:58.968733: | transitioning from state STATE_V2_NEW_CHILD_I1 to state STATE_V2_ESTABLISHED_CHILD_SA Oct 31 15:24:58.968736: | Message ID: updating counters for #4 Oct 31 15:24:58.968749: | Message ID: CHILD #1.#4 XXX: no EVENT_RETRANSMIT to clear; suspect IKE->CHILD switch: ike.initiator.sent=2 ike.initiator.recv=1 ike.initiator.last_contact=744571.379965 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:58.968758: | Message ID: CHILD #1.#4 updating initiator received message response 2: ike.initiator.sent=2 ike.initiator.recv=1->2 ike.initiator.last_contact=744571.379965->744573.40154 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=2->-1 child.wip.responder=-1 Oct 31 15:24:58.968764: | Message ID: CHILD #1.#4 skipping update_send as nothing to send: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:58.968770: | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:58.968774: | child state #4: V2_NEW_CHILD_I1(established IKE SA) => ESTABLISHED_CHILD_SA(established CHILD SA) Oct 31 15:24:58.968777: | pstats #4 ikev2.child established Oct 31 15:24:58.968780: | announcing the state transition Oct 31 15:24:58.968788: "north-eastnets/0x2" #4: negotiated connection [192.0.3.0-192.0.3.255:0-65535 0] -> [192.0.22.0-192.0.22.255:0-65535 0] Oct 31 15:24:58.968802: | NAT-T: encaps is 'auto' Oct 31 15:24:58.968808: "north-eastnets/0x2" #4: IPsec SA established tunnel mode {ESP=>0x98b3bf89 <0x8a51674e xfrm=AES_CBC_128-HMAC_SHA2_512_256-MODP3072 NATOA=none NATD=none DPD=passive} Oct 31 15:24:58.968813: | releasing #4's fd-fd@0x559bbabc6aa0 because IKEv2 transitions finished Oct 31 15:24:58.968817: | delref fd@0x559bbabc6aa0(1->0) (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:58.968823: | freeref fd-fd@0x559bbabc6aa0 (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:58.968827: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:58.968830: | unpending #4's IKE SA #1 Oct 31 15:24:58.968832: | unpending state #1 connection "north-eastnets/0x2" Oct 31 15:24:58.968835: | releasing #1's fd-fd@(nil) because IKEv2 transitions finished so releaseing IKE SA Oct 31 15:24:58.968838: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) Oct 31 15:24:58.968840: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) Oct 31 15:24:58.968844: | #4 will start re-keying in 27838 seconds with margin of 962 seconds (attempting re-key) Oct 31 15:24:58.968847: | state #4 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:58.968851: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:24:58.968854: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabd0d80 Oct 31 15:24:58.968858: | event_schedule: newref EVENT_SA_REKEY-pe@0x559bbabd0d80 Oct 31 15:24:58.968861: | inserting event EVENT_SA_REKEY, timeout in 27838 seconds for #4 Oct 31 15:24:58.968864: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:24:58.968869: | delref mdp@0x559bbabd5e40(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:58.968872: | delref logger@0x559bbabc4000(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:58.968874: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:58.968876: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:58.968884: | #4 spent 1.16 (1.17) milliseconds in resume sending helper answer back to state Oct 31 15:24:58.968889: | stop processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:58.968893: | libevent_free: delref ptr-libevent@0x7f32c0003b30 Oct 31 15:24:59.314095: | "north-eastnets/0x1" #6: spent 2.21 (1e+03) milliseconds in helper 6 processing job 10 for state #6: DHv2 for child sa (dh) Oct 31 15:24:59.314123: | job 10 for #6: DHv2 for child sa (dh): helper thread 6 sending result back to state Oct 31 15:24:59.314128: | scheduling resume sending helper answer back to state for #6 Oct 31 15:24:59.314132: | libevent_malloc: newref ptr-libevent@0x7f32c40123c0 size 128 Oct 31 15:24:59.314145: | helper thread 6 has nothing to do Oct 31 15:24:59.314157: | processing resume sending helper answer back to state for #6 Oct 31 15:24:59.314171: | start processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in resume_handler() at server.c:641) Oct 31 15:24:59.314177: | unsuspending #6 MD 0x559bbabc8750 Oct 31 15:24:59.314181: | job 10 for #6: DHv2 for child sa (dh): processing response from helper 6 Oct 31 15:24:59.314184: | job 10 for #6: DHv2 for child sa (dh): calling continuation function 0x559bb8fe57cb Oct 31 15:24:59.314187: | DH secret MODP3072@0x7f32c8003bc0: transferring ownership from helper IKEv2 DH to state #6 Oct 31 15:24:59.314191: | ikev2_child_inIoutR_continue_continue() for #6 STATE_V2_NEW_CHILD_R0 Oct 31 15:24:59.314201: | opening output PBS reply packet Oct 31 15:24:59.314210: | **emit ISAKMP Message: Oct 31 15:24:59.314215: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:24:59.314219: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:59.314222: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:24:59.314225: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:24:59.314228: | exchange type: ISAKMP_v2_CREATE_CHILD_SA (0x24) Oct 31 15:24:59.314231: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:24:59.314235: | Message ID: 2 (00 00 00 02) Oct 31 15:24:59.314239: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:24:59.314242: | ***emit IKEv2 Encryption Payload: Oct 31 15:24:59.314245: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:59.314247: | flags: none (0x0) Oct 31 15:24:59.314251: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:24:59.314253: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' Oct 31 15:24:59.314257: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:24:59.314655: | netlink_get_spi: allocated 0xe2910ac0 for esp.0@192.1.3.33 Oct 31 15:24:59.314660: | emitting ikev2_proposal ... Oct 31 15:24:59.314663: | ****emit IKEv2 Security Association Payload: Oct 31 15:24:59.314666: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:59.314668: | flags: none (0x0) Oct 31 15:24:59.314672: | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) Oct 31 15:24:59.314675: | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' Oct 31 15:24:59.314680: | *****emit IKEv2 Proposal Substructure Payload: Oct 31 15:24:59.314682: | last proposal: v2_PROPOSAL_LAST (0x0) Oct 31 15:24:59.314686: | prop #: 1 (01) Oct 31 15:24:59.314688: | proto ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:24:59.314691: | spi size: 4 (04) Oct 31 15:24:59.314694: | # transforms: 4 (04) Oct 31 15:24:59.314697: | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' Oct 31 15:24:59.314700: | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload Oct 31 15:24:59.314704: | our spi: e2 91 0a c0 Oct 31 15:24:59.314706: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:59.314709: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:59.314711: | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) Oct 31 15:24:59.314713: | IKEv2 transform ID: AES_CBC (0xc) Oct 31 15:24:59.314715: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:59.314720: | *******emit IKEv2 Attribute Substructure Payload: Oct 31 15:24:59.314723: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) Oct 31 15:24:59.314726: | length/value: 128 (00 80) Oct 31 15:24:59.314729: | emitting length of IKEv2 Transform Substructure Payload: 12 Oct 31 15:24:59.314731: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:59.314733: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:59.314735: | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) Oct 31 15:24:59.314737: | IKEv2 transform ID: AUTH_HMAC_SHA2_512_256 (0xe) Oct 31 15:24:59.314739: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:59.314741: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:59.314743: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:59.314746: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:59.314748: | last transform: v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:59.314750: | IKEv2 transform type: TRANS_TYPE_DH (0x4) Oct 31 15:24:59.314752: | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) Oct 31 15:24:59.314754: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:59.314756: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:59.314759: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:59.314761: | ******emit IKEv2 Transform Substructure Payload: Oct 31 15:24:59.314763: | last transform: v2_TRANSFORM_LAST (0x0) Oct 31 15:24:59.314766: | IKEv2 transform type: TRANS_TYPE_ESN (0x5) Oct 31 15:24:59.314768: | IKEv2 transform ID: ESN_DISABLED (0x0) Oct 31 15:24:59.314770: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) Oct 31 15:24:59.314772: | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' Oct 31 15:24:59.314774: | emitting length of IKEv2 Transform Substructure Payload: 8 Oct 31 15:24:59.314776: | emitting length of IKEv2 Proposal Substructure Payload: 48 Oct 31 15:24:59.314779: | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 Oct 31 15:24:59.314781: | emitting length of IKEv2 Security Association Payload: 52 Oct 31 15:24:59.314783: | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 Oct 31 15:24:59.314785: | ****emit IKEv2 Nonce Payload: Oct 31 15:24:59.314788: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:59.314790: | flags: none (0x0) Oct 31 15:24:59.314793: | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) Oct 31 15:24:59.314796: | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' Oct 31 15:24:59.314799: | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload Oct 31 15:24:59.314801: | IKEv2 nonce: Oct 31 15:24:59.314804: | d4 26 25 aa b0 7a c0 4f 1f 5f 2e 13 a7 62 d6 cc Oct 31 15:24:59.314807: | 26 a9 ee ca 68 1f 31 bd 7f 67 72 e9 14 67 c9 d8 Oct 31 15:24:59.314809: | emitting length of IKEv2 Nonce Payload: 36 Oct 31 15:24:59.314811: | ****emit IKEv2 Key Exchange Payload: Oct 31 15:24:59.314814: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:59.314816: | flags: none (0x0) Oct 31 15:24:59.314818: | DH group: OAKLEY_GROUP_MODP3072 (0xf) Oct 31 15:24:59.314821: | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) Oct 31 15:24:59.314826: | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' Oct 31 15:24:59.314829: | emitting 384 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload Oct 31 15:24:59.314831: | ikev2 g^x: Oct 31 15:24:59.314833: | 2d bc 90 ca c1 d1 01 97 0f d7 c4 ca b9 9b 90 d6 Oct 31 15:24:59.314835: | ef 9d de 64 97 1e b0 fa e0 d0 8b 5e 84 34 cf 3c Oct 31 15:24:59.314837: | f6 3f 0d 1e 49 7f 73 41 d4 fe c3 91 b6 ca 9c 36 Oct 31 15:24:59.314839: | d5 ac 56 09 62 4b 05 f8 f9 e6 a8 57 ec 51 73 67 Oct 31 15:24:59.314841: | 93 d5 74 c9 10 1d d7 e1 36 47 82 74 aa be 33 96 Oct 31 15:24:59.314843: | 69 5f 6a cd f0 2d f1 b5 b0 19 67 8a 0c 11 a7 e1 Oct 31 15:24:59.314845: | 7c c7 36 a3 21 56 7e 37 69 9d 59 19 c1 68 3a 4b Oct 31 15:24:59.314847: | 04 e8 ec 37 71 d5 84 3e 4e 1d 9a e7 de c6 44 7b Oct 31 15:24:59.314849: | 0a 4d 21 5e cc c1 4d 87 65 c6 27 8f 7f dc 4d f2 Oct 31 15:24:59.314851: | d4 8d f1 01 f6 b3 c6 b8 42 3f f0 e2 b1 40 b1 14 Oct 31 15:24:59.314853: | 3f a7 49 0a fb 6a f9 7a e0 bc a5 d1 51 dd 7b 82 Oct 31 15:24:59.314855: | c5 e1 84 bf a7 73 4d b9 37 cb 10 72 f1 e0 0f a9 Oct 31 15:24:59.314858: | 2e 8d d4 34 04 02 24 c0 14 f6 1e b7 07 b9 e9 16 Oct 31 15:24:59.314860: | 91 b2 d1 42 62 33 d4 2c 6d 91 09 55 df 1d 14 34 Oct 31 15:24:59.314862: | d2 6f 0d 2c 0e 96 35 46 86 66 a7 59 97 c3 cc 55 Oct 31 15:24:59.314864: | 91 75 de db ba e2 e0 f8 ea 22 5f fe 08 fa ab 4c Oct 31 15:24:59.314866: | 84 01 7d a3 5c 68 31 3d 1c 36 2b 7a f0 e2 b1 4b Oct 31 15:24:59.314868: | 69 7c 88 a9 5e 15 dd 3b f0 53 2b 3b ae 2f c7 16 Oct 31 15:24:59.314871: | f4 8e ef a7 5d cc cb 7b f8 18 22 f6 83 20 04 d6 Oct 31 15:24:59.314873: | f2 dc c8 22 cc e8 77 4d 38 c2 ca 85 66 8f a7 ea Oct 31 15:24:59.314875: | d3 fc e7 e2 2e ff e1 ef 3b 9c 32 5f fa 71 a6 8b Oct 31 15:24:59.314877: | dd ca e9 17 d7 29 b5 21 61 40 08 fa 79 c4 44 14 Oct 31 15:24:59.314879: | ed 61 4e 0e 49 77 47 35 a2 7c dd 5b 44 32 9c b2 Oct 31 15:24:59.314881: | b6 57 f2 43 e5 b9 11 8c 33 58 2b 91 29 5b 0b b3 Oct 31 15:24:59.314884: | emitting length of IKEv2 Key Exchange Payload: 392 Oct 31 15:24:59.314887: | ****emit IKEv2 Traffic Selector - Initiator - Payload: Oct 31 15:24:59.314890: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:59.314892: | flags: none (0x0) Oct 31 15:24:59.314895: | number of TS: 1 (01) Oct 31 15:24:59.314898: | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) Oct 31 15:24:59.314900: | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:59.314903: | *****emit IKEv2 Traffic Selector: Oct 31 15:24:59.314905: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:59.314908: | IP Protocol ID: ALL (0x0) Oct 31 15:24:59.314912: | start port: 0 (00 00) Oct 31 15:24:59.314915: | end port: 65535 (ff ff) Oct 31 15:24:59.314918: | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector Oct 31 15:24:59.314921: | IP start: c0 00 02 00 Oct 31 15:24:59.314924: | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector Oct 31 15:24:59.314927: | IP end: c0 00 02 ff Oct 31 15:24:59.314929: | emitting length of IKEv2 Traffic Selector: 16 Oct 31 15:24:59.314932: | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 Oct 31 15:24:59.314934: | ****emit IKEv2 Traffic Selector - Responder - Payload: Oct 31 15:24:59.314936: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:24:59.314939: | flags: none (0x0) Oct 31 15:24:59.314941: | number of TS: 1 (01) Oct 31 15:24:59.314945: | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) Oct 31 15:24:59.314949: | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' Oct 31 15:24:59.314952: | *****emit IKEv2 Traffic Selector: Oct 31 15:24:59.314954: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) Oct 31 15:24:59.314957: | IP Protocol ID: ALL (0x0) Oct 31 15:24:59.314959: | start port: 0 (00 00) Oct 31 15:24:59.314962: | end port: 65535 (ff ff) Oct 31 15:24:59.314965: | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector Oct 31 15:24:59.314968: | IP start: c0 00 03 00 Oct 31 15:24:59.314971: | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector Oct 31 15:24:59.314974: | IP end: c0 00 03 ff Oct 31 15:24:59.314976: | emitting length of IKEv2 Traffic Selector: 16 Oct 31 15:24:59.314978: | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 Oct 31 15:24:59.314981: | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED Oct 31 15:24:59.314985: | integ=HMAC_SHA2_512_256: .key_size=64 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=80 Oct 31 15:24:59.315078: | install_ipsec_sa() for #6: inbound and outbound Oct 31 15:24:59.315084: | could_route called for north-eastnets/0x1; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 Oct 31 15:24:59.315087: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:24:59.315090: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:24:59.315093: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:24:59.315096: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:24:59.315098: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:24:59.315102: | route owner of "north-eastnets/0x1" erouted: self; eroute owner: self Oct 31 15:24:59.315105: | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA2_512_256 Oct 31 15:24:59.315109: | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 Oct 31 15:24:59.315111: | st->st_esp.keymat_len=80 is encrypt_keymat_size=16 + integ_keymat_size=64 Oct 31 15:24:59.315116: | setting IPsec SA replay-window to 32 Oct 31 15:24:59.315119: | NIC esp-hw-offload not for connection 'north-eastnets/0x1' not available on interface eth1 Oct 31 15:24:59.315122: | netlink: enabling tunnel mode Oct 31 15:24:59.315125: | XFRM: adding IPsec SA with reqid 16389 Oct 31 15:24:59.315127: | netlink: setting IPsec SA replay-window to 32 using old-style req Oct 31 15:24:59.315130: | netlink: esp-hw-offload not set for IPsec SA Oct 31 15:24:59.315391: | netlink response for Add SA esp.bd68e0ed@192.1.2.23 included non-error error Oct 31 15:24:59.315399: | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#3 mode=1 Oct 31 15:24:59.315402: | set up outgoing SA, ref=0/0 Oct 31 15:24:59.315404: | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA2_512_256 Oct 31 15:24:59.315406: | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 Oct 31 15:24:59.315408: | st->st_esp.keymat_len=80 is encrypt_keymat_size=16 + integ_keymat_size=64 Oct 31 15:24:59.315411: | setting IPsec SA replay-window to 32 Oct 31 15:24:59.315413: | NIC esp-hw-offload not for connection 'north-eastnets/0x1' not available on interface eth1 Oct 31 15:24:59.315415: | netlink: enabling tunnel mode Oct 31 15:24:59.315417: | XFRM: adding IPsec SA with reqid 16389 Oct 31 15:24:59.315418: | netlink: setting IPsec SA replay-window to 32 using old-style req Oct 31 15:24:59.315420: | netlink: esp-hw-offload not set for IPsec SA Oct 31 15:24:59.315453: | netlink response for Add SA esp.e2910ac0@192.1.3.33 included non-error error Oct 31 15:24:59.315499: | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#3 mode=1 Oct 31 15:24:59.315503: | set up incoming SA, ref=0/0 Oct 31 15:24:59.315506: | sr for #6: erouted Oct 31 15:24:59.315509: | route_and_eroute() for proto 0, and source port 0 dest port 0 Oct 31 15:24:59.315512: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:24:59.315515: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:24:59.315520: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:24:59.315524: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:24:59.315526: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:24:59.315530: | route owner of "north-eastnets/0x1" erouted: self; eroute owner: self Oct 31 15:24:59.315533: | route_and_eroute with c: north-eastnets/0x1 (next: none) ero:north-eastnets/0x1 esr:{(nil)} ro:north-eastnets/0x1 rosr:{(nil)} and state: #6 Oct 31 15:24:59.315536: | we are replacing an eroute Oct 31 15:24:59.315539: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:24:59.315549: | eroute_connection replace eroute 192.0.3.0/24:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23>tun.0@192.1.2.23 using reqid 16389 (raw_eroute) proto=50 Oct 31 15:24:59.315552: | IPsec SA SPD priority set to 2084814 Oct 31 15:24:59.315569: | raw_eroute result=success Oct 31 15:24:59.315573: | route_and_eroute: firewall_notified: true Oct 31 15:24:59.315613: | route_and_eroute: instance "north-eastnets/0x1", setting eroute_owner {spd=0x559bbabc1d00,sr=0x559bbabc1d00} to #6 (was #3) (newest_ipsec_sa=#3) Oct 31 15:24:59.315702: | ISAKMP_v2_CREATE_CHILD_SA: instance north-eastnets/0x1[0], setting IKEv2 newest_ipsec_sa to #6 (was #3) (spd.eroute=#6) cloned from #2 Oct 31 15:24:59.315708: | adding 16 bytes of padding (including 1 byte padding-length) Oct 31 15:24:59.315711: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315713: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315715: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315718: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315720: | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315722: | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315724: | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315727: | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315729: | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315732: | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315735: | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315738: | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315741: | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315744: | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315749: | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315753: | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:24:59.315756: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:24:59.315759: | emitting length of IKEv2 Encryption Payload: 580 Oct 31 15:24:59.315761: | emitting length of ISAKMP Message: 608 Oct 31 15:24:59.315935: "north-eastnets/0x1" #6: negotiated new IPsec SA [192.0.3.0-192.0.3.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] Oct 31 15:24:59.315941: | delref logger@0x559bbabb3560(1->0) (in handle_helper_answer() at pluto_crypt.c:658) Oct 31 15:24:59.315944: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:59.315945: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:59.315951: | [RE]START processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:24:59.315954: | #6 complete_v2_state_transition() V2_NEW_CHILD_R0->ESTABLISHED_CHILD_SA with status STF_OK Oct 31 15:24:59.315958: | transitioning from state STATE_V2_NEW_CHILD_R0 to state STATE_V2_ESTABLISHED_CHILD_SA Oct 31 15:24:59.315960: | Message ID: updating counters for #6 Oct 31 15:24:59.315966: | Message ID: CHILD #2.#6 updating responder received message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=1 ike.responder.recv=1->2 ike.responder.last_contact=744571.607475->744573.748758 child.wip.initiator=-1 child.wip.responder=2->-1 Oct 31 15:24:59.315970: | Message ID: CHILD #2.#6 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=1->2 ike.responder.recv=2 ike.responder.last_contact=744573.748758 child.wip.initiator=-1 child.wip.responder=-1 Oct 31 15:24:59.315974: | Message ID: IKE #2 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744573.748758 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:24:59.315976: | child state #6: V2_NEW_CHILD_R0(established IKE SA) => ESTABLISHED_CHILD_SA(established CHILD SA) Oct 31 15:24:59.315979: | pstats #6 ikev2.child established Oct 31 15:24:59.315980: | announcing the state transition Oct 31 15:24:59.315985: "north-eastnets/0x1" #6: negotiated connection [192.0.3.0-192.0.3.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] Oct 31 15:24:59.315987: | NAT-T: encaps is 'auto' Oct 31 15:24:59.315991: "north-eastnets/0x1" #6: IPsec SA established tunnel mode {ESP=>0xbd68e0ed <0xe2910ac0 xfrm=AES_CBC_128-HMAC_SHA2_512_256-MODP3072 NATOA=none NATD=none DPD=passive} Oct 31 15:24:59.315996: | sending 608 bytes for STATE_V2_NEW_CHILD_R0 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #2) Oct 31 15:24:59.315998: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:24:59.315999: | 2e 20 24 20 00 00 00 02 00 00 02 60 21 00 02 44 Oct 31 15:24:59.316000: | 05 03 fc 5e 6e 31 73 6f 90 c7 64 4e 78 1b 00 6a Oct 31 15:24:59.316002: | d0 27 28 4d 21 6f 31 dc f8 de 26 d1 60 d1 a9 0e Oct 31 15:24:59.316003: | 2b b8 9c 36 05 3b c4 e1 63 db 89 80 9c e2 47 e4 Oct 31 15:24:59.316004: | e9 ff 93 66 d6 ef fc a3 a4 b8 1a 6c d6 4d 68 33 Oct 31 15:24:59.316006: | 73 20 9f bf 97 c5 c3 0d 50 17 b2 d4 3d 15 6e 00 Oct 31 15:24:59.316007: | 1a ef 20 53 ba 53 f0 df 63 9f d1 41 ac 3b 2f 3d Oct 31 15:24:59.316008: | 7f c5 5b fb cd 40 1c f3 e5 94 78 d5 0d 16 81 18 Oct 31 15:24:59.316010: | 3a ee df b3 e9 23 36 5c a0 23 9d d8 32 b8 77 b6 Oct 31 15:24:59.316011: | ef 8d d2 2a d3 5e 0e 72 5c 2e d8 06 49 09 7a 56 Oct 31 15:24:59.316012: | a6 5d f5 78 68 36 fb 0d ee 8a 49 02 be 00 29 1c Oct 31 15:24:59.316014: | 5b f7 84 e7 14 b9 19 8f 53 45 cd af ea 40 bc 12 Oct 31 15:24:59.316015: | 12 63 43 74 32 a3 92 11 5b f4 ef cd e3 5c 88 fb Oct 31 15:24:59.316016: | ce ae 0b 95 c5 4b 61 34 79 fa 0d 70 f4 d7 2d 14 Oct 31 15:24:59.316018: | c0 51 85 d2 eb e1 d4 cf 58 f4 c2 44 c4 50 2f 3a Oct 31 15:24:59.316019: | 6a a8 90 d5 4a 7a 76 6d 54 92 fd 1c fe a4 69 52 Oct 31 15:24:59.316021: | dc 27 85 8a bd 64 57 88 e6 14 53 d3 0b 51 45 8c Oct 31 15:24:59.316022: | 23 43 f4 2d 02 8f 3e 26 a8 40 6e ce 9d 59 ab 28 Oct 31 15:24:59.316023: | a7 37 b4 9d 7d d0 fb bb 67 88 50 28 0f 2b e6 16 Oct 31 15:24:59.316025: | 70 84 75 c3 1f 79 ff 57 08 d6 02 b8 64 3e aa fc Oct 31 15:24:59.316026: | 34 8b d6 99 dd f7 5a 92 eb 43 f3 f5 a2 56 39 99 Oct 31 15:24:59.316027: | b2 29 38 60 dc d4 1a cf 99 54 61 e7 c7 7b 4d 39 Oct 31 15:24:59.316029: | e7 ce b1 64 26 45 69 d7 83 5c 9e 9e b0 13 6e a4 Oct 31 15:24:59.316030: | ac ca 7b b3 96 51 b5 a2 9b d9 df dd 97 74 5a 2a Oct 31 15:24:59.316031: | 3d 0b b3 d6 58 4a 29 47 b6 93 de 34 f8 3b cd bb Oct 31 15:24:59.316033: | 4c cb 53 9e 3a c2 fe 41 08 60 88 c4 80 6a af 0d Oct 31 15:24:59.316034: | 90 33 ad 30 a0 79 19 07 af 23 8e 57 f3 f0 d3 65 Oct 31 15:24:59.316036: | 31 c6 4c 78 85 a2 59 3d 41 ad 54 22 a4 62 bc a7 Oct 31 15:24:59.316038: | ef ee 21 e4 64 0f c9 92 46 22 e7 61 2a 2e 30 2d Oct 31 15:24:59.316039: | fb 89 76 a7 31 c8 35 04 1c 4f 03 c5 a6 32 d0 fd Oct 31 15:24:59.316040: | e7 ec cd 7e 84 5d 1b d8 3a 3c 52 c4 77 b1 ec a7 Oct 31 15:24:59.316042: | 52 1f ac 1c 41 b9 23 23 fb 4f a5 47 f0 b4 14 e2 Oct 31 15:24:59.316043: | 86 97 63 23 58 78 37 c0 2d b1 3a 41 de 05 cb f0 Oct 31 15:24:59.316045: | 6f f8 40 73 74 79 de 14 eb e4 8c 56 94 38 60 42 Oct 31 15:24:59.316046: | 22 93 cc da 62 14 4a 25 b1 0d 96 53 15 69 44 94 Oct 31 15:24:59.316047: | 4f b5 22 f3 f1 31 10 21 30 a6 5b 7f c4 28 e2 12 Oct 31 15:24:59.316049: | 74 85 33 4c bd cf 0a f7 e3 f2 32 f3 15 e3 d8 c2 Oct 31 15:24:59.316071: | sent 1 messages Oct 31 15:24:59.316082: | releasing #6's fd-fd@(nil) because IKEv2 transitions finished Oct 31 15:24:59.316085: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:59.316087: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) Oct 31 15:24:59.316090: | unpending #6's IKE SA #2 Oct 31 15:24:59.316092: | unpending state #2 connection "north-eastnets/0x1" Oct 31 15:24:59.316095: | releasing #2's fd-fd@(nil) because IKEv2 transitions finished so releaseing IKE SA Oct 31 15:24:59.316097: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) Oct 31 15:24:59.316099: | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) Oct 31 15:24:59.316103: | #6 will start re-keying in 28530 seconds with margin of 270 seconds (attempting re-key) Oct 31 15:24:59.316106: | state #6 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:24:59.316111: | libevent_free: delref ptr-libevent@0x7f32b0000c80 Oct 31 15:24:59.316113: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbab12940 Oct 31 15:24:59.316117: | event_schedule: newref EVENT_SA_REKEY-pe@0x559bbab12940 Oct 31 15:24:59.316120: | inserting event EVENT_SA_REKEY, timeout in 28530 seconds for #6 Oct 31 15:24:59.316123: | libevent_malloc: newref ptr-libevent@0x7f32b0000c80 size 128 Oct 31 15:24:59.316128: | delref mdp@0x559bbabc8750(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:59.316131: | delref logger@0x559bbabb4380(1->0) (in resume_handler() at server.c:743) Oct 31 15:24:59.316134: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:24:59.316136: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:24:59.316144: | #6 spent 1.5 (1.96) milliseconds in resume sending helper answer back to state Oct 31 15:24:59.316150: | stop processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in resume_handler() at server.c:745) Oct 31 15:24:59.316154: | libevent_free: delref ptr-libevent@0x7f32c40123c0 Oct 31 15:25:13.334715: | processing global timer EVENT_SHUNT_SCAN Oct 31 15:25:13.334738: | checking for aged bare shunts from shunt table to expire Oct 31 15:25:13.334747: | spent 0.00562 (0.00526) milliseconds in global timer EVENT_SHUNT_SCAN Oct 31 15:25:17.496504: | newref struct fd@0x559bbab12980(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:25:17.496531: | fd_accept: new fd-fd@0x559bbab12980 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:25:17.496544: | whack: traffic_status Oct 31 15:25:17.496547: | FOR_EACH_STATE_... in show_traffic_status (sort_states) Oct 31 15:25:17.496550: | FOR_EACH_STATE_... in sort_states Oct 31 15:25:17.496557: | get_sa_info esp.1e003267@192.1.3.33 Oct 31 15:25:17.496571: | get_sa_info esp.323e8a54@192.1.2.23 Oct 31 15:25:17.496584: | get_sa_info esp.e2910ac0@192.1.3.33 Oct 31 15:25:17.496590: | get_sa_info esp.bd68e0ed@192.1.2.23 Oct 31 15:25:17.496611: | get_sa_info esp.8a51674e@192.1.3.33 Oct 31 15:25:17.496636: | get_sa_info esp.98b3bf89@192.1.2.23 Oct 31 15:25:17.496657: | get_sa_info esp.f040d50e@192.1.3.33 Oct 31 15:25:17.496668: | get_sa_info esp.de706675@192.1.2.23 Oct 31 15:25:17.496681: | delref fd@0x559bbab12980(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:25:17.496691: | freeref fd-fd@0x559bbab12980 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:25:17.496697: | spent 0.213 (0.216) milliseconds in whack Oct 31 15:25:17.774138: | newref struct fd@0x559bbab12980(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:25:17.774155: | fd_accept: new fd-fd@0x559bbab12980 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:25:17.774166: | whack: status Oct 31 15:25:17.774416: | FOR_EACH_CONNECTION_... in show_connections_status Oct 31 15:25:17.774425: | FOR_EACH_CONNECTION_... in show_connections_status Oct 31 15:25:17.774524: | FOR_EACH_STATE_... in show_states (sort_states) Oct 31 15:25:17.774528: | FOR_EACH_STATE_... in sort_states Oct 31 15:25:17.774535: | get_sa_info esp.1e003267@192.1.3.33 Oct 31 15:25:17.774549: | get_sa_info esp.323e8a54@192.1.2.23 Oct 31 15:25:17.774565: | get_sa_info esp.e2910ac0@192.1.3.33 Oct 31 15:25:17.774572: | get_sa_info esp.bd68e0ed@192.1.2.23 Oct 31 15:25:17.774589: | get_sa_info esp.8a51674e@192.1.3.33 Oct 31 15:25:17.774595: | get_sa_info esp.98b3bf89@192.1.2.23 Oct 31 15:25:17.774607: | get_sa_info esp.f040d50e@192.1.3.33 Oct 31 15:25:17.774613: | get_sa_info esp.de706675@192.1.2.23 Oct 31 15:25:17.774628: | delref fd@0x559bbab12980(1->0) (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:25:17.774633: | freeref fd-fd@0x559bbab12980 (in whack_handle_cb() at rcv_whack.c:903) Oct 31 15:25:17.774638: | spent 0.508 (0.511) milliseconds in whack Oct 31 15:25:18.003325: | spent 0.00259 (0.00257) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:25:18.003344: | newref struct msg_digest@0x559bbabc8750(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.003350: | newref alloc logger@0x559bbabce640(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.003357: | *received 80 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:25:18.003360: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.003363: | 2e 20 25 00 00 00 00 00 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.003365: | 0a 79 c1 a1 1d 55 e8 40 fe 20 d5 d4 c5 a4 02 7c Oct 31 15:25:18.003367: | a3 c4 a3 47 eb dd e9 d1 cc 96 a6 42 c9 5f a6 7e Oct 31 15:25:18.003370: | 85 de 7a a5 a0 8b 7f 03 00 cd 1d a4 20 e8 88 bb Oct 31 15:25:18.003375: | **parse ISAKMP Message: Oct 31 15:25:18.003380: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:25:18.003384: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.003387: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:25:18.003390: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.003393: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.003396: | flags: none (0x0) Oct 31 15:25:18.003400: | Message ID: 0 (00 00 00 00) Oct 31 15:25:18.003404: | length: 80 (00 00 00 50) Oct 31 15:25:18.003407: | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) Oct 31 15:25:18.003411: | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL request Oct 31 15:25:18.003416: | State DB: found IKEv2 state #1 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:25:18.003424: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:25:18.003428: | #1 st.st_msgid_lastrecv -1 md.hdr.isa_msgid 00000000 Oct 31 15:25:18.003432: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:25:18.003435: | #1 is idle Oct 31 15:25:18.003442: | Message ID: IKE #1 not a duplicate - message request 0 is new: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.003448: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:25:18.003451: | unpacking clear payload Oct 31 15:25:18.003454: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:25:18.003461: | ***parse IKEv2 Encryption Payload: Oct 31 15:25:18.003464: | next payload type: ISAKMP_NEXT_v2D (0x2a) Oct 31 15:25:18.003467: | flags: none (0x0) Oct 31 15:25:18.003470: | length: 52 (00 34) Oct 31 15:25:18.003473: | processing payload: ISAKMP_NEXT_v2SK (len=48) Oct 31 15:25:18.003476: | #1 in state ESTABLISHED_IKE_SA: established IKE SA Oct 31 15:25:18.003507: | authenticator matched Oct 31 15:25:18.003520: | #1 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success Oct 31 15:25:18.003524: | Now let's proceed with payload (ISAKMP_NEXT_v2D) Oct 31 15:25:18.003528: | **parse IKEv2 Delete Payload: Oct 31 15:25:18.003531: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.003533: | flags: none (0x0) Oct 31 15:25:18.003537: | length: 12 (00 0c) Oct 31 15:25:18.003539: | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:25:18.003542: | SPI size: 4 (04) Oct 31 15:25:18.003546: | number of SPIs: 1 (00 01) Oct 31 15:25:18.003549: | processing payload: ISAKMP_NEXT_v2D (len=4) Oct 31 15:25:18.003551: | selected state microcode Informational Request Oct 31 15:25:18.003558: | Message ID: IKE #1 responder starting message request 0: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1 ike.wip.responder=-1->0 Oct 31 15:25:18.003562: | calling processor Informational Request Oct 31 15:25:18.003566: | an informational request should send a response Oct 31 15:25:18.003571: | opening output PBS information exchange reply packet Oct 31 15:25:18.003574: | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness Oct 31 15:25:18.003577: | **emit ISAKMP Message: Oct 31 15:25:18.003581: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:25:18.003585: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.003588: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:25:18.003591: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.003593: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.003597: | flags: ISAKMP_FLAG_v2_IKE_INIT+ISAKMP_FLAG_v2_MSG_RESPONSE (0x28) Oct 31 15:25:18.003600: | Message ID: 0 (00 00 00 00) Oct 31 15:25:18.003603: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:25:18.003607: | ***emit IKEv2 Encryption Payload: Oct 31 15:25:18.003609: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.003612: | flags: none (0x0) Oct 31 15:25:18.003615: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:25:18.003618: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.003621: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:25:18.003627: | parsing 4 raw bytes of IKEv2 Delete Payload into SPI Oct 31 15:25:18.003630: | SPI Oct 31 15:25:18.003632: | 98 b3 bf 89 Oct 31 15:25:18.003635: | delete IKEv2_SEC_PROTO_ESP SA(0x98b3bf89) Oct 31 15:25:18.003638: | v2 CHILD SA #4 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA Oct 31 15:25:18.003641: | State DB: found IKEv2 state #4 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) Oct 31 15:25:18.003644: | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0x98b3bf89) Oct 31 15:25:18.003648: "north-eastnets/0x2" #1: received Delete SA payload: replace IPsec State #4 now Oct 31 15:25:18.003652: | #4 requesting EVENT_SA_REKEY-pe@0x559bbabd0d80 be deleted Oct 31 15:25:18.003655: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:25:18.003658: | free_event_entry: delref EVENT_SA_REKEY-pe@0x559bbabd0d80 Oct 31 15:25:18.003661: | event_schedule: newref EVENT_SA_REPLACE-pe@0x559bbabd0d80 Oct 31 15:25:18.003664: | inserting event EVENT_SA_REPLACE, timeout in 0 seconds for #4 Oct 31 15:25:18.003667: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:25:18.003673: | ****emit IKEv2 Delete Payload: Oct 31 15:25:18.003676: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.003678: | flags: none (0x0) Oct 31 15:25:18.003681: | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:25:18.003684: | SPI size: 4 (04) Oct 31 15:25:18.003687: | number of SPIs: 1 (00 01) Oct 31 15:25:18.003690: | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) Oct 31 15:25:18.003692: | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.003696: | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload Oct 31 15:25:18.003700: | local SPIs: 8a 51 67 4e Oct 31 15:25:18.003702: | emitting length of IKEv2 Delete Payload: 12 Oct 31 15:25:18.003704: | adding 4 bytes of padding (including 1 byte padding-length) Oct 31 15:25:18.003707: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.003710: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.003712: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.003715: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.003718: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:25:18.003720: | emitting length of IKEv2 Encryption Payload: 52 Oct 31 15:25:18.003723: | emitting length of ISAKMP Message: 80 Oct 31 15:25:18.003755: | sending 80 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #1) Oct 31 15:25:18.003760: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.003762: | 2e 20 25 28 00 00 00 00 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.003764: | 1a c7 06 1f c6 73 ee 7c 9f 69 03 11 da 16 31 97 Oct 31 15:25:18.003767: | 14 6b e3 36 95 ef b7 a8 7e c8 3d 6b ce e2 c5 e2 Oct 31 15:25:18.003769: | 37 4e d9 8d 63 d3 47 fb 83 2a f6 8a 79 0b c4 ae Oct 31 15:25:18.003797: | sent 1 messages Oct 31 15:25:18.003806: | Message ID: IKE #1 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1 ike.wip.responder=0 Oct 31 15:25:18.003813: | Message ID: IKE #1 updating responder sent message response 0: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=-1->0 ike.responder.recv=-1 ike.responder.last_contact=744568.227774 ike.wip.initiator=-1 ike.wip.responder=0 Oct 31 15:25:18.003821: | #1 spent 0.237 (0.253) milliseconds in processing: Informational Request in v2_dispatch() Oct 31 15:25:18.003827: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:25:18.003832: | #1 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_I0->PARENT_I1 Oct 31 15:25:18.003835: | Message ID: updating counters for #1 Oct 31 15:25:18.003842: | Message ID: IKE #1 updating responder received message request 0: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=0 ike.responder.recv=-1->0 ike.responder.last_contact=744568.227774->744592.436634 ike.wip.initiator=-1 ike.wip.responder=0->-1 Oct 31 15:25:18.003849: | Message ID: IKE #1 updating responder sent message response 0: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744592.436634 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.003857: | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744592.436634 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.003861: | announcing the state transition Oct 31 15:25:18.003864: "north-eastnets/0x2" #1: established IKE SA Oct 31 15:25:18.003871: | sending 80 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #1) Oct 31 15:25:18.003874: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.003876: | 2e 20 25 28 00 00 00 00 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.003878: | 1a c7 06 1f c6 73 ee 7c 9f 69 03 11 da 16 31 97 Oct 31 15:25:18.003880: | 14 6b e3 36 95 ef b7 a8 7e c8 3d 6b ce e2 c5 e2 Oct 31 15:25:18.003882: | 37 4e d9 8d 63 d3 47 fb 83 2a f6 8a 79 0b c4 ae Oct 31 15:25:18.003897: | sent 1 messages Oct 31 15:25:18.003902: | #1 is retaining EVENT_SA_REKEY with is previously set timeout Oct 31 15:25:18.003907: | stop processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:25:18.003913: | #1 spent 0.576 (0.596) milliseconds in ikev2_process_packet() Oct 31 15:25:18.003916: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:25:18.003919: | delref mdp@0x559bbabc8750(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.003922: | delref logger@0x559bbabce640(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.003926: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.003928: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.003933: | spent 0.596 (0.616) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:25:18.003940: | timer_event_cb: processing event@0x559bbabd0d80 Oct 31 15:25:18.003944: | handling event EVENT_SA_REPLACE for child state #4 Oct 31 15:25:18.003947: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:25:18.003949: | free_event_entry: delref EVENT_SA_REPLACE-pe@0x559bbabd0d80 Oct 31 15:25:18.003955: | start processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in timer_event_cb() at timer.c:188) Oct 31 15:25:18.003959: | picked newest_ipsec_sa #4 for #4 Oct 31 15:25:18.003962: | replacing stale CHILD SA Oct 31 15:25:18.003966: | FOR_EACH_STATE_... in find_phase1_state Oct 31 15:25:18.003970: | FOR_EACH_STATE_... in find_pending_phase2 Oct 31 15:25:18.003976: | newref alloc logger@0x559bbabce640(0->1) (in new_state() at state.c:576) Oct 31 15:25:18.003979: | addref fd@NULL (in new_state() at state.c:577) Oct 31 15:25:18.003981: | creating state object #7 at 0x559bbabc8750 Oct 31 15:25:18.003984: | State DB: adding IKEv2 state #7 in UNDEFINED Oct 31 15:25:18.003989: | pstats #7 ikev2.child started Oct 31 15:25:18.003992: | duplicating state object #2 "north-eastnets/0x2" as #7 for IPSEC SA Oct 31 15:25:18.003998: | #7 setting local endpoint to 192.1.3.33:500 from #2.st_localport (in duplicate_state() at state.c:1581) Oct 31 15:25:18.004006: | Message ID: CHILD #2.#7 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744573.748758 child.wip.initiator=0->-1 child.wip.responder=0->-1 Oct 31 15:25:18.004010: | child state #7: UNDEFINED(ignore) => V2_REKEY_CHILD_I0(established IKE SA) Oct 31 15:25:18.004015: | #7.st_v2_transition NULL -> V2_REKEY_CHILD_I0->V2_REKEY_CHILD_I1 (in new_v2_child_state() at state.c:1666) Oct 31 15:25:18.004020: | suspend processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:5960) Oct 31 15:25:18.004025: | start processing: state #7 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:5960) Oct 31 15:25:18.004033: | using existing local ESP/AH proposals for north-eastnets/0x2 (ESP/AH initiator emitting proposals): 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED Oct 31 15:25:18.004041: | #7 schedule rekey initiate IPsec SA RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 to replace #4 using IKE# 2 pfs=MODP3072 Oct 31 15:25:18.004045: | event_schedule: newref EVENT_v2_INITIATE_CHILD-pe@0x559bbabcdb10 Oct 31 15:25:18.004048: | inserting event EVENT_v2_INITIATE_CHILD, timeout in 0 seconds for #7 Oct 31 15:25:18.004051: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:25:18.004057: | RESET processing: state #7 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:6035) Oct 31 15:25:18.004060: | event_schedule: newref EVENT_SA_EXPIRE-pe@0x559bbabd0d80 Oct 31 15:25:18.004063: | inserting event EVENT_SA_EXPIRE, timeout in 0 seconds for #4 Oct 31 15:25:18.004065: | libevent_malloc: newref ptr-libevent@0x7f32c40123c0 size 128 Oct 31 15:25:18.004071: | #4 spent 0.129 (0.129) milliseconds in timer_event_cb() EVENT_SA_REPLACE Oct 31 15:25:18.004074: | processing: STOP state #0 (in timer_event_cb() at timer.c:447) Oct 31 15:25:18.004080: | timer_event_cb: processing event@0x559bbabcdb10 Oct 31 15:25:18.004082: | handling event EVENT_v2_INITIATE_CHILD for child state #7 Oct 31 15:25:18.004085: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:25:18.004087: | free_event_entry: delref EVENT_v2_INITIATE_CHILD-pe@0x559bbabcdb10 Oct 31 15:25:18.004092: | start processing: state #7 connection "north-eastnets/0x2" from 192.1.2.23:500 (in timer_event_cb() at timer.c:188) Oct 31 15:25:18.004098: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:25:18.004101: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:25:18.004105: | newref clone logger@0x559bbabc4000(0->1) (in clone_logger() at log.c:817) Oct 31 15:25:18.004108: | job 11 for #7: Child Rekey Initiator KE and nonce ni (build KE and nonce): adding job to queue Oct 31 15:25:18.004111: | state #7 has no .st_event to delete Oct 31 15:25:18.004113: | #7 STATE_V2_REKEY_CHILD_I0: retransmits: cleared Oct 31 15:25:18.004116: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabcdb10 Oct 31 15:25:18.004118: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #7 Oct 31 15:25:18.004121: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:25:18.004132: | #7 spent 0.0503 (0.0503) milliseconds in timer_event_cb() EVENT_v2_INITIATE_CHILD Oct 31 15:25:18.004137: | stop processing: state #7 connection "north-eastnets/0x2" from 192.1.2.23:500 (in timer_event_cb() at timer.c:447) Oct 31 15:25:18.004141: | timer_event_cb: processing event@0x559bbabd0d80 Oct 31 15:25:18.004143: | handling event EVENT_SA_EXPIRE for child state #4 Oct 31 15:25:18.004146: | libevent_free: delref ptr-libevent@0x7f32c40123c0 Oct 31 15:25:18.004149: | free_event_entry: delref EVENT_SA_EXPIRE-pe@0x559bbabd0d80 Oct 31 15:25:18.004153: | start processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in timer_event_cb() at timer.c:188) Oct 31 15:25:18.004157: | picked newest_ipsec_sa #4 for #4 Oct 31 15:25:18.004160: | un-established partial CHILD SA timeout (SA expired) Oct 31 15:25:18.004162: | pstats #4 ikev2.child re-failed exchange-timeout Oct 31 15:25:18.004165: | should_send_delete: no, just because Oct 31 15:25:18.004167: | pstats #4 ikev2.child deleted completed Oct 31 15:25:18.004171: | #4 main thread spent 1.61 (1.63) milliseconds helper thread spent 6.9 (2.01e+03) milliseconds in total Oct 31 15:25:18.004176: | [RE]START processing: state #4 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.004179: | should_send_delete: no, just because Oct 31 15:25:18.004183: "north-eastnets/0x2" #4: deleting state (STATE_V2_ESTABLISHED_CHILD_SA) aged 21.056866s and NOT sending notification Oct 31 15:25:18.004186: | child state #4: ESTABLISHED_CHILD_SA(established CHILD SA) => delete Oct 31 15:25:18.004191: | get_sa_info esp.98b3bf89@192.1.2.23 Oct 31 15:25:18.004212: | get_sa_info esp.8a51674e@192.1.3.33 Oct 31 15:25:18.004227: "north-eastnets/0x2" #4: ESP traffic information: in=27MB out=27MB Oct 31 15:25:18.004232: | unsuspending #4 MD (nil) Oct 31 15:25:18.004235: | should_send_delete: no, just because Oct 31 15:25:18.004238: | child state #4: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) Oct 31 15:25:18.004241: | state #4 has no .st_event to delete Oct 31 15:25:18.004243: | #4 STATE_CHILDSA_DEL: retransmits: cleared Oct 31 15:25:18.004340: | job 11 for #7: Child Rekey Initiator KE and nonce ni (build KE and nonce): helper 2 starting job Oct 31 15:25:18.004346: | helper 2 is pausing for 1 seconds Oct 31 15:25:18.005673: | running updown command "ipsec _updown" for verb down Oct 31 15:25:18.005688: | command executing down-client Oct 31 15:25:18.005696: | get_sa_info esp.98b3bf89@192.1.2.23 Oct 31 15:25:18.005713: | get_sa_info esp.8a51674e@192.1.3.33 Oct 31 15:25:18.005757: | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157898' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFI... Oct 31 15:25:18.005762: | popen cmd is 1158 chars long Oct 31 15:25:18.005765: | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x: Oct 31 15:25:18.005768: | cmd( 80):2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO: Oct 31 15:25:18.005771: | cmd( 160):_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIEN: Oct 31 15:25:18.005773: | cmd( 240):T='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.2: Oct 31 15:25:18.005775: | cmd( 320):55.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TY: Oct 31 15:25:18.005777: | cmd( 400):PE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.: Oct 31 15:25:18.005780: | cmd( 480):22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.255.: Oct 31 15:25:18.005782: | cmd( 560):0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfr: Oct 31 15:25:18.005785: | cmd( 640):m' PLUTO_ADDTIME='1604157898' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS: Oct 31 15:25:18.005787: | cmd( 720):+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT: Oct 31 15:25:18.005789: | cmd( 800):' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER: Oct 31 15:25:18.005791: | cmd( 880):_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0': Oct 31 15:25:18.005793: | cmd( 960): PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='28581672' PLUTO_OUT: Oct 31 15:25:18.005796: | cmd(1040):BYTES='28581756' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x98b3bf89: Oct 31 15:25:18.005798: | cmd(1120): SPI_OUT=0x8a51674e ipsec _updown 2>&1: Oct 31 15:25:18.023202: | shunt_eroute() called for connection 'north-eastnets/0x2' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.3.0/24:0 --0->- 192.0.22.0/24:0 Oct 31 15:25:18.023220: | netlink_shunt_eroute for proto 0, and source 192.0.3.0/24:0 dest 192.0.22.0/24:0 Oct 31 15:25:18.023226: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:25:18.023235: | IPsec SA SPD priority set to 2084814 Oct 31 15:25:18.023406: | delete esp.98b3bf89@192.1.2.23 Oct 31 15:25:18.023413: | XFRM: deleting IPsec SA with reqid 0 Oct 31 15:25:18.023496: | netlink response for Del SA esp.98b3bf89@192.1.2.23 included non-error error Oct 31 15:25:18.023502: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:25:18.023700: | delete inbound eroute 192.0.22.0/24:0 --0-> 192.0.3.0/24:0 => unk.10000@192.1.3.33 using reqid 0 (raw_eroute) proto=50 Oct 31 15:25:18.023740: | raw_eroute result=success Oct 31 15:25:18.023748: | delete esp.8a51674e@192.1.3.33 Oct 31 15:25:18.023751: | XFRM: deleting IPsec SA with reqid 0 Oct 31 15:25:18.023765: | netlink response for Del SA esp.8a51674e@192.1.3.33 included non-error error Oct 31 15:25:18.023772: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:25:18.023839: | State DB: deleting IKEv2 state #4 in CHILDSA_DEL Oct 31 15:25:18.023847: | child state #4: CHILDSA_DEL(informational) => UNDEFINED(ignore) Oct 31 15:25:18.023851: | releasing #4's fd-fd@(nil) because deleting state Oct 31 15:25:18.023854: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.023857: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.023860: | delref pkp@NULL (in delete_state() at state.c:1202) Oct 31 15:25:18.023884: | stop processing: state #4 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.023895: | delref logger@0x559bbabce5f0(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:18.023899: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.023902: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.023906: | State DB: found IKEv2 state #3 in ESTABLISHED_CHILD_SA (v2_expire_unused_ike_sa) Oct 31 15:25:18.023909: | can't expire unused IKE SA #1; it has the child #3 Oct 31 15:25:18.023913: | in statetime_stop() and could not find #4 Oct 31 15:25:18.023916: | processing: STOP state #0 (in timer_event_cb() at timer.c:447) Oct 31 15:25:18.023937: | spent 0.00211 (0.00211) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:25:18.023948: | newref struct msg_digest@0x559bbabdd030(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.023953: | newref alloc logger@0x7f32b4001980(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.023959: | *received 80 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:25:18.023962: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.023965: | 2e 20 25 08 00 00 00 03 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.023967: | 1e d2 c3 c4 6a ac 19 b5 3d e8 68 3d 97 e5 df 62 Oct 31 15:25:18.023969: | f6 46 a9 90 48 61 69 dc 9e 34 11 ab 2d 5b 36 a5 Oct 31 15:25:18.023972: | 34 21 0e ba 41 18 7a 4f c7 40 1c ac 14 dd 8b 75 Oct 31 15:25:18.023977: | **parse ISAKMP Message: Oct 31 15:25:18.023982: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:25:18.023986: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.023990: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:25:18.023993: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.023996: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.023999: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:25:18.024003: | Message ID: 3 (00 00 00 03) Oct 31 15:25:18.024007: | length: 80 (00 00 00 50) Oct 31 15:25:18.024010: | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) Oct 31 15:25:18.024014: | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request Oct 31 15:25:18.024018: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:25:18.024026: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:25:18.024030: | #2 st.st_msgid_lastrecv 2 md.hdr.isa_msgid 00000003 Oct 31 15:25:18.024036: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:25:18.024039: | #2 is idle Oct 31 15:25:18.024047: | Message ID: IKE #2 not a duplicate - message request 3 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744573.748758 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.024052: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:25:18.024055: | unpacking clear payload Oct 31 15:25:18.024058: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:25:18.024062: | ***parse IKEv2 Encryption Payload: Oct 31 15:25:18.024065: | next payload type: ISAKMP_NEXT_v2D (0x2a) Oct 31 15:25:18.024068: | flags: none (0x0) Oct 31 15:25:18.024071: | length: 52 (00 34) Oct 31 15:25:18.024074: | processing payload: ISAKMP_NEXT_v2SK (len=48) Oct 31 15:25:18.024076: | #2 in state ESTABLISHED_IKE_SA: established IKE SA Oct 31 15:25:18.024113: | authenticator matched Oct 31 15:25:18.024127: | #2 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success Oct 31 15:25:18.024131: | Now let's proceed with payload (ISAKMP_NEXT_v2D) Oct 31 15:25:18.024135: | **parse IKEv2 Delete Payload: Oct 31 15:25:18.024209: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.024214: | flags: none (0x0) Oct 31 15:25:18.024218: | length: 12 (00 0c) Oct 31 15:25:18.024220: | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:25:18.024223: | SPI size: 4 (04) Oct 31 15:25:18.024227: | number of SPIs: 1 (00 01) Oct 31 15:25:18.024229: | processing payload: ISAKMP_NEXT_v2D (len=4) Oct 31 15:25:18.024233: | selected state microcode Informational Request Oct 31 15:25:18.024240: | Message ID: IKE #2 responder starting message request 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744573.748758 ike.wip.initiator=-1 ike.wip.responder=-1->3 Oct 31 15:25:18.024243: | calling processor Informational Request Oct 31 15:25:18.024247: | an informational request should send a response Oct 31 15:25:18.024252: | opening output PBS information exchange reply packet Oct 31 15:25:18.024255: | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness Oct 31 15:25:18.024258: | **emit ISAKMP Message: Oct 31 15:25:18.024263: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:25:18.024267: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.024270: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:25:18.024273: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.024275: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.024278: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:25:18.024281: | Message ID: 3 (00 00 00 03) Oct 31 15:25:18.024285: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:25:18.024289: | ***emit IKEv2 Encryption Payload: Oct 31 15:25:18.024292: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.024294: | flags: none (0x0) Oct 31 15:25:18.024297: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:25:18.024300: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.024304: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:25:18.024314: | parsing 4 raw bytes of IKEv2 Delete Payload into SPI Oct 31 15:25:18.024317: | SPI Oct 31 15:25:18.024319: | de 70 66 75 Oct 31 15:25:18.024322: | delete IKEv2_SEC_PROTO_ESP SA(0xde706675) Oct 31 15:25:18.024326: | v2 CHILD SA #5 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA Oct 31 15:25:18.024329: | State DB: found IKEv2 state #5 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) Oct 31 15:25:18.024334: | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0xde706675) Oct 31 15:25:18.024338: "north-eastnets/0x2" #2: received Delete SA payload: delete IPsec State #5 now Oct 31 15:25:18.024342: | pstats #5 ikev2.child deleted completed Oct 31 15:25:18.024347: | #5 main thread spent 0 (0) milliseconds helper thread spent 0 (0) milliseconds in total Oct 31 15:25:18.024352: | suspend processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.024357: | start processing: state #5 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.024360: | should_send_delete: no, just because Oct 31 15:25:18.024365: "north-eastnets/0x2" #5: deleting other state #5 (STATE_V2_ESTABLISHED_CHILD_SA) aged 20.971348s and NOT sending notification Oct 31 15:25:18.024368: | child state #5: ESTABLISHED_CHILD_SA(established CHILD SA) => delete Oct 31 15:25:18.024374: | get_sa_info esp.de706675@192.1.2.23 Oct 31 15:25:18.024510: | get_sa_info esp.f040d50e@192.1.3.33 Oct 31 15:25:18.024524: "north-eastnets/0x2" #5: ESP traffic information: in=4MB out=4MB Oct 31 15:25:18.024529: | unsuspending #5 MD (nil) Oct 31 15:25:18.024532: | should_send_delete: no, just because Oct 31 15:25:18.024535: | child state #5: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) Oct 31 15:25:18.024539: | state #5 deleting .st_event EVENT_SA_REKEY Oct 31 15:25:18.024544: | libevent_free: delref ptr-libevent@0x7f32c8002790 Oct 31 15:25:18.024547: | free_event_entry: delref EVENT_SA_REKEY-pe@0x559bbab82620 Oct 31 15:25:18.024550: | #5 STATE_CHILDSA_DEL: retransmits: cleared Oct 31 15:25:18.024663: | delete esp.de706675@192.1.2.23 Oct 31 15:25:18.024669: | XFRM: deleting IPsec SA with reqid 0 Oct 31 15:25:18.024691: | netlink response for Del SA esp.de706675@192.1.2.23 included non-error error Oct 31 15:25:18.024696: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:25:18.024705: | delete inbound eroute 192.0.22.0/24:0 --0-> 192.0.3.0/24:0 => unk.10000@192.1.3.33 using reqid 0 (raw_eroute) proto=50 Oct 31 15:25:18.024719: | raw_eroute result=success Oct 31 15:25:18.024725: | delete esp.f040d50e@192.1.3.33 Oct 31 15:25:18.024728: | XFRM: deleting IPsec SA with reqid 0 Oct 31 15:25:18.024742: | netlink response for Del SA esp.f040d50e@192.1.3.33 included non-error error Oct 31 15:25:18.024748: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:25:18.024751: | State DB: deleting IKEv2 state #5 in CHILDSA_DEL Oct 31 15:25:18.024756: | child state #5: CHILDSA_DEL(informational) => UNDEFINED(ignore) Oct 31 15:25:18.024759: | releasing #5's fd-fd@(nil) because deleting state Oct 31 15:25:18.024761: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.024764: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.024767: | delref pkp@NULL (in delete_state() at state.c:1202) Oct 31 15:25:18.024772: | stop processing: state #5 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.024777: | resume processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.024784: | delref logger@0x559bbabb00e0(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:18.024787: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.024790: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.024793: | ****emit IKEv2 Delete Payload: Oct 31 15:25:18.024796: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.024798: | flags: none (0x0) Oct 31 15:25:18.024801: | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:25:18.024805: | SPI size: 4 (04) Oct 31 15:25:18.024808: | number of SPIs: 1 (00 01) Oct 31 15:25:18.024872: | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) Oct 31 15:25:18.024877: | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.024885: | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload Oct 31 15:25:18.024889: | local SPIs: f0 40 d5 0e Oct 31 15:25:18.024892: | emitting length of IKEv2 Delete Payload: 12 Oct 31 15:25:18.024895: | adding 4 bytes of padding (including 1 byte padding-length) Oct 31 15:25:18.024898: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.024901: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.024904: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.024906: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.024909: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:25:18.024912: | emitting length of IKEv2 Encryption Payload: 52 Oct 31 15:25:18.024914: | emitting length of ISAKMP Message: 80 Oct 31 15:25:18.024954: | sending 80 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #2) Oct 31 15:25:18.024959: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.024962: | 2e 20 25 20 00 00 00 03 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.024964: | 1e fb c4 6b 17 ea 10 58 02 8a 17 fa 73 ab ba 1b Oct 31 15:25:18.024966: | 19 b2 86 5b d0 90 64 f1 a2 2a f9 2e 85 c4 b6 c2 Oct 31 15:25:18.024969: | c7 d8 02 2c b2 41 58 2c 0e 3a fd 7b 5d e0 e4 ba Oct 31 15:25:18.025010: | sent 1 messages Oct 31 15:25:18.025020: | Message ID: IKE #2 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744573.748758 ike.wip.initiator=-1 ike.wip.responder=3 Oct 31 15:25:18.025028: | Message ID: IKE #2 updating responder sent message response 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=2->3 ike.responder.recv=2 ike.responder.last_contact=744573.748758 ike.wip.initiator=-1 ike.wip.responder=3 Oct 31 15:25:18.025037: | #2 spent 0.548 (0.787) milliseconds in processing: Informational Request in v2_dispatch() Oct 31 15:25:18.025044: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:25:18.025049: | #2 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_R0->PARENT_R1 Oct 31 15:25:18.025052: | Message ID: updating counters for #2 Oct 31 15:25:18.025060: | Message ID: IKE #2 updating responder received message request 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=3 ike.responder.recv=2->3 ike.responder.last_contact=744573.748758->744592.457851 ike.wip.initiator=-1 ike.wip.responder=3->-1 Oct 31 15:25:18.025066: | Message ID: IKE #2 updating responder sent message response 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=3 ike.responder.recv=3 ike.responder.last_contact=744592.457851 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.025073: | Message ID: IKE #2 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=3 ike.responder.recv=3 ike.responder.last_contact=744592.457851 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.025076: | announcing the state transition Oct 31 15:25:18.025079: "north-eastnets/0x2" #2: established IKE SA Oct 31 15:25:18.025086: | sending 80 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #2) Oct 31 15:25:18.025088: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.025093: | 2e 20 25 20 00 00 00 03 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.025096: | 1e fb c4 6b 17 ea 10 58 02 8a 17 fa 73 ab ba 1b Oct 31 15:25:18.025098: | 19 b2 86 5b d0 90 64 f1 a2 2a f9 2e 85 c4 b6 c2 Oct 31 15:25:18.025100: | c7 d8 02 2c b2 41 58 2c 0e 3a fd 7b 5d e0 e4 ba Oct 31 15:25:18.025116: | sent 1 messages Oct 31 15:25:18.025121: | #2 is retaining EVENT_SA_REKEY with is previously set timeout Oct 31 15:25:18.025127: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:25:18.025133: | #2 spent 0.898 (1.2) milliseconds in ikev2_process_packet() Oct 31 15:25:18.025136: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:25:18.025139: | delref mdp@0x559bbabdd030(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.025143: | delref logger@0x7f32b4001980(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.025146: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.025148: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.025153: | spent 0.919 (1.22) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:25:18.025162: | processing signal PLUTO_SIGCHLD Oct 31 15:25:18.025168: | waitpid returned ECHILD (no child processes left) Oct 31 15:25:18.025261: | spent 0.0057 (0.00565) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:25:18.025280: | spent 0.00164 (0.00162) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:25:18.025290: | newref struct msg_digest@0x559bbabdd030(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.025294: | newref alloc logger@0x559bbabb00e0(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.025301: | *received 80 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:25:18.025304: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.025306: | 2e 20 25 08 00 00 00 04 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.025308: | b6 24 57 50 97 03 72 63 73 fc 1b e6 be ea a4 b7 Oct 31 15:25:18.025310: | 20 26 e8 0c 80 0f 60 83 9f 44 83 10 a4 81 65 c4 Oct 31 15:25:18.025313: | 85 f5 8d 4f 50 fa 45 f9 60 74 e1 db 81 e2 41 75 Oct 31 15:25:18.025316: | **parse ISAKMP Message: Oct 31 15:25:18.025321: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:25:18.025325: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.025328: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:25:18.025331: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.025334: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.025337: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:25:18.025341: | Message ID: 4 (00 00 00 04) Oct 31 15:25:18.025345: | length: 80 (00 00 00 50) Oct 31 15:25:18.025348: | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) Oct 31 15:25:18.025352: | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request Oct 31 15:25:18.025356: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:25:18.025363: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:25:18.025366: | #2 st.st_msgid_lastrecv 3 md.hdr.isa_msgid 00000004 Oct 31 15:25:18.025369: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:25:18.025372: | #2 is idle Oct 31 15:25:18.025379: | Message ID: IKE #2 not a duplicate - message request 4 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=3 ike.responder.recv=3 ike.responder.last_contact=744592.457851 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.025385: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:25:18.025388: | unpacking clear payload Oct 31 15:25:18.025390: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:25:18.025396: | ***parse IKEv2 Encryption Payload: Oct 31 15:25:18.025399: | next payload type: ISAKMP_NEXT_v2D (0x2a) Oct 31 15:25:18.025402: | flags: none (0x0) Oct 31 15:25:18.025405: | length: 52 (00 34) Oct 31 15:25:18.025408: | processing payload: ISAKMP_NEXT_v2SK (len=48) Oct 31 15:25:18.025416: | #2 in state ESTABLISHED_IKE_SA: established IKE SA Oct 31 15:25:18.025439: | authenticator matched Oct 31 15:25:18.025450: | #2 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success Oct 31 15:25:18.025454: | Now let's proceed with payload (ISAKMP_NEXT_v2D) Oct 31 15:25:18.025457: | **parse IKEv2 Delete Payload: Oct 31 15:25:18.025460: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.025463: | flags: none (0x0) Oct 31 15:25:18.025466: | length: 12 (00 0c) Oct 31 15:25:18.025468: | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:25:18.025471: | SPI size: 4 (04) Oct 31 15:25:18.025474: | number of SPIs: 1 (00 01) Oct 31 15:25:18.025477: | processing payload: ISAKMP_NEXT_v2D (len=4) Oct 31 15:25:18.025540: | selected state microcode Informational Request Oct 31 15:25:18.025551: | Message ID: IKE #2 responder starting message request 4: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=3 ike.responder.recv=3 ike.responder.last_contact=744592.457851 ike.wip.initiator=-1 ike.wip.responder=-1->4 Oct 31 15:25:18.025554: | calling processor Informational Request Oct 31 15:25:18.025558: | an informational request should send a response Oct 31 15:25:18.025563: | opening output PBS information exchange reply packet Oct 31 15:25:18.025566: | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness Oct 31 15:25:18.025569: | **emit ISAKMP Message: Oct 31 15:25:18.025573: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:25:18.025576: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.025579: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:25:18.025581: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.025584: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.025587: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:25:18.025591: | Message ID: 4 (00 00 00 04) Oct 31 15:25:18.025594: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:25:18.025597: | ***emit IKEv2 Encryption Payload: Oct 31 15:25:18.025599: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.025601: | flags: none (0x0) Oct 31 15:25:18.025604: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:25:18.025607: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.025610: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:25:18.025617: | parsing 4 raw bytes of IKEv2 Delete Payload into SPI Oct 31 15:25:18.025620: | SPI Oct 31 15:25:18.025622: | bd 68 e0 ed Oct 31 15:25:18.025625: | delete IKEv2_SEC_PROTO_ESP SA(0xbd68e0ed) Oct 31 15:25:18.025689: | v2 CHILD SA #6 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA Oct 31 15:25:18.025695: | State DB: found IKEv2 state #6 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) Oct 31 15:25:18.025698: | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0xbd68e0ed) Oct 31 15:25:18.025702: "north-eastnets/0x2" #2: received Delete SA payload: replace IPsec State #6 now Oct 31 15:25:18.025706: | #6 requesting EVENT_SA_REKEY-pe@0x559bbab12940 be deleted Oct 31 15:25:18.025710: | libevent_free: delref ptr-libevent@0x7f32b0000c80 Oct 31 15:25:18.025714: | free_event_entry: delref EVENT_SA_REKEY-pe@0x559bbab12940 Oct 31 15:25:18.025717: | event_schedule: newref EVENT_SA_REPLACE-pe@0x559bbab12940 Oct 31 15:25:18.025720: | inserting event EVENT_SA_REPLACE, timeout in 0 seconds for #6 Oct 31 15:25:18.025723: | libevent_malloc: newref ptr-libevent@0x7f32b0000c80 size 128 Oct 31 15:25:18.025730: | ****emit IKEv2 Delete Payload: Oct 31 15:25:18.025733: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.025736: | flags: none (0x0) Oct 31 15:25:18.025738: | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:25:18.025742: | SPI size: 4 (04) Oct 31 15:25:18.025745: | number of SPIs: 1 (00 01) Oct 31 15:25:18.025748: | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) Oct 31 15:25:18.025751: | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.025754: | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload Oct 31 15:25:18.025758: | local SPIs: e2 91 0a c0 Oct 31 15:25:18.025761: | emitting length of IKEv2 Delete Payload: 12 Oct 31 15:25:18.025763: | adding 4 bytes of padding (including 1 byte padding-length) Oct 31 15:25:18.025766: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.025769: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.025772: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.025775: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.025777: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:25:18.025780: | emitting length of IKEv2 Encryption Payload: 52 Oct 31 15:25:18.025782: | emitting length of ISAKMP Message: 80 Oct 31 15:25:18.025815: | sending 80 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #2) Oct 31 15:25:18.025820: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.025823: | 2e 20 25 20 00 00 00 04 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.025825: | db 6f 6d 0b 00 1f 88 8c 7f fc c2 50 d4 33 9c 4b Oct 31 15:25:18.025828: | db 9c 2e b9 59 0d ce 03 12 fc e4 16 51 53 41 d8 Oct 31 15:25:18.025830: | bf 4f 9c 10 45 a4 c6 0b a7 4d 45 4d 02 0c e1 71 Oct 31 15:25:18.025909: | sent 1 messages Oct 31 15:25:18.025919: | Message ID: IKE #2 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=3 ike.responder.recv=3 ike.responder.last_contact=744592.457851 ike.wip.initiator=-1 ike.wip.responder=4 Oct 31 15:25:18.025927: | Message ID: IKE #2 updating responder sent message response 4: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=3->4 ike.responder.recv=3 ike.responder.last_contact=744592.457851 ike.wip.initiator=-1 ike.wip.responder=4 Oct 31 15:25:18.025934: | #2 spent 0.257 (0.374) milliseconds in processing: Informational Request in v2_dispatch() Oct 31 15:25:18.025941: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:25:18.025945: | #2 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_R0->PARENT_R1 Oct 31 15:25:18.025948: | Message ID: updating counters for #2 Oct 31 15:25:18.025955: | Message ID: IKE #2 updating responder received message request 4: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=4 ike.responder.recv=3->4 ike.responder.last_contact=744592.457851->744592.458747 ike.wip.initiator=-1 ike.wip.responder=4->-1 Oct 31 15:25:18.025963: | Message ID: IKE #2 updating responder sent message response 4: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=4 ike.responder.recv=4 ike.responder.last_contact=744592.458747 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.025972: | Message ID: IKE #2 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=4 ike.responder.recv=4 ike.responder.last_contact=744592.458747 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.025975: | announcing the state transition Oct 31 15:25:18.025979: "north-eastnets/0x2" #2: established IKE SA Oct 31 15:25:18.025986: | sending 80 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #2) Oct 31 15:25:18.025989: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.025992: | 2e 20 25 20 00 00 00 04 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.025994: | db 6f 6d 0b 00 1f 88 8c 7f fc c2 50 d4 33 9c 4b Oct 31 15:25:18.025997: | db 9c 2e b9 59 0d ce 03 12 fc e4 16 51 53 41 d8 Oct 31 15:25:18.025999: | bf 4f 9c 10 45 a4 c6 0b a7 4d 45 4d 02 0c e1 71 Oct 31 15:25:18.026018: | sent 1 messages Oct 31 15:25:18.026023: | #2 is retaining EVENT_SA_REKEY with is previously set timeout Oct 31 15:25:18.026030: | stop processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:25:18.026036: | #2 spent 0.577 (0.759) milliseconds in ikev2_process_packet() Oct 31 15:25:18.026039: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:25:18.026042: | delref mdp@0x559bbabdd030(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.026046: | delref logger@0x559bbabb00e0(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.026049: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.026051: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.026057: | spent 0.598 (0.78) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:25:18.026064: | timer_event_cb: processing event@0x559bbab12940 Oct 31 15:25:18.026067: | handling event EVENT_SA_REPLACE for child state #6 Oct 31 15:25:18.026070: | libevent_free: delref ptr-libevent@0x7f32b0000c80 Oct 31 15:25:18.026072: | free_event_entry: delref EVENT_SA_REPLACE-pe@0x559bbab12940 Oct 31 15:25:18.026078: | start processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in timer_event_cb() at timer.c:188) Oct 31 15:25:18.026083: | picked newest_ipsec_sa #6 for #6 Oct 31 15:25:18.026086: | replacing stale CHILD SA Oct 31 15:25:18.026089: | FOR_EACH_STATE_... in find_phase1_state Oct 31 15:25:18.026094: | FOR_EACH_STATE_... in find_pending_phase2 Oct 31 15:25:18.026100: | newref alloc logger@0x559bbabb00e0(0->1) (in new_state() at state.c:576) Oct 31 15:25:18.026103: | addref fd@NULL (in new_state() at state.c:577) Oct 31 15:25:18.026106: | creating state object #8 at 0x559bbabd3960 Oct 31 15:25:18.026108: | State DB: adding IKEv2 state #8 in UNDEFINED Oct 31 15:25:18.026113: | pstats #8 ikev2.child started Oct 31 15:25:18.026117: | duplicating state object #2 "north-eastnets/0x2" as #8 for IPSEC SA Oct 31 15:25:18.026122: | #8 setting local endpoint to 192.1.3.33:500 from #2.st_localport (in duplicate_state() at state.c:1581) Oct 31 15:25:18.026131: | Message ID: CHILD #2.#8 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=4 ike.responder.recv=4 ike.responder.last_contact=744592.458747 child.wip.initiator=0->-1 child.wip.responder=0->-1 Oct 31 15:25:18.026135: | child state #8: UNDEFINED(ignore) => V2_REKEY_CHILD_I0(established IKE SA) Oct 31 15:25:18.026140: | #8.st_v2_transition NULL -> V2_REKEY_CHILD_I0->V2_REKEY_CHILD_I1 (in new_v2_child_state() at state.c:1666) Oct 31 15:25:18.026143: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:25:18.026149: | suspend processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:5960) Oct 31 15:25:18.026154: | start processing: state #8 connection "north-eastnets/0x1" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:5960) Oct 31 15:25:18.026160: | create child proposal's DH changed from no-PFS to MODP2048, flushing Oct 31 15:25:18.026164: | constructing ESP/AH proposals with default DH MODP2048 for north-eastnets/0x1 (ESP/AH initiator emitting proposals) Oct 31 15:25:18.026169: | converting proposal AES_CBC_128-HMAC_SHA2_512_256-MODP3072 to ikev2 ... Oct 31 15:25:18.026177: | ... ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED Oct 31 15:25:18.026181: "north-eastnets/0x1": local ESP/AH proposals (ESP/AH initiator emitting proposals): Oct 31 15:25:18.026187: "north-eastnets/0x1": 1:ESP=AES_CBC_128-HMAC_SHA2_512_256-MODP3072-DISABLED Oct 31 15:25:18.026193: | #8 schedule rekey initiate IPsec SA RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 to replace #6 using IKE# 2 pfs=MODP3072 Oct 31 15:25:18.026196: | event_schedule: newref EVENT_v2_INITIATE_CHILD-pe@0x559bbabd0d80 Oct 31 15:25:18.026207: | inserting event EVENT_v2_INITIATE_CHILD, timeout in 0 seconds for #8 Oct 31 15:25:18.026211: | libevent_malloc: newref ptr-libevent@0x7f32b0000c80 size 128 Oct 31 15:25:18.026217: | RESET processing: state #8 connection "north-eastnets/0x1" from 192.1.2.23:500 (in ikev2_initiate_child_sa() at ikev2_parent.c:6035) Oct 31 15:25:18.026221: | event_schedule: newref EVENT_SA_EXPIRE-pe@0x559bbab82620 Oct 31 15:25:18.026224: | inserting event EVENT_SA_EXPIRE, timeout in 0 seconds for #6 Oct 31 15:25:18.026227: | libevent_malloc: newref ptr-libevent@0x7f32c8002790 size 128 Oct 31 15:25:18.026290: | #6 spent 0.164 (0.224) milliseconds in timer_event_cb() EVENT_SA_REPLACE Oct 31 15:25:18.026296: | processing: STOP state #0 (in timer_event_cb() at timer.c:447) Oct 31 15:25:18.026302: | timer_event_cb: processing event@0x559bbabd0d80 Oct 31 15:25:18.026305: | handling event EVENT_v2_INITIATE_CHILD for child state #8 Oct 31 15:25:18.026309: | libevent_free: delref ptr-libevent@0x7f32b0000c80 Oct 31 15:25:18.026311: | free_event_entry: delref EVENT_v2_INITIATE_CHILD-pe@0x559bbabd0d80 Oct 31 15:25:18.026317: | start processing: state #8 connection "north-eastnets/0x1" from 192.1.2.23:500 (in timer_event_cb() at timer.c:188) Oct 31 15:25:18.026324: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:25:18.026327: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:25:18.026330: | newref clone logger@0x7f32b4001660(0->1) (in clone_logger() at log.c:817) Oct 31 15:25:18.026333: | job 12 for #8: Child Rekey Initiator KE and nonce ni (build KE and nonce): adding job to queue Oct 31 15:25:18.026336: | state #8 has no .st_event to delete Oct 31 15:25:18.026339: | #8 STATE_V2_REKEY_CHILD_I0: retransmits: cleared Oct 31 15:25:18.026342: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabd0d80 Oct 31 15:25:18.026345: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #8 Oct 31 15:25:18.026348: | libevent_malloc: newref ptr-libevent@0x7f32b0000c80 size 128 Oct 31 15:25:18.026360: | #8 spent 0.0557 (0.0557) milliseconds in timer_event_cb() EVENT_v2_INITIATE_CHILD Oct 31 15:25:18.026366: | stop processing: state #8 connection "north-eastnets/0x1" from 192.1.2.23:500 (in timer_event_cb() at timer.c:447) Oct 31 15:25:18.026370: | timer_event_cb: processing event@0x559bbab82620 Oct 31 15:25:18.026373: | handling event EVENT_SA_EXPIRE for child state #6 Oct 31 15:25:18.026376: | libevent_free: delref ptr-libevent@0x7f32c8002790 Oct 31 15:25:18.026379: | free_event_entry: delref EVENT_SA_EXPIRE-pe@0x559bbab82620 Oct 31 15:25:18.026384: | start processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in timer_event_cb() at timer.c:188) Oct 31 15:25:18.026388: | picked newest_ipsec_sa #6 for #6 Oct 31 15:25:18.026391: | un-established partial CHILD SA timeout (SA expired) Oct 31 15:25:18.026393: | pstats #6 ikev2.child re-failed exchange-timeout Oct 31 15:25:18.026396: | should_send_delete: no, just because Oct 31 15:25:18.026399: | pstats #6 ikev2.child deleted completed Oct 31 15:25:18.026403: | #6 main thread spent 2.21 (2.86) milliseconds helper thread spent 6.65 (2.01e+03) milliseconds in total Oct 31 15:25:18.026411: | [RE]START processing: state #6 connection "north-eastnets/0x1" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.026414: | should_send_delete: no, just because Oct 31 15:25:18.026419: "north-eastnets/0x1" #6: deleting state (STATE_V2_ESTABLISHED_CHILD_SA) aged 20.71998s and NOT sending notification Oct 31 15:25:18.026422: | child state #6: ESTABLISHED_CHILD_SA(established CHILD SA) => delete Oct 31 15:25:18.026427: | get_sa_info esp.bd68e0ed@192.1.2.23 Oct 31 15:25:18.026442: | get_sa_info esp.e2910ac0@192.1.3.33 Oct 31 15:25:18.026454: "north-eastnets/0x1" #6: ESP traffic information: in=7MB out=7MB Oct 31 15:25:18.026458: | unsuspending #6 MD (nil) Oct 31 15:25:18.026460: | should_send_delete: no, just because Oct 31 15:25:18.026463: | child state #6: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) Oct 31 15:25:18.026466: | state #6 has no .st_event to delete Oct 31 15:25:18.026469: | #6 STATE_CHILDSA_DEL: retransmits: cleared Oct 31 15:25:18.026579: | job 12 for #8: Child Rekey Initiator KE and nonce ni (build KE and nonce): helper 5 starting job Oct 31 15:25:18.026585: | helper 5 is pausing for 1 seconds Oct 31 15:25:18.026602: | running updown command "ipsec _updown" for verb down Oct 31 15:25:18.026607: | command executing down-client Oct 31 15:25:18.026612: | get_sa_info esp.bd68e0ed@192.1.2.23 Oct 31 15:25:18.026623: | get_sa_info esp.e2910ac0@192.1.3.33 Oct 31 15:25:18.026657: | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157899' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGU... Oct 31 15:25:18.026718: | popen cmd is 1154 chars long Oct 31 15:25:18.026725: | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x: Oct 31 15:25:18.026728: | cmd( 80):1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO: Oct 31 15:25:18.026730: | cmd( 160):_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIEN: Oct 31 15:25:18.026733: | cmd( 240):T='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.2: Oct 31 15:25:18.026735: | cmd( 320):55.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TY: Oct 31 15:25:18.026737: | cmd( 400):PE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.: Oct 31 15:25:18.026740: | cmd( 480):2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0': Oct 31 15:25:18.026742: | cmd( 560): PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm': Oct 31 15:25:18.026744: | cmd( 640): PLUTO_ADDTIME='1604157899' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+U: Oct 31 15:25:18.026747: | cmd( 720):P+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' : Oct 31 15:25:18.026749: | cmd( 800):PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_D: Oct 31 15:25:18.026751: | cmd( 880):NS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' P: Oct 31 15:25:18.026753: | cmd( 960):LUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='8212848' PLUTO_OUTBYT: Oct 31 15:25:18.026758: | cmd(1040):ES='8213352' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xbd68e0ed SPI: Oct 31 15:25:18.026761: | cmd(1120):_OUT=0xe2910ac0 ipsec _updown 2>&1: Oct 31 15:25:18.041328: | shunt_eroute() called for connection 'north-eastnets/0x1' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.3.0/24:0 --0->- 192.0.2.0/24:0 Oct 31 15:25:18.041350: | netlink_shunt_eroute for proto 0, and source 192.0.3.0/24:0 dest 192.0.2.0/24:0 Oct 31 15:25:18.041355: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:25:18.041360: | IPsec SA SPD priority set to 2084814 Oct 31 15:25:18.041401: | delete esp.bd68e0ed@192.1.2.23 Oct 31 15:25:18.041406: | XFRM: deleting IPsec SA with reqid 0 Oct 31 15:25:18.041429: | netlink response for Del SA esp.bd68e0ed@192.1.2.23 included non-error error Oct 31 15:25:18.041433: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:25:18.041441: | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.3.0/24:0 => unk.10000@192.1.3.33 using reqid 0 (raw_eroute) proto=50 Oct 31 15:25:18.041466: | raw_eroute result=success Oct 31 15:25:18.041471: | delete esp.e2910ac0@192.1.3.33 Oct 31 15:25:18.041473: | XFRM: deleting IPsec SA with reqid 0 Oct 31 15:25:18.041491: | netlink response for Del SA esp.e2910ac0@192.1.3.33 included non-error error Oct 31 15:25:18.041497: | in connection_discard for connection north-eastnets/0x1 Oct 31 15:25:18.041500: | State DB: deleting IKEv2 state #6 in CHILDSA_DEL Oct 31 15:25:18.041505: | child state #6: CHILDSA_DEL(informational) => UNDEFINED(ignore) Oct 31 15:25:18.041509: | releasing #6's fd-fd@(nil) because deleting state Oct 31 15:25:18.041512: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.041514: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.041517: | delref pkp@NULL (in delete_state() at state.c:1202) Oct 31 15:25:18.041540: | stop processing: state #6 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.041550: | delref logger@0x559bbabc9f30(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:18.041553: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.041555: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.041559: | State DB: found IKEv2 state #8 in V2_REKEY_CHILD_I0 (v2_expire_unused_ike_sa) Oct 31 15:25:18.041562: | can't expire unused IKE SA #2; it has the child #8 Oct 31 15:25:18.041565: | in statetime_stop() and could not find #6 Oct 31 15:25:18.041567: | processing: STOP state #0 (in timer_event_cb() at timer.c:447) Oct 31 15:25:18.041579: | processing signal PLUTO_SIGCHLD Oct 31 15:25:18.041585: | waitpid returned ECHILD (no child processes left) Oct 31 15:25:18.041593: | spent 0.0056 (0.00501) milliseconds in signal handler PLUTO_SIGCHLD Oct 31 15:25:18.044028: | spent 0.00231 (0.00229) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:25:18.044044: | newref struct msg_digest@0x559bbabdd030(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.044047: | newref alloc logger@0x7f32c8009080(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.044052: | *received 80 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:25:18.044054: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.044056: | 2e 20 25 00 00 00 00 01 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.044057: | 5a 4c 0a 86 ec 2d 3d 52 58 6a 8c a7 ae 38 af 41 Oct 31 15:25:18.044059: | 5b ae 98 5d 44 ae a7 79 54 f9 91 c8 c4 ca 12 08 Oct 31 15:25:18.044061: | aa a3 30 d2 03 b1 89 e3 23 a6 75 4e 0b 1b 91 5a Oct 31 15:25:18.044064: | **parse ISAKMP Message: Oct 31 15:25:18.044067: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:25:18.044070: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.044073: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:25:18.044119: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.044159: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.044163: | flags: none (0x0) Oct 31 15:25:18.044168: | Message ID: 1 (00 00 00 01) Oct 31 15:25:18.044171: | length: 80 (00 00 00 50) Oct 31 15:25:18.044174: | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) Oct 31 15:25:18.044178: | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL request Oct 31 15:25:18.044183: | State DB: found IKEv2 state #1 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:25:18.044192: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:25:18.044196: | #1 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 Oct 31 15:25:18.044213: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:25:18.044219: | #1 is idle Oct 31 15:25:18.044227: | Message ID: IKE #1 not a duplicate - message request 1 is new: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744592.436634 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.044233: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:25:18.044237: | unpacking clear payload Oct 31 15:25:18.044240: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:25:18.044243: | ***parse IKEv2 Encryption Payload: Oct 31 15:25:18.044246: | next payload type: ISAKMP_NEXT_v2D (0x2a) Oct 31 15:25:18.044249: | flags: none (0x0) Oct 31 15:25:18.044253: | length: 52 (00 34) Oct 31 15:25:18.044256: | processing payload: ISAKMP_NEXT_v2SK (len=48) Oct 31 15:25:18.044259: | #1 in state ESTABLISHED_IKE_SA: established IKE SA Oct 31 15:25:18.044288: | authenticator matched Oct 31 15:25:18.044302: | #1 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success Oct 31 15:25:18.044308: | Now let's proceed with payload (ISAKMP_NEXT_v2D) Oct 31 15:25:18.044311: | **parse IKEv2 Delete Payload: Oct 31 15:25:18.044314: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.044317: | flags: none (0x0) Oct 31 15:25:18.044320: | length: 12 (00 0c) Oct 31 15:25:18.044323: | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:25:18.044326: | SPI size: 4 (04) Oct 31 15:25:18.044330: | number of SPIs: 1 (00 01) Oct 31 15:25:18.044332: | processing payload: ISAKMP_NEXT_v2D (len=4) Oct 31 15:25:18.044336: | selected state microcode Informational Request Oct 31 15:25:18.044343: | Message ID: IKE #1 responder starting message request 1: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744592.436634 ike.wip.initiator=-1 ike.wip.responder=-1->1 Oct 31 15:25:18.044347: | calling processor Informational Request Oct 31 15:25:18.044350: | an informational request should send a response Oct 31 15:25:18.044396: | opening output PBS information exchange reply packet Oct 31 15:25:18.044402: | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness Oct 31 15:25:18.044405: | **emit ISAKMP Message: Oct 31 15:25:18.044410: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:25:18.044415: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.044417: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:25:18.044420: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.044423: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.044426: | flags: ISAKMP_FLAG_v2_IKE_INIT+ISAKMP_FLAG_v2_MSG_RESPONSE (0x28) Oct 31 15:25:18.044429: | Message ID: 1 (00 00 00 01) Oct 31 15:25:18.044431: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:25:18.044433: | ***emit IKEv2 Encryption Payload: Oct 31 15:25:18.044435: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.044436: | flags: none (0x0) Oct 31 15:25:18.044438: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:25:18.044442: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.044444: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:25:18.044450: | parsing 4 raw bytes of IKEv2 Delete Payload into SPI Oct 31 15:25:18.044452: | SPI Oct 31 15:25:18.044453: | 32 3e 8a 54 Oct 31 15:25:18.044455: | delete IKEv2_SEC_PROTO_ESP SA(0x323e8a54) Oct 31 15:25:18.044457: | v2 CHILD SA #3 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA Oct 31 15:25:18.044459: | State DB: found IKEv2 state #3 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) Oct 31 15:25:18.044460: | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0x323e8a54) Oct 31 15:25:18.044463: "north-eastnets/0x2" #1: received Delete SA payload: delete IPsec State #3 now Oct 31 15:25:18.044465: | pstats #3 ikev2.child deleted completed Oct 31 15:25:18.044468: | #3 main thread spent 2.84 (111) milliseconds helper thread spent 0 (0) milliseconds in total Oct 31 15:25:18.044472: | suspend processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.044475: | start processing: state #3 connection "north-eastnets/0x1" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.044477: | should_send_delete: no, just because Oct 31 15:25:18.044479: "north-eastnets/0x1" #3: deleting other state #3 connection (STATE_V2_ESTABLISHED_CHILD_SA) "north-eastnets/0x1" aged 21.232868s and NOT sending notification Oct 31 15:25:18.044481: | child state #3: ESTABLISHED_CHILD_SA(established CHILD SA) => delete Oct 31 15:25:18.044484: | get_sa_info esp.323e8a54@192.1.2.23 Oct 31 15:25:18.044495: | get_sa_info esp.1e003267@192.1.3.33 Oct 31 15:25:18.044501: "north-eastnets/0x1" #3: ESP traffic information: in=19MB out=19MB Oct 31 15:25:18.044503: | unsuspending #3 MD (nil) Oct 31 15:25:18.044505: | should_send_delete: no, just because Oct 31 15:25:18.044506: | child state #3: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) Oct 31 15:25:18.044509: | state #3 deleting .st_event EVENT_SA_REKEY Oct 31 15:25:18.044512: | libevent_free: delref ptr-libevent@0x7f32c0002790 Oct 31 15:25:18.044514: | free_event_entry: delref EVENT_SA_REKEY-pe@0x559bbab82b00 Oct 31 15:25:18.044516: | #3 STATE_CHILDSA_DEL: retransmits: cleared Oct 31 15:25:18.044639: | delete esp.323e8a54@192.1.2.23 Oct 31 15:25:18.044644: | XFRM: deleting IPsec SA with reqid 0 Oct 31 15:25:18.044663: | netlink response for Del SA esp.323e8a54@192.1.2.23 included non-error error Oct 31 15:25:18.044706: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:25:18.044717: | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.3.0/24:0 => unk.10000@192.1.3.33 using reqid 0 (raw_eroute) proto=50 Oct 31 15:25:18.044731: | raw_eroute result=success Oct 31 15:25:18.044736: | delete esp.1e003267@192.1.3.33 Oct 31 15:25:18.044739: | XFRM: deleting IPsec SA with reqid 0 Oct 31 15:25:18.044753: | netlink response for Del SA esp.1e003267@192.1.3.33 included non-error error Oct 31 15:25:18.044788: | in connection_discard for connection north-eastnets/0x1 Oct 31 15:25:18.044794: | State DB: deleting IKEv2 state #3 in CHILDSA_DEL Oct 31 15:25:18.044799: | child state #3: CHILDSA_DEL(informational) => UNDEFINED(ignore) Oct 31 15:25:18.044803: | releasing #3's fd-fd@(nil) because deleting state Oct 31 15:25:18.044806: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.044808: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.044811: | delref pkp@NULL (in delete_state() at state.c:1202) Oct 31 15:25:18.044817: | stop processing: state #3 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.044823: | resume processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.044830: | delref logger@0x559bbabb42e0(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:18.044834: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.044836: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.044840: | ****emit IKEv2 Delete Payload: Oct 31 15:25:18.044842: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.044843: | flags: none (0x0) Oct 31 15:25:18.044845: | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) Oct 31 15:25:18.044847: | SPI size: 4 (04) Oct 31 15:25:18.044849: | number of SPIs: 1 (00 01) Oct 31 15:25:18.044851: | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) Oct 31 15:25:18.044853: | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.044855: | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload Oct 31 15:25:18.044857: | local SPIs: 1e 00 32 67 Oct 31 15:25:18.044858: | emitting length of IKEv2 Delete Payload: 12 Oct 31 15:25:18.044860: | adding 4 bytes of padding (including 1 byte padding-length) Oct 31 15:25:18.044862: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.044864: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.044865: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.044867: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.044868: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:25:18.044870: | emitting length of IKEv2 Encryption Payload: 52 Oct 31 15:25:18.044871: | emitting length of ISAKMP Message: 80 Oct 31 15:25:18.044894: | sending 80 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #1) Oct 31 15:25:18.044897: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.044898: | 2e 20 25 28 00 00 00 01 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.044899: | 17 a7 2c a7 52 39 3f b9 38 02 60 ff d1 e4 e9 79 Oct 31 15:25:18.044901: | 93 60 2f 4a 29 dc 8b e7 0c b8 21 3b 99 69 fb 58 Oct 31 15:25:18.044902: | 38 f9 c3 36 8c 03 5a 14 f4 14 a7 1c bc b2 eb 86 Oct 31 15:25:18.044928: | sent 1 messages Oct 31 15:25:18.044933: | Message ID: IKE #1 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744592.436634 ike.wip.initiator=-1 ike.wip.responder=1 Oct 31 15:25:18.044937: | Message ID: IKE #1 updating responder sent message response 1: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=0->1 ike.responder.recv=0 ike.responder.last_contact=744592.436634 ike.wip.initiator=-1 ike.wip.responder=1 Oct 31 15:25:18.044945: | #1 spent 0.408 (0.592) milliseconds in processing: Informational Request in v2_dispatch() Oct 31 15:25:18.044953: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) Oct 31 15:25:18.044958: | #1 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_I0->PARENT_I1 Oct 31 15:25:18.044961: | Message ID: updating counters for #1 Oct 31 15:25:18.044969: | Message ID: IKE #1 updating responder received message request 1: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=1 ike.responder.recv=0->1 ike.responder.last_contact=744592.436634->744592.477761 ike.wip.initiator=-1 ike.wip.responder=1->-1 Oct 31 15:25:18.044976: | Message ID: IKE #1 updating responder sent message response 1: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744592.477761 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.044985: | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744592.477761 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.044988: | announcing the state transition Oct 31 15:25:18.044992: "north-eastnets/0x2" #1: established IKE SA Oct 31 15:25:18.044997: | sending 80 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #1) Oct 31 15:25:18.044999: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.045000: | 2e 20 25 28 00 00 00 01 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.045002: | 17 a7 2c a7 52 39 3f b9 38 02 60 ff d1 e4 e9 79 Oct 31 15:25:18.045003: | 93 60 2f 4a 29 dc 8b e7 0c b8 21 3b 99 69 fb 58 Oct 31 15:25:18.045004: | 38 f9 c3 36 8c 03 5a 14 f4 14 a7 1c bc b2 eb 86 Oct 31 15:25:18.045018: | sent 1 messages Oct 31 15:25:18.045020: | #1 is retaining EVENT_SA_REKEY with is previously set timeout Oct 31 15:25:18.045024: | stop processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:25:18.045028: | #1 spent 0.739 (1.01) milliseconds in ikev2_process_packet() Oct 31 15:25:18.045030: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:25:18.045032: | delref mdp@0x559bbabdd030(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.045034: | delref logger@0x7f32c8009080(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.045036: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.045037: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.045041: | spent 0.752 (1.02) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:25:18.045049: | spent 0.00127 (0.00127) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:25:18.045055: | newref struct msg_digest@0x559bbabdd030(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.045056: | newref alloc logger@0x559bbabb42e0(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.045060: | *received 80 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:25:18.045061: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.045063: | 2e 20 25 00 00 00 00 02 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.045064: | e5 be 3a 5e 84 36 9b 03 1e 8b f4 2b 2e 33 fc ff Oct 31 15:25:18.045066: | de b4 52 58 b7 7a b7 cb 4c 1e db f9 32 8b 81 5d Oct 31 15:25:18.045067: | 79 c0 10 bf 3c 6d a8 b1 ba 64 dd be b8 b7 fa d7 Oct 31 15:25:18.045070: | **parse ISAKMP Message: Oct 31 15:25:18.045072: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:25:18.045074: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.045076: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:25:18.045078: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.045079: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.045081: | flags: none (0x0) Oct 31 15:25:18.045083: | Message ID: 2 (00 00 00 02) Oct 31 15:25:18.045085: | length: 80 (00 00 00 50) Oct 31 15:25:18.045087: | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) Oct 31 15:25:18.045089: | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL request Oct 31 15:25:18.045092: | State DB: found IKEv2 state #1 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:25:18.045096: | start processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:25:18.045097: | #1 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 Oct 31 15:25:18.045100: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:25:18.045103: | #1 is idle Oct 31 15:25:18.045107: | Message ID: IKE #1 not a duplicate - message request 2 is new: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744592.477761 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.045110: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:25:18.045111: | unpacking clear payload Oct 31 15:25:18.045113: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:25:18.045115: | ***parse IKEv2 Encryption Payload: Oct 31 15:25:18.045116: | next payload type: ISAKMP_NEXT_v2D (0x2a) Oct 31 15:25:18.045118: | flags: none (0x0) Oct 31 15:25:18.045120: | length: 52 (00 34) Oct 31 15:25:18.045121: | processing payload: ISAKMP_NEXT_v2SK (len=48) Oct 31 15:25:18.045123: | #1 in state ESTABLISHED_IKE_SA: established IKE SA Oct 31 15:25:18.045138: | authenticator matched Oct 31 15:25:18.045144: | #1 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success Oct 31 15:25:18.045146: | Now let's proceed with payload (ISAKMP_NEXT_v2D) Oct 31 15:25:18.045148: | **parse IKEv2 Delete Payload: Oct 31 15:25:18.045149: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.045151: | flags: none (0x0) Oct 31 15:25:18.045152: | length: 8 (00 08) Oct 31 15:25:18.045154: | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) Oct 31 15:25:18.045156: | SPI size: 0 (00) Oct 31 15:25:18.045158: | number of SPIs: 0 (00 00) Oct 31 15:25:18.045159: | processing payload: ISAKMP_NEXT_v2D (len=0) Oct 31 15:25:18.045161: | selected state microcode Informational Request Oct 31 15:25:18.045165: | Message ID: IKE #1 responder starting message request 2: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744592.477761 ike.wip.initiator=-1 ike.wip.responder=-1->2 Oct 31 15:25:18.045166: | calling processor Informational Request Oct 31 15:25:18.045169: | an informational request should send a response Oct 31 15:25:18.045172: | opening output PBS information exchange reply packet Oct 31 15:25:18.045228: | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness Oct 31 15:25:18.045233: | **emit ISAKMP Message: Oct 31 15:25:18.045238: | initiator SPI: 2f db aa cf a4 4d 20 39 Oct 31 15:25:18.045242: | responder SPI: 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.045245: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:25:18.045248: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.045251: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.045254: | flags: ISAKMP_FLAG_v2_IKE_INIT+ISAKMP_FLAG_v2_MSG_RESPONSE (0x28) Oct 31 15:25:18.045258: | Message ID: 2 (00 00 00 02) Oct 31 15:25:18.045261: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:25:18.045264: | ***emit IKEv2 Encryption Payload: Oct 31 15:25:18.045267: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.045269: | flags: none (0x0) Oct 31 15:25:18.045272: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:25:18.045275: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.045278: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:25:18.045283: | adding 16 bytes of padding (including 1 byte padding-length) Oct 31 15:25:18.045286: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045287: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045289: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045290: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045294: | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045295: | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045297: | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045298: | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045300: | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045301: | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045303: | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045304: | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045306: | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045307: | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045309: | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045310: | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045312: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:25:18.045313: | emitting length of IKEv2 Encryption Payload: 52 Oct 31 15:25:18.045315: | emitting length of ISAKMP Message: 80 Oct 31 15:25:18.045343: | sending 80 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #1) Oct 31 15:25:18.045348: | 2f db aa cf a4 4d 20 39 91 12 8b 2d 12 ca 59 2a Oct 31 15:25:18.045351: | 2e 20 25 28 00 00 00 02 00 00 00 50 00 00 00 34 Oct 31 15:25:18.045354: | 50 a5 4a 15 b3 84 14 fc ef 4c be 00 48 68 3a 48 Oct 31 15:25:18.045356: | c0 ef 85 75 8b 7a f5 bc 5d 94 67 96 83 07 45 9f Oct 31 15:25:18.045359: | bf d2 39 73 34 da f5 a7 e4 16 ec 54 a3 ba 59 58 Oct 31 15:25:18.045378: | sent 1 messages Oct 31 15:25:18.045384: | Message ID: IKE #1 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744592.477761 ike.wip.initiator=-1 ike.wip.responder=2 Oct 31 15:25:18.045388: | Message ID: IKE #1 updating responder sent message response 2: ike.initiator.sent=2 ike.initiator.recv=2 ike.initiator.last_contact=744573.40154 ike.responder.sent=1->2 ike.responder.recv=1 ike.responder.last_contact=744592.477761 ike.wip.initiator=-1 ike.wip.responder=2 Oct 31 15:25:18.045390: | State DB: IKEv2 state not found (delete_ike_family) Oct 31 15:25:18.045392: | pstats #1 ikev2.ike deleted completed Oct 31 15:25:18.045396: | #1 main thread spent 7.99 (116) milliseconds helper thread spent 12.2 (3.01e+03) milliseconds in total Oct 31 15:25:18.045399: | [RE]START processing: state #1 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.045401: | should_send_delete: no, just because Oct 31 15:25:18.045403: "north-eastnets/0x2" #1: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 24.250458s and NOT sending notification Oct 31 15:25:18.045405: | parent state #1: ESTABLISHED_IKE_SA(established IKE SA) => delete Oct 31 15:25:18.045485: | unsuspending #1 MD (nil) Oct 31 15:25:18.045491: | should_send_delete: no, just because Oct 31 15:25:18.045495: | state #1 deleting .st_event EVENT_SA_REKEY Oct 31 15:25:18.045498: | libevent_free: delref ptr-libevent@0x559bbabc3470 Oct 31 15:25:18.045501: | free_event_entry: delref EVENT_SA_REKEY-pe@0x559bbabc3500 Oct 31 15:25:18.045504: | #1 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared Oct 31 15:25:18.045507: | State DB: IKEv2 state not found (flush_incomplete_children) Oct 31 15:25:18.045510: | picked newest_isakmp_sa #2 for #1 Oct 31 15:25:18.045515: | IKE delete_state() for #1 and connection 'north-eastnets/0x2' that is supposed to remain up; not a problem - have newer #2 Oct 31 15:25:18.045519: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:25:18.045522: | State DB: deleting IKEv2 state #1 in ESTABLISHED_IKE_SA Oct 31 15:25:18.045525: | parent state #1: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) Oct 31 15:25:18.045529: | releasing #1's fd-fd@(nil) because deleting state Oct 31 15:25:18.045531: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.045534: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.045537: | delref pkp@0x559bbabc5ab0(3->2) (in delete_state() at state.c:1202) Oct 31 15:25:18.045547: | stop processing: state #1 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.045558: | delref logger@0x559bbabb4330(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:18.045560: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.045562: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.045564: | in statetime_stop() and could not find #1 Oct 31 15:25:18.045565: | XXX: processor 'Informational Request' for #1 deleted state MD.ST Oct 31 15:25:18.045567: | processing: STOP state #0 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:25:18.045569: | in statetime_stop() and could not find #1 Oct 31 15:25:18.045570: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:25:18.045572: | delref mdp@0x559bbabdd030(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.045574: | delref logger@0x559bbabb42e0(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.045575: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.045577: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.045580: | spent 0.437 (0.533) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:25:18.045626: | spent 0.00197 (0.00178) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() Oct 31 15:25:18.045636: | newref struct msg_digest@0x559bbabdd030(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.045640: | newref alloc logger@0x7f32c80037e0(0->1) (in read_message() at demux.c:103) Oct 31 15:25:18.045645: | *received 80 bytes from 192.1.2.23:500 on eth1 192.1.3.33:500 using UDP Oct 31 15:25:18.045648: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.045650: | 2e 20 25 08 00 00 00 05 00 00 00 50 2a 00 00 34 Oct 31 15:25:18.045653: | 78 b8 fd 02 f9 be 8f af f5 bb 32 49 43 b0 0a 5e Oct 31 15:25:18.045655: | c7 a0 b5 54 da 6f ad b6 20 26 c3 a9 47 37 26 4c Oct 31 15:25:18.045657: | 6f 08 3e 48 12 be a8 49 71 fa 36 ae 49 cc 40 e2 Oct 31 15:25:18.045659: | **parse ISAKMP Message: Oct 31 15:25:18.045662: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:25:18.045664: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.045666: | next payload type: ISAKMP_NEXT_v2SK (0x2e) Oct 31 15:25:18.045668: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.045669: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.045671: | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) Oct 31 15:25:18.045673: | Message ID: 5 (00 00 00 05) Oct 31 15:25:18.045675: | length: 80 (00 00 00 50) Oct 31 15:25:18.045677: | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) Oct 31 15:25:18.045679: | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request Oct 31 15:25:18.045682: | State DB: found IKEv2 state #2 in ESTABLISHED_IKE_SA (find_v2_ike_sa) Oct 31 15:25:18.045686: | start processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) Oct 31 15:25:18.045688: | #2 st.st_msgid_lastrecv 4 md.hdr.isa_msgid 00000005 Oct 31 15:25:18.045689: | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) Oct 31 15:25:18.045691: | #2 is idle Oct 31 15:25:18.045695: | Message ID: IKE #2 not a duplicate - message request 5 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=4 ike.responder.recv=4 ike.responder.last_contact=744592.458747 ike.wip.initiator=-1 ike.wip.responder=-1 Oct 31 15:25:18.045700: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) Oct 31 15:25:18.045701: | unpacking clear payload Oct 31 15:25:18.045703: | Now let's proceed with payload (ISAKMP_NEXT_v2SK) Oct 31 15:25:18.045705: | ***parse IKEv2 Encryption Payload: Oct 31 15:25:18.045706: | next payload type: ISAKMP_NEXT_v2D (0x2a) Oct 31 15:25:18.045708: | flags: none (0x0) Oct 31 15:25:18.045710: | length: 52 (00 34) Oct 31 15:25:18.045711: | processing payload: ISAKMP_NEXT_v2SK (len=48) Oct 31 15:25:18.045713: | #2 in state ESTABLISHED_IKE_SA: established IKE SA Oct 31 15:25:18.045727: | authenticator matched Oct 31 15:25:18.045733: | #2 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success Oct 31 15:25:18.045735: | Now let's proceed with payload (ISAKMP_NEXT_v2D) Oct 31 15:25:18.045737: | **parse IKEv2 Delete Payload: Oct 31 15:25:18.045739: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.045740: | flags: none (0x0) Oct 31 15:25:18.045742: | length: 8 (00 08) Oct 31 15:25:18.045744: | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) Oct 31 15:25:18.045745: | SPI size: 0 (00) Oct 31 15:25:18.045747: | number of SPIs: 0 (00 00) Oct 31 15:25:18.045749: | processing payload: ISAKMP_NEXT_v2D (len=0) Oct 31 15:25:18.045753: | selected state microcode Informational Request Oct 31 15:25:18.045762: | Message ID: IKE #2 responder starting message request 5: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=4 ike.responder.recv=4 ike.responder.last_contact=744592.458747 ike.wip.initiator=-1 ike.wip.responder=-1->5 Oct 31 15:25:18.045765: | calling processor Informational Request Oct 31 15:25:18.045769: | an informational request should send a response Oct 31 15:25:18.045774: | opening output PBS information exchange reply packet Oct 31 15:25:18.045776: | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness Oct 31 15:25:18.045779: | **emit ISAKMP Message: Oct 31 15:25:18.045783: | initiator SPI: 39 a0 1b dc 13 1c ca 88 Oct 31 15:25:18.045787: | responder SPI: 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.045790: | next payload type: ISAKMP_NEXT_NONE (0x0) Oct 31 15:25:18.045793: | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) Oct 31 15:25:18.045796: | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) Oct 31 15:25:18.045799: | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) Oct 31 15:25:18.045803: | Message ID: 5 (00 00 00 05) Oct 31 15:25:18.045806: | next payload chain: saving message location 'ISAKMP Message'.'next payload type' Oct 31 15:25:18.045810: | ***emit IKEv2 Encryption Payload: Oct 31 15:25:18.045812: | next payload type: ISAKMP_NEXT_v2NONE (0x0) Oct 31 15:25:18.045815: | flags: none (0x0) Oct 31 15:25:18.045818: | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) Oct 31 15:25:18.045821: | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' Oct 31 15:25:18.045824: | emitting 16 zero bytes of IV into IKEv2 Encryption Payload Oct 31 15:25:18.045830: | adding 16 bytes of padding (including 1 byte padding-length) Oct 31 15:25:18.045833: | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045836: | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045839: | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045841: | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045843: | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045849: | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045851: | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045853: | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045856: | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045858: | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045861: | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045864: | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045867: | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045870: | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045872: | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045875: | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload Oct 31 15:25:18.045877: | emitting 16 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload Oct 31 15:25:18.045880: | emitting length of IKEv2 Encryption Payload: 52 Oct 31 15:25:18.045882: | emitting length of ISAKMP Message: 80 Oct 31 15:25:18.045910: | sending 80 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.3.33:500 to 192.1.2.23:500 using UDP (for #2) Oct 31 15:25:18.045914: | 39 a0 1b dc 13 1c ca 88 9b b1 cd 4e 99 d1 dc 27 Oct 31 15:25:18.045916: | 2e 20 25 20 00 00 00 05 00 00 00 50 00 00 00 34 Oct 31 15:25:18.045919: | f7 51 ec 80 84 72 96 22 ec cb 08 ab 0b c0 4e 74 Oct 31 15:25:18.045921: | b9 c9 04 e2 57 34 43 f5 fe 9b 42 a5 8a f6 e2 dc Oct 31 15:25:18.045923: | f7 b4 60 56 36 1d ba c0 65 b7 dd e1 d8 35 2f 35 Oct 31 15:25:18.045942: | sent 1 messages Oct 31 15:25:18.045949: | Message ID: IKE #2 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=4 ike.responder.recv=4 ike.responder.last_contact=744592.458747 ike.wip.initiator=-1 ike.wip.responder=5 Oct 31 15:25:18.045956: | Message ID: IKE #2 updating responder sent message response 5: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744568.466363 ike.responder.sent=4->5 ike.responder.recv=4 ike.responder.last_contact=744592.458747 ike.wip.initiator=-1 ike.wip.responder=5 Oct 31 15:25:18.045960: | pstats #8 ikev2.child deleted other Oct 31 15:25:18.045964: | #8 main thread spent 0.0557 (0.0557) milliseconds helper thread spent 0 (0) milliseconds in total Oct 31 15:25:18.045969: | suspend processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.045974: | start processing: state #8 connection "north-eastnets/0x1" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.045978: | should_send_delete: no, just because Oct 31 15:25:18.045984: "north-eastnets/0x1" #8: deleting other state #8 connection (STATE_V2_REKEY_CHILD_I0) "north-eastnets/0x1" aged 0.019884s and NOT sending notification Oct 31 15:25:18.045988: | child state #8: V2_REKEY_CHILD_I0(established IKE SA) => delete Oct 31 15:25:18.045991: | unsuspending #8 MD (nil) Oct 31 15:25:18.045994: | should_send_delete: no, just because Oct 31 15:25:18.045996: | child state #8: V2_REKEY_CHILD_I0(established IKE SA) => CHILDSA_DEL(informational) Oct 31 15:25:18.045999: | state #8 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:25:18.046003: | libevent_free: delref ptr-libevent@0x7f32b0000c80 Oct 31 15:25:18.046006: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabd0d80 Oct 31 15:25:18.046009: | #8 STATE_CHILDSA_DEL: retransmits: cleared Oct 31 15:25:18.046017: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:25:18.046025: | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.3.0/24:0 => unk.10000@192.1.3.33 using reqid 0 (raw_eroute) proto=50 Oct 31 15:25:18.046040: | raw_eroute result=success Oct 31 15:25:18.046044: | in connection_discard for connection north-eastnets/0x1 Oct 31 15:25:18.046047: | State DB: deleting IKEv2 state #8 in CHILDSA_DEL Oct 31 15:25:18.046051: | child state #8: CHILDSA_DEL(informational) => UNDEFINED(ignore) Oct 31 15:25:18.046054: | releasing #8's fd-fd@(nil) because deleting state Oct 31 15:25:18.046057: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.046059: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.046062: | delref pkp@NULL (in delete_state() at state.c:1202) Oct 31 15:25:18.046065: | stop processing: state #8 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.046068: | resume processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.046071: | delref logger@0x559bbabb00e0(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:18.046072: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.046074: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.046076: | pstats #7 ikev2.child deleted other Oct 31 15:25:18.046079: | #7 main thread spent 0.0503 (0.0503) milliseconds helper thread spent 0 (0) milliseconds in total Oct 31 15:25:18.046081: | suspend processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.046084: | start processing: state #7 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.046085: | should_send_delete: no, just because Oct 31 15:25:18.046088: "north-eastnets/0x2" #7: deleting other state #7 (STATE_V2_REKEY_CHILD_I0) aged 0.042113s and NOT sending notification Oct 31 15:25:18.046090: | child state #7: V2_REKEY_CHILD_I0(established IKE SA) => delete Oct 31 15:25:18.046092: | unsuspending #7 MD (nil) Oct 31 15:25:18.046093: | should_send_delete: no, just because Oct 31 15:25:18.046095: | child state #7: V2_REKEY_CHILD_I0(established IKE SA) => CHILDSA_DEL(informational) Oct 31 15:25:18.046097: | state #7 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:25:18.046099: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:25:18.046100: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbabcdb10 Oct 31 15:25:18.046102: | #7 STATE_CHILDSA_DEL: retransmits: cleared Oct 31 15:25:18.046104: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:25:18.046109: | delete inbound eroute 192.0.22.0/24:0 --0-> 192.0.3.0/24:0 => unk.10000@192.1.3.33 using reqid 0 (raw_eroute) proto=50 Oct 31 15:25:18.046117: | raw_eroute result=success Oct 31 15:25:18.046119: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:25:18.046121: | State DB: deleting IKEv2 state #7 in CHILDSA_DEL Oct 31 15:25:18.046123: | child state #7: CHILDSA_DEL(informational) => UNDEFINED(ignore) Oct 31 15:25:18.046125: | releasing #7's fd-fd@(nil) because deleting state Oct 31 15:25:18.046126: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.046128: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.046129: | delref pkp@NULL (in delete_state() at state.c:1202) Oct 31 15:25:18.046132: | stop processing: state #7 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.046134: | resume processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.046137: | delref logger@0x559bbabce640(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:18.046138: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.046139: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.046141: | State DB: IKEv2 state not found (delete_ike_family) Oct 31 15:25:18.046145: | pstats #2 ikev2.ike deleted completed Oct 31 15:25:18.046148: | #2 main thread spent 12.2 (132) milliseconds helper thread spent 5.89 (3.01e+03) milliseconds in total Oct 31 15:25:18.046150: | [RE]START processing: state #2 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:18.046152: | should_send_delete: no, just because Oct 31 15:25:18.046154: "north-eastnets/0x2" #2: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 24.012727s and NOT sending notification Oct 31 15:25:18.046156: | parent state #2: ESTABLISHED_IKE_SA(established IKE SA) => delete Oct 31 15:25:18.046256: | unsuspending #2 MD (nil) Oct 31 15:25:18.046264: | should_send_delete: no, just because Oct 31 15:25:18.046267: | state #2 deleting .st_event EVENT_SA_REKEY Oct 31 15:25:18.046271: | libevent_free: delref ptr-libevent@0x559bbabc3340 Oct 31 15:25:18.046274: | free_event_entry: delref EVENT_SA_REKEY-pe@0x559bbabc3410 Oct 31 15:25:18.046277: | #2 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared Oct 31 15:25:18.046280: | State DB: IKEv2 state not found (flush_incomplete_children) Oct 31 15:25:18.046282: | picked newest_isakmp_sa #0 for #2 Oct 31 15:25:18.046286: "north-eastnets/0x2" #2: deleting IKE SA but connection is supposed to remain up; schedule EVENT_REVIVE_CONNS Oct 31 15:25:18.046290: | add revival: connection 'north-eastnets/0x2' added to the list and scheduled for 0 seconds Oct 31 15:25:18.046293: | global one-shot timer EVENT_REVIVE_CONNS scheduled in 0 seconds Oct 31 15:25:18.046298: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:25:18.046300: | State DB: deleting IKEv2 state #2 in ESTABLISHED_IKE_SA Oct 31 15:25:18.046303: | parent state #2: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) Oct 31 15:25:18.046304: | releasing #2's fd-fd@(nil) because deleting state Oct 31 15:25:18.046306: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.046307: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:18.046309: | delref pkp@0x559bbabc5ab0(2->1) (in delete_state() at state.c:1202) Oct 31 15:25:18.046320: | stop processing: state #2 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:18.046331: | delref logger@0x559bbabb43d0(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:18.046332: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.046334: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.046336: | in statetime_stop() and could not find #2 Oct 31 15:25:18.046338: | XXX: processor 'Informational Request' for #2 deleted state MD.ST Oct 31 15:25:18.046339: | processing: STOP state #0 (in ikev2_process_packet() at ikev2.c:1904) Oct 31 15:25:18.046341: | in statetime_stop() and could not find #2 Oct 31 15:25:18.046343: | processing: STOP state #0 (in process_md() at demux.c:287) Oct 31 15:25:18.046344: | delref mdp@0x559bbabdd030(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.046346: | delref logger@0x7f32c80037e0(1->0) (in handle_packet_cb() at demux.c:318) Oct 31 15:25:18.046348: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:18.046349: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:18.046354: | spent 0.664 (0.732) milliseconds in handle_packet_cb() reading and processing packet Oct 31 15:25:18.046361: | processing global timer EVENT_REVIVE_CONNS Oct 31 15:25:18.046366: | FOR_EACH_CONNECTION_... in conn_by_name Oct 31 15:25:18.046369: "north-eastnets/0x2": initiating connection which received a Delete/Notify but must remain up per local policy Oct 31 15:25:18.046374: | connection 'north-eastnets/0x2' +POLICY_UP Oct 31 15:25:18.046376: | FOR_EACH_STATE_... in find_phase1_state Oct 31 15:25:18.046384: | newref alloc logger@0x559bbabb00e0(0->1) (in new_state() at state.c:576) Oct 31 15:25:18.046387: | addref fd@NULL (in new_state() at state.c:577) Oct 31 15:25:18.046389: | creating state object #9 at 0x559bbabd1130 Oct 31 15:25:18.046392: | State DB: adding IKEv2 state #9 in UNDEFINED Oct 31 15:25:18.046396: | pstats #9 ikev2.ike started Oct 31 15:25:18.046402: | parent state #9: UNDEFINED(ignore) => PARENT_I0(ignore) Oct 31 15:25:18.046406: | #9.st_v2_transition NULL -> PARENT_I0->PARENT_I1 (in new_v2_ike_state() at state.c:620) Oct 31 15:25:18.046414: | Message ID: IKE #9 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744592.479205 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744592.479205 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 Oct 31 15:25:18.046417: | orienting north-eastnets/0x2 Oct 31 15:25:18.046420: | north-eastnets/0x2 doesn't match 127.0.0.1:4500 at all Oct 31 15:25:18.046422: | north-eastnets/0x2 doesn't match 127.0.0.1:500 at all Oct 31 15:25:18.046425: | north-eastnets/0x2 doesn't match 192.0.3.254:4500 at all Oct 31 15:25:18.046427: | north-eastnets/0x2 doesn't match 192.0.3.254:500 at all Oct 31 15:25:18.046429: | north-eastnets/0x2 doesn't match 192.1.3.33:4500 at all Oct 31 15:25:18.046431: | oriented north-eastnets/0x2's this Oct 31 15:25:18.046435: | start processing: state #9 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:544) Oct 31 15:25:18.046437: | addref fd@NULL (in add_pending() at pending.c:86) Oct 31 15:25:18.046439: | queuing pending IPsec SA negotiating with 192.1.2.23 IKE SA #9 "north-eastnets/0x2" Oct 31 15:25:18.046442: "north-eastnets/0x2" #9: initiating IKEv2 connection Oct 31 15:25:18.046446: | using existing local IKE proposals for connection north-eastnets/0x2 (IKE SA initiator selecting KE): 1:IKE=AES_CBC_256-HMAC_SHA2_256-HMAC_SHA2_256_128-MODP2048 Oct 31 15:25:18.046450: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:25:18.046452: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:25:18.046454: | newref clone logger@0x7f32c8008c00(0->1) (in clone_logger() at log.c:817) Oct 31 15:25:18.046456: | job 13 for #9: ikev2_outI1 KE (build KE and nonce): adding job to queue Oct 31 15:25:18.046457: | state #9 has no .st_event to delete Oct 31 15:25:18.046459: | #9 STATE_PARENT_I0: retransmits: cleared Oct 31 15:25:18.046461: | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x559bbab82620 Oct 31 15:25:18.046463: | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #9 Oct 31 15:25:18.046465: | libevent_malloc: newref ptr-libevent@0x559bbabc0800 size 128 Oct 31 15:25:18.046473: | #9 spent 0.0991 (0.0991) milliseconds in ikev2_parent_outI1() Oct 31 15:25:18.046476: | RESET processing: state #9 connection "north-eastnets/0x2" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:640) Oct 31 15:25:18.046479: | spent 0.113 (0.113) milliseconds in global timer EVENT_REVIVE_CONNS Oct 31 15:25:18.046482: | job 13 for #9: ikev2_outI1 KE (build KE and nonce): helper 4 starting job Oct 31 15:25:18.046490: | helper 4 is pausing for 1 seconds Oct 31 15:25:18.801541: | newref struct fd@0x559bbabcff80(0->1) (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:25:18.801556: | fd_accept: new fd-fd@0x559bbabcff80 (in whack_handle_cb() at rcv_whack.c:869) Oct 31 15:25:18.801570: shutting down Oct 31 15:25:18.801579: | leaking fd-fd@0x559bbabcff80's FD; will be closed when pluto exits (in whack_handle_cb() at rcv_whack.c:889) Oct 31 15:25:18.801583: | delref fd@0x559bbabcff80(1->0) (in whack_handle_cb() at rcv_whack.c:895) Oct 31 15:25:18.801586: | freeref fd-fd@0x559bbabcff80 (in whack_handle_cb() at rcv_whack.c:895) Oct 31 15:25:18.801600: | shutting down helper thread 3 Oct 31 15:25:18.801648: | helper thread 3 exited Oct 31 15:25:18.801661: | shutting down helper thread 1 Oct 31 15:25:18.801685: | helper thread 1 exited Oct 31 15:25:18.801696: | shutting down helper thread 7 Oct 31 15:25:18.801725: | helper thread 7 exited Oct 31 15:25:18.801738: | shutting down helper thread 6 Oct 31 15:25:18.801769: | helper thread 6 exited Oct 31 15:25:19.015682: | "north-eastnets/0x2" #7: spent 4.52 (1.01e+03) milliseconds in helper 2 processing job 11 for state #7: Child Rekey Initiator KE and nonce ni (pcr) Oct 31 15:25:19.015700: | job 11 for #7: Child Rekey Initiator KE and nonce ni (build KE and nonce): helper thread 2 sending result back to state Oct 31 15:25:19.015709: | scheduling resume sending helper answer back to state for #7 Oct 31 15:25:19.015714: | libevent_malloc: newref ptr-libevent@0x7f32b8013800 size 128 Oct 31 15:25:19.015721: | shutting down helper thread 2 Oct 31 15:25:19.015732: | helper thread 2 exited Oct 31 15:25:19.029885: | "north-eastnets/0x1" #8: spent 3.17 (1e+03) milliseconds in helper 5 processing job 12 for state #8: Child Rekey Initiator KE and nonce ni (pcr) Oct 31 15:25:19.029900: | job 12 for #8: Child Rekey Initiator KE and nonce ni (build KE and nonce): helper thread 5 sending result back to state Oct 31 15:25:19.029903: | scheduling resume sending helper answer back to state for #8 Oct 31 15:25:19.029906: | libevent_malloc: newref ptr-libevent@0x7f32bc001910 size 128 Oct 31 15:25:19.029909: | shutting down helper thread 5 Oct 31 15:25:19.029923: | helper thread 5 exited Oct 31 15:25:19.048349: | "north-eastnets/0x2" #9: spent 1.8 (1e+03) milliseconds in helper 4 processing job 13 for state #9: ikev2_outI1 KE (pcr) Oct 31 15:25:19.048368: | job 13 for #9: ikev2_outI1 KE (build KE and nonce): helper thread 4 sending result back to state Oct 31 15:25:19.048372: | scheduling resume sending helper answer back to state for #9 Oct 31 15:25:19.048377: | libevent_malloc: newref ptr-libevent@0x7f32b0003290 size 128 Oct 31 15:25:19.048383: | shutting down helper thread 4 Oct 31 15:25:19.048432: | helper thread 4 exited Oct 31 15:25:19.048437: 7 helper threads shutdown Oct 31 15:25:19.048441: | delref root_certs@NULL (in free_root_certs() at root_certs.c:127) Oct 31 15:25:19.048445: | certs and keys locked by 'free_preshared_secrets' Oct 31 15:25:19.048447: forgetting secrets Oct 31 15:25:19.048456: | certs and keys unlocked by 'free_preshared_secrets' Oct 31 15:25:19.048461: | delref pkp@0x559bbabc5ab0(1->0) (in free_public_keyentry() at secrets.c:1591) Oct 31 15:25:19.048464: | delref pkp@0x559bbabc6ba0(1->0) (in free_public_keyentry() at secrets.c:1591) Oct 31 15:25:19.048468: | delref fd@NULL (in delete_pending() at pending.c:218) Oct 31 15:25:19.048470: | removing pending policy for no connection {0x559bbab82a80} Oct 31 15:25:19.048473: | deleting states for connection - including all other IPsec SA's of this IKE SA Oct 31 15:25:19.048475: | pass 0 Oct 31 15:25:19.048478: | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete Oct 31 15:25:19.048480: | state #9 Oct 31 15:25:19.048489: | start processing: state #9 connection "north-eastnets/0x2" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) Oct 31 15:25:19.048492: | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) Oct 31 15:25:19.048495: | addref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1409) Oct 31 15:25:19.048498: | pstats #9 ikev2.ike deleted other Oct 31 15:25:19.048503: | #9 main thread spent 0.0991 (0.0991) milliseconds helper thread spent 0 (0) milliseconds in total Oct 31 15:25:19.048508: | [RE]START processing: state #9 connection "north-eastnets/0x2" from 192.1.2.23:500 (in delete_state() at state.c:935) Oct 31 15:25:19.048511: | should_send_delete: no, not established Oct 31 15:25:19.048517: "north-eastnets/0x2" #9: deleting state (STATE_PARENT_I0) aged 1.002131s and NOT sending notification Oct 31 15:25:19.048520: | parent state #9: PARENT_I0(ignore) => delete Oct 31 15:25:19.048523: | unsuspending #9 MD (nil) Oct 31 15:25:19.048525: | should_send_delete: no, not established Oct 31 15:25:19.048528: | state #9 deleting .st_event EVENT_CRYPTO_TIMEOUT Oct 31 15:25:19.048532: | libevent_free: delref ptr-libevent@0x559bbabc0800 Oct 31 15:25:19.048536: | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x559bbab82620 Oct 31 15:25:19.048539: | #9 STATE_PARENT_I0: retransmits: cleared Oct 31 15:25:19.048543: | State DB: IKEv2 state not found (flush_incomplete_children) Oct 31 15:25:19.048547: | picked newest_isakmp_sa #0 for #9 Oct 31 15:25:19.048551: "north-eastnets/0x2" #9: deleting IKE SA but connection is supposed to remain up; schedule EVENT_REVIVE_CONNS Oct 31 15:25:19.048558: | add revival: connection 'north-eastnets/0x2' added to the list and scheduled for 5 seconds Oct 31 15:25:19.048561: | global one-shot timer EVENT_REVIVE_CONNS scheduled in 5 seconds Oct 31 15:25:19.048567: | in connection_discard for connection north-eastnets/0x2 Oct 31 15:25:19.048570: | State DB: deleting IKEv2 state #9 in PARENT_I0 Oct 31 15:25:19.048575: | parent state #9: PARENT_I0(ignore) => UNDEFINED(ignore) Oct 31 15:25:19.048578: | releasing #9's fd-fd@(nil) because deleting state Oct 31 15:25:19.048581: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:19.048583: | delref fd@NULL (in delete_state() at state.c:1195) Oct 31 15:25:19.048586: | delref pkp@NULL (in delete_state() at state.c:1202) Oct 31 15:25:19.048591: | stop processing: state #9 from 192.1.2.23:500 (in delete_state() at state.c:1239) Oct 31 15:25:19.048596: | delref logger@0x559bbabb00e0(1->0) (in delete_state() at state.c:1306) Oct 31 15:25:19.048598: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:19.048601: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:19.048604: | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) Oct 31 15:25:19.048606: | pass 1 Oct 31 15:25:19.048609: | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete Oct 31 15:25:19.048615: | shunt_eroute() called for connection 'north-eastnets/0x2' to 'delete' for rt_kind 'unrouted' using protoports 192.0.3.0/24:0 --0->- 192.0.22.0/24:0 Oct 31 15:25:19.048622: | netlink_shunt_eroute for proto 0, and source 192.0.3.0/24:0 dest 192.0.22.0/24:0 Oct 31 15:25:19.048626: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:25:19.048675: | priority calculation of connection "north-eastnets/0x2" is 2084814 (0x1fcfce) Oct 31 15:25:19.048690: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:25:19.048694: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:25:19.048696: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 Oct 31 15:25:19.048699: | conn north-eastnets/0x2 mark 0/00000000, 0/00000000 vs Oct 31 15:25:19.048702: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:25:19.048706: | route owner of "north-eastnets/0x2" unrouted: NULL Oct 31 15:25:19.048709: | running updown command "ipsec _updown" for verb unroute Oct 31 15:25:19.048711: | command executing unroute-client Oct 31 15:25:19.048738: | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGU... Oct 31 15:25:19.048742: | popen cmd is 1088 chars long Oct 31 15:25:19.048745: | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets: Oct 31 15:25:19.048748: | cmd( 80):/0x2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PL: Oct 31 15:25:19.048750: | cmd( 160):UTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CL: Oct 31 15:25:19.048752: | cmd( 240):IENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.25: Oct 31 15:25:19.048757: | cmd( 320):5.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA: Oct 31 15:25:19.048760: | cmd( 400):_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='19: Oct 31 15:25:19.048762: | cmd( 480):2.0.22.0/24' PLUTO_PEER_CLIENT_NET='192.0.22.0' PLUTO_PEER_CLIENT_MASK='255.255.: Oct 31 15:25:19.048765: | cmd( 560):255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK=: Oct 31 15:25:19.048767: | cmd( 640):'xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+I: Oct 31 15:25:19.048770: | cmd( 720):KEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLU: Oct 31 15:25:19.048772: | cmd( 800):TO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_: Oct 31 15:25:19.048774: | cmd( 880):INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUT: Oct 31 15:25:19.048777: | cmd( 960):O_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARE: Oct 31 15:25:19.048779: | cmd(1040):D='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1: Oct 31 15:25:19.065659: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.065720: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.065764: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.065852: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.065920: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.065936: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.065955: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.065971: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.065988: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066004: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066019: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066036: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066053: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066068: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066083: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066098: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066116: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066132: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066147: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066164: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066180: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066211: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066222: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066237: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066436: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066450: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066466: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066482: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066497: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066511: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066526: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066543: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066558: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.066622: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.110755: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:25:19.110774: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:25:19.110780: | newref clone logger@0x559bbabc3d70(0->1) (in clone_logger() at log.c:817) Oct 31 15:25:19.110784: | flush revival: connection 'north-eastnets/0x2' revival flushed Oct 31 15:25:19.110789: | delref vip@NULL (in discard_connection() at connections.c:262) Oct 31 15:25:19.110792: | delref vip@NULL (in discard_connection() at connections.c:263) Oct 31 15:25:19.110797: | Connection DB: deleting connection $2 Oct 31 15:25:19.110802: | delref logger@0x559bbabc3d70(1->0) (in delete_connection() at connections.c:214) Oct 31 15:25:19.110805: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:19.110808: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:19.110811: | deleting states for connection - including all other IPsec SA's of this IKE SA Oct 31 15:25:19.110814: | pass 0 Oct 31 15:25:19.110816: | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete Oct 31 15:25:19.110931: | pass 1 Oct 31 15:25:19.110935: | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete Oct 31 15:25:19.111104: | shunt_eroute() called for connection 'north-eastnets/0x1' to 'delete' for rt_kind 'unrouted' using protoports 192.0.3.0/24:0 --0->- 192.0.2.0/24:0 Oct 31 15:25:19.111114: | netlink_shunt_eroute for proto 0, and source 192.0.3.0/24:0 dest 192.0.2.0/24:0 Oct 31 15:25:19.111118: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:25:19.111159: | priority calculation of connection "north-eastnets/0x1" is 2084814 (0x1fcfce) Oct 31 15:25:19.111173: | FOR_EACH_CONNECTION_... in route_owner Oct 31 15:25:19.111178: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 vs Oct 31 15:25:19.111181: | conn north-eastnets/0x1 mark 0/00000000, 0/00000000 Oct 31 15:25:19.111184: | route owner of "north-eastnets/0x1" unrouted: NULL Oct 31 15:25:19.111187: | running updown command "ipsec _updown" for verb unroute Oct 31 15:25:19.111190: | command executing unroute-client Oct 31 15:25:19.111224: | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets/0x1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CLIENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURE... Oct 31 15:25:19.111232: | popen cmd is 1086 chars long Oct 31 15:25:19.111235: | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='north-eastnets: Oct 31 15:25:19.111238: | cmd( 80):/0x1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PL: Oct 31 15:25:19.111240: | cmd( 160):UTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.3.33' PLUTO_MY_ID='@north' PLUTO_MY_CL: Oct 31 15:25:19.111243: | cmd( 240):IENT='192.0.3.0/24' PLUTO_MY_CLIENT_NET='192.0.3.0' PLUTO_MY_CLIENT_MASK='255.25: Oct 31 15:25:19.111245: | cmd( 320):5.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA: Oct 31 15:25:19.111247: | cmd( 400):_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='19: Oct 31 15:25:19.111250: | cmd( 480):2.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.25: Oct 31 15:25:19.111252: | cmd( 560):5.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='x: Oct 31 15:25:19.111258: | cmd( 640):frm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKE: Oct 31 15:25:19.111261: | cmd( 720):V2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO: Oct 31 15:25:19.111264: | cmd( 800):_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_IN: Oct 31 15:25:19.111266: | cmd( 880):FO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_: Oct 31 15:25:19.111269: | cmd( 960):CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED=: Oct 31 15:25:19.111271: | cmd(1040):'no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1: Oct 31 15:25:19.130436: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130492: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130531: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130563: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130597: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130629: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130665: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130700: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130736: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130768: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130804: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130849: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130859: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130872: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130887: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130899: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130974: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130980: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130983: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130986: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130988: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130992: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.130994: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131006: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131316: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131330: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131347: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131362: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131375: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131388: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131416: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131459: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131468: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.131483: unroute-client output: Error: Peer netns reference is invalid. Oct 31 15:25:19.152169: | addref fd@NULL (in clone_logger() at log.c:809) Oct 31 15:25:19.152183: | addref fd@NULL (in clone_logger() at log.c:810) Oct 31 15:25:19.152189: | newref clone logger@0x559bbabc08d0(0->1) (in clone_logger() at log.c:817) Oct 31 15:25:19.152194: | delref hp@0x559bbabc22f0(1->0) (in delete_oriented_hp() at hostpair.c:360) Oct 31 15:25:19.152197: | flush revival: connection 'north-eastnets/0x1' wasn't on the list Oct 31 15:25:19.152226: | delref vip@NULL (in discard_connection() at connections.c:262) Oct 31 15:25:19.152229: | delref vip@NULL (in discard_connection() at connections.c:263) Oct 31 15:25:19.152234: | Connection DB: deleting connection $1 Oct 31 15:25:19.152238: | delref logger@0x559bbabc08d0(1->0) (in delete_connection() at connections.c:214) Oct 31 15:25:19.152240: | delref fd@NULL (in free_logger() at log.c:853) Oct 31 15:25:19.152242: | delref fd@NULL (in free_logger() at log.c:854) Oct 31 15:25:19.152245: | crl fetch request list locked by 'free_crl_fetch' Oct 31 15:25:19.152247: | crl fetch request list unlocked by 'free_crl_fetch' Oct 31 15:25:19.152252: | iface: marking eth1 dead Oct 31 15:25:19.152254: | iface: marking eth0 dead Oct 31 15:25:19.152256: | iface: marking lo dead Oct 31 15:25:19.152258: | updating interfaces - listing interfaces that are going down Oct 31 15:25:19.152264: shutting down interface lo 127.0.0.1:4500 Oct 31 15:25:19.152268: shutting down interface lo 127.0.0.1:500 Oct 31 15:25:19.152272: shutting down interface eth0 192.0.3.254:4500 Oct 31 15:25:19.152275: shutting down interface eth0 192.0.3.254:500 Oct 31 15:25:19.152279: shutting down interface eth1 192.1.3.33:4500 Oct 31 15:25:19.152282: shutting down interface eth1 192.1.3.33:500 Oct 31 15:25:19.152284: | updating interfaces - deleting the dead Oct 31 15:25:19.152290: | FOR_EACH_STATE_... in delete_states_dead_interfaces Oct 31 15:25:19.152298: | libevent_free: delref ptr-libevent@0x559bbabc12f0 Oct 31 15:25:19.152302: | delref id@0x559bbabc0ac0(3->2) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152313: | libevent_free: delref ptr-libevent@0x559bbabc1380 Oct 31 15:25:19.152316: | delref id@0x559bbabc0ac0(2->1) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152323: | libevent_free: delref ptr-libevent@0x559bbabc1430 Oct 31 15:25:19.152326: | delref id@0x559bbabc0a30(3->2) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152332: | libevent_free: delref ptr-libevent@0x559bbabc14e0 Oct 31 15:25:19.152335: | delref id@0x559bbabc0a30(2->1) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152343: | libevent_free: delref ptr-libevent@0x559bbabc1590 Oct 31 15:25:19.152346: | delref id@0x559bbabc0960(3->2) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152353: | libevent_free: delref ptr-libevent@0x559bbabc1640 Oct 31 15:25:19.152356: | delref id@0x559bbabc0960(2->1) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152363: | delref id@0x559bbabc0960(1->0) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152366: | delref id@0x559bbabc0a30(1->0) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152370: | delref id@0x559bbabc0ac0(1->0) (in release_iface_dev() at iface.c:125) Oct 31 15:25:19.152373: | updating interfaces - checking orientation Oct 31 15:25:19.152375: | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations Oct 31 15:25:19.155078: | libevent_free: delref ptr-libevent@0x559bbabbd9d0 Oct 31 15:25:19.155091: | free_event_entry: delref EVENT_NULL-pe@0x559bbabbff90 Oct 31 15:25:19.155097: | libevent_free: delref ptr-libevent@0x559bbabbd940 Oct 31 15:25:19.155100: | free_event_entry: delref EVENT_NULL-pe@0x559bbabb5c40 Oct 31 15:25:19.155104: | libevent_free: delref ptr-libevent@0x559bbabbcc90 Oct 31 15:25:19.155107: | free_event_entry: delref EVENT_NULL-pe@0x559bbabb9110 Oct 31 15:25:19.155111: | global timer EVENT_REINIT_SECRET uninitialized Oct 31 15:25:19.155114: | global timer EVENT_SHUNT_SCAN uninitialized Oct 31 15:25:19.155116: | global timer EVENT_PENDING_DDNS uninitialized Oct 31 15:25:19.155118: | global timer EVENT_PENDING_PHASE2 uninitialized Oct 31 15:25:19.155121: | global timer EVENT_CHECK_CRLS uninitialized Oct 31 15:25:19.155124: | global timer EVENT_REVIVE_CONNS uninitialized Oct 31 15:25:19.155126: | global timer EVENT_FREE_ROOT_CERTS uninitialized Oct 31 15:25:19.155128: | global timer EVENT_RESET_LOG_RATE_LIMIT uninitialized Oct 31 15:25:19.155130: | global timer EVENT_NAT_T_KEEPALIVE uninitialized Oct 31 15:25:19.155139: | libevent_free: delref ptr-libevent@0x559bbabc0120 Oct 31 15:25:19.155142: | signal event handler PLUTO_SIGCHLD uninstalled Oct 31 15:25:19.155145: | libevent_free: delref ptr-libevent@0x559bbabc0200 Oct 31 15:25:19.155147: | signal event handler PLUTO_SIGTERM uninstalled Oct 31 15:25:19.155150: | libevent_free: delref ptr-libevent@0x559bbabc02c0 Oct 31 15:25:19.155152: | signal event handler PLUTO_SIGHUP uninstalled Oct 31 15:25:19.155155: | libevent_free: delref ptr-libevent@0x559bbabb3320 Oct 31 15:25:19.155157: | signal event handler PLUTO_SIGSYS uninstalled Oct 31 15:25:19.155159: | releasing event base Oct 31 15:25:19.155174: | libevent_free: delref ptr-libevent@0x559bbabc0380 Oct 31 15:25:19.155177: | libevent_free: delref ptr-libevent@0x559bbab76770 Oct 31 15:25:19.155180: | libevent_free: delref ptr-libevent@0x559bbabae2e0 Oct 31 15:25:19.155183: | libevent_free: delref ptr-libevent@0x559bbabc32a0 Oct 31 15:25:19.155185: | libevent_free: delref ptr-libevent@0x559bbabae3b0 Oct 31 15:25:19.155188: | libevent_free: delref ptr-libevent@0x559bbabbffd0 Oct 31 15:25:19.155190: | libevent_free: delref ptr-libevent@0x559bbabc01c0 Oct 31 15:25:19.155192: | libevent_free: delref ptr-libevent@0x559bbabae480 Oct 31 15:25:19.155194: | libevent_free: delref ptr-libevent@0x559bbabb3f60 Oct 31 15:25:19.155196: | libevent_free: delref ptr-libevent@0x559bbabb3f40 Oct 31 15:25:19.155237: | libevent_free: delref ptr-libevent@0x559bbabc16d0 Oct 31 15:25:19.155241: | libevent_free: delref ptr-libevent@0x559bbabc1620 Oct 31 15:25:19.155243: | libevent_free: delref ptr-libevent@0x559bbabc1570 Oct 31 15:25:19.155245: | libevent_free: delref ptr-libevent@0x559bbabc14c0 Oct 31 15:25:19.155247: | libevent_free: delref ptr-libevent@0x559bbabc1410 Oct 31 15:25:19.155249: | libevent_free: delref ptr-libevent@0x559bbabc0f30 Oct 31 15:25:19.155252: | libevent_free: delref ptr-libevent@0x559bbabaffd0 Oct 31 15:25:19.155254: | libevent_free: delref ptr-libevent@0x559bbabc02a0 Oct 31 15:25:19.155257: | libevent_free: delref ptr-libevent@0x559bbabc01e0 Oct 31 15:25:19.155259: | libevent_free: delref ptr-libevent@0x559bbabc0100 Oct 31 15:25:19.155261: | libevent_free: delref ptr-libevent@0x559bbabc0360 Oct 31 15:25:19.155263: | libevent_free: delref ptr-libevent@0x559bbabbfff0 Oct 31 15:25:19.155266: | libevent_free: delref ptr-libevent@0x559bbabaff60 Oct 31 15:25:19.155268: | libevent_free: delref ptr-libevent@0x559bbabaff90 Oct 31 15:25:19.155270: | libevent_free: delref ptr-libevent@0x559bbabafcc0 Oct 31 15:25:19.155272: | releasing global libevent data Oct 31 15:25:19.155275: | libevent_free: delref ptr-libevent@0x559bbabae550 Oct 31 15:25:19.155277: | libevent_free: delref ptr-libevent@0x559bbabae580 Oct 31 15:25:19.155280: | libevent_free: delref ptr-libevent@0x559bbabafc50