| newref logger@0x55701b875bb8(0->1) (in main() at plutomain.c:1591) | delref logger@0x55701b875bb8(1->0) (in main() at plutomain.c:1592) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) NSS DB directory: sql:/var/lib/ipsec/nss Initializing NSS Opening NSS database "sql:/var/lib/ipsec/nss" read-only FIPS Mode: NO NSS crypto library initialized FIPS mode disabled for pluto daemon FIPS HMAC integrity support [disabled] libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v4.1-88-gf1d1933837ef-main IKEv2 IKEv1 XFRM(netkey) XFRMI esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) (NSS-PRF) DNSSEC LABELED_IPSEC (SELINUX) SECCOMP LIBCAP_NG LINUX_AUDIT AUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:2190309 core dump dir: /tmp secrets file: /etc/ipsec.secrets leak-detective enabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: newref ptr-libevent@0x55701b8fb0b8 size 40 | libevent_malloc: newref ptr-libevent@0x55701b87a738 size 40 | libevent_malloc: newref ptr-libevent@0x55701b8fb598 size 40 | creating event base | libevent_malloc: newref ptr-libevent@0x55701b8fb898 size 56 | libevent_malloc: newref ptr-libevent@0x55701b8f1d58 size 664 | libevent_malloc: newref ptr-libevent@0x55701b9286e8 size 24 | libevent_malloc: newref ptr-libevent@0x55701b928738 size 384 | libevent_malloc: newref ptr-libevent@0x55701b9288e8 size 16 | libevent_malloc: newref ptr-libevent@0x55701b8fb518 size 40 | libevent_malloc: newref ptr-libevent@0x55701b8fad78 size 48 | libevent_realloc: newref ptr-libevent@0x55701b91eeb8 size 256 | libevent_malloc: newref ptr-libevent@0x55701b928928 size 16 | libevent_free: delref ptr-libevent@0x55701b8fb898 | libevent initialized | libevent_realloc: newref ptr-libevent@0x55701b8fb898 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | checking IKEv1 state table | MAIN_R0: category: half-open IKE SA; flags: 0: | -> MAIN_R1 EVENT_SO_DISCARD (main_inI1_outR1) | MAIN_I1: category: half-open IKE SA; flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT (main_inR1_outI2) | MAIN_R1: category: open IKE SA; flags: 0: | -> MAIN_R2 EVENT_RETRANSMIT (main_inI2_outR2) | -> MAIN_R1 EVENT_RETRANSMIT (unexpected) | -> MAIN_R1 EVENT_RETRANSMIT (unexpected) | MAIN_I2: category: open IKE SA; flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT (main_inR2_outI3) | -> MAIN_I2 EVENT_RETRANSMIT (unexpected) | -> MAIN_I2 EVENT_RETRANSMIT (unexpected) | MAIN_R2: category: open IKE SA; flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE (main_inI3_outR3) | -> MAIN_R3 EVENT_SA_REPLACE (main_inI3_outR3) | -> MAIN_R2 EVENT_SA_REPLACE (unexpected) | MAIN_I3: category: open IKE SA; flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE (main_inR3) | -> MAIN_I4 EVENT_SA_REPLACE (main_inR3) | -> MAIN_I3 EVENT_SA_REPLACE (unexpected) | MAIN_R3: category: established IKE SA; flags: 0: | -> MAIN_R3 EVENT_NULL (unexpected) | MAIN_I4: category: established IKE SA; flags: 0: | -> MAIN_I4 EVENT_NULL (unexpected) | AGGR_R0: category: half-open IKE SA; flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD (aggr_inI1_outR1) | AGGR_I1: category: half-open IKE SA; flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE (aggr_inR1_outI2) | -> AGGR_I2 EVENT_SA_REPLACE (aggr_inR1_outI2) | AGGR_R1: category: open IKE SA; flags: 0: | -> AGGR_R2 EVENT_SA_REPLACE (aggr_inI2) | -> AGGR_R2 EVENT_SA_REPLACE (aggr_inI2) | AGGR_I2: category: established IKE SA; flags: 0: | -> AGGR_I2 EVENT_NULL (unexpected) | AGGR_R2: category: established IKE SA; flags: 0: | -> AGGR_R2 EVENT_NULL (unexpected) | QUICK_R0: category: established CHILD SA; flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT (quick_inI1_outR1) | QUICK_I1: category: established CHILD SA; flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE (quick_inR1_outI2) | QUICK_R1: category: established CHILD SA; flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE (quick_inI2) | QUICK_I2: category: established CHILD SA; flags: 0: | -> QUICK_I2 EVENT_NULL (unexpected) | QUICK_R2: category: established CHILD SA; flags: 0: | -> QUICK_R2 EVENT_NULL (unexpected) | INFO: category: informational; flags: 0: | -> INFO EVENT_NULL (informational) | INFO_PROTECTED: category: informational; flags: 0: | -> INFO_PROTECTED EVENT_NULL (informational) | XAUTH_R0: category: established IKE SA; flags: 0: | -> XAUTH_R1 EVENT_NULL (xauth_inR0) | XAUTH_R1: category: established IKE SA; flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE (xauth_inR1) | MODE_CFG_R0: category: informational; flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE (modecfg_inR0) | MODE_CFG_R1: category: established IKE SA; flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE (modecfg_inR1) | MODE_CFG_R2: category: established IKE SA; flags: 0: | -> MODE_CFG_R2 EVENT_NULL (unexpected) | MODE_CFG_I1: category: established IKE SA; flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE (modecfg_inR1) | XAUTH_I0: category: established IKE SA; flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT (xauth_inI0) | XAUTH_I1: category: established IKE SA; flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT (xauth_inI1) | checking IKEv2 state table | V2_REKEY_IKE_I0: category: established IKE SA; flags: 0: | -> V2_REKEY_IKE_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_I0: category: established IKE SA; flags: 0: | -> V2_REKEY_CHILD_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_NEW_CHILD_I0: category: established IKE SA; flags: 0: | -> V2_NEW_CHILD_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | PARENT_I0: category: ignore; flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA; flags: 0: | -> PARENT_I0 EVENT_SO_DISCARD (received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added) | -> PARENT_I0 EVENT_SO_DISCARD (received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload) | -> IKESA_DEL EVENT_v2_REDIRECT (received REDIRECT notify response; resending IKE_SA_INIT request to new destination) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE) | PARENT_I2: category: open IKE SA; flags: 0: | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_INTERMEDIATE reply, initiate IKE_AUTH or IKE_INTERMEDIATE) | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_R0: category: half-open IKE SA; flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-response (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA; flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_AUTH request (no SKEYSEED)) | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_INTERMEDIATE request (no SKEYSEED)) | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_INTERMEDIATE request (with SKEYSEED)) | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Responder: process IKE_AUTH request) | V2_REKEY_IKE_R0: category: established IKE SA; flags: 0: | -> ESTABLISHED_IKE_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I1: category: established IKE SA; flags: 0: | -> ESTABLISHED_IKE_SA EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_NEW_CHILD_I1: category: established IKE SA; flags: 0: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_CHILD_R0: category: established IKE SA; flags: 0: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA rekey CHILD SA request) | V2_NEW_CHILD_R0: category: established IKE SA; flags: 0: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA IPsec SA Request) | ESTABLISHED_IKE_SA: category: established IKE SA; flags: 0: | -> ESTABLISHED_IKE_SA EVENT_RETAIN send-response (Informational Request (liveness probe)) | -> ESTABLISHED_IKE_SA EVENT_RETAIN (Informational Response (liveness probe)) | -> ESTABLISHED_IKE_SA EVENT_RETAIN send-response (Informational Request) | -> ESTABLISHED_IKE_SA EVENT_RETAIN (Informational Response) | IKESA_DEL: category: established IKE SA; flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational; flags: 0: | -> CHILDSA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm, aes_ccm_c AES_CCM_12 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm_b AES_CCM_8 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm_a 3DES_CBC [*192] IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CBC) 3des CAMELLIA_CTR {256,192,*128} IKEv1: ESP IKEv2: ESP CAMELLIA_CBC {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP NSS(CBC) camellia AES_GCM_16 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm, aes_gcm_c AES_GCM_12 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm_b AES_GCM_8 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm_a AES_CTR {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CTR) aesctr AES_CBC {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CBC) aes NULL_AUTH_AES_GMAC {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_gmac NULL [] IKEv1: ESP IKEv2: ESP CHACHA20_POLY1305 [*256] IKEv1: IKEv2: IKE ESP NSS(AEAD) chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: NSS SHA1 IKEv1: IKE IKEv2: IKE FIPS NSS sha SHA2_256 IKEv1: IKE IKEv2: IKE FIPS NSS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: IKE FIPS NSS sha384 SHA2_512 IKEv1: IKE IKEv2: IKE FIPS NSS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE native(HMAC) md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS NSS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS NSS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS NSS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS NSS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE native(XCBC) aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH native(HMAC) md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH native(XCBC) aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS NSS(MODP) null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH NSS(MODP) dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH NSS(ECP) curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case 1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case 2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case 3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case 4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case 5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case 6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case 7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 helper threads started thread for helper 0 started thread for helper 1 | starting helper thread 2 seccomp security disabled for crypto helper 2 | status value returned by setting the priority of this helper thread 2: 22 | helper thread 2 has nothing to do started thread for helper 2 | starting helper thread 3 seccomp security disabled for crypto helper 3 started thread for helper 3 | starting helper thread 4 seccomp security disabled for crypto helper 4 | status value returned by setting the priority of this helper thread 4: 22 | helper thread 4 has nothing to do | status value returned by setting the priority of this helper thread 3: 22 started thread for helper 4 | helper thread 3 has nothing to do | starting helper thread 5 | starting helper thread 6 started thread for helper 5 seccomp security disabled for crypto helper 5 seccomp security disabled for crypto helper 6 | status value returned by setting the priority of this helper thread 5: 22 started thread for helper 6 | helper thread 5 has nothing to do | status value returned by setting the priority of this helper thread 6: 22 | helper thread 6 has nothing to do Using Linux XFRM/NETKEY IPsec kernel support code on 5.8.15-201.fc32.x86_64 | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: newref KERNEL_XRM_FD-pe@0x55701b92d288 | libevent_malloc: newref ptr-libevent@0x55701b8f9028 size 128 | libevent_malloc: newref ptr-libevent@0x55701b92c728 size 16 | add_fd_read_event_handler: newref KERNEL_ROUTE_FD-pe@0x55701b933b18 | libevent_malloc: newref ptr-libevent@0x55701b8f90d8 size 128 | libevent_malloc: newref ptr-libevent@0x55701b92c0e8 size 16 | starting helper thread 1 seccomp security disabled for crypto helper 1 | status value returned by setting the priority of this helper thread 1: 22 | helper thread 1 has nothing to do | global one-shot timer EVENT_CHECK_CRLS initialized SELinux support is enabled in PERMISSIVE mode. | starting helper thread 7 seccomp security disabled for crypto helper 7 | status value returned by setting the priority of this helper thread 7: 22 | helper thread 7 has nothing to do | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | loading dnssec root key from:/var/lib/unbound/root.key | no additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: newref PLUTO_CTL_FD-pe@0x55701b939188 | libevent_malloc: newref ptr-libevent@0x55701b935dc8 size 128 | libevent_malloc: newref ptr-libevent@0x55701b92cb08 size 16 | libevent_realloc: newref ptr-libevent@0x55701b9391f8 size 256 | libevent_malloc: newref ptr-libevent@0x55701b92c768 size 8 | libevent_realloc: newref ptr-libevent@0x55701b92cf98 size 144 | libevent_malloc: newref ptr-libevent@0x55701b88b578 size 152 | libevent_malloc: newref ptr-libevent@0x55701b92c918 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: newref ptr-libevent@0x55701b939328 size 8 | libevent_malloc: newref ptr-libevent@0x55701b87a798 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: newref ptr-libevent@0x55701b939368 size 8 | libevent_malloc: newref ptr-libevent@0x55701b9393a8 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: newref ptr-libevent@0x55701b939478 size 8 | libevent_realloc: delref ptr-libevent@0x55701b92cf98 | libevent_realloc: newref ptr-libevent@0x55701b9394b8 size 256 | libevent_malloc: newref ptr-libevent@0x55701b9395e8 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:2190362) using fork+execve | forked child 2190362 seccomp security disabled | newref struct fd@0x55701b939748(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x55701b939748 (in whack_handle_cb() at rcv_whack.c:869) | whack: listen listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.2.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.23 | newref struct iface_dev@0x55701b939be8(0->1) (in add_iface_dev() at iface.c:67) Kernel supports NIC esp-hw-offload | iface: marking eth1 add | newref struct iface_dev@0x55701b939d18(0->1) (in add_iface_dev() at iface.c:67) | iface: marking eth0 add | newref struct iface_dev@0x55701b939de8(0->1) (in add_iface_dev() at iface.c:67) | iface: marking lo add | no interfaces to sort | MSG_ERRQUEUE enabled on fd 18 | addref ifd@0x55701b939be8(1->2) (in bind_iface_port() at iface.c:237) adding UDP interface eth1 192.1.2.23:500 | MSG_ERRQUEUE enabled on fd 19 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 | addref ifd@0x55701b939be8(2->3) (in bind_iface_port() at iface.c:237) adding UDP interface eth1 192.1.2.23:4500 | MSG_ERRQUEUE enabled on fd 20 | addref ifd@0x55701b939d18(1->2) (in bind_iface_port() at iface.c:237) adding UDP interface eth0 192.0.2.254:500 | MSG_ERRQUEUE enabled on fd 21 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 | addref ifd@0x55701b939d18(2->3) (in bind_iface_port() at iface.c:237) adding UDP interface eth0 192.0.2.254:4500 | MSG_ERRQUEUE enabled on fd 22 | addref ifd@0x55701b939de8(1->2) (in bind_iface_port() at iface.c:237) adding UDP interface lo 127.0.0.1:500 | MSG_ERRQUEUE enabled on fd 23 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 | addref ifd@0x55701b939de8(2->3) (in bind_iface_port() at iface.c:237) adding UDP interface lo 127.0.0.1:4500 | updating interfaces - listing interfaces that are going down | updating interfaces - checking orientation | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | libevent_malloc: newref ptr-libevent@0x55701b935d18 size 128 | libevent_malloc: newref ptr-libevent@0x55701b93a798 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 23 on UDP | libevent_malloc: newref ptr-libevent@0x55701b8f91d8 size 128 | libevent_malloc: newref ptr-libevent@0x55701b93a7d8 size 16 | setup callback for interface lo 127.0.0.1:500 fd 22 on UDP | libevent_malloc: newref ptr-libevent@0x55701b8ee498 size 128 | libevent_malloc: newref ptr-libevent@0x55701b93a818 size 16 | setup callback for interface eth0 192.0.2.254:4500 fd 21 on UDP | libevent_malloc: newref ptr-libevent@0x55701b8f92d8 size 128 | libevent_malloc: newref ptr-libevent@0x55701b93a858 size 16 | setup callback for interface eth0 192.0.2.254:500 fd 20 on UDP | libevent_malloc: newref ptr-libevent@0x55701b8f5cf8 size 128 | libevent_malloc: newref ptr-libevent@0x55701b93a898 size 16 | setup callback for interface eth1 192.1.2.23:4500 fd 19 on UDP | libevent_malloc: newref ptr-libevent@0x55701b8f5c48 size 128 | libevent_malloc: newref ptr-libevent@0x55701b93a8d8 size 16 | setup callback for interface eth1 192.1.2.23:500 fd 18 on UDP | no stale xfrmi interface 'ipsec1' found | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" no secrets filename matched "/etc/ipsec.d/*.secrets" | old food groups: | new food groups: | delref fd@0x55701b939748(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x55701b939748 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.517 (1.66) milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 2190362 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0154 (0.0153) milliseconds in signal handler PLUTO_SIGCHLD | newref struct fd@0x55701b939cb8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x55701b939cb8 (in whack_handle_cb() at rcv_whack.c:869) | whack: options (impair|debug) | old debugging base+cpu-usage + none | new debugging = base+cpu-usage | delref fd@0x55701b939cb8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x55701b939cb8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.0882 (0.104) milliseconds in whack | newref struct fd@0x55701b939788(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x55701b939788 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes' | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | whack: connection 'westnet-eastnet-aes' | addref fd@0x55701b939788(1->2) (in string_logger() at log.c:838) | newref string logger@0x55701b92d058(0->1) (in add_connection() at connections.c:1998) | Connection DB: adding connection "westnet-eastnet-aes" $1 | FOR_EACH_CONNECTION_... in conn_by_name | added new connection westnet-eastnet-aes with policy RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | ike (phase1) algorithm values: AES_CBC-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp=aes-sha1 | ESP/AH string values: AES_CBC-HMAC_SHA1_96 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | saving left CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 extracted from raw RSA public key | spent 0.111 (0.116) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key matching left CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350: can't find the private key matching the NSS CKAID | counting wild cards for @west is 0 | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | saving right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 extracted from raw RSA public key | loaded private key matching CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 | copying key using reference slot | certs and keys locked by 'lsw_add_rsa_secret' | certs and keys unlocked by 'lsw_add_rsa_secret' | spent 1.86 (1.88) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID connection "westnet-eastnet-aes": loaded private key matching right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 | counting wild cards for @east is 0 | updating connection from left.host_addr | left host_port 500 | updating connection from right.host_addr | right host_port 500 | orienting westnet-eastnet-aes | westnet-eastnet-aes doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:4500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:500 at all | westnet-eastnet-aes doesn't match 192.1.2.23:4500 at all | oriented westnet-eastnet-aes's that | swapping ends so that that is this | connect_to_host_pair: 192.1.2.23:500 192.1.2.45:500 -> hp@(nil): none | newref hp@0x55701b93c3f8(0->1) (in connect_to_host_pair() at hostpair.c:290) added IKEv2 connection "westnet-eastnet-aes" | ike_life: 3600; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | 192.0.2.0/24===192.1.2.23<192.1.2.23>[@east]...192.1.2.45<192.1.2.45>[@west]===192.0.1.0/24 | delref logger@0x55701b92d058(1->0) (in add_connection() at connections.c:2026) | delref fd@0x55701b939788(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | delref fd@0x55701b939788(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x55701b939788 (in whack_handle_cb() at rcv_whack.c:903) | spent 2.42 (2.46) milliseconds in whack | newref struct fd@0x55701b93eaf8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x55701b93eaf8 (in whack_handle_cb() at rcv_whack.c:869) | whack: key add keyid @west | 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | 15 04 37 f9 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | newref struct pubkey@0x55701b9407a8(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x55701b9407a8(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x55701b9407a8(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQO9bJbr3 | spent 0.0363 (0.0362) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key: can't find the private key matching the NSS CKAID | delref fd@0x55701b93eaf8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x55701b93eaf8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.175 (0.174) milliseconds in whack | newref struct fd@0x55701b9321b8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x55701b9321b8 (in whack_handle_cb() at rcv_whack.c:869) | whack: key add keyid @east | 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | 51 51 48 ef | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | newref struct pubkey@0x55701b93f848(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x55701b93f848(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x55701b93f848(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | spent 0.00465 (0.00459) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | delref fd@0x55701b9321b8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x55701b9321b8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.103 (0.103) milliseconds in whack | spent 0.00324 (0.00321) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b940d18(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b92d058(0->1) (in read_message() at demux.c:103) | *received 522 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 20 69 ce b5 5d 96 95 94 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 02 0a 22 00 00 74 | 00 00 00 70 01 01 00 0c 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 0c 01 00 00 0c 80 0e 00 80 | 03 00 00 08 02 00 00 02 03 00 00 08 03 00 00 02 | 03 00 00 08 04 00 00 0e 03 00 00 08 04 00 00 0f | 03 00 00 08 04 00 00 10 03 00 00 08 04 00 00 12 | 03 00 00 08 04 00 00 13 03 00 00 08 04 00 00 14 | 03 00 00 08 04 00 00 15 00 00 00 08 04 00 00 1f | 28 00 01 08 00 0e 00 00 47 26 e6 1c c7 e9 68 aa | 16 1a 12 dc e4 6b 4d 98 15 17 ad 51 28 30 0c 70 | 2f 70 e9 37 f7 d5 55 2c 97 f0 69 d5 c3 64 4a 2d | c2 2c 2e 9a 6d 47 6b a6 0d 5a 2e 02 c8 82 f6 1e | 25 49 e8 a8 9e b6 85 7e 0b 5b d7 16 3e ac 6b de | d2 ae d3 95 0f 8f 18 d6 a3 e3 7b 4d 09 3d 0c fc | de 40 96 cc cb ca 8a bf fe e2 a8 89 17 5b 3a 49 | cc ed 00 bc 1f 90 94 37 ab 6d 3a c7 b0 8c 02 2a | e8 b8 3e 6e b4 d5 9d 3d 95 90 bd 20 fe 4a 84 4b | e9 1b 96 89 19 0e 14 14 84 4f 95 e4 3c e4 fb 55 | a2 a3 6b de 7e da 5c 86 6b 1d 67 86 d7 dc 97 3f | 2c 42 57 4a 54 91 be 9a c3 e1 35 d3 e2 73 e3 ba | 06 ab 5b d1 30 84 1f f8 2f 25 e2 de 52 66 17 5b | 55 15 e7 bf 55 eb 67 d5 12 ec 67 87 56 24 59 65 | 3e 3d 0c fa 28 65 bf e2 a7 db bb 0b e1 f1 59 b8 | a8 5c 2c ed 53 50 e4 94 75 ce 9e 8a 73 1f 74 ba | 21 7d 50 21 05 65 36 b8 29 00 00 24 16 4a e7 68 | 4d 53 40 d4 0f 36 c3 d8 f3 1b 9f a0 33 c3 4c b8 | 2e 50 3c 36 2d 52 a8 ce 72 60 b2 1a 29 00 00 08 | 00 00 40 2e 29 00 00 0e 00 00 40 2f 00 02 00 03 | 00 04 29 00 00 1c 00 00 40 04 57 67 67 3b b3 b8 | 14 5d ea f3 dc f6 64 93 78 1b 2c d4 85 4d 00 00 | 00 1c 00 00 40 05 28 0d a5 da f3 32 23 72 66 28 | 00 40 a1 c2 26 5d 95 51 1b 4b | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | length: 522 (00 00 02 0a) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Responder receiving an IKEv2 IKE_SA_INIT request | State DB: IKEv2 state not found (find_v2_ike_sa_by_initiator_spi) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 116 (00 74) | processing payload: ISAKMP_NEXT_v2SA (len=112) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | DDOS disabled and no cookie sent, continuing | looking for message matching transition from STATE_PARENT_R0 | trying Respond to IKE_SA_INIT | matched unencrypted message | find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=ECDSA+IKEV2_ALLOW but ignoring ports | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | found policy = RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 (westnet-eastnet-aes) | find_next_host_connection returns "westnet-eastnet-aes" | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | find_next_host_connection returns | found connection: "westnet-eastnet-aes" with policy ECDSA+IKEV2_ALLOW | newref alloc logger@0x55701b92cf28(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #1 at 0x55701b942528 | State DB: adding IKEv2 state #1 in UNDEFINED | pstats #1 ikev2.ike started | parent state #1: UNDEFINED(ignore) => PARENT_R0(half-open IKE SA) | #1.st_v2_transition NULL -> PARENT_R0->PARENT_R1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #1 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744608.579905 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744608.579905 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes | westnet-eastnet-aes doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:4500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:500 at all | westnet-eastnet-aes doesn't match 192.1.2.23:4500 at all | oriented westnet-eastnet-aes's this | start processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1758) | Message ID: IKE #1 responder starting message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.579905 ike.wip.initiator=-1 ike.wip.responder=-1->0 | calling processor Respond to IKE_SA_INIT | #1 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | constructing local IKE proposals for westnet-eastnet-aes (IKE SA responder matching remote proposals) | converting ike_info AES_CBC-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | forcing IKEv2 IKE AES_CBC ENCRYPT transform high-to-low key lengths: 256 128 | ... ikev2_proposal: 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 "westnet-eastnet-aes": local IKE proposals (IKE SA responder matching remote proposals): "westnet-eastnet-aes": 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE responder 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 112 (00 70) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 12 (0c) | Comparing remote proposal 1 containing 12 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 2 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 3 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 4 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #1: proposal 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_CBC_256;ENCR=AES_CBC_128;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519[first-match] | accepted IKE proposal ikev2_proposal: 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048 | converting proposal to internal trans attrs | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 20 69 ce b5 5d 96 95 94 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 28 0d a5 da f3 32 23 72 66 28 00 40 a1 c2 26 5d | 95 51 1b 4b | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 20 69 ce b5 5d 96 95 94 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 57 67 67 3b b3 b8 14 5d ea f3 dc f6 64 93 78 1b | 2c d4 85 4d | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.45 | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b92ce58(0->1) (in clone_logger() at log.c:817) | job 1 for #1: ikev2_inI1outR1 KE (build KE and nonce): adding job to queue | state #1 has no .st_event to delete | #1 STATE_PARENT_R0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93fe18 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: newref ptr-libevent@0x55701b93c5f8 size 128 | #1 spent 0.291 (0.297) milliseconds in processing: Respond to IKE_SA_INIT in v2_dispatch() | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #1 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_SUSPEND | suspending state #1 and saving MD 0x55701b940d18 | addref md@0x55701b940d18(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #1 is busy; has suspended MD 0x55701b940d18 | stop processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1760) | #1 spent 0.595 (0.604) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b940d18(2->1) (in handle_packet_cb() at demux.c:318) | job 1 for #1: ikev2_inI1outR1 KE (build KE and nonce): helper 2 starting job | spent 0.602 (0.612) milliseconds in handle_packet_cb() reading and processing packet | "westnet-eastnet-aes" #1: spent 1.22 (1.23) milliseconds in helper 2 processing job 1 for state #1: ikev2_inI1outR1 KE (pcr) | job 1 for #1: ikev2_inI1outR1 KE (build KE and nonce): helper thread 2 sending result back to state | scheduling resume sending helper answer back to state for #1 | libevent_malloc: newref ptr-libevent@0x7f3edc006108 size 128 | helper thread 2 has nothing to do | processing resume sending helper answer back to state for #1 | start processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #1 MD 0x55701b940d18 | job 1 for #1: ikev2_inI1outR1 KE (build KE and nonce): processing response from helper 2 | job 1 for #1: ikev2_inI1outR1 KE (build KE and nonce): calling continuation function 0x557019a27fe7 | ikev2_parent_inI1outR1_continue() for #1 STATE_PARENT_R0: calculated ke+nonce, sending R1 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | emitting ikev2_proposal ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 44 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 48 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | DH secret MODP2048@0x7f3edc006ba8: transferring ownership from helper KE to state #1 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | c1 07 d9 3a 38 2b 54 0f bf 30 dc 6a f6 d7 43 67 | 7a 4e 42 a7 8e 39 c3 99 ad 52 63 68 0f 68 1a 38 | 18 f0 b9 05 7e a2 d1 f9 62 56 26 a3 ac 3e b5 6d | 96 82 07 0c 06 5d 9c e4 44 05 50 ee 15 91 9a e3 | bf 0b 3a ec 52 f1 a1 40 95 f7 3a b4 01 8f 33 a9 | fd 54 f5 8d 81 33 b9 28 c0 61 00 a6 75 a0 80 03 | 55 15 1e 96 a1 fc 22 e2 d5 84 56 c5 e2 52 dc d3 | 59 18 20 15 5e d1 7a 1d 4a 36 dc 1f 9a 4d 29 c1 | 03 cc f2 e5 73 c9 a5 3c 5d 99 82 7d 2a d6 d6 18 | 45 a2 7c 86 c6 e1 e4 b9 c1 86 e6 8c 5b 20 cc 98 | 7a 4b fa 11 24 bf 22 3e 8e 20 8a 01 59 fb c4 90 | f7 f7 88 16 0b ad 39 3f f7 96 0a 7b 70 0f 03 4f | b8 6c 70 e7 58 37 1c 1d 4a dd 19 1b 9e fe 03 4f | d4 f3 e5 c3 7b 0b fa 80 2c a9 0f 43 8e 1c 5d 58 | 78 34 cf f9 c4 a2 a1 40 b7 8b 19 6e d6 f0 be 1a | 87 e0 f7 86 52 03 67 47 d0 59 b8 30 55 1b ca d3 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | a2 2d e6 66 7d 84 d6 98 c6 a7 3c 26 88 21 64 fe | cf 22 1b 87 c0 a0 e6 53 8b df b6 5f a2 b3 93 3f | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 20 69 ce b5 5d 96 95 94 | natd_hash: rcookie= | 02 9f 97 23 d7 43 93 9f | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | d4 76 4c 14 ef 94 9c 6b be ed ef 89 00 9d f8 4d | fe 3a c2 e6 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | d4 76 4c 14 ef 94 9c 6b be ed ef 89 00 9d f8 4d | fe 3a c2 e6 | emitting length of IKEv2 Notify Payload: 28 | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 20 69 ce b5 5d 96 95 94 | natd_hash: rcookie= | 02 9f 97 23 d7 43 93 9f | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 0f 70 24 51 38 af 08 12 77 fd 2c 72 bc 27 48 76 | 4c 1e a1 eb | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 0f 70 24 51 38 af 08 12 77 fd 2c 72 bc 27 48 76 | 4c 1e a1 eb | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 454 | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #1 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_OK | transitioning from state STATE_PARENT_R0 to state STATE_PARENT_R1 | Message ID: updating counters for #1 | Message ID: IKE #1 updating responder received message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=-1 ike.responder.recv=-1->0 ike.responder.last_contact=744608.579905->744608.581925 ike.wip.initiator=-1 ike.wip.responder=0->-1 | Message ID: IKE #1 updating responder sent message response 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=-1->0 ike.responder.recv=0 ike.responder.last_contact=744608.581925 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744608.581925 ike.wip.initiator=-1 ike.wip.responder=-1 | parent state #1: PARENT_R0(half-open IKE SA) => PARENT_R1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes" #1: sent IKE_SA_INIT reply {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 454 bytes for STATE_PARENT_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 c1 07 d9 3a 38 2b 54 0f bf 30 dc 6a | f6 d7 43 67 7a 4e 42 a7 8e 39 c3 99 ad 52 63 68 | 0f 68 1a 38 18 f0 b9 05 7e a2 d1 f9 62 56 26 a3 | ac 3e b5 6d 96 82 07 0c 06 5d 9c e4 44 05 50 ee | 15 91 9a e3 bf 0b 3a ec 52 f1 a1 40 95 f7 3a b4 | 01 8f 33 a9 fd 54 f5 8d 81 33 b9 28 c0 61 00 a6 | 75 a0 80 03 55 15 1e 96 a1 fc 22 e2 d5 84 56 c5 | e2 52 dc d3 59 18 20 15 5e d1 7a 1d 4a 36 dc 1f | 9a 4d 29 c1 03 cc f2 e5 73 c9 a5 3c 5d 99 82 7d | 2a d6 d6 18 45 a2 7c 86 c6 e1 e4 b9 c1 86 e6 8c | 5b 20 cc 98 7a 4b fa 11 24 bf 22 3e 8e 20 8a 01 | 59 fb c4 90 f7 f7 88 16 0b ad 39 3f f7 96 0a 7b | 70 0f 03 4f b8 6c 70 e7 58 37 1c 1d 4a dd 19 1b | 9e fe 03 4f d4 f3 e5 c3 7b 0b fa 80 2c a9 0f 43 | 8e 1c 5d 58 78 34 cf f9 c4 a2 a1 40 b7 8b 19 6e | d6 f0 be 1a 87 e0 f7 86 52 03 67 47 d0 59 b8 30 | 55 1b ca d3 29 00 00 24 a2 2d e6 66 7d 84 d6 98 | c6 a7 3c 26 88 21 64 fe cf 22 1b 87 c0 a0 e6 53 | 8b df b6 5f a2 b3 93 3f 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 d4 76 4c 14 ef 94 9c 6b be ed | ef 89 00 9d f8 4d fe 3a c2 e6 00 00 00 1c 00 00 | 40 05 0f 70 24 51 38 af 08 12 77 fd 2c 72 bc 27 | 48 76 4c 1e a1 eb | sent 1 messages | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x55701b93c5f8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93fe18 | event_schedule: newref EVENT_SO_DISCARD-pe@0x55701b93c5f8 | inserting event EVENT_SO_DISCARD, timeout in 200 seconds for #1 | libevent_malloc: newref ptr-libevent@0x55701b93bd28 size 128 | delref logger@0x55701b92ce58(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #1 suppresed complete_v2_state_transition() | delref mdp@0x55701b940d18(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b92d058(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #1 spent 0.498 (0.533) milliseconds in resume sending helper answer back to state | stop processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3edc006108 | spent 0.00196 (0.00193) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b940d18(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b92d058(0->1) (in read_message() at demux.c:103) | *received 544 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 79 94 eb 15 5c 6c df a2 76 70 62 42 | 8e 3d 1f b3 e2 7f a1 09 0e 6d 29 4a fc 1a 0a 1d | 7d 8b ef 38 ac 51 90 f7 8e d5 ee 86 8d d0 23 63 | d1 ca 18 26 f6 22 78 c9 ad 05 aa 18 01 8b 10 88 | c0 08 02 66 54 e9 ac b3 c7 70 36 67 75 a1 9b 02 | 4c a7 25 1c 3c b6 f0 83 1c a9 74 c8 b2 13 c3 3b | 0c 28 f6 65 e5 d2 0e 6d 0c a8 1d 6d 04 69 f2 69 | 1f 4d f4 fd 3f 06 89 38 7b 5a f5 7e 86 75 a2 45 | f1 a2 59 49 59 ae ad e1 c5 2a 3d ab e9 27 33 fd | c0 68 35 c2 31 f6 57 0a cd 89 ad 86 5f e2 04 09 | 52 f9 b1 1e 4d 1f 85 e3 10 e1 eb 4e a3 3c 80 dd | 96 cf 37 13 38 21 c2 cb 8d 45 24 04 fb bd 00 cf | e9 dd aa 24 7c 70 e3 6a 6d 74 18 3f 1b 09 b2 5e | 9d 1b b9 30 c7 cf ee 3f 3a dd 7d d5 ae 82 e4 05 | f2 07 d7 03 17 a3 4f 59 fa 47 1f 5e 81 5e 4b dd | fc fd 57 74 46 a3 9e cd db 3f fb e8 a9 cc b1 0e | 35 d2 b4 2a 0c 4a 38 19 42 3c 57 26 21 20 21 5c | 0c 95 87 76 9b 51 c5 c4 d6 8c 88 3d 09 05 71 a4 | 04 29 c0 46 86 62 51 0d 3d 5b ed dc ab ed fb eb | 3c 02 e1 43 29 98 38 83 04 6b 54 e2 56 37 05 c7 | eb 78 0d d9 18 ca 4e 1a 24 06 14 99 9f bd 24 2e | 22 21 b4 eb 4f 3d 6c c7 4e 90 22 b8 2f c0 89 d9 | 75 01 07 f9 07 2d 58 87 f4 47 8b b1 d1 e7 d1 64 | 5a 49 fb b7 f6 29 8c dd cf 0c 1e 56 8c 77 77 d2 | 65 b3 e5 37 ce 78 54 dd 0c bc 4b 3f b0 be 87 31 | fd 5e 35 f5 57 98 a8 02 8e de ad 13 25 09 15 28 | 30 3a 04 3b 25 59 7b 8f 0d 23 02 53 49 88 b5 01 | 85 5c 34 55 c0 be 95 83 d4 4b db 22 01 de 89 4c | 5c e8 82 38 3c 5b 55 c3 2a 71 3c 66 4c ac 44 29 | 88 87 3a d0 38 b6 7f 74 9c 72 74 2d dc 90 7d c4 | 1e 0a 61 b8 9f c6 9e 4b 4a 80 2f 78 c8 49 a8 ac | 5b 1d 37 b7 72 b6 8d 18 01 da 75 0a d3 5e ea b0 | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 544 (00 00 02 20) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request | State DB: found IKEv2 state #1 in PARENT_R1 (find_v2_ike_sa) | start processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #1 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #1 is idle | Message ID: IKE #1 not a duplicate - message request 1 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744608.581925 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 516 (02 04) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | processing payload: ISAKMP_NEXT_v2SKF (len=508) | #1 in state PARENT_R1: sent IKE_SA_INIT reply | received IKE encrypted fragment number '1', total number '1', next payload '35' | selected state microcode Responder: process IKE_AUTH request (no SKEYSEED) | calling processor Responder: process IKE_AUTH request (no SKEYSEED) | ikev2 parent ikev2_ike_sa_process_auth_request_no_skeyid(): calculating g^{xy} in order to decrypt I2 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f3edc006ba8: transferring ownership from state #1 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b92ce58(0->1) (in clone_logger() at log.c:817) | job 2 for #1: ikev2_inI2outR2 KE (compute dh (V2)): adding job to queue | state #1 deleting .st_event EVENT_SO_DISCARD | libevent_free: delref ptr-libevent@0x55701b93bd28 | free_event_entry: delref EVENT_SO_DISCARD-pe@0x55701b93c5f8 | #1 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93bd28 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: newref ptr-libevent@0x7f3edc006108 size 128 | #1 spent 0.0358 (0.04) milliseconds in processing: Responder: process IKE_AUTH request (no SKEYSEED) in v2_dispatch() | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #1 complete_v2_state_transition() PARENT_R1->PARENT_R1 with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #1 and saving MD 0x55701b940d18 | addref md@0x55701b940d18(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #1 is busy; has suspended MD 0x55701b940d18 | stop processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #1 spent 0.206 (0.209) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | job 2 for #1: ikev2_inI2outR2 KE (compute dh (V2)): helper 4 starting job | delref mdp@0x55701b940d18(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.216 (0.223) milliseconds in handle_packet_cb() reading and processing packet | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=32 salt-size=0 | "westnet-eastnet-aes" #1: spent 0.617 (0.626) milliseconds in helper 4 processing job 2 for state #1: ikev2_inI2outR2 KE (pcr) | job 2 for #1: ikev2_inI2outR2 KE (compute dh (V2)): helper thread 4 sending result back to state | scheduling resume sending helper answer back to state for #1 | libevent_malloc: newref ptr-libevent@0x7f3ed40030e8 size 128 | helper thread 4 has nothing to do | processing resume sending helper answer back to state for #1 | start processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #1 MD 0x55701b940d18 | job 2 for #1: ikev2_inI2outR2 KE (compute dh (V2)): processing response from helper 4 | job 2 for #1: ikev2_inI2outR2 KE (compute dh (V2)): calling continuation function 0x557019a27fe7 | ikev2_ike_sa_process_auth_request_no_skeyid_continue() for #1 STATE_PARENT_R1: calculating g^{xy}, sending R2 | DH secret MODP2048@0x7f3edc006ba8: transferring ownership from helper IKEv2 DH to state #1 | #1 in state PARENT_R1: sent IKE_SA_INIT reply | already have all fragments, skipping fragment collection | already have all fragments, skipping fragment collection | authenticator matched | #1 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDi) | **parse IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDi (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 56 (00 38) | processing payload: ISAKMP_NEXT_v2SA (len=52) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Responder: process IKE_AUTH request | Message ID: IKE #1 responder starting message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744608.581925 ike.wip.initiator=-1 ike.wip.responder=-1->1 | calling processor Responder: process IKE_AUTH request "westnet-eastnet-aes" #1: processing decrypted IKE_AUTH request: SK{IDi,IDr,AUTH,SA,TSi,TSr} | no certs to decode | #1 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | received IDr payload - extracting our alleged ID | refine_host_connection for IKEv2: starting with "westnet-eastnet-aes" | match_id a=@west | b=@west | results matched | refine_host_connection: checking "westnet-eastnet-aes" against "westnet-eastnet-aes", best=(none) with match=1(id=1(0)/ca=1(0)/reqca=1(0)) | warning: not switching back to template of current instance | peer expects us to be @east (ID_FQDN) according to its IDr payload | this connection's local id is @east (ID_FQDN) | refine_host_connection: checked "westnet-eastnet-aes" against "westnet-eastnet-aes", now for see if best | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | returning because exact peer id match | offered CA: '%none' "westnet-eastnet-aes" #1: IKEv2 mode peer ID is ID_FQDN: '@west' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @west | trying all preloaded keys public keys for RSA key that matches ID: @west | skipping '@east' with wrong ID | trying '@west' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | 60 bb be e0 ab e1 11 65 02 ae bd ce 50 a5 21 cf | 51 ff dc 5f 3e 66 43 4c f5 09 eb 8f ea 20 3e 00 | 35 28 63 60 a9 28 d1 34 03 76 ec ec d2 16 64 10 | 23 aa 35 9f 71 2f 2b 0c 66 b8 f1 8e dc e8 9e 59 | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x55701b9407a8(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQOm9dY/4 [preloaded keys] | #1 spent 0.0647 (0.0647) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes" #1: authenticated using RSA with SHA2_512 | #1 spent 0.0864 (0.0863) milliseconds in ikev2_verify_rsa_hash() | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b93c5f8(0->1) (in clone_logger() at log.c:817) | job 3 for #1: computing responder signature (signature): adding job to queue | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3edc006108 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93bd28 | #1 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93ace8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: newref ptr-libevent@0x55701b93ac38 size 128 | ikev2_parent_inI2outR2_continue_tail returned STF_SUSPEND | #1 spent 0.207 (0.21) milliseconds in processing: Responder: process IKE_AUTH request in v2_dispatch() | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #1 complete_v2_state_transition() PARENT_R1->ESTABLISHED_CHILD_SA with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #1 and saving MD 0x55701b940d18 | job 3 for #1: computing responder signature (signature): helper 3 starting job | addref md@0x55701b940d18(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #1 is busy; has suspended MD 0x55701b940d18 | hash to sign | 03 47 07 5a ea 36 2e 5e 2d 0d 30 33 5f 21 09 f5 | delref logger@0x55701b92ce58(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #1 suppresed complete_v2_state_transition() | 22 41 0a 9f 4d fc f7 f2 c7 f9 ee d8 9a e6 98 09 | ab 08 d0 ba 3d e3 09 40 a2 81 ee 90 14 a6 d6 ce | 36 1e 00 95 11 e4 25 e1 b6 51 c1 b7 1e 8a f9 fc | delref mdp@0x55701b940d18(2->1) (in resume_handler() at server.c:743) | RSA_sign_hash: Started using NSS | #1 spent 0.374 (0.389) milliseconds in resume sending helper answer back to state | stop processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ed40030e8 | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes" #1: spent 4.73 (4.79) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes" #1: spent 4.76 (4.83) milliseconds in v2_auth_signature() | "westnet-eastnet-aes" #1: spent 4.78 (4.85) milliseconds in helper 3 processing job 3 for state #1: computing responder signature (signature) | job 3 for #1: computing responder signature (signature): helper thread 3 sending result back to state | scheduling resume sending helper answer back to state for #1 | libevent_malloc: newref ptr-libevent@0x7f3ed8000d38 size 128 | helper thread 3 has nothing to do | processing resume sending helper answer back to state for #1 | start processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #1 MD 0x55701b940d18 | job 3 for #1: computing responder signature (signature): processing response from helper 3 | job 3 for #1: computing responder signature (signature): calling continuation function 0x55701995677f | parent state #1: PARENT_R1(half-open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #1 will start re-keying in 3330 seconds with margin of 270 seconds (attempting re-key) | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x55701b93ac38 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93ace8 | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b93ace8 | inserting event EVENT_SA_REKEY, timeout in 3330 seconds for #1 | libevent_malloc: newref ptr-libevent@0x7f3ed40030e8 size 128 | pstats #1 ikev2.ike established | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Responder - Payload | my identity: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | added IDr payload to packet | CHILD SA proposals received | going to assemble AUTH payload | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 71 0b a0 41 3c 26 fa c8 01 92 1b 87 5d bb 68 59 | d4 33 6f e9 48 88 fb 84 3b e5 e4 08 e0 86 bd 58 | af 7c 6c 00 ff 21 b2 00 03 06 d7 d1 96 5d 6f 8b | 86 f9 b5 27 29 db 72 00 28 30 62 5c 14 ed b4 77 | 9e 58 29 73 5d ac a4 33 d3 2a 56 45 18 01 7a 37 | 35 f3 9a 9c 59 a3 9b ba f4 78 f4 07 37 8d 5a 08 | 3b cf 0c 92 0a 46 3d 15 34 6d 9f 92 71 d3 23 e6 | 9f 59 ca 58 04 47 44 ed 86 20 a5 05 b6 37 e5 50 | d7 6e 0c f1 6d 20 2a f4 94 fe a5 4e 42 db 70 fd | 67 0f 17 18 44 aa 3e 74 47 a7 59 ff b6 4a 18 8d | e9 2d d4 2c 63 6f 72 6e ef 04 64 8e 0b 24 f3 60 | 5b d3 24 4e bc 5b 7c 4f 4f da 1e bb f0 21 06 d0 | c2 8e 8d 26 f6 66 e1 af 91 65 d6 bd b2 3f a8 ae | 61 f0 1d ee b2 af be 31 04 01 8d 5b f3 33 fa 42 | db de 37 5d 57 c7 87 41 5a 0a 0d 8c a2 fd e1 5c | 0e 2e 1a 38 cb 1a 13 0f 02 85 33 ae be 6e 34 20 | 80 e5 89 21 31 54 dd 0d 94 b8 7c 68 4e 6d 7d 2e | c5 fd | emitting length of IKEv2 Authentication Payload: 350 | newref alloc logger@0x55701b92ce58(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #2 at 0x55701b945a68 | State DB: adding IKEv2 state #2 in UNDEFINED | pstats #2 ikev2.child started | duplicating state object #1 "westnet-eastnet-aes" as #2 for IPSEC SA | #2 setting local endpoint to 192.1.2.23:500 from #1.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #1.#2 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744608.581925 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #2: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_R0(ignore) | #2.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #1 switching from IKE SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744608.581925 ike.wip.initiator=-1 ike.wip.responder=1->-1 | Message ID: CHILD #1.#2 switching to CHILD SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744608.581925 child.wip.initiator=-1 child.wip.responder=-1->1 | switching IKEv2 MD.ST from IKE #1 ESTABLISHED_IKE_SA to CHILD #2 V2_IKE_AUTH_CHILD_R0 (in ike_auth_child_responder() at ikev2_parent.c:3282) | Child SA TS Request has child->sa == md->st; so using child connection | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | looking for best SPD in current connection | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found better spd route for TSi[0],TSr[0] | looking for better host pair | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | checking hostpair 192.0.2.0/24:0 -> 192.0.1.0/24:0 is found | investigating connection "westnet-eastnet-aes" as a better match | match_id a=@west | b=@west | results matched | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | did not find a better connection using host pair | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | constructing ESP/AH proposals with all DH removed for westnet-eastnet-aes (IKE_AUTH responder matching remote ESP/AH proposals) | converting proposal AES_CBC-HMAC_SHA1_96 to ikev2 ... | forcing IKEv2 ESP AES_CBC ENCRYPT transform low-to-high key lengths: 128 256 | ... ikev2_proposal: 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED "westnet-eastnet-aes": local ESP/AH proposals (IKE_AUTH responder matching remote ESP/AH proposals): "westnet-eastnet-aes": 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH responder matching remote ESP/AH proposals 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 52 (00 34) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 4 (04) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | d0 4a 71 01 | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 3 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #2: proposal 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=d04a7101 chosen from remote proposals 1:ESP:ENCR=AES_CBC_128;ENCR=AES_CBC_256;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH responder matching remote ESP/AH proposals ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=d04a7101 | converting proposal to internal trans attrs | netlink_get_spi: allocated 0x1d9b75af for esp.0@192.1.2.23 | emitting ikev2_proposal ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: 1d 9b 75 af | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=36 | FOR_EACH_CONNECTION_... in IKE_SA_established | install_ipsec_sa() for #2: inbound and outbound | could_route called for westnet-eastnet-aes; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.d04a7101@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.1d9b75af@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | add inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.10000@192.1.2.23 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #2: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-aes (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #2 | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | eroute_connection add eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.0@192.1.2.45 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.d04a7101@192.1.2.45 | get_sa_info esp.1d9b75af@192.1.2.23 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0'... | popen cmd is 1137 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_: | cmd( 160):NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT=: | cmd( 240):'192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255: | cmd( 320):.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE: | cmd( 400):='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.: | cmd( 480):0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' P: | cmd( 560):LUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' P: | cmd( 640):LUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKE: | cmd( 720):V2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO: | cmd( 800):_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_IN: | cmd( 880):FO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_: | cmd( 960):CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VTI_: | cmd(1040):IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xd04a7101 SPI_OUT=0x1d9b75af i: | cmd(1120):psec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | get_sa_info esp.d04a7101@192.1.2.45 | get_sa_info esp.1d9b75af@192.1.2.23 | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONF... | popen cmd is 1142 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' P: | cmd( 160):LUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CL: | cmd( 240):IENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.25: | cmd( 320):5.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA: | cmd( 400):_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192: | cmd( 480):.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255: | cmd( 560):.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xf: | cmd( 640):rm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PF: | cmd( 720):S+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' : | cmd( 800):PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_D: | cmd( 880):NS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' P: | cmd( 960):LUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0': | cmd(1040): VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xd04a7101 SPI_OUT=0x1d9b7: | cmd(1120):5af ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | get_sa_info esp.d04a7101@192.1.2.45 | get_sa_info esp.1d9b75af@192.1.2.23 | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGUR... | popen cmd is 1140 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLU: | cmd( 160):TO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIE: | cmd( 240):NT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.: | cmd( 320):255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_T: | cmd( 400):YPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0: | cmd( 480):.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0: | cmd( 560):' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm: | cmd( 640):' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+: | cmd( 720):IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PL: | cmd( 800):UTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS: | cmd( 880):_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLU: | cmd( 960):TO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' V: | cmd(1040):TI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xd04a7101 SPI_OUT=0x1d9b75a: | cmd(1120):f ipsec _updown 2>&1: "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes" #1: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "westnet-eastnet-aes", setting eroute_owner {spd=0x55701b93af28,sr=0x55701b93af28} to #2 (was #0) (newest_ipsec_sa=#0) | ISAKMP_v2_IKE_AUTH: instance westnet-eastnet-aes[0], setting IKEv2 newest_ipsec_sa to #2 (was #0) (spd.eroute=#2) cloned from #1 | adding 10 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 496 | emitting length of ISAKMP Message: 524 | recording outgoing fragment failed | delref logger@0x55701b93c5f8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #1 switched MD.ST to #2 | suspend processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #2 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #2 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_R0 PARENT_R1->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_R1 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #2 | Message ID: CHILD #1.#2 updating responder received message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=0 ike.responder.recv=0->1 ike.responder.last_contact=744608.581925->744608.629149 child.wip.initiator=-1 child.wip.responder=1->-1 | Message ID: CHILD #1.#2 updating responder sent message response 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=0->1 ike.responder.recv=1 ike.responder.last_contact=744608.629149 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744608.629149 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #2: V2_IKE_AUTH_CHILD_R0(ignore) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #2 ikev2.child established | announcing the state transition "westnet-eastnet-aes" #2: negotiated connection [192.0.2.0-192.0.2.255:0-65535 0] -> [192.0.1.0-192.0.1.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes" #2: IPsec SA established tunnel mode {ESP=>0xd04a7101 <0x1d9b75af xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | sending 524 bytes for STATE_PARENT_R1 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | 94 08 00 37 6d 25 0c 92 04 53 57 ce b7 5f 35 6d | 30 ee d0 d7 f0 ef 8a 72 af c5 bc 53 0a aa 67 b8 | c5 ad 3d ae 49 50 59 ba be 7a 6f c8 67 e5 e2 fa | ac dc 33 68 4d 4f b1 f2 6c 36 4b 50 46 0e 0a 92 | 32 c1 8f 52 d7 0c c5 00 13 d5 ef 9a 14 55 a8 d8 | 9d 03 d0 3f 99 eb af 29 32 c8 01 2d f4 f3 76 16 | c9 af e9 0e 4e 86 f0 6c 61 5d 80 be 67 43 87 a3 | da 2b de d0 38 ce 00 d8 fd 54 65 fd b5 9e b5 2c | c2 90 11 89 f3 4e 7a d7 9d 1d e1 c3 f3 5d 0d c6 | 1b c4 10 b7 fc fb 3e 57 d1 dd 18 b9 72 9d d9 e1 | d7 d2 fc fd 61 61 fb 96 77 14 b9 ac 62 9e 75 9c | 23 41 6b e4 bd ae 45 61 31 39 de ae b5 34 14 ff | 65 f6 3d 17 9b b1 b1 cd 4c 86 0e d9 4c 71 c6 41 | 23 71 43 6d 6c fb e8 c9 f6 e3 12 91 36 14 00 6a | d3 70 cf c5 e6 fe 51 cf 30 3d 46 fa 79 89 96 33 | 97 ce e7 d5 c1 36 09 ea 93 4d 9b 07 6f 33 b9 4b | 01 1f 18 53 f4 d7 17 dc 3a 91 9d 00 c5 9a 4f f9 | 90 be 42 8b 73 94 51 e7 2e e3 9a 1f 83 70 de 5b | 41 0b b9 d2 1f 1c 83 ee eb 0e 24 ee d6 4e 5a 22 | 1c 34 2d 85 08 4f ce a8 df b4 22 20 d2 f7 2d 36 | 14 7f 6f eb 4c 55 09 78 53 92 cd 6d 7e 74 fd fb | fb cf b9 06 e2 46 eb 30 88 52 b7 f7 a2 99 a0 cb | 65 bb 96 96 b0 da 15 cc e8 36 c3 88 61 18 ca f3 | 36 6a 49 c1 89 15 f6 10 16 2e f4 df 5f 99 d8 75 | c4 53 14 89 50 86 a0 06 c6 8b da 6f 2d c2 d2 87 | fe 3c e5 6c 35 24 23 d8 70 41 fe 37 96 ab 45 e4 | c0 ab 5e 39 68 73 5d 72 1d 14 2b f8 b9 58 43 76 | e5 dc e4 ef 89 b0 cc a5 3e 8e 47 e3 58 32 67 0c | c6 4a 5f 34 85 5d 53 9d 70 b9 2b 18 0b 85 f6 02 | 82 27 f2 b8 9c 69 7f f8 12 c7 96 9e 48 44 3c 46 | e6 c0 61 4c e5 cf 16 fb 6a d1 fe ac | sent 1 messages | releasing #2's fd-fd@(nil) because IKEv2 transitions finished | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #2's IKE SA #1 | unpending state #1 connection "westnet-eastnet-aes" | releasing #1's fd-fd@(nil) because IKEv2 transitions finished so releaseing IKE SA | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #2 will start re-keying in 28530 seconds with margin of 270 seconds (attempting re-key) | state #2 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b93c5f8 | inserting event EVENT_SA_REKEY, timeout in 28530 seconds for #2 | libevent_malloc: newref ptr-libevent@0x55701b944708 size 128 | delref mdp@0x55701b940d18(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b92d058(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #1 spent 2 (34.5) milliseconds in resume sending helper answer back to state | stop processing: state #2 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ed8000d38 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00462 (0.00451) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00269 (0.00269) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00287 (0.00287) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00229 (0.00229) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b940d18(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93ac38(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | 48 1e 62 13 0e 91 cb 3e 00 00 a3 12 d5 2d 23 ab | cb d7 e8 2b f7 43 5c 8b 44 f3 ac 4f ee 1d ab 8f | 3c 39 5a da 17 6f 66 31 f8 13 9c c2 | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #1 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #1 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #1 is idle | Message ID: IKE #1 not a duplicate - message request 2 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744608.629149 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #1 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #1 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 12 (00 0c) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | processing payload: ISAKMP_NEXT_v2D (len=4) | selected state microcode Informational Request | Message ID: IKE #1 responder starting message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744608.629149 ike.wip.initiator=-1 ike.wip.responder=-1->2 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | parsing 4 raw bytes of IKEv2 Delete Payload into SPI | SPI | d0 4a 71 01 | delete IKEv2_SEC_PROTO_ESP SA(0xd04a7101) | v2 CHILD SA #2 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA | State DB: found IKEv2 state #2 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0xd04a7101) "westnet-eastnet-aes" #1: received Delete SA payload: delete IPsec State #2 now | pstats #2 ikev2.child deleted completed | #2 main thread spent 0 (0) milliseconds helper thread spent 0 (0) milliseconds in total | suspend processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | start processing: state #2 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #2: deleting other state #2 (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.149661s and NOT sending notification | child state #2: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.d04a7101@192.1.2.45 | get_sa_info esp.1d9b75af@192.1.2.23 "westnet-eastnet-aes" #2: ESP traffic information: in=0B out=0B | unsuspending #2 MD (nil) | should_send_delete: no, just because | child state #2: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) | state #2 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x55701b944708 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b93c5f8 | #2 STATE_CHILDSA_DEL: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.d04a7101@192.1.2.45 | get_sa_info esp.1d9b75af@192.1.2.23 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED... | popen cmd is 1139 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUT: | cmd( 160):O_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIEN: | cmd( 240):T='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.2: | cmd( 320):55.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TY: | cmd( 400):PE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.: | cmd( 480):1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0': | cmd( 560): PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm': | cmd( 640): PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+I: | cmd( 720):KEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLU: | cmd( 800):TO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_: | cmd( 880):INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUT: | cmd( 960):O_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VT: | cmd(1040):I_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xd04a7101 SPI_OUT=0x1d9b75af: | cmd(1120): ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.2.0/24:0 --0->- 192.0.1.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.2.0/24:0 dest 192.0.1.0/24:0 | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.d04a7101@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.d04a7101@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => unk.10000@192.1.2.23 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.1d9b75af@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.1d9b75af@192.1.2.23 included non-error error | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #2 in CHILDSA_DEL | child state #2: CHILDSA_DEL(informational) => UNDEFINED(ignore) | releasing #2's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #2 from 192.1.2.45:500 (in delete_state() at state.c:1239) | resume processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b92ce58(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload | local SPIs: 1d 9b 75 af | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 32 92 35 0f e3 77 3d 08 3f 55 38 04 e0 19 42 78 | 0c 7a 14 1e 7a 57 c1 44 2c 67 3a 4b 44 49 14 b3 | cb ac 35 42 76 6d 2e fc 6c d5 a7 44 | sent 1 messages | Message ID: IKE #1 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744608.629149 ike.wip.initiator=-1 ike.wip.responder=2 | Message ID: IKE #1 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=1->2 ike.responder.recv=1 ike.responder.last_contact=744608.629149 ike.wip.initiator=-1 ike.wip.responder=2 | #1 spent 0.745 (17.4) milliseconds in processing: Informational Request in v2_dispatch() | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #1 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_R0->PARENT_R1 | Message ID: updating counters for #1 | Message ID: IKE #1 updating responder received message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=2 ike.responder.recv=1->2 ike.responder.last_contact=744608.629149->744608.762201 ike.wip.initiator=-1 ike.wip.responder=2->-1 | Message ID: IKE #1 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744608.762201 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744608.762201 ike.wip.initiator=-1 ike.wip.responder=-1 | announcing the state transition "westnet-eastnet-aes" #1: established IKE SA | sending 76 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 32 92 35 0f e3 77 3d 08 3f 55 38 04 e0 19 42 78 | 0c 7a 14 1e 7a 57 c1 44 2c 67 3a 4b 44 49 14 b3 | cb ac 35 42 76 6d 2e fc 6c d5 a7 44 | sent 1 messages | #1 is retaining EVENT_SA_REKEY with is previously set timeout | stop processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #1 spent 1.04 (17.7) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b940d18(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b93ac38(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 1.05 (17.7) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00127 (0.00126) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b940d18(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93c5f8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | 3d f5 4d de ae 6e ce db 68 5c e2 f2 d2 2f 73 77 | ef 35 f9 15 43 d9 9d 4f dd 56 30 dc e3 b2 47 4c | d5 f7 b6 da f7 54 7e 3d 65 b1 c5 05 | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #1 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #1 st.st_msgid_lastrecv 2 md.hdr.isa_msgid 00000003 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #1 is idle | Message ID: IKE #1 not a duplicate - message request 3 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744608.762201 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #1 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #1 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 8 (00 08) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | processing payload: ISAKMP_NEXT_v2D (len=0) | selected state microcode Informational Request | Message ID: IKE #1 responder starting message request 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744608.762201 ike.wip.initiator=-1 ike.wip.responder=-1->3 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | adding 16 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | 68 09 04 db af b5 68 26 51 ae 5f 2a 58 ba ce 93 | b9 b2 c5 e7 1a f7 d3 41 5a 18 a0 9d 3b c9 98 8d | d0 37 6f dc 25 62 6e af b0 60 0d d7 | sent 1 messages | Message ID: IKE #1 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744608.762201 ike.wip.initiator=-1 ike.wip.responder=3 | Message ID: IKE #1 updating responder sent message response 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744608.579905 ike.responder.sent=2->3 ike.responder.recv=2 ike.responder.last_contact=744608.762201 ike.wip.initiator=-1 ike.wip.responder=3 | State DB: IKEv2 state not found (delete_ike_family) | pstats #1 ikev2.ike deleted completed | #1 main thread spent 4.71 (53.9) milliseconds helper thread spent 6.61 (6.7) milliseconds in total | [RE]START processing: state #1 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #1: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.1827s and NOT sending notification | parent state #1: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #1 MD (nil) | should_send_delete: no, just because | state #1 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f3ed40030e8 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b93ace8 | #1 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #1 in ESTABLISHED_IKE_SA | parent state #1: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #1's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@0x55701b9407a8(2->1) (in delete_state() at state.c:1202) | stop processing: state #1 from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b92cf28(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | in statetime_stop() and could not find #1 | XXX: processor 'Informational Request' for #1 deleted state MD.ST | processing: STOP state #0 (in ikev2_process_packet() at ikev2.c:1904) | in statetime_stop() and could not find #1 | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b940d18(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b93c5f8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.435 (0.441) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.005 (0.00491) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00246 (0.0024) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93ace8(0->1) (in read_message() at demux.c:103) | *received 510 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 01 fe 22 00 00 68 | 00 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 0c | 80 0e 00 80 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 28 00 01 08 00 0e 00 00 fa a3 19 71 | 3d 23 bf eb 49 de 15 8c 2f 8b 23 a1 41 0e fd a3 | 82 f9 75 ad 9f 8d 31 59 f7 a4 be 59 a6 16 89 5b | 01 f5 a3 3c 11 cd 2d 51 5a c6 6f 76 f7 ea 3b 84 | f3 82 72 1f bb 53 c9 0d 96 8b e4 ba 83 ab ae 7e | a1 cb d1 6e d0 24 cc f9 23 d8 db 9d 8b 6c 29 a3 | 2e f4 40 7d 76 15 06 62 45 ea 92 58 a7 4c 6b 48 | 68 70 4f d2 d6 ac e9 2c 10 b8 0e 9a da 7c da d0 | 16 08 cc fc 2e f9 70 bd 99 26 e1 b1 ba 7c 64 fa | ea 0d 70 e8 fa 3b bc 4a ab 18 d7 b8 b3 7e b5 e8 | 96 f5 9f 65 d6 78 b8 47 6d ed a0 3a 19 31 e7 5a | b9 6f 9d a2 76 3d 42 7a 94 e9 9b 51 eb c2 bf d8 | 14 b6 5f 6e b8 cc a9 12 cc 05 b2 e5 21 e7 c8 51 | b3 21 1c 78 26 11 6c d2 0e 9e e8 ef d7 3a c0 76 | 14 04 3c 5a 6d b9 6f 7c 0f 17 0d 76 a6 62 7d b5 | d0 ab 0d 6c f0 d6 a4 46 62 e2 72 ed b1 92 3f f1 | f4 01 51 c3 6f fe f0 74 d2 ec a8 7f 29 00 00 24 | 54 78 e2 31 c2 bd 34 df 8b 94 6a e9 98 b4 00 10 | d4 39 1b c9 1f 44 ab e4 8d f4 94 4f 56 03 aa 0c | 29 00 00 08 00 00 40 2e 29 00 00 0e 00 00 40 2f | 00 02 00 03 00 04 29 00 00 1c 00 00 40 04 b4 e1 | ed ef ab c0 04 2d 36 d2 68 ad 9d 1c 27 5c 38 e7 | 03 1f 00 00 00 1c 00 00 40 05 27 bb 2f d0 ae 59 | be 68 5b cd f1 98 e5 d2 4a 7a 36 7b b2 cd | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | length: 510 (00 00 01 fe) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Responder receiving an IKEv2 IKE_SA_INIT request | State DB: IKEv2 state not found (find_v2_ike_sa_by_initiator_spi) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 104 (00 68) | processing payload: ISAKMP_NEXT_v2SA (len=100) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | DDOS disabled and no cookie sent, continuing | looking for message matching transition from STATE_PARENT_R0 | trying Respond to IKE_SA_INIT | matched unencrypted message | find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=ECDSA+IKEV2_ALLOW but ignoring ports | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | found policy = RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 (westnet-eastnet-aes) | find_next_host_connection returns "westnet-eastnet-aes" | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | find_next_host_connection returns | found connection: "westnet-eastnet-aes" with policy ECDSA+IKEV2_ALLOW | newref alloc logger@0x55701b93bd28(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #3 at 0x55701b940d18 | State DB: adding IKEv2 state #3 in UNDEFINED | pstats #3 ikev2.ike started | parent state #3: UNDEFINED(ignore) => PARENT_R0(half-open IKE SA) | #3.st_v2_transition NULL -> PARENT_R0->PARENT_R1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #3 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744609.033406 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744609.033406 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes | westnet-eastnet-aes doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:4500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:500 at all | westnet-eastnet-aes doesn't match 192.1.2.23:4500 at all | oriented westnet-eastnet-aes's this | start processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1758) | Message ID: IKE #3 responder starting message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.033406 ike.wip.initiator=-1 ike.wip.responder=-1->0 | calling processor Respond to IKE_SA_INIT | #3 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | using existing local IKE proposals for connection westnet-eastnet-aes (IKE SA responder matching remote proposals): 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE responder 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 100 (00 64) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 11 (0b) | Comparing remote proposal 1 containing 11 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 1 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #3: proposal 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519[first-match] | accepted IKE proposal ikev2_proposal: 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048 | converting proposal to internal trans attrs | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 6a c3 f8 a0 76 2a 06 5c | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 27 bb 2f d0 ae 59 be 68 5b cd f1 98 e5 d2 4a 7a | 36 7b b2 cd | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 6a c3 f8 a0 76 2a 06 5c | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | b4 e1 ed ef ab c0 04 2d 36 d2 68 ad 9d 1c 27 5c | 38 e7 03 1f | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.45 | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b93fe18(0->1) (in clone_logger() at log.c:817) | job 4 for #3: ikev2_inI1outR1 KE (build KE and nonce): adding job to queue | state #3 has no .st_event to delete | #3 STATE_PARENT_R0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92d058 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: newref ptr-libevent@0x7f3ed8000d38 size 128 | #3 spent 0.337 (0.337) milliseconds in processing: Respond to IKE_SA_INIT in v2_dispatch() | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #3 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_SUSPEND | suspending state #3 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | job 4 for #3: ikev2_inI1outR1 KE (build KE and nonce): helper 5 starting job | #3 is busy; has suspended MD 0x55701b9449c8 | stop processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1760) | #3 spent 0.763 (0.771) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.774 (0.781) milliseconds in handle_packet_cb() reading and processing packet | "westnet-eastnet-aes" #3: spent 1.8 (2.11) milliseconds in helper 5 processing job 4 for state #3: ikev2_inI1outR1 KE (pcr) | job 4 for #3: ikev2_inI1outR1 KE (build KE and nonce): helper thread 5 sending result back to state | scheduling resume sending helper answer back to state for #3 | libevent_malloc: newref ptr-libevent@0x7f3ecc006108 size 128 | helper thread 5 has nothing to do | processing resume sending helper answer back to state for #3 | start processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #3 MD 0x55701b9449c8 | job 4 for #3: ikev2_inI1outR1 KE (build KE and nonce): processing response from helper 5 | job 4 for #3: ikev2_inI1outR1 KE (build KE and nonce): calling continuation function 0x557019a27fe7 | ikev2_parent_inI1outR1_continue() for #3 STATE_PARENT_R0: calculated ke+nonce, sending R1 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | emitting ikev2_proposal ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 44 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 48 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | DH secret MODP2048@0x7f3ecc006ba8: transferring ownership from helper KE to state #3 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | 40 1a c3 62 bc 71 f1 ac de fc 31 15 ff fb 05 4a | 9d 30 f8 23 80 3a c7 08 93 2e 23 fe 9b a6 45 3a | b9 13 d1 bb d4 a6 57 5d 13 93 55 fa d7 96 18 f4 | 45 11 82 71 9c a6 19 bc a6 61 e1 43 c6 89 e4 8f | 8a 2e f4 97 b6 bc 8e 49 0a 0a 17 58 ff 31 bd 39 | 3b 0f 28 b1 28 32 ee 71 16 fd 5c 82 d3 aa fd d3 | 77 43 ab 28 71 1e 2e 0e 79 b0 c1 f5 e4 0d 0e 94 | b5 f4 1d 6e 27 36 bf 48 ec f3 b6 23 64 84 ac 3e | eb 84 85 d0 98 6b 6b 3b 29 d8 be 2a 38 be 33 a5 | 4b 0a f2 1b 85 ea 5b 8a 06 ae e4 ff 71 5f 65 d4 | d1 92 46 4b a9 89 78 30 6d 22 90 4e 41 a4 41 0e | fa 12 94 26 a0 bc 41 6e e9 c8 21 20 a4 a5 de f2 | 5f 27 bb 89 ff d7 90 98 57 df 1f 80 d8 b5 83 42 | c0 0a e8 f8 96 31 4d 47 64 e8 08 5e 18 91 db 77 | ed b1 c3 91 37 4c 3a 41 fb 78 7d a4 48 0e 75 79 | 3f 12 c9 07 6f fa c0 71 8c 61 9c 0b a9 a6 97 c2 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | ec 07 b5 82 22 f7 10 1e 24 9b f5 43 e6 93 ad 9a | f3 0c fa 53 e6 56 a3 58 c1 07 1f 60 86 4c b8 63 | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 6a c3 f8 a0 76 2a 06 5c | natd_hash: rcookie= | 0b 42 76 fa 7e fb 01 81 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 17 dd 3e 28 61 2e 86 5b 11 56 fb 9f d8 b8 4c 19 | 36 c2 40 74 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 17 dd 3e 28 61 2e 86 5b 11 56 fb 9f d8 b8 4c 19 | 36 c2 40 74 | emitting length of IKEv2 Notify Payload: 28 | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 6a c3 f8 a0 76 2a 06 5c | natd_hash: rcookie= | 0b 42 76 fa 7e fb 01 81 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 92 96 ba ac 11 c8 58 5b 67 53 f2 a8 97 f1 80 61 | 20 a2 15 5d | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 92 96 ba ac 11 c8 58 5b 67 53 f2 a8 97 f1 80 61 | 20 a2 15 5d | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 454 | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #3 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_OK | transitioning from state STATE_PARENT_R0 to state STATE_PARENT_R1 | Message ID: updating counters for #3 | Message ID: IKE #3 updating responder received message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=-1 ike.responder.recv=-1->0 ike.responder.last_contact=744609.033406->744609.036483 ike.wip.initiator=-1 ike.wip.responder=0->-1 | Message ID: IKE #3 updating responder sent message response 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=-1->0 ike.responder.recv=0 ike.responder.last_contact=744609.036483 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #3 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.036483 ike.wip.initiator=-1 ike.wip.responder=-1 | parent state #3: PARENT_R0(half-open IKE SA) => PARENT_R1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes" #3: sent IKE_SA_INIT reply {auth=IKEv2 cipher=AES_CBC_128 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 454 bytes for STATE_PARENT_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 00 80 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 40 1a c3 62 bc 71 f1 ac de fc 31 15 | ff fb 05 4a 9d 30 f8 23 80 3a c7 08 93 2e 23 fe | 9b a6 45 3a b9 13 d1 bb d4 a6 57 5d 13 93 55 fa | d7 96 18 f4 45 11 82 71 9c a6 19 bc a6 61 e1 43 | c6 89 e4 8f 8a 2e f4 97 b6 bc 8e 49 0a 0a 17 58 | ff 31 bd 39 3b 0f 28 b1 28 32 ee 71 16 fd 5c 82 | d3 aa fd d3 77 43 ab 28 71 1e 2e 0e 79 b0 c1 f5 | e4 0d 0e 94 b5 f4 1d 6e 27 36 bf 48 ec f3 b6 23 | 64 84 ac 3e eb 84 85 d0 98 6b 6b 3b 29 d8 be 2a | 38 be 33 a5 4b 0a f2 1b 85 ea 5b 8a 06 ae e4 ff | 71 5f 65 d4 d1 92 46 4b a9 89 78 30 6d 22 90 4e | 41 a4 41 0e fa 12 94 26 a0 bc 41 6e e9 c8 21 20 | a4 a5 de f2 5f 27 bb 89 ff d7 90 98 57 df 1f 80 | d8 b5 83 42 c0 0a e8 f8 96 31 4d 47 64 e8 08 5e | 18 91 db 77 ed b1 c3 91 37 4c 3a 41 fb 78 7d a4 | 48 0e 75 79 3f 12 c9 07 6f fa c0 71 8c 61 9c 0b | a9 a6 97 c2 29 00 00 24 ec 07 b5 82 22 f7 10 1e | 24 9b f5 43 e6 93 ad 9a f3 0c fa 53 e6 56 a3 58 | c1 07 1f 60 86 4c b8 63 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 17 dd 3e 28 61 2e 86 5b 11 56 | fb 9f d8 b8 4c 19 36 c2 40 74 00 00 00 1c 00 00 | 40 05 92 96 ba ac 11 c8 58 5b 67 53 f2 a8 97 f1 | 80 61 20 a2 15 5d | sent 1 messages | state #3 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3ed8000d38 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92d058 | event_schedule: newref EVENT_SO_DISCARD-pe@0x55701b92d058 | inserting event EVENT_SO_DISCARD, timeout in 200 seconds for #3 | libevent_malloc: newref ptr-libevent@0x55701b93ab98 size 128 | delref logger@0x55701b93fe18(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #3 suppresed complete_v2_state_transition() | delref mdp@0x55701b9449c8(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b93ace8(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #3 spent 0.601 (0.666) milliseconds in resume sending helper answer back to state | stop processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ecc006108 | spent 0.0024 (0.00238) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93c5f8(0->1) (in read_message() at demux.c:103) | *received 544 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 c0 67 90 55 15 a6 0f ae ec 2e dd 23 | 99 61 73 47 e7 85 50 21 d5 fa af 66 f5 fa d9 89 | e7 78 c3 40 e2 ae 59 08 48 65 1c 84 f4 58 4c 58 | 5c 1e 92 e8 7c d3 8e 78 e8 df 2e ab 6a 31 d7 7c | 22 5e 64 16 99 35 59 bc 86 5a 31 d4 76 44 da 34 | d4 d2 1b e5 0e e3 a2 20 b4 f2 3e bf bc da 26 03 | 85 b6 f9 77 34 b9 b0 05 29 9c 8d 90 6b 7b 49 94 | a6 b5 96 9c 33 cd 69 2f 3b 61 29 c1 23 2e 63 fb | 97 e1 15 02 c3 5e 6c 03 2b 3e ae 20 00 17 e0 25 | 78 03 a3 1c 06 3d c8 12 9b 9f 17 ad cc 71 bb a0 | 44 b8 00 eb 6e f7 e1 62 ec 64 d3 bb e4 66 52 73 | 9b 2b 9b 72 ec e8 fe a3 a5 31 c7 13 c9 5b 99 d2 | 0c ee ab 52 07 94 85 a2 57 62 17 fb 87 99 09 45 | 73 a6 7a 1b bb 75 0f f7 a4 ad 30 26 8e da aa 63 | 4c 5d 75 07 84 61 dd 7d 53 96 18 e2 b0 4d 1e 02 | 7b bb 65 74 f8 ae ca 1c 71 0c e9 6c 88 34 49 fa | 5f ca e7 86 c0 30 76 21 1e b9 46 4f 74 f2 2f 65 | e4 87 2e 8c cb ba 9f 62 2f ed 97 b7 eb e4 b9 38 | 8a e5 c9 d1 ba 27 11 d9 f5 da 7a 4e 42 d6 ef 55 | 5d 9b 7f 7c 45 a2 5e 5a 24 de 84 5d 77 3b 65 d4 | f5 0a 98 1d b0 07 01 dd ea 4c 37 fa e1 8c fb ff | ce 00 2b b1 63 c8 96 f9 0a 49 53 69 ca 78 37 e2 | be 80 4a 46 2f 42 91 b5 a2 4d 1d 6e 23 61 cc 25 | 0b 1e 24 b3 c1 9a c6 86 fb 33 6d 5d 44 a2 66 53 | 5a eb 04 d1 9c 5e 3b 9c 97 9f 34 ee e7 1a 60 19 | 78 6a cf a9 c8 5b ee 9b 99 b6 28 45 2c 5a e4 77 | 4a c6 7e a7 95 9d 57 18 ec ef b9 35 4c 2c 59 6d | 70 ab 57 94 e7 43 f2 2c 60 9f 28 82 67 75 4c eb | c8 0f 87 a0 af f7 55 5c db a8 25 7d b7 38 a8 9f | 7e 8a 07 16 e6 2f a2 6b 3c 12 df 19 ae 61 62 b5 | 28 f0 2f 21 56 d3 fa 7c 3d 23 48 82 1e a0 af 40 | da 6c a2 ef b3 aa d1 1c 2c 1d 15 1f 6f 4f 3b c9 | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 544 (00 00 02 20) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request | State DB: found IKEv2 state #3 in PARENT_R1 (find_v2_ike_sa) | start processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #3 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #3 is idle | Message ID: IKE #3 not a duplicate - message request 1 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.036483 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 516 (02 04) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | processing payload: ISAKMP_NEXT_v2SKF (len=508) | #3 in state PARENT_R1: sent IKE_SA_INIT reply | received IKE encrypted fragment number '1', total number '1', next payload '35' | selected state microcode Responder: process IKE_AUTH request (no SKEYSEED) | calling processor Responder: process IKE_AUTH request (no SKEYSEED) | ikev2 parent ikev2_ike_sa_process_auth_request_no_skeyid(): calculating g^{xy} in order to decrypt I2 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f3ecc006ba8: transferring ownership from state #3 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b93c9c8(0->1) (in clone_logger() at log.c:817) | job 5 for #3: ikev2_inI2outR2 KE (compute dh (V2)): adding job to queue | state #3 deleting .st_event EVENT_SO_DISCARD | libevent_free: delref ptr-libevent@0x55701b93ab98 | free_event_entry: delref EVENT_SO_DISCARD-pe@0x55701b92d058 | #3 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92cf28 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: newref ptr-libevent@0x7f3ecc006108 size 128 | #3 spent 0.0479 (0.0477) milliseconds in processing: Responder: process IKE_AUTH request (no SKEYSEED) in v2_dispatch() | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #3 complete_v2_state_transition() PARENT_R1->PARENT_R1 with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #3 and saving MD 0x55701b9449c8 | job 5 for #3: ikev2_inI2outR2 KE (compute dh (V2)): helper 6 starting job | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #3 is busy; has suspended MD 0x55701b9449c8 | stop processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #3 spent 0.284 (0.404) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.293 (0.413) milliseconds in handle_packet_cb() reading and processing packet | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=16 salt-size=0 | "westnet-eastnet-aes" #3: spent 1 (1.06) milliseconds in helper 6 processing job 5 for state #3: ikev2_inI2outR2 KE (pcr) | job 5 for #3: ikev2_inI2outR2 KE (compute dh (V2)): helper thread 6 sending result back to state | scheduling resume sending helper answer back to state for #3 | libevent_malloc: newref ptr-libevent@0x7f3ed0004f78 size 128 | helper thread 6 has nothing to do | processing resume sending helper answer back to state for #3 | start processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #3 MD 0x55701b9449c8 | job 5 for #3: ikev2_inI2outR2 KE (compute dh (V2)): processing response from helper 6 | job 5 for #3: ikev2_inI2outR2 KE (compute dh (V2)): calling continuation function 0x557019a27fe7 | ikev2_ike_sa_process_auth_request_no_skeyid_continue() for #3 STATE_PARENT_R1: calculating g^{xy}, sending R2 | DH secret MODP2048@0x7f3ecc006ba8: transferring ownership from helper IKEv2 DH to state #3 | #3 in state PARENT_R1: sent IKE_SA_INIT reply | already have all fragments, skipping fragment collection | already have all fragments, skipping fragment collection | authenticator matched | #3 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDi) | **parse IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDi (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Responder: process IKE_AUTH request | Message ID: IKE #3 responder starting message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.036483 ike.wip.initiator=-1 ike.wip.responder=-1->1 | calling processor Responder: process IKE_AUTH request "westnet-eastnet-aes" #3: processing decrypted IKE_AUTH request: SK{IDi,IDr,AUTH,SA,TSi,TSr} | no certs to decode | #3 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | received IDr payload - extracting our alleged ID | refine_host_connection for IKEv2: starting with "westnet-eastnet-aes" | match_id a=@west | b=@west | results matched | refine_host_connection: checking "westnet-eastnet-aes" against "westnet-eastnet-aes", best=(none) with match=1(id=1(0)/ca=1(0)/reqca=1(0)) | warning: not switching back to template of current instance | peer expects us to be @east (ID_FQDN) according to its IDr payload | this connection's local id is @east (ID_FQDN) | refine_host_connection: checked "westnet-eastnet-aes" against "westnet-eastnet-aes", now for see if best | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | returning because exact peer id match | offered CA: '%none' "westnet-eastnet-aes" #3: IKEv2 mode peer ID is ID_FQDN: '@west' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @west | trying all preloaded keys public keys for RSA key that matches ID: @west | skipping '@east' with wrong ID | trying '@west' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | cb 2d f1 bb 3b 4b 55 1d 03 d9 0f 45 b4 a4 8e c7 | 6e 05 73 d5 e7 7b 4c 2c ba 24 17 80 2e 5c c6 78 | 5c e0 ce e0 36 40 42 03 81 67 72 25 23 87 7c 94 | 8b 57 4a 73 5f cc b9 50 ff 47 72 4a a4 38 85 7e | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x55701b9407a8(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQOm9dY/4 [preloaded keys] | #3 spent 0.0837 (0.0837) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes" #3: authenticated using RSA with SHA2_512 | #3 spent 0.125 (0.125) milliseconds in ikev2_verify_rsa_hash() | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b92d058(0->1) (in clone_logger() at log.c:817) | job 6 for #3: computing responder signature (signature): adding job to queue | state #3 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3ecc006108 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92cf28 | #3 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b946688 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: newref ptr-libevent@0x55701b93ace8 size 128 | ikev2_parent_inI2outR2_continue_tail returned STF_SUSPEND | #3 spent 0.327 (0.353) milliseconds in processing: Responder: process IKE_AUTH request in v2_dispatch() | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | job 6 for #3: computing responder signature (signature): helper 1 starting job | #3 complete_v2_state_transition() PARENT_R1->ESTABLISHED_CHILD_SA with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #3 and saving MD 0x55701b9449c8 | hash to sign | be c6 c3 54 6a da 7c e6 9e 5e 90 a9 e9 a9 bd 42 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #3 is busy; has suspended MD 0x55701b9449c8 | delref logger@0x55701b93c9c8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #3 suppresed complete_v2_state_transition() | delref mdp@0x55701b9449c8(2->1) (in resume_handler() at server.c:743) | #3 spent 0.55 (0.603) milliseconds in resume sending helper answer back to state | stop processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ed0004f78 | 7d 71 45 03 65 f0 14 fe 38 0a 8f a4 a8 03 87 61 | 3b 48 74 93 1a 09 96 6e 13 b9 1b 95 37 e8 fc a0 | f6 e1 2c 33 6e c4 5d c3 1f 67 d3 53 aa 89 4b aa | RSA_sign_hash: Started using NSS | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes" #3: spent 2.12 (2.16) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes" #3: spent 2.14 (2.22) milliseconds in v2_auth_signature() | "westnet-eastnet-aes" #3: spent 2.16 (2.23) milliseconds in helper 1 processing job 6 for state #3: computing responder signature (signature) | job 6 for #3: computing responder signature (signature): helper thread 1 sending result back to state | scheduling resume sending helper answer back to state for #3 | libevent_malloc: newref ptr-libevent@0x7f3ec4000d38 size 128 | helper thread 1 has nothing to do | processing resume sending helper answer back to state for #3 | start processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #3 MD 0x55701b9449c8 | job 6 for #3: computing responder signature (signature): processing response from helper 1 | job 6 for #3: computing responder signature (signature): calling continuation function 0x55701995677f | parent state #3: PARENT_R1(half-open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #3 will start re-keying in 3330 seconds with margin of 270 seconds (attempting re-key) | state #3 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x55701b93ace8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b946688 | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b93fe18 | inserting event EVENT_SA_REKEY, timeout in 3330 seconds for #3 | libevent_malloc: newref ptr-libevent@0x7f3ed0004f78 size 128 | pstats #3 ikev2.ike established | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Responder - Payload | my identity: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | added IDr payload to packet | CHILD SA proposals received | going to assemble AUTH payload | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 0f 75 04 3e f8 fb 7b 08 b1 08 37 70 9e c8 c5 28 | 26 d7 ea 18 41 5e d5 ba 2b 04 1f f0 89 06 11 c0 | 21 df 43 0b 33 07 e3 84 28 eb f9 69 bf 70 de f4 | 6f a9 b2 27 bb 82 0b fd 3a 9f 25 3b f7 01 f1 a7 | d9 8e 8d 9b 68 51 d5 3b 6d a1 0e e2 0d d9 6a ee | bc 28 9e a2 8e 88 c5 05 fd 00 f1 6a 61 5d 04 75 | eb 56 2b ee 91 93 cc e8 bc c5 f6 80 f6 6c a7 83 | 20 d5 88 ea 75 db 12 32 69 53 7e d6 ba 25 e2 a4 | 18 53 08 ee c2 5e 12 47 98 33 48 ec 5c 4e 82 7c | c8 70 a1 18 14 ae aa 06 df 1c 08 67 40 9b b3 d0 | 09 5d 8e 6d 20 b7 92 c4 fa 6e 20 95 b1 0e d4 66 | b4 a1 7e 73 e3 39 a7 68 7d 22 6b 94 17 3b 11 35 | df 76 f3 93 f0 cb 9e 04 8e 04 1d 9f 7e 3b 36 33 | 26 8b 73 1d 64 75 52 c3 3b b6 74 81 75 d2 db 51 | 30 e9 e9 c2 a9 c3 e9 0e a2 f6 ac 78 d2 62 b5 a0 | 4e 7f ff fd 2d c6 ad bf 0b cd 5b 14 8f f4 ca 7c | 0a c4 c2 4f 71 75 28 f9 73 78 d0 2e 50 05 f5 76 | ff 6c | emitting length of IKEv2 Authentication Payload: 350 | newref alloc logger@0x55701b93c9c8(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #4 at 0x55701b9421b8 | State DB: adding IKEv2 state #4 in UNDEFINED | pstats #4 ikev2.child started | duplicating state object #3 "westnet-eastnet-aes" as #4 for IPSEC SA | #4 setting local endpoint to 192.1.2.23:500 from #3.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #3.#4 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.036483 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #4: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_R0(ignore) | #4.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #3 switching from IKE SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.036483 ike.wip.initiator=-1 ike.wip.responder=1->-1 | Message ID: CHILD #3.#4 switching to CHILD SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.036483 child.wip.initiator=-1 child.wip.responder=-1->1 | switching IKEv2 MD.ST from IKE #3 ESTABLISHED_IKE_SA to CHILD #4 V2_IKE_AUTH_CHILD_R0 (in ike_auth_child_responder() at ikev2_parent.c:3282) | Child SA TS Request has child->sa == md->st; so using child connection | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | looking for best SPD in current connection | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found better spd route for TSi[0],TSr[0] | looking for better host pair | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | checking hostpair 192.0.2.0/24:0 -> 192.0.1.0/24:0 is found | investigating connection "westnet-eastnet-aes" as a better match | match_id a=@west | b=@west | results matched | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | did not find a better connection using host pair | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | using existing local ESP/AH proposals for westnet-eastnet-aes (IKE_AUTH responder matching remote ESP/AH proposals): 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH responder matching remote ESP/AH proposals 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | 10 c7 ae a4 | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #4: proposal 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=10c7aea4 chosen from remote proposals 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH responder matching remote ESP/AH proposals ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=10c7aea4 | converting proposal to internal trans attrs | netlink_get_spi: allocated 0x109a8188 for esp.0@192.1.2.23 | emitting ikev2_proposal ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: 10 9a 81 88 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=36 | FOR_EACH_CONNECTION_... in IKE_SA_established | install_ipsec_sa() for #4: inbound and outbound | could_route called for westnet-eastnet-aes; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" prospective erouted: self; eroute owner: self | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.10c7aea4@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.109a8188@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | add inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.10000@192.1.2.23 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #4: prospective erouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" prospective erouted: self; eroute owner: self | route_and_eroute with c: westnet-eastnet-aes (next: none) ero:westnet-eastnet-aes esr:{(nil)} ro:westnet-eastnet-aes rosr:{(nil)} and state: #4 | we are replacing an eroute | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | eroute_connection replace eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.0@192.1.2.45>tun.0@192.1.2.45 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.10c7aea4@192.1.2.45 | get_sa_info esp.109a8188@192.1.2.23 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0'... | popen cmd is 1137 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_: | cmd( 160):NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT=: | cmd( 240):'192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255: | cmd( 320):.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE: | cmd( 400):='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.: | cmd( 480):0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' P: | cmd( 560):LUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' P: | cmd( 640):LUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKE: | cmd( 720):V2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO: | cmd( 800):_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_IN: | cmd( 880):FO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_: | cmd( 960):CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VTI_: | cmd(1040):IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x10c7aea4 SPI_OUT=0x109a8188 i: | cmd(1120):psec _updown 2>&1: | route_and_eroute: firewall_notified: true | route_and_eroute: instance "westnet-eastnet-aes", setting eroute_owner {spd=0x55701b93af28,sr=0x55701b93af28} to #4 (was #0) (newest_ipsec_sa=#0) | ISAKMP_v2_IKE_AUTH: instance westnet-eastnet-aes[0], setting IKEv2 newest_ipsec_sa to #4 (was #0) (spd.eroute=#4) cloned from #3 | adding 10 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 496 | emitting length of ISAKMP Message: 524 | recording outgoing fragment failed | delref logger@0x55701b92d058(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #3 switched MD.ST to #4 | suspend processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #4 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #4 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_R0 PARENT_R1->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_R1 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #4 | Message ID: CHILD #3.#4 updating responder received message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=0 ike.responder.recv=0->1 ike.responder.last_contact=744609.036483->744609.064522 child.wip.initiator=-1 child.wip.responder=1->-1 | Message ID: CHILD #3.#4 updating responder sent message response 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=0->1 ike.responder.recv=1 ike.responder.last_contact=744609.064522 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #3 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.064522 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #4: V2_IKE_AUTH_CHILD_R0(ignore) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #4 ikev2.child established | announcing the state transition "westnet-eastnet-aes" #4: negotiated connection [192.0.2.0-192.0.2.255:0-65535 0] -> [192.0.1.0-192.0.1.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes" #4: IPsec SA established tunnel mode {ESP=>0x10c7aea4 <0x109a8188 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | sending 524 bytes for STATE_PARENT_R1 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | d4 1c 33 26 2e e5 2a d4 9c 17 50 f0 0d e3 37 6a | 53 d0 9b f7 1a e1 b8 e4 1b fa 1e 28 32 2b 8c 20 | 9a 60 e8 53 e2 a1 4e 0e 63 92 05 c7 81 18 56 72 | e4 3d b8 cd fd 8f c2 8e bb 9f f3 c8 c0 60 18 95 | 5d e7 3f 57 0a 3b 72 01 09 8e be f4 ff 46 17 13 | 61 d2 87 1d 66 c6 ab 9d d1 60 62 bf 08 1d 9f a8 | 57 95 0c c8 f2 53 8a 2d 77 27 22 36 f4 5c d8 1b | 4e b9 e3 f7 3c 87 43 5d 85 ff 5d 73 46 72 15 6f | ec 76 2e 14 8b 77 99 ca 84 5d 84 1a 06 a2 4f f6 | cc f7 b3 5c 5e 08 7a 6f 01 32 a5 7a ea fe 4c e4 | 48 8a 7b c5 46 c9 ed 1c 7f 62 4f d7 8c 88 31 a0 | 68 59 b6 b1 4d 13 06 07 17 36 88 47 74 d5 ab 85 | fb 7c d3 f9 59 4c 1a 7d 9c 19 5a 33 35 57 9e 59 | 88 3a 72 18 5d 14 a7 d9 63 a4 bf f7 a7 74 72 b3 | 3e e5 1d bc 1e ec 91 59 70 c9 03 11 a0 fc c7 ce | ee a0 5b 87 5c 32 88 a9 4f f4 c3 69 18 87 e7 16 | e1 8a 23 86 c1 10 d4 71 e2 16 e3 31 ae 26 db 48 | 66 75 2e a9 78 cd e5 69 34 5e 8b 42 90 be e6 6a | 9f 29 0a fa 5f a4 8c e1 70 9d 4d 3f 62 74 13 b8 | e2 a6 17 a2 c0 31 1d 6d 79 32 5f b2 f8 83 b6 55 | 99 22 7c fd ff 3e eb 3a 75 a2 68 87 2f 32 d4 79 | 81 be e8 28 e6 e6 5d 05 ae 21 6d 6c fa 6c 34 a1 | ba c8 f7 63 d8 54 8f 99 4e b1 9b a6 af e6 1a 2a | 48 1f c4 89 ee dc 3c a3 1c 05 d4 13 59 9f e2 66 | 13 11 60 ea f3 96 1c 1d f2 4c 42 eb ea c4 be 42 | d0 8e d1 3e d7 cc c6 23 fb ee 2d 38 f4 26 5f bf | b7 6f 06 dc e7 45 29 a9 77 96 05 39 db d0 08 a6 | e3 2a 42 73 d9 2f 3d 8a be b1 af 52 7e 08 09 4a | c7 6a c7 4c 1e 4e 9c 58 80 ef 13 87 4b cf 23 1a | 57 9e 0c d0 7f 83 07 85 9c ce 54 f5 04 d2 b0 90 | 0c 21 45 eb 94 45 71 5b 32 41 ca 1e | sent 1 messages | releasing #4's fd-fd@(nil) because IKEv2 transitions finished | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #4's IKE SA #3 | unpending state #3 connection "westnet-eastnet-aes" | releasing #3's fd-fd@(nil) because IKEv2 transitions finished so releaseing IKE SA | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #4 will start re-keying in 28530 seconds with margin of 270 seconds (attempting re-key) | state #4 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b92d058 | inserting event EVENT_SA_REKEY, timeout in 28530 seconds for #4 | libevent_malloc: newref ptr-libevent@0x55701b93ab98 size 128 | delref mdp@0x55701b9449c8(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b93c5f8(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #3 spent 1.41 (10.9) milliseconds in resume sending helper answer back to state | stop processing: state #4 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ec4000d38 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00478 (0.00457) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00243 (0.00237) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93c358(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | 16 41 cb 56 db 95 b9 b9 a0 cf 42 5d 1e 3f 72 dc | 1c 0d 6c 63 19 08 17 fe 3c ef 94 65 e6 a1 06 16 | 41 e7 8b 8e 45 dc 70 4f 1f 93 6b 19 | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #3 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #3 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #3 is idle | Message ID: IKE #3 not a duplicate - message request 2 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.064522 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #3 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #3 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 12 (00 0c) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | processing payload: ISAKMP_NEXT_v2D (len=4) | selected state microcode Informational Request | Message ID: IKE #3 responder starting message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.064522 ike.wip.initiator=-1 ike.wip.responder=-1->2 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | parsing 4 raw bytes of IKEv2 Delete Payload into SPI | SPI | 10 c7 ae a4 | delete IKEv2_SEC_PROTO_ESP SA(0x10c7aea4) | v2 CHILD SA #4 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA | State DB: found IKEv2 state #4 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0x10c7aea4) "westnet-eastnet-aes" #3: received Delete SA payload: delete IPsec State #4 now | pstats #4 ikev2.child deleted completed | #4 main thread spent 0 (0) milliseconds helper thread spent 0 (0) milliseconds in total | suspend processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | start processing: state #4 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #4: deleting other state #4 (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.134285s and NOT sending notification | child state #4: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.10c7aea4@192.1.2.45 | get_sa_info esp.109a8188@192.1.2.23 "westnet-eastnet-aes" #4: ESP traffic information: in=0B out=0B | unsuspending #4 MD (nil) | should_send_delete: no, just because | child state #4: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) | state #4 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x55701b93ab98 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b92d058 | #4 STATE_CHILDSA_DEL: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.10c7aea4@192.1.2.45 | get_sa_info esp.109a8188@192.1.2.23 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED... | popen cmd is 1139 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUT: | cmd( 160):O_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIEN: | cmd( 240):T='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.2: | cmd( 320):55.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TY: | cmd( 400):PE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.: | cmd( 480):1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0': | cmd( 560): PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm': | cmd( 640): PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+I: | cmd( 720):KEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLU: | cmd( 800):TO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_: | cmd( 880):INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUT: | cmd( 960):O_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VT: | cmd(1040):I_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x10c7aea4 SPI_OUT=0x109a8188: | cmd(1120): ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.2.0/24:0 --0->- 192.0.1.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.2.0/24:0 dest 192.0.1.0/24:0 | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.10c7aea4@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.10c7aea4@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => unk.10000@192.1.2.23 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.109a8188@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.109a8188@192.1.2.23 included non-error error | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #4 in CHILDSA_DEL | child state #4: CHILDSA_DEL(informational) => UNDEFINED(ignore) | releasing #4's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #4 from 192.1.2.45:500 (in delete_state() at state.c:1239) | resume processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b93c9c8(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload | local SPIs: 10 9a 81 88 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 37 ed b5 67 f5 70 71 2b 8e 6a 4d 99 2e cf 74 ed | a6 32 3c aa ac 15 d8 18 ec 7d d2 db 7a 19 2a 3b | 9d 33 e2 e8 69 3d 0d 58 05 fb 7b 06 | sent 1 messages | Message ID: IKE #3 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.064522 ike.wip.initiator=-1 ike.wip.responder=2 | Message ID: IKE #3 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=1->2 ike.responder.recv=1 ike.responder.last_contact=744609.064522 ike.wip.initiator=-1 ike.wip.responder=2 | #3 spent 0.812 (15.7) milliseconds in processing: Informational Request in v2_dispatch() | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #3 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_R0->PARENT_R1 | Message ID: updating counters for #3 | Message ID: IKE #3 updating responder received message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=2 ike.responder.recv=1->2 ike.responder.last_contact=744609.064522->744609.203921 ike.wip.initiator=-1 ike.wip.responder=2->-1 | Message ID: IKE #3 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.203921 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #3 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.203921 ike.wip.initiator=-1 ike.wip.responder=-1 | announcing the state transition "westnet-eastnet-aes" #3: established IKE SA | sending 76 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 37 ed b5 67 f5 70 71 2b 8e 6a 4d 99 2e cf 74 ed | a6 32 3c aa ac 15 d8 18 ec 7d d2 db 7a 19 2a 3b | 9d 33 e2 e8 69 3d 0d 58 05 fb 7b 06 | sent 1 messages | #3 is retaining EVENT_SA_REKEY with is previously set timeout | stop processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #3 spent 1.1 (16.1) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b93c358(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 1.12 (16.1) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00475 (0.00469) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.0022 (0.00222) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b92d058(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | 77 31 68 80 32 d6 a8 34 f3 3a 74 04 23 1f 91 45 | 62 2b a2 de 69 48 1a 7a 20 5c 34 96 e6 0e 43 d5 | ac 45 a7 1d 88 2d 4e 36 42 50 e9 91 | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #3 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #3 st.st_msgid_lastrecv 2 md.hdr.isa_msgid 00000003 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #3 is idle | Message ID: IKE #3 not a duplicate - message request 3 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.203921 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #3 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #3 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 8 (00 08) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | processing payload: ISAKMP_NEXT_v2D (len=0) | selected state microcode Informational Request | Message ID: IKE #3 responder starting message request 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.203921 ike.wip.initiator=-1 ike.wip.responder=-1->3 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | adding 16 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | 37 5d 9a 16 93 05 4d 27 a1 5a 47 44 29 dc 52 e4 | ab 9e 5b de ee e9 d4 7d f0 a4 6f 7b 20 dc a4 3b | 73 80 72 27 a9 bc 8d 52 2d 9f 57 c5 | sent 1 messages | Message ID: IKE #3 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.203921 ike.wip.initiator=-1 ike.wip.responder=3 | Message ID: IKE #3 updating responder sent message response 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.033406 ike.responder.sent=2->3 ike.responder.recv=2 ike.responder.last_contact=744609.203921 ike.wip.initiator=-1 ike.wip.responder=3 | State DB: IKEv2 state not found (delete_ike_family) | pstats #3 ikev2.ike deleted completed | #3 main thread spent 4.71 (29.4) milliseconds helper thread spent 4.96 (5.41) milliseconds in total | [RE]START processing: state #3 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #3: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.177655s and NOT sending notification | parent state #3: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #3 MD (nil) | should_send_delete: no, just because | state #3 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f3ed0004f78 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b93fe18 | #3 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #3 in ESTABLISHED_IKE_SA | parent state #3: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #3's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@0x55701b9407a8(2->1) (in delete_state() at state.c:1202) | stop processing: state #3 from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b93bd28(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | in statetime_stop() and could not find #3 | XXX: processor 'Informational Request' for #3 deleted state MD.ST | processing: STOP state #0 (in ikev2_process_packet() at ikev2.c:1904) | in statetime_stop() and could not find #3 | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b92d058(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.55 (0.683) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00205 (0.00204) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93fe18(0->1) (in read_message() at demux.c:103) | *received 510 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | e5 0b d6 ad a8 7a c5 b0 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 01 fe 22 00 00 68 | 00 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 28 00 01 08 00 0e 00 00 7a 07 ef 5e | 78 35 06 94 07 e0 b7 ec cb 3f dd d6 fe 0b 9b 7e | 28 34 af 67 1e 60 95 e4 39 56 a3 d1 9f a1 b6 7a | 3f 0f fe 6a bb 47 fb a0 ea b5 6b 61 4e ae 19 1d | 78 62 7b 9b 96 e5 c7 b8 7e fc 89 09 d6 d5 52 73 | 9e c3 68 a4 d1 6f 6b 69 74 7f 9e d1 a8 ac 5f d1 | 1c ec 45 63 d8 44 b8 8c a9 f2 36 13 6f 33 a7 13 | 32 33 e2 70 a8 de d4 20 bd da 2a 98 90 f0 0f 4e | 01 8f 53 fe 78 92 62 f5 db e5 1b 82 b7 dc 32 50 | 9b 89 2b 38 84 22 dc d9 6e 50 91 13 88 00 f0 45 | c7 09 a0 8a 05 97 6e bd 74 4f 16 aa fe e4 08 87 | e8 bb 05 44 31 a9 0e c4 99 e7 0f 5a f0 46 5e 0b | 4d 2b c5 34 95 b5 ec 50 f7 db d7 bf 53 87 e4 da | 82 f1 c9 46 0b 1a e9 15 4e ba e4 a9 5d 8e 99 54 | e5 0a 80 76 70 ee 6d 1a 95 c5 e3 82 43 9f 9b e0 | b4 31 2f 11 29 53 a2 4a 0e d0 fb 3d ee b6 96 b6 | e7 29 cd 0e 0b 25 fc e5 8f a6 46 c0 29 00 00 24 | c9 87 99 78 0a 7a ce ce 67 9d 76 4b b0 44 d6 72 | c4 95 92 df b9 f8 d9 4c 09 bc cb fb 11 94 83 43 | 29 00 00 08 00 00 40 2e 29 00 00 0e 00 00 40 2f | 00 02 00 03 00 04 29 00 00 1c 00 00 40 04 eb 50 | 4f 62 b7 f2 0a bc 3d 73 11 cb 9a 31 20 68 f8 cd | a7 4a 00 00 00 1c 00 00 40 05 f1 87 75 0c 4f 6a | 81 1f a6 be 27 47 73 d3 8a c2 21 5b d9 fa | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | length: 510 (00 00 01 fe) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Responder receiving an IKEv2 IKE_SA_INIT request | State DB: IKEv2 state not found (find_v2_ike_sa_by_initiator_spi) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 104 (00 68) | processing payload: ISAKMP_NEXT_v2SA (len=100) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | DDOS disabled and no cookie sent, continuing | looking for message matching transition from STATE_PARENT_R0 | trying Respond to IKE_SA_INIT | matched unencrypted message | find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=ECDSA+IKEV2_ALLOW but ignoring ports | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | found policy = RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 (westnet-eastnet-aes) | find_next_host_connection returns "westnet-eastnet-aes" | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | find_next_host_connection returns | found connection: "westnet-eastnet-aes" with policy ECDSA+IKEV2_ALLOW | newref alloc logger@0x55701b92cf28(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #5 at 0x55701b940d18 | State DB: adding IKEv2 state #5 in UNDEFINED | pstats #5 ikev2.ike started | parent state #5: UNDEFINED(ignore) => PARENT_R0(half-open IKE SA) | #5.st_v2_transition NULL -> PARENT_R0->PARENT_R1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #5 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744609.42248 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744609.42248 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes | westnet-eastnet-aes doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:4500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:500 at all | westnet-eastnet-aes doesn't match 192.1.2.23:4500 at all | oriented westnet-eastnet-aes's this | start processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1758) | Message ID: IKE #5 responder starting message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.42248 ike.wip.initiator=-1 ike.wip.responder=-1->0 | calling processor Respond to IKE_SA_INIT | #5 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | using existing local IKE proposals for connection westnet-eastnet-aes (IKE SA responder matching remote proposals): 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE responder 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 100 (00 64) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 11 (0b) | Comparing remote proposal 1 containing 11 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #5: proposal 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519[first-match] | accepted IKE proposal ikev2_proposal: 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048 | converting proposal to internal trans attrs | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | e5 0b d6 ad a8 7a c5 b0 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | f1 87 75 0c 4f 6a 81 1f a6 be 27 47 73 d3 8a c2 | 21 5b d9 fa | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | e5 0b d6 ad a8 7a c5 b0 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | eb 50 4f 62 b7 f2 0a bc 3d 73 11 cb 9a 31 20 68 | f8 cd a7 4a | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.45 | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b92ce58(0->1) (in clone_logger() at log.c:817) | job 7 for #5: ikev2_inI1outR1 KE (build KE and nonce): adding job to queue | state #5 has no .st_event to delete | #5 STATE_PARENT_R0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93c5f8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: newref ptr-libevent@0x7f3ec4000d38 size 128 | #5 spent 0.216 (0.219) milliseconds in processing: Respond to IKE_SA_INIT in v2_dispatch() | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #5 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_SUSPEND | suspending state #5 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #5 is busy; has suspended MD 0x55701b9449c8 | job 7 for #5: ikev2_inI1outR1 KE (build KE and nonce): helper 7 starting job | stop processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1760) | #5 spent 0.517 (0.522) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.524 (0.528) milliseconds in handle_packet_cb() reading and processing packet | "westnet-eastnet-aes" #5: spent 1.08 (1.11) milliseconds in helper 7 processing job 7 for state #5: ikev2_inI1outR1 KE (pcr) | job 7 for #5: ikev2_inI1outR1 KE (build KE and nonce): helper thread 7 sending result back to state | scheduling resume sending helper answer back to state for #5 | libevent_malloc: newref ptr-libevent@0x7f3ec8006108 size 128 | helper thread 7 has nothing to do | processing resume sending helper answer back to state for #5 | start processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #5 MD 0x55701b9449c8 | job 7 for #5: ikev2_inI1outR1 KE (build KE and nonce): processing response from helper 7 | job 7 for #5: ikev2_inI1outR1 KE (build KE and nonce): calling continuation function 0x557019a27fe7 | ikev2_parent_inI1outR1_continue() for #5 STATE_PARENT_R0: calculated ke+nonce, sending R1 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | emitting ikev2_proposal ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 44 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 48 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | DH secret MODP2048@0x7f3ec8006ba8: transferring ownership from helper KE to state #5 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | 9e ce c5 d1 9d 9b 0f 46 67 cf 69 9a 79 ef 0a 9b | fc 32 0d ef f0 cd 05 3b 88 66 a7 35 59 2b 57 35 | e7 29 40 eb 96 10 87 f9 e0 75 41 d6 71 3f f8 af | e9 3b 33 ab 7d c1 39 0c 74 3a 3c 4d 20 67 e2 26 | bd fb 5b 50 72 b7 ae 0c 0e 57 69 70 00 04 d5 17 | 0f 62 68 96 5d 8a ed 25 6a 2a 06 c0 04 9b 46 25 | 8a cc 64 58 7d 71 32 bd 01 99 d2 ed 7e 4e 26 9e | b3 36 f8 f1 c0 24 98 87 d6 11 0e db 1b 96 a6 b7 | f3 79 ab 92 4f a1 1a 43 20 5b 67 62 1e 60 25 ba | fe 96 cf fb c8 e4 d6 df 60 65 1a 50 5c 98 48 c5 | 20 05 0d 64 9e 1e 9d 79 02 8f 7d c6 96 e4 57 28 | d1 42 c7 e2 f3 26 b8 1b 89 59 33 f8 d9 43 aa 49 | a9 77 7d 97 e9 4b b0 53 c9 cf ce da 81 da 18 fe | 18 e1 46 93 a7 71 d0 fd 2f 2c bf 66 b5 36 a9 f9 | c6 e8 d6 ae 00 19 14 16 ab a6 4c 63 94 ce 3a f5 | b7 ba af a3 14 97 59 ca 55 9a b1 36 04 3a b7 32 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | d5 e4 4c f9 83 ac 77 24 a8 6a 96 3c a2 f5 d1 d2 | 59 cb d1 40 a7 1d 35 0a 54 af bc 70 0f 37 0b d8 | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | e5 0b d6 ad a8 7a c5 b0 | natd_hash: rcookie= | 4e f3 d1 eb 16 b6 5d 47 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 66 4a 31 b9 93 5b 0d 97 00 6e 51 01 74 d3 44 bc | 2d ad 1f f6 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 66 4a 31 b9 93 5b 0d 97 00 6e 51 01 74 d3 44 bc | 2d ad 1f f6 | emitting length of IKEv2 Notify Payload: 28 | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | e5 0b d6 ad a8 7a c5 b0 | natd_hash: rcookie= | 4e f3 d1 eb 16 b6 5d 47 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 65 e0 97 4d 22 d3 94 15 3b 3c 6f a7 7e 50 3c bc | 80 6e a9 f3 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 65 e0 97 4d 22 d3 94 15 3b 3c 6f a7 7e 50 3c bc | 80 6e a9 f3 | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 454 | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #5 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_OK | transitioning from state STATE_PARENT_R0 to state STATE_PARENT_R1 | Message ID: updating counters for #5 | Message ID: IKE #5 updating responder received message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=-1 ike.responder.recv=-1->0 ike.responder.last_contact=744609.42248->744609.424195 ike.wip.initiator=-1 ike.wip.responder=0->-1 | Message ID: IKE #5 updating responder sent message response 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=-1->0 ike.responder.recv=0 ike.responder.last_contact=744609.424195 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #5 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.424195 ike.wip.initiator=-1 ike.wip.responder=-1 | parent state #5: PARENT_R0(half-open IKE SA) => PARENT_R1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes" #5: sent IKE_SA_INIT reply {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 454 bytes for STATE_PARENT_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 9e ce c5 d1 9d 9b 0f 46 67 cf 69 9a | 79 ef 0a 9b fc 32 0d ef f0 cd 05 3b 88 66 a7 35 | 59 2b 57 35 e7 29 40 eb 96 10 87 f9 e0 75 41 d6 | 71 3f f8 af e9 3b 33 ab 7d c1 39 0c 74 3a 3c 4d | 20 67 e2 26 bd fb 5b 50 72 b7 ae 0c 0e 57 69 70 | 00 04 d5 17 0f 62 68 96 5d 8a ed 25 6a 2a 06 c0 | 04 9b 46 25 8a cc 64 58 7d 71 32 bd 01 99 d2 ed | 7e 4e 26 9e b3 36 f8 f1 c0 24 98 87 d6 11 0e db | 1b 96 a6 b7 f3 79 ab 92 4f a1 1a 43 20 5b 67 62 | 1e 60 25 ba fe 96 cf fb c8 e4 d6 df 60 65 1a 50 | 5c 98 48 c5 20 05 0d 64 9e 1e 9d 79 02 8f 7d c6 | 96 e4 57 28 d1 42 c7 e2 f3 26 b8 1b 89 59 33 f8 | d9 43 aa 49 a9 77 7d 97 e9 4b b0 53 c9 cf ce da | 81 da 18 fe 18 e1 46 93 a7 71 d0 fd 2f 2c bf 66 | b5 36 a9 f9 c6 e8 d6 ae 00 19 14 16 ab a6 4c 63 | 94 ce 3a f5 b7 ba af a3 14 97 59 ca 55 9a b1 36 | 04 3a b7 32 29 00 00 24 d5 e4 4c f9 83 ac 77 24 | a8 6a 96 3c a2 f5 d1 d2 59 cb d1 40 a7 1d 35 0a | 54 af bc 70 0f 37 0b d8 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 66 4a 31 b9 93 5b 0d 97 00 6e | 51 01 74 d3 44 bc 2d ad 1f f6 00 00 00 1c 00 00 | 40 05 65 e0 97 4d 22 d3 94 15 3b 3c 6f a7 7e 50 | 3c bc 80 6e a9 f3 | sent 1 messages | state #5 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3ec4000d38 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93c5f8 | event_schedule: newref EVENT_SO_DISCARD-pe@0x55701b942918 | inserting event EVENT_SO_DISCARD, timeout in 200 seconds for #5 | libevent_malloc: newref ptr-libevent@0x55701b93ab98 size 128 | delref logger@0x55701b92ce58(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #5 suppresed complete_v2_state_transition() | delref mdp@0x55701b9449c8(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b93fe18(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #5 spent 0.409 (0.427) milliseconds in resume sending helper answer back to state | stop processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ec8006108 | spent 0.0024 (0.00238) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93c5f8(0->1) (in read_message() at demux.c:103) | *received 544 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 6c 82 97 bf 7f e2 0c 55 4b 9d 01 99 | 9e c9 33 41 ee a5 14 52 7e 12 9b 88 88 e5 13 1e | 46 b2 3d ab d8 77 e2 24 d6 52 55 74 49 4b c0 f8 | 79 1f 73 fc a1 50 e5 c9 d6 a8 51 16 3d 6d ae b4 | b2 18 b0 52 53 e4 36 fe 01 9f 05 b4 c9 3f 74 3e | 5a 23 4c 60 36 7e c5 42 3b 29 7e 39 84 56 f5 f6 | cc 38 01 2b 47 5a 13 ea 90 18 87 8e 5c e5 16 bd | df aa 01 13 f1 d8 0d b5 0a 1f 75 61 9b e1 a9 79 | 61 e1 1b 09 f0 bb 3f 9f 90 9c 91 31 ad 52 0f 60 | d8 f5 c0 94 9c 08 32 da 4e 01 9f ee 18 90 82 85 | 29 e7 60 62 af 58 9d 6d 82 d6 23 04 ef 48 a2 59 | 1d 04 76 67 71 ad 6a bd d5 04 b3 71 d4 d4 3a 42 | 4a 92 e4 17 20 ea ce b9 17 24 1d 26 81 d2 3b 7b | 09 9f 63 79 09 57 06 41 17 1b 29 23 e9 c6 87 e8 | 16 cf 0e 31 50 e1 ba fb ef 2d 4c fb f1 00 76 ba | 22 f7 6f 79 91 f5 09 fb 16 85 aa e4 a3 33 7f ff | 32 58 40 4e de 51 30 27 49 f9 d5 23 8b fa 94 4e | b1 22 4a 21 c8 cb 43 0b b9 75 51 8d 88 4e 09 be | 39 08 55 70 99 d5 38 3e 01 14 03 11 d8 db d5 06 | 12 bb 51 29 ea 22 6c 2f 3d 06 83 06 29 70 87 b8 | 2e 02 d7 10 fa bc 5c 24 96 a4 1b 15 3c f5 21 e5 | ed 69 fa f7 19 00 b7 cb 8c 72 0c 9e d0 77 b5 13 | 13 ff b6 cd 65 df 45 58 d5 68 14 17 88 4e 6f 39 | 95 a6 19 d1 4f 44 72 5b 6a 3f 44 7d 15 f8 31 e8 | 32 83 39 93 8b 59 fd 7a b6 28 c1 c1 f1 44 d6 c0 | 06 28 c9 e2 8a d1 46 a7 41 5c 81 5b e8 88 21 58 | 0b e8 4b ed fe 39 46 c7 f5 07 14 b1 78 87 47 8e | 96 c4 31 e0 47 66 57 5f 7d 92 13 4e 55 98 d6 5e | 65 ae 6c c9 b7 d4 b4 5e 8b 3d db 1c 05 7e 23 fb | 43 17 e3 18 6c ae 3a 92 45 dc e7 af 9f 99 bc 06 | 3d 60 51 06 70 4a 3c ca 53 2e 4a 48 3a 2f e2 d9 | 47 31 9d 8c 59 18 fd 6a d0 01 e9 b9 ea b7 5d ab | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 544 (00 00 02 20) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request | State DB: found IKEv2 state #5 in PARENT_R1 (find_v2_ike_sa) | start processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #5 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #5 is idle | Message ID: IKE #5 not a duplicate - message request 1 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.424195 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 516 (02 04) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | processing payload: ISAKMP_NEXT_v2SKF (len=508) | #5 in state PARENT_R1: sent IKE_SA_INIT reply | received IKE encrypted fragment number '1', total number '1', next payload '35' | selected state microcode Responder: process IKE_AUTH request (no SKEYSEED) | calling processor Responder: process IKE_AUTH request (no SKEYSEED) | ikev2 parent ikev2_ike_sa_process_auth_request_no_skeyid(): calculating g^{xy} in order to decrypt I2 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f3ec8006ba8: transferring ownership from state #5 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b92d058(0->1) (in clone_logger() at log.c:817) | job 8 for #5: ikev2_inI2outR2 KE (compute dh (V2)): adding job to queue | state #5 deleting .st_event EVENT_SO_DISCARD | libevent_free: delref ptr-libevent@0x55701b93ab98 | free_event_entry: delref EVENT_SO_DISCARD-pe@0x55701b942918 | #5 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92ce58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: newref ptr-libevent@0x7f3ec8006108 size 128 | #5 spent 0.0503 (0.0502) milliseconds in processing: Responder: process IKE_AUTH request (no SKEYSEED) in v2_dispatch() | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #5 complete_v2_state_transition() PARENT_R1->PARENT_R1 with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #5 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #5 is busy; has suspended MD 0x55701b9449c8 | stop processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #5 spent 0.289 (0.296) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.298 (0.306) milliseconds in handle_packet_cb() reading and processing packet | job 8 for #5: ikev2_inI2outR2 KE (compute dh (V2)): helper 2 starting job | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=32 salt-size=0 | "westnet-eastnet-aes" #5: spent 0.969 (0.976) milliseconds in helper 2 processing job 8 for state #5: ikev2_inI2outR2 KE (pcr) | job 8 for #5: ikev2_inI2outR2 KE (compute dh (V2)): helper thread 2 sending result back to state | scheduling resume sending helper answer back to state for #5 | libevent_malloc: newref ptr-libevent@0x7f3edc002b48 size 128 | helper thread 2 has nothing to do | processing resume sending helper answer back to state for #5 | start processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #5 MD 0x55701b9449c8 | job 8 for #5: ikev2_inI2outR2 KE (compute dh (V2)): processing response from helper 2 | job 8 for #5: ikev2_inI2outR2 KE (compute dh (V2)): calling continuation function 0x557019a27fe7 | ikev2_ike_sa_process_auth_request_no_skeyid_continue() for #5 STATE_PARENT_R1: calculating g^{xy}, sending R2 | DH secret MODP2048@0x7f3ec8006ba8: transferring ownership from helper IKEv2 DH to state #5 | #5 in state PARENT_R1: sent IKE_SA_INIT reply | already have all fragments, skipping fragment collection | already have all fragments, skipping fragment collection | authenticator matched | #5 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDi) | **parse IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDi (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Responder: process IKE_AUTH request | Message ID: IKE #5 responder starting message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.424195 ike.wip.initiator=-1 ike.wip.responder=-1->1 | calling processor Responder: process IKE_AUTH request "westnet-eastnet-aes" #5: processing decrypted IKE_AUTH request: SK{IDi,IDr,AUTH,SA,TSi,TSr} | no certs to decode | #5 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | received IDr payload - extracting our alleged ID | refine_host_connection for IKEv2: starting with "westnet-eastnet-aes" | match_id a=@west | b=@west | results matched | refine_host_connection: checking "westnet-eastnet-aes" against "westnet-eastnet-aes", best=(none) with match=1(id=1(0)/ca=1(0)/reqca=1(0)) | warning: not switching back to template of current instance | peer expects us to be @east (ID_FQDN) according to its IDr payload | this connection's local id is @east (ID_FQDN) | refine_host_connection: checked "westnet-eastnet-aes" against "westnet-eastnet-aes", now for see if best | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | returning because exact peer id match | offered CA: '%none' "westnet-eastnet-aes" #5: IKEv2 mode peer ID is ID_FQDN: '@west' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @west | trying all preloaded keys public keys for RSA key that matches ID: @west | skipping '@east' with wrong ID | trying '@west' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | 92 4f cb 97 d9 24 d9 93 e7 06 db 22 30 95 f0 f9 | 59 b7 ad 4d 6f c1 b6 da 6d 1f 19 1c 05 e7 f5 88 | 1f e6 94 25 0e 04 fc 02 ea c1 a7 87 50 bb dd a5 | cb 16 b2 07 8b 90 18 c4 42 56 b8 16 99 1d 92 02 | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x55701b9407a8(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQOm9dY/4 [preloaded keys] | #5 spent 0.0849 (0.0849) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes" #5: authenticated using RSA with SHA2_512 | #5 spent 0.123 (0.123) milliseconds in ikev2_verify_rsa_hash() | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b942918(0->1) (in clone_logger() at log.c:817) | job 9 for #5: computing responder signature (signature): adding job to queue | state #5 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3ec8006108 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92ce58 | #5 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b948a28 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: newref ptr-libevent@0x55701b93ab98 size 128 | ikev2_parent_inI2outR2_continue_tail returned STF_SUSPEND | #5 spent 0.315 (0.315) milliseconds in processing: Responder: process IKE_AUTH request in v2_dispatch() | job 9 for #5: computing responder signature (signature): helper 4 starting job | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | hash to sign | b8 da ea 51 16 17 6d c1 23 e6 47 7c 38 3f 55 53 | 1a b9 76 3b 39 ce 5a 49 4a 59 d6 12 65 45 c5 d4 | df 3e a7 7c 5a 79 c1 af 60 5c 00 a8 e3 d4 43 cf | 1d 0b d2 a3 64 dc b1 55 b2 1a 14 82 60 04 c0 3f | #5 complete_v2_state_transition() PARENT_R1->ESTABLISHED_CHILD_SA with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | RSA_sign_hash: Started using NSS | suspending state #5 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #5 is busy; has suspended MD 0x55701b9449c8 | delref logger@0x55701b92d058(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #5 suppresed complete_v2_state_transition() | delref mdp@0x55701b9449c8(2->1) (in resume_handler() at server.c:743) | #5 spent 0.535 (0.548) milliseconds in resume sending helper answer back to state | stop processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3edc002b48 | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes" #5: spent 3.06 (3.09) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes" #5: spent 3.09 (3.12) milliseconds in v2_auth_signature() | "westnet-eastnet-aes" #5: spent 3.11 (3.14) milliseconds in helper 4 processing job 9 for state #5: computing responder signature (signature) | job 9 for #5: computing responder signature (signature): helper thread 4 sending result back to state | scheduling resume sending helper answer back to state for #5 | libevent_malloc: newref ptr-libevent@0x7f3ed40030e8 size 128 | helper thread 4 has nothing to do | processing resume sending helper answer back to state for #5 | start processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #5 MD 0x55701b9449c8 | job 9 for #5: computing responder signature (signature): processing response from helper 4 | job 9 for #5: computing responder signature (signature): calling continuation function 0x55701995677f | parent state #5: PARENT_R1(half-open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #5 will start re-keying in 3330 seconds with margin of 270 seconds (attempting re-key) | state #5 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x55701b93ab98 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b948a28 | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b93fe18 | inserting event EVENT_SA_REKEY, timeout in 3330 seconds for #5 | libevent_malloc: newref ptr-libevent@0x7f3edc002b48 size 128 | pstats #5 ikev2.ike established | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Responder - Payload | my identity: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | added IDr payload to packet | CHILD SA proposals received | going to assemble AUTH payload | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 01 9c a4 c2 90 06 55 f7 c0 d5 05 a0 84 cf 0c eb | 25 2f 8a 37 d1 62 76 7a d3 b5 c9 0a 17 bf e2 44 | 6f 28 a0 14 50 f3 72 2c 1c 65 b1 ef f4 41 b4 97 | 51 96 f0 69 99 ed fd 22 c1 80 c2 86 be 1a 6e d6 | 5b 05 d3 3c b7 99 b8 dc f5 7b 92 d5 e8 23 2d d9 | 70 84 67 90 96 10 94 44 ba 84 e1 04 8b 3c 02 ac | 6d 76 7f 90 df b7 b8 79 5b 09 e7 ca 6c 2b f4 5b | 0d 95 7a ab 84 88 42 0c 2a c2 8f 56 df ae 68 a3 | b6 1f 99 e5 cd 94 3c d6 42 6f d4 31 17 84 46 79 | 3e 50 58 26 46 44 04 b1 c1 77 97 fe 15 79 05 52 | 01 16 ee 69 03 da 9b 2b 81 d1 78 7e 30 ee 84 9c | 8a 9a 3c b5 69 e5 e5 08 fb 62 60 7b 0a a6 f3 ab | 05 74 0c 02 ba 4e a7 28 62 80 07 28 95 e9 09 11 | fa 48 5f af a0 6d 96 ae fb 91 7b 7a d5 a7 4b 56 | e7 ed d4 e8 4b db f3 2f 15 2a ab f7 34 7f 49 e7 | ea dc 21 fa cf 9a 76 cc f0 92 7b 09 40 ef 2e ba | da fa f7 c6 30 b2 1a 0c 21 0f f6 d9 9a e5 9f 52 | 49 2d | emitting length of IKEv2 Authentication Payload: 350 | newref alloc logger@0x55701b92d058(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #6 at 0x55701b949c68 | State DB: adding IKEv2 state #6 in UNDEFINED | pstats #6 ikev2.child started | duplicating state object #5 "westnet-eastnet-aes" as #6 for IPSEC SA | #6 setting local endpoint to 192.1.2.23:500 from #5.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #5.#6 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.424195 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #6: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_R0(ignore) | #6.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #5 switching from IKE SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.424195 ike.wip.initiator=-1 ike.wip.responder=1->-1 | Message ID: CHILD #5.#6 switching to CHILD SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.424195 child.wip.initiator=-1 child.wip.responder=-1->1 | switching IKEv2 MD.ST from IKE #5 ESTABLISHED_IKE_SA to CHILD #6 V2_IKE_AUTH_CHILD_R0 (in ike_auth_child_responder() at ikev2_parent.c:3282) | Child SA TS Request has child->sa == md->st; so using child connection | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | looking for best SPD in current connection | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found better spd route for TSi[0],TSr[0] | looking for better host pair | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | checking hostpair 192.0.2.0/24:0 -> 192.0.1.0/24:0 is found | investigating connection "westnet-eastnet-aes" as a better match | match_id a=@west | b=@west | results matched | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | did not find a better connection using host pair | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | using existing local ESP/AH proposals for westnet-eastnet-aes (IKE_AUTH responder matching remote ESP/AH proposals): 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH responder matching remote ESP/AH proposals 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | bd ec 73 84 | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 1 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #6: proposal 1:ESP=AES_CBC_256-HMAC_SHA1_96-DISABLED SPI=bdec7384 chosen from remote proposals 1:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH responder matching remote ESP/AH proposals ikev2_proposal: 1:ESP=AES_CBC_256-HMAC_SHA1_96-DISABLED SPI=bdec7384 | converting proposal to internal trans attrs | netlink_get_spi: allocated 0xcb6b2693 for esp.0@192.1.2.23 | emitting ikev2_proposal ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: cb 6b 26 93 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=32 .salt_size=0 keymat_len=52 | FOR_EACH_CONNECTION_... in IKE_SA_established | install_ipsec_sa() for #6: inbound and outbound | could_route called for westnet-eastnet-aes; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" prospective erouted: self; eroute owner: self | looking for alg with encrypt: AES_CBC keylen: 256 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=256 transid=12, key_size=32, encryptalg=12 | st->st_esp.keymat_len=52 is encrypt_keymat_size=32 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.bdec7384@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 256 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=256 transid=12, key_size=32, encryptalg=12 | st->st_esp.keymat_len=52 is encrypt_keymat_size=32 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.cb6b2693@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | add inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.10000@192.1.2.23 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #6: prospective erouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" prospective erouted: self; eroute owner: self | route_and_eroute with c: westnet-eastnet-aes (next: none) ero:westnet-eastnet-aes esr:{(nil)} ro:westnet-eastnet-aes rosr:{(nil)} and state: #6 | we are replacing an eroute | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | eroute_connection replace eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.0@192.1.2.45>tun.0@192.1.2.45 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.bdec7384@192.1.2.45 | get_sa_info esp.cb6b2693@192.1.2.23 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0'... | popen cmd is 1137 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_: | cmd( 160):NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT=: | cmd( 240):'192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255: | cmd( 320):.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE: | cmd( 400):='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.: | cmd( 480):0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' P: | cmd( 560):LUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' P: | cmd( 640):LUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKE: | cmd( 720):V2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO: | cmd( 800):_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_IN: | cmd( 880):FO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_: | cmd( 960):CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VTI_: | cmd(1040):IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xbdec7384 SPI_OUT=0xcb6b2693 i: | cmd(1120):psec _updown 2>&1: | route_and_eroute: firewall_notified: true | route_and_eroute: instance "westnet-eastnet-aes", setting eroute_owner {spd=0x55701b93af28,sr=0x55701b93af28} to #6 (was #0) (newest_ipsec_sa=#0) | ISAKMP_v2_IKE_AUTH: instance westnet-eastnet-aes[0], setting IKEv2 newest_ipsec_sa to #6 (was #0) (spd.eroute=#6) cloned from #5 | adding 10 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 496 | emitting length of ISAKMP Message: 524 | recording outgoing fragment failed | delref logger@0x55701b942918(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #5 switched MD.ST to #6 | suspend processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #6 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #6 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_R0 PARENT_R1->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_R1 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #6 | Message ID: CHILD #5.#6 updating responder received message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=0 ike.responder.recv=0->1 ike.responder.last_contact=744609.424195->744609.445296 child.wip.initiator=-1 child.wip.responder=1->-1 | Message ID: CHILD #5.#6 updating responder sent message response 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=0->1 ike.responder.recv=1 ike.responder.last_contact=744609.445296 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #5 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.445296 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #6: V2_IKE_AUTH_CHILD_R0(ignore) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #6 ikev2.child established | announcing the state transition "westnet-eastnet-aes" #6: negotiated connection [192.0.2.0-192.0.2.255:0-65535 0] -> [192.0.1.0-192.0.1.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes" #6: IPsec SA established tunnel mode {ESP=>0xbdec7384 <0xcb6b2693 xfrm=AES_CBC_256-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | sending 524 bytes for STATE_PARENT_R1 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | 5c e2 b0 1e 8a 59 4a 46 09 93 e3 64 3b 8e 4f 63 | bf da 03 bb 9c 37 f4 c5 2c 1c 68 1a 0e 55 74 65 | d5 7e e7 48 7c 80 7c 55 75 de 91 e0 f7 36 d4 30 | e8 18 c9 92 90 ea 0d 3f 1d d6 df 3e 42 c0 74 69 | 52 24 99 43 da fa fe dc 82 09 99 6f 6d 12 bb d7 | 7d c8 78 9a c1 82 65 0c e0 b9 c0 f6 ba 98 db 11 | 28 d1 8a 6a 66 16 9d 27 ff 61 4c 25 4d 36 8d 2e | 60 a7 35 65 cf 20 fb 50 8a 11 9b db b8 23 5e 27 | 0f e1 7c c3 6c 51 6f 79 93 d2 03 cf 1a a5 d8 9f | 49 e9 4b 84 f4 f0 85 54 04 4b 6a 8b 34 97 5b 50 | ff 25 19 42 df 43 9f 94 f0 9e 44 94 13 07 61 0b | bc 21 cb 5b 21 1e 48 5c de cc 1d b1 d8 9e b3 81 | a7 ad b9 17 15 6f cb 92 3e 3d 4e 8d ad 63 29 8c | f5 c5 5f 3b e2 8a 7b c6 9e 99 19 0c 35 3a ab af | 33 66 45 9c 2e b0 59 3f bd 36 a8 1b 1e 34 67 90 | 14 ad 8e 9f 10 29 f9 9e 7c a2 37 00 a4 90 18 dd | 9f 72 49 f7 bd 89 af 85 32 70 ef 4c 50 f8 d4 8c | f8 da a8 eb 94 27 94 b6 39 2b 85 7c f9 34 a4 97 | 40 7b 43 88 d6 44 1d c5 5d ff 71 c6 00 eb fd eb | 4d 71 c8 2f 70 1d 07 9b 51 96 a6 cc a1 97 5e de | ce e7 aa 02 92 7a d0 0f 95 12 7c 10 9e 40 37 49 | 4e 41 66 2b 6b c3 70 03 76 79 98 d1 0d c2 c0 75 | f7 c7 95 d9 a5 93 41 92 64 c1 ef c0 b4 07 f4 02 | 9c 3a 86 47 1b 34 cc c5 81 08 38 cd c3 69 2e d8 | d2 79 18 64 9a 94 78 32 81 69 4c 31 43 5b 8f 0a | cc 0d 4f 00 ae 82 0c 57 7e 5e 37 74 38 fb fa 1d | 15 b9 65 d6 c7 f6 cf e9 eb fa cf 75 23 ed d4 3e | d5 d8 04 55 00 4d 10 76 19 76 6c ea 76 aa a3 fc | 55 e1 14 24 69 2c 6a 9e a2 d6 89 da 20 d9 57 f5 | de ec 89 63 bc 5c 46 a3 aa 5e 86 cf 91 84 44 99 | 1a cb 75 3c 3d b2 0c b9 de 67 95 b2 | sent 1 messages | releasing #6's fd-fd@(nil) because IKEv2 transitions finished | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #6's IKE SA #5 | unpending state #5 connection "westnet-eastnet-aes" | releasing #5's fd-fd@(nil) because IKEv2 transitions finished so releaseing IKE SA | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #6 will start re-keying in 28530 seconds with margin of 270 seconds (attempting re-key) | state #6 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b942918 | inserting event EVENT_SA_REKEY, timeout in 28530 seconds for #6 | libevent_malloc: newref ptr-libevent@0x55701b948208 size 128 | delref mdp@0x55701b9449c8(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b93c5f8(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #5 spent 1.79 (10.4) milliseconds in resume sending helper answer back to state | stop processing: state #6 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ed40030e8 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00526 (0.00516) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00221 (0.00224) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93ac08(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | ad 8d 2e f2 02 aa a1 c3 e6 b0 d1 4c 99 66 d5 80 | 1a 57 78 58 46 b9 01 a2 d8 e1 6c e3 20 25 2f 87 | df 3d 8f 0c 90 1a 99 18 ee 61 98 a6 | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #5 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #5 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #5 is idle | Message ID: IKE #5 not a duplicate - message request 2 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.445296 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #5 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #5 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 12 (00 0c) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | processing payload: ISAKMP_NEXT_v2D (len=4) | selected state microcode Informational Request | Message ID: IKE #5 responder starting message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.445296 ike.wip.initiator=-1 ike.wip.responder=-1->2 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | parsing 4 raw bytes of IKEv2 Delete Payload into SPI | SPI | bd ec 73 84 | delete IKEv2_SEC_PROTO_ESP SA(0xbdec7384) | v2 CHILD SA #6 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA | State DB: found IKEv2 state #6 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0xbdec7384) "westnet-eastnet-aes" #5: received Delete SA payload: delete IPsec State #6 now | pstats #6 ikev2.child deleted completed | #6 main thread spent 0 (0) milliseconds helper thread spent 0 (0) milliseconds in total | suspend processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | start processing: state #6 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #6: deleting other state #6 (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.159606s and NOT sending notification | child state #6: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.bdec7384@192.1.2.45 | get_sa_info esp.cb6b2693@192.1.2.23 "westnet-eastnet-aes" #6: ESP traffic information: in=0B out=0B | unsuspending #6 MD (nil) | should_send_delete: no, just because | child state #6: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) | state #6 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x55701b948208 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b942918 | #6 STATE_CHILDSA_DEL: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.bdec7384@192.1.2.45 | get_sa_info esp.cb6b2693@192.1.2.23 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED... | popen cmd is 1139 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUT: | cmd( 160):O_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIEN: | cmd( 240):T='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.2: | cmd( 320):55.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TY: | cmd( 400):PE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.: | cmd( 480):1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0': | cmd( 560): PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm': | cmd( 640): PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+I: | cmd( 720):KEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLU: | cmd( 800):TO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_: | cmd( 880):INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUT: | cmd( 960):O_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VT: | cmd(1040):I_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xbdec7384 SPI_OUT=0xcb6b2693: | cmd(1120): ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.2.0/24:0 --0->- 192.0.1.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.2.0/24:0 dest 192.0.1.0/24:0 | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.bdec7384@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.bdec7384@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => unk.10000@192.1.2.23 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.cb6b2693@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.cb6b2693@192.1.2.23 included non-error error | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #6 in CHILDSA_DEL | child state #6: CHILDSA_DEL(informational) => UNDEFINED(ignore) | releasing #6's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #6 from 192.1.2.45:500 (in delete_state() at state.c:1239) | resume processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b92d058(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload | local SPIs: cb 6b 26 93 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | f4 0c ac 38 a4 ef 5b b8 28 6d 03 77 2d e7 43 65 | 94 a6 a3 b2 dd d4 57 ef bd fa 13 c8 d9 c5 cf 5f | d9 12 f1 de 27 8c dc 2a 0a ac 13 49 | sent 1 messages | Message ID: IKE #5 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.445296 ike.wip.initiator=-1 ike.wip.responder=2 | Message ID: IKE #5 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=1->2 ike.responder.recv=1 ike.responder.last_contact=744609.445296 ike.wip.initiator=-1 ike.wip.responder=2 | #5 spent 0.648 (11.2) milliseconds in processing: Informational Request in v2_dispatch() | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #5 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_R0->PARENT_R1 | Message ID: updating counters for #5 | Message ID: IKE #5 updating responder received message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=2 ike.responder.recv=1->2 ike.responder.last_contact=744609.445296->744609.606068 ike.wip.initiator=-1 ike.wip.responder=2->-1 | Message ID: IKE #5 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.606068 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #5 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.606068 ike.wip.initiator=-1 ike.wip.responder=-1 | announcing the state transition "westnet-eastnet-aes" #5: established IKE SA | sending 76 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | f4 0c ac 38 a4 ef 5b b8 28 6d 03 77 2d e7 43 65 | 94 a6 a3 b2 dd d4 57 ef bd fa 13 c8 d9 c5 cf 5f | d9 12 f1 de 27 8c dc 2a 0a ac 13 49 | sent 1 messages | #5 is retaining EVENT_SA_REKEY with is previously set timeout | stop processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #5 spent 0.937 (11.5) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b93ac08(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.954 (11.5) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00143 (0.00142) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b942918(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | 9d 4c 8e 33 30 25 53 d4 ba 90 06 38 8c 32 80 07 | 16 d7 48 3d 01 82 81 6d 52 91 4a 1c 44 d8 3b 67 | 43 2d fb 75 14 8e 48 a9 40 e0 2c 15 | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #5 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #5 st.st_msgid_lastrecv 2 md.hdr.isa_msgid 00000003 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #5 is idle | Message ID: IKE #5 not a duplicate - message request 3 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.606068 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #5 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #5 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 8 (00 08) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | processing payload: ISAKMP_NEXT_v2D (len=0) | selected state microcode Informational Request | Message ID: IKE #5 responder starting message request 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.606068 ike.wip.initiator=-1 ike.wip.responder=-1->3 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | adding 16 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | 11 f3 2e 58 54 3b a5 17 7d 5f 4c fa a4 d1 42 b1 | 56 96 0b 11 03 cb 5e fd e4 8f 0c ed 9d 81 9f 6f | 2e 08 d7 9b 9d fa 6f 23 30 c3 ab 59 | sent 1 messages | Message ID: IKE #5 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.606068 ike.wip.initiator=-1 ike.wip.responder=3 | Message ID: IKE #5 updating responder sent message response 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.42248 ike.responder.sent=2->3 ike.responder.recv=2 ike.responder.last_contact=744609.606068 ike.wip.initiator=-1 ike.wip.responder=3 | State DB: IKEv2 state not found (delete_ike_family) | pstats #5 ikev2.ike deleted completed | #5 main thread spent 4.47 (23.7) milliseconds helper thread spent 5.16 (5.23) milliseconds in total | [RE]START processing: state #5 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #5: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.183955s and NOT sending notification | parent state #5: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #5 MD (nil) | should_send_delete: no, just because | state #5 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f3edc002b48 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b93fe18 | #5 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #5 in ESTABLISHED_IKE_SA | parent state #5: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #5's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@0x55701b9407a8(2->1) (in delete_state() at state.c:1202) | stop processing: state #5 from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b92cf28(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | in statetime_stop() and could not find #5 | XXX: processor 'Informational Request' for #5 deleted state MD.ST | processing: STOP state #0 (in ikev2_process_packet() at ikev2.c:1904) | in statetime_stop() and could not find #5 | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b942918(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.367 (0.374) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00384 (0.0038) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00207 (0.00206) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93fe18(0->1) (in read_message() at demux.c:103) | *received 510 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | a7 9b 4b 3b b2 27 9d 65 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 01 fe 22 00 00 68 | 00 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 0c | 80 0e 00 80 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 28 00 01 08 00 0e 00 00 9e 8c 07 a7 | 4e 13 ca bf ab d9 8e b7 e3 63 e9 1a 4a c6 e6 93 | 14 af f3 b7 68 a2 00 72 4c e4 dd 36 b6 57 97 fb | 79 2c 74 c2 fa 6b 7d a5 50 ed e0 05 3b 5d 68 0c | 02 0b 88 e2 70 ea 03 4c 1e e2 6b 2d e8 b0 d1 8b | ff 51 03 bc ed a5 80 29 73 9a 3c 52 6e f6 b3 96 | ba 13 13 f6 64 eb 92 5a e1 58 7a c9 2f e6 ec ba | 94 73 b9 b2 c9 a4 13 df 55 71 a2 fc 52 8b a0 22 | 73 8f 77 1a 34 4f 39 86 2e e4 92 8d 07 06 d5 3f | c4 e0 77 c3 0d a0 68 a4 4f da 0b ca 01 e8 d5 17 | df fa d3 69 15 9d 22 4e 02 8c 96 e1 63 3b 70 86 | ee 56 1b 19 8b 5e 2c f7 31 3d e3 de 04 e6 57 7b | 45 fb 14 17 9e 8f 8a ec 58 f0 d2 32 f5 af 9d 29 | de 81 e6 ef db df 9b e6 ad db 86 2b 33 a6 50 7c | f9 1d 85 fb 5b ac 0d 4f ac 51 a8 0c d7 51 43 e8 | 87 c6 74 5f 48 63 12 12 f9 11 7c 9b b5 38 4a 35 | 71 d7 c7 61 f6 7c 5a eb 5b fd b7 af 29 00 00 24 | 7a 6a 1e 63 6a e3 b8 80 84 d0 e8 11 a2 f5 32 b2 | c0 45 39 6b cc 26 7b 18 32 0d f2 23 e3 af 4b 84 | 29 00 00 08 00 00 40 2e 29 00 00 0e 00 00 40 2f | 00 02 00 03 00 04 29 00 00 1c 00 00 40 04 ae 44 | 14 22 d1 43 c3 a5 15 d1 af d0 e0 83 16 be 60 ea | a9 cc 00 00 00 1c 00 00 40 05 db 06 b5 95 c9 9e | b0 cc 12 7f fc 36 cc 28 61 24 29 84 c6 8c | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | length: 510 (00 00 01 fe) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Responder receiving an IKEv2 IKE_SA_INIT request | State DB: IKEv2 state not found (find_v2_ike_sa_by_initiator_spi) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 104 (00 68) | processing payload: ISAKMP_NEXT_v2SA (len=100) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | DDOS disabled and no cookie sent, continuing | looking for message matching transition from STATE_PARENT_R0 | trying Respond to IKE_SA_INIT | matched unencrypted message | find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=ECDSA+IKEV2_ALLOW but ignoring ports | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | found policy = RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 (westnet-eastnet-aes) | find_next_host_connection returns "westnet-eastnet-aes" | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | find_next_host_connection returns | found connection: "westnet-eastnet-aes" with policy ECDSA+IKEV2_ALLOW | newref alloc logger@0x55701b93ab98(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #7 at 0x55701b940d18 | State DB: adding IKEv2 state #7 in UNDEFINED | pstats #7 ikev2.ike started | parent state #7: UNDEFINED(ignore) => PARENT_R0(half-open IKE SA) | #7.st_v2_transition NULL -> PARENT_R0->PARENT_R1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #7 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744609.831847 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744609.831847 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes | westnet-eastnet-aes doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:4500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:500 at all | westnet-eastnet-aes doesn't match 192.1.2.23:4500 at all | oriented westnet-eastnet-aes's this | start processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1758) | Message ID: IKE #7 responder starting message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.831847 ike.wip.initiator=-1 ike.wip.responder=-1->0 | calling processor Respond to IKE_SA_INIT | #7 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | using existing local IKE proposals for connection westnet-eastnet-aes (IKE SA responder matching remote proposals): 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE responder 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 100 (00 64) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 11 (0b) | Comparing remote proposal 1 containing 11 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 1 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #7: proposal 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519[first-match] | accepted IKE proposal ikev2_proposal: 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048 | converting proposal to internal trans attrs | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | a7 9b 4b 3b b2 27 9d 65 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | db 06 b5 95 c9 9e b0 cc 12 7f fc 36 cc 28 61 24 | 29 84 c6 8c | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | a7 9b 4b 3b b2 27 9d 65 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | ae 44 14 22 d1 43 c3 a5 15 d1 af d0 e0 83 16 be | 60 ea a9 cc | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.45 | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b93c9c8(0->1) (in clone_logger() at log.c:817) | job 10 for #7: ikev2_inI1outR1 KE (build KE and nonce): adding job to queue | state #7 has no .st_event to delete | #7 STATE_PARENT_R0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92ce58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #7 | libevent_malloc: newref ptr-libevent@0x7f3ed40030e8 size 128 | #7 spent 0.266 (0.273) milliseconds in processing: Respond to IKE_SA_INIT in v2_dispatch() | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #7 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_SUSPEND | suspending state #7 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #7 is busy; has suspended MD 0x55701b9449c8 | stop processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1760) | #7 spent 0.621 (0.631) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(2->1) (in handle_packet_cb() at demux.c:318) | job 10 for #7: ikev2_inI1outR1 KE (build KE and nonce): helper 3 starting job | spent 0.634 (0.643) milliseconds in handle_packet_cb() reading and processing packet | "westnet-eastnet-aes" #7: spent 1.12 (1.13) milliseconds in helper 3 processing job 10 for state #7: ikev2_inI1outR1 KE (pcr) | job 10 for #7: ikev2_inI1outR1 KE (build KE and nonce): helper thread 3 sending result back to state | scheduling resume sending helper answer back to state for #7 | libevent_malloc: newref ptr-libevent@0x7f3ed8006be8 size 128 | helper thread 3 has nothing to do | processing resume sending helper answer back to state for #7 | start processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #7 MD 0x55701b9449c8 | job 10 for #7: ikev2_inI1outR1 KE (build KE and nonce): processing response from helper 3 | job 10 for #7: ikev2_inI1outR1 KE (build KE and nonce): calling continuation function 0x557019a27fe7 | ikev2_parent_inI1outR1_continue() for #7 STATE_PARENT_R0: calculated ke+nonce, sending R1 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | emitting ikev2_proposal ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 44 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 48 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | DH secret MODP2048@0x7f3ed80019d8: transferring ownership from helper KE to state #7 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | 96 f3 01 4c 02 b8 f9 90 49 79 5a 7c 2c 6e 14 f0 | 26 f5 2f f9 9e 10 9b 49 70 b4 1e e2 d3 c9 ce 50 | 47 2d 93 7f 19 2b 52 97 46 d4 ad a8 b1 8f 4a 3b | 01 da ac 52 80 50 ad 41 fc 1b 6b 1b 81 4c 2d 96 | ff 6b 88 6f 1c e7 22 54 f0 b2 e2 95 81 11 57 3d | 01 72 81 b7 5c 8e 08 87 da ca 41 a5 d8 e3 56 1f | 3f 95 e7 0a 04 2f 84 0a 1b 78 dd d4 3d e2 be be | 35 be 96 e3 50 7f 19 b9 db 55 8c 1c 9b ae 8f 7e | 2a 6a ea 92 c4 7a 41 bc d1 53 94 13 66 7e 8f be | 20 1a 9b 9c 8f 9d 45 8e d4 53 1c 7b c3 ec 5f a2 | 83 27 7c 9c 91 85 02 8d 46 ec e8 50 78 83 9a 60 | 72 78 39 c7 10 8c fc 7a cc ec 5c 73 99 73 86 de | d0 cf f7 6a ed 49 54 c0 69 e4 d1 1c ae e9 b9 c5 | 36 ff 46 72 10 21 1b c5 65 20 90 9a a0 09 a5 97 | 3c 02 d7 75 3d 7e 64 4e 0a c3 1b 2e 67 a9 ed 65 | bd 31 1b 4c 56 3e 43 77 cd b2 0d 78 d7 90 0b 36 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | 85 25 44 24 75 91 8a f2 82 e3 70 6a 6c 10 99 24 | a8 4d fc 69 0c d2 f2 01 2f c2 d3 17 51 b1 6a 33 | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | a7 9b 4b 3b b2 27 9d 65 | natd_hash: rcookie= | 2e 82 68 54 c7 94 26 55 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 20 26 70 d3 99 3e bc ca b5 b4 45 6d 88 ad 40 af | 02 a8 86 04 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 20 26 70 d3 99 3e bc ca b5 b4 45 6d 88 ad 40 af | 02 a8 86 04 | emitting length of IKEv2 Notify Payload: 28 | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | a7 9b 4b 3b b2 27 9d 65 | natd_hash: rcookie= | 2e 82 68 54 c7 94 26 55 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | ad 31 54 c3 75 e5 e1 8d 76 33 96 5b 0c df 94 c9 | 31 a9 a1 a6 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | ad 31 54 c3 75 e5 e1 8d 76 33 96 5b 0c df 94 c9 | 31 a9 a1 a6 | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 454 | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #7 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_OK | transitioning from state STATE_PARENT_R0 to state STATE_PARENT_R1 | Message ID: updating counters for #7 | Message ID: IKE #7 updating responder received message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=-1 ike.responder.recv=-1->0 ike.responder.last_contact=744609.831847->744609.833694 ike.wip.initiator=-1 ike.wip.responder=0->-1 | Message ID: IKE #7 updating responder sent message response 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=-1->0 ike.responder.recv=0 ike.responder.last_contact=744609.833694 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #7 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.833694 ike.wip.initiator=-1 ike.wip.responder=-1 | parent state #7: PARENT_R0(half-open IKE SA) => PARENT_R1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes" #7: sent IKE_SA_INIT reply {auth=IKEv2 cipher=AES_CBC_128 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 454 bytes for STATE_PARENT_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 00 80 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 96 f3 01 4c 02 b8 f9 90 49 79 5a 7c | 2c 6e 14 f0 26 f5 2f f9 9e 10 9b 49 70 b4 1e e2 | d3 c9 ce 50 47 2d 93 7f 19 2b 52 97 46 d4 ad a8 | b1 8f 4a 3b 01 da ac 52 80 50 ad 41 fc 1b 6b 1b | 81 4c 2d 96 ff 6b 88 6f 1c e7 22 54 f0 b2 e2 95 | 81 11 57 3d 01 72 81 b7 5c 8e 08 87 da ca 41 a5 | d8 e3 56 1f 3f 95 e7 0a 04 2f 84 0a 1b 78 dd d4 | 3d e2 be be 35 be 96 e3 50 7f 19 b9 db 55 8c 1c | 9b ae 8f 7e 2a 6a ea 92 c4 7a 41 bc d1 53 94 13 | 66 7e 8f be 20 1a 9b 9c 8f 9d 45 8e d4 53 1c 7b | c3 ec 5f a2 83 27 7c 9c 91 85 02 8d 46 ec e8 50 | 78 83 9a 60 72 78 39 c7 10 8c fc 7a cc ec 5c 73 | 99 73 86 de d0 cf f7 6a ed 49 54 c0 69 e4 d1 1c | ae e9 b9 c5 36 ff 46 72 10 21 1b c5 65 20 90 9a | a0 09 a5 97 3c 02 d7 75 3d 7e 64 4e 0a c3 1b 2e | 67 a9 ed 65 bd 31 1b 4c 56 3e 43 77 cd b2 0d 78 | d7 90 0b 36 29 00 00 24 85 25 44 24 75 91 8a f2 | 82 e3 70 6a 6c 10 99 24 a8 4d fc 69 0c d2 f2 01 | 2f c2 d3 17 51 b1 6a 33 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 20 26 70 d3 99 3e bc ca b5 b4 | 45 6d 88 ad 40 af 02 a8 86 04 00 00 00 1c 00 00 | 40 05 ad 31 54 c3 75 e5 e1 8d 76 33 96 5b 0c df | 94 c9 31 a9 a1 a6 | sent 1 messages | state #7 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3ed40030e8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92ce58 | event_schedule: newref EVENT_SO_DISCARD-pe@0x55701b92ce58 | inserting event EVENT_SO_DISCARD, timeout in 200 seconds for #7 | libevent_malloc: newref ptr-libevent@0x55701b93bdd8 size 128 | delref logger@0x55701b93c9c8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #7 suppresed complete_v2_state_transition() | delref mdp@0x55701b9449c8(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b93fe18(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #7 spent 0.41 (0.425) milliseconds in resume sending helper answer back to state | stop processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ed8006be8 | spent 0.00249 (0.00249) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b942f48(0->1) (in read_message() at demux.c:103) | *received 544 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 7a 27 56 47 16 fa 69 02 08 e9 42 18 | 20 1e 7c d0 cf 75 2d 48 f8 30 b6 ae e6 a8 a6 34 | 6b ea 3b 62 46 0f ac 5b 8f 0f 37 bc 8e a1 20 df | 6e 12 c9 82 b1 8e 0c 1c 8f 02 b0 8e 63 10 ad 69 | 5c 1d 80 30 16 c9 5b 02 d5 13 49 d3 c3 55 f9 7f | 27 bf cf 96 1e 92 1c 59 ad f9 2f 1e 18 6a e4 01 | a0 6e 30 74 a4 e5 0c 4b 4a 38 b7 bf d8 3e 45 41 | e1 92 6f 00 a8 8e cb dc 72 00 38 97 97 d4 0c b0 | 8a e2 3b 87 74 7f c8 27 f3 a1 f0 87 2f 12 cc a8 | 67 27 ab c9 36 41 fc bb 7e 11 47 d1 39 8f 59 40 | f3 ee 17 65 fe 0a c5 1c d6 71 82 93 1d 37 f1 97 | 37 8c 7a 83 24 a9 0e e9 58 96 29 1c 5d 7e 4f 7c | 68 0a 93 4a c2 ab b9 d9 77 74 7b 26 9e be 71 b0 | f2 42 05 38 20 23 b7 ad af 3f ed c3 c8 09 34 8c | f3 d6 f6 2d 29 8e bc 24 21 1c db f2 a4 4e 6a d0 | 0f 5d c1 f4 4d 14 29 5e 41 8d 40 87 c5 ec 26 8e | 5e a5 f7 67 21 25 79 af 01 b0 d2 4e bb dd 56 a5 | f3 07 2d ed 7a 88 b5 6e ac 3b d7 91 71 13 94 c9 | 60 62 1e 37 f8 c7 3e fb 85 53 36 55 60 bf ee bd | 12 1e 13 3c 5a a1 12 c4 58 8a 4d a0 f0 4e dc 11 | b3 de 4c 33 d2 59 a7 f5 9d 4e 9e d5 c6 7f eb 33 | c8 c7 1e 6a d6 74 dd eb db f2 3c e2 f2 db 72 36 | b4 b6 5b 29 12 38 72 54 ba 72 4c 30 2d a4 70 0f | b6 09 3f 0d 52 84 fd da 2d 7e ad 3f 4b 3d 58 d0 | 01 f2 85 c0 84 7b 16 b9 49 0c ef e2 d7 2e 7f 3f | 3a 85 0e 20 75 27 aa 0c 35 a7 9a 23 ea be b2 92 | 0f 2b 86 42 1d 41 f8 9e 22 90 f8 d7 92 4c f6 0e | e4 76 9b 00 25 d3 1b fc 3c 6d 45 ac d8 19 c4 b4 | fc 01 19 64 48 98 23 f7 28 13 82 a1 40 8f fb 06 | 8f 72 52 9e 3e c2 d7 e0 97 10 28 c3 34 88 a7 a6 | f1 d5 da 51 e2 5f 9d 02 a5 49 f6 fc 87 4a 42 bf | b4 c2 67 71 26 52 1b e6 14 89 fb f0 8f 1d 2d c4 | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 544 (00 00 02 20) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request | State DB: found IKEv2 state #7 in PARENT_R1 (find_v2_ike_sa) | start processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #7 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #7 is idle | Message ID: IKE #7 not a duplicate - message request 1 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.833694 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 516 (02 04) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | processing payload: ISAKMP_NEXT_v2SKF (len=508) | #7 in state PARENT_R1: sent IKE_SA_INIT reply | received IKE encrypted fragment number '1', total number '1', next payload '35' | selected state microcode Responder: process IKE_AUTH request (no SKEYSEED) | calling processor Responder: process IKE_AUTH request (no SKEYSEED) | ikev2 parent ikev2_ike_sa_process_auth_request_no_skeyid(): calculating g^{xy} in order to decrypt I2 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f3ed80019d8: transferring ownership from state #7 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b92d058(0->1) (in clone_logger() at log.c:817) | job 11 for #7: ikev2_inI2outR2 KE (compute dh (V2)): adding job to queue | state #7 deleting .st_event EVENT_SO_DISCARD | libevent_free: delref ptr-libevent@0x55701b93bdd8 | free_event_entry: delref EVENT_SO_DISCARD-pe@0x55701b92ce58 | #7 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92cf28 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #7 | libevent_malloc: newref ptr-libevent@0x7f3ed8006be8 size 128 | #7 spent 0.0467 (0.0467) milliseconds in processing: Responder: process IKE_AUTH request (no SKEYSEED) in v2_dispatch() | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | job 11 for #7: ikev2_inI2outR2 KE (compute dh (V2)): helper 5 starting job | #7 complete_v2_state_transition() PARENT_R1->PARENT_R1 with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #7 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #7 is busy; has suspended MD 0x55701b9449c8 | stop processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #7 spent 0.298 (0.419) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.307 (0.428) milliseconds in handle_packet_cb() reading and processing packet | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=16 salt-size=0 | "westnet-eastnet-aes" #7: spent 0.984 (1.04) milliseconds in helper 5 processing job 11 for state #7: ikev2_inI2outR2 KE (pcr) | job 11 for #7: ikev2_inI2outR2 KE (compute dh (V2)): helper thread 5 sending result back to state | scheduling resume sending helper answer back to state for #7 | libevent_malloc: newref ptr-libevent@0x7f3ecc004b78 size 128 | helper thread 5 has nothing to do | processing resume sending helper answer back to state for #7 | start processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #7 MD 0x55701b9449c8 | job 11 for #7: ikev2_inI2outR2 KE (compute dh (V2)): processing response from helper 5 | job 11 for #7: ikev2_inI2outR2 KE (compute dh (V2)): calling continuation function 0x557019a27fe7 | ikev2_ike_sa_process_auth_request_no_skeyid_continue() for #7 STATE_PARENT_R1: calculating g^{xy}, sending R2 | DH secret MODP2048@0x7f3ed80019d8: transferring ownership from helper IKEv2 DH to state #7 | #7 in state PARENT_R1: sent IKE_SA_INIT reply | already have all fragments, skipping fragment collection | already have all fragments, skipping fragment collection | authenticator matched | #7 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDi) | **parse IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDi (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Responder: process IKE_AUTH request | Message ID: IKE #7 responder starting message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.833694 ike.wip.initiator=-1 ike.wip.responder=-1->1 | calling processor Responder: process IKE_AUTH request "westnet-eastnet-aes" #7: processing decrypted IKE_AUTH request: SK{IDi,IDr,AUTH,SA,TSi,TSr} | no certs to decode | #7 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | received IDr payload - extracting our alleged ID | refine_host_connection for IKEv2: starting with "westnet-eastnet-aes" | match_id a=@west | b=@west | results matched | refine_host_connection: checking "westnet-eastnet-aes" against "westnet-eastnet-aes", best=(none) with match=1(id=1(0)/ca=1(0)/reqca=1(0)) | warning: not switching back to template of current instance | peer expects us to be @east (ID_FQDN) according to its IDr payload | this connection's local id is @east (ID_FQDN) | refine_host_connection: checked "westnet-eastnet-aes" against "westnet-eastnet-aes", now for see if best | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | returning because exact peer id match | offered CA: '%none' "westnet-eastnet-aes" #7: IKEv2 mode peer ID is ID_FQDN: '@west' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @west | trying all preloaded keys public keys for RSA key that matches ID: @west | skipping '@east' with wrong ID | trying '@west' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | 88 65 4f 0a d2 62 a0 db f2 55 c2 9e 39 f2 f9 e9 | e3 a0 12 a7 58 7b e8 7c 84 8f 35 a6 a6 69 2b 39 | 5c 66 ac c1 f3 a2 03 cf 70 78 45 e8 e1 54 43 db | 21 0a 35 ab a7 5a 71 27 52 25 83 3f 50 0c 4c 2b | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x55701b9407a8(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQOm9dY/4 [preloaded keys] | #7 spent 0.0813 (0.0813) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes" #7: authenticated using RSA with SHA2_512 | #7 spent 0.121 (0.121) milliseconds in ikev2_verify_rsa_hash() | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b93c9c8(0->1) (in clone_logger() at log.c:817) | job 12 for #7: computing responder signature (signature): adding job to queue | state #7 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3ed8006be8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92cf28 | #7 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93fe18 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #7 | libevent_malloc: newref ptr-libevent@0x55701b93bdd8 size 128 | ikev2_parent_inI2outR2_continue_tail returned STF_SUSPEND | #7 spent 0.318 (0.318) milliseconds in processing: Responder: process IKE_AUTH request in v2_dispatch() | job 12 for #7: computing responder signature (signature): helper 6 starting job | hash to sign | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #7 complete_v2_state_transition() PARENT_R1->ESTABLISHED_CHILD_SA with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #7 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #7 is busy; has suspended MD 0x55701b9449c8 | delref logger@0x55701b92d058(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #7 suppresed complete_v2_state_transition() | delref mdp@0x55701b9449c8(2->1) (in resume_handler() at server.c:743) | #7 spent 0.527 (0.532) milliseconds in resume sending helper answer back to state | stop processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ecc004b78 | 1b 8f e2 81 2e c0 1d 5a 44 1e d9 27 69 e8 d5 9a | 13 2b 0a 5d 46 d7 88 e8 70 dc f7 88 cc 31 8e 48 | 7b 78 6d b7 8e fa 47 1d b8 4e d4 71 a7 be e2 f9 | 56 e5 af cb 6a 9d eb fa 7f b9 c2 68 11 46 48 9c | RSA_sign_hash: Started using NSS | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes" #7: spent 3.66 (3.75) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes" #7: spent 3.7 (4.03) milliseconds in v2_auth_signature() | "westnet-eastnet-aes" #7: spent 3.71 (4.05) milliseconds in helper 6 processing job 12 for state #7: computing responder signature (signature) | job 12 for #7: computing responder signature (signature): helper thread 6 sending result back to state | scheduling resume sending helper answer back to state for #7 | libevent_malloc: newref ptr-libevent@0x7f3ed0004f78 size 128 | helper thread 6 has nothing to do | processing resume sending helper answer back to state for #7 | start processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #7 MD 0x55701b9449c8 | job 12 for #7: computing responder signature (signature): processing response from helper 6 | job 12 for #7: computing responder signature (signature): calling continuation function 0x55701995677f | parent state #7: PARENT_R1(half-open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #7 will start re-keying in 3330 seconds with margin of 270 seconds (attempting re-key) | state #7 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x55701b93bdd8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93fe18 | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b93fe18 | inserting event EVENT_SA_REKEY, timeout in 3330 seconds for #7 | libevent_malloc: newref ptr-libevent@0x7f3ecc004b78 size 128 | pstats #7 ikev2.ike established | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Responder - Payload | my identity: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | added IDr payload to packet | CHILD SA proposals received | going to assemble AUTH payload | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 5a b8 90 26 2b 41 5b d0 d4 59 76 04 4f 07 70 82 | f5 91 54 17 91 b0 47 fd e1 9d d1 39 f4 29 58 c4 | 71 5b e7 37 c6 29 10 64 9a 3f 68 8d d0 69 8e 13 | c5 fb aa a7 76 f4 1f 18 89 31 5f 87 9a 86 86 5c | f0 7a 87 5d 84 4b 2c 1e c4 fb 23 27 98 ba 55 b3 | d4 e8 47 dd 72 bd fc cb 33 a4 49 ab df 6a a0 0b | e8 ef 48 5d 03 a3 4c 38 28 ea d8 06 28 3e d4 97 | 5c 0f 63 9a 86 bf a2 ba 1c 54 99 6b 81 37 e1 67 | 6b 14 34 ed d3 47 0f 4f 68 b4 37 40 08 8d 6c d2 | 0d 34 e5 fb 9f 20 e9 12 40 fc 74 99 35 07 68 0e | c8 8b 34 29 85 d1 09 8b 28 98 30 98 fe e9 55 a6 | 61 4e 38 6e 71 b6 ce 1a 2b be 0d 00 af cd 09 c4 | b2 52 02 c5 8f d4 d1 10 92 45 2e 9c 88 80 78 11 | 22 f7 bd 95 fa dc e6 7a da c8 d7 f1 ec 94 58 5d | 94 5b 48 f0 88 96 1d 58 dd 59 44 d3 b7 e5 a3 99 | 72 1c 27 91 40 bb 9c 88 d9 60 d3 44 d9 1f cc f8 | 83 4c 33 db d0 19 c9 64 ad a2 89 ac ed 63 29 39 | 2c d0 | emitting length of IKEv2 Authentication Payload: 350 | newref alloc logger@0x55701b92cf28(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #8 at 0x55701b94a868 | State DB: adding IKEv2 state #8 in UNDEFINED | pstats #8 ikev2.child started | duplicating state object #7 "westnet-eastnet-aes" as #8 for IPSEC SA | #8 setting local endpoint to 192.1.2.23:500 from #7.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #7.#8 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.833694 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #8: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_R0(ignore) | #8.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #7 switching from IKE SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.833694 ike.wip.initiator=-1 ike.wip.responder=1->-1 | Message ID: CHILD #7.#8 switching to CHILD SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744609.833694 child.wip.initiator=-1 child.wip.responder=-1->1 | switching IKEv2 MD.ST from IKE #7 ESTABLISHED_IKE_SA to CHILD #8 V2_IKE_AUTH_CHILD_R0 (in ike_auth_child_responder() at ikev2_parent.c:3282) | Child SA TS Request has child->sa == md->st; so using child connection | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | looking for best SPD in current connection | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found better spd route for TSi[0],TSr[0] | looking for better host pair | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | checking hostpair 192.0.2.0/24:0 -> 192.0.1.0/24:0 is found | investigating connection "westnet-eastnet-aes" as a better match | match_id a=@west | b=@west | results matched | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | did not find a better connection using host pair | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | using existing local ESP/AH proposals for westnet-eastnet-aes (IKE_AUTH responder matching remote ESP/AH proposals): 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH responder matching remote ESP/AH proposals 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | a6 01 9f 76 | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 1 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #8: proposal 1:ESP=AES_CBC_256-HMAC_SHA1_96-DISABLED SPI=a6019f76 chosen from remote proposals 1:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH responder matching remote ESP/AH proposals ikev2_proposal: 1:ESP=AES_CBC_256-HMAC_SHA1_96-DISABLED SPI=a6019f76 | converting proposal to internal trans attrs | netlink_get_spi: allocated 0xab2a7153 for esp.0@192.1.2.23 | emitting ikev2_proposal ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: ab 2a 71 53 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=32 .salt_size=0 keymat_len=52 | FOR_EACH_CONNECTION_... in IKE_SA_established | install_ipsec_sa() for #8: inbound and outbound | could_route called for westnet-eastnet-aes; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" prospective erouted: self; eroute owner: self | looking for alg with encrypt: AES_CBC keylen: 256 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=256 transid=12, key_size=32, encryptalg=12 | st->st_esp.keymat_len=52 is encrypt_keymat_size=32 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.a6019f76@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 256 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=256 transid=12, key_size=32, encryptalg=12 | st->st_esp.keymat_len=52 is encrypt_keymat_size=32 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.ab2a7153@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | add inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.10000@192.1.2.23 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #8: prospective erouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" prospective erouted: self; eroute owner: self | route_and_eroute with c: westnet-eastnet-aes (next: none) ero:westnet-eastnet-aes esr:{(nil)} ro:westnet-eastnet-aes rosr:{(nil)} and state: #8 | we are replacing an eroute | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | eroute_connection replace eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.0@192.1.2.45>tun.0@192.1.2.45 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.a6019f76@192.1.2.45 | get_sa_info esp.ab2a7153@192.1.2.23 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0'... | popen cmd is 1137 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_: | cmd( 160):NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT=: | cmd( 240):'192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255: | cmd( 320):.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE: | cmd( 400):='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.: | cmd( 480):0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' P: | cmd( 560):LUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' P: | cmd( 640):LUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKE: | cmd( 720):V2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO: | cmd( 800):_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_IN: | cmd( 880):FO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_: | cmd( 960):CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VTI_: | cmd(1040):IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa6019f76 SPI_OUT=0xab2a7153 i: | cmd(1120):psec _updown 2>&1: | route_and_eroute: firewall_notified: true | route_and_eroute: instance "westnet-eastnet-aes", setting eroute_owner {spd=0x55701b93af28,sr=0x55701b93af28} to #8 (was #0) (newest_ipsec_sa=#0) | ISAKMP_v2_IKE_AUTH: instance westnet-eastnet-aes[0], setting IKEv2 newest_ipsec_sa to #8 (was #0) (spd.eroute=#8) cloned from #7 | adding 10 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 496 | emitting length of ISAKMP Message: 524 | recording outgoing fragment failed | delref logger@0x55701b93c9c8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #7 switched MD.ST to #8 | suspend processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #8 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #8 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_R0 PARENT_R1->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_R1 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #8 | Message ID: CHILD #7.#8 updating responder received message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=0 ike.responder.recv=0->1 ike.responder.last_contact=744609.833694->744609.855276 child.wip.initiator=-1 child.wip.responder=1->-1 | Message ID: CHILD #7.#8 updating responder sent message response 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=0->1 ike.responder.recv=1 ike.responder.last_contact=744609.855276 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #7 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.855276 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #8: V2_IKE_AUTH_CHILD_R0(ignore) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #8 ikev2.child established | announcing the state transition "westnet-eastnet-aes" #8: negotiated connection [192.0.2.0-192.0.2.255:0-65535 0] -> [192.0.1.0-192.0.1.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes" #8: IPsec SA established tunnel mode {ESP=>0xa6019f76 <0xab2a7153 xfrm=AES_CBC_256-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | sending 524 bytes for STATE_PARENT_R1 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | 9e f6 0f 9f 7b d1 55 06 91 47 99 05 f0 1f 01 f2 | 85 6b 6a 73 f3 f0 64 88 f6 5c ec 65 b6 84 f7 a9 | 5b 20 d6 b1 b3 ec 8b 38 cb 3c 23 98 b4 9f f9 97 | b7 1b 0d 8f b9 55 7f 88 07 cd 7f 90 d7 98 c6 13 | 9f c8 e0 39 53 db 1e 29 30 9d c7 64 55 cc 2d 99 | b8 8c 35 6b 1b 69 ff 41 31 2a 3f e4 93 a5 24 54 | d2 02 6c 30 32 33 99 dc 6d cb 2a bf cf 73 f2 24 | c4 db 3c d2 13 09 5e 7e de c1 c3 8b 66 d2 5e 03 | 7f c4 33 44 3f a8 c2 a2 62 e9 f0 2e 90 c0 05 0d | 12 94 e6 b3 6e d2 53 18 db ce e3 56 e5 8e 68 0e | e4 59 b9 f7 f5 fd dd be 62 9d f8 f3 11 33 87 d9 | 0c 30 9c 06 72 07 1d ba aa b0 62 3f e6 2d d3 d6 | a4 60 da e1 75 1e 40 eb a1 58 fc b4 60 f3 e9 93 | 44 58 33 65 8f 8e 33 3a be 0f d0 f7 92 c7 79 b8 | 06 36 17 6a 6c 58 f3 52 82 92 71 8f 14 aa 3b e4 | ba 3b 0b 58 c9 50 7a 86 de 66 f0 fc aa 24 41 b8 | 17 4b f3 d3 f6 6a 39 a4 ab 5f a7 ee 67 9c bd 60 | 9f 5b 30 da fb ad 10 1c 86 38 c2 68 a8 ea 79 c1 | 35 60 92 04 85 96 28 23 24 df 5a 95 12 d4 73 36 | 1b 18 6e 7d 60 b0 78 7f d0 54 cf 60 8e a2 17 08 | 8e d7 ac b7 54 4e 1c 2b c2 dd b5 5f 83 0b 55 47 | 71 e8 37 0b e5 40 7f ae 65 fa 9a 73 22 42 61 04 | 37 5a 98 81 4c 28 60 ab aa 61 51 3b 2e f1 f8 43 | 26 bf 91 70 73 54 64 3d 20 da cd 1b d1 65 24 7b | 2a e7 27 5d db 81 a2 e1 b4 27 2b 69 7c 68 ee c2 | 18 77 6f 75 c6 43 44 24 11 60 8c ff a0 97 56 ce | d2 07 89 40 87 9a 55 09 04 51 55 25 43 f0 4f ac | e4 dd 43 91 72 cc d0 c5 45 e5 1c a6 f4 33 2d c8 | 9d cc 37 e8 75 61 85 a1 db db 26 71 68 e3 c7 38 | 72 53 08 9b 5a 1f 3b 63 5e 2a ca 84 d8 38 07 9c | 9a ab 3e e8 79 fe 15 0a 7c 28 c3 8f | sent 1 messages | releasing #8's fd-fd@(nil) because IKEv2 transitions finished | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #8's IKE SA #7 | unpending state #7 connection "westnet-eastnet-aes" | releasing #7's fd-fd@(nil) because IKEv2 transitions finished so releaseing IKE SA | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #8 will start re-keying in 28530 seconds with margin of 270 seconds (attempting re-key) | state #8 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b93c9c8 | inserting event EVENT_SA_REKEY, timeout in 28530 seconds for #8 | libevent_malloc: newref ptr-libevent@0x55701b93bdd8 size 128 | delref mdp@0x55701b9449c8(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b942f48(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #7 spent 1.79 (10.8) milliseconds in resume sending helper answer back to state | stop processing: state #8 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ed0004f78 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00471 (0.00456) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00234 (0.00232) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b948988(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | a1 9c ef 54 ca 36 cf 68 79 02 5e a1 70 36 70 54 | 20 58 fd c7 00 a5 5b 88 75 33 21 9e 6d 40 f6 75 | 8e 2f f2 7e a7 a8 50 c8 1d 6f 6a 9e | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #7 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #7 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #7 is idle | Message ID: IKE #7 not a duplicate - message request 2 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.855276 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #7 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #7 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 12 (00 0c) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | processing payload: ISAKMP_NEXT_v2D (len=4) | selected state microcode Informational Request | Message ID: IKE #7 responder starting message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.855276 ike.wip.initiator=-1 ike.wip.responder=-1->2 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | parsing 4 raw bytes of IKEv2 Delete Payload into SPI | SPI | a6 01 9f 76 | delete IKEv2_SEC_PROTO_ESP SA(0xa6019f76) | v2 CHILD SA #8 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA | State DB: found IKEv2 state #8 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0xa6019f76) "westnet-eastnet-aes" #7: received Delete SA payload: delete IPsec State #8 now | pstats #8 ikev2.child deleted completed | #8 main thread spent 0 (0) milliseconds helper thread spent 0 (0) milliseconds in total | suspend processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | start processing: state #8 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #8: deleting other state #8 (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.105457s and NOT sending notification | child state #8: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.a6019f76@192.1.2.45 | get_sa_info esp.ab2a7153@192.1.2.23 "westnet-eastnet-aes" #8: ESP traffic information: in=0B out=0B | unsuspending #8 MD (nil) | should_send_delete: no, just because | child state #8: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) | state #8 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x55701b93bdd8 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b93c9c8 | #8 STATE_CHILDSA_DEL: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.a6019f76@192.1.2.45 | get_sa_info esp.ab2a7153@192.1.2.23 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED... | popen cmd is 1139 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUT: | cmd( 160):O_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIEN: | cmd( 240):T='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.2: | cmd( 320):55.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TY: | cmd( 400):PE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.: | cmd( 480):1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0': | cmd( 560): PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm': | cmd( 640): PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+I: | cmd( 720):KEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLU: | cmd( 800):TO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_: | cmd( 880):INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUT: | cmd( 960):O_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VT: | cmd(1040):I_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xa6019f76 SPI_OUT=0xab2a7153: | cmd(1120): ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.2.0/24:0 --0->- 192.0.1.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.2.0/24:0 dest 192.0.1.0/24:0 | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.a6019f76@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.a6019f76@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => unk.10000@192.1.2.23 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.ab2a7153@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.ab2a7153@192.1.2.23 included non-error error | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #8 in CHILDSA_DEL | child state #8: CHILDSA_DEL(informational) => UNDEFINED(ignore) | releasing #8's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #8 from 192.1.2.45:500 (in delete_state() at state.c:1239) | resume processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b92cf28(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload | local SPIs: ab 2a 71 53 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 99 85 f4 72 13 5c 76 f9 dd c4 74 7d 5d 7e b1 cd | 2f f7 58 dd cc fc 01 08 41 36 0f 0e 01 b7 0c 79 | c5 ac 50 a9 1a a6 f4 ae d8 1f 61 0b | sent 1 messages | Message ID: IKE #7 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744609.855276 ike.wip.initiator=-1 ike.wip.responder=2 | Message ID: IKE #7 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=1->2 ike.responder.recv=1 ike.responder.last_contact=744609.855276 ike.wip.initiator=-1 ike.wip.responder=2 | #7 spent 0.789 (11.1) milliseconds in processing: Informational Request in v2_dispatch() | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #7 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_R0->PARENT_R1 | Message ID: updating counters for #7 | Message ID: IKE #7 updating responder received message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=2 ike.responder.recv=1->2 ike.responder.last_contact=744609.855276->744609.961538 ike.wip.initiator=-1 ike.wip.responder=2->-1 | Message ID: IKE #7 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.961538 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #7 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.961538 ike.wip.initiator=-1 ike.wip.responder=-1 | announcing the state transition "westnet-eastnet-aes" #7: established IKE SA | sending 76 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 99 85 f4 72 13 5c 76 f9 dd c4 74 7d 5d 7e b1 cd | 2f f7 58 dd cc fc 01 08 41 36 0f 0e 01 b7 0c 79 | c5 ac 50 a9 1a a6 f4 ae d8 1f 61 0b | sent 1 messages | #7 is retaining EVENT_SA_REKEY with is previously set timeout | stop processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #7 spent 1.11 (11.7) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b948988(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 1.14 (11.7) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00564 (0.00552) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00262 (0.0025) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93c9c8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | ff e6 ba 81 22 31 ac c3 2d 89 ca 34 47 83 c1 5f | 91 fb 22 75 06 16 6b 1b 98 0e c6 7c 60 cb e6 d6 | f3 ec b2 01 f6 c4 06 e0 11 b3 20 62 | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #7 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #7 st.st_msgid_lastrecv 2 md.hdr.isa_msgid 00000003 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #7 is idle | Message ID: IKE #7 not a duplicate - message request 3 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.961538 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #7 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #7 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 8 (00 08) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | processing payload: ISAKMP_NEXT_v2D (len=0) | selected state microcode Informational Request | Message ID: IKE #7 responder starting message request 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.961538 ike.wip.initiator=-1 ike.wip.responder=-1->3 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | adding 16 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | a4 af f2 2d 7c c6 e0 68 d7 92 e9 39 76 f8 82 23 | 3e 66 72 ce e0 36 65 b4 5e cc f0 f1 ef 4c fe 0d | f4 2f 99 b4 26 25 1f f3 4f 22 f3 f5 | sent 1 messages | Message ID: IKE #7 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744609.961538 ike.wip.initiator=-1 ike.wip.responder=3 | Message ID: IKE #7 updating responder sent message response 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744609.831847 ike.responder.sent=2->3 ike.responder.recv=2 ike.responder.last_contact=744609.961538 ike.wip.initiator=-1 ike.wip.responder=3 | State DB: IKEv2 state not found (delete_ike_family) | pstats #7 ikev2.ike deleted completed | #7 main thread spent 4.76 (24.5) milliseconds helper thread spent 5.81 (6.22) milliseconds in total | [RE]START processing: state #7 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #7: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.133985s and NOT sending notification | parent state #7: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #7 MD (nil) | should_send_delete: no, just because | state #7 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f3ecc004b78 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b93fe18 | #7 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #7 in ESTABLISHED_IKE_SA | parent state #7: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #7's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@0x55701b9407a8(2->1) (in delete_state() at state.c:1202) | stop processing: state #7 from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b93ab98(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | in statetime_stop() and could not find #7 | XXX: processor 'Informational Request' for #7 deleted state MD.ST | processing: STOP state #0 (in ikev2_process_packet() at ikev2.c:1904) | in statetime_stop() and could not find #7 | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b93c9c8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.652 (1.7) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00258 (0.00257) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93fe18(0->1) (in read_message() at demux.c:103) | *received 510 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 01 fe 22 00 00 68 | 00 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 28 00 01 08 00 0e 00 00 6c 57 16 94 | 51 44 10 bd 37 f5 a9 e1 98 9d ba c8 d4 c2 09 9a | a6 77 d5 4c 93 85 7d 0e 1d 14 75 27 80 98 11 4e | a5 ba 9d c3 19 ac be 71 71 16 28 0f 1f 15 1f 70 | 00 7a 35 c3 8d a7 bd 6c 90 69 95 cb a4 e3 01 a3 | f8 9c f2 28 ed f4 b9 91 89 9f 28 5e c0 9c ab f8 | 36 44 4c 7c 68 c4 7c a5 ce 71 74 14 2e dd eb 94 | 95 20 fb b4 b7 4e 95 b3 88 97 74 9d b5 b5 21 c3 | ed 14 a0 62 b9 4b 16 8c 67 8e 9d a8 e8 42 af cd | 34 39 2d ce 6c 21 f5 25 d4 80 59 80 4c 63 64 79 | 00 52 69 b1 c1 ad b7 66 39 49 81 5c 5b 8a a8 aa | 9f 6d 25 c7 f8 99 44 6e 0c bb a9 6c 96 be 37 01 | b5 1f 29 f1 04 d9 72 59 0e 39 8e 3a 5d 32 b9 e8 | 03 b1 14 b9 3d c1 92 36 fe ed ee fc 32 15 ab 37 | ef 1c d2 8a 47 db 29 bf fc 0e dd 53 bf ad 8e 30 | 96 c2 f7 fd ac 6f d5 e4 72 1f 91 f7 14 0d 04 b0 | 59 87 1d 9e bc 93 a8 c6 19 fd 90 04 29 00 00 24 | d4 cb 89 fe 6f aa f1 9c f4 d3 ba d3 13 70 8a 2d | 20 56 40 bb 9f 6d 7f f2 84 f2 50 66 20 18 99 5b | 29 00 00 08 00 00 40 2e 29 00 00 0e 00 00 40 2f | 00 02 00 03 00 04 29 00 00 1c 00 00 40 04 04 e9 | f0 eb 5d 7d 0e b9 11 93 d8 fd cf 77 04 32 fc 7e | 85 af 00 00 00 1c 00 00 40 05 55 8f 5f a8 5c 0d | d2 f4 d2 5e 1e 31 fa d0 50 9b c2 db b8 01 | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | length: 510 (00 00 01 fe) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Responder receiving an IKEv2 IKE_SA_INIT request | State DB: IKEv2 state not found (find_v2_ike_sa_by_initiator_spi) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 104 (00 68) | processing payload: ISAKMP_NEXT_v2SA (len=100) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | DDOS disabled and no cookie sent, continuing | looking for message matching transition from STATE_PARENT_R0 | trying Respond to IKE_SA_INIT | matched unencrypted message | find_host_connection local=192.1.2.23:500 remote=192.1.2.45:500 policy=ECDSA+IKEV2_ALLOW but ignoring ports | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | found policy = RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 (westnet-eastnet-aes) | find_next_host_connection returns "westnet-eastnet-aes" | find_next_host_connection policy=ECDSA+IKEV2_ALLOW | find_next_host_connection returns | found connection: "westnet-eastnet-aes" with policy ECDSA+IKEV2_ALLOW | newref alloc logger@0x55701b92d058(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #9 at 0x55701b940d18 | State DB: adding IKEv2 state #9 in UNDEFINED | pstats #9 ikev2.ike started | parent state #9: UNDEFINED(ignore) => PARENT_R0(half-open IKE SA) | #9.st_v2_transition NULL -> PARENT_R0->PARENT_R1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #9 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744610.18992 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744610.18992 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes | westnet-eastnet-aes doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:4500 at all | westnet-eastnet-aes doesn't match 192.0.2.254:500 at all | westnet-eastnet-aes doesn't match 192.1.2.23:4500 at all | oriented westnet-eastnet-aes's this | start processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1758) | Message ID: IKE #9 responder starting message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.18992 ike.wip.initiator=-1 ike.wip.responder=-1->0 | calling processor Respond to IKE_SA_INIT | #9 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | using existing local IKE proposals for connection westnet-eastnet-aes (IKE SA responder matching remote proposals): 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE responder 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 100 (00 64) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 11 (0b) | Comparing remote proposal 1 containing 11 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #9: proposal 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048 chosen from remote proposals 1:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048;DH=MODP3072;DH=MODP4096;DH=MODP8192;DH=ECP_256;DH=ECP_384;DH=ECP_521;DH=CURVE25519[first-match] | accepted IKE proposal ikev2_proposal: 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048 | converting proposal to internal trans attrs | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 7c 3c a3 0a 2f 3b 2b ec | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 55 8f 5f a8 5c 0d d2 f4 d2 5e 1e 31 fa d0 50 9b | c2 db b8 01 | nat: IKE.SPIr is zero | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 7c 3c a3 0a 2f 3b 2b ec | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 04 e9 f0 eb 5d 7d 0e b9 11 93 d8 fd cf 77 04 32 | fc 7e 85 af | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.45 | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b93c5f8(0->1) (in clone_logger() at log.c:817) | job 13 for #9: ikev2_inI1outR1 KE (build KE and nonce): adding job to queue | state #9 has no .st_event to delete | #9 STATE_PARENT_R0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92ce58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #9 | libevent_malloc: newref ptr-libevent@0x7f3ed0004f78 size 128 | #9 spent 0.376 (0.495) milliseconds in processing: Respond to IKE_SA_INIT in v2_dispatch() | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #9 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_SUSPEND | suspending state #9 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #9 is busy; has suspended MD 0x55701b9449c8 | stop processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1760) | job 13 for #9: ikev2_inI1outR1 KE (build KE and nonce): helper 1 starting job | #9 spent 0.811 (0.934) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.824 (0.951) milliseconds in handle_packet_cb() reading and processing packet | "westnet-eastnet-aes" #9: spent 1.37 (1.4) milliseconds in helper 1 processing job 13 for state #9: ikev2_inI1outR1 KE (pcr) | job 13 for #9: ikev2_inI1outR1 KE (build KE and nonce): helper thread 1 sending result back to state | scheduling resume sending helper answer back to state for #9 | libevent_malloc: newref ptr-libevent@0x7f3ec4004508 size 128 | helper thread 1 has nothing to do | processing resume sending helper answer back to state for #9 | start processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #9 MD 0x55701b9449c8 | job 13 for #9: ikev2_inI1outR1 KE (build KE and nonce): processing response from helper 1 | job 13 for #9: ikev2_inI1outR1 KE (build KE and nonce): calling continuation function 0x557019a27fe7 | ikev2_parent_inI1outR1_continue() for #9 STATE_PARENT_R0: calculated ke+nonce, sending R1 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | emitting ikev2_proposal ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 44 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 48 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | DH secret MODP2048@0x7f3ec40046d8: transferring ownership from helper KE to state #9 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | a4 b0 2d a8 d6 67 a4 c5 87 e0 17 71 cf e6 c7 43 | f6 67 4a 68 d5 7a 2d 25 bf 38 1c c0 a1 5f fd 93 | e8 55 12 3b 81 a2 e7 cb 33 30 c8 60 ce f1 d5 09 | 8c 23 97 66 d9 12 6e 5a f3 b5 37 db b8 06 69 ab | fb c4 25 cc 98 18 50 f8 11 26 e3 e5 58 5d 66 9b | 1d 2c 54 39 9f 23 c0 39 9f 82 71 db 29 10 a1 8a | 12 3a e9 59 a8 b0 cf a2 1f 41 31 ab 6a e6 33 94 | 85 bf e2 26 08 a0 d7 92 fc 97 4d 1e b7 cb a8 04 | b8 ce 70 5c 8f fe 77 e4 2d 9b f1 63 cd fe 6b 09 | 0f a7 a0 b2 86 fc d0 63 f1 92 40 16 a0 95 35 ea | d1 09 a2 99 9b 25 2b 6c 35 c6 cb c8 b5 20 b8 89 | 7c 4c 26 0e a2 58 75 fb ff 24 10 02 7a 25 8e 57 | d6 db 0e d1 02 85 f4 ad e8 71 c3 8e ca 74 e8 33 | 0c ef 3a 41 98 70 71 5b 3a 42 b5 66 8b ed c4 d9 | f3 bf 34 a8 6a ee 26 79 31 a5 96 63 30 67 f0 b3 | a5 bf 19 b0 d4 36 2e b3 99 ea 71 7c 04 11 82 80 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | 66 b1 a1 98 f3 a6 c8 d2 18 76 b1 9f b0 74 7f a3 | 18 7c e6 96 62 f9 65 a2 2f 64 71 e2 13 ea 32 46 | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 7c 3c a3 0a 2f 3b 2b ec | natd_hash: rcookie= | 64 9b 94 9e 8e 63 c9 78 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 80 5d 73 59 c2 bc 51 c9 f8 b8 43 76 b1 02 c0 08 | a8 9e 10 00 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 80 5d 73 59 c2 bc 51 c9 f8 b8 43 76 b1 02 c0 08 | a8 9e 10 00 | emitting length of IKEv2 Notify Payload: 28 | natd_hash: hasher=0x557019b19f80(20) | natd_hash: icookie= | 7c 3c a3 0a 2f 3b 2b ec | natd_hash: rcookie= | 64 9b 94 9e 8e 63 c9 78 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 4b a5 45 1d ec fe fa 3d 49 1e ec 4a af 34 bc 01 | db 14 09 bd | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 4b a5 45 1d ec fe fa 3d 49 1e ec 4a af 34 bc 01 | db 14 09 bd | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 454 | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #9 complete_v2_state_transition() PARENT_R0->PARENT_R1 with status STF_OK | transitioning from state STATE_PARENT_R0 to state STATE_PARENT_R1 | Message ID: updating counters for #9 | Message ID: IKE #9 updating responder received message request 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=-1 ike.responder.recv=-1->0 ike.responder.last_contact=744610.18992->744610.192283 ike.wip.initiator=-1 ike.wip.responder=0->-1 | Message ID: IKE #9 updating responder sent message response 0: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=-1->0 ike.responder.recv=0 ike.responder.last_contact=744610.192283 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #9 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744610.192283 ike.wip.initiator=-1 ike.wip.responder=-1 | parent state #9: PARENT_R0(half-open IKE SA) => PARENT_R1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes" #9: sent IKE_SA_INIT reply {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 454 bytes for STATE_PARENT_R0 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 a4 b0 2d a8 d6 67 a4 c5 87 e0 17 71 | cf e6 c7 43 f6 67 4a 68 d5 7a 2d 25 bf 38 1c c0 | a1 5f fd 93 e8 55 12 3b 81 a2 e7 cb 33 30 c8 60 | ce f1 d5 09 8c 23 97 66 d9 12 6e 5a f3 b5 37 db | b8 06 69 ab fb c4 25 cc 98 18 50 f8 11 26 e3 e5 | 58 5d 66 9b 1d 2c 54 39 9f 23 c0 39 9f 82 71 db | 29 10 a1 8a 12 3a e9 59 a8 b0 cf a2 1f 41 31 ab | 6a e6 33 94 85 bf e2 26 08 a0 d7 92 fc 97 4d 1e | b7 cb a8 04 b8 ce 70 5c 8f fe 77 e4 2d 9b f1 63 | cd fe 6b 09 0f a7 a0 b2 86 fc d0 63 f1 92 40 16 | a0 95 35 ea d1 09 a2 99 9b 25 2b 6c 35 c6 cb c8 | b5 20 b8 89 7c 4c 26 0e a2 58 75 fb ff 24 10 02 | 7a 25 8e 57 d6 db 0e d1 02 85 f4 ad e8 71 c3 8e | ca 74 e8 33 0c ef 3a 41 98 70 71 5b 3a 42 b5 66 | 8b ed c4 d9 f3 bf 34 a8 6a ee 26 79 31 a5 96 63 | 30 67 f0 b3 a5 bf 19 b0 d4 36 2e b3 99 ea 71 7c | 04 11 82 80 29 00 00 24 66 b1 a1 98 f3 a6 c8 d2 | 18 76 b1 9f b0 74 7f a3 18 7c e6 96 62 f9 65 a2 | 2f 64 71 e2 13 ea 32 46 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 80 5d 73 59 c2 bc 51 c9 f8 b8 | 43 76 b1 02 c0 08 a8 9e 10 00 00 00 00 1c 00 00 | 40 05 4b a5 45 1d ec fe fa 3d 49 1e ec 4a af 34 | bc 01 db 14 09 bd | sent 1 messages | state #9 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3ed0004f78 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b92ce58 | event_schedule: newref EVENT_SO_DISCARD-pe@0x55701b92ce58 | inserting event EVENT_SO_DISCARD, timeout in 200 seconds for #9 | libevent_malloc: newref ptr-libevent@0x55701b942078 size 128 | delref logger@0x55701b93c5f8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #9 suppresed complete_v2_state_transition() | delref mdp@0x55701b9449c8(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b93fe18(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #9 spent 0.476 (0.502) milliseconds in resume sending helper answer back to state | stop processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ec4004508 | spent 0.00249 (0.00245) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93c9c8(0->1) (in read_message() at demux.c:103) | *received 544 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 73 1e 7f e8 4d fd 98 56 35 1e b1 f0 | 45 0b 50 73 37 86 df ce 2d 87 f2 7c ff b2 a5 b4 | 1e 23 5d 7e 86 7f dd e4 ad 3d 9e b4 52 2d 46 7a | 5f 54 a4 e1 71 4b 9e 05 eb 03 10 d5 72 af 53 ec | bc 84 79 25 c0 3b a7 29 a4 94 34 f4 cf 00 0a 19 | c8 1e be 70 27 00 a5 2d f1 a4 b9 83 9e 66 44 c1 | 06 3d f3 77 7d d4 29 ae 7a 62 7e 34 8c 9d c8 ab | fd 9c 36 91 6b ef 18 17 e8 cb 9c 0f de 81 db dc | f6 6f 09 6e b7 93 c3 1d a7 28 d6 66 c9 0b 7e 07 | 6f 71 56 05 42 bd 6f 5d f3 8a df cf 53 31 23 10 | 86 37 de 36 59 b1 c3 1c 79 c7 9a 5a 66 ad fe bc | 3d 7a 14 f5 2c bc 71 ba 43 b4 ac 37 a7 2c 2d fd | 9b 0e b8 93 17 d4 cd 06 44 41 16 2f b5 f9 b7 3a | de 60 e5 d3 e3 25 dc 6d 49 43 70 31 4f 44 b8 41 | bf 70 57 4b b2 90 22 cb 9b c3 fa 98 ca 59 16 3f | 95 89 6e 48 27 5f a6 4d 0c 6a a1 6d aa 53 40 f9 | 0a 2d 6c ce 61 bc 64 1c ac 15 c2 9c b2 fd 47 f1 | e0 47 e4 7e 12 58 8f 47 35 db a0 c2 4e b2 3a 26 | 7d f8 38 45 c9 41 6e 2c fe 4e eb 67 95 a3 1e 0d | c0 ed ca 2e d9 9a a7 5c 32 fa 36 41 b7 cb 59 51 | 1a 75 61 e1 c8 84 27 c0 90 f6 30 e1 36 63 8a 19 | 18 1f 0b 38 b3 be 86 bd fe d9 16 e7 4d dd 68 fa | 9c 71 42 22 9c ac 58 30 c7 f3 e2 f9 06 57 3d e1 | cd d5 fe d0 62 d9 25 5c 82 97 af 2d d9 c3 83 39 | 50 c5 b2 b5 dd 33 da 9e a0 52 2a 65 19 43 b5 aa | c2 48 0c 9f c8 c0 c8 7e d9 c9 71 a9 f9 4e 76 7b | 0f 9b c6 aa 9b 05 70 67 d1 76 a3 07 79 3f c7 64 | 69 e8 19 b6 1f 0f 84 50 bc 56 78 3d 89 8a 96 90 | d3 10 a1 2b 14 ec 63 29 80 a0 35 29 79 f3 3a a9 | 22 c0 2c 8f 18 d5 a0 68 30 86 45 01 4b 82 e7 ec | e8 be 01 df 6b 3b 16 70 3b ed 38 25 be 4a 67 10 | 45 e7 83 aa 8e 84 92 9b 42 27 82 d4 07 87 8a 2d | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SKF (0x35) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 544 (00 00 02 20) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Responder receiving an IKEv2 IKE_AUTH request | State DB: found IKEv2 state #9 in PARENT_R1 (find_v2_ike_sa) | start processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #9 st.st_msgid_lastrecv 0 md.hdr.isa_msgid 00000001 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #9 is idle | Message ID: IKE #9 not a duplicate - message request 1 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744610.192283 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SKF) | ***parse IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 516 (02 04) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | processing payload: ISAKMP_NEXT_v2SKF (len=508) | #9 in state PARENT_R1: sent IKE_SA_INIT reply | received IKE encrypted fragment number '1', total number '1', next payload '35' | selected state microcode Responder: process IKE_AUTH request (no SKEYSEED) | calling processor Responder: process IKE_AUTH request (no SKEYSEED) | ikev2 parent ikev2_ike_sa_process_auth_request_no_skeyid(): calculating g^{xy} in order to decrypt I2 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f3ec40046d8: transferring ownership from state #9 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b92cf28(0->1) (in clone_logger() at log.c:817) | job 14 for #9: ikev2_inI2outR2 KE (compute dh (V2)): adding job to queue | state #9 deleting .st_event EVENT_SO_DISCARD | libevent_free: delref ptr-libevent@0x55701b942078 | free_event_entry: delref EVENT_SO_DISCARD-pe@0x55701b92ce58 | #9 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93ab98 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #9 | libevent_malloc: newref ptr-libevent@0x7f3ec4004508 size 128 | #9 spent 0.0655 (0.125) milliseconds in processing: Responder: process IKE_AUTH request (no SKEYSEED) in v2_dispatch() | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #9 complete_v2_state_transition() PARENT_R1->PARENT_R1 with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #9 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #9 is busy; has suspended MD 0x55701b9449c8 | stop processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #9 spent 0.319 (0.483) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.328 (0.492) milliseconds in handle_packet_cb() reading and processing packet | job 14 for #9: ikev2_inI2outR2 KE (compute dh (V2)): helper 7 starting job | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=32 salt-size=0 | "westnet-eastnet-aes" #9: spent 0.952 (1.13) milliseconds in helper 7 processing job 14 for state #9: ikev2_inI2outR2 KE (pcr) | job 14 for #9: ikev2_inI2outR2 KE (compute dh (V2)): helper thread 7 sending result back to state | scheduling resume sending helper answer back to state for #9 | libevent_malloc: newref ptr-libevent@0x7f3ec8002b48 size 128 | helper thread 7 has nothing to do | processing resume sending helper answer back to state for #9 | start processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #9 MD 0x55701b9449c8 | job 14 for #9: ikev2_inI2outR2 KE (compute dh (V2)): processing response from helper 7 | job 14 for #9: ikev2_inI2outR2 KE (compute dh (V2)): calling continuation function 0x557019a27fe7 | ikev2_ike_sa_process_auth_request_no_skeyid_continue() for #9 STATE_PARENT_R1: calculating g^{xy}, sending R2 | DH secret MODP2048@0x7f3ec40046d8: transferring ownership from helper IKEv2 DH to state #9 | #9 in state PARENT_R1: sent IKE_SA_INIT reply | already have all fragments, skipping fragment collection | already have all fragments, skipping fragment collection | authenticator matched | #9 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDi) | **parse IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDi (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Responder: process IKE_AUTH request | Message ID: IKE #9 responder starting message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744610.192283 ike.wip.initiator=-1 ike.wip.responder=-1->1 | calling processor Responder: process IKE_AUTH request "westnet-eastnet-aes" #9: processing decrypted IKE_AUTH request: SK{IDi,IDr,AUTH,SA,TSi,TSr} | no certs to decode | #9 updating local interface from 192.1.2.23:500 to 192.1.2.23:500 using md->iface (in update_ike_endpoints() at state.c:2631) | received IDr payload - extracting our alleged ID | refine_host_connection for IKEv2: starting with "westnet-eastnet-aes" | match_id a=@west | b=@west | results matched | refine_host_connection: checking "westnet-eastnet-aes" against "westnet-eastnet-aes", best=(none) with match=1(id=1(0)/ca=1(0)/reqca=1(0)) | warning: not switching back to template of current instance | peer expects us to be @east (ID_FQDN) according to its IDr payload | this connection's local id is @east (ID_FQDN) | refine_host_connection: checked "westnet-eastnet-aes" against "westnet-eastnet-aes", now for see if best | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | returning because exact peer id match | offered CA: '%none' "westnet-eastnet-aes" #9: IKEv2 mode peer ID is ID_FQDN: '@west' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @west | trying all preloaded keys public keys for RSA key that matches ID: @west | skipping '@east' with wrong ID | trying '@west' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | d6 d9 28 79 be 87 74 91 a4 df af 84 d1 2f 3e ca | f6 9e d6 59 fc 2d 4d b3 da 3b 96 cd 55 a0 f3 39 | 36 00 a4 a9 31 ed 7b 71 6d 2e ae 18 b8 39 5e 90 | 39 a7 5f 34 df 0e 5d f2 e1 d4 b7 df c1 4e 8c c3 | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x55701b9407a8(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQOm9dY/4 [preloaded keys] | #9 spent 0.0527 (0.0526) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes" #9: authenticated using RSA with SHA2_512 | #9 spent 0.0789 (0.0786) milliseconds in ikev2_verify_rsa_hash() | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 to find private key for @east->@west of kind RSA | trying secret PKK_RSA:AQO9bJbr3 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b93c5f8(0->1) (in clone_logger() at log.c:817) | job 15 for #9: computing responder signature (signature): adding job to queue | state #9 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x7f3ec4004508 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93ab98 | #9 STATE_PARENT_R1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93fe18 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #9 | libevent_malloc: newref ptr-libevent@0x55701b942078 size 128 | ikev2_parent_inI2outR2_continue_tail returned STF_SUSPEND | #9 spent 0.241 (0.246) milliseconds in processing: Responder: process IKE_AUTH request in v2_dispatch() | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #9 complete_v2_state_transition() PARENT_R1->ESTABLISHED_CHILD_SA with status STF_SUSPEND; .st_v2_transition=PARENT_R0->PARENT_R1 | suspending state #9 and saving MD 0x55701b9449c8 | addref md@0x55701b9449c8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #9 is busy; has suspended MD 0x55701b9449c8 | delref logger@0x55701b92cf28(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | resume sending helper answer back to state for #9 suppresed complete_v2_state_transition() | delref mdp@0x55701b9449c8(2->1) (in resume_handler() at server.c:743) | #9 spent 0.397 (0.402) milliseconds in resume sending helper answer back to state | stop processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3ec8002b48 | job 15 for #9: computing responder signature (signature): helper 2 starting job | hash to sign | 3b 43 c4 a0 62 d0 e9 ba bf 3e cb 16 bf 3e de 81 | 8c 8b ed 0e e8 db 60 79 93 75 82 cb 5c 8b 74 db | bb 4d 68 b4 34 0c c9 2e a6 03 5c 73 cc 8b 1d 0b | 9d f9 0e 94 e3 a6 9b c0 93 e4 34 9e a4 42 85 07 | RSA_sign_hash: Started using NSS | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes" #9: spent 2.95 (2.97) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes" #9: spent 2.96 (2.99) milliseconds in v2_auth_signature() | "westnet-eastnet-aes" #9: spent 2.97 (2.99) milliseconds in helper 2 processing job 15 for state #9: computing responder signature (signature) | job 15 for #9: computing responder signature (signature): helper thread 2 sending result back to state | scheduling resume sending helper answer back to state for #9 | libevent_malloc: newref ptr-libevent@0x7f3edc002b48 size 128 | helper thread 2 has nothing to do | processing resume sending helper answer back to state for #9 | start processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:641) | unsuspending #9 MD 0x55701b9449c8 | job 15 for #9: computing responder signature (signature): processing response from helper 2 | job 15 for #9: computing responder signature (signature): calling continuation function 0x55701995677f | parent state #9: PARENT_R1(half-open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #9 will start re-keying in 3330 seconds with margin of 270 seconds (attempting re-key) | state #9 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x55701b942078 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x55701b93fe18 | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b93fe18 | inserting event EVENT_SA_REKEY, timeout in 3330 seconds for #9 | libevent_malloc: newref ptr-libevent@0x7f3ec8002b48 size 128 | pstats #9 ikev2.ike established | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Responder - Payload | my identity: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | added IDr payload to packet | CHILD SA proposals received | going to assemble AUTH payload | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | ba d5 fa 35 e1 65 7c 47 ee cc 42 4b 03 88 a5 97 | bb 83 f0 0d a6 cd bf c3 de 76 d1 24 2b b0 c0 c4 | bb 86 51 ab f9 0c 37 fc 40 48 b6 1a 2a 43 68 5d | 7a 13 39 f6 9f b4 27 50 48 79 22 bf fd 69 ff 8e | d5 2b 50 a1 d0 4c 50 60 c8 51 01 cf 11 60 db 6d | 7c 9b e2 8d 84 60 dd 4a 44 47 70 2b ab 03 4c 9f | 34 5e b3 13 45 38 30 15 03 f9 e3 26 90 08 81 fa | 57 10 b2 07 ea 85 2c b6 dc b6 61 4c 48 fc 91 08 | 93 cf e8 eb c4 f1 d6 78 91 2b 67 35 45 43 57 95 | cf 91 f1 33 cc c5 05 65 fa c4 ca 19 0c 0f e0 65 | 65 d2 11 02 1d 33 20 2a 3b 2a 00 a4 90 82 83 c4 | dd ac 8a 29 71 d3 de 23 7a 06 55 82 09 da 0b b1 | 60 c8 a9 ec f0 43 e7 53 92 3c 4d 54 39 b0 2e 86 | 64 f3 01 d4 40 f0 06 c8 62 cf c8 8c 7d ca 1e f9 | 66 dc f2 1b 71 a8 a8 30 17 c3 37 d8 f5 f8 c8 e8 | 4f 7a 92 a1 1f 72 af 27 e3 03 5b 46 51 51 44 95 | 18 2c 44 86 70 59 cb e2 26 97 cf 42 76 82 ca 3d | 6b b7 | emitting length of IKEv2 Authentication Payload: 350 | newref alloc logger@0x55701b93ab98(0->1) (in new_state() at state.c:576) | addref fd@NULL (in new_state() at state.c:577) | creating state object #10 at 0x55701b94aac8 | State DB: adding IKEv2 state #10 in UNDEFINED | pstats #10 ikev2.child started | duplicating state object #9 "westnet-eastnet-aes" as #10 for IPSEC SA | #10 setting local endpoint to 192.1.2.23:500 from #9.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #9.#10 initializing (CHILD SA): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744610.192283 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #10: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_R0(ignore) | #10.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #9 switching from IKE SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744610.192283 ike.wip.initiator=-1 ike.wip.responder=1->-1 | Message ID: CHILD #9.#10 switching to CHILD SA responder message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=0 ike.responder.recv=0 ike.responder.last_contact=744610.192283 child.wip.initiator=-1 child.wip.responder=-1->1 | switching IKEv2 MD.ST from IKE #9 ESTABLISHED_IKE_SA to CHILD #10 V2_IKE_AUTH_CHILD_R0 (in ike_auth_child_responder() at ikev2_parent.c:3282) | Child SA TS Request has child->sa == md->st; so using child connection | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | looking for best SPD in current connection | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found better spd route for TSi[0],TSr[0] | looking for better host pair | find_host_pair: comparing 192.1.2.23:500 to 192.1.2.45:500 but ignoring ports | checking hostpair 192.0.2.0/24:0 -> 192.0.1.0/24:0 is found | investigating connection "westnet-eastnet-aes" as a better match | match_id a=@west | b=@west | results matched | evaluating our conn="westnet-eastnet-aes" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | did not find a better connection using host pair | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | using existing local ESP/AH proposals for westnet-eastnet-aes (IKE_AUTH responder matching remote ESP/AH proposals): 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH responder matching remote ESP/AH proposals 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | 5c af ef 29 | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 "westnet-eastnet-aes" #10: proposal 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=5cafef29 chosen from remote proposals 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH responder matching remote ESP/AH proposals ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=5cafef29 | converting proposal to internal trans attrs | netlink_get_spi: allocated 0x7af83f5 for esp.0@192.1.2.23 | emitting ikev2_proposal ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: 07 af 83 f5 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=36 | FOR_EACH_CONNECTION_... in IKE_SA_established | install_ipsec_sa() for #10: inbound and outbound | could_route called for westnet-eastnet-aes; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" prospective erouted: self; eroute owner: self | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.5cafef29@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.7af83f5@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | add inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.10000@192.1.2.23 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #10: prospective erouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" prospective erouted: self; eroute owner: self | route_and_eroute with c: westnet-eastnet-aes (next: none) ero:westnet-eastnet-aes esr:{(nil)} ro:westnet-eastnet-aes rosr:{(nil)} and state: #10 | we are replacing an eroute | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | eroute_connection replace eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.0@192.1.2.45>tun.0@192.1.2.45 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.5cafef29@192.1.2.45 | get_sa_info esp.7af83f5@192.1.2.23 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0'... | popen cmd is 1136 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_: | cmd( 160):NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT=: | cmd( 240):'192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255: | cmd( 320):.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE: | cmd( 400):='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.: | cmd( 480):0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' P: | cmd( 560):LUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' P: | cmd( 640):LUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKE: | cmd( 720):V2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO: | cmd( 800):_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_IN: | cmd( 880):FO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_: | cmd( 960):CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VTI_: | cmd(1040):IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x5cafef29 SPI_OUT=0x7af83f5 ip: | cmd(1120):sec _updown 2>&1: | route_and_eroute: firewall_notified: true | route_and_eroute: instance "westnet-eastnet-aes", setting eroute_owner {spd=0x55701b93af28,sr=0x55701b93af28} to #10 (was #0) (newest_ipsec_sa=#0) | ISAKMP_v2_IKE_AUTH: instance westnet-eastnet-aes[0], setting IKEv2 newest_ipsec_sa to #10 (was #0) (spd.eroute=#10) cloned from #9 | adding 10 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 496 | emitting length of ISAKMP Message: 524 | recording outgoing fragment failed | delref logger@0x55701b93c5f8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #9 switched MD.ST to #10 | suspend processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #10 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #10 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_R0 PARENT_R1->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_R1 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #10 | Message ID: CHILD #9.#10 updating responder received message request 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=0 ike.responder.recv=0->1 ike.responder.last_contact=744610.192283->744610.219165 child.wip.initiator=-1 child.wip.responder=1->-1 | Message ID: CHILD #9.#10 updating responder sent message response 1: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=0->1 ike.responder.recv=1 ike.responder.last_contact=744610.219165 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #9 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744610.219165 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #10: V2_IKE_AUTH_CHILD_R0(ignore) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #10 ikev2.child established | announcing the state transition "westnet-eastnet-aes" #10: negotiated connection [192.0.2.0-192.0.2.255:0-65535 0] -> [192.0.1.0-192.0.1.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes" #10: IPsec SA established tunnel mode {ESP=>0x5cafef29 <0x07af83f5 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | sending 524 bytes for STATE_PARENT_R1 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | ac 61 cc df 5b c4 53 69 ed 6a aa ff 48 05 5a 92 | 43 33 ed ea f5 d7 83 e7 2d e9 8f 02 3c ca 6d 79 | eb fe e0 b3 bd da c5 1b b8 ab 5b 00 5c ec c3 7a | 32 a1 a7 12 9a 04 36 93 0a f4 9e 56 2d 27 f8 c9 | 1e fa 6b 71 8f e2 95 f0 cd 14 6d ab 17 43 23 32 | 34 15 9f ae 67 36 aa b6 f8 7b 80 b4 e6 8a df 2e | d8 b8 a1 7a a8 70 81 fe 6d 35 62 50 63 40 5b 6f | 6f 2f de 5d 22 e6 5a e7 06 1a 9c 10 65 c9 6e 6b | 74 d0 6a 45 b1 2b 65 aa c0 c2 ed 9b be 1d a9 6d | 11 f3 2f c4 25 7d f3 2a 71 f1 79 5e 2b 2e 0c 46 | c4 05 0b d6 37 e5 e8 a6 d2 16 12 1c 1b 54 b7 31 | e4 91 17 93 f8 f3 73 0f e6 90 c1 d8 04 25 b7 a6 | c5 cf e8 38 a6 7d 4b b4 ef f5 c6 f4 5f cf 3d 95 | 9f 9e 51 6d 4c 66 fa 66 02 cf 2e 4b 64 1d 6b 6a | 28 7b f2 b9 4b 28 e2 a0 eb 77 fe 7b d5 7a 01 d4 | df 9b 58 5c d0 30 f0 b6 bc 3b 65 af 18 cf 2a 87 | 24 dd 2a 54 5a 95 f0 e0 17 ff ea d7 be df 39 3d | e9 e7 e8 99 85 23 63 67 d7 d2 53 05 b6 16 95 a6 | 45 2b 2b 51 30 22 f6 1e 89 72 d3 ad 9b 70 67 4d | 90 d0 72 34 82 96 9f bb be 1a 45 5a 65 cb 29 99 | 26 db 0e 60 da be 30 20 73 9a d1 3f c6 ad 55 13 | 70 00 a3 fb f0 3a 0e da 4a 1d 1e 0d 18 19 1c 43 | bf 66 4a a5 46 af 1e 1e 99 71 d3 62 aa 8a 1e 04 | 92 90 c8 c7 c6 d8 64 91 26 e7 ef 9f f6 15 ca 7b | 8a 91 a7 e3 a8 ae b1 e0 28 e9 3b aa e2 e5 40 7d | ad 45 70 58 c3 33 22 7c 7e 65 7f 2a 26 a3 08 d7 | bb 66 74 0c 00 0a 32 12 0e 8f 0c cf 22 55 a4 20 | 89 9c c7 cd a6 d4 0b cb 34 36 a0 54 a0 08 10 03 | e8 58 57 d4 b7 11 5d ac 01 8e d3 78 61 52 92 bd | d4 d5 ea fe 5c 34 72 a5 8f fc ac 8f 41 17 13 6d | 39 8f ed f0 f1 61 4b 50 b9 c4 49 10 | sent 1 messages | releasing #10's fd-fd@(nil) because IKEv2 transitions finished | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #10's IKE SA #9 | unpending state #9 connection "westnet-eastnet-aes" | releasing #9's fd-fd@(nil) because IKEv2 transitions finished so releaseing IKE SA | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #10 will start re-keying in 28530 seconds with margin of 270 seconds (attempting re-key) | state #10 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x55701b93c5f8 | inserting event EVENT_SA_REKEY, timeout in 28530 seconds for #10 | libevent_malloc: newref ptr-libevent@0x55701b9486a8 size 128 | delref mdp@0x55701b9449c8(1->0) (in resume_handler() at server.c:743) | delref logger@0x55701b93c9c8(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #9 spent 1.9 (15.4) milliseconds in resume sending helper answer back to state | stop processing: state #10 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f3edc002b48 | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00473 (0.00461) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00211 (0.0021) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b92cf28(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | 07 74 cb c0 b4 8c 87 b7 b6 bd b6 a7 01 d6 9e 11 | 40 e0 3a e5 28 c2 91 00 cf 47 7c 0f 77 0f 03 50 | df 5b c6 f9 4e 20 cb da b4 e8 33 97 | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #9 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #9 st.st_msgid_lastrecv 1 md.hdr.isa_msgid 00000002 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #9 is idle | Message ID: IKE #9 not a duplicate - message request 2 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744610.219165 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #9 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #9 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 12 (00 0c) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | processing payload: ISAKMP_NEXT_v2D (len=4) | selected state microcode Informational Request | Message ID: IKE #9 responder starting message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744610.219165 ike.wip.initiator=-1 ike.wip.responder=-1->2 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | parsing 4 raw bytes of IKEv2 Delete Payload into SPI | SPI | 5c af ef 29 | delete IKEv2_SEC_PROTO_ESP SA(0x5cafef29) | v2 CHILD SA #10 found using their inbound (our outbound) SPI, in STATE_V2_ESTABLISHED_CHILD_SA | State DB: found IKEv2 state #10 in ESTABLISHED_CHILD_SA (find_v2_child_sa_by_outbound_spi) | our side SPI that needs to be deleted: IKEv2_SEC_PROTO_ESP SA(0x5cafef29) "westnet-eastnet-aes" #9: received Delete SA payload: delete IPsec State #10 now | pstats #10 ikev2.child deleted completed | #10 main thread spent 0 (0) milliseconds helper thread spent 0 (0) milliseconds in total | suspend processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | start processing: state #10 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #10: deleting other state #10 (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.141168s and NOT sending notification | child state #10: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.5cafef29@192.1.2.45 | get_sa_info esp.7af83f5@192.1.2.23 "westnet-eastnet-aes" #10: ESP traffic information: in=0B out=0B | unsuspending #10 MD (nil) | should_send_delete: no, just because | child state #10: ESTABLISHED_CHILD_SA(established CHILD SA) => CHILDSA_DEL(informational) | state #10 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x55701b9486a8 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b93c5f8 | #10 STATE_CHILDSA_DEL: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.5cafef29@192.1.2.45 | get_sa_info esp.7af83f5@192.1.2.23 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED... | popen cmd is 1138 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUT: | cmd( 160):O_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIEN: | cmd( 240):T='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.2: | cmd( 320):55.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TY: | cmd( 400):PE='ESP' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.: | cmd( 480):1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0': | cmd( 560): PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm': | cmd( 640): PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+I: | cmd( 720):KEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLU: | cmd( 800):TO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_: | cmd( 880):INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUT: | cmd( 960):O_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0' VT: | cmd(1040):I_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x5cafef29 SPI_OUT=0x7af83f5 : | cmd(1120):ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.2.0/24:0 --0->- 192.0.1.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.2.0/24:0 dest 192.0.1.0/24:0 | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.5cafef29@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.5cafef29@192.1.2.45 included non-error error | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => unk.10000@192.1.2.23 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.7af83f5@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.7af83f5@192.1.2.23 included non-error error | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #10 in CHILDSA_DEL | child state #10: CHILDSA_DEL(informational) => UNDEFINED(ignore) | releasing #10's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #10 from 192.1.2.45:500 (in delete_state() at state.c:1239) | resume processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b93ab98(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'information exchange reply packet' | emitting 4 raw bytes of local SPIs into IKEv2 Delete Payload | local SPIs: 07 af 83 f5 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | d0 2e 30 6b 3d 98 c4 4e ab 05 f8 55 09 eb a0 0d | 8a 9d 75 23 68 a3 c0 b4 27 49 6a 72 4f 9b 07 f0 | 4d f8 f5 f5 aa 7e b6 0e 6a 6d be 55 | sent 1 messages | Message ID: IKE #9 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=1 ike.responder.recv=1 ike.responder.last_contact=744610.219165 ike.wip.initiator=-1 ike.wip.responder=2 | Message ID: IKE #9 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=1->2 ike.responder.recv=1 ike.responder.last_contact=744610.219165 ike.wip.initiator=-1 ike.wip.responder=2 | #9 spent 0.707 (13.8) milliseconds in processing: Informational Request in v2_dispatch() | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in complete_v2_state_transition() at ikev2.c:3364) | #9 complete_v2_state_transition() ESTABLISHED_IKE_SA->ESTABLISHED_IKE_SA with status STF_OK; .st_v2_transition=PARENT_R0->PARENT_R1 | Message ID: updating counters for #9 | Message ID: IKE #9 updating responder received message request 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=2 ike.responder.recv=1->2 ike.responder.last_contact=744610.219165->744610.359171 ike.wip.initiator=-1 ike.wip.responder=2->-1 | Message ID: IKE #9 updating responder sent message response 2: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744610.359171 ike.wip.initiator=-1 ike.wip.responder=-1 | Message ID: IKE #9 no pending message initiators to schedule: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744610.359171 ike.wip.initiator=-1 ike.wip.responder=-1 | announcing the state transition "westnet-eastnet-aes" #9: established IKE SA | sending 76 bytes for STATE_V2_ESTABLISHED_IKE_SA through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | d0 2e 30 6b 3d 98 c4 4e ab 05 f8 55 09 eb a0 0d | 8a 9d 75 23 68 a3 c0 b4 27 49 6a 72 4f 9b 07 f0 | 4d f8 f5 f5 aa 7e b6 0e 6a 6d be 55 | sent 1 messages | #9 is retaining EVENT_SA_REKEY with is previously set timeout | stop processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1904) | #9 spent 0.978 (14) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b92cf28(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.994 (14.1) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00157 (0.00153) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x55701b9449c8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x55701b93c5f8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.45:500 on eth1 192.1.2.23:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | 98 96 37 1d 9e 8a 43 af 46 ef fd c6 0d ea 0d 56 | a0 fd be 74 75 c3 a1 44 c4 9e 90 f4 28 9c 3b 74 | dc 80 a8 80 d9 c0 b4 bb 78 79 9a 1d | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Responder receiving an IKEv2 INFORMATIONAL request | State DB: found IKEv2 state #9 in ESTABLISHED_IKE_SA (find_v2_ike_sa) | start processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ikev2_process_packet() at ikev2.c:1902) | #9 st.st_msgid_lastrecv 2 md.hdr.isa_msgid 00000003 | State DB: IKEv2 state not found (find_v2_sa_by_responder_wip) | #9 is idle | Message ID: IKE #9 not a duplicate - message request 3 is new: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744610.359171 ike.wip.initiator=-1 ike.wip.responder=-1 | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2D (0x2a) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SK (len=44) | #9 in state ESTABLISHED_IKE_SA: established IKE SA | authenticator matched | #9 ikev2 ISAKMP_v2_INFORMATIONAL decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2D) | **parse IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 8 (00 08) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | processing payload: ISAKMP_NEXT_v2D (len=0) | selected state microcode Informational Request | Message ID: IKE #9 responder starting message request 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744610.359171 ike.wip.initiator=-1 ike.wip.responder=-1->3 | calling processor Informational Request | an informational request should send a response | opening output PBS information exchange reply packet | Received an INFORMATIONAL response, updating st_last_liveness, no pending_liveness | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'information exchange reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | adding 16 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0e repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0f repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for reply packet for process_encrypted_informational_ikev2 through eth1 from 192.1.2.23:500 to 192.1.2.45:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | be 26 f2 17 75 ee 87 d3 25 f0 df 96 c1 e5 90 4f | 2b a8 7a 3d 58 3f 4d 1e 90 86 89 c0 d9 29 5d 7b | 3f d2 57 89 47 45 64 81 2d 2d cf ac | sent 1 messages | Message ID: IKE #9 XXX: in process_encrypted_informational_ikev2() hacking around record 'n' send bypassing send queue hacking around delete_ike_family(): ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=2 ike.responder.recv=2 ike.responder.last_contact=744610.359171 ike.wip.initiator=-1 ike.wip.responder=3 | Message ID: IKE #9 updating responder sent message response 3: ike.initiator.sent=-1 ike.initiator.recv=-1 ike.initiator.last_contact=744610.18992 ike.responder.sent=2->3 ike.responder.recv=2 ike.responder.last_contact=744610.359171 ike.wip.initiator=-1 ike.wip.responder=3 | State DB: IKEv2 state not found (delete_ike_family) | pstats #9 ikev2.ike deleted completed | #9 main thread spent 4.88 (31.7) milliseconds helper thread spent 5.29 (5.52) milliseconds in total | [RE]START processing: state #9 connection "westnet-eastnet-aes" from 192.1.2.45:500 (in delete_state() at state.c:935) | should_send_delete: no, just because "westnet-eastnet-aes" #9: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.169767s and NOT sending notification | parent state #9: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #9 MD (nil) | should_send_delete: no, just because | state #9 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f3ec8002b48 | free_event_entry: delref EVENT_SA_REKEY-pe@0x55701b93fe18 | #9 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes | State DB: deleting IKEv2 state #9 in ESTABLISHED_IKE_SA | parent state #9: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #9's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@NULL (in delete_state() at state.c:1195) | delref pkp@0x55701b9407a8(2->1) (in delete_state() at state.c:1202) | stop processing: state #9 from 192.1.2.45:500 (in delete_state() at state.c:1239) | delref logger@0x55701b92d058(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | in statetime_stop() and could not find #9 | XXX: processor 'Informational Request' for #9 deleted state MD.ST | processing: STOP state #0 (in ikev2_process_packet() at ikev2.c:1904) | in statetime_stop() and could not find #9 | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x55701b9449c8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x55701b93c5f8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.535 (0.562) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00506 (0.00498) milliseconds in signal handler PLUTO_SIGCHLD | newref struct fd@0x55701b943058(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x55701b943058 (in whack_handle_cb() at rcv_whack.c:869) | whack: status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_STATE_... in show_states (sort_states) | delref fd@0x55701b943058(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x55701b943058 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.519 (0.958) milliseconds in whack | newref struct fd@0x55701b943058(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x55701b943058 (in whack_handle_cb() at rcv_whack.c:869) shutting down | leaking fd-fd@0x55701b943058's FD; will be closed when pluto exits (in whack_handle_cb() at rcv_whack.c:889) | delref fd@0x55701b943058(1->0) (in whack_handle_cb() at rcv_whack.c:895) | freeref fd-fd@0x55701b943058 (in whack_handle_cb() at rcv_whack.c:895) | shutting down helper thread 4 | helper thread 4 exited | shutting down helper thread 3 | helper thread 3 exited | shutting down helper thread 5 | helper thread 5 exited | shutting down helper thread 6 | helper thread 6 exited | shutting down helper thread 1 | helper thread 1 exited | shutting down helper thread 7 | helper thread 7 exited | shutting down helper thread 2 | helper thread 2 exited 7 helper threads shutdown | delref root_certs@NULL (in free_root_certs() at root_certs.c:127) | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' | delref pkp@0x55701b93f848(1->0) (in free_public_keyentry() at secrets.c:1591) | delref pkp@0x55701b9407a8(1->0) (in free_public_keyentry() at secrets.c:1591) | deleting states for connection - including all other IPsec SA's of this IKE SA | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-aes' to 'delete' for rt_kind 'unrouted' using protoports 192.0.2.0/24:0 --0->- 192.0.1.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.2.0/24:0 dest 192.0.1.0/24:0 | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | priority calculation of connection "westnet-eastnet-aes" is 2084814 (0x1fcfce) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CLIENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='192.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='... | popen cmd is 1083 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' P: | cmd( 160):LUTO_NEXT_HOP='192.1.2.45' PLUTO_ME='192.1.2.23' PLUTO_MY_ID='@east' PLUTO_MY_CL: | cmd( 240):IENT='192.0.2.0/24' PLUTO_MY_CLIENT_NET='192.0.2.0' PLUTO_MY_CLIENT_MASK='255.25: | cmd( 320):5.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA: | cmd( 400):_TYPE='none' PLUTO_PEER='192.1.2.45' PLUTO_PEER_ID='@west' PLUTO_PEER_CLIENT='19: | cmd( 480):2.0.1.0/24' PLUTO_PEER_CLIENT_NET='192.0.1.0' PLUTO_PEER_CLIENT_MASK='255.255.25: | cmd( 560):5.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='x: | cmd( 640):frm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_: | cmd( 720):ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CO: | cmd( 800):NN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO=: | cmd( 880):'' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG: | cmd( 960):_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no: | cmd(1040):' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1: unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x55701b93fe18(0->1) (in clone_logger() at log.c:817) | delref hp@0x55701b93c3f8(1->0) (in delete_oriented_hp() at hostpair.c:360) | flush revival: connection 'westnet-eastnet-aes' wasn't on the list | delref vip@NULL (in discard_connection() at connections.c:262) | delref vip@NULL (in discard_connection() at connections.c:263) | Connection DB: deleting connection $1 | delref logger@0x55701b93fe18(1->0) (in delete_connection() at connections.c:214) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | crl fetch request list locked by 'free_crl_fetch' | crl fetch request list unlocked by 'free_crl_fetch' | iface: marking eth1 dead | iface: marking eth0 dead | iface: marking lo dead | updating interfaces - listing interfaces that are going down shutting down interface lo 127.0.0.1:4500 shutting down interface lo 127.0.0.1:500 shutting down interface eth0 192.0.2.254:4500 shutting down interface eth0 192.0.2.254:500 shutting down interface eth1 192.1.2.23:4500 shutting down interface eth1 192.1.2.23:500 | updating interfaces - deleting the dead | FOR_EACH_STATE_... in delete_states_dead_interfaces | libevent_free: delref ptr-libevent@0x55701b935d18 | delref id@0x55701b939de8(3->2) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x55701b8f91d8 | delref id@0x55701b939de8(2->1) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x55701b8ee498 | delref id@0x55701b939d18(3->2) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x55701b8f92d8 | delref id@0x55701b939d18(2->1) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x55701b8f5cf8 | delref id@0x55701b939be8(3->2) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x55701b8f5c48 | delref id@0x55701b939be8(2->1) (in release_iface_dev() at iface.c:125) | delref id@0x55701b939be8(1->0) (in release_iface_dev() at iface.c:125) | delref id@0x55701b939d18(1->0) (in release_iface_dev() at iface.c:125) | delref id@0x55701b939de8(1->0) (in release_iface_dev() at iface.c:125) | updating interfaces - checking orientation | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | libevent_free: delref ptr-libevent@0x55701b935dc8 | free_event_entry: delref EVENT_NULL-pe@0x55701b939188 | libevent_free: delref ptr-libevent@0x55701b8f90d8 | free_event_entry: delref EVENT_NULL-pe@0x55701b933b18 | libevent_free: delref ptr-libevent@0x55701b8f9028 | free_event_entry: delref EVENT_NULL-pe@0x55701b92d288 | global timer EVENT_REINIT_SECRET uninitialized | global timer EVENT_SHUNT_SCAN uninitialized | global timer EVENT_PENDING_DDNS uninitialized | global timer EVENT_PENDING_PHASE2 uninitialized | global timer EVENT_CHECK_CRLS uninitialized | global timer EVENT_REVIVE_CONNS uninitialized | global timer EVENT_FREE_ROOT_CERTS uninitialized | global timer EVENT_RESET_LOG_RATE_LIMIT uninitialized | global timer EVENT_NAT_T_KEEPALIVE uninitialized | libevent_free: delref ptr-libevent@0x55701b88b578 | signal event handler PLUTO_SIGCHLD uninstalled | libevent_free: delref ptr-libevent@0x55701b87a798 | signal event handler PLUTO_SIGTERM uninstalled | libevent_free: delref ptr-libevent@0x55701b9393a8 | signal event handler PLUTO_SIGHUP uninstalled | libevent_free: delref ptr-libevent@0x55701b9395e8 | signal event handler PLUTO_SIGSYS uninstalled | releasing event base | libevent_free: delref ptr-libevent@0x55701b9394b8 | libevent_free: delref ptr-libevent@0x55701b928738 | libevent_free: delref ptr-libevent@0x55701b9286e8 | libevent_free: delref ptr-libevent@0x55701b8fb898 | libevent_free: delref ptr-libevent@0x55701b9288e8 | libevent_free: delref ptr-libevent@0x55701b92cb08 | libevent_free: delref ptr-libevent@0x55701b92c918 | libevent_free: delref ptr-libevent@0x55701b928928 | libevent_free: delref ptr-libevent@0x55701b92c728 | libevent_free: delref ptr-libevent@0x55701b92c0e8 | libevent_free: delref ptr-libevent@0x55701b93a8d8 | libevent_free: delref ptr-libevent@0x55701b93a898 | libevent_free: delref ptr-libevent@0x55701b93a858 | libevent_free: delref ptr-libevent@0x55701b93a818 | libevent_free: delref ptr-libevent@0x55701b93a7d8 | libevent_free: delref ptr-libevent@0x55701b93a798 | libevent_free: delref ptr-libevent@0x55701b91eeb8 | libevent_free: delref ptr-libevent@0x55701b939368 | libevent_free: delref ptr-libevent@0x55701b939328 | libevent_free: delref ptr-libevent@0x55701b92c768 | libevent_free: delref ptr-libevent@0x55701b939478 | libevent_free: delref ptr-libevent@0x55701b9391f8 | libevent_free: delref ptr-libevent@0x55701b8fb518 | libevent_free: delref ptr-libevent@0x55701b8fad78 | libevent_free: delref ptr-libevent@0x55701b8f1d58 | releasing global libevent data | libevent_free: delref ptr-libevent@0x55701b8fb0b8 | libevent_free: delref ptr-libevent@0x55701b87a738 | libevent_free: delref ptr-libevent@0x55701b8fb598 leak detective found no leaks