| newref logger@0x5634e16dcbb8(0->1) (in main() at plutomain.c:1591) | delref logger@0x5634e16dcbb8(1->0) (in main() at plutomain.c:1592) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) NSS DB directory: sql:/var/lib/ipsec/nss Initializing NSS Opening NSS database "sql:/var/lib/ipsec/nss" read-only FIPS Mode: NO NSS crypto library initialized FIPS mode disabled for pluto daemon FIPS HMAC integrity support [disabled] libcap-ng support [enabled] Linux audit support [enabled] Linux audit activated Starting Pluto (Libreswan Version v4.1-88-gf1d1933837ef-main IKEv2 IKEv1 XFRM(netkey) XFRMI esp-hw-offload FORK PTHREAD_SETSCHEDPRIO NSS (IPsec profile) (NSS-PRF) DNSSEC LABELED_IPSEC (SELINUX) SECCOMP LIBCAP_NG LINUX_AUDIT AUTH_PAM NETWORKMANAGER CURL(non-NSS)) pid:2190947 core dump dir: /tmp secrets file: /etc/ipsec.secrets leak-detective enabled NSS crypto [enabled] XAUTH PAM support [enabled] | libevent is using pluto's memory allocator Initializing libevent in pthreads mode: headers: 2.1.8-stable (2010800); library: 2.1.8-stable (2010800) | libevent_malloc: newref ptr-libevent@0x5634e17620b8 size 40 | libevent_malloc: newref ptr-libevent@0x5634e16e1738 size 40 | libevent_malloc: newref ptr-libevent@0x5634e1762598 size 40 | creating event base | libevent_malloc: newref ptr-libevent@0x5634e1762898 size 56 | libevent_malloc: newref ptr-libevent@0x5634e1758d58 size 664 | libevent_malloc: newref ptr-libevent@0x5634e178f6e8 size 24 | libevent_malloc: newref ptr-libevent@0x5634e178f738 size 384 | libevent_malloc: newref ptr-libevent@0x5634e178f8e8 size 16 | libevent_malloc: newref ptr-libevent@0x5634e1762518 size 40 | libevent_malloc: newref ptr-libevent@0x5634e1761d78 size 48 | libevent_realloc: newref ptr-libevent@0x5634e1785eb8 size 256 | libevent_malloc: newref ptr-libevent@0x5634e178f928 size 16 | libevent_free: delref ptr-libevent@0x5634e1762898 | libevent initialized | libevent_realloc: newref ptr-libevent@0x5634e1762898 size 64 | global periodic timer EVENT_RESET_LOG_RATE_LIMIT enabled with interval of 3600 seconds | init_nat_traversal() initialized with keep_alive=0s NAT-Traversal support [enabled] | global one-shot timer EVENT_NAT_T_KEEPALIVE initialized | global one-shot timer EVENT_FREE_ROOT_CERTS initialized | global periodic timer EVENT_REINIT_SECRET enabled with interval of 3600 seconds | checking IKEv1 state table | MAIN_R0: category: half-open IKE SA; flags: 0: | -> MAIN_R1 EVENT_SO_DISCARD (main_inI1_outR1) | MAIN_I1: category: half-open IKE SA; flags: 0: | -> MAIN_I2 EVENT_RETRANSMIT (main_inR1_outI2) | MAIN_R1: category: open IKE SA; flags: 0: | -> MAIN_R2 EVENT_RETRANSMIT (main_inI2_outR2) | -> MAIN_R1 EVENT_RETRANSMIT (unexpected) | -> MAIN_R1 EVENT_RETRANSMIT (unexpected) | MAIN_I2: category: open IKE SA; flags: 0: | -> MAIN_I3 EVENT_RETRANSMIT (main_inR2_outI3) | -> MAIN_I2 EVENT_RETRANSMIT (unexpected) | -> MAIN_I2 EVENT_RETRANSMIT (unexpected) | MAIN_R2: category: open IKE SA; flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE (main_inI3_outR3) | -> MAIN_R3 EVENT_SA_REPLACE (main_inI3_outR3) | -> MAIN_R2 EVENT_SA_REPLACE (unexpected) | MAIN_I3: category: open IKE SA; flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE (main_inR3) | -> MAIN_I4 EVENT_SA_REPLACE (main_inR3) | -> MAIN_I3 EVENT_SA_REPLACE (unexpected) | MAIN_R3: category: established IKE SA; flags: 0: | -> MAIN_R3 EVENT_NULL (unexpected) | MAIN_I4: category: established IKE SA; flags: 0: | -> MAIN_I4 EVENT_NULL (unexpected) | AGGR_R0: category: half-open IKE SA; flags: 0: | -> AGGR_R1 EVENT_SO_DISCARD (aggr_inI1_outR1) | AGGR_I1: category: half-open IKE SA; flags: 0: | -> AGGR_I2 EVENT_SA_REPLACE (aggr_inR1_outI2) | -> AGGR_I2 EVENT_SA_REPLACE (aggr_inR1_outI2) | AGGR_R1: category: open IKE SA; flags: 0: | -> AGGR_R2 EVENT_SA_REPLACE (aggr_inI2) | -> AGGR_R2 EVENT_SA_REPLACE (aggr_inI2) | AGGR_I2: category: established IKE SA; flags: 0: | -> AGGR_I2 EVENT_NULL (unexpected) | AGGR_R2: category: established IKE SA; flags: 0: | -> AGGR_R2 EVENT_NULL (unexpected) | QUICK_R0: category: established CHILD SA; flags: 0: | -> QUICK_R1 EVENT_RETRANSMIT (quick_inI1_outR1) | QUICK_I1: category: established CHILD SA; flags: 0: | -> QUICK_I2 EVENT_SA_REPLACE (quick_inR1_outI2) | QUICK_R1: category: established CHILD SA; flags: 0: | -> QUICK_R2 EVENT_SA_REPLACE (quick_inI2) | QUICK_I2: category: established CHILD SA; flags: 0: | -> QUICK_I2 EVENT_NULL (unexpected) | QUICK_R2: category: established CHILD SA; flags: 0: | -> QUICK_R2 EVENT_NULL (unexpected) | INFO: category: informational; flags: 0: | -> INFO EVENT_NULL (informational) | INFO_PROTECTED: category: informational; flags: 0: | -> INFO_PROTECTED EVENT_NULL (informational) | XAUTH_R0: category: established IKE SA; flags: 0: | -> XAUTH_R1 EVENT_NULL (xauth_inR0) | XAUTH_R1: category: established IKE SA; flags: 0: | -> MAIN_R3 EVENT_SA_REPLACE (xauth_inR1) | MODE_CFG_R0: category: informational; flags: 0: | -> MODE_CFG_R1 EVENT_SA_REPLACE (modecfg_inR0) | MODE_CFG_R1: category: established IKE SA; flags: 0: | -> MODE_CFG_R2 EVENT_SA_REPLACE (modecfg_inR1) | MODE_CFG_R2: category: established IKE SA; flags: 0: | -> MODE_CFG_R2 EVENT_NULL (unexpected) | MODE_CFG_I1: category: established IKE SA; flags: 0: | -> MAIN_I4 EVENT_SA_REPLACE (modecfg_inR1) | XAUTH_I0: category: established IKE SA; flags: 0: | -> XAUTH_I1 EVENT_RETRANSMIT (xauth_inI0) | XAUTH_I1: category: established IKE SA; flags: 0: | -> MAIN_I4 EVENT_RETRANSMIT (xauth_inI1) | checking IKEv2 state table | V2_REKEY_IKE_I0: category: established IKE SA; flags: 0: | -> V2_REKEY_IKE_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IKE Rekey) | V2_REKEY_CHILD_I0: category: established IKE SA; flags: 0: | -> V2_REKEY_CHILD_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec Rekey SA) | V2_NEW_CHILD_I0: category: established IKE SA; flags: 0: | -> V2_NEW_CHILD_I1 EVENT_RETRANSMIT send-request (Initiate CREATE_CHILD_SA IPsec SA) | PARENT_I0: category: ignore; flags: 0: | -> PARENT_I1 EVENT_RETRANSMIT send-request (initiate IKE_SA_INIT) | PARENT_I1: category: half-open IKE SA; flags: 0: | -> PARENT_I0 EVENT_SO_DISCARD (received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added) | -> PARENT_I0 EVENT_SO_DISCARD (received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload) | -> IKESA_DEL EVENT_v2_REDIRECT (received REDIRECT notify response; resending IKE_SA_INIT request to new destination) | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE) | PARENT_I2: category: open IKE SA; flags: 0: | -> PARENT_I2 EVENT_RETRANSMIT send-request (Initiator: process IKE_INTERMEDIATE reply, initiate IKE_AUTH or IKE_INTERMEDIATE) | -> PARENT_I2 EVENT_NULL (Initiator: process INVALID_SYNTAX AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process AUTHENTICATION_FAILED AUTH notification) | -> PARENT_I2 EVENT_NULL (Initiator: process UNSUPPORTED_CRITICAL_PAYLOAD AUTH notification) | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE (Initiator: process IKE_AUTH response) | -> PARENT_I2 EVENT_NULL (IKE SA: process IKE_AUTH response containing unknown notification) | PARENT_R0: category: half-open IKE SA; flags: 0: | -> PARENT_R1 EVENT_SO_DISCARD send-response (Respond to IKE_SA_INIT) | PARENT_R1: category: half-open IKE SA; flags: 0: | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_AUTH request (no SKEYSEED)) | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_INTERMEDIATE request (no SKEYSEED)) | -> PARENT_R1 EVENT_SA_REPLACE send-response (Responder: process IKE_INTERMEDIATE request (with SKEYSEED)) | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Responder: process IKE_AUTH request) | V2_REKEY_IKE_R0: category: established IKE SA; flags: 0: | -> ESTABLISHED_IKE_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA IKE Rekey) | V2_REKEY_IKE_I1: category: established IKE SA; flags: 0: | -> ESTABLISHED_IKE_SA EVENT_SA_REPLACE (Process CREATE_CHILD_SA IKE Rekey Response) | V2_NEW_CHILD_I1: category: established IKE SA; flags: 0: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE (Process CREATE_CHILD_SA IPsec SA Response) | V2_REKEY_CHILD_R0: category: established IKE SA; flags: 0: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA rekey CHILD SA request) | V2_NEW_CHILD_R0: category: established IKE SA; flags: 0: | -> ESTABLISHED_CHILD_SA EVENT_SA_REPLACE send-response (Respond to CREATE_CHILD_SA IPsec SA Request) | ESTABLISHED_IKE_SA: category: established IKE SA; flags: 0: | -> ESTABLISHED_IKE_SA EVENT_RETAIN send-response (Informational Request (liveness probe)) | -> ESTABLISHED_IKE_SA EVENT_RETAIN (Informational Response (liveness probe)) | -> ESTABLISHED_IKE_SA EVENT_RETAIN send-response (Informational Request) | -> ESTABLISHED_IKE_SA EVENT_RETAIN (Informational Response) | IKESA_DEL: category: established IKE SA; flags: 0: | -> IKESA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | CHILDSA_DEL: category: informational; flags: 0: | -> CHILDSA_DEL EVENT_RETAIN (IKE_SA_DEL: process INFORMATIONAL) | global one-shot timer EVENT_REVIVE_CONNS initialized | global periodic timer EVENT_PENDING_DDNS enabled with interval of 60 seconds | global periodic timer EVENT_PENDING_PHASE2 enabled with interval of 120 seconds Encryption algorithms: AES_CCM_16 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm, aes_ccm_c AES_CCM_12 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm_b AES_CCM_8 {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_ccm_a 3DES_CBC [*192] IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CBC) 3des CAMELLIA_CTR {256,192,*128} IKEv1: ESP IKEv2: ESP CAMELLIA_CBC {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP NSS(CBC) camellia AES_GCM_16 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm, aes_gcm_c AES_GCM_12 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm_b AES_GCM_8 {256,192,*128} IKEv1: ESP IKEv2: IKE ESP FIPS NSS(GCM) aes_gcm_a AES_CTR {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CTR) aesctr AES_CBC {256,192,*128} IKEv1: IKE ESP IKEv2: IKE ESP FIPS NSS(CBC) aes NULL_AUTH_AES_GMAC {256,192,*128} IKEv1: ESP IKEv2: ESP FIPS aes_gmac NULL [] IKEv1: ESP IKEv2: ESP CHACHA20_POLY1305 [*256] IKEv1: IKEv2: IKE ESP NSS(AEAD) chacha20poly1305 Hash algorithms: MD5 IKEv1: IKE IKEv2: NSS SHA1 IKEv1: IKE IKEv2: IKE FIPS NSS sha SHA2_256 IKEv1: IKE IKEv2: IKE FIPS NSS sha2, sha256 SHA2_384 IKEv1: IKE IKEv2: IKE FIPS NSS sha384 SHA2_512 IKEv1: IKE IKEv2: IKE FIPS NSS sha512 PRF algorithms: HMAC_MD5 IKEv1: IKE IKEv2: IKE native(HMAC) md5 HMAC_SHA1 IKEv1: IKE IKEv2: IKE FIPS NSS sha, sha1 HMAC_SHA2_256 IKEv1: IKE IKEv2: IKE FIPS NSS sha2, sha256, sha2_256 HMAC_SHA2_384 IKEv1: IKE IKEv2: IKE FIPS NSS sha384, sha2_384 HMAC_SHA2_512 IKEv1: IKE IKEv2: IKE FIPS NSS sha512, sha2_512 AES_XCBC IKEv1: IKEv2: IKE native(XCBC) aes128_xcbc Integrity algorithms: HMAC_MD5_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH native(HMAC) md5, hmac_md5 HMAC_SHA1_96 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha, sha1, sha1_96, hmac_sha1 HMAC_SHA2_512_256 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha512, sha2_512, sha2_512_256, hmac_sha2_512 HMAC_SHA2_384_192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha384, sha2_384, sha2_384_192, hmac_sha2_384 HMAC_SHA2_256_128 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS sha2, sha256, sha2_256, sha2_256_128, hmac_sha2_256 HMAC_SHA2_256_TRUNCBUG IKEv1: ESP AH IKEv2: AH AES_XCBC_96 IKEv1: ESP AH IKEv2: IKE ESP AH native(XCBC) aes_xcbc, aes128_xcbc, aes128_xcbc_96 AES_CMAC_96 IKEv1: ESP AH IKEv2: ESP AH FIPS aes_cmac NONE IKEv1: ESP IKEv2: IKE ESP FIPS null DH algorithms: NONE IKEv1: IKEv2: IKE ESP AH FIPS NSS(MODP) null, dh0 MODP1536 IKEv1: IKE ESP AH IKEv2: IKE ESP AH NSS(MODP) dh5 MODP2048 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh14 MODP3072 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh15 MODP4096 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh16 MODP6144 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh17 MODP8192 IKEv1: IKE ESP AH IKEv2: IKE ESP AH FIPS NSS(MODP) dh18 DH19 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_256, ecp256 DH20 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_384, ecp384 DH21 IKEv1: IKE IKEv2: IKE ESP AH FIPS NSS(ECP) ecp_521, ecp521 DH31 IKEv1: IKE IKEv2: IKE ESP AH NSS(ECP) curve25519 testing CAMELLIA_CBC: Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 128-bit key Camellia: 16 bytes with 256-bit key Camellia: 16 bytes with 256-bit key testing AES_GCM_16: empty string one block two blocks two blocks with associated data testing AES_CTR: Encrypting 16 octets using AES-CTR with 128-bit key Encrypting 32 octets using AES-CTR with 128-bit key Encrypting 36 octets using AES-CTR with 128-bit key Encrypting 16 octets using AES-CTR with 192-bit key Encrypting 32 octets using AES-CTR with 192-bit key Encrypting 36 octets using AES-CTR with 192-bit key Encrypting 16 octets using AES-CTR with 256-bit key Encrypting 32 octets using AES-CTR with 256-bit key Encrypting 36 octets using AES-CTR with 256-bit key testing AES_CBC: Encrypting 16 bytes (1 block) using AES-CBC with 128-bit key Encrypting 32 bytes (2 blocks) using AES-CBC with 128-bit key Encrypting 48 bytes (3 blocks) using AES-CBC with 128-bit key Encrypting 64 bytes (4 blocks) using AES-CBC with 128-bit key testing AES_XCBC: RFC 3566 Test Case 1: AES-XCBC-MAC-96 with 0-byte input RFC 3566 Test Case 2: AES-XCBC-MAC-96 with 3-byte input RFC 3566 Test Case 3: AES-XCBC-MAC-96 with 16-byte input RFC 3566 Test Case 4: AES-XCBC-MAC-96 with 20-byte input RFC 3566 Test Case 5: AES-XCBC-MAC-96 with 32-byte input RFC 3566 Test Case 6: AES-XCBC-MAC-96 with 34-byte input RFC 3566 Test Case 7: AES-XCBC-MAC-96 with 1000-byte input RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 16) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 10) RFC 4434 Test Case AES-XCBC-PRF-128 with 20-byte input (key length 18) testing HMAC_MD5: RFC 2104: MD5_HMAC test 1 RFC 2104: MD5_HMAC test 2 RFC 2104: MD5_HMAC test 3 8 CPU cores online starting up 7 helper threads started thread for helper 0 | starting helper thread 1 seccomp security disabled for crypto helper 1 | status value returned by setting the priority of this helper thread 1: 22 | helper thread 1 has nothing to do started thread for helper 1 | starting helper thread 2 seccomp security disabled for crypto helper 2 | status value returned by setting the priority of this helper thread 2: 22 | helper thread 2 has nothing to do started thread for helper 2 | starting helper thread 3 seccomp security disabled for crypto helper 3 | status value returned by setting the priority of this helper thread 3: 22 | helper thread 3 has nothing to do started thread for helper 3 | starting helper thread 4 seccomp security disabled for crypto helper 4 | status value returned by setting the priority of this helper thread 4: 22 | helper thread 4 has nothing to do started thread for helper 4 | starting helper thread 5 seccomp security disabled for crypto helper 5 started thread for helper 5 | starting helper thread 6 seccomp security disabled for crypto helper 6 | status value returned by setting the priority of this helper thread 6: 22 | helper thread 6 has nothing to do | status value returned by setting the priority of this helper thread 5: 22 | helper thread 5 has nothing to do started thread for helper 6 | starting helper thread 7 seccomp security disabled for crypto helper 7 | status value returned by setting the priority of this helper thread 7: 22 | helper thread 7 has nothing to do Using Linux XFRM/NETKEY IPsec kernel support code on 5.8.15-201.fc32.x86_64 | Hard-wiring algorithms | adding AES_CCM_16 to kernel algorithm db | adding AES_CCM_12 to kernel algorithm db | adding AES_CCM_8 to kernel algorithm db | adding 3DES_CBC to kernel algorithm db | adding CAMELLIA_CBC to kernel algorithm db | adding AES_GCM_16 to kernel algorithm db | adding AES_GCM_12 to kernel algorithm db | adding AES_GCM_8 to kernel algorithm db | adding AES_CTR to kernel algorithm db | adding AES_CBC to kernel algorithm db | adding NULL_AUTH_AES_GMAC to kernel algorithm db | adding NULL to kernel algorithm db | adding CHACHA20_POLY1305 to kernel algorithm db | adding HMAC_MD5_96 to kernel algorithm db | adding HMAC_SHA1_96 to kernel algorithm db | adding HMAC_SHA2_512_256 to kernel algorithm db | adding HMAC_SHA2_384_192 to kernel algorithm db | adding HMAC_SHA2_256_128 to kernel algorithm db | adding HMAC_SHA2_256_TRUNCBUG to kernel algorithm db | adding AES_XCBC_96 to kernel algorithm db | adding AES_CMAC_96 to kernel algorithm db | adding NONE to kernel algorithm db | net.ipv6.conf.all.disable_ipv6=1 ignore ipv6 holes | global periodic timer EVENT_SHUNT_SCAN enabled with interval of 20 seconds | setup kernel fd callback | add_fd_read_event_handler: newref KERNEL_XRM_FD-pe@0x5634e1794288 | libevent_malloc: newref ptr-libevent@0x5634e1760028 size 128 | libevent_malloc: newref ptr-libevent@0x5634e1793728 size 16 | add_fd_read_event_handler: newref KERNEL_ROUTE_FD-pe@0x5634e179ab18 | libevent_malloc: newref ptr-libevent@0x5634e17600d8 size 128 | libevent_malloc: newref ptr-libevent@0x5634e17930e8 size 16 | global one-shot timer EVENT_CHECK_CRLS initialized SELinux support is enabled in PERMISSIVE mode. | unbound context created - setting debug level to 5 | /etc/hosts lookups activated | /etc/resolv.conf usage activated | outgoing-port-avoid set 0-65535 | outgoing-port-permit set 32768-60999 | loading dnssec root key from:/var/lib/unbound/root.key | no additional dnssec trust anchors defined via dnssec-trusted= option | Setting up events, loop start | add_fd_read_event_handler: newref PLUTO_CTL_FD-pe@0x5634e17a0188 | libevent_malloc: newref ptr-libevent@0x5634e179cdc8 size 128 | libevent_malloc: newref ptr-libevent@0x5634e1793b08 size 16 | libevent_realloc: newref ptr-libevent@0x5634e17a01f8 size 256 | libevent_malloc: newref ptr-libevent@0x5634e1793768 size 8 | libevent_realloc: newref ptr-libevent@0x5634e1793f98 size 144 | libevent_malloc: newref ptr-libevent@0x5634e16f2578 size 152 | libevent_malloc: newref ptr-libevent@0x5634e1793918 size 16 | signal event handler PLUTO_SIGCHLD installed | libevent_malloc: newref ptr-libevent@0x5634e17a0328 size 8 | libevent_malloc: newref ptr-libevent@0x5634e16e1798 size 152 | signal event handler PLUTO_SIGTERM installed | libevent_malloc: newref ptr-libevent@0x5634e17a0368 size 8 | libevent_malloc: newref ptr-libevent@0x5634e17a03a8 size 152 | signal event handler PLUTO_SIGHUP installed | libevent_malloc: newref ptr-libevent@0x5634e17a0478 size 8 | libevent_realloc: delref ptr-libevent@0x5634e1793f98 | libevent_realloc: newref ptr-libevent@0x5634e17a04b8 size 256 | libevent_malloc: newref ptr-libevent@0x5634e17a05e8 size 152 | signal event handler PLUTO_SIGSYS installed | created addconn helper (pid:2190970) using fork+execve | forked child 2190970 seccomp security disabled | newref struct fd@0x5634e17a0748(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a0748 (in whack_handle_cb() at rcv_whack.c:869) | whack: listen listening for IKE messages | Inspecting interface lo | found lo with address 127.0.0.1 | Inspecting interface eth0 | found eth0 with address 192.0.1.254 | Inspecting interface eth1 | found eth1 with address 192.1.2.45 | newref struct iface_dev@0x5634e17a0be8(0->1) (in add_iface_dev() at iface.c:67) Kernel supports NIC esp-hw-offload | iface: marking eth1 add | newref struct iface_dev@0x5634e17a0d18(0->1) (in add_iface_dev() at iface.c:67) | iface: marking eth0 add | newref struct iface_dev@0x5634e17a0de8(0->1) (in add_iface_dev() at iface.c:67) | iface: marking lo add | no interfaces to sort | MSG_ERRQUEUE enabled on fd 18 | addref ifd@0x5634e17a0be8(1->2) (in bind_iface_port() at iface.c:237) adding UDP interface eth1 192.1.2.45:500 | MSG_ERRQUEUE enabled on fd 19 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 | addref ifd@0x5634e17a0be8(2->3) (in bind_iface_port() at iface.c:237) adding UDP interface eth1 192.1.2.45:4500 | MSG_ERRQUEUE enabled on fd 20 | addref ifd@0x5634e17a0d18(1->2) (in bind_iface_port() at iface.c:237) adding UDP interface eth0 192.0.1.254:500 | MSG_ERRQUEUE enabled on fd 21 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 | addref ifd@0x5634e17a0d18(2->3) (in bind_iface_port() at iface.c:237) adding UDP interface eth0 192.0.1.254:4500 | MSG_ERRQUEUE enabled on fd 22 | addref ifd@0x5634e17a0de8(1->2) (in bind_iface_port() at iface.c:237) adding UDP interface lo 127.0.0.1:500 | MSG_ERRQUEUE enabled on fd 23 | NAT-Traversal: Trying sockopt style NAT-T | NAT-Traversal: ESPINUDP(2) setup succeeded for sockopt style NAT-T family IPv4 | addref ifd@0x5634e17a0de8(2->3) (in bind_iface_port() at iface.c:237) adding UDP interface lo 127.0.0.1:4500 | updating interfaces - listing interfaces that are going down | updating interfaces - checking orientation | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | libevent_malloc: newref ptr-libevent@0x5634e179cd18 size 128 | libevent_malloc: newref ptr-libevent@0x5634e17a1798 size 16 | setup callback for interface lo 127.0.0.1:4500 fd 23 on UDP | libevent_malloc: newref ptr-libevent@0x5634e17601d8 size 128 | libevent_malloc: newref ptr-libevent@0x5634e17a17d8 size 16 | setup callback for interface lo 127.0.0.1:500 fd 22 on UDP | libevent_malloc: newref ptr-libevent@0x5634e1755498 size 128 | libevent_malloc: newref ptr-libevent@0x5634e17a1818 size 16 | setup callback for interface eth0 192.0.1.254:4500 fd 21 on UDP | libevent_malloc: newref ptr-libevent@0x5634e17602d8 size 128 | libevent_malloc: newref ptr-libevent@0x5634e17a1858 size 16 | setup callback for interface eth0 192.0.1.254:500 fd 20 on UDP | libevent_malloc: newref ptr-libevent@0x5634e175ccf8 size 128 | libevent_malloc: newref ptr-libevent@0x5634e17a1898 size 16 | setup callback for interface eth1 192.1.2.45:4500 fd 19 on UDP | libevent_malloc: newref ptr-libevent@0x5634e175cc48 size 128 | libevent_malloc: newref ptr-libevent@0x5634e17a18d8 size 16 | setup callback for interface eth1 192.1.2.45:500 fd 18 on UDP | no stale xfrmi interface 'ipsec1' found | certs and keys locked by 'free_preshared_secrets' | certs and keys unlocked by 'free_preshared_secrets' loading secrets from "/etc/ipsec.secrets" no secrets filename matched "/etc/ipsec.d/*.secrets" | old food groups: | new food groups: | delref fd@0x5634e17a0748(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a0748 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.688 (3.34) milliseconds in whack | processing signal PLUTO_SIGCHLD | waitpid returned pid 2190970 (exited with status 0) | reaped addconn helper child (status 0) | waitpid returned ECHILD (no child processes left) | spent 0.0207 (0.0207) milliseconds in signal handler PLUTO_SIGCHLD | newref struct fd@0x5634e17a0cb8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a0cb8 (in whack_handle_cb() at rcv_whack.c:869) | whack: options (impair|debug) | old debugging base+cpu-usage + none | new debugging = base+cpu-usage | delref fd@0x5634e17a0cb8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a0cb8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.0542 (0.0563) milliseconds in whack | newref struct fd@0x5634e17a0788(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a0788 (in whack_handle_cb() at rcv_whack.c:869) | whack: options (impair|debug) | old debugging base+cpu-usage + none | new debugging = base+cpu-usage | suppress-retransmits:yes | delref fd@0x5634e17a0788(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a0788 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.0727 (0.0723) milliseconds in whack | newref struct fd@0x5634e17a07c8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a07c8 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-default' | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | whack: connection 'westnet-eastnet-aes-default' | addref fd@0x5634e17a07c8(1->2) (in string_logger() at log.c:838) | newref string logger@0x5634e1794058(0->1) (in add_connection() at connections.c:1998) | Connection DB: adding connection "westnet-eastnet-aes-default" $1 | FOR_EACH_CONNECTION_... in conn_by_name | added new connection westnet-eastnet-aes-default with policy RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | ike (phase1) algorithm values: AES_CBC-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp=aes-sha1 | ESP/AH string values: AES_CBC-HMAC_SHA1_96 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | saving left CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 extracted from raw RSA public key | loaded private key matching CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 | copying key using reference slot | certs and keys locked by 'lsw_add_rsa_secret' | certs and keys unlocked by 'lsw_add_rsa_secret' | spent 1.86 (2.02) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID connection "westnet-eastnet-aes-default": loaded private key matching left CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 | counting wild cards for @west is 0 | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | saving right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | spent 0.049 (0.0489) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key matching right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1: can't find the private key matching the NSS CKAID | counting wild cards for @east is 0 | updating connection from left.host_addr | left host_port 500 | updating connection from right.host_addr | right host_port 500 | orienting westnet-eastnet-aes-default | westnet-eastnet-aes-default doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-default doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-default doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-default doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-default doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-default's this | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | newref hp@0x5634e17a75b8(0->1) (in connect_to_host_pair() at hostpair.c:290) added IKEv2 connection "westnet-eastnet-aes-default" | ike_life: 3600; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | 192.0.1.0/24===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.0/24 | delref logger@0x5634e1794058(1->0) (in add_connection() at connections.c:2026) | delref fd@0x5634e17a07c8(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | delref fd@0x5634e17a07c8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a07c8 (in whack_handle_cb() at rcv_whack.c:903) | spent 2.27 (2.43) milliseconds in whack | newref struct fd@0x5634e17a59e8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a59e8 (in whack_handle_cb() at rcv_whack.c:869) | whack: key add keyid @west | 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | 15 04 37 f9 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | newref struct pubkey@0x5634e17a7708(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17a7708(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17a7708(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.00922 (0.0093) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | delref fd@0x5634e17a59e8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a59e8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.121 (0.121) milliseconds in whack | newref struct fd@0x5634e17a7898(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a7898 (in whack_handle_cb() at rcv_whack.c:869) | whack: key add keyid @east | 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | 51 51 48 ef | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | newref struct pubkey@0x5634e17a6848(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17a6848(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17a6848(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | spent 0.0434 (0.0435) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key: can't find the private key matching the NSS CKAID | delref fd@0x5634e17a7898(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a7898 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.172 (0.187) milliseconds in whack | newref struct fd@0x5634e17a78d8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a78d8 (in whack_handle_cb() at rcv_whack.c:869) | whack: initiate | FOR_EACH_CONNECTION_... in conn_by_name | connection 'westnet-eastnet-aes-default' +POLICY_UP | FOR_EACH_STATE_... in find_phase1_state | newref alloc logger@0x5634e1794058(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a78d8(1->2) (in new_state() at state.c:577) | creating state object #1 at 0x5634e17a7bc8 | State DB: adding IKEv2 state #1 in UNDEFINED | pstats #1 ikev2.ike started | parent state #1: UNDEFINED(ignore) => PARENT_I0(ignore) | #1.st_v2_transition NULL -> PARENT_I0->PARENT_I1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #1 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744608.577806 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744608.577806 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes-default | westnet-eastnet-aes-default doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-default doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-default doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-default doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-default doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-default's this | start processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:544) | addref fd@0x5634e17a78d8(2->3) (in add_pending() at pending.c:86) | queuing pending IPsec SA negotiating with 192.1.2.23 IKE SA #1 "westnet-eastnet-aes-default" "westnet-eastnet-aes-default" #1: initiating IKEv2 connection | constructing local IKE proposals for westnet-eastnet-aes-default (IKE SA initiator selecting KE) | converting ike_info AES_CBC-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | forcing IKEv2 IKE AES_CBC ENCRYPT transform high-to-low key lengths: 256 128 | ... ikev2_proposal: 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 "westnet-eastnet-aes-default": local IKE proposals (IKE SA initiator selecting KE): "westnet-eastnet-aes-default": 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a78d8(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e1793f28(0->1) (in clone_logger() at log.c:817) | job 1 for #1: ikev2_outI1 KE (build KE and nonce): adding job to queue | state #1 has no .st_event to delete | #1 STATE_PARENT_I0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a4078 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: newref ptr-libevent@0x5634e17a49c8 size 128 | #1 spent 0.146 (0.146) milliseconds in ikev2_parent_outI1() | RESET processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:640) | delref fd@0x5634e17a78d8(4->3) (in whack_handle_cb() at rcv_whack.c:903) | job 1 for #1: ikev2_outI1 KE (build KE and nonce): helper 1 starting job | spent 0.2 (0.203) milliseconds in whack | "westnet-eastnet-aes-default" #1: spent 1.14 (1.17) milliseconds in helper 1 processing job 1 for state #1: ikev2_outI1 KE (pcr) | job 1 for #1: ikev2_outI1 KE (build KE and nonce): helper thread 1 sending result back to state | scheduling resume sending helper answer back to state for #1 | libevent_malloc: newref ptr-libevent@0x7f6aa8006108 size 128 | helper thread 1 has nothing to do | processing resume sending helper answer back to state for #1 | start processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #1 MD (nil) | job 1 for #1: ikev2_outI1 KE (build KE and nonce): processing response from helper 1 | job 1 for #1: ikev2_outI1 KE (build KE and nonce): calling continuation function 0x5634df8f5fe7 | ikev2_parent_outI1_continue() for #1 STATE_PARENT_I0 | DH secret MODP2048@0x7f6aa8006ba8: transferring ownership from helper KE to state #1 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | using existing local IKE proposals for connection westnet-eastnet-aes-default (IKE SA initiator emitting local proposals): 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | Emitting ikev2_proposals ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 12 (0c) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 112 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 116 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | 47 26 e6 1c c7 e9 68 aa 16 1a 12 dc e4 6b 4d 98 | 15 17 ad 51 28 30 0c 70 2f 70 e9 37 f7 d5 55 2c | 97 f0 69 d5 c3 64 4a 2d c2 2c 2e 9a 6d 47 6b a6 | 0d 5a 2e 02 c8 82 f6 1e 25 49 e8 a8 9e b6 85 7e | 0b 5b d7 16 3e ac 6b de d2 ae d3 95 0f 8f 18 d6 | a3 e3 7b 4d 09 3d 0c fc de 40 96 cc cb ca 8a bf | fe e2 a8 89 17 5b 3a 49 cc ed 00 bc 1f 90 94 37 | ab 6d 3a c7 b0 8c 02 2a e8 b8 3e 6e b4 d5 9d 3d | 95 90 bd 20 fe 4a 84 4b e9 1b 96 89 19 0e 14 14 | 84 4f 95 e4 3c e4 fb 55 a2 a3 6b de 7e da 5c 86 | 6b 1d 67 86 d7 dc 97 3f 2c 42 57 4a 54 91 be 9a | c3 e1 35 d3 e2 73 e3 ba 06 ab 5b d1 30 84 1f f8 | 2f 25 e2 de 52 66 17 5b 55 15 e7 bf 55 eb 67 d5 | 12 ec 67 87 56 24 59 65 3e 3d 0c fa 28 65 bf e2 | a7 db bb 0b e1 f1 59 b8 a8 5c 2c ed 53 50 e4 94 | 75 ce 9e 8a 73 1f 74 ba 21 7d 50 21 05 65 36 b8 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | 16 4a e7 68 4d 53 40 d4 0f 36 c3 d8 f3 1b 9f a0 | 33 c3 4c b8 2e 50 3c 36 2d 52 a8 ce 72 60 b2 1a | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 20 69 ce b5 5d 96 95 94 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 57 67 67 3b b3 b8 14 5d ea f3 dc f6 64 93 78 1b | 2c d4 85 4d | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 57 67 67 3b b3 b8 14 5d ea f3 dc f6 64 93 78 1b | 2c d4 85 4d | emitting length of IKEv2 Notify Payload: 28 | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 20 69 ce b5 5d 96 95 94 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 28 0d a5 da f3 32 23 72 66 28 00 40 a1 c2 26 5d | 95 51 1b 4b | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 28 0d a5 da f3 32 23 72 66 28 00 40 a1 c2 26 5d | 95 51 1b 4b | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 522 | [RE]START processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #1 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK | transitioning from state STATE_PARENT_I0 to state STATE_PARENT_I1 | Message ID: updating counters for #1 | Message ID: IKE #1 skipping update_recv as MD is fake | Message ID: IKE #1 scheduling EVENT_RETRANSMIT: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744608.577806 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=0 ike.wip.responder=-1 "westnet-eastnet-aes-default" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a1bb8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: newref ptr-libevent@0x5634e17a6a58 size 128 | #1 STATE_PARENT_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744608.579523 | Message ID: IKE #1 updating initiator sent message request 0: ike.initiator.sent=-1->0 ike.initiator.recv=-1 ike.initiator.last_contact=744608.577806 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=-1->0 ike.wip.responder=-1 | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744608.577806 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=0 ike.wip.responder=-1 | parent state #1: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes-default" #1: sent IKE_SA_INIT request | sending 522 bytes for STATE_PARENT_I0 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 02 0a 22 00 00 74 | 00 00 00 70 01 01 00 0c 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 0c 01 00 00 0c 80 0e 00 80 | 03 00 00 08 02 00 00 02 03 00 00 08 03 00 00 02 | 03 00 00 08 04 00 00 0e 03 00 00 08 04 00 00 0f | 03 00 00 08 04 00 00 10 03 00 00 08 04 00 00 12 | 03 00 00 08 04 00 00 13 03 00 00 08 04 00 00 14 | 03 00 00 08 04 00 00 15 00 00 00 08 04 00 00 1f | 28 00 01 08 00 0e 00 00 47 26 e6 1c c7 e9 68 aa | 16 1a 12 dc e4 6b 4d 98 15 17 ad 51 28 30 0c 70 | 2f 70 e9 37 f7 d5 55 2c 97 f0 69 d5 c3 64 4a 2d | c2 2c 2e 9a 6d 47 6b a6 0d 5a 2e 02 c8 82 f6 1e | 25 49 e8 a8 9e b6 85 7e 0b 5b d7 16 3e ac 6b de | d2 ae d3 95 0f 8f 18 d6 a3 e3 7b 4d 09 3d 0c fc | de 40 96 cc cb ca 8a bf fe e2 a8 89 17 5b 3a 49 | cc ed 00 bc 1f 90 94 37 ab 6d 3a c7 b0 8c 02 2a | e8 b8 3e 6e b4 d5 9d 3d 95 90 bd 20 fe 4a 84 4b | e9 1b 96 89 19 0e 14 14 84 4f 95 e4 3c e4 fb 55 | a2 a3 6b de 7e da 5c 86 6b 1d 67 86 d7 dc 97 3f | 2c 42 57 4a 54 91 be 9a c3 e1 35 d3 e2 73 e3 ba | 06 ab 5b d1 30 84 1f f8 2f 25 e2 de 52 66 17 5b | 55 15 e7 bf 55 eb 67 d5 12 ec 67 87 56 24 59 65 | 3e 3d 0c fa 28 65 bf e2 a7 db bb 0b e1 f1 59 b8 | a8 5c 2c ed 53 50 e4 94 75 ce 9e 8a 73 1f 74 ba | 21 7d 50 21 05 65 36 b8 29 00 00 24 16 4a e7 68 | 4d 53 40 d4 0f 36 c3 d8 f3 1b 9f a0 33 c3 4c b8 | 2e 50 3c 36 2d 52 a8 ce 72 60 b2 1a 29 00 00 08 | 00 00 40 2e 29 00 00 0e 00 00 40 2f 00 02 00 03 | 00 04 29 00 00 1c 00 00 40 04 57 67 67 3b b3 b8 | 14 5d ea f3 dc f6 64 93 78 1b 2c d4 85 4d 00 00 | 00 1c 00 00 40 05 28 0d a5 da f3 32 23 72 66 28 | 00 40 a1 c2 26 5d 95 51 1b 4b | sent 1 messages | checking that a retransmit timeout_event was already | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17a49c8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a4078 | delref logger@0x5634e1793f28(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a78d8(3->2) (in free_logger() at log.c:854) | resume sending helper answer back to state for #1 suppresed complete_v2_state_transition() | delref mdp@NULL (in resume_handler() at server.c:743) | #1 spent 0.526 (0.542) milliseconds in resume sending helper answer back to state | stop processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6aa8006108 | spent 0.00191 (0.00186) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8868(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e1793f28(0->1) (in read_message() at demux.c:103) | *received 454 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 c1 07 d9 3a 38 2b 54 0f bf 30 dc 6a | f6 d7 43 67 7a 4e 42 a7 8e 39 c3 99 ad 52 63 68 | 0f 68 1a 38 18 f0 b9 05 7e a2 d1 f9 62 56 26 a3 | ac 3e b5 6d 96 82 07 0c 06 5d 9c e4 44 05 50 ee | 15 91 9a e3 bf 0b 3a ec 52 f1 a1 40 95 f7 3a b4 | 01 8f 33 a9 fd 54 f5 8d 81 33 b9 28 c0 61 00 a6 | 75 a0 80 03 55 15 1e 96 a1 fc 22 e2 d5 84 56 c5 | e2 52 dc d3 59 18 20 15 5e d1 7a 1d 4a 36 dc 1f | 9a 4d 29 c1 03 cc f2 e5 73 c9 a5 3c 5d 99 82 7d | 2a d6 d6 18 45 a2 7c 86 c6 e1 e4 b9 c1 86 e6 8c | 5b 20 cc 98 7a 4b fa 11 24 bf 22 3e 8e 20 8a 01 | 59 fb c4 90 f7 f7 88 16 0b ad 39 3f f7 96 0a 7b | 70 0f 03 4f b8 6c 70 e7 58 37 1c 1d 4a dd 19 1b | 9e fe 03 4f d4 f3 e5 c3 7b 0b fa 80 2c a9 0f 43 | 8e 1c 5d 58 78 34 cf f9 c4 a2 a1 40 b7 8b 19 6e | d6 f0 be 1a 87 e0 f7 86 52 03 67 47 d0 59 b8 30 | 55 1b ca d3 29 00 00 24 a2 2d e6 66 7d 84 d6 98 | c6 a7 3c 26 88 21 64 fe cf 22 1b 87 c0 a0 e6 53 | 8b df b6 5f a2 b3 93 3f 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 d4 76 4c 14 ef 94 9c 6b be ed | ef 89 00 9d f8 4d fe 3a c2 e6 00 00 00 1c 00 00 | 40 05 0f 70 24 51 38 af 08 12 77 fd 2c 72 bc 27 | 48 76 4c 1e a1 eb | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | length: 454 (00 00 01 c6) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response | State DB: found IKEv2 state #1 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) | #1 is idle | #1 idle | unpacking clear payloads | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SA (len=44) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | looking for message matching transition from STATE_PARENT_I1 | trying received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added | message has errors | trying received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload | message has errors | trying received REDIRECT notify response; resending IKE_SA_INIT request to new destination | message has errors | trying Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | matched unencrypted message | start processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1848) | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | ikev2 parent inR1: calculating g^{xy} in order to send I2 | using existing local IKE proposals for connection westnet-eastnet-aes-default (IKE SA initiator accepting remote proposal): 1:IKE=AES_CBC_256+AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE initiator (accepting) 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 44 (00 2c) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048[first-match] | converting proposal to internal trans attrs | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 20 69 ce b5 5d 96 95 94 | natd_hash: rcookie= | 02 9f 97 23 d7 43 93 9f | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 0f 70 24 51 38 af 08 12 77 fd 2c 72 bc 27 48 76 | 4c 1e a1 eb | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 20 69 ce b5 5d 96 95 94 | natd_hash: rcookie= | 02 9f 97 23 d7 43 93 9f | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | d4 76 4c 14 ef 94 9c 6b be ed ef 89 00 9d f8 4d | fe 3a c2 e6 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f6aa8006ba8: transferring ownership from state #1 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a78d8(2->3) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a4078(0->1) (in clone_logger() at log.c:817) | job 2 for #1: ikev2_inR1outI2 KE (compute dh (V2)): adding job to queue | state #1 has no .st_event to delete | #1 requesting EVENT_RETRANSMIT-pe@0x5634e17a1bb8 be deleted | libevent_free: delref ptr-libevent@0x5634e17a6a58 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a1bb8 | #1 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a6a58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: newref ptr-libevent@0x5634e17a49c8 size 128 | #1 spent 0.168 (0.168) milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE in v2_dispatch() | [RE]START processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #1 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | job 2 for #1: ikev2_inR1outI2 KE (compute dh (V2)): helper 2 starting job | suspending state #1 and saving MD 0x5634e17a8868 | addref md@0x5634e17a8868(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #1 is busy; has suspended MD 0x5634e17a8868 | stop processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1850) | #1 spent 0.43 (0.432) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8868(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.439 (0.442) milliseconds in handle_packet_cb() reading and processing packet | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=32 salt-size=0 | "westnet-eastnet-aes-default" #1: spent 0.72 (0.734) milliseconds in helper 2 processing job 2 for state #1: ikev2_inR1outI2 KE (pcr) | job 2 for #1: ikev2_inR1outI2 KE (compute dh (V2)): helper thread 2 sending result back to state | scheduling resume sending helper answer back to state for #1 | libevent_malloc: newref ptr-libevent@0x7f6aa0002cd8 size 128 | helper thread 2 has nothing to do | processing resume sending helper answer back to state for #1 | start processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #1 MD 0x5634e17a8868 | job 2 for #1: ikev2_inR1outI2 KE (compute dh (V2)): processing response from helper 2 | job 2 for #1: ikev2_inR1outI2 KE (compute dh (V2)): calling continuation function 0x5634df8f5fe7 | ikev2_parent_inR1outI2_continue() for #1 STATE_PARENT_I1: g^{xy} calculated, sending I2 | DH secret MODP2048@0x7f6aa8006ba8: transferring ownership from helper IKEv2 DH to state #1 | State DB: re-hashing IKEv2 state #1 IKE SPIi and SPI[ir] | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 to find private key for @west->@east of kind RSA | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes-default's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a78d8(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a1bb8(0->1) (in clone_logger() at log.c:817) | job 3 for #1: computing responder signature (signature): adding job to queue | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17a49c8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a6a58 | #1 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a49c8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #1 | libevent_malloc: newref ptr-libevent@0x5634e17a1c28 size 128 | [RE]START processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #1 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | suspending state #1 and saving MD 0x5634e17a8868 | job 3 for #1: computing responder signature (signature): helper 3 starting job | addref md@0x5634e17a8868(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #1 is busy; has suspended MD 0x5634e17a8868 | delref logger@0x5634e17a4078(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a78d8(4->3) (in free_logger() at log.c:854) | hash to sign | 60 bb be e0 ab e1 11 65 02 ae bd ce 50 a5 21 cf | 51 ff dc 5f 3e 66 43 4c f5 09 eb 8f ea 20 3e 00 | 35 28 63 60 a9 28 d1 34 03 76 ec ec d2 16 64 10 | 23 aa 35 9f 71 2f 2b 0c 66 b8 f1 8e dc e8 9e 59 | RSA_sign_hash: Started using NSS | resume sending helper answer back to state for #1 suppresed complete_v2_state_transition() | delref mdp@0x5634e17a8868(2->1) (in resume_handler() at server.c:743) | #1 spent 0.128 (0.14) milliseconds in resume sending helper answer back to state | stop processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6aa0002cd8 | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes-default" #1: spent 4.77 (4.8) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes-default" #1: spent 4.8 (4.83) milliseconds in v2_auth_signature() | "westnet-eastnet-aes-default" #1: spent 4.81 (4.84) milliseconds in helper 3 processing job 3 for state #1: computing responder signature (signature) | job 3 for #1: computing responder signature (signature): helper thread 3 sending result back to state | scheduling resume sending helper answer back to state for #1 | libevent_malloc: newref ptr-libevent@0x7f6aa4000d38 size 128 | helper thread 3 has nothing to do | processing resume sending helper answer back to state for #1 | start processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #1 MD 0x5634e17a8868 | job 3 for #1: computing responder signature (signature): processing response from helper 3 | job 3 for #1: computing responder signature (signature): calling continuation function 0x5634df82477f | newref alloc logger@0x5634e17a4078(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a78d8(3->4) (in new_state() at state.c:577) | creating state object #2 at 0x5634e17aa078 | State DB: adding IKEv2 state #2 in UNDEFINED | pstats #2 ikev2.child started | duplicating state object #1 "westnet-eastnet-aes-default" as #2 for IPSEC SA | #2 setting local endpoint to 192.1.2.45:500 from #1.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #1.#2 initializing (CHILD SA): ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744608.577806 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #2: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_I0(ignore) | #2.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #1 switching from IKE SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744608.577806 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=0->-1 ike.wip.responder=-1 | Message ID: CHILD #1.#2 switching to CHILD SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744608.577806 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=-1->0 child.wip.responder=-1 | switching IKEv2 MD.ST from IKE #1 PARENT_I1 to CHILD #2 V2_IKE_AUTH_CHILD_I0 (in ikev2_parent_inR1outI2_auth_signature_continue() at ikev2_parent.c:2155) | state #1 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17a1c28 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a49c8 | #1 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_SA_REPLACE-pe@0x5634e17aad18 | inserting event EVENT_SA_REPLACE, timeout in 120 seconds for #1 | libevent_malloc: newref ptr-libevent@0x7f6aa0002cd8 size 128 | parent state #1: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | IDr payload will be sent | ****emit IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Initiator - Payload | my identity: 77 65 73 74 | emitting length of IKEv2 Identification - Initiator - Payload: 12 | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of their IDr into IKEv2 Identification - Responder - Payload | their IDr: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | not sending INITIAL_CONTACT | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 92 3f 09 4c 8a 65 b4 d6 cc cd 9c 5e bc b6 34 82 | 75 80 c7 86 cd 0b b4 b2 4a 0d de 90 60 d4 96 5c | bc d4 86 0d 9c dd 93 65 79 83 7d 23 ba 5b 8f 31 | 0a 51 05 d1 2f 3c b7 e5 2d c9 33 a8 4a 1a 0c f1 | 56 9d 12 5c 34 9e 1f f7 35 2a f8 04 79 47 35 89 | b0 42 07 26 0e 68 10 36 b8 9b 9f 9b 02 61 87 f3 | a5 de 12 8d ad 31 62 41 0c 40 6b 02 86 86 fc be | cd 13 86 49 38 7d d4 15 d4 43 62 76 7d 6e d7 d7 | 83 a0 70 f3 89 7a cb 73 b9 89 a6 5c 11 bd 2a 87 | c6 eb 19 e9 dc cd 69 08 a3 ec 3c 85 8f f4 57 1d | 87 8b 8e 5a 34 ad d8 5f 67 43 a8 a5 50 1c 4d 4c | 14 4d e3 3f ab 0a f8 b8 fb b3 ef 06 7f b7 e2 54 | d1 e5 5e 7e 1c cd 73 f8 12 3d d2 19 70 9a 11 22 | 23 c5 31 94 28 2d a8 43 6a 08 8c 30 c0 7a 84 ea | 81 1a df 3e d8 39 2d e3 74 75 cb a0 05 05 a1 ba | 31 c3 00 43 e9 0f d9 34 07 9e fb 5a 15 df 18 cf | 24 58 32 23 d7 80 84 52 17 d2 7f 88 ea c6 97 20 | 2e 66 | emitting length of IKEv2 Authentication Payload: 350 | getting first pending from state #1 | delref fd@0x5634e17a78d8(4->3) (in first_pending() at pending.c:318) | addref fd@0x5634e17a78d8(3->4) (in first_pending() at pending.c:319) | netlink_get_spi: allocated 0xd04a7101 for esp.0@192.1.2.45 | constructing ESP/AH proposals with all DH removed for westnet-eastnet-aes-default (IKE SA initiator emitting ESP/AH proposals) | converting proposal AES_CBC-HMAC_SHA1_96 to ikev2 ... | forcing IKEv2 ESP AES_CBC ENCRYPT transform low-to-high key lengths: 128 256 | ... ikev2_proposal: 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED "westnet-eastnet-aes-default": local ESP/AH proposals (IKE SA initiator emitting ESP/AH proposals): "westnet-eastnet-aes-default": 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | Emitting ikev2_proposals ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discard DH=NONE when counting transforms (multiple 0; allow single 0) | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 4 (04) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: d0 4a 71 01 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discard DH=NONE when emitting proposal (multiple 0; allow single 0) | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 52 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 56 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | adding 2 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 512 | emitting length of ISAKMP Message: 540 | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 540 (00 00 02 1c) | **parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 512 (02 00) | opening output PBS reply frag packet | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 16 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 478 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment: | 24 00 00 0c 02 00 00 00 77 65 73 74 27 00 00 0c | 02 00 00 00 65 61 73 74 21 00 01 5e 0e 00 00 00 | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 92 3f 09 4c 8a 65 b4 d6 cc cd 9c 5e | bc b6 34 82 75 80 c7 86 cd 0b b4 b2 4a 0d de 90 | 60 d4 96 5c bc d4 86 0d 9c dd 93 65 79 83 7d 23 | ba 5b 8f 31 0a 51 05 d1 2f 3c b7 e5 2d c9 33 a8 | 4a 1a 0c f1 56 9d 12 5c 34 9e 1f f7 35 2a f8 04 | 79 47 35 89 b0 42 07 26 0e 68 10 36 b8 9b 9f 9b | 02 61 87 f3 a5 de 12 8d ad 31 62 41 0c 40 6b 02 | 86 86 fc be cd 13 86 49 38 7d d4 15 d4 43 62 76 | 7d 6e d7 d7 83 a0 70 f3 89 7a cb 73 b9 89 a6 5c | 11 bd 2a 87 c6 eb 19 e9 dc cd 69 08 a3 ec 3c 85 | 8f f4 57 1d 87 8b 8e 5a 34 ad d8 5f 67 43 a8 a5 | 50 1c 4d 4c 14 4d e3 3f ab 0a f8 b8 fb b3 ef 06 | 7f b7 e2 54 d1 e5 5e 7e 1c cd 73 f8 12 3d d2 19 | 70 9a 11 22 23 c5 31 94 28 2d a8 43 6a 08 8c 30 | c0 7a 84 ea 81 1a df 3e d8 39 2d e3 74 75 cb a0 | 05 05 a1 ba 31 c3 00 43 e9 0f d9 34 07 9e fb 5a | 15 df 18 cf 24 58 32 23 d7 80 84 52 17 d2 7f 88 | ea c6 97 20 2e 66 2c 00 00 38 00 00 00 34 01 03 | 04 04 d0 4a 71 01 03 00 00 0c 01 00 00 0c 80 0e | 00 80 03 00 00 0c 01 00 00 0c 80 0e 01 00 03 00 | 00 08 03 00 00 02 00 00 00 08 05 00 00 00 2d 00 | 00 18 01 00 00 00 07 00 00 10 00 00 ff ff c0 00 | 01 00 c0 00 01 ff 00 00 00 18 01 00 00 00 07 00 | 00 10 00 00 ff ff c0 00 02 00 c0 00 02 ff | adding 2 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 516 | emitting length of ISAKMP Message: 544 | recording fragment 1 | delref logger@0x5634e17a1bb8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a78d8(4->3) (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #1 switched MD.ST to #2 | suspend processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #2 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #2 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_I0 PARENT_I1->PARENT_I2 with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I1 to state STATE_PARENT_I2 | Message ID: updating counters for #2 | Message ID: CHILD #1.#2 XXX: no EVENT_RETRANSMIT to clear; suspect IKE->CHILD switch: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744608.577806 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: CHILD #1.#2 updating initiator received message response 0: ike.initiator.sent=0 ike.initiator.recv=-1->0 ike.initiator.last_contact=744608.577806->744608.58868 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=0->-1 child.wip.responder=-1 | Message ID: CHILD #1.#2 scheduling EVENT_RETRANSMIT: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744608.58868 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=1 child.wip.responder=-1 "westnet-eastnet-aes-default" #2: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a1bb8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #2 | libevent_malloc: newref ptr-libevent@0x5634e17a1c28 size 128 | #2 STATE_V2_IKE_AUTH_CHILD_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744608.5887 | Message ID: CHILD #1.#2 updating initiator sent message request 1: ike.initiator.sent=0->1 ike.initiator.recv=0 ike.initiator.last_contact=744608.58868 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=-1->1 child.wip.responder=-1 | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744608.58868 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #2: V2_IKE_AUTH_CHILD_I0(ignore) => PARENT_I2(open IKE SA) | announcing the state transition "westnet-eastnet-aes-default" #1: sent IKE_AUTH request {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 544 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 79 94 eb 15 5c 6c df a2 76 70 62 42 | 8e 3d 1f b3 e2 7f a1 09 0e 6d 29 4a fc 1a 0a 1d | 7d 8b ef 38 ac 51 90 f7 8e d5 ee 86 8d d0 23 63 | d1 ca 18 26 f6 22 78 c9 ad 05 aa 18 01 8b 10 88 | c0 08 02 66 54 e9 ac b3 c7 70 36 67 75 a1 9b 02 | 4c a7 25 1c 3c b6 f0 83 1c a9 74 c8 b2 13 c3 3b | 0c 28 f6 65 e5 d2 0e 6d 0c a8 1d 6d 04 69 f2 69 | 1f 4d f4 fd 3f 06 89 38 7b 5a f5 7e 86 75 a2 45 | f1 a2 59 49 59 ae ad e1 c5 2a 3d ab e9 27 33 fd | c0 68 35 c2 31 f6 57 0a cd 89 ad 86 5f e2 04 09 | 52 f9 b1 1e 4d 1f 85 e3 10 e1 eb 4e a3 3c 80 dd | 96 cf 37 13 38 21 c2 cb 8d 45 24 04 fb bd 00 cf | e9 dd aa 24 7c 70 e3 6a 6d 74 18 3f 1b 09 b2 5e | 9d 1b b9 30 c7 cf ee 3f 3a dd 7d d5 ae 82 e4 05 | f2 07 d7 03 17 a3 4f 59 fa 47 1f 5e 81 5e 4b dd | fc fd 57 74 46 a3 9e cd db 3f fb e8 a9 cc b1 0e | 35 d2 b4 2a 0c 4a 38 19 42 3c 57 26 21 20 21 5c | 0c 95 87 76 9b 51 c5 c4 d6 8c 88 3d 09 05 71 a4 | 04 29 c0 46 86 62 51 0d 3d 5b ed dc ab ed fb eb | 3c 02 e1 43 29 98 38 83 04 6b 54 e2 56 37 05 c7 | eb 78 0d d9 18 ca 4e 1a 24 06 14 99 9f bd 24 2e | 22 21 b4 eb 4f 3d 6c c7 4e 90 22 b8 2f c0 89 d9 | 75 01 07 f9 07 2d 58 87 f4 47 8b b1 d1 e7 d1 64 | 5a 49 fb b7 f6 29 8c dd cf 0c 1e 56 8c 77 77 d2 | 65 b3 e5 37 ce 78 54 dd 0c bc 4b 3f b0 be 87 31 | fd 5e 35 f5 57 98 a8 02 8e de ad 13 25 09 15 28 | 30 3a 04 3b 25 59 7b 8f 0d 23 02 53 49 88 b5 01 | 85 5c 34 55 c0 be 95 83 d4 4b db 22 01 de 89 4c | 5c e8 82 38 3c 5b 55 c3 2a 71 3c 66 4c ac 44 29 | 88 87 3a d0 38 b6 7f 74 9c 72 74 2d dc 90 7d c4 | 1e 0a 61 b8 9f c6 9e 4b 4a 80 2f 78 c8 49 a8 ac | 5b 1d 37 b7 72 b6 8d 18 01 da 75 0a d3 5e ea b0 | sent 1 messages | checking that a retransmit timeout_event was already | state #2 has no .st_event to delete | delref mdp@0x5634e17a8868(1->0) (in resume_handler() at server.c:743) | delref logger@0x5634e1793f28(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #1 spent 0.649 (0.667) milliseconds in resume sending helper answer back to state | stop processing: state #2 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6aa4000d38 | spent 0.00223 (0.00221) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8868(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a49c8(0->1) (in read_message() at demux.c:103) | *received 524 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | 94 08 00 37 6d 25 0c 92 04 53 57 ce b7 5f 35 6d | 30 ee d0 d7 f0 ef 8a 72 af c5 bc 53 0a aa 67 b8 | c5 ad 3d ae 49 50 59 ba be 7a 6f c8 67 e5 e2 fa | ac dc 33 68 4d 4f b1 f2 6c 36 4b 50 46 0e 0a 92 | 32 c1 8f 52 d7 0c c5 00 13 d5 ef 9a 14 55 a8 d8 | 9d 03 d0 3f 99 eb af 29 32 c8 01 2d f4 f3 76 16 | c9 af e9 0e 4e 86 f0 6c 61 5d 80 be 67 43 87 a3 | da 2b de d0 38 ce 00 d8 fd 54 65 fd b5 9e b5 2c | c2 90 11 89 f3 4e 7a d7 9d 1d e1 c3 f3 5d 0d c6 | 1b c4 10 b7 fc fb 3e 57 d1 dd 18 b9 72 9d d9 e1 | d7 d2 fc fd 61 61 fb 96 77 14 b9 ac 62 9e 75 9c | 23 41 6b e4 bd ae 45 61 31 39 de ae b5 34 14 ff | 65 f6 3d 17 9b b1 b1 cd 4c 86 0e d9 4c 71 c6 41 | 23 71 43 6d 6c fb e8 c9 f6 e3 12 91 36 14 00 6a | d3 70 cf c5 e6 fe 51 cf 30 3d 46 fa 79 89 96 33 | 97 ce e7 d5 c1 36 09 ea 93 4d 9b 07 6f 33 b9 4b | 01 1f 18 53 f4 d7 17 dc 3a 91 9d 00 c5 9a 4f f9 | 90 be 42 8b 73 94 51 e7 2e e3 9a 1f 83 70 de 5b | 41 0b b9 d2 1f 1c 83 ee eb 0e 24 ee d6 4e 5a 22 | 1c 34 2d 85 08 4f ce a8 df b4 22 20 d2 f7 2d 36 | 14 7f 6f eb 4c 55 09 78 53 92 cd 6d 7e 74 fd fb | fb cf b9 06 e2 46 eb 30 88 52 b7 f7 a2 99 a0 cb | 65 bb 96 96 b0 da 15 cc e8 36 c3 88 61 18 ca f3 | 36 6a 49 c1 89 15 f6 10 16 2e f4 df 5f 99 d8 75 | c4 53 14 89 50 86 a0 06 c6 8b da 6f 2d c2 d2 87 | fe 3c e5 6c 35 24 23 d8 70 41 fe 37 96 ab 45 e4 | c0 ab 5e 39 68 73 5d 72 1d 14 2b f8 b9 58 43 76 | e5 dc e4 ef 89 b0 cc a5 3e 8e 47 e3 58 32 67 0c | c6 4a 5f 34 85 5d 53 9d 70 b9 2b 18 0b 85 f6 02 | 82 27 f2 b8 9c 69 7f f8 12 c7 96 9e 48 44 3c 46 | e6 c0 61 4c e5 cf 16 fb 6a d1 fe ac | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | length: 524 (00 00 02 0c) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #1 in PARENT_I2 (find_v2_ike_sa) | start processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) | State DB: found IKEv2 state #2 in PARENT_I2 (find_v2_sa_by_initiator_wip) | #2 is idle | #2 idle | suspend processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | start processing: state #2 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 496 (01 f0) | processing payload: ISAKMP_NEXT_v2SK (len=492) | #2 in state PARENT_I2: sent IKE_AUTH request | authenticator matched | #1 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Initiator: process IKE_AUTH response | calling processor Initiator: process IKE_AUTH response | no certs to decode | offered CA: '%none' "westnet-eastnet-aes-default" #2: IKEv2 mode peer ID is ID_FQDN: '@east' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @east | trying all preloaded keys public keys for RSA key that matches ID: @east | trying '@east' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | 03 47 07 5a ea 36 2e 5e 2d 0d 30 33 5f 21 09 f5 | 22 41 0a 9f 4d fc f7 f2 c7 f9 ee d8 9a e6 98 09 | ab 08 d0 ba 3d e3 09 40 a2 81 ee 90 14 a6 d6 ce | 36 1e 00 95 11 e4 25 e1 b6 51 c1 b7 1e 8a f9 fc | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x5634e17a6848(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQO9bJbr3 [preloaded keys] | #1 spent 0.101 (0.101) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes-default" #1: authenticated using RSA with SHA2_512 | #1 spent 0.14 (0.14) milliseconds in ikev2_verify_rsa_hash() | parent state #1: PARENT_I2(open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #1 will start re-keying in 2607 seconds with margin of 993 seconds (attempting re-key) | state #1 deleting .st_event EVENT_SA_REPLACE | libevent_free: delref ptr-libevent@0x7f6aa0002cd8 | free_event_entry: delref EVENT_SA_REPLACE-pe@0x5634e17aad18 | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e1793f28 | inserting event EVENT_SA_REKEY, timeout in 2607 seconds for #1 | libevent_malloc: newref ptr-libevent@0x7f6aa4000d38 size 128 | pstats #1 ikev2.ike established | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | evaluating our conn="westnet-eastnet-aes-default" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found an acceptable TSi/TSr Traffic Selector | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | using existing local ESP/AH proposals for westnet-eastnet-aes-default (IKE_AUTH initiator accepting remote ESP/AH proposal): 1:ESP=AES_CBC_128+AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH initiator accepting remote ESP/AH proposal 1 local proposals | local proposal 1 type ENCR has 2 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | 1d 9b 75 af | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH initiator accepting remote ESP/AH proposal ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=1d9b75af | converting proposal to internal trans attrs | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=36 | install_ipsec_sa() for #2: inbound and outbound | could_route called for westnet-eastnet-aes-default; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-default mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-default mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-default" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-default' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.1d9b75af@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-default' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16389 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.d04a7101@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes-default" is 2084814 (0x1fcfce) | add inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.10000@192.1.2.45 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #2: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-default mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-default mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-default" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-aes-default (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #2 | priority calculation of connection "westnet-eastnet-aes-default" is 2084814 (0x1fcfce) | eroute_connection add eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23 using reqid 16389 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.1d9b75af@192.1.2.23 | get_sa_info esp.d04a7101@192.1.2.45 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CON... | popen cmd is 1148 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=': | cmd( 160):' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY: | cmd( 240):_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255: | cmd( 320):.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO: | cmd( 400):_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT=': | cmd( 480):192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.: | cmd( 560):255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK=: | cmd( 640):'xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL: | cmd( 720):+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMA: | cmd( 800):NENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_: | cmd( 880):PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER: | cmd( 960):='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYT: | cmd(1040):ES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x1d9b75af SPI_OUT=0: | cmd(1120):xd04a7101 ipsec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | get_sa_info esp.1d9b75af@192.1.2.23 | get_sa_info esp.d04a7101@192.1.2.45 | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PL... | popen cmd is 1153 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_RO: | cmd( 160):UTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLU: | cmd( 240):TO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK: | cmd( 320):='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' : | cmd( 400):PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLI: | cmd( 480):ENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255: | cmd( 560):.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_S: | cmd( 640):TACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+T: | cmd( 720):UNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_: | cmd( 800):PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' P: | cmd( 880):LUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_S: | cmd( 960):ERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_O: | cmd(1040):UTBYTES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x1d9b75af SPI_: | cmd(1120):OUT=0xd04a7101 ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | get_sa_info esp.1d9b75af@192.1.2.23 | get_sa_info esp.d04a7101@192.1.2.45 | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_... | popen cmd is 1151 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):aes-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUT: | cmd( 160):E='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO: | cmd( 240):_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK=': | cmd( 320):255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PL: | cmd( 400):UTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIEN: | cmd( 480):T='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.2: | cmd( 560):55.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STA: | cmd( 640):CK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUN: | cmd( 720):NEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PE: | cmd( 800):RMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLU: | cmd( 880):TO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SER: | cmd( 960):VER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUT: | cmd(1040):BYTES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x1d9b75af SPI_OU: | cmd(1120):T=0xd04a7101 ipsec _updown 2>&1: "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-default" #2: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "westnet-eastnet-aes-default", setting eroute_owner {spd=0x5634e17a1f28,sr=0x5634e17a1f28} to #2 (was #0) (newest_ipsec_sa=#0) | inR2: instance westnet-eastnet-aes-default[0], setting IKEv2 newest_ipsec_sa to #2 (was #0) (spd.eroute=#2) cloned from #1 | #2 spent 1.81 (48) milliseconds in processing: Initiator: process IKE_AUTH response in v2_dispatch() | [RE]START processing: state #2 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #2 complete_v2_state_transition() PARENT_I2->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I2 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #2 | Message ID: CHILD #1.#2 clearing EVENT_RETRANSMIT as response received: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744608.58868 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=-1 child.wip.responder=-1 | #2 requesting EVENT_RETRANSMIT-pe@0x5634e17a1bb8 be deleted | libevent_free: delref ptr-libevent@0x5634e17a1c28 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a1bb8 | #2 STATE_PARENT_I2: retransmits: cleared | Message ID: CHILD #1.#2 updating initiator received message response 1: ike.initiator.sent=1 ike.initiator.recv=0->1 ike.initiator.last_contact=744608.58868->744608.677716 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=1->-1 child.wip.responder=-1 | Message ID: CHILD #1.#2 skipping update_send as nothing to send: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744608.677716 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #1 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744608.677716 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #2: PARENT_I2(open IKE SA) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #2 ikev2.child established | announcing the state transition "westnet-eastnet-aes-default" #2: negotiated connection [192.0.1.0-192.0.1.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes-default" #2: IPsec SA established tunnel mode {ESP=>0x1d9b75af <0xd04a7101 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | releasing #2's fd-fd@0x5634e17a78d8 because IKEv2 transitions finished | delref fd@0x5634e17a78d8(3->2) (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #2's IKE SA #1 | unpending state #1 connection "westnet-eastnet-aes-default" | delete from pending Child SA with 192.1.2.23 "westnet-eastnet-aes-default" | delref fd@0x5634e17a78d8(2->1) (in delete_pending() at pending.c:218) | removing pending policy for no connection {0x5634e17a7918} | releasing #1's fd-fd@0x5634e17a78d8 because IKEv2 transitions finished so releaseing IKE SA | delref fd@0x5634e17a78d8(1->0) (in success_v2_state_transition() at ikev2.c:3222) | freeref fd-fd@0x5634e17a78d8 (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #2 will start re-keying in 28048 seconds with margin of 752 seconds (attempting re-key) | state #2 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17a1c28 | inserting event EVENT_SA_REKEY, timeout in 28048 seconds for #2 | libevent_malloc: newref ptr-libevent@0x5634e17ab658 size 128 | stop processing: state #2 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) | #1 spent 1.77 (48) milliseconds | #1 spent 2.26 (48.5) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8868(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17a49c8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 2.28 (48.5) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00421 (0.00415) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00278 (0.00278) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00273 (0.00273) milliseconds in signal handler PLUTO_SIGCHLD | newref struct fd@0x5634e17a78d8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a78d8 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-default' | FOR_EACH_CONNECTION_... in conn_by_name "westnet-eastnet-aes-default": terminating SAs using this connection | connection 'westnet-eastnet-aes-default' -POLICY_UP | FOR_EACH_STATE_... in shared_phase1_connection | connection not shared - terminating IKE and IPsec SA | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #2 | start processing: state #2 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a78d8(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #2 ikev2.child deleted completed | #2 main thread spent 1.81 (48) milliseconds helper thread spent 0 (0) milliseconds in total | [RE]START processing: state #2 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-default" #2: deleting state (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.156016s and sending notification | child state #2: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.1d9b75af@192.1.2.23 | get_sa_info esp.d04a7101@192.1.2.45 "westnet-eastnet-aes-default" #2: ESP traffic information: in=0B out=0B | unsuspending #2 MD (nil) | should_send_delete: yes | #2 send IKEv2 delete notification for STATE_V2_ESTABLISHED_CHILD_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting 4 raw bytes of local spis into IKEv2 Delete Payload | local spis: d0 4a 71 01 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | 48 1e 62 13 0e 91 cb 3e 00 00 a3 12 d5 2d 23 ab | cb d7 e8 2b f7 43 5c 8b 44 f3 ac 4f ee 1d ab 8f | 3c 39 5a da 17 6f 66 31 f8 13 9c c2 | sent 1 messages | Message ID: IKE #1 sender #2 in send_delete hacking around record 'n' send | Message ID: IKE #1 scheduling EVENT_RETRANSMIT: ike.initiator.sent=2 ike.initiator.recv=1 ike.initiator.last_contact=744608.677716 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=2 ike.wip.responder=-1 "westnet-eastnet-aes-default" #1: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a49c8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #1 | libevent_malloc: newref ptr-libevent@0x5634e17ab908 size 128 | #1 STATE_V2_ESTABLISHED_IKE_SA: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744608.744481 | Message ID: IKE #1 updating initiator sent message request 2: ike.initiator.sent=1->2 ike.initiator.recv=1 ike.initiator.last_contact=744608.677716 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=-1->2 ike.wip.responder=-1 | state #2 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x5634e17ab658 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17a1c28 | #2 STATE_V2_ESTABLISHED_CHILD_SA: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.1d9b75af@192.1.2.23 | get_sa_info esp.d04a7101@192.1.2.45 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CO... | popen cmd is 1147 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE: | cmd( 160):='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_: | cmd( 240):MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='2: | cmd( 320):55.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLU: | cmd( 400):TO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT: | cmd( 480):='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.25: | cmd( 560):5.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STAC: | cmd( 640):K='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNN: | cmd( 720):EL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMAN: | cmd( 800):ENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_P: | cmd( 880):EER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER=: | cmd( 960):'0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTE: | cmd(1040):S='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x1d9b75af SPI_OUT=0x: | cmd(1120):d04a7101 ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes-default' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-default" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.1d9b75af@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.1d9b75af@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-aes-default" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => unk.10000@192.1.2.45 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.d04a7101@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.d04a7101@192.1.2.45 included non-error error | in connection_discard for connection westnet-eastnet-aes-default | State DB: deleting IKEv2 state #2 in ESTABLISHED_CHILD_SA | child state #2: ESTABLISHED_CHILD_SA(established CHILD SA) => UNDEFINED(ignore) | releasing #2's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a78d8(2->1) (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #2 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e17a4078(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | state #1 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #1 | start processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a78d8(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #1 ikev2.ike deleted completed | #1 main thread spent 4.14 (50.4) milliseconds helper thread spent 6.67 (6.75) milliseconds in total | [RE]START processing: state #1 connection "westnet-eastnet-aes-default" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-default" #1: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.17973s and sending notification | parent state #1: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #1 MD (nil) | should_send_delete: yes | #1 send IKEv2 delete notification for STATE_V2_ESTABLISHED_IKE_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting length of IKEv2 Delete Payload: 8 | adding 8 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #1) | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | 3d f5 4d de ae 6e ce db 68 5c e2 f2 d2 2f 73 77 | ef 35 f9 15 43 d9 9d 4f dd 56 30 dc e3 b2 47 4c | d5 f7 b6 da f7 54 7e 3d 65 b1 c5 05 | sent 1 messages | Message ID: IKE #1 sender #1 in send_delete hacking around record 'n' send | Message ID: IKE #1 XXX: expecting sender.wip.initiator 2 == -1 - suspect record'n'send out-of-order?): ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744608.677716 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #1 XXX: EVENT_RETRANSMIT already scheduled -- suspect record'n'send: ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744608.677716 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #1 updating initiator sent message request 3: ike.initiator.sent=2->3 ike.initiator.recv=1 ike.initiator.last_contact=744608.677716 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744608.577806 ike.wip.initiator=2->3 ike.wip.responder=-1 | state #1 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f6aa4000d38 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e1793f28 | #1 requesting EVENT_RETRANSMIT-pe@0x5634e17a49c8 be deleted | libevent_free: delref ptr-libevent@0x5634e17ab908 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a49c8 | #1 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes-default | State DB: deleting IKEv2 state #1 in ESTABLISHED_IKE_SA | parent state #1: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #1's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a78d8(2->1) (in delete_state() at state.c:1195) | delref pkp@0x5634e17a6848(2->1) (in delete_state() at state.c:1202) | stop processing: state #1 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e1794058(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | FOR_EACH_CONNECTION_... in conn_by_name | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-aes-default' to 'delete' for rt_kind 'unrouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-default" is 2084814 (0x1fcfce) | priority calculation of connection "westnet-eastnet-aes-default" is 2084814 (0x1fcfce) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-default mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-default mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-default" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONF... | popen cmd is 1091 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-default' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_RO: | cmd( 160):UTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLU: | cmd( 240):TO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK: | cmd( 320):='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' : | cmd( 400):PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CL: | cmd( 480):IENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='25: | cmd( 560):5.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_: | cmd( 640):STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PF: | cmd( 720):S+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' : | cmd( 800):PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_D: | cmd( 880):NS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' P: | cmd( 960):LUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SH: | cmd(1040):ARED='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1: unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. | addref fd@0x5634e17a78d8(1->2) (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a1bb8(0->1) (in clone_logger() at log.c:817) | delref hp@0x5634e17a75b8(1->0) (in delete_oriented_hp() at hostpair.c:360) | flush revival: connection 'westnet-eastnet-aes-default' wasn't on the list | delref vip@NULL (in discard_connection() at connections.c:262) | delref vip@NULL (in discard_connection() at connections.c:263) | Connection DB: deleting connection $1 | delref logger@0x5634e17a1bb8(1->0) (in delete_connection() at connections.c:214) | delref fd@0x5634e17a78d8(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | FOR_EACH_CONNECTION_... in conn_by_name | delref fd@0x5634e17a78d8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a78d8 (in whack_handle_cb() at rcv_whack.c:903) | spent 1.59 (44) milliseconds in whack | spent 0.00204 (0.00208) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a1bb8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 32 92 35 0f e3 77 3d 08 3f 55 38 04 e0 19 42 78 | 0c 7a 14 1e 7a 57 c1 44 2c 67 3a 4b 44 49 14 b3 | cb ac 35 42 76 6d 2e fc 6c d5 a7 44 | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17a1bb8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.105 (0.105) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00752 (0.00781) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00279 (0.00276) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00167 (0.00168) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a1bb8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 32 92 35 0f e3 77 3d 08 3f 55 38 04 e0 19 42 78 | 0c 7a 14 1e 7a 57 c1 44 2c 67 3a 4b 44 49 14 b3 | cb ac 35 42 76 6d 2e fc 6c d5 a7 44 | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17a1bb8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0877 (0.0879) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00176 (0.00178) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a1bb8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 20 69 ce b5 5d 96 95 94 02 9f 97 23 d7 43 93 9f | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | 68 09 04 db af b5 68 26 51 ae 5f 2a 58 ba ce 93 | b9 b2 c5 e7 1a f7 d3 41 5a 18 a0 9d 3b c9 98 8d | d0 37 6f dc 25 62 6e af b0 60 0d d7 | **parse ISAKMP Message: | initiator SPI: 20 69 ce b5 5d 96 95 94 | responder SPI: 02 9f 97 23 d7 43 93 9f | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17a1bb8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0751 (0.0753) milliseconds in handle_packet_cb() reading and processing packet | newref struct fd@0x5634e17a78d8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a78d8 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-128' | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | whack: connection 'westnet-eastnet-aes-128' | addref fd@0x5634e17a78d8(1->2) (in string_logger() at log.c:838) | newref string logger@0x5634e17a1bb8(0->1) (in add_connection() at connections.c:1998) | Connection DB: adding connection "westnet-eastnet-aes-128" $2 | FOR_EACH_CONNECTION_... in conn_by_name | added new connection westnet-eastnet-aes-128 with policy RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | ike (phase1) algorithm values: AES_CBC_128-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp=aes128-sha1 | ESP/AH string values: AES_CBC_128-HMAC_SHA1_96 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | saving left CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.00819 (0.00725) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | counting wild cards for @west is 0 | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | saving right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | spent 0.0898 (0.0943) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key matching right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1: can't find the private key matching the NSS CKAID | counting wild cards for @east is 0 | updating connection from left.host_addr | left host_port 500 | updating connection from right.host_addr | right host_port 500 | orienting westnet-eastnet-aes-128 | westnet-eastnet-aes-128 doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-128 doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-128 doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-128 doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-128 doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-128's this | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | newref hp@0x5634e17a75b8(0->1) (in connect_to_host_pair() at hostpair.c:290) added IKEv2 connection "westnet-eastnet-aes-128" | ike_life: 3600; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | 192.0.1.0/24===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.0/24 | delref logger@0x5634e17a1bb8(1->0) (in add_connection() at connections.c:2026) | delref fd@0x5634e17a78d8(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | delref fd@0x5634e17a78d8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a78d8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.499 (0.506) milliseconds in whack | newref struct fd@0x5634e17a44e8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a44e8 (in whack_handle_cb() at rcv_whack.c:869) | whack: key | delref pkp@0x5634e17a7708(1->0) (in free_public_keyentry() at secrets.c:1591) add keyid @west | 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | 15 04 37 f9 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | newref struct pubkey@0x5634e17a7708(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17a7708(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17a7708(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.00876 (0.00866) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | delref fd@0x5634e17a44e8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a44e8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.15 (0.15) milliseconds in whack | newref struct fd@0x5634e17a1c78(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a1c78 (in whack_handle_cb() at rcv_whack.c:869) | whack: key | delref pkp@0x5634e17a6848(1->0) (in free_public_keyentry() at secrets.c:1591) add keyid @east | 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | 51 51 48 ef | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | newref struct pubkey@0x5634e17a6848(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17a6848(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17a6848(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | spent 0.053 (0.0529) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key: can't find the private key matching the NSS CKAID | delref fd@0x5634e17a1c78(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a1c78 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.193 (0.197) milliseconds in whack | newref struct fd@0x5634e17a1c78(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a1c78 (in whack_handle_cb() at rcv_whack.c:869) | whack: initiate | FOR_EACH_CONNECTION_... in conn_by_name | connection 'westnet-eastnet-aes-128' +POLICY_UP | FOR_EACH_STATE_... in find_phase1_state | newref alloc logger@0x5634e17a49c8(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a1c78(1->2) (in new_state() at state.c:577) | creating state object #3 at 0x5634e17a7bc8 | State DB: adding IKEv2 state #3 in UNDEFINED | pstats #3 ikev2.ike started | parent state #3: UNDEFINED(ignore) => PARENT_I0(ignore) | #3.st_v2_transition NULL -> PARENT_I0->PARENT_I1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #3 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744609.030194 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744609.030194 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes-128 | westnet-eastnet-aes-128 doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-128 doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-128 doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-128 doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-128 doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-128's this | start processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:544) | addref fd@0x5634e17a1c78(2->3) (in add_pending() at pending.c:86) | queuing pending IPsec SA negotiating with 192.1.2.23 IKE SA #3 "westnet-eastnet-aes-128" "westnet-eastnet-aes-128" #3: initiating IKEv2 connection | constructing local IKE proposals for westnet-eastnet-aes-128 (IKE SA initiator selecting KE) | converting ike_info AES_CBC_128-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 "westnet-eastnet-aes-128": local IKE proposals (IKE SA initiator selecting KE): "westnet-eastnet-aes-128": 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a1c78(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a6a58(0->1) (in clone_logger() at log.c:817) | job 4 for #3: ikev2_outI1 KE (build KE and nonce): adding job to queue | state #3 has no .st_event to delete | #3 STATE_PARENT_I0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17ab8a8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: newref ptr-libevent@0x5634e17ab658 size 128 | #3 spent 0.163 (0.163) milliseconds in ikev2_parent_outI1() | RESET processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:640) | delref fd@0x5634e17a1c78(4->3) (in whack_handle_cb() at rcv_whack.c:903) | job 4 for #3: ikev2_outI1 KE (build KE and nonce): helper 4 starting job | spent 0.221 (0.22) milliseconds in whack | "westnet-eastnet-aes-128" #3: spent 1.93 (1.96) milliseconds in helper 4 processing job 4 for state #3: ikev2_outI1 KE (pcr) | job 4 for #3: ikev2_outI1 KE (build KE and nonce): helper thread 4 sending result back to state | scheduling resume sending helper answer back to state for #3 | libevent_malloc: newref ptr-libevent@0x7f6a98006108 size 128 | helper thread 4 has nothing to do | processing resume sending helper answer back to state for #3 | start processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #3 MD (nil) | job 4 for #3: ikev2_outI1 KE (build KE and nonce): processing response from helper 4 | job 4 for #3: ikev2_outI1 KE (build KE and nonce): calling continuation function 0x5634df8f5fe7 | ikev2_parent_outI1_continue() for #3 STATE_PARENT_I0 | DH secret MODP2048@0x7f6a98006ba8: transferring ownership from helper KE to state #3 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | using existing local IKE proposals for connection westnet-eastnet-aes-128 (IKE SA initiator emitting local proposals): 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | Emitting ikev2_proposals ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 11 (0b) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 104 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | fa a3 19 71 3d 23 bf eb 49 de 15 8c 2f 8b 23 a1 | 41 0e fd a3 82 f9 75 ad 9f 8d 31 59 f7 a4 be 59 | a6 16 89 5b 01 f5 a3 3c 11 cd 2d 51 5a c6 6f 76 | f7 ea 3b 84 f3 82 72 1f bb 53 c9 0d 96 8b e4 ba | 83 ab ae 7e a1 cb d1 6e d0 24 cc f9 23 d8 db 9d | 8b 6c 29 a3 2e f4 40 7d 76 15 06 62 45 ea 92 58 | a7 4c 6b 48 68 70 4f d2 d6 ac e9 2c 10 b8 0e 9a | da 7c da d0 16 08 cc fc 2e f9 70 bd 99 26 e1 b1 | ba 7c 64 fa ea 0d 70 e8 fa 3b bc 4a ab 18 d7 b8 | b3 7e b5 e8 96 f5 9f 65 d6 78 b8 47 6d ed a0 3a | 19 31 e7 5a b9 6f 9d a2 76 3d 42 7a 94 e9 9b 51 | eb c2 bf d8 14 b6 5f 6e b8 cc a9 12 cc 05 b2 e5 | 21 e7 c8 51 b3 21 1c 78 26 11 6c d2 0e 9e e8 ef | d7 3a c0 76 14 04 3c 5a 6d b9 6f 7c 0f 17 0d 76 | a6 62 7d b5 d0 ab 0d 6c f0 d6 a4 46 62 e2 72 ed | b1 92 3f f1 f4 01 51 c3 6f fe f0 74 d2 ec a8 7f | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | 54 78 e2 31 c2 bd 34 df 8b 94 6a e9 98 b4 00 10 | d4 39 1b c9 1f 44 ab e4 8d f4 94 4f 56 03 aa 0c | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 6a c3 f8 a0 76 2a 06 5c | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | b4 e1 ed ef ab c0 04 2d 36 d2 68 ad 9d 1c 27 5c | 38 e7 03 1f | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | b4 e1 ed ef ab c0 04 2d 36 d2 68 ad 9d 1c 27 5c | 38 e7 03 1f | emitting length of IKEv2 Notify Payload: 28 | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 6a c3 f8 a0 76 2a 06 5c | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 27 bb 2f d0 ae 59 be 68 5b cd f1 98 e5 d2 4a 7a | 36 7b b2 cd | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 27 bb 2f d0 ae 59 be 68 5b cd f1 98 e5 d2 4a 7a | 36 7b b2 cd | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 510 | [RE]START processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #3 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK | transitioning from state STATE_PARENT_I0 to state STATE_PARENT_I1 | Message ID: updating counters for #3 | Message ID: IKE #3 skipping update_recv as MD is fake | Message ID: IKE #3 scheduling EVENT_RETRANSMIT: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.030194 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=0 ike.wip.responder=-1 "westnet-eastnet-aes-128" #3: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a3bf8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #3 | libevent_malloc: newref ptr-libevent@0x5634e17ac178 size 128 | #3 STATE_PARENT_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.032878 | Message ID: IKE #3 updating initiator sent message request 0: ike.initiator.sent=-1->0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.030194 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=-1->0 ike.wip.responder=-1 | Message ID: IKE #3 no pending message initiators to schedule: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.030194 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=0 ike.wip.responder=-1 | parent state #3: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes-128" #3: sent IKE_SA_INIT request | sending 510 bytes for STATE_PARENT_I0 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 01 fe 22 00 00 68 | 00 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 0c | 80 0e 00 80 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 28 00 01 08 00 0e 00 00 fa a3 19 71 | 3d 23 bf eb 49 de 15 8c 2f 8b 23 a1 41 0e fd a3 | 82 f9 75 ad 9f 8d 31 59 f7 a4 be 59 a6 16 89 5b | 01 f5 a3 3c 11 cd 2d 51 5a c6 6f 76 f7 ea 3b 84 | f3 82 72 1f bb 53 c9 0d 96 8b e4 ba 83 ab ae 7e | a1 cb d1 6e d0 24 cc f9 23 d8 db 9d 8b 6c 29 a3 | 2e f4 40 7d 76 15 06 62 45 ea 92 58 a7 4c 6b 48 | 68 70 4f d2 d6 ac e9 2c 10 b8 0e 9a da 7c da d0 | 16 08 cc fc 2e f9 70 bd 99 26 e1 b1 ba 7c 64 fa | ea 0d 70 e8 fa 3b bc 4a ab 18 d7 b8 b3 7e b5 e8 | 96 f5 9f 65 d6 78 b8 47 6d ed a0 3a 19 31 e7 5a | b9 6f 9d a2 76 3d 42 7a 94 e9 9b 51 eb c2 bf d8 | 14 b6 5f 6e b8 cc a9 12 cc 05 b2 e5 21 e7 c8 51 | b3 21 1c 78 26 11 6c d2 0e 9e e8 ef d7 3a c0 76 | 14 04 3c 5a 6d b9 6f 7c 0f 17 0d 76 a6 62 7d b5 | d0 ab 0d 6c f0 d6 a4 46 62 e2 72 ed b1 92 3f f1 | f4 01 51 c3 6f fe f0 74 d2 ec a8 7f 29 00 00 24 | 54 78 e2 31 c2 bd 34 df 8b 94 6a e9 98 b4 00 10 | d4 39 1b c9 1f 44 ab e4 8d f4 94 4f 56 03 aa 0c | 29 00 00 08 00 00 40 2e 29 00 00 0e 00 00 40 2f | 00 02 00 03 00 04 29 00 00 1c 00 00 40 04 b4 e1 | ed ef ab c0 04 2d 36 d2 68 ad 9d 1c 27 5c 38 e7 | 03 1f 00 00 00 1c 00 00 40 05 27 bb 2f d0 ae 59 | be 68 5b cd f1 98 e5 d2 4a 7a 36 7b b2 cd | sent 1 messages | checking that a retransmit timeout_event was already | state #3 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17ab658 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17ab8a8 | delref logger@0x5634e17a6a58(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a1c78(3->2) (in free_logger() at log.c:854) | resume sending helper answer back to state for #3 suppresed complete_v2_state_transition() | delref mdp@NULL (in resume_handler() at server.c:743) | #3 spent 0.694 (0.755) milliseconds in resume sending helper answer back to state | stop processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6a98006108 | spent 0.00243 (0.00244) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8868(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a6a58(0->1) (in read_message() at demux.c:103) | *received 454 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 00 80 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 40 1a c3 62 bc 71 f1 ac de fc 31 15 | ff fb 05 4a 9d 30 f8 23 80 3a c7 08 93 2e 23 fe | 9b a6 45 3a b9 13 d1 bb d4 a6 57 5d 13 93 55 fa | d7 96 18 f4 45 11 82 71 9c a6 19 bc a6 61 e1 43 | c6 89 e4 8f 8a 2e f4 97 b6 bc 8e 49 0a 0a 17 58 | ff 31 bd 39 3b 0f 28 b1 28 32 ee 71 16 fd 5c 82 | d3 aa fd d3 77 43 ab 28 71 1e 2e 0e 79 b0 c1 f5 | e4 0d 0e 94 b5 f4 1d 6e 27 36 bf 48 ec f3 b6 23 | 64 84 ac 3e eb 84 85 d0 98 6b 6b 3b 29 d8 be 2a | 38 be 33 a5 4b 0a f2 1b 85 ea 5b 8a 06 ae e4 ff | 71 5f 65 d4 d1 92 46 4b a9 89 78 30 6d 22 90 4e | 41 a4 41 0e fa 12 94 26 a0 bc 41 6e e9 c8 21 20 | a4 a5 de f2 5f 27 bb 89 ff d7 90 98 57 df 1f 80 | d8 b5 83 42 c0 0a e8 f8 96 31 4d 47 64 e8 08 5e | 18 91 db 77 ed b1 c3 91 37 4c 3a 41 fb 78 7d a4 | 48 0e 75 79 3f 12 c9 07 6f fa c0 71 8c 61 9c 0b | a9 a6 97 c2 29 00 00 24 ec 07 b5 82 22 f7 10 1e | 24 9b f5 43 e6 93 ad 9a f3 0c fa 53 e6 56 a3 58 | c1 07 1f 60 86 4c b8 63 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 17 dd 3e 28 61 2e 86 5b 11 56 | fb 9f d8 b8 4c 19 36 c2 40 74 00 00 00 1c 00 00 | 40 05 92 96 ba ac 11 c8 58 5b 67 53 f2 a8 97 f1 | 80 61 20 a2 15 5d | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | length: 454 (00 00 01 c6) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response | State DB: found IKEv2 state #3 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) | #3 is idle | #3 idle | unpacking clear payloads | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SA (len=44) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | looking for message matching transition from STATE_PARENT_I1 | trying received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added | message has errors | trying received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload | message has errors | trying received REDIRECT notify response; resending IKE_SA_INIT request to new destination | message has errors | trying Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | matched unencrypted message | start processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1848) | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | ikev2 parent inR1: calculating g^{xy} in order to send I2 | using existing local IKE proposals for connection westnet-eastnet-aes-128 (IKE SA initiator accepting remote proposal): 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE initiator (accepting) 1 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 44 (00 2c) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048[first-match] | converting proposal to internal trans attrs | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 6a c3 f8 a0 76 2a 06 5c | natd_hash: rcookie= | 0b 42 76 fa 7e fb 01 81 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 92 96 ba ac 11 c8 58 5b 67 53 f2 a8 97 f1 80 61 | 20 a2 15 5d | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 6a c3 f8 a0 76 2a 06 5c | natd_hash: rcookie= | 0b 42 76 fa 7e fb 01 81 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 17 dd 3e 28 61 2e 86 5b 11 56 fb 9f d8 b8 4c 19 | 36 c2 40 74 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f6a98006ba8: transferring ownership from state #3 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a1c78(2->3) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17ab8a8(0->1) (in clone_logger() at log.c:817) | job 5 for #3: ikev2_inR1outI2 KE (compute dh (V2)): adding job to queue | state #3 has no .st_event to delete | #3 requesting EVENT_RETRANSMIT-pe@0x5634e17a3bf8 be deleted | libevent_free: delref ptr-libevent@0x5634e17ac178 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a3bf8 | #3 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a3fc8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: newref ptr-libevent@0x5634e17ab658 size 128 | #3 spent 0.324 (0.454) milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE in v2_dispatch() | [RE]START processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #3 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | suspending state #3 and saving MD 0x5634e17a8868 | addref md@0x5634e17a8868(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #3 is busy; has suspended MD 0x5634e17a8868 | stop processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1850) | #3 spent 0.635 (0.764) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8868(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.644 (0.773) milliseconds in handle_packet_cb() reading and processing packet | job 5 for #3: ikev2_inR1outI2 KE (compute dh (V2)): helper 6 starting job | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=16 salt-size=0 | "westnet-eastnet-aes-128" #3: spent 1.03 (1.1) milliseconds in helper 6 processing job 5 for state #3: ikev2_inR1outI2 KE (pcr) | job 5 for #3: ikev2_inR1outI2 KE (compute dh (V2)): helper thread 6 sending result back to state | scheduling resume sending helper answer back to state for #3 | libevent_malloc: newref ptr-libevent@0x7f6a9c004f78 size 128 | helper thread 6 has nothing to do | processing resume sending helper answer back to state for #3 | start processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #3 MD 0x5634e17a8868 | job 5 for #3: ikev2_inR1outI2 KE (compute dh (V2)): processing response from helper 6 | job 5 for #3: ikev2_inR1outI2 KE (compute dh (V2)): calling continuation function 0x5634df8f5fe7 | ikev2_parent_inR1outI2_continue() for #3 STATE_PARENT_I1: g^{xy} calculated, sending I2 | DH secret MODP2048@0x7f6a98006ba8: transferring ownership from helper IKEv2 DH to state #3 | State DB: re-hashing IKEv2 state #3 IKE SPIi and SPI[ir] | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 to find private key for @west->@east of kind RSA | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes-128's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a1c78(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a3bf8(0->1) (in clone_logger() at log.c:817) | job 6 for #3: computing responder signature (signature): adding job to queue | state #3 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17ab658 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a3fc8 | #3 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17ab658 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #3 | libevent_malloc: newref ptr-libevent@0x5634e17a4038 size 128 | [RE]START processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #3 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | suspending state #3 and saving MD 0x5634e17a8868 | addref md@0x5634e17a8868(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #3 is busy; has suspended MD 0x5634e17a8868 | delref logger@0x5634e17ab8a8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a1c78(4->3) (in free_logger() at log.c:854) | resume sending helper answer back to state for #3 suppresed complete_v2_state_transition() | delref mdp@0x5634e17a8868(2->1) (in resume_handler() at server.c:743) | #3 spent 0.16 (0.16) milliseconds in resume sending helper answer back to state | stop processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6a9c004f78 | job 6 for #3: computing responder signature (signature): helper 5 starting job | hash to sign | cb 2d f1 bb 3b 4b 55 1d 03 d9 0f 45 b4 a4 8e c7 | 6e 05 73 d5 e7 7b 4c 2c ba 24 17 80 2e 5c c6 78 | 5c e0 ce e0 36 40 42 03 81 67 72 25 23 87 7c 94 | 8b 57 4a 73 5f cc b9 50 ff 47 72 4a a4 38 85 7e | RSA_sign_hash: Started using NSS | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes-128" #3: spent 3.56 (4.92) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes-128" #3: spent 3.58 (4.94) milliseconds in v2_auth_signature() | "westnet-eastnet-aes-128" #3: spent 3.59 (4.95) milliseconds in helper 5 processing job 6 for state #3: computing responder signature (signature) | job 6 for #3: computing responder signature (signature): helper thread 5 sending result back to state | scheduling resume sending helper answer back to state for #3 | libevent_malloc: newref ptr-libevent@0x7f6a90000d38 size 128 | helper thread 5 has nothing to do | processing resume sending helper answer back to state for #3 | start processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #3 MD 0x5634e17a8868 | job 6 for #3: computing responder signature (signature): processing response from helper 5 | job 6 for #3: computing responder signature (signature): calling continuation function 0x5634df82477f | newref alloc logger@0x5634e17ab8a8(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a1c78(3->4) (in new_state() at state.c:577) | creating state object #4 at 0x5634e17af0b8 | State DB: adding IKEv2 state #4 in UNDEFINED | pstats #4 ikev2.child started | duplicating state object #3 "westnet-eastnet-aes-128" as #4 for IPSEC SA | #4 setting local endpoint to 192.1.2.45:500 from #3.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #3.#4 initializing (CHILD SA): ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.030194 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #4: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_I0(ignore) | #4.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #3 switching from IKE SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.030194 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=0->-1 ike.wip.responder=-1 | Message ID: CHILD #3.#4 switching to CHILD SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.030194 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=-1->0 child.wip.responder=-1 | switching IKEv2 MD.ST from IKE #3 PARENT_I1 to CHILD #4 V2_IKE_AUTH_CHILD_I0 (in ikev2_parent_inR1outI2_auth_signature_continue() at ikev2_parent.c:2155) | state #3 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17a4038 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17ab658 | #3 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_SA_REPLACE-pe@0x5634e17a4038 | inserting event EVENT_SA_REPLACE, timeout in 120 seconds for #3 | libevent_malloc: newref ptr-libevent@0x7f6a9c004f78 size 128 | parent state #3: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | IDr payload will be sent | ****emit IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Initiator - Payload | my identity: 77 65 73 74 | emitting length of IKEv2 Identification - Initiator - Payload: 12 | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of their IDr into IKEv2 Identification - Responder - Payload | their IDr: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | not sending INITIAL_CONTACT | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 1c d0 1f b6 e1 34 67 6e de a5 6c 72 df 05 78 cc | 93 15 15 de 8b 1e d7 ea 41 91 36 ff 96 20 b9 63 | 36 f1 2c 7c 8a 1e 26 b1 dc 5b b3 58 98 c5 95 83 | 3b a5 a8 cf c7 aa f9 39 89 e6 06 26 aa 79 31 28 | 5b ac 9e d9 fb 66 10 4e e7 8e 9f ef 1a a1 31 49 | 2c 51 fd bc 31 61 8d 5a 38 be c8 dc fa 47 8e b9 | cf a4 f6 50 5b 2b bb 1a f7 65 8c d0 03 52 85 c5 | e5 d5 c1 60 ec ac 42 53 df d4 a4 67 33 28 15 32 | b8 5e 0d c3 b2 49 33 0a a8 63 13 5d cd 8c 3f 33 | 71 98 1c d5 04 6c 56 1f b7 21 4a d9 cf 9d 48 7c | 29 f7 f7 32 ba 71 a5 c1 f4 ac 66 15 c9 da b9 ff | e1 ec 28 8b dd 0c 59 14 33 f3 1d 56 9f ee a9 21 | 1e ca cd 17 bf 18 b5 bd 13 68 f4 2a 65 42 37 65 | 24 ec d1 11 23 79 a5 bb ca 5e 8d 8a 54 c9 7b ff | 47 e6 af 64 a2 34 0b 1e 5c 36 80 8c f3 f2 2c bd | 52 2b b6 05 f8 1e 10 5f 76 d6 00 ea 85 5d 26 78 | 34 66 77 ec 8e d2 60 f0 a2 f1 d5 a3 2d 5c 79 5e | 5e 5b | emitting length of IKEv2 Authentication Payload: 350 | getting first pending from state #3 | delref fd@0x5634e17a1c78(4->3) (in first_pending() at pending.c:318) | addref fd@0x5634e17a1c78(3->4) (in first_pending() at pending.c:319) | netlink_get_spi: allocated 0x10c7aea4 for esp.0@192.1.2.45 | constructing ESP/AH proposals with all DH removed for westnet-eastnet-aes-128 (IKE SA initiator emitting ESP/AH proposals) | converting proposal AES_CBC_128-HMAC_SHA1_96 to ikev2 ... | ... ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA1_96-NONE-DISABLED "westnet-eastnet-aes-128": local ESP/AH proposals (IKE SA initiator emitting ESP/AH proposals): "westnet-eastnet-aes-128": 1:ESP=AES_CBC_128-HMAC_SHA1_96-NONE-DISABLED | Emitting ikev2_proposals ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discard DH=NONE when counting transforms (multiple 0; allow single 0) | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: 10 c7 ae a4 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discard DH=NONE when emitting proposal (multiple 0; allow single 0) | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | adding 14 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 512 | emitting length of ISAKMP Message: 540 | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 540 (00 00 02 1c) | **parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 512 (02 00) | opening output PBS reply frag packet | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 16 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 466 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment: | 24 00 00 0c 02 00 00 00 77 65 73 74 27 00 00 0c | 02 00 00 00 65 61 73 74 21 00 01 5e 0e 00 00 00 | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 1c d0 1f b6 e1 34 67 6e de a5 6c 72 | df 05 78 cc 93 15 15 de 8b 1e d7 ea 41 91 36 ff | 96 20 b9 63 36 f1 2c 7c 8a 1e 26 b1 dc 5b b3 58 | 98 c5 95 83 3b a5 a8 cf c7 aa f9 39 89 e6 06 26 | aa 79 31 28 5b ac 9e d9 fb 66 10 4e e7 8e 9f ef | 1a a1 31 49 2c 51 fd bc 31 61 8d 5a 38 be c8 dc | fa 47 8e b9 cf a4 f6 50 5b 2b bb 1a f7 65 8c d0 | 03 52 85 c5 e5 d5 c1 60 ec ac 42 53 df d4 a4 67 | 33 28 15 32 b8 5e 0d c3 b2 49 33 0a a8 63 13 5d | cd 8c 3f 33 71 98 1c d5 04 6c 56 1f b7 21 4a d9 | cf 9d 48 7c 29 f7 f7 32 ba 71 a5 c1 f4 ac 66 15 | c9 da b9 ff e1 ec 28 8b dd 0c 59 14 33 f3 1d 56 | 9f ee a9 21 1e ca cd 17 bf 18 b5 bd 13 68 f4 2a | 65 42 37 65 24 ec d1 11 23 79 a5 bb ca 5e 8d 8a | 54 c9 7b ff 47 e6 af 64 a2 34 0b 1e 5c 36 80 8c | f3 f2 2c bd 52 2b b6 05 f8 1e 10 5f 76 d6 00 ea | 85 5d 26 78 34 66 77 ec 8e d2 60 f0 a2 f1 d5 a3 | 2d 5c 79 5e 5e 5b 2c 00 00 2c 00 00 00 28 01 03 | 04 03 10 c7 ae a4 03 00 00 0c 01 00 00 0c 80 0e | 00 80 03 00 00 08 03 00 00 02 00 00 00 08 05 00 | 00 00 2d 00 00 18 01 00 00 00 07 00 00 10 00 00 | ff ff c0 00 01 00 c0 00 01 ff 00 00 00 18 01 00 | 00 00 07 00 00 10 00 00 ff ff c0 00 02 00 c0 00 | 02 ff | adding 14 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 516 | emitting length of ISAKMP Message: 544 | recording fragment 1 | delref logger@0x5634e17a3bf8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a1c78(4->3) (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #3 switched MD.ST to #4 | suspend processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #4 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #4 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_I0 PARENT_I1->PARENT_I2 with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I1 to state STATE_PARENT_I2 | Message ID: updating counters for #4 | Message ID: CHILD #3.#4 XXX: no EVENT_RETRANSMIT to clear; suspect IKE->CHILD switch: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.030194 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: CHILD #3.#4 updating initiator received message response 0: ike.initiator.sent=0 ike.initiator.recv=-1->0 ike.initiator.last_contact=744609.030194->744609.049393 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=0->-1 child.wip.responder=-1 | Message ID: CHILD #3.#4 scheduling EVENT_RETRANSMIT: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.049393 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=1 child.wip.responder=-1 "westnet-eastnet-aes-128" #4: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a3bf8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #4 | libevent_malloc: newref ptr-libevent@0x5634e17ac1c8 size 128 | #4 STATE_V2_IKE_AUTH_CHILD_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.049428 | Message ID: CHILD #3.#4 updating initiator sent message request 1: ike.initiator.sent=0->1 ike.initiator.recv=0 ike.initiator.last_contact=744609.049393 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=-1->1 child.wip.responder=-1 | Message ID: IKE #3 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.049393 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #4: V2_IKE_AUTH_CHILD_I0(ignore) => PARENT_I2(open IKE SA) | announcing the state transition "westnet-eastnet-aes-128" #3: sent IKE_AUTH request {auth=IKEv2 cipher=AES_CBC_128 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 544 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 c0 67 90 55 15 a6 0f ae ec 2e dd 23 | 99 61 73 47 e7 85 50 21 d5 fa af 66 f5 fa d9 89 | e7 78 c3 40 e2 ae 59 08 48 65 1c 84 f4 58 4c 58 | 5c 1e 92 e8 7c d3 8e 78 e8 df 2e ab 6a 31 d7 7c | 22 5e 64 16 99 35 59 bc 86 5a 31 d4 76 44 da 34 | d4 d2 1b e5 0e e3 a2 20 b4 f2 3e bf bc da 26 03 | 85 b6 f9 77 34 b9 b0 05 29 9c 8d 90 6b 7b 49 94 | a6 b5 96 9c 33 cd 69 2f 3b 61 29 c1 23 2e 63 fb | 97 e1 15 02 c3 5e 6c 03 2b 3e ae 20 00 17 e0 25 | 78 03 a3 1c 06 3d c8 12 9b 9f 17 ad cc 71 bb a0 | 44 b8 00 eb 6e f7 e1 62 ec 64 d3 bb e4 66 52 73 | 9b 2b 9b 72 ec e8 fe a3 a5 31 c7 13 c9 5b 99 d2 | 0c ee ab 52 07 94 85 a2 57 62 17 fb 87 99 09 45 | 73 a6 7a 1b bb 75 0f f7 a4 ad 30 26 8e da aa 63 | 4c 5d 75 07 84 61 dd 7d 53 96 18 e2 b0 4d 1e 02 | 7b bb 65 74 f8 ae ca 1c 71 0c e9 6c 88 34 49 fa | 5f ca e7 86 c0 30 76 21 1e b9 46 4f 74 f2 2f 65 | e4 87 2e 8c cb ba 9f 62 2f ed 97 b7 eb e4 b9 38 | 8a e5 c9 d1 ba 27 11 d9 f5 da 7a 4e 42 d6 ef 55 | 5d 9b 7f 7c 45 a2 5e 5a 24 de 84 5d 77 3b 65 d4 | f5 0a 98 1d b0 07 01 dd ea 4c 37 fa e1 8c fb ff | ce 00 2b b1 63 c8 96 f9 0a 49 53 69 ca 78 37 e2 | be 80 4a 46 2f 42 91 b5 a2 4d 1d 6e 23 61 cc 25 | 0b 1e 24 b3 c1 9a c6 86 fb 33 6d 5d 44 a2 66 53 | 5a eb 04 d1 9c 5e 3b 9c 97 9f 34 ee e7 1a 60 19 | 78 6a cf a9 c8 5b ee 9b 99 b6 28 45 2c 5a e4 77 | 4a c6 7e a7 95 9d 57 18 ec ef b9 35 4c 2c 59 6d | 70 ab 57 94 e7 43 f2 2c 60 9f 28 82 67 75 4c eb | c8 0f 87 a0 af f7 55 5c db a8 25 7d b7 38 a8 9f | 7e 8a 07 16 e6 2f a2 6b 3c 12 df 19 ae 61 62 b5 | 28 f0 2f 21 56 d3 fa 7c 3d 23 48 82 1e a0 af 40 | da 6c a2 ef b3 aa d1 1c 2c 1d 15 1f 6f 4f 3b c9 | sent 1 messages | checking that a retransmit timeout_event was already | state #4 has no .st_event to delete | delref mdp@0x5634e17a8868(1->0) (in resume_handler() at server.c:743) | delref logger@0x5634e17a6a58(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #3 spent 1.01 (1.09) milliseconds in resume sending helper answer back to state | stop processing: state #4 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6a90000d38 | spent 0.00252 (0.00247) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8868(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17ab658(0->1) (in read_message() at demux.c:103) | *received 524 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | d4 1c 33 26 2e e5 2a d4 9c 17 50 f0 0d e3 37 6a | 53 d0 9b f7 1a e1 b8 e4 1b fa 1e 28 32 2b 8c 20 | 9a 60 e8 53 e2 a1 4e 0e 63 92 05 c7 81 18 56 72 | e4 3d b8 cd fd 8f c2 8e bb 9f f3 c8 c0 60 18 95 | 5d e7 3f 57 0a 3b 72 01 09 8e be f4 ff 46 17 13 | 61 d2 87 1d 66 c6 ab 9d d1 60 62 bf 08 1d 9f a8 | 57 95 0c c8 f2 53 8a 2d 77 27 22 36 f4 5c d8 1b | 4e b9 e3 f7 3c 87 43 5d 85 ff 5d 73 46 72 15 6f | ec 76 2e 14 8b 77 99 ca 84 5d 84 1a 06 a2 4f f6 | cc f7 b3 5c 5e 08 7a 6f 01 32 a5 7a ea fe 4c e4 | 48 8a 7b c5 46 c9 ed 1c 7f 62 4f d7 8c 88 31 a0 | 68 59 b6 b1 4d 13 06 07 17 36 88 47 74 d5 ab 85 | fb 7c d3 f9 59 4c 1a 7d 9c 19 5a 33 35 57 9e 59 | 88 3a 72 18 5d 14 a7 d9 63 a4 bf f7 a7 74 72 b3 | 3e e5 1d bc 1e ec 91 59 70 c9 03 11 a0 fc c7 ce | ee a0 5b 87 5c 32 88 a9 4f f4 c3 69 18 87 e7 16 | e1 8a 23 86 c1 10 d4 71 e2 16 e3 31 ae 26 db 48 | 66 75 2e a9 78 cd e5 69 34 5e 8b 42 90 be e6 6a | 9f 29 0a fa 5f a4 8c e1 70 9d 4d 3f 62 74 13 b8 | e2 a6 17 a2 c0 31 1d 6d 79 32 5f b2 f8 83 b6 55 | 99 22 7c fd ff 3e eb 3a 75 a2 68 87 2f 32 d4 79 | 81 be e8 28 e6 e6 5d 05 ae 21 6d 6c fa 6c 34 a1 | ba c8 f7 63 d8 54 8f 99 4e b1 9b a6 af e6 1a 2a | 48 1f c4 89 ee dc 3c a3 1c 05 d4 13 59 9f e2 66 | 13 11 60 ea f3 96 1c 1d f2 4c 42 eb ea c4 be 42 | d0 8e d1 3e d7 cc c6 23 fb ee 2d 38 f4 26 5f bf | b7 6f 06 dc e7 45 29 a9 77 96 05 39 db d0 08 a6 | e3 2a 42 73 d9 2f 3d 8a be b1 af 52 7e 08 09 4a | c7 6a c7 4c 1e 4e 9c 58 80 ef 13 87 4b cf 23 1a | 57 9e 0c d0 7f 83 07 85 9c ce 54 f5 04 d2 b0 90 | 0c 21 45 eb 94 45 71 5b 32 41 ca 1e | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | length: 524 (00 00 02 0c) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #3 in PARENT_I2 (find_v2_ike_sa) | start processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) | State DB: found IKEv2 state #4 in PARENT_I2 (find_v2_sa_by_initiator_wip) | #4 is idle | #4 idle | suspend processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | start processing: state #4 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 496 (01 f0) | processing payload: ISAKMP_NEXT_v2SK (len=492) | #4 in state PARENT_I2: sent IKE_AUTH request | authenticator matched | #3 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Initiator: process IKE_AUTH response | calling processor Initiator: process IKE_AUTH response | no certs to decode | offered CA: '%none' "westnet-eastnet-aes-128" #4: IKEv2 mode peer ID is ID_FQDN: '@east' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @east | trying all preloaded keys public keys for RSA key that matches ID: @east | trying '@east' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | be c6 c3 54 6a da 7c e6 9e 5e 90 a9 e9 a9 bd 42 | 7d 71 45 03 65 f0 14 fe 38 0a 8f a4 a8 03 87 61 | 3b 48 74 93 1a 09 96 6e 13 b9 1b 95 37 e8 fc a0 | f6 e1 2c 33 6e c4 5d c3 1f 67 d3 53 aa 89 4b aa | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x5634e17a6848(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQO9bJbr3 [preloaded keys] | #3 spent 0.0954 (0.0957) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes-128" #3: authenticated using RSA with SHA2_512 | #3 spent 0.139 (0.139) milliseconds in ikev2_verify_rsa_hash() | parent state #3: PARENT_I2(open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #3 will start re-keying in 2638 seconds with margin of 962 seconds (attempting re-key) | state #3 deleting .st_event EVENT_SA_REPLACE | libevent_free: delref ptr-libevent@0x7f6a9c004f78 | free_event_entry: delref EVENT_SA_REPLACE-pe@0x5634e17a4038 | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17ac498 | inserting event EVENT_SA_REKEY, timeout in 2638 seconds for #3 | libevent_malloc: newref ptr-libevent@0x7f6a90000d38 size 128 | pstats #3 ikev2.ike established | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | evaluating our conn="westnet-eastnet-aes-128" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found an acceptable TSi/TSr Traffic Selector | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | using existing local ESP/AH proposals for westnet-eastnet-aes-128 (IKE_AUTH initiator accepting remote ESP/AH proposal): 1:ESP=AES_CBC_128-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH initiator accepting remote ESP/AH proposal 1 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | 10 9a 81 88 | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH initiator accepting remote ESP/AH proposal ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=109a8188 | converting proposal to internal trans attrs | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=36 | install_ipsec_sa() for #4: inbound and outbound | could_route called for westnet-eastnet-aes-128; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-128 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-128 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-128" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-128' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16393 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.109a8188@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-128' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16393 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.10c7aea4@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes-128" is 2084814 (0x1fcfce) | add inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.10000@192.1.2.45 using reqid 16393 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #4: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-128 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-128 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-128" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-aes-128 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #4 | priority calculation of connection "westnet-eastnet-aes-128" is 2084814 (0x1fcfce) | eroute_connection add eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23 using reqid 16393 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.109a8188@192.1.2.23 | get_sa_info esp.10c7aea4@192.1.2.45 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGU... | popen cmd is 1144 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PL: | cmd( 160):UTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLI: | cmd( 240):ENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255: | cmd( 320):.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_: | cmd( 400):TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.: | cmd( 480):0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.: | cmd( 560):0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfr: | cmd( 640):m' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS: | cmd( 720):+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT: | cmd( 800):' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER: | cmd( 880):_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0': | cmd( 960): PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES=': | cmd(1040):0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x109a8188 SPI_OUT=0x10c: | cmd(1120):7aea4 ipsec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | get_sa_info esp.109a8188@192.1.2.23 | get_sa_info esp.10c7aea4@192.1.2.45 | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_... | popen cmd is 1149 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=: | cmd( 160):'' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_M: | cmd( 240):Y_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='25: | cmd( 320):5.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUT: | cmd( 400):O_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT=: | cmd( 480):'192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255: | cmd( 560):.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK: | cmd( 640):='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNE: | cmd( 720):L+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERM: | cmd( 800):ANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO: | cmd( 880):_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVE: | cmd( 960):R='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBY: | cmd(1040):TES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x109a8188 SPI_OUT=: | cmd(1120):0x10c7aea4 ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | get_sa_info esp.109a8188@192.1.2.23 | get_sa_info esp.10c7aea4@192.1.2.45 | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_C... | popen cmd is 1147 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):aes-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='': | cmd( 160): PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_: | cmd( 240):CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.: | cmd( 320):255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_: | cmd( 400):SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='1: | cmd( 480):92.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.2: | cmd( 560):55.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK=': | cmd( 640):xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+: | cmd( 720):PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMAN: | cmd( 800):ENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_P: | cmd( 880):EER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER=: | cmd( 960):'0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTE: | cmd(1040):S='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x109a8188 SPI_OUT=0x: | cmd(1120):10c7aea4 ipsec _updown 2>&1: "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-128" #4: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "westnet-eastnet-aes-128", setting eroute_owner {spd=0x5634e17a1ef8,sr=0x5634e17a1ef8} to #4 (was #0) (newest_ipsec_sa=#0) | inR2: instance westnet-eastnet-aes-128[0], setting IKEv2 newest_ipsec_sa to #4 (was #0) (spd.eroute=#4) cloned from #3 | #4 spent 1.73 (54) milliseconds in processing: Initiator: process IKE_AUTH response in v2_dispatch() | [RE]START processing: state #4 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #4 complete_v2_state_transition() PARENT_I2->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I2 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #4 | Message ID: CHILD #3.#4 clearing EVENT_RETRANSMIT as response received: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.049393 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=-1 child.wip.responder=-1 | #4 requesting EVENT_RETRANSMIT-pe@0x5634e17a3bf8 be deleted | libevent_free: delref ptr-libevent@0x5634e17ac1c8 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a3bf8 | #4 STATE_PARENT_I2: retransmits: cleared | Message ID: CHILD #3.#4 updating initiator received message response 1: ike.initiator.sent=1 ike.initiator.recv=0->1 ike.initiator.last_contact=744609.049393->744609.118992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=1->-1 child.wip.responder=-1 | Message ID: CHILD #3.#4 skipping update_send as nothing to send: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744609.118992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #3 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744609.118992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #4: PARENT_I2(open IKE SA) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #4 ikev2.child established | announcing the state transition "westnet-eastnet-aes-128" #4: negotiated connection [192.0.1.0-192.0.1.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes-128" #4: IPsec SA established tunnel mode {ESP=>0x109a8188 <0x10c7aea4 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | releasing #4's fd-fd@0x5634e17a1c78 because IKEv2 transitions finished | delref fd@0x5634e17a1c78(3->2) (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #4's IKE SA #3 | unpending state #3 connection "westnet-eastnet-aes-128" | delete from pending Child SA with 192.1.2.23 "westnet-eastnet-aes-128" | delref fd@0x5634e17a1c78(2->1) (in delete_pending() at pending.c:218) | removing pending policy for no connection {0x5634e1792a98} | releasing #3's fd-fd@0x5634e17a1c78 because IKEv2 transitions finished so releaseing IKE SA | delref fd@0x5634e17a1c78(1->0) (in success_v2_state_transition() at ikev2.c:3222) | freeref fd-fd@0x5634e17a1c78 (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #4 will start re-keying in 27829 seconds with margin of 971 seconds (attempting re-key) | state #4 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17a3bf8 | inserting event EVENT_SA_REKEY, timeout in 27829 seconds for #4 | libevent_malloc: newref ptr-libevent@0x5634e17aa9e8 size 128 | stop processing: state #4 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) | #3 spent 1.71 (54) milliseconds | #3 spent 2.21 (54.5) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8868(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17ab658(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 2.24 (54.5) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00532 (0.00524) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00295 (0.00294) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00271 (0.00272) milliseconds in signal handler PLUTO_SIGCHLD | newref struct fd@0x5634e17a1c78(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a1c78 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-128' | FOR_EACH_CONNECTION_... in conn_by_name "westnet-eastnet-aes-128": terminating SAs using this connection | connection 'westnet-eastnet-aes-128' -POLICY_UP | FOR_EACH_STATE_... in shared_phase1_connection | connection not shared - terminating IKE and IPsec SA | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #4 | start processing: state #4 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a1c78(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #4 ikev2.child deleted completed | #4 main thread spent 1.73 (54) milliseconds helper thread spent 0 (0) milliseconds in total | [RE]START processing: state #4 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-128" #4: deleting state (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.138754s and sending notification | child state #4: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.109a8188@192.1.2.23 | get_sa_info esp.10c7aea4@192.1.2.45 "westnet-eastnet-aes-128" #4: ESP traffic information: in=0B out=0B | unsuspending #4 MD (nil) | should_send_delete: yes | #4 send IKEv2 delete notification for STATE_V2_ESTABLISHED_CHILD_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting 4 raw bytes of local spis into IKEv2 Delete Payload | local spis: 10 c7 ae a4 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | 16 41 cb 56 db 95 b9 b9 a0 cf 42 5d 1e 3f 72 dc | 1c 0d 6c 63 19 08 17 fe 3c ef 94 65 e6 a1 06 16 | 41 e7 8b 8e 45 dc 70 4f 1f 93 6b 19 | sent 1 messages | Message ID: IKE #3 sender #4 in send_delete hacking around record 'n' send | Message ID: IKE #3 scheduling EVENT_RETRANSMIT: ike.initiator.sent=2 ike.initiator.recv=1 ike.initiator.last_contact=744609.118992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=2 ike.wip.responder=-1 "westnet-eastnet-aes-128" #3: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17aa978 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #3 | libevent_malloc: newref ptr-libevent@0x5634e17ac1c8 size 128 | #3 STATE_V2_ESTABLISHED_IKE_SA: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.187896 | Message ID: IKE #3 updating initiator sent message request 2: ike.initiator.sent=1->2 ike.initiator.recv=1 ike.initiator.last_contact=744609.118992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=-1->2 ike.wip.responder=-1 | state #4 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x5634e17aa9e8 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17a3bf8 | #4 STATE_V2_ESTABLISHED_CHILD_SA: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.109a8188@192.1.2.23 | get_sa_info esp.10c7aea4@192.1.2.45 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIG... | popen cmd is 1143 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' : | cmd( 160):PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_C: | cmd( 240):LIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.2: | cmd( 320):55.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_S: | cmd( 400):A_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='19: | cmd( 480):2.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.25: | cmd( 560):5.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='x: | cmd( 640):frm' PLUTO_ADDTIME='1604157934' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+P: | cmd( 720):FS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT': | cmd( 800): PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_: | cmd( 880):DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' : | cmd( 960):PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0: | cmd(1040):' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x109a8188 SPI_OUT=0x10c7: | cmd(1120):aea4 ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes-128' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-128" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.109a8188@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.109a8188@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-aes-128" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => unk.10000@192.1.2.45 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.10c7aea4@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.10c7aea4@192.1.2.45 included non-error error | in connection_discard for connection westnet-eastnet-aes-128 | State DB: deleting IKEv2 state #4 in ESTABLISHED_CHILD_SA | child state #4: ESTABLISHED_CHILD_SA(established CHILD SA) => UNDEFINED(ignore) | releasing #4's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a1c78(2->1) (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #4 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e17ab8a8(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | state #3 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #3 | start processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a1c78(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #3 ikev2.ike deleted completed | #3 main thread spent 4.88 (57.4) milliseconds helper thread spent 6.56 (8.01) milliseconds in total | [RE]START processing: state #3 connection "westnet-eastnet-aes-128" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-128" #3: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.179003s and sending notification | parent state #3: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #3 MD (nil) | should_send_delete: yes | #3 send IKEv2 delete notification for STATE_V2_ESTABLISHED_IKE_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting length of IKEv2 Delete Payload: 8 | adding 8 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #3) | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | 77 31 68 80 32 d6 a8 34 f3 3a 74 04 23 1f 91 45 | 62 2b a2 de 69 48 1a 7a 20 5c 34 96 e6 0e 43 d5 | ac 45 a7 1d 88 2d 4e 36 42 50 e9 91 | sent 1 messages | Message ID: IKE #3 sender #3 in send_delete hacking around record 'n' send | Message ID: IKE #3 XXX: expecting sender.wip.initiator 2 == -1 - suspect record'n'send out-of-order?): ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744609.118992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #3 XXX: EVENT_RETRANSMIT already scheduled -- suspect record'n'send: ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744609.118992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #3 updating initiator sent message request 3: ike.initiator.sent=2->3 ike.initiator.recv=1 ike.initiator.last_contact=744609.118992 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.030194 ike.wip.initiator=2->3 ike.wip.responder=-1 | state #3 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f6a90000d38 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17ac498 | #3 requesting EVENT_RETRANSMIT-pe@0x5634e17aa978 be deleted | libevent_free: delref ptr-libevent@0x5634e17ac1c8 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17aa978 | #3 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes-128 | State DB: deleting IKEv2 state #3 in ESTABLISHED_IKE_SA | parent state #3: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #3's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a1c78(2->1) (in delete_state() at state.c:1195) | delref pkp@0x5634e17a6848(2->1) (in delete_state() at state.c:1202) | stop processing: state #3 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e17a49c8(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | FOR_EACH_CONNECTION_... in conn_by_name | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-aes-128' to 'delete' for rt_kind 'unrouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-128" is 2084814 (0x1fcfce) | priority calculation of connection "westnet-eastnet-aes-128" is 2084814 (0x1fcfce) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-128 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-128 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-128" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGUR... | popen cmd is 1087 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-128' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=: | cmd( 160):'' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_M: | cmd( 240):Y_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='25: | cmd( 320):5.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16392' PLUT: | cmd( 400):O_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT: | cmd( 480):='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.25: | cmd( 560):5.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STAC: | cmd( 640):K='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IK: | cmd( 720):EV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUT: | cmd( 800):O_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_I: | cmd( 880):NFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO: | cmd( 960):_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED: | cmd(1040):='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1: unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. | addref fd@0x5634e17a1c78(1->2) (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a4038(0->1) (in clone_logger() at log.c:817) | delref hp@0x5634e17a75b8(1->0) (in delete_oriented_hp() at hostpair.c:360) | flush revival: connection 'westnet-eastnet-aes-128' wasn't on the list | delref vip@NULL (in discard_connection() at connections.c:262) | delref vip@NULL (in discard_connection() at connections.c:263) | Connection DB: deleting connection $2 | delref logger@0x5634e17a4038(1->0) (in delete_connection() at connections.c:214) | delref fd@0x5634e17a1c78(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | FOR_EACH_CONNECTION_... in conn_by_name | delref fd@0x5634e17a1c78(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a1c78 (in whack_handle_cb() at rcv_whack.c:903) | spent 2.47 (52.2) milliseconds in whack | spent 0.00224 (0.00225) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a4038(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 37 ed b5 67 f5 70 71 2b 8e 6a 4d 99 2e cf 74 ed | a6 32 3c aa ac 15 d8 18 ec 7d d2 db 7a 19 2a 3b | 9d 33 e2 e8 69 3d 0d 58 05 fb 7b 06 | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17a4038(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0824 (0.0826) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00481 (0.0048) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00321 (0.00318) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00169 (0.0016) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a4038(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 37 ed b5 67 f5 70 71 2b 8e 6a 4d 99 2e cf 74 ed | a6 32 3c aa ac 15 d8 18 ec 7d d2 db 7a 19 2a 3b | 9d 33 e2 e8 69 3d 0d 58 05 fb 7b 06 | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17a4038(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0601 (0.0602) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00133 (0.00133) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a4038(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 6a c3 f8 a0 76 2a 06 5c 0b 42 76 fa 7e fb 01 81 | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | 37 5d 9a 16 93 05 4d 27 a1 5a 47 44 29 dc 52 e4 | ab 9e 5b de ee e9 d4 7d f0 a4 6f 7b 20 dc a4 3b | 73 80 72 27 a9 bc 8d 52 2d 9f 57 c5 | **parse ISAKMP Message: | initiator SPI: 6a c3 f8 a0 76 2a 06 5c | responder SPI: 0b 42 76 fa 7e fb 01 81 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17a4038(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0654 (0.0656) milliseconds in handle_packet_cb() reading and processing packet | newref struct fd@0x5634e17a44e8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a44e8 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-256' | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | whack: connection 'westnet-eastnet-aes-256' | addref fd@0x5634e17a44e8(1->2) (in string_logger() at log.c:838) | newref string logger@0x5634e17a4038(0->1) (in add_connection() at connections.c:1998) | Connection DB: adding connection "westnet-eastnet-aes-256" $3 | FOR_EACH_CONNECTION_... in conn_by_name | added new connection westnet-eastnet-aes-256 with policy RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | ike (phase1) algorithm values: AES_CBC_256-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp=aes256-sha1 | ESP/AH string values: AES_CBC_256-HMAC_SHA1_96 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | saving left CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.00705 (0.0068) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | counting wild cards for @west is 0 | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | saving right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | spent 0.0892 (0.0934) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key matching right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1: can't find the private key matching the NSS CKAID | counting wild cards for @east is 0 | updating connection from left.host_addr | left host_port 500 | updating connection from right.host_addr | right host_port 500 | orienting westnet-eastnet-aes-256 | westnet-eastnet-aes-256 doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-256 doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-256 doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-256 doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-256 doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-256's this | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | newref hp@0x5634e17ab658(0->1) (in connect_to_host_pair() at hostpair.c:290) added IKEv2 connection "westnet-eastnet-aes-256" | ike_life: 3600; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | 192.0.1.0/24===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.0/24 | delref logger@0x5634e17a4038(1->0) (in add_connection() at connections.c:2026) | delref fd@0x5634e17a44e8(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | delref fd@0x5634e17a44e8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a44e8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.503 (0.511) milliseconds in whack | newref struct fd@0x5634e17aba08(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17aba08 (in whack_handle_cb() at rcv_whack.c:869) | whack: key | delref pkp@0x5634e17a7708(1->0) (in free_public_keyentry() at secrets.c:1591) add keyid @west | 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | 15 04 37 f9 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | newref struct pubkey@0x5634e17ac278(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17ac278(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17ac278(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.006 (0.00579) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | delref fd@0x5634e17aba08(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17aba08 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.148 (0.156) milliseconds in whack | newref struct fd@0x5634e17a5648(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a5648 (in whack_handle_cb() at rcv_whack.c:869) | whack: key | delref pkp@0x5634e17a6848(1->0) (in free_public_keyentry() at secrets.c:1591) add keyid @east | 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | 51 51 48 ef | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | newref struct pubkey@0x5634e17a7708(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17a7708(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17a7708(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | spent 0.0575 (0.0573) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key: can't find the private key matching the NSS CKAID | delref fd@0x5634e17a5648(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a5648 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.228 (0.262) milliseconds in whack | newref struct fd@0x5634e17a3908(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a3908 (in whack_handle_cb() at rcv_whack.c:869) | whack: initiate | FOR_EACH_CONNECTION_... in conn_by_name | connection 'westnet-eastnet-aes-256' +POLICY_UP | FOR_EACH_STATE_... in find_phase1_state | newref alloc logger@0x5634e1794058(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a3908(1->2) (in new_state() at state.c:577) | creating state object #5 at 0x5634e17a7bc8 | State DB: adding IKEv2 state #5 in UNDEFINED | pstats #5 ikev2.ike started | parent state #5: UNDEFINED(ignore) => PARENT_I0(ignore) | #5.st_v2_transition NULL -> PARENT_I0->PARENT_I1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #5 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744609.420362 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744609.420362 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes-256 | westnet-eastnet-aes-256 doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-256 doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-256 doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-256 doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-256 doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-256's this | start processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:544) | addref fd@0x5634e17a3908(2->3) (in add_pending() at pending.c:86) | queuing pending IPsec SA negotiating with 192.1.2.23 IKE SA #5 "westnet-eastnet-aes-256" "westnet-eastnet-aes-256" #5: initiating IKEv2 connection | constructing local IKE proposals for westnet-eastnet-aes-256 (IKE SA initiator selecting KE) | converting ike_info AES_CBC_256-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 "westnet-eastnet-aes-256": local IKE proposals (IKE SA initiator selecting KE): "westnet-eastnet-aes-256": 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a3908(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a3fc8(0->1) (in clone_logger() at log.c:817) | job 7 for #5: ikev2_outI1 KE (build KE and nonce): adding job to queue | state #5 has no .st_event to delete | #5 STATE_PARENT_I0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a75f8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: newref ptr-libevent@0x5634e17aa9e8 size 128 | #5 spent 0.133 (0.133) milliseconds in ikev2_parent_outI1() | RESET processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:640) | delref fd@0x5634e17a3908(4->3) (in whack_handle_cb() at rcv_whack.c:903) | spent 0.18 (0.179) milliseconds in whack | job 7 for #5: ikev2_outI1 KE (build KE and nonce): helper 7 starting job | "westnet-eastnet-aes-256" #5: spent 1.08 (1.11) milliseconds in helper 7 processing job 7 for state #5: ikev2_outI1 KE (pcr) | job 7 for #5: ikev2_outI1 KE (build KE and nonce): helper thread 7 sending result back to state | scheduling resume sending helper answer back to state for #5 | libevent_malloc: newref ptr-libevent@0x7f6a94006108 size 128 | helper thread 7 has nothing to do | processing resume sending helper answer back to state for #5 | start processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #5 MD (nil) | job 7 for #5: ikev2_outI1 KE (build KE and nonce): processing response from helper 7 | job 7 for #5: ikev2_outI1 KE (build KE and nonce): calling continuation function 0x5634df8f5fe7 | ikev2_parent_outI1_continue() for #5 STATE_PARENT_I0 | DH secret MODP2048@0x7f6a94006ba8: transferring ownership from helper KE to state #5 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | using existing local IKE proposals for connection westnet-eastnet-aes-256 (IKE SA initiator emitting local proposals): 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | Emitting ikev2_proposals ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 11 (0b) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 104 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | 7a 07 ef 5e 78 35 06 94 07 e0 b7 ec cb 3f dd d6 | fe 0b 9b 7e 28 34 af 67 1e 60 95 e4 39 56 a3 d1 | 9f a1 b6 7a 3f 0f fe 6a bb 47 fb a0 ea b5 6b 61 | 4e ae 19 1d 78 62 7b 9b 96 e5 c7 b8 7e fc 89 09 | d6 d5 52 73 9e c3 68 a4 d1 6f 6b 69 74 7f 9e d1 | a8 ac 5f d1 1c ec 45 63 d8 44 b8 8c a9 f2 36 13 | 6f 33 a7 13 32 33 e2 70 a8 de d4 20 bd da 2a 98 | 90 f0 0f 4e 01 8f 53 fe 78 92 62 f5 db e5 1b 82 | b7 dc 32 50 9b 89 2b 38 84 22 dc d9 6e 50 91 13 | 88 00 f0 45 c7 09 a0 8a 05 97 6e bd 74 4f 16 aa | fe e4 08 87 e8 bb 05 44 31 a9 0e c4 99 e7 0f 5a | f0 46 5e 0b 4d 2b c5 34 95 b5 ec 50 f7 db d7 bf | 53 87 e4 da 82 f1 c9 46 0b 1a e9 15 4e ba e4 a9 | 5d 8e 99 54 e5 0a 80 76 70 ee 6d 1a 95 c5 e3 82 | 43 9f 9b e0 b4 31 2f 11 29 53 a2 4a 0e d0 fb 3d | ee b6 96 b6 e7 29 cd 0e 0b 25 fc e5 8f a6 46 c0 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | c9 87 99 78 0a 7a ce ce 67 9d 76 4b b0 44 d6 72 | c4 95 92 df b9 f8 d9 4c 09 bc cb fb 11 94 83 43 | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | e5 0b d6 ad a8 7a c5 b0 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | eb 50 4f 62 b7 f2 0a bc 3d 73 11 cb 9a 31 20 68 | f8 cd a7 4a | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | eb 50 4f 62 b7 f2 0a bc 3d 73 11 cb 9a 31 20 68 | f8 cd a7 4a | emitting length of IKEv2 Notify Payload: 28 | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | e5 0b d6 ad a8 7a c5 b0 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | f1 87 75 0c 4f 6a 81 1f a6 be 27 47 73 d3 8a c2 | 21 5b d9 fa | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | f1 87 75 0c 4f 6a 81 1f a6 be 27 47 73 d3 8a c2 | 21 5b d9 fa | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 510 | [RE]START processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #5 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK | transitioning from state STATE_PARENT_I0 to state STATE_PARENT_I1 | Message ID: updating counters for #5 | Message ID: IKE #5 skipping update_recv as MD is fake | Message ID: IKE #5 scheduling EVENT_RETRANSMIT: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.420362 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=0 ike.wip.responder=-1 "westnet-eastnet-aes-256" #5: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a1fd8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #5 | libevent_malloc: newref ptr-libevent@0x5634e17a6a18 size 128 | #5 STATE_PARENT_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.422041 | Message ID: IKE #5 updating initiator sent message request 0: ike.initiator.sent=-1->0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.420362 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=-1->0 ike.wip.responder=-1 | Message ID: IKE #5 no pending message initiators to schedule: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.420362 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=0 ike.wip.responder=-1 | parent state #5: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes-256" #5: sent IKE_SA_INIT request | sending 510 bytes for STATE_PARENT_I0 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 01 fe 22 00 00 68 | 00 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 28 00 01 08 00 0e 00 00 7a 07 ef 5e | 78 35 06 94 07 e0 b7 ec cb 3f dd d6 fe 0b 9b 7e | 28 34 af 67 1e 60 95 e4 39 56 a3 d1 9f a1 b6 7a | 3f 0f fe 6a bb 47 fb a0 ea b5 6b 61 4e ae 19 1d | 78 62 7b 9b 96 e5 c7 b8 7e fc 89 09 d6 d5 52 73 | 9e c3 68 a4 d1 6f 6b 69 74 7f 9e d1 a8 ac 5f d1 | 1c ec 45 63 d8 44 b8 8c a9 f2 36 13 6f 33 a7 13 | 32 33 e2 70 a8 de d4 20 bd da 2a 98 90 f0 0f 4e | 01 8f 53 fe 78 92 62 f5 db e5 1b 82 b7 dc 32 50 | 9b 89 2b 38 84 22 dc d9 6e 50 91 13 88 00 f0 45 | c7 09 a0 8a 05 97 6e bd 74 4f 16 aa fe e4 08 87 | e8 bb 05 44 31 a9 0e c4 99 e7 0f 5a f0 46 5e 0b | 4d 2b c5 34 95 b5 ec 50 f7 db d7 bf 53 87 e4 da | 82 f1 c9 46 0b 1a e9 15 4e ba e4 a9 5d 8e 99 54 | e5 0a 80 76 70 ee 6d 1a 95 c5 e3 82 43 9f 9b e0 | b4 31 2f 11 29 53 a2 4a 0e d0 fb 3d ee b6 96 b6 | e7 29 cd 0e 0b 25 fc e5 8f a6 46 c0 29 00 00 24 | c9 87 99 78 0a 7a ce ce 67 9d 76 4b b0 44 d6 72 | c4 95 92 df b9 f8 d9 4c 09 bc cb fb 11 94 83 43 | 29 00 00 08 00 00 40 2e 29 00 00 0e 00 00 40 2f | 00 02 00 03 00 04 29 00 00 1c 00 00 40 04 eb 50 | 4f 62 b7 f2 0a bc 3d 73 11 cb 9a 31 20 68 f8 cd | a7 4a 00 00 00 1c 00 00 40 05 f1 87 75 0c 4f 6a | 81 1f a6 be 27 47 73 d3 8a c2 21 5b d9 fa | sent 1 messages | checking that a retransmit timeout_event was already | state #5 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17aa9e8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a75f8 | delref logger@0x5634e17a3fc8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a3908(3->2) (in free_logger() at log.c:854) | resume sending helper answer back to state for #5 suppresed complete_v2_state_transition() | delref mdp@NULL (in resume_handler() at server.c:743) | #5 spent 0.568 (0.609) milliseconds in resume sending helper answer back to state | stop processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6a94006108 | spent 0.00175 (0.00175) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8ef8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a3fc8(0->1) (in read_message() at demux.c:103) | *received 454 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 9e ce c5 d1 9d 9b 0f 46 67 cf 69 9a | 79 ef 0a 9b fc 32 0d ef f0 cd 05 3b 88 66 a7 35 | 59 2b 57 35 e7 29 40 eb 96 10 87 f9 e0 75 41 d6 | 71 3f f8 af e9 3b 33 ab 7d c1 39 0c 74 3a 3c 4d | 20 67 e2 26 bd fb 5b 50 72 b7 ae 0c 0e 57 69 70 | 00 04 d5 17 0f 62 68 96 5d 8a ed 25 6a 2a 06 c0 | 04 9b 46 25 8a cc 64 58 7d 71 32 bd 01 99 d2 ed | 7e 4e 26 9e b3 36 f8 f1 c0 24 98 87 d6 11 0e db | 1b 96 a6 b7 f3 79 ab 92 4f a1 1a 43 20 5b 67 62 | 1e 60 25 ba fe 96 cf fb c8 e4 d6 df 60 65 1a 50 | 5c 98 48 c5 20 05 0d 64 9e 1e 9d 79 02 8f 7d c6 | 96 e4 57 28 d1 42 c7 e2 f3 26 b8 1b 89 59 33 f8 | d9 43 aa 49 a9 77 7d 97 e9 4b b0 53 c9 cf ce da | 81 da 18 fe 18 e1 46 93 a7 71 d0 fd 2f 2c bf 66 | b5 36 a9 f9 c6 e8 d6 ae 00 19 14 16 ab a6 4c 63 | 94 ce 3a f5 b7 ba af a3 14 97 59 ca 55 9a b1 36 | 04 3a b7 32 29 00 00 24 d5 e4 4c f9 83 ac 77 24 | a8 6a 96 3c a2 f5 d1 d2 59 cb d1 40 a7 1d 35 0a | 54 af bc 70 0f 37 0b d8 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 66 4a 31 b9 93 5b 0d 97 00 6e | 51 01 74 d3 44 bc 2d ad 1f f6 00 00 00 1c 00 00 | 40 05 65 e0 97 4d 22 d3 94 15 3b 3c 6f a7 7e 50 | 3c bc 80 6e a9 f3 | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | length: 454 (00 00 01 c6) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response | State DB: found IKEv2 state #5 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) | #5 is idle | #5 idle | unpacking clear payloads | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SA (len=44) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | looking for message matching transition from STATE_PARENT_I1 | trying received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added | message has errors | trying received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload | message has errors | trying received REDIRECT notify response; resending IKE_SA_INIT request to new destination | message has errors | trying Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | matched unencrypted message | start processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1848) | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | ikev2 parent inR1: calculating g^{xy} in order to send I2 | using existing local IKE proposals for connection westnet-eastnet-aes-256 (IKE SA initiator accepting remote proposal): 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE initiator (accepting) 1 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 44 (00 2c) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048[first-match] | converting proposal to internal trans attrs | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | e5 0b d6 ad a8 7a c5 b0 | natd_hash: rcookie= | 4e f3 d1 eb 16 b6 5d 47 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 65 e0 97 4d 22 d3 94 15 3b 3c 6f a7 7e 50 3c bc | 80 6e a9 f3 | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | e5 0b d6 ad a8 7a c5 b0 | natd_hash: rcookie= | 4e f3 d1 eb 16 b6 5d 47 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 66 4a 31 b9 93 5b 0d 97 00 6e 51 01 74 d3 44 bc | 2d ad 1f f6 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f6a94006ba8: transferring ownership from state #5 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a3908(2->3) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a75f8(0->1) (in clone_logger() at log.c:817) | job 8 for #5: ikev2_inR1outI2 KE (compute dh (V2)): adding job to queue | state #5 has no .st_event to delete | #5 requesting EVENT_RETRANSMIT-pe@0x5634e17a1fd8 be deleted | libevent_free: delref ptr-libevent@0x5634e17a6a18 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a1fd8 | #5 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a6a18 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: newref ptr-libevent@0x5634e17aa9e8 size 128 | #5 spent 0.173 (0.177) milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE in v2_dispatch() | [RE]START processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #5 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | job 8 for #5: ikev2_inR1outI2 KE (compute dh (V2)): helper 1 starting job | suspending state #5 and saving MD 0x5634e17a8ef8 | addref md@0x5634e17a8ef8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #5 is busy; has suspended MD 0x5634e17a8ef8 | stop processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1850) | #5 spent 0.392 (0.451) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8ef8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.398 (0.458) milliseconds in handle_packet_cb() reading and processing packet | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=32 salt-size=0 | "westnet-eastnet-aes-256" #5: spent 0.632 (0.639) milliseconds in helper 1 processing job 8 for state #5: ikev2_inR1outI2 KE (pcr) | job 8 for #5: ikev2_inR1outI2 KE (compute dh (V2)): helper thread 1 sending result back to state | scheduling resume sending helper answer back to state for #5 | libevent_malloc: newref ptr-libevent@0x7f6aa8002b48 size 128 | helper thread 1 has nothing to do | processing resume sending helper answer back to state for #5 | start processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #5 MD 0x5634e17a8ef8 | job 8 for #5: ikev2_inR1outI2 KE (compute dh (V2)): processing response from helper 1 | job 8 for #5: ikev2_inR1outI2 KE (compute dh (V2)): calling continuation function 0x5634df8f5fe7 | ikev2_parent_inR1outI2_continue() for #5 STATE_PARENT_I1: g^{xy} calculated, sending I2 | DH secret MODP2048@0x7f6a94006ba8: transferring ownership from helper IKEv2 DH to state #5 | State DB: re-hashing IKEv2 state #5 IKE SPIi and SPI[ir] | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 to find private key for @west->@east of kind RSA | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes-256's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a3908(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a1fd8(0->1) (in clone_logger() at log.c:817) | job 9 for #5: computing responder signature (signature): adding job to queue | state #5 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17aa9e8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a6a18 | #5 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17aa9e8 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #5 | libevent_malloc: newref ptr-libevent@0x5634e17a49c8 size 128 | [RE]START processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #5 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | suspending state #5 and saving MD 0x5634e17a8ef8 | job 9 for #5: computing responder signature (signature): helper 2 starting job | hash to sign | 92 4f cb 97 d9 24 d9 93 e7 06 db 22 30 95 f0 f9 | addref md@0x5634e17a8ef8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #5 is busy; has suspended MD 0x5634e17a8ef8 | 59 b7 ad 4d 6f c1 b6 da 6d 1f 19 1c 05 e7 f5 88 | 1f e6 94 25 0e 04 fc 02 ea c1 a7 87 50 bb dd a5 | cb 16 b2 07 8b 90 18 c4 42 56 b8 16 99 1d 92 02 | delref logger@0x5634e17a75f8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | RSA_sign_hash: Started using NSS | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a3908(4->3) (in free_logger() at log.c:854) | resume sending helper answer back to state for #5 suppresed complete_v2_state_transition() | delref mdp@0x5634e17a8ef8(2->1) (in resume_handler() at server.c:743) | #5 spent 0.128 (0.133) milliseconds in resume sending helper answer back to state | stop processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6aa8002b48 | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes-256" #5: spent 3.05 (3.21) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes-256" #5: spent 3.07 (3.24) milliseconds in v2_auth_signature() | "westnet-eastnet-aes-256" #5: spent 3.08 (3.25) milliseconds in helper 2 processing job 9 for state #5: computing responder signature (signature) | job 9 for #5: computing responder signature (signature): helper thread 2 sending result back to state | scheduling resume sending helper answer back to state for #5 | libevent_malloc: newref ptr-libevent@0x7f6aa0002cd8 size 128 | helper thread 2 has nothing to do | processing resume sending helper answer back to state for #5 | start processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #5 MD 0x5634e17a8ef8 | job 9 for #5: computing responder signature (signature): processing response from helper 2 | job 9 for #5: computing responder signature (signature): calling continuation function 0x5634df82477f | newref alloc logger@0x5634e17a75f8(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a3908(3->4) (in new_state() at state.c:577) | creating state object #6 at 0x5634e17b0018 | State DB: adding IKEv2 state #6 in UNDEFINED | pstats #6 ikev2.child started | duplicating state object #5 "westnet-eastnet-aes-256" as #6 for IPSEC SA | #6 setting local endpoint to 192.1.2.45:500 from #5.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #5.#6 initializing (CHILD SA): ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.420362 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #6: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_I0(ignore) | #6.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #5 switching from IKE SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.420362 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=0->-1 ike.wip.responder=-1 | Message ID: CHILD #5.#6 switching to CHILD SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.420362 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=-1->0 child.wip.responder=-1 | switching IKEv2 MD.ST from IKE #5 PARENT_I1 to CHILD #6 V2_IKE_AUTH_CHILD_I0 (in ikev2_parent_inR1outI2_auth_signature_continue() at ikev2_parent.c:2155) | state #5 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17a49c8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17aa9e8 | #5 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_SA_REPLACE-pe@0x5634e17a49c8 | inserting event EVENT_SA_REPLACE, timeout in 120 seconds for #5 | libevent_malloc: newref ptr-libevent@0x7f6aa8002b48 size 128 | parent state #5: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | IDr payload will be sent | ****emit IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Initiator - Payload | my identity: 77 65 73 74 | emitting length of IKEv2 Identification - Initiator - Payload: 12 | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of their IDr into IKEv2 Identification - Responder - Payload | their IDr: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | not sending INITIAL_CONTACT | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 8b 20 01 d9 80 0a c6 39 91 8a 70 06 a5 6e 93 d7 | 01 be 27 d5 05 36 3f a0 e1 89 66 1a cf 9b ae da | a8 6a a2 3a 8a b2 11 80 91 b6 fc 1a 93 db cd 3a | 0f 98 4c 65 5a 94 cc 2e 6a cd e8 16 6f 42 e1 6d | f9 6b 32 29 ae bb ff 16 fd 74 2c 31 9e 60 c4 f4 | b2 ec b8 87 24 36 1a 2d 17 44 db 17 f9 51 fe 18 | 43 d5 79 d3 33 81 2d c9 d2 ab ae 9f 4a 0e d7 95 | e3 0d f5 33 67 a5 97 23 3b ed 2c ff bf 49 67 02 | 0c 7a 09 84 b8 db 4a 3b ac db 8f 0b 6d 9c ba c4 | f2 e0 9b 68 74 05 23 3a a4 42 7d 8f 57 d0 fb 3d | 6c e9 6f 39 5f cd 56 1d d6 c4 36 45 a7 a8 e2 75 | 55 39 7d a0 71 91 5b 13 10 e1 70 4f 6f 10 f1 1b | 09 b8 ed 69 e4 0a e4 a5 58 6f 27 b1 17 d4 5c 96 | bf 95 bf 1d 57 5d 0a 27 76 20 5c 00 f2 d9 7f 99 | 93 aa 2f df 32 00 a9 18 2c f7 46 f2 09 ef de 48 | 20 f2 47 c4 8c 6d 48 fe ba 50 ff 0b 8a eb c0 60 | 23 5b 4d 0e 7c ad ce e0 59 0e c4 74 37 bf 4f 7c | fd 0f | emitting length of IKEv2 Authentication Payload: 350 | getting first pending from state #5 | delref fd@0x5634e17a3908(4->3) (in first_pending() at pending.c:318) | addref fd@0x5634e17a3908(3->4) (in first_pending() at pending.c:319) | netlink_get_spi: allocated 0xbdec7384 for esp.0@192.1.2.45 | constructing ESP/AH proposals with all DH removed for westnet-eastnet-aes-256 (IKE SA initiator emitting ESP/AH proposals) | converting proposal AES_CBC_256-HMAC_SHA1_96 to ikev2 ... | ... ikev2_proposal: 1:ESP=AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED "westnet-eastnet-aes-256": local ESP/AH proposals (IKE SA initiator emitting ESP/AH proposals): "westnet-eastnet-aes-256": 1:ESP=AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | Emitting ikev2_proposals ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discard DH=NONE when counting transforms (multiple 0; allow single 0) | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: bd ec 73 84 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discard DH=NONE when emitting proposal (multiple 0; allow single 0) | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | adding 14 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 512 | emitting length of ISAKMP Message: 540 | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 540 (00 00 02 1c) | **parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 512 (02 00) | opening output PBS reply frag packet | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 16 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 466 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment: | 24 00 00 0c 02 00 00 00 77 65 73 74 27 00 00 0c | 02 00 00 00 65 61 73 74 21 00 01 5e 0e 00 00 00 | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 8b 20 01 d9 80 0a c6 39 91 8a 70 06 | a5 6e 93 d7 01 be 27 d5 05 36 3f a0 e1 89 66 1a | cf 9b ae da a8 6a a2 3a 8a b2 11 80 91 b6 fc 1a | 93 db cd 3a 0f 98 4c 65 5a 94 cc 2e 6a cd e8 16 | 6f 42 e1 6d f9 6b 32 29 ae bb ff 16 fd 74 2c 31 | 9e 60 c4 f4 b2 ec b8 87 24 36 1a 2d 17 44 db 17 | f9 51 fe 18 43 d5 79 d3 33 81 2d c9 d2 ab ae 9f | 4a 0e d7 95 e3 0d f5 33 67 a5 97 23 3b ed 2c ff | bf 49 67 02 0c 7a 09 84 b8 db 4a 3b ac db 8f 0b | 6d 9c ba c4 f2 e0 9b 68 74 05 23 3a a4 42 7d 8f | 57 d0 fb 3d 6c e9 6f 39 5f cd 56 1d d6 c4 36 45 | a7 a8 e2 75 55 39 7d a0 71 91 5b 13 10 e1 70 4f | 6f 10 f1 1b 09 b8 ed 69 e4 0a e4 a5 58 6f 27 b1 | 17 d4 5c 96 bf 95 bf 1d 57 5d 0a 27 76 20 5c 00 | f2 d9 7f 99 93 aa 2f df 32 00 a9 18 2c f7 46 f2 | 09 ef de 48 20 f2 47 c4 8c 6d 48 fe ba 50 ff 0b | 8a eb c0 60 23 5b 4d 0e 7c ad ce e0 59 0e c4 74 | 37 bf 4f 7c fd 0f 2c 00 00 2c 00 00 00 28 01 03 | 04 03 bd ec 73 84 03 00 00 0c 01 00 00 0c 80 0e | 01 00 03 00 00 08 03 00 00 02 00 00 00 08 05 00 | 00 00 2d 00 00 18 01 00 00 00 07 00 00 10 00 00 | ff ff c0 00 01 00 c0 00 01 ff 00 00 00 18 01 00 | 00 00 07 00 00 10 00 00 ff ff c0 00 02 00 c0 00 | 02 ff | adding 14 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 516 | emitting length of ISAKMP Message: 544 | recording fragment 1 | delref logger@0x5634e17a1fd8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a3908(4->3) (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #5 switched MD.ST to #6 | suspend processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #6 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #6 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_I0 PARENT_I1->PARENT_I2 with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I1 to state STATE_PARENT_I2 | Message ID: updating counters for #6 | Message ID: CHILD #5.#6 XXX: no EVENT_RETRANSMIT to clear; suspect IKE->CHILD switch: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.420362 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: CHILD #5.#6 updating initiator received message response 0: ike.initiator.sent=0 ike.initiator.recv=-1->0 ike.initiator.last_contact=744609.420362->744609.429746 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=0->-1 child.wip.responder=-1 | Message ID: CHILD #5.#6 scheduling EVENT_RETRANSMIT: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.429746 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=1 child.wip.responder=-1 "westnet-eastnet-aes-256" #6: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a1fd8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #6 | libevent_malloc: newref ptr-libevent@0x5634e17a6848 size 128 | #6 STATE_V2_IKE_AUTH_CHILD_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.429778 | Message ID: CHILD #5.#6 updating initiator sent message request 1: ike.initiator.sent=0->1 ike.initiator.recv=0 ike.initiator.last_contact=744609.429746 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=-1->1 child.wip.responder=-1 | Message ID: IKE #5 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.429746 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #6: V2_IKE_AUTH_CHILD_I0(ignore) => PARENT_I2(open IKE SA) | announcing the state transition "westnet-eastnet-aes-256" #5: sent IKE_AUTH request {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 544 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 6c 82 97 bf 7f e2 0c 55 4b 9d 01 99 | 9e c9 33 41 ee a5 14 52 7e 12 9b 88 88 e5 13 1e | 46 b2 3d ab d8 77 e2 24 d6 52 55 74 49 4b c0 f8 | 79 1f 73 fc a1 50 e5 c9 d6 a8 51 16 3d 6d ae b4 | b2 18 b0 52 53 e4 36 fe 01 9f 05 b4 c9 3f 74 3e | 5a 23 4c 60 36 7e c5 42 3b 29 7e 39 84 56 f5 f6 | cc 38 01 2b 47 5a 13 ea 90 18 87 8e 5c e5 16 bd | df aa 01 13 f1 d8 0d b5 0a 1f 75 61 9b e1 a9 79 | 61 e1 1b 09 f0 bb 3f 9f 90 9c 91 31 ad 52 0f 60 | d8 f5 c0 94 9c 08 32 da 4e 01 9f ee 18 90 82 85 | 29 e7 60 62 af 58 9d 6d 82 d6 23 04 ef 48 a2 59 | 1d 04 76 67 71 ad 6a bd d5 04 b3 71 d4 d4 3a 42 | 4a 92 e4 17 20 ea ce b9 17 24 1d 26 81 d2 3b 7b | 09 9f 63 79 09 57 06 41 17 1b 29 23 e9 c6 87 e8 | 16 cf 0e 31 50 e1 ba fb ef 2d 4c fb f1 00 76 ba | 22 f7 6f 79 91 f5 09 fb 16 85 aa e4 a3 33 7f ff | 32 58 40 4e de 51 30 27 49 f9 d5 23 8b fa 94 4e | b1 22 4a 21 c8 cb 43 0b b9 75 51 8d 88 4e 09 be | 39 08 55 70 99 d5 38 3e 01 14 03 11 d8 db d5 06 | 12 bb 51 29 ea 22 6c 2f 3d 06 83 06 29 70 87 b8 | 2e 02 d7 10 fa bc 5c 24 96 a4 1b 15 3c f5 21 e5 | ed 69 fa f7 19 00 b7 cb 8c 72 0c 9e d0 77 b5 13 | 13 ff b6 cd 65 df 45 58 d5 68 14 17 88 4e 6f 39 | 95 a6 19 d1 4f 44 72 5b 6a 3f 44 7d 15 f8 31 e8 | 32 83 39 93 8b 59 fd 7a b6 28 c1 c1 f1 44 d6 c0 | 06 28 c9 e2 8a d1 46 a7 41 5c 81 5b e8 88 21 58 | 0b e8 4b ed fe 39 46 c7 f5 07 14 b1 78 87 47 8e | 96 c4 31 e0 47 66 57 5f 7d 92 13 4e 55 98 d6 5e | 65 ae 6c c9 b7 d4 b4 5e 8b 3d db 1c 05 7e 23 fb | 43 17 e3 18 6c ae 3a 92 45 dc e7 af 9f 99 bc 06 | 3d 60 51 06 70 4a 3c ca 53 2e 4a 48 3a 2f e2 d9 | 47 31 9d 8c 59 18 fd 6a d0 01 e9 b9 ea b7 5d ab | sent 1 messages | checking that a retransmit timeout_event was already | state #6 has no .st_event to delete | delref mdp@0x5634e17a8ef8(1->0) (in resume_handler() at server.c:743) | delref logger@0x5634e17a3fc8(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #5 spent 1.05 (2.59) milliseconds in resume sending helper answer back to state | stop processing: state #6 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6aa0002cd8 | spent 0.00244 (0.00244) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8ef8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17aa9e8(0->1) (in read_message() at demux.c:103) | *received 524 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | 5c e2 b0 1e 8a 59 4a 46 09 93 e3 64 3b 8e 4f 63 | bf da 03 bb 9c 37 f4 c5 2c 1c 68 1a 0e 55 74 65 | d5 7e e7 48 7c 80 7c 55 75 de 91 e0 f7 36 d4 30 | e8 18 c9 92 90 ea 0d 3f 1d d6 df 3e 42 c0 74 69 | 52 24 99 43 da fa fe dc 82 09 99 6f 6d 12 bb d7 | 7d c8 78 9a c1 82 65 0c e0 b9 c0 f6 ba 98 db 11 | 28 d1 8a 6a 66 16 9d 27 ff 61 4c 25 4d 36 8d 2e | 60 a7 35 65 cf 20 fb 50 8a 11 9b db b8 23 5e 27 | 0f e1 7c c3 6c 51 6f 79 93 d2 03 cf 1a a5 d8 9f | 49 e9 4b 84 f4 f0 85 54 04 4b 6a 8b 34 97 5b 50 | ff 25 19 42 df 43 9f 94 f0 9e 44 94 13 07 61 0b | bc 21 cb 5b 21 1e 48 5c de cc 1d b1 d8 9e b3 81 | a7 ad b9 17 15 6f cb 92 3e 3d 4e 8d ad 63 29 8c | f5 c5 5f 3b e2 8a 7b c6 9e 99 19 0c 35 3a ab af | 33 66 45 9c 2e b0 59 3f bd 36 a8 1b 1e 34 67 90 | 14 ad 8e 9f 10 29 f9 9e 7c a2 37 00 a4 90 18 dd | 9f 72 49 f7 bd 89 af 85 32 70 ef 4c 50 f8 d4 8c | f8 da a8 eb 94 27 94 b6 39 2b 85 7c f9 34 a4 97 | 40 7b 43 88 d6 44 1d c5 5d ff 71 c6 00 eb fd eb | 4d 71 c8 2f 70 1d 07 9b 51 96 a6 cc a1 97 5e de | ce e7 aa 02 92 7a d0 0f 95 12 7c 10 9e 40 37 49 | 4e 41 66 2b 6b c3 70 03 76 79 98 d1 0d c2 c0 75 | f7 c7 95 d9 a5 93 41 92 64 c1 ef c0 b4 07 f4 02 | 9c 3a 86 47 1b 34 cc c5 81 08 38 cd c3 69 2e d8 | d2 79 18 64 9a 94 78 32 81 69 4c 31 43 5b 8f 0a | cc 0d 4f 00 ae 82 0c 57 7e 5e 37 74 38 fb fa 1d | 15 b9 65 d6 c7 f6 cf e9 eb fa cf 75 23 ed d4 3e | d5 d8 04 55 00 4d 10 76 19 76 6c ea 76 aa a3 fc | 55 e1 14 24 69 2c 6a 9e a2 d6 89 da 20 d9 57 f5 | de ec 89 63 bc 5c 46 a3 aa 5e 86 cf 91 84 44 99 | 1a cb 75 3c 3d b2 0c b9 de 67 95 b2 | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | length: 524 (00 00 02 0c) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #5 in PARENT_I2 (find_v2_ike_sa) | start processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) | State DB: found IKEv2 state #6 in PARENT_I2 (find_v2_sa_by_initiator_wip) | #6 is idle | #6 idle | suspend processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | start processing: state #6 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 496 (01 f0) | processing payload: ISAKMP_NEXT_v2SK (len=492) | #6 in state PARENT_I2: sent IKE_AUTH request | authenticator matched | #5 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Initiator: process IKE_AUTH response | calling processor Initiator: process IKE_AUTH response | no certs to decode | offered CA: '%none' "westnet-eastnet-aes-256" #6: IKEv2 mode peer ID is ID_FQDN: '@east' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @east | trying all preloaded keys public keys for RSA key that matches ID: @east | trying '@east' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | b8 da ea 51 16 17 6d c1 23 e6 47 7c 38 3f 55 53 | 1a b9 76 3b 39 ce 5a 49 4a 59 d6 12 65 45 c5 d4 | df 3e a7 7c 5a 79 c1 af 60 5c 00 a8 e3 d4 43 cf | 1d 0b d2 a3 64 dc b1 55 b2 1a 14 82 60 04 c0 3f | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x5634e17a7708(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQO9bJbr3 [preloaded keys] | #5 spent 0.0588 (0.0588) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes-256" #5: authenticated using RSA with SHA2_512 | #5 spent 0.0948 (0.0946) milliseconds in ikev2_verify_rsa_hash() | parent state #5: PARENT_I2(open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #5 will start re-keying in 2568 seconds with margin of 1032 seconds (attempting re-key) | state #5 deleting .st_event EVENT_SA_REPLACE | libevent_free: delref ptr-libevent@0x7f6aa8002b48 | free_event_entry: delref EVENT_SA_REPLACE-pe@0x5634e17a49c8 | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17a2448 | inserting event EVENT_SA_REKEY, timeout in 2568 seconds for #5 | libevent_malloc: newref ptr-libevent@0x7f6aa0002cd8 size 128 | pstats #5 ikev2.ike established | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | evaluating our conn="westnet-eastnet-aes-256" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found an acceptable TSi/TSr Traffic Selector | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | using existing local ESP/AH proposals for westnet-eastnet-aes-256 (IKE_AUTH initiator accepting remote ESP/AH proposal): 1:ESP=AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH initiator accepting remote ESP/AH proposal 1 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | cb 6b 26 93 | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH initiator accepting remote ESP/AH proposal ikev2_proposal: 1:ESP=AES_CBC_256-HMAC_SHA1_96-DISABLED SPI=cb6b2693 | converting proposal to internal trans attrs | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=32 .salt_size=0 keymat_len=52 | install_ipsec_sa() for #6: inbound and outbound | could_route called for westnet-eastnet-aes-256; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-256 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-256 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-256" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 256 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=256 transid=12, key_size=32, encryptalg=12 | st->st_esp.keymat_len=52 is encrypt_keymat_size=32 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-256' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16397 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.cb6b2693@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 256 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=256 transid=12, key_size=32, encryptalg=12 | st->st_esp.keymat_len=52 is encrypt_keymat_size=32 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-256' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16397 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.bdec7384@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes-256" is 2084814 (0x1fcfce) | add inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.10000@192.1.2.45 using reqid 16397 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #6: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-256 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-256 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-256" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-aes-256 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #6 | priority calculation of connection "westnet-eastnet-aes-256" is 2084814 (0x1fcfce) | eroute_connection add eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23 using reqid 16397 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.cb6b2693@192.1.2.23 | get_sa_info esp.bdec7384@192.1.2.45 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGU... | popen cmd is 1144 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PL: | cmd( 160):UTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLI: | cmd( 240):ENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255: | cmd( 320):.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_: | cmd( 400):TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.: | cmd( 480):0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.: | cmd( 560):0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfr: | cmd( 640):m' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS: | cmd( 720):+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT: | cmd( 800):' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER: | cmd( 880):_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0': | cmd( 960): PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES=': | cmd(1040):0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xcb6b2693 SPI_OUT=0xbde: | cmd(1120):c7384 ipsec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | get_sa_info esp.cb6b2693@192.1.2.23 | get_sa_info esp.bdec7384@192.1.2.45 | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_... | popen cmd is 1149 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=: | cmd( 160):'' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_M: | cmd( 240):Y_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='25: | cmd( 320):5.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUT: | cmd( 400):O_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT=: | cmd( 480):'192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255: | cmd( 560):.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK: | cmd( 640):='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNE: | cmd( 720):L+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERM: | cmd( 800):ANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO: | cmd( 880):_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVE: | cmd( 960):R='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBY: | cmd(1040):TES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xcb6b2693 SPI_OUT=: | cmd(1120):0xbdec7384 ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | get_sa_info esp.cb6b2693@192.1.2.23 | get_sa_info esp.bdec7384@192.1.2.45 | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_C... | popen cmd is 1147 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):aes-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='': | cmd( 160): PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_: | cmd( 240):CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.: | cmd( 320):255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_: | cmd( 400):SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='1: | cmd( 480):92.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.2: | cmd( 560):55.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK=': | cmd( 640):xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+: | cmd( 720):PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMAN: | cmd( 800):ENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_P: | cmd( 880):EER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER=: | cmd( 960):'0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTE: | cmd(1040):S='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xcb6b2693 SPI_OUT=0x: | cmd(1120):bdec7384 ipsec _updown 2>&1: "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-256" #6: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "westnet-eastnet-aes-256", setting eroute_owner {spd=0x5634e17abc58,sr=0x5634e17abc58} to #6 (was #0) (newest_ipsec_sa=#0) | inR2: instance westnet-eastnet-aes-256[0], setting IKEv2 newest_ipsec_sa to #6 (was #0) (spd.eroute=#6) cloned from #5 | #6 spent 1.51 (86.7) milliseconds in processing: Initiator: process IKE_AUTH response in v2_dispatch() | [RE]START processing: state #6 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #6 complete_v2_state_transition() PARENT_I2->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I2 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #6 | Message ID: CHILD #5.#6 clearing EVENT_RETRANSMIT as response received: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.429746 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=-1 child.wip.responder=-1 | #6 requesting EVENT_RETRANSMIT-pe@0x5634e17a1fd8 be deleted | libevent_free: delref ptr-libevent@0x5634e17a6848 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a1fd8 | #6 STATE_PARENT_I2: retransmits: cleared | Message ID: CHILD #5.#6 updating initiator received message response 1: ike.initiator.sent=1 ike.initiator.recv=0->1 ike.initiator.last_contact=744609.429746->744609.532446 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=1->-1 child.wip.responder=-1 | Message ID: CHILD #5.#6 skipping update_send as nothing to send: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744609.532446 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #5 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744609.532446 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #6: PARENT_I2(open IKE SA) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #6 ikev2.child established | announcing the state transition "westnet-eastnet-aes-256" #6: negotiated connection [192.0.1.0-192.0.1.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes-256" #6: IPsec SA established tunnel mode {ESP=>0xcb6b2693 <0xbdec7384 xfrm=AES_CBC_256-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | releasing #6's fd-fd@0x5634e17a3908 because IKEv2 transitions finished | delref fd@0x5634e17a3908(3->2) (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #6's IKE SA #5 | unpending state #5 connection "westnet-eastnet-aes-256" | delete from pending Child SA with 192.1.2.23 "westnet-eastnet-aes-256" | delref fd@0x5634e17a3908(2->1) (in delete_pending() at pending.c:218) | removing pending policy for no connection {0x5634e17a3218} | releasing #5's fd-fd@0x5634e17a3908 because IKEv2 transitions finished so releaseing IKE SA | delref fd@0x5634e17a3908(1->0) (in success_v2_state_transition() at ikev2.c:3222) | freeref fd-fd@0x5634e17a3908 (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #6 will start re-keying in 28154 seconds with margin of 646 seconds (attempting re-key) | state #6 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17a1fd8 | inserting event EVENT_SA_REKEY, timeout in 28154 seconds for #6 | libevent_malloc: newref ptr-libevent@0x5634e17a40a8 size 128 | stop processing: state #6 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) | #5 spent 1.53 (86.9) milliseconds | #5 spent 1.92 (87.3) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8ef8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17aa9e8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 1.94 (87.3) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00475 (0.00469) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00278 (0.00276) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00254 (0.00254) milliseconds in signal handler PLUTO_SIGCHLD | newref struct fd@0x5634e17a3908(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a3908 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-256' | FOR_EACH_CONNECTION_... in conn_by_name "westnet-eastnet-aes-256": terminating SAs using this connection | connection 'westnet-eastnet-aes-256' -POLICY_UP | FOR_EACH_STATE_... in shared_phase1_connection | connection not shared - terminating IKE and IPsec SA | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #6 | start processing: state #6 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a3908(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #6 ikev2.child deleted completed | #6 main thread spent 1.51 (86.7) milliseconds helper thread spent 0 (0) milliseconds in total | [RE]START processing: state #6 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-256" #6: deleting state (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.165409s and sending notification | child state #6: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.cb6b2693@192.1.2.23 | get_sa_info esp.bdec7384@192.1.2.45 "westnet-eastnet-aes-256" #6: ESP traffic information: in=0B out=0B | unsuspending #6 MD (nil) | should_send_delete: yes | #6 send IKEv2 delete notification for STATE_V2_ESTABLISHED_CHILD_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting 4 raw bytes of local spis into IKEv2 Delete Payload | local spis: bd ec 73 84 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | ad 8d 2e f2 02 aa a1 c3 e6 b0 d1 4c 99 66 d5 80 | 1a 57 78 58 46 b9 01 a2 d8 e1 6c e3 20 25 2f 87 | df 3d 8f 0c 90 1a 99 18 ee 61 98 a6 | sent 1 messages | Message ID: IKE #5 sender #6 in send_delete hacking around record 'n' send | Message ID: IKE #5 scheduling EVENT_RETRANSMIT: ike.initiator.sent=2 ike.initiator.recv=1 ike.initiator.last_contact=744609.532446 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=2 ike.wip.responder=-1 "westnet-eastnet-aes-256" #5: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a4038 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #5 | libevent_malloc: newref ptr-libevent@0x5634e17aa9e8 size 128 | #5 STATE_V2_ESTABLISHED_IKE_SA: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.594619 | Message ID: IKE #5 updating initiator sent message request 2: ike.initiator.sent=1->2 ike.initiator.recv=1 ike.initiator.last_contact=744609.532446 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=-1->2 ike.wip.responder=-1 | state #6 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x5634e17a40a8 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17a1fd8 | #6 STATE_V2_ESTABLISHED_CHILD_SA: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.cb6b2693@192.1.2.23 | get_sa_info esp.bdec7384@192.1.2.45 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIG... | popen cmd is 1143 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' : | cmd( 160):PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_C: | cmd( 240):LIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.2: | cmd( 320):55.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_S: | cmd( 400):A_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='19: | cmd( 480):2.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.25: | cmd( 560):5.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='x: | cmd( 640):frm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+P: | cmd( 720):FS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT': | cmd( 800): PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_: | cmd( 880):DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' : | cmd( 960):PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES='0: | cmd(1040):' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xcb6b2693 SPI_OUT=0xbdec: | cmd(1120):7384 ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes-256' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-256" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.cb6b2693@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.cb6b2693@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-aes-256" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => unk.10000@192.1.2.45 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.bdec7384@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.bdec7384@192.1.2.45 included non-error error | in connection_discard for connection westnet-eastnet-aes-256 | State DB: deleting IKEv2 state #6 in ESTABLISHED_CHILD_SA | child state #6: ESTABLISHED_CHILD_SA(established CHILD SA) => UNDEFINED(ignore) | releasing #6's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a3908(2->1) (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #6 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e17a75f8(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | state #5 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #5 | start processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a3908(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #5 ikev2.ike deleted completed | #5 main thread spent 4.19 (91.2) milliseconds helper thread spent 4.8 (5) milliseconds in total | [RE]START processing: state #5 connection "westnet-eastnet-aes-256" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-256" #5: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.185278s and sending notification | parent state #5: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #5 MD (nil) | should_send_delete: yes | #5 send IKEv2 delete notification for STATE_V2_ESTABLISHED_IKE_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting length of IKEv2 Delete Payload: 8 | adding 8 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #5) | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | 9d 4c 8e 33 30 25 53 d4 ba 90 06 38 8c 32 80 07 | 16 d7 48 3d 01 82 81 6d 52 91 4a 1c 44 d8 3b 67 | 43 2d fb 75 14 8e 48 a9 40 e0 2c 15 | sent 1 messages | Message ID: IKE #5 sender #5 in send_delete hacking around record 'n' send | Message ID: IKE #5 XXX: expecting sender.wip.initiator 2 == -1 - suspect record'n'send out-of-order?): ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744609.532446 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #5 XXX: EVENT_RETRANSMIT already scheduled -- suspect record'n'send: ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744609.532446 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #5 updating initiator sent message request 3: ike.initiator.sent=2->3 ike.initiator.recv=1 ike.initiator.last_contact=744609.532446 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.420362 ike.wip.initiator=2->3 ike.wip.responder=-1 | state #5 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f6aa0002cd8 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17a2448 | #5 requesting EVENT_RETRANSMIT-pe@0x5634e17a4038 be deleted | libevent_free: delref ptr-libevent@0x5634e17aa9e8 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a4038 | #5 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes-256 | State DB: deleting IKEv2 state #5 in ESTABLISHED_IKE_SA | parent state #5: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #5's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a3908(2->1) (in delete_state() at state.c:1195) | delref pkp@0x5634e17a7708(2->1) (in delete_state() at state.c:1202) | stop processing: state #5 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e1794058(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | FOR_EACH_CONNECTION_... in conn_by_name | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-aes-256' to 'delete' for rt_kind 'unrouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-256" is 2084814 (0x1fcfce) | priority calculation of connection "westnet-eastnet-aes-256" is 2084814 (0x1fcfce) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-256 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-256 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-256" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGUR... | popen cmd is 1087 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-256' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=: | cmd( 160):'' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_M: | cmd( 240):Y_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='25: | cmd( 320):5.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16396' PLUT: | cmd( 400):O_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT: | cmd( 480):='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.25: | cmd( 560):5.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STAC: | cmd( 640):K='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IK: | cmd( 720):EV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUT: | cmd( 800):O_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_I: | cmd( 880):NFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO: | cmd( 960):_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED: | cmd(1040):='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1: unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. | addref fd@0x5634e17a3908(1->2) (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a3fc8(0->1) (in clone_logger() at log.c:817) | delref hp@0x5634e17ab658(1->0) (in delete_oriented_hp() at hostpair.c:360) | flush revival: connection 'westnet-eastnet-aes-256' wasn't on the list | delref vip@NULL (in discard_connection() at connections.c:262) | delref vip@NULL (in discard_connection() at connections.c:263) | Connection DB: deleting connection $3 | delref logger@0x5634e17a3fc8(1->0) (in delete_connection() at connections.c:214) | delref fd@0x5634e17a3908(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | FOR_EACH_CONNECTION_... in conn_by_name | delref fd@0x5634e17a3908(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a3908 (in whack_handle_cb() at rcv_whack.c:903) | spent 1.82 (45.2) milliseconds in whack | spent 0.00237 (0.00237) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17aa978(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | f4 0c ac 38 a4 ef 5b b8 28 6d 03 77 2d e7 43 65 | 94 a6 a3 b2 dd d4 57 ef bd fa 13 c8 d9 c5 cf 5f | d9 12 f1 de 27 8c dc 2a 0a ac 13 49 | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17aa978(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.106 (0.106) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00483 (0.00479) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00308 (0.00306) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.00176 (0.00183) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17aa978(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | f4 0c ac 38 a4 ef 5b b8 28 6d 03 77 2d e7 43 65 | 94 a6 a3 b2 dd d4 57 ef bd fa 13 c8 d9 c5 cf 5f | d9 12 f1 de 27 8c dc 2a 0a ac 13 49 | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17aa978(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0825 (0.0826) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00169 (0.00167) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17aa978(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | e5 0b d6 ad a8 7a c5 b0 4e f3 d1 eb 16 b6 5d 47 | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | 11 f3 2e 58 54 3b a5 17 7d 5f 4c fa a4 d1 42 b1 | 56 96 0b 11 03 cb 5e fd e4 8f 0c ed 9d 81 9f 6f | 2e 08 d7 9b 9d fa 6f 23 30 c3 ab 59 | **parse ISAKMP Message: | initiator SPI: e5 0b d6 ad a8 7a c5 b0 | responder SPI: 4e f3 d1 eb 16 b6 5d 47 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17aa978(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0829 (0.083) milliseconds in handle_packet_cb() reading and processing packet | newref struct fd@0x5634e17a6a88(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a6a88 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-mix-1' | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | whack: connection 'westnet-eastnet-aes-mix-1' | addref fd@0x5634e17a6a88(1->2) (in string_logger() at log.c:838) | newref string logger@0x5634e17aa978(0->1) (in add_connection() at connections.c:1998) | Connection DB: adding connection "westnet-eastnet-aes-mix-1" $4 | FOR_EACH_CONNECTION_... in conn_by_name | added new connection westnet-eastnet-aes-mix-1 with policy RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | ike (phase1) algorithm values: AES_CBC_128-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp=aes256-sha1 | ESP/AH string values: AES_CBC_256-HMAC_SHA1_96 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | saving left CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.00725 (0.0068) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | counting wild cards for @west is 0 | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | saving right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | spent 0.0864 (0.0862) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key matching right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1: can't find the private key matching the NSS CKAID | counting wild cards for @east is 0 | updating connection from left.host_addr | left host_port 500 | updating connection from right.host_addr | right host_port 500 | orienting westnet-eastnet-aes-mix-1 | westnet-eastnet-aes-mix-1 doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-mix-1 doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-mix-1 doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-mix-1 doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-mix-1 doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-mix-1's this | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | newref hp@0x5634e17ab658(0->1) (in connect_to_host_pair() at hostpair.c:290) added IKEv2 connection "westnet-eastnet-aes-mix-1" | ike_life: 3600; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | 192.0.1.0/24===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.0/24 | delref logger@0x5634e17aa978(1->0) (in add_connection() at connections.c:2026) | delref fd@0x5634e17a6a88(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | delref fd@0x5634e17a6a88(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a6a88 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.55 (0.552) milliseconds in whack | newref struct fd@0x5634e17a52d8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a52d8 (in whack_handle_cb() at rcv_whack.c:869) | whack: key | delref pkp@0x5634e17ac278(1->0) (in free_public_keyentry() at secrets.c:1591) add keyid @west | 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | 15 04 37 f9 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | newref struct pubkey@0x5634e17a6848(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17a6848(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17a6848(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.00673 (0.00652) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | delref fd@0x5634e17a52d8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a52d8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.196 (0.199) milliseconds in whack | newref struct fd@0x5634e17a1fd8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a1fd8 (in whack_handle_cb() at rcv_whack.c:869) | whack: key | delref pkp@0x5634e17a7708(1->0) (in free_public_keyentry() at secrets.c:1591) add keyid @east | 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | 51 51 48 ef | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | newref struct pubkey@0x5634e17ac278(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17ac278(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17ac278(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | spent 0.0388 (0.0389) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key: can't find the private key matching the NSS CKAID | delref fd@0x5634e17a1fd8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a1fd8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.143 (0.143) milliseconds in whack | newref struct fd@0x5634e17a3908(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a3908 (in whack_handle_cb() at rcv_whack.c:869) | whack: initiate | FOR_EACH_CONNECTION_... in conn_by_name | connection 'westnet-eastnet-aes-mix-1' +POLICY_UP | FOR_EACH_STATE_... in find_phase1_state | newref alloc logger@0x5634e1793f28(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a3908(1->2) (in new_state() at state.c:577) | creating state object #7 at 0x5634e17a7bc8 | State DB: adding IKEv2 state #7 in UNDEFINED | pstats #7 ikev2.ike started | parent state #7: UNDEFINED(ignore) => PARENT_I0(ignore) | #7.st_v2_transition NULL -> PARENT_I0->PARENT_I1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #7 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744609.829728 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744609.829728 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes-mix-1 | westnet-eastnet-aes-mix-1 doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-mix-1 doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-mix-1 doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-mix-1 doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-mix-1 doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-mix-1's this | start processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:544) | addref fd@0x5634e17a3908(2->3) (in add_pending() at pending.c:86) | queuing pending IPsec SA negotiating with 192.1.2.23 IKE SA #7 "westnet-eastnet-aes-mix-1" "westnet-eastnet-aes-mix-1" #7: initiating IKEv2 connection | constructing local IKE proposals for westnet-eastnet-aes-mix-1 (IKE SA initiator selecting KE) | converting ike_info AES_CBC_128-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 "westnet-eastnet-aes-mix-1": local IKE proposals (IKE SA initiator selecting KE): "westnet-eastnet-aes-mix-1": 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a3908(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a6a18(0->1) (in clone_logger() at log.c:817) | job 10 for #7: ikev2_outI1 KE (build KE and nonce): adding job to queue | state #7 has no .st_event to delete | #7 STATE_PARENT_I0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a4a08 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #7 | libevent_malloc: newref ptr-libevent@0x5634e17a40a8 size 128 | #7 spent 0.147 (0.147) milliseconds in ikev2_parent_outI1() | job 10 for #7: ikev2_outI1 KE (build KE and nonce): helper 3 starting job | RESET processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:640) | delref fd@0x5634e17a3908(4->3) (in whack_handle_cb() at rcv_whack.c:903) | spent 0.209 (0.213) milliseconds in whack | "westnet-eastnet-aes-mix-1" #7: spent 1.14 (1.19) milliseconds in helper 3 processing job 10 for state #7: ikev2_outI1 KE (pcr) | job 10 for #7: ikev2_outI1 KE (build KE and nonce): helper thread 3 sending result back to state | scheduling resume sending helper answer back to state for #7 | libevent_malloc: newref ptr-libevent@0x7f6aa40069c8 size 128 | helper thread 3 has nothing to do | processing resume sending helper answer back to state for #7 | start processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #7 MD (nil) | job 10 for #7: ikev2_outI1 KE (build KE and nonce): processing response from helper 3 | job 10 for #7: ikev2_outI1 KE (build KE and nonce): calling continuation function 0x5634df8f5fe7 | ikev2_parent_outI1_continue() for #7 STATE_PARENT_I0 | DH secret MODP2048@0x7f6aa40019d8: transferring ownership from helper KE to state #7 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | using existing local IKE proposals for connection westnet-eastnet-aes-mix-1 (IKE SA initiator emitting local proposals): 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | Emitting ikev2_proposals ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 11 (0b) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 104 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | 9e 8c 07 a7 4e 13 ca bf ab d9 8e b7 e3 63 e9 1a | 4a c6 e6 93 14 af f3 b7 68 a2 00 72 4c e4 dd 36 | b6 57 97 fb 79 2c 74 c2 fa 6b 7d a5 50 ed e0 05 | 3b 5d 68 0c 02 0b 88 e2 70 ea 03 4c 1e e2 6b 2d | e8 b0 d1 8b ff 51 03 bc ed a5 80 29 73 9a 3c 52 | 6e f6 b3 96 ba 13 13 f6 64 eb 92 5a e1 58 7a c9 | 2f e6 ec ba 94 73 b9 b2 c9 a4 13 df 55 71 a2 fc | 52 8b a0 22 73 8f 77 1a 34 4f 39 86 2e e4 92 8d | 07 06 d5 3f c4 e0 77 c3 0d a0 68 a4 4f da 0b ca | 01 e8 d5 17 df fa d3 69 15 9d 22 4e 02 8c 96 e1 | 63 3b 70 86 ee 56 1b 19 8b 5e 2c f7 31 3d e3 de | 04 e6 57 7b 45 fb 14 17 9e 8f 8a ec 58 f0 d2 32 | f5 af 9d 29 de 81 e6 ef db df 9b e6 ad db 86 2b | 33 a6 50 7c f9 1d 85 fb 5b ac 0d 4f ac 51 a8 0c | d7 51 43 e8 87 c6 74 5f 48 63 12 12 f9 11 7c 9b | b5 38 4a 35 71 d7 c7 61 f6 7c 5a eb 5b fd b7 af | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | 7a 6a 1e 63 6a e3 b8 80 84 d0 e8 11 a2 f5 32 b2 | c0 45 39 6b cc 26 7b 18 32 0d f2 23 e3 af 4b 84 | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | a7 9b 4b 3b b2 27 9d 65 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | ae 44 14 22 d1 43 c3 a5 15 d1 af d0 e0 83 16 be | 60 ea a9 cc | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | ae 44 14 22 d1 43 c3 a5 15 d1 af d0 e0 83 16 be | 60 ea a9 cc | emitting length of IKEv2 Notify Payload: 28 | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | a7 9b 4b 3b b2 27 9d 65 | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | db 06 b5 95 c9 9e b0 cc 12 7f fc 36 cc 28 61 24 | 29 84 c6 8c | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | db 06 b5 95 c9 9e b0 cc 12 7f fc 36 cc 28 61 24 | 29 84 c6 8c | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 510 | [RE]START processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #7 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK | transitioning from state STATE_PARENT_I0 to state STATE_PARENT_I1 | Message ID: updating counters for #7 | Message ID: IKE #7 skipping update_recv as MD is fake | Message ID: IKE #7 scheduling EVENT_RETRANSMIT: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.829728 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=0 ike.wip.responder=-1 "westnet-eastnet-aes-mix-1" #7: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17ae5c8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #7 | libevent_malloc: newref ptr-libevent@0x5634e17aac28 size 128 | #7 STATE_PARENT_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.831447 | Message ID: IKE #7 updating initiator sent message request 0: ike.initiator.sent=-1->0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.829728 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=-1->0 ike.wip.responder=-1 | Message ID: IKE #7 no pending message initiators to schedule: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.829728 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=0 ike.wip.responder=-1 | parent state #7: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes-mix-1" #7: sent IKE_SA_INIT request | sending 510 bytes for STATE_PARENT_I0 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 01 fe 22 00 00 68 | 00 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 0c | 80 0e 00 80 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 28 00 01 08 00 0e 00 00 9e 8c 07 a7 | 4e 13 ca bf ab d9 8e b7 e3 63 e9 1a 4a c6 e6 93 | 14 af f3 b7 68 a2 00 72 4c e4 dd 36 b6 57 97 fb | 79 2c 74 c2 fa 6b 7d a5 50 ed e0 05 3b 5d 68 0c | 02 0b 88 e2 70 ea 03 4c 1e e2 6b 2d e8 b0 d1 8b | ff 51 03 bc ed a5 80 29 73 9a 3c 52 6e f6 b3 96 | ba 13 13 f6 64 eb 92 5a e1 58 7a c9 2f e6 ec ba | 94 73 b9 b2 c9 a4 13 df 55 71 a2 fc 52 8b a0 22 | 73 8f 77 1a 34 4f 39 86 2e e4 92 8d 07 06 d5 3f | c4 e0 77 c3 0d a0 68 a4 4f da 0b ca 01 e8 d5 17 | df fa d3 69 15 9d 22 4e 02 8c 96 e1 63 3b 70 86 | ee 56 1b 19 8b 5e 2c f7 31 3d e3 de 04 e6 57 7b | 45 fb 14 17 9e 8f 8a ec 58 f0 d2 32 f5 af 9d 29 | de 81 e6 ef db df 9b e6 ad db 86 2b 33 a6 50 7c | f9 1d 85 fb 5b ac 0d 4f ac 51 a8 0c d7 51 43 e8 | 87 c6 74 5f 48 63 12 12 f9 11 7c 9b b5 38 4a 35 | 71 d7 c7 61 f6 7c 5a eb 5b fd b7 af 29 00 00 24 | 7a 6a 1e 63 6a e3 b8 80 84 d0 e8 11 a2 f5 32 b2 | c0 45 39 6b cc 26 7b 18 32 0d f2 23 e3 af 4b 84 | 29 00 00 08 00 00 40 2e 29 00 00 0e 00 00 40 2f | 00 02 00 03 00 04 29 00 00 1c 00 00 40 04 ae 44 | 14 22 d1 43 c3 a5 15 d1 af d0 e0 83 16 be 60 ea | a9 cc 00 00 00 1c 00 00 40 05 db 06 b5 95 c9 9e | b0 cc 12 7f fc 36 cc 28 61 24 29 84 c6 8c | sent 1 messages | checking that a retransmit timeout_event was already | state #7 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17a40a8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a4a08 | delref logger@0x5634e17a6a18(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a3908(3->2) (in free_logger() at log.c:854) | resume sending helper answer back to state for #7 suppresed complete_v2_state_transition() | delref mdp@NULL (in resume_handler() at server.c:743) | #7 spent 0.49 (0.506) milliseconds in resume sending helper answer back to state | stop processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6aa40069c8 | spent 0.00199 (0.00199) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8ef8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a6a18(0->1) (in read_message() at demux.c:103) | *received 454 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 00 80 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 96 f3 01 4c 02 b8 f9 90 49 79 5a 7c | 2c 6e 14 f0 26 f5 2f f9 9e 10 9b 49 70 b4 1e e2 | d3 c9 ce 50 47 2d 93 7f 19 2b 52 97 46 d4 ad a8 | b1 8f 4a 3b 01 da ac 52 80 50 ad 41 fc 1b 6b 1b | 81 4c 2d 96 ff 6b 88 6f 1c e7 22 54 f0 b2 e2 95 | 81 11 57 3d 01 72 81 b7 5c 8e 08 87 da ca 41 a5 | d8 e3 56 1f 3f 95 e7 0a 04 2f 84 0a 1b 78 dd d4 | 3d e2 be be 35 be 96 e3 50 7f 19 b9 db 55 8c 1c | 9b ae 8f 7e 2a 6a ea 92 c4 7a 41 bc d1 53 94 13 | 66 7e 8f be 20 1a 9b 9c 8f 9d 45 8e d4 53 1c 7b | c3 ec 5f a2 83 27 7c 9c 91 85 02 8d 46 ec e8 50 | 78 83 9a 60 72 78 39 c7 10 8c fc 7a cc ec 5c 73 | 99 73 86 de d0 cf f7 6a ed 49 54 c0 69 e4 d1 1c | ae e9 b9 c5 36 ff 46 72 10 21 1b c5 65 20 90 9a | a0 09 a5 97 3c 02 d7 75 3d 7e 64 4e 0a c3 1b 2e | 67 a9 ed 65 bd 31 1b 4c 56 3e 43 77 cd b2 0d 78 | d7 90 0b 36 29 00 00 24 85 25 44 24 75 91 8a f2 | 82 e3 70 6a 6c 10 99 24 a8 4d fc 69 0c d2 f2 01 | 2f c2 d3 17 51 b1 6a 33 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 20 26 70 d3 99 3e bc ca b5 b4 | 45 6d 88 ad 40 af 02 a8 86 04 00 00 00 1c 00 00 | 40 05 ad 31 54 c3 75 e5 e1 8d 76 33 96 5b 0c df | 94 c9 31 a9 a1 a6 | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | length: 454 (00 00 01 c6) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response | State DB: found IKEv2 state #7 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) | #7 is idle | #7 idle | unpacking clear payloads | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SA (len=44) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | looking for message matching transition from STATE_PARENT_I1 | trying received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added | message has errors | trying received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload | message has errors | trying received REDIRECT notify response; resending IKE_SA_INIT request to new destination | message has errors | trying Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | matched unencrypted message | start processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1848) | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | ikev2 parent inR1: calculating g^{xy} in order to send I2 | using existing local IKE proposals for connection westnet-eastnet-aes-mix-1 (IKE SA initiator accepting remote proposal): 1:IKE=AES_CBC_128-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE initiator (accepting) 1 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 44 (00 2c) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:IKE:ENCR=AES_CBC_128;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048[first-match] | converting proposal to internal trans attrs | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | a7 9b 4b 3b b2 27 9d 65 | natd_hash: rcookie= | 2e 82 68 54 c7 94 26 55 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | ad 31 54 c3 75 e5 e1 8d 76 33 96 5b 0c df 94 c9 | 31 a9 a1 a6 | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | a7 9b 4b 3b b2 27 9d 65 | natd_hash: rcookie= | 2e 82 68 54 c7 94 26 55 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 20 26 70 d3 99 3e bc ca b5 b4 45 6d 88 ad 40 af | 02 a8 86 04 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f6aa40019d8: transferring ownership from state #7 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a3908(2->3) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17a4a08(0->1) (in clone_logger() at log.c:817) | job 11 for #7: ikev2_inR1outI2 KE (compute dh (V2)): adding job to queue | state #7 has no .st_event to delete | #7 requesting EVENT_RETRANSMIT-pe@0x5634e17ae5c8 be deleted | libevent_free: delref ptr-libevent@0x5634e17aac28 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17ae5c8 | #7 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17aac28 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #7 | libevent_malloc: newref ptr-libevent@0x5634e17a40a8 size 128 | #7 spent 0.184 (0.198) milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE in v2_dispatch() | [RE]START processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | job 11 for #7: ikev2_inR1outI2 KE (compute dh (V2)): helper 4 starting job | #7 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | suspending state #7 and saving MD 0x5634e17a8ef8 | addref md@0x5634e17a8ef8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #7 is busy; has suspended MD 0x5634e17a8ef8 | stop processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1850) | #7 spent 0.402 (0.423) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8ef8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.408 (0.429) milliseconds in handle_packet_cb() reading and processing packet | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=16 salt-size=0 | "westnet-eastnet-aes-mix-1" #7: spent 0.63 (0.629) milliseconds in helper 4 processing job 11 for state #7: ikev2_inR1outI2 KE (pcr) | job 11 for #7: ikev2_inR1outI2 KE (compute dh (V2)): helper thread 4 sending result back to state | scheduling resume sending helper answer back to state for #7 | libevent_malloc: newref ptr-libevent@0x7f6a98004b78 size 128 | helper thread 4 has nothing to do | processing resume sending helper answer back to state for #7 | start processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #7 MD 0x5634e17a8ef8 | job 11 for #7: ikev2_inR1outI2 KE (compute dh (V2)): processing response from helper 4 | job 11 for #7: ikev2_inR1outI2 KE (compute dh (V2)): calling continuation function 0x5634df8f5fe7 | ikev2_parent_inR1outI2_continue() for #7 STATE_PARENT_I1: g^{xy} calculated, sending I2 | DH secret MODP2048@0x7f6aa40019d8: transferring ownership from helper IKEv2 DH to state #7 | State DB: re-hashing IKEv2 state #7 IKE SPIi and SPI[ir] | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 to find private key for @west->@east of kind RSA | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes-mix-1's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a3908(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17ae5c8(0->1) (in clone_logger() at log.c:817) | job 12 for #7: computing responder signature (signature): adding job to queue | state #7 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17a40a8 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17aac28 | #7 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a4068 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #7 | libevent_malloc: newref ptr-libevent@0x5634e17aa978 size 128 | [RE]START processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #7 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | suspending state #7 and saving MD 0x5634e17a8ef8 | addref md@0x5634e17a8ef8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #7 is busy; has suspended MD 0x5634e17a8ef8 | delref logger@0x5634e17a4a08(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | job 12 for #7: computing responder signature (signature): helper 6 starting job | delref fd@0x5634e17a3908(4->3) (in free_logger() at log.c:854) | hash to sign | 88 65 4f 0a d2 62 a0 db f2 55 c2 9e 39 f2 f9 e9 | e3 a0 12 a7 58 7b e8 7c 84 8f 35 a6 a6 69 2b 39 | resume sending helper answer back to state for #7 suppresed complete_v2_state_transition() | delref mdp@0x5634e17a8ef8(2->1) (in resume_handler() at server.c:743) | 5c 66 ac c1 f3 a2 03 cf 70 78 45 e8 e1 54 43 db | #7 spent 0.104 (0.111) milliseconds in resume sending helper answer back to state | 21 0a 35 ab a7 5a 71 27 52 25 83 3f 50 0c 4c 2b | stop processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in resume_handler() at server.c:745) | RSA_sign_hash: Started using NSS | libevent_free: delref ptr-libevent@0x7f6a98004b78 | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes-mix-1" #7: spent 2.51 (2.53) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes-mix-1" #7: spent 2.53 (2.56) milliseconds in v2_auth_signature() | "westnet-eastnet-aes-mix-1" #7: spent 2.55 (2.58) milliseconds in helper 6 processing job 12 for state #7: computing responder signature (signature) | job 12 for #7: computing responder signature (signature): helper thread 6 sending result back to state | scheduling resume sending helper answer back to state for #7 | libevent_malloc: newref ptr-libevent@0x7f6a9c004f78 size 128 | helper thread 6 has nothing to do | processing resume sending helper answer back to state for #7 | start processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #7 MD 0x5634e17a8ef8 | job 12 for #7: computing responder signature (signature): processing response from helper 6 | job 12 for #7: computing responder signature (signature): calling continuation function 0x5634df82477f | newref alloc logger@0x5634e17a4a08(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a3908(3->4) (in new_state() at state.c:577) | creating state object #8 at 0x5634e17b0c78 | State DB: adding IKEv2 state #8 in UNDEFINED | pstats #8 ikev2.child started | duplicating state object #7 "westnet-eastnet-aes-mix-1" as #8 for IPSEC SA | #8 setting local endpoint to 192.1.2.45:500 from #7.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #7.#8 initializing (CHILD SA): ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.829728 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #8: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_I0(ignore) | #8.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #7 switching from IKE SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.829728 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=0->-1 ike.wip.responder=-1 | Message ID: CHILD #7.#8 switching to CHILD SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.829728 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=-1->0 child.wip.responder=-1 | switching IKEv2 MD.ST from IKE #7 PARENT_I1 to CHILD #8 V2_IKE_AUTH_CHILD_I0 (in ikev2_parent_inR1outI2_auth_signature_continue() at ikev2_parent.c:2155) | state #7 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17aa978 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a4068 | #7 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_SA_REPLACE-pe@0x5634e17a40d8 | inserting event EVENT_SA_REPLACE, timeout in 120 seconds for #7 | libevent_malloc: newref ptr-libevent@0x7f6a98004b78 size 128 | parent state #7: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | IDr payload will be sent | ****emit IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Initiator - Payload | my identity: 77 65 73 74 | emitting length of IKEv2 Identification - Initiator - Payload: 12 | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of their IDr into IKEv2 Identification - Responder - Payload | their IDr: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | not sending INITIAL_CONTACT | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 3f cb 4d 8d 88 2e 21 df cb 08 ba 35 e0 c7 ee 3a | bc 44 e6 ca d6 fd 3d ee 32 50 b4 51 8a 86 25 6d | 71 90 8a 69 b9 f8 f2 50 ad 4e bf e1 6b b2 60 ba | b4 86 6c 1c cc 93 57 70 ba 9f 60 1b 1b c7 a5 d6 | 38 fc 14 d7 24 2d 5b 24 c5 a1 6d 36 61 c4 8f 27 | 0d d0 cf dd 6e 9f 47 f4 6c 26 05 7a c7 95 7e 35 | da 26 cd cd 73 95 e5 56 a6 47 88 b9 27 23 56 94 | 8e d1 4b eb 6a 88 fd cd d2 99 57 6c 5c da c2 ef | 28 1b 3b 8e a2 ef 9f c3 d5 97 07 59 0a 21 f1 7c | 8c 5a 8e a4 c3 c5 54 58 14 21 a7 89 af 5a ed 9d | c4 31 e1 66 53 36 27 e8 da 20 e0 db 4f d0 81 37 | 21 44 0e 1d a6 99 f3 5c 45 bc 17 d6 f9 cf bd 0f | 0b 84 f7 18 93 3b 54 b8 e9 3c 86 0f fb 84 bf 16 | 44 f3 a0 46 1b 22 1f 1e 73 81 1b 6f 4e ec f9 d9 | bd 6c 58 e1 7f 48 0e ed 98 62 bd ef af 22 73 2c | 28 24 f6 06 1e 29 e5 ef 57 44 42 67 2a ec 99 d0 | 79 4b 6a 89 ed 00 85 4c c3 14 a1 e6 41 0f e6 74 | cc fd | emitting length of IKEv2 Authentication Payload: 350 | getting first pending from state #7 | delref fd@0x5634e17a3908(4->3) (in first_pending() at pending.c:318) | addref fd@0x5634e17a3908(3->4) (in first_pending() at pending.c:319) | netlink_get_spi: allocated 0xa6019f76 for esp.0@192.1.2.45 | constructing ESP/AH proposals with all DH removed for westnet-eastnet-aes-mix-1 (IKE SA initiator emitting ESP/AH proposals) | converting proposal AES_CBC_256-HMAC_SHA1_96 to ikev2 ... | ... ikev2_proposal: 1:ESP=AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED "westnet-eastnet-aes-mix-1": local ESP/AH proposals (IKE SA initiator emitting ESP/AH proposals): "westnet-eastnet-aes-mix-1": 1:ESP=AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | Emitting ikev2_proposals ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discard DH=NONE when counting transforms (multiple 0; allow single 0) | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: a6 01 9f 76 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discard DH=NONE when emitting proposal (multiple 0; allow single 0) | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | adding 14 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 512 | emitting length of ISAKMP Message: 540 | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 540 (00 00 02 1c) | **parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 512 (02 00) | opening output PBS reply frag packet | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 16 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 466 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment: | 24 00 00 0c 02 00 00 00 77 65 73 74 27 00 00 0c | 02 00 00 00 65 61 73 74 21 00 01 5e 0e 00 00 00 | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 3f cb 4d 8d 88 2e 21 df cb 08 ba 35 | e0 c7 ee 3a bc 44 e6 ca d6 fd 3d ee 32 50 b4 51 | 8a 86 25 6d 71 90 8a 69 b9 f8 f2 50 ad 4e bf e1 | 6b b2 60 ba b4 86 6c 1c cc 93 57 70 ba 9f 60 1b | 1b c7 a5 d6 38 fc 14 d7 24 2d 5b 24 c5 a1 6d 36 | 61 c4 8f 27 0d d0 cf dd 6e 9f 47 f4 6c 26 05 7a | c7 95 7e 35 da 26 cd cd 73 95 e5 56 a6 47 88 b9 | 27 23 56 94 8e d1 4b eb 6a 88 fd cd d2 99 57 6c | 5c da c2 ef 28 1b 3b 8e a2 ef 9f c3 d5 97 07 59 | 0a 21 f1 7c 8c 5a 8e a4 c3 c5 54 58 14 21 a7 89 | af 5a ed 9d c4 31 e1 66 53 36 27 e8 da 20 e0 db | 4f d0 81 37 21 44 0e 1d a6 99 f3 5c 45 bc 17 d6 | f9 cf bd 0f 0b 84 f7 18 93 3b 54 b8 e9 3c 86 0f | fb 84 bf 16 44 f3 a0 46 1b 22 1f 1e 73 81 1b 6f | 4e ec f9 d9 bd 6c 58 e1 7f 48 0e ed 98 62 bd ef | af 22 73 2c 28 24 f6 06 1e 29 e5 ef 57 44 42 67 | 2a ec 99 d0 79 4b 6a 89 ed 00 85 4c c3 14 a1 e6 | 41 0f e6 74 cc fd 2c 00 00 2c 00 00 00 28 01 03 | 04 03 a6 01 9f 76 03 00 00 0c 01 00 00 0c 80 0e | 01 00 03 00 00 08 03 00 00 02 00 00 00 08 05 00 | 00 00 2d 00 00 18 01 00 00 00 07 00 00 10 00 00 | ff ff c0 00 01 00 c0 00 01 ff 00 00 00 18 01 00 | 00 00 07 00 00 10 00 00 ff ff c0 00 02 00 c0 00 | 02 ff | adding 14 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 516 | emitting length of ISAKMP Message: 544 | recording fragment 1 | delref logger@0x5634e17ae5c8(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a3908(4->3) (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #7 switched MD.ST to #8 | suspend processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #8 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #8 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_I0 PARENT_I1->PARENT_I2 with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I1 to state STATE_PARENT_I2 | Message ID: updating counters for #8 | Message ID: CHILD #7.#8 XXX: no EVENT_RETRANSMIT to clear; suspect IKE->CHILD switch: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744609.829728 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: CHILD #7.#8 updating initiator received message response 0: ike.initiator.sent=0 ike.initiator.recv=-1->0 ike.initiator.last_contact=744609.829728->744609.838433 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=0->-1 child.wip.responder=-1 | Message ID: CHILD #7.#8 scheduling EVENT_RETRANSMIT: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.838433 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=1 child.wip.responder=-1 "westnet-eastnet-aes-mix-1" #8: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17ae5c8 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #8 | libevent_malloc: newref ptr-libevent@0x5634e17aa978 size 128 | #8 STATE_V2_IKE_AUTH_CHILD_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.838465 | Message ID: CHILD #7.#8 updating initiator sent message request 1: ike.initiator.sent=0->1 ike.initiator.recv=0 ike.initiator.last_contact=744609.838433 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=-1->1 child.wip.responder=-1 | Message ID: IKE #7 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.838433 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #8: V2_IKE_AUTH_CHILD_I0(ignore) => PARENT_I2(open IKE SA) | announcing the state transition "westnet-eastnet-aes-mix-1" #7: sent IKE_AUTH request {auth=IKEv2 cipher=AES_CBC_128 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 544 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 7a 27 56 47 16 fa 69 02 08 e9 42 18 | 20 1e 7c d0 cf 75 2d 48 f8 30 b6 ae e6 a8 a6 34 | 6b ea 3b 62 46 0f ac 5b 8f 0f 37 bc 8e a1 20 df | 6e 12 c9 82 b1 8e 0c 1c 8f 02 b0 8e 63 10 ad 69 | 5c 1d 80 30 16 c9 5b 02 d5 13 49 d3 c3 55 f9 7f | 27 bf cf 96 1e 92 1c 59 ad f9 2f 1e 18 6a e4 01 | a0 6e 30 74 a4 e5 0c 4b 4a 38 b7 bf d8 3e 45 41 | e1 92 6f 00 a8 8e cb dc 72 00 38 97 97 d4 0c b0 | 8a e2 3b 87 74 7f c8 27 f3 a1 f0 87 2f 12 cc a8 | 67 27 ab c9 36 41 fc bb 7e 11 47 d1 39 8f 59 40 | f3 ee 17 65 fe 0a c5 1c d6 71 82 93 1d 37 f1 97 | 37 8c 7a 83 24 a9 0e e9 58 96 29 1c 5d 7e 4f 7c | 68 0a 93 4a c2 ab b9 d9 77 74 7b 26 9e be 71 b0 | f2 42 05 38 20 23 b7 ad af 3f ed c3 c8 09 34 8c | f3 d6 f6 2d 29 8e bc 24 21 1c db f2 a4 4e 6a d0 | 0f 5d c1 f4 4d 14 29 5e 41 8d 40 87 c5 ec 26 8e | 5e a5 f7 67 21 25 79 af 01 b0 d2 4e bb dd 56 a5 | f3 07 2d ed 7a 88 b5 6e ac 3b d7 91 71 13 94 c9 | 60 62 1e 37 f8 c7 3e fb 85 53 36 55 60 bf ee bd | 12 1e 13 3c 5a a1 12 c4 58 8a 4d a0 f0 4e dc 11 | b3 de 4c 33 d2 59 a7 f5 9d 4e 9e d5 c6 7f eb 33 | c8 c7 1e 6a d6 74 dd eb db f2 3c e2 f2 db 72 36 | b4 b6 5b 29 12 38 72 54 ba 72 4c 30 2d a4 70 0f | b6 09 3f 0d 52 84 fd da 2d 7e ad 3f 4b 3d 58 d0 | 01 f2 85 c0 84 7b 16 b9 49 0c ef e2 d7 2e 7f 3f | 3a 85 0e 20 75 27 aa 0c 35 a7 9a 23 ea be b2 92 | 0f 2b 86 42 1d 41 f8 9e 22 90 f8 d7 92 4c f6 0e | e4 76 9b 00 25 d3 1b fc 3c 6d 45 ac d8 19 c4 b4 | fc 01 19 64 48 98 23 f7 28 13 82 a1 40 8f fb 06 | 8f 72 52 9e 3e c2 d7 e0 97 10 28 c3 34 88 a7 a6 | f1 d5 da 51 e2 5f 9d 02 a5 49 f6 fc 87 4a 42 bf | b4 c2 67 71 26 52 1b e6 14 89 fb f0 8f 1d 2d c4 | sent 1 messages | checking that a retransmit timeout_event was already | state #8 has no .st_event to delete | delref mdp@0x5634e17a8ef8(1->0) (in resume_handler() at server.c:743) | delref logger@0x5634e17a6a18(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #7 spent 0.981 (1.01) milliseconds in resume sending helper answer back to state | stop processing: state #8 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6a9c004f78 | spent 0.00209 (0.00207) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8ef8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17a4068(0->1) (in read_message() at demux.c:103) | *received 524 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | 9e f6 0f 9f 7b d1 55 06 91 47 99 05 f0 1f 01 f2 | 85 6b 6a 73 f3 f0 64 88 f6 5c ec 65 b6 84 f7 a9 | 5b 20 d6 b1 b3 ec 8b 38 cb 3c 23 98 b4 9f f9 97 | b7 1b 0d 8f b9 55 7f 88 07 cd 7f 90 d7 98 c6 13 | 9f c8 e0 39 53 db 1e 29 30 9d c7 64 55 cc 2d 99 | b8 8c 35 6b 1b 69 ff 41 31 2a 3f e4 93 a5 24 54 | d2 02 6c 30 32 33 99 dc 6d cb 2a bf cf 73 f2 24 | c4 db 3c d2 13 09 5e 7e de c1 c3 8b 66 d2 5e 03 | 7f c4 33 44 3f a8 c2 a2 62 e9 f0 2e 90 c0 05 0d | 12 94 e6 b3 6e d2 53 18 db ce e3 56 e5 8e 68 0e | e4 59 b9 f7 f5 fd dd be 62 9d f8 f3 11 33 87 d9 | 0c 30 9c 06 72 07 1d ba aa b0 62 3f e6 2d d3 d6 | a4 60 da e1 75 1e 40 eb a1 58 fc b4 60 f3 e9 93 | 44 58 33 65 8f 8e 33 3a be 0f d0 f7 92 c7 79 b8 | 06 36 17 6a 6c 58 f3 52 82 92 71 8f 14 aa 3b e4 | ba 3b 0b 58 c9 50 7a 86 de 66 f0 fc aa 24 41 b8 | 17 4b f3 d3 f6 6a 39 a4 ab 5f a7 ee 67 9c bd 60 | 9f 5b 30 da fb ad 10 1c 86 38 c2 68 a8 ea 79 c1 | 35 60 92 04 85 96 28 23 24 df 5a 95 12 d4 73 36 | 1b 18 6e 7d 60 b0 78 7f d0 54 cf 60 8e a2 17 08 | 8e d7 ac b7 54 4e 1c 2b c2 dd b5 5f 83 0b 55 47 | 71 e8 37 0b e5 40 7f ae 65 fa 9a 73 22 42 61 04 | 37 5a 98 81 4c 28 60 ab aa 61 51 3b 2e f1 f8 43 | 26 bf 91 70 73 54 64 3d 20 da cd 1b d1 65 24 7b | 2a e7 27 5d db 81 a2 e1 b4 27 2b 69 7c 68 ee c2 | 18 77 6f 75 c6 43 44 24 11 60 8c ff a0 97 56 ce | d2 07 89 40 87 9a 55 09 04 51 55 25 43 f0 4f ac | e4 dd 43 91 72 cc d0 c5 45 e5 1c a6 f4 33 2d c8 | 9d cc 37 e8 75 61 85 a1 db db 26 71 68 e3 c7 38 | 72 53 08 9b 5a 1f 3b 63 5e 2a ca 84 d8 38 07 9c | 9a ab 3e e8 79 fe 15 0a 7c 28 c3 8f | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | length: 524 (00 00 02 0c) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #7 in PARENT_I2 (find_v2_ike_sa) | start processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) | State DB: found IKEv2 state #8 in PARENT_I2 (find_v2_sa_by_initiator_wip) | #8 is idle | #8 idle | suspend processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | start processing: state #8 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 496 (01 f0) | processing payload: ISAKMP_NEXT_v2SK (len=492) | #8 in state PARENT_I2: sent IKE_AUTH request | authenticator matched | #7 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Initiator: process IKE_AUTH response | calling processor Initiator: process IKE_AUTH response | no certs to decode | offered CA: '%none' "westnet-eastnet-aes-mix-1" #8: IKEv2 mode peer ID is ID_FQDN: '@east' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @east | trying all preloaded keys public keys for RSA key that matches ID: @east | trying '@east' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | 1b 8f e2 81 2e c0 1d 5a 44 1e d9 27 69 e8 d5 9a | 13 2b 0a 5d 46 d7 88 e8 70 dc f7 88 cc 31 8e 48 | 7b 78 6d b7 8e fa 47 1d b8 4e d4 71 a7 be e2 f9 | 56 e5 af cb 6a 9d eb fa 7f b9 c2 68 11 46 48 9c | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x5634e17ac278(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQO9bJbr3 [preloaded keys] | #7 spent 0.0711 (0.0714) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes-mix-1" #7: authenticated using RSA with SHA2_512 | #7 spent 0.104 (0.104) milliseconds in ikev2_verify_rsa_hash() | parent state #7: PARENT_I2(open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #7 will start re-keying in 2879 seconds with margin of 721 seconds (attempting re-key) | state #7 deleting .st_event EVENT_SA_REPLACE | libevent_free: delref ptr-libevent@0x7f6a98004b78 | free_event_entry: delref EVENT_SA_REPLACE-pe@0x5634e17a40d8 | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17ab868 | inserting event EVENT_SA_REKEY, timeout in 2879 seconds for #7 | libevent_malloc: newref ptr-libevent@0x7f6a9c004f78 size 128 | pstats #7 ikev2.ike established | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | evaluating our conn="westnet-eastnet-aes-mix-1" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found an acceptable TSi/TSr Traffic Selector | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | using existing local ESP/AH proposals for westnet-eastnet-aes-mix-1 (IKE_AUTH initiator accepting remote ESP/AH proposal): 1:ESP=AES_CBC_256-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH initiator accepting remote ESP/AH proposal 1 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | ab 2a 71 53 | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:ESP:ENCR=AES_CBC_256;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH initiator accepting remote ESP/AH proposal ikev2_proposal: 1:ESP=AES_CBC_256-HMAC_SHA1_96-DISABLED SPI=ab2a7153 | converting proposal to internal trans attrs | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=32 .salt_size=0 keymat_len=52 | install_ipsec_sa() for #8: inbound and outbound | could_route called for westnet-eastnet-aes-mix-1; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-mix-1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-mix-1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-mix-1" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 256 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=256 transid=12, key_size=32, encryptalg=12 | st->st_esp.keymat_len=52 is encrypt_keymat_size=32 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-mix-1' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16401 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.ab2a7153@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 256 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=256 transid=12, key_size=32, encryptalg=12 | st->st_esp.keymat_len=52 is encrypt_keymat_size=32 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-mix-1' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16401 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.a6019f76@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes-mix-1" is 2084814 (0x1fcfce) | add inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.10000@192.1.2.45 using reqid 16401 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #8: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-mix-1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-mix-1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-mix-1" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-aes-mix-1 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #8 | priority calculation of connection "westnet-eastnet-aes-mix-1" is 2084814 (0x1fcfce) | eroute_connection add eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23 using reqid 16401 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.ab2a7153@192.1.2.23 | get_sa_info esp.a6019f76@192.1.2.45 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFI... | popen cmd is 1146 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' : | cmd( 160):PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_C: | cmd( 240):LIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.2: | cmd( 320):55.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_S: | cmd( 400):A_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='19: | cmd( 480):2.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.25: | cmd( 560):5.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='x: | cmd( 640):frm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+P: | cmd( 720):FS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANE: | cmd( 800):NT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PE: | cmd( 880):ER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER=': | cmd( 960):0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES: | cmd(1040):='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xab2a7153 SPI_OUT=0xa: | cmd(1120):6019f76 ipsec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | get_sa_info esp.ab2a7153@192.1.2.23 | get_sa_info esp.a6019f76@192.1.2.45 | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUT... | popen cmd is 1151 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUT: | cmd( 160):E='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO: | cmd( 240):_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK=': | cmd( 320):255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PL: | cmd( 400):UTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIEN: | cmd( 480):T='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.2: | cmd( 560):55.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STA: | cmd( 640):CK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUN: | cmd( 720):NEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PE: | cmd( 800):RMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLU: | cmd( 880):TO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SER: | cmd( 960):VER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUT: | cmd(1040):BYTES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xab2a7153 SPI_OU: | cmd(1120):T=0xa6019f76 ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | get_sa_info esp.ab2a7153@192.1.2.23 | get_sa_info esp.a6019f76@192.1.2.45 | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM... | popen cmd is 1149 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):aes-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=: | cmd( 160):'' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_M: | cmd( 240):Y_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='25: | cmd( 320):5.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUT: | cmd( 400):O_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT=: | cmd( 480):'192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255: | cmd( 560):.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK: | cmd( 640):='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNE: | cmd( 720):L+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERM: | cmd( 800):ANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO: | cmd( 880):_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVE: | cmd( 960):R='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBY: | cmd(1040):TES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xab2a7153 SPI_OUT=: | cmd(1120):0xa6019f76 ipsec _updown 2>&1: "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-1" #8: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "westnet-eastnet-aes-mix-1", setting eroute_owner {spd=0x5634e17abc58,sr=0x5634e17abc58} to #8 (was #0) (newest_ipsec_sa=#0) | inR2: instance westnet-eastnet-aes-mix-1[0], setting IKEv2 newest_ipsec_sa to #8 (was #0) (spd.eroute=#8) cloned from #7 | #8 spent 1.38 (34.1) milliseconds in processing: Initiator: process IKE_AUTH response in v2_dispatch() | [RE]START processing: state #8 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #8 complete_v2_state_transition() PARENT_I2->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I2 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #8 | Message ID: CHILD #7.#8 clearing EVENT_RETRANSMIT as response received: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744609.838433 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=-1 child.wip.responder=-1 | #8 requesting EVENT_RETRANSMIT-pe@0x5634e17ae5c8 be deleted | libevent_free: delref ptr-libevent@0x5634e17aa978 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17ae5c8 | #8 STATE_PARENT_I2: retransmits: cleared | Message ID: CHILD #7.#8 updating initiator received message response 1: ike.initiator.sent=1 ike.initiator.recv=0->1 ike.initiator.last_contact=744609.838433->744609.889809 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=1->-1 child.wip.responder=-1 | Message ID: CHILD #7.#8 skipping update_send as nothing to send: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744609.889809 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #7 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744609.889809 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #8: PARENT_I2(open IKE SA) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #8 ikev2.child established | announcing the state transition "westnet-eastnet-aes-mix-1" #8: negotiated connection [192.0.1.0-192.0.1.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes-mix-1" #8: IPsec SA established tunnel mode {ESP=>0xab2a7153 <0xa6019f76 xfrm=AES_CBC_256-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | releasing #8's fd-fd@0x5634e17a3908 because IKEv2 transitions finished | delref fd@0x5634e17a3908(3->2) (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #8's IKE SA #7 | unpending state #7 connection "westnet-eastnet-aes-mix-1" | delete from pending Child SA with 192.1.2.23 "westnet-eastnet-aes-mix-1" | delref fd@0x5634e17a3908(2->1) (in delete_pending() at pending.c:218) | removing pending policy for no connection {0x5634e17a75b8} | releasing #7's fd-fd@0x5634e17a3908 because IKEv2 transitions finished so releaseing IKE SA | delref fd@0x5634e17a3908(1->0) (in success_v2_state_transition() at ikev2.c:3222) | freeref fd-fd@0x5634e17a3908 (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #8 will start re-keying in 27846 seconds with margin of 954 seconds (attempting re-key) | state #8 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17ae5c8 | inserting event EVENT_SA_REKEY, timeout in 27846 seconds for #8 | libevent_malloc: newref ptr-libevent@0x5634e17af748 size 128 | stop processing: state #8 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) | #7 spent 1.37 (34.1) milliseconds | #7 spent 1.79 (34.5) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8ef8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17a4068(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 1.81 (34.5) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00426 (0.0042) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00289 (0.00284) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00276 (0.00276) milliseconds in signal handler PLUTO_SIGCHLD | newref struct fd@0x5634e17a3908(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a3908 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-mix-1' | FOR_EACH_CONNECTION_... in conn_by_name "westnet-eastnet-aes-mix-1": terminating SAs using this connection | connection 'westnet-eastnet-aes-mix-1' -POLICY_UP | FOR_EACH_STATE_... in shared_phase1_connection | connection not shared - terminating IKE and IPsec SA | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #8 | start processing: state #8 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a3908(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #8 ikev2.child deleted completed | #8 main thread spent 1.38 (34.1) milliseconds helper thread spent 0 (0) milliseconds in total | [RE]START processing: state #8 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-mix-1" #8: deleting state (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.112269s and sending notification | child state #8: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.ab2a7153@192.1.2.23 | get_sa_info esp.a6019f76@192.1.2.45 "westnet-eastnet-aes-mix-1" #8: ESP traffic information: in=0B out=0B | unsuspending #8 MD (nil) | should_send_delete: yes | #8 send IKEv2 delete notification for STATE_V2_ESTABLISHED_CHILD_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting 4 raw bytes of local spis into IKEv2 Delete Payload | local spis: a6 01 9f 76 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | a1 9c ef 54 ca 36 cf 68 79 02 5e a1 70 36 70 54 | 20 58 fd c7 00 a5 5b 88 75 33 21 9e 6d 40 f6 75 | 8e 2f f2 7e a7 a8 50 c8 1d 6f 6a 9e | sent 1 messages | Message ID: IKE #7 sender #8 in send_delete hacking around record 'n' send | Message ID: IKE #7 scheduling EVENT_RETRANSMIT: ike.initiator.sent=2 ike.initiator.recv=1 ike.initiator.last_contact=744609.889809 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=2 ike.wip.responder=-1 "westnet-eastnet-aes-mix-1" #7: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17a6a18 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #7 | libevent_malloc: newref ptr-libevent@0x5634e17aa978 size 128 | #7 STATE_V2_ESTABLISHED_IKE_SA: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744609.950102 | Message ID: IKE #7 updating initiator sent message request 2: ike.initiator.sent=1->2 ike.initiator.recv=1 ike.initiator.last_contact=744609.889809 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=-1->2 ike.wip.responder=-1 | state #8 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x5634e17af748 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17ae5c8 | #8 STATE_V2_ESTABLISHED_CHILD_SA: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.ab2a7153@192.1.2.23 | get_sa_info esp.a6019f76@192.1.2.45 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONF... | popen cmd is 1145 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=': | cmd( 160):' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY: | cmd( 240):_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255: | cmd( 320):.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO: | cmd( 400):_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT=': | cmd( 480):192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.: | cmd( 560):255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK=: | cmd( 640):'xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL: | cmd( 720):+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANEN: | cmd( 800):T' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEE: | cmd( 880):R_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0: | cmd( 960):' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES=: | cmd(1040):'0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0xab2a7153 SPI_OUT=0xa6: | cmd(1120):019f76 ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes-mix-1' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-mix-1" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.ab2a7153@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.ab2a7153@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-aes-mix-1" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => unk.10000@192.1.2.45 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.a6019f76@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.a6019f76@192.1.2.45 included non-error error | in connection_discard for connection westnet-eastnet-aes-mix-1 | State DB: deleting IKEv2 state #8 in ESTABLISHED_CHILD_SA | child state #8: ESTABLISHED_CHILD_SA(established CHILD SA) => UNDEFINED(ignore) | releasing #8's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a3908(2->1) (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #8 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e17a4a08(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | state #7 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #7 | start processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a3908(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #7 ikev2.ike deleted completed | #7 main thread spent 3.91 (36.7) milliseconds helper thread spent 4.32 (4.4) milliseconds in total | [RE]START processing: state #7 connection "westnet-eastnet-aes-mix-1" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-mix-1" #7: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.133647s and sending notification | parent state #7: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #7 MD (nil) | should_send_delete: yes | #7 send IKEv2 delete notification for STATE_V2_ESTABLISHED_IKE_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting length of IKEv2 Delete Payload: 8 | adding 8 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #7) | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | ff e6 ba 81 22 31 ac c3 2d 89 ca 34 47 83 c1 5f | 91 fb 22 75 06 16 6b 1b 98 0e c6 7c 60 cb e6 d6 | f3 ec b2 01 f6 c4 06 e0 11 b3 20 62 | sent 1 messages | Message ID: IKE #7 sender #7 in send_delete hacking around record 'n' send | Message ID: IKE #7 XXX: expecting sender.wip.initiator 2 == -1 - suspect record'n'send out-of-order?): ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744609.889809 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #7 XXX: EVENT_RETRANSMIT already scheduled -- suspect record'n'send: ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744609.889809 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #7 updating initiator sent message request 3: ike.initiator.sent=2->3 ike.initiator.recv=1 ike.initiator.last_contact=744609.889809 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744609.829728 ike.wip.initiator=2->3 ike.wip.responder=-1 | state #7 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f6a9c004f78 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17ab868 | #7 requesting EVENT_RETRANSMIT-pe@0x5634e17a6a18 be deleted | libevent_free: delref ptr-libevent@0x5634e17aa978 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17a6a18 | #7 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes-mix-1 | State DB: deleting IKEv2 state #7 in ESTABLISHED_IKE_SA | parent state #7: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #7's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a3908(2->1) (in delete_state() at state.c:1195) | delref pkp@0x5634e17ac278(2->1) (in delete_state() at state.c:1202) | stop processing: state #7 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e1793f28(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | FOR_EACH_CONNECTION_... in conn_by_name | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-aes-mix-1' to 'delete' for rt_kind 'unrouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-mix-1" is 2084814 (0x1fcfce) | priority calculation of connection "westnet-eastnet-aes-mix-1" is 2084814 (0x1fcfce) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-mix-1 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-mix-1 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-mix-1" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIG... | popen cmd is 1089 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-mix-1' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUT: | cmd( 160):E='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO: | cmd( 240):_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK=': | cmd( 320):255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16400' PL: | cmd( 400):UTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIE: | cmd( 480):NT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.: | cmd( 560):255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_ST: | cmd( 640):ACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+: | cmd( 720):IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PL: | cmd( 800):UTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS: | cmd( 880):_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLU: | cmd( 960):TO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHAR: | cmd(1040):ED='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1: unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. | addref fd@0x5634e17a3908(1->2) (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x5634e17af6d8(0->1) (in clone_logger() at log.c:817) | delref hp@0x5634e17ab658(1->0) (in delete_oriented_hp() at hostpair.c:360) | flush revival: connection 'westnet-eastnet-aes-mix-1' wasn't on the list | delref vip@NULL (in discard_connection() at connections.c:262) | delref vip@NULL (in discard_connection() at connections.c:263) | Connection DB: deleting connection $4 | delref logger@0x5634e17af6d8(1->0) (in delete_connection() at connections.c:214) | delref fd@0x5634e17a3908(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | FOR_EACH_CONNECTION_... in conn_by_name | delref fd@0x5634e17a3908(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a3908 (in whack_handle_cb() at rcv_whack.c:903) | spent 1.71 (35) milliseconds in whack | spent 0.00169 (0.00169) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17af6d8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 99 85 f4 72 13 5c 76 f9 dd c4 74 7d 5d 7e b1 cd | 2f f7 58 dd cc fc 01 08 41 36 0f 0e 01 b7 0c 79 | c5 ac 50 a9 1a a6 f4 ae d8 1f 61 0b | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17af6d8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0707 (0.0709) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.0071 (0.0072) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00344 (0.00351) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.0017 (0.00172) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17af6d8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | 99 85 f4 72 13 5c 76 f9 dd c4 74 7d 5d 7e b1 cd | 2f f7 58 dd cc fc 01 08 41 36 0f 0e 01 b7 0c 79 | c5 ac 50 a9 1a a6 f4 ae d8 1f 61 0b | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17af6d8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0832 (0.0833) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00165 (0.00165) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17af6d8(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | a7 9b 4b 3b b2 27 9d 65 2e 82 68 54 c7 94 26 55 | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | a4 af f2 2d 7c c6 e0 68 d7 92 e9 39 76 f8 82 23 | 3e 66 72 ce e0 36 65 b4 5e cc f0 f1 ef 4c fe 0d | f4 2f 99 b4 26 25 1f f3 4f 22 f3 f5 | **parse ISAKMP Message: | initiator SPI: a7 9b 4b 3b b2 27 9d 65 | responder SPI: 2e 82 68 54 c7 94 26 55 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17af6d8(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0846 (0.0875) milliseconds in handle_packet_cb() reading and processing packet | newref struct fd@0x5634e17af7f8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17af7f8 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-mix-2' | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | FOR_EACH_CONNECTION_... in conn_by_name | FOR_EACH_CONNECTION_... in foreach_connection_by_alias | whack: connection 'westnet-eastnet-aes-mix-2' | addref fd@0x5634e17af7f8(1->2) (in string_logger() at log.c:838) | newref string logger@0x5634e17af6d8(0->1) (in add_connection() at connections.c:1998) | Connection DB: adding connection "westnet-eastnet-aes-mix-2" $5 | FOR_EACH_CONNECTION_... in conn_by_name | added new connection westnet-eastnet-aes-mix-2 with policy RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | ike (phase1) algorithm values: AES_CBC_256-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 | from whack: got --esp=aes128-sha1 | ESP/AH string values: AES_CBC_128-HMAC_SHA1_96 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | saving left CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.00852 (0.00831) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | counting wild cards for @west is 0 | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | saving right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1 extracted from raw RSA public key | trying secret PKK_RSA:AQOm9dY/4 | spent 0.093 (0.0931) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key matching right CKAID 61559973d3acef7d3a370e3e82ad92c18a8225f1: can't find the private key matching the NSS CKAID | counting wild cards for @east is 0 | updating connection from left.host_addr | left host_port 500 | updating connection from right.host_addr | right host_port 500 | orienting westnet-eastnet-aes-mix-2 | westnet-eastnet-aes-mix-2 doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-mix-2 doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-mix-2 doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-mix-2 doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-mix-2 doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-mix-2's this | connect_to_host_pair: 192.1.2.45:500 192.1.2.23:500 -> hp@(nil): none | newref hp@0x5634e17aac28(0->1) (in connect_to_host_pair() at hostpair.c:290) added IKEv2 connection "westnet-eastnet-aes-mix-2" | ike_life: 3600; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 0; replay_window: 32; policy: RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5 | 192.0.1.0/24===192.1.2.45<192.1.2.45>[@west]...192.1.2.23<192.1.2.23>[@east]===192.0.2.0/24 | delref logger@0x5634e17af6d8(1->0) (in add_connection() at connections.c:2026) | delref fd@0x5634e17af7f8(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | delref fd@0x5634e17af7f8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17af7f8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.526 (0.526) milliseconds in whack | newref struct fd@0x5634e17a7818(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a7818 (in whack_handle_cb() at rcv_whack.c:869) | whack: key | delref pkp@0x5634e17a6848(1->0) (in free_public_keyentry() at secrets.c:1591) add keyid @west | 01 03 a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 | 8b 49 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e | b3 96 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 | 09 f0 c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 | 8f 95 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 | f5 99 f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c | ac 34 ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a | 94 d3 d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 | b2 2b 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 | 7d 7a 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a | 8f 52 a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 | ca 80 db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc | 2a b3 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e | d3 3a 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 | 87 33 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d | 6e e8 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f | c9 20 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 | 15 04 37 f9 | computed rsa CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | keyid: *AQOm9dY/4 | size: 274 | n | a6 f5 d6 3f e3 8f 6c 01 6a fc 7b 7c 6d 57 8b 49 | 39 0d 77 f7 ac e2 85 f1 98 1e 4b 6d a5 3e b3 96 | 9a d1 99 5a bc 10 f2 97 de f2 28 f9 5f 92 09 f0 | c8 d4 12 e4 60 6e 9c 60 98 10 01 7d 26 b7 8f 95 | 62 2d 87 dd cd de f6 d3 8f 35 b0 50 d0 18 f5 99 | f8 04 f1 ff 61 5b bc 7f 1f c0 04 d8 e4 8c ac 34 | ad 7a c1 da 3c 2d 8c 30 ae d6 3c 59 b1 3a 94 d3 | d5 2a 73 91 bd 59 5f 3e 72 bf 4a 1b 9d c5 b2 2b | 4d e7 0d 24 3e 77 f9 7f 2d d6 9d 29 ef 70 7d 7a | 6d a2 b8 61 0c 4b 09 4a 06 71 84 70 85 9a 8f 52 | a1 80 06 fd c6 fc 3e 27 fa 16 fa 32 83 a9 ca 80 | db 0f 4a bf f7 e9 55 8e bd 29 4d 23 a6 dc 2a b3 | 5d 62 a9 21 1e be 83 d8 69 3c 03 0a 48 8e d3 3a | 11 f2 86 5a d1 30 65 bd c8 f4 83 87 ff 04 87 33 | 05 4f e0 d8 8c fe b3 19 4c dd 85 40 f3 4d 6e e8 | 49 14 06 2c 1f 59 59 05 8f 20 b0 ca 46 3f c9 20 | 7e 04 30 7d 9a 80 6c 3f 0a 89 f7 d3 af d8 15 04 | 37 f9 | e | 03 | CKAID | b4 9f 1a ac 9e 45 6e 79 29 c8 81 97 3a 0c 6a d3 | 7f 0f 03 50 | newref struct pubkey@0x5634e17a6848(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17a6848(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17a6848(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | spent 0.00665 (0.00651) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | delref fd@0x5634e17a7818(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a7818 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.223 (0.25) milliseconds in whack | newref struct fd@0x5634e17a1fd8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a1fd8 (in whack_handle_cb() at rcv_whack.c:869) | whack: key | delref pkp@0x5634e17ac278(1->0) (in free_public_keyentry() at secrets.c:1591) add keyid @east | 01 03 bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b | e5 16 c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 | 85 7a e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c | 78 ca 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 | 21 c9 f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d | d2 67 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 | 62 cd 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce | 62 b5 af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e | bb 23 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d | ac 47 f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce | e0 98 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a | 92 b8 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 | 4d 58 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 | 5f 56 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 | d5 f1 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c | 47 cc 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 | 07 8f 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 | 51 51 48 ef | computed rsa CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | keyid: *AQO9bJbr3 | size: 274 | n | bd 6c 96 eb df 78 89 b3 ed 77 0d a1 7f 7b e5 16 | c2 c9 e4 7d 92 0a 90 9d 55 43 b4 62 13 03 85 7a | e0 26 7b 54 1f ca 09 93 cf ff 25 c9 02 4c 78 ca | 94 e5 3e ac d1 f9 a8 e5 bb 7f cc 20 84 e0 21 c9 | f0 0d c5 44 ba f3 48 64 61 58 f6 0f 63 0d d2 67 | 1e 59 8b ec f3 50 39 71 fb 39 da 11 64 b6 62 cd | 5f d3 8d 2e c1 50 ed 9c 6e 22 0c 39 a7 ce 62 b5 | af 8a 80 0f 2e 4c 05 5c 82 c7 8d 29 02 2e bb 23 | 5f db f2 9e b5 7d e2 20 70 1a 63 f3 8e 5d ac 47 | f0 5c 26 4e b1 d0 42 60 52 4a b0 77 25 ce e0 98 | 2b 43 f4 c7 59 1a 64 01 83 ea 4e e3 1a 2a 92 b8 | 55 ab 63 dd 4b 70 47 29 dc e9 b4 60 bf 43 4d 58 | 8f 64 73 95 70 ac 35 89 b2 c2 9c d4 62 c0 5f 56 | 5f ad 1b e5 dd 49 93 6a f5 23 82 ed d4 e7 d5 f1 | 55 f2 2d a2 26 a6 36 53 2f 94 fb 99 22 5c 47 cc | 6d 80 30 88 96 38 0c f5 f2 ed 37 d0 09 d5 07 8f | 69 ef a9 99 ce 4d 1a 77 9e 39 c4 38 f3 c5 51 51 | 48 ef | e | 03 | CKAID | 61 55 99 73 d3 ac ef 7d 3a 37 0e 3e 82 ad 92 c1 | 8a 82 25 f1 | newref struct pubkey@0x5634e17ac278(0->1) (in add_public_key() at secrets.c:1716) | addref pk@0x5634e17ac278(1->2) (in add_public_key() at secrets.c:1718) | delref pkp@0x5634e17ac278(2->1) (in key_add_request() at rcv_whack.c:341) | trying secret PKK_RSA:AQOm9dY/4 | spent 0.085 (0.0852) milliseconds in preload_private_key_by_ckaid() loading private key using CKAID | no private key: can't find the private key matching the NSS CKAID | delref fd@0x5634e17a1fd8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a1fd8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.236 (0.242) milliseconds in whack | newref struct fd@0x5634e17a1fd8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a1fd8 (in whack_handle_cb() at rcv_whack.c:869) | whack: initiate | FOR_EACH_CONNECTION_... in conn_by_name | connection 'westnet-eastnet-aes-mix-2' +POLICY_UP | FOR_EACH_STATE_... in find_phase1_state | newref alloc logger@0x5634e1793f28(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a1fd8(1->2) (in new_state() at state.c:577) | creating state object #9 at 0x5634e17a7bc8 | State DB: adding IKEv2 state #9 in UNDEFINED | pstats #9 ikev2.ike started | parent state #9: UNDEFINED(ignore) => PARENT_I0(ignore) | #9.st_v2_transition NULL -> PARENT_I0->PARENT_I1 (in new_v2_ike_state() at state.c:620) | Message ID: IKE #9 initializing (IKE SA): ike.initiator.sent=0->-1 ike.initiator.recv=0->-1 ike.initiator.last_contact=0->744610.186835 ike.responder.sent=0->-1 ike.responder.recv=0->-1 ike.responder.last_contact=0->744610.186835 ike.wip.initiator=0->-1 ike.wip.responder=0->-1 | orienting westnet-eastnet-aes-mix-2 | westnet-eastnet-aes-mix-2 doesn't match 127.0.0.1:4500 at all | westnet-eastnet-aes-mix-2 doesn't match 127.0.0.1:500 at all | westnet-eastnet-aes-mix-2 doesn't match 192.0.1.254:4500 at all | westnet-eastnet-aes-mix-2 doesn't match 192.0.1.254:500 at all | westnet-eastnet-aes-mix-2 doesn't match 192.1.2.45:4500 at all | oriented westnet-eastnet-aes-mix-2's this | start processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:544) | addref fd@0x5634e17a1fd8(2->3) (in add_pending() at pending.c:86) | queuing pending IPsec SA negotiating with 192.1.2.23 IKE SA #9 "westnet-eastnet-aes-mix-2" "westnet-eastnet-aes-mix-2" #9: initiating IKEv2 connection | constructing local IKE proposals for westnet-eastnet-aes-mix-2 (IKE SA initiator selecting KE) | converting ike_info AES_CBC_256-HMAC_SHA1-MODP2048+MODP3072+MODP4096+MODP8192+DH19+DH20+DH21+DH31 to ikev2 ... | ... ikev2_proposal: 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 "westnet-eastnet-aes-mix-2": local IKE proposals (IKE SA initiator selecting KE): "westnet-eastnet-aes-mix-2": 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a1fd8(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17af668(0->1) (in clone_logger() at log.c:817) | job 13 for #9: ikev2_outI1 KE (build KE and nonce): adding job to queue | state #9 has no .st_event to delete | #9 STATE_PARENT_I0: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a3908 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #9 | libevent_malloc: newref ptr-libevent@0x5634e17af748 size 128 | #9 spent 0.163 (0.164) milliseconds in ikev2_parent_outI1() | job 13 for #9: ikev2_outI1 KE (build KE and nonce): helper 5 starting job | RESET processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in ikev2_parent_outI1() at ikev2_parent.c:640) | delref fd@0x5634e17a1fd8(4->3) (in whack_handle_cb() at rcv_whack.c:903) | spent 0.249 (0.281) milliseconds in whack | "westnet-eastnet-aes-mix-2" #9: spent 1.7 (1.81) milliseconds in helper 5 processing job 13 for state #9: ikev2_outI1 KE (pcr) | job 13 for #9: ikev2_outI1 KE (build KE and nonce): helper thread 5 sending result back to state | scheduling resume sending helper answer back to state for #9 | libevent_malloc: newref ptr-libevent@0x7f6a90004508 size 128 | helper thread 5 has nothing to do | processing resume sending helper answer back to state for #9 | start processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #9 MD (nil) | job 13 for #9: ikev2_outI1 KE (build KE and nonce): processing response from helper 5 | job 13 for #9: ikev2_outI1 KE (build KE and nonce): calling continuation function 0x5634df8f5fe7 | ikev2_parent_outI1_continue() for #9 STATE_PARENT_I0 | DH secret MODP2048@0x7f6a900046d8: transferring ownership from helper KE to state #9 | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 00 00 00 00 00 00 00 00 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 0 (00 00 00 00) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | using existing local IKE proposals for connection westnet-eastnet-aes-mix-2 (IKE SA initiator emitting local proposals): 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | Emitting ikev2_proposals ... | ***emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | ****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 11 (0b) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | ******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | emitting length of IKEv2 Transform Substructure Payload: 12 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP3072 (0xf) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP4096 (0x10) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP8192 (0x12) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_256 (0x13) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_384 (0x14) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_ECP_521 (0x15) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | *****emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_CURVE25519 (0x1f) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 100 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 104 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ***emit IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Key Exchange Payload (34:ISAKMP_NEXT_v2KE) | next payload chain: saving location 'IKEv2 Key Exchange Payload'.'next payload type' in 'reply packet' | emitting 256 raw bytes of ikev2 g^x into IKEv2 Key Exchange Payload | ikev2 g^x: | 6c 57 16 94 51 44 10 bd 37 f5 a9 e1 98 9d ba c8 | d4 c2 09 9a a6 77 d5 4c 93 85 7d 0e 1d 14 75 27 | 80 98 11 4e a5 ba 9d c3 19 ac be 71 71 16 28 0f | 1f 15 1f 70 00 7a 35 c3 8d a7 bd 6c 90 69 95 cb | a4 e3 01 a3 f8 9c f2 28 ed f4 b9 91 89 9f 28 5e | c0 9c ab f8 36 44 4c 7c 68 c4 7c a5 ce 71 74 14 | 2e dd eb 94 95 20 fb b4 b7 4e 95 b3 88 97 74 9d | b5 b5 21 c3 ed 14 a0 62 b9 4b 16 8c 67 8e 9d a8 | e8 42 af cd 34 39 2d ce 6c 21 f5 25 d4 80 59 80 | 4c 63 64 79 00 52 69 b1 c1 ad b7 66 39 49 81 5c | 5b 8a a8 aa 9f 6d 25 c7 f8 99 44 6e 0c bb a9 6c | 96 be 37 01 b5 1f 29 f1 04 d9 72 59 0e 39 8e 3a | 5d 32 b9 e8 03 b1 14 b9 3d c1 92 36 fe ed ee fc | 32 15 ab 37 ef 1c d2 8a 47 db 29 bf fc 0e dd 53 | bf ad 8e 30 96 c2 f7 fd ac 6f d5 e4 72 1f 91 f7 | 14 0d 04 b0 59 87 1d 9e bc 93 a8 c6 19 fd 90 04 | emitting length of IKEv2 Key Exchange Payload: 264 | ***emit IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Key Exchange Payload'.'next payload type' to current IKEv2 Nonce Payload (40:ISAKMP_NEXT_v2Ni) | next payload chain: saving location 'IKEv2 Nonce Payload'.'next payload type' in 'reply packet' | emitting 32 raw bytes of IKEv2 nonce into IKEv2 Nonce Payload | IKEv2 nonce: | d4 cb 89 fe 6f aa f1 9c f4 d3 ba d3 13 70 8a 2d | 20 56 40 bb 9f 6d 7f f2 84 f2 50 66 20 18 99 5b | emitting length of IKEv2 Nonce Payload: 36 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | next payload chain: setting previous 'IKEv2 Nonce Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting length of IKEv2 Notify Payload: 8 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_256: 00 02 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_384: 00 03 | emitting 2 raw bytes of hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512 into IKEv2 Notify Payload | hash algorithm identifier IKEv2_HASH_ALGORITHM_SHA2_512: 00 04 | emitting length of IKEv2 Notify Payload: 14 | NAT-Traversal support [enabled] add v2N payloads. | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 7c 3c a3 0a 2f 3b 2b ec | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 04 e9 f0 eb 5d 7d 0e b9 11 93 d8 fd cf 77 04 32 | fc 7e 85 af | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 04 e9 f0 eb 5d 7d 0e b9 11 93 d8 fd cf 77 04 32 | fc 7e 85 af | emitting length of IKEv2 Notify Payload: 28 | nat: IKE.SPIr is zero | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 7c 3c a3 0a 2f 3b 2b ec | natd_hash: rcookie= | 00 00 00 00 00 00 00 00 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 55 8f 5f a8 5c 0d d2 f4 d2 5e 1e 31 fa d0 50 9b | c2 db b8 01 | adding a v2N Payload | ***emit IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | next payload chain: setting previous 'IKEv2 Notify Payload'.'next payload type' to current IKEv2 Notify Payload (41:ISAKMP_NEXT_v2N) | next payload chain: saving location 'IKEv2 Notify Payload'.'next payload type' in 'reply packet' | emitting 20 raw bytes of Notify data into IKEv2 Notify Payload | Notify data: | 55 8f 5f a8 5c 0d d2 f4 d2 5e 1e 31 fa d0 50 9b | c2 db b8 01 | emitting length of IKEv2 Notify Payload: 28 | emitting length of ISAKMP Message: 510 | [RE]START processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #9 complete_v2_state_transition() PARENT_I0->PARENT_I1 with status STF_OK | transitioning from state STATE_PARENT_I0 to state STATE_PARENT_I1 | Message ID: updating counters for #9 | Message ID: IKE #9 skipping update_recv as MD is fake | Message ID: IKE #9 scheduling EVENT_RETRANSMIT: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744610.186835 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=0 ike.wip.responder=-1 "westnet-eastnet-aes-mix-2" #9: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17ae818 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #9 | libevent_malloc: newref ptr-libevent@0x5634e17aa978 size 128 | #9 STATE_PARENT_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744610.18941 | Message ID: IKE #9 updating initiator sent message request 0: ike.initiator.sent=-1->0 ike.initiator.recv=-1 ike.initiator.last_contact=744610.186835 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=-1->0 ike.wip.responder=-1 | Message ID: IKE #9 no pending message initiators to schedule: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744610.186835 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=0 ike.wip.responder=-1 | parent state #9: PARENT_I0(ignore) => PARENT_I1(half-open IKE SA) | announcing the state transition "westnet-eastnet-aes-mix-2" #9: sent IKE_SA_INIT request | sending 510 bytes for STATE_PARENT_I0 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 00 00 00 00 00 00 00 00 | 21 20 22 08 00 00 00 00 00 00 01 fe 22 00 00 68 | 00 00 00 64 01 01 00 0b 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 03 00 00 08 04 00 00 0e 03 00 00 08 | 04 00 00 0f 03 00 00 08 04 00 00 10 03 00 00 08 | 04 00 00 12 03 00 00 08 04 00 00 13 03 00 00 08 | 04 00 00 14 03 00 00 08 04 00 00 15 00 00 00 08 | 04 00 00 1f 28 00 01 08 00 0e 00 00 6c 57 16 94 | 51 44 10 bd 37 f5 a9 e1 98 9d ba c8 d4 c2 09 9a | a6 77 d5 4c 93 85 7d 0e 1d 14 75 27 80 98 11 4e | a5 ba 9d c3 19 ac be 71 71 16 28 0f 1f 15 1f 70 | 00 7a 35 c3 8d a7 bd 6c 90 69 95 cb a4 e3 01 a3 | f8 9c f2 28 ed f4 b9 91 89 9f 28 5e c0 9c ab f8 | 36 44 4c 7c 68 c4 7c a5 ce 71 74 14 2e dd eb 94 | 95 20 fb b4 b7 4e 95 b3 88 97 74 9d b5 b5 21 c3 | ed 14 a0 62 b9 4b 16 8c 67 8e 9d a8 e8 42 af cd | 34 39 2d ce 6c 21 f5 25 d4 80 59 80 4c 63 64 79 | 00 52 69 b1 c1 ad b7 66 39 49 81 5c 5b 8a a8 aa | 9f 6d 25 c7 f8 99 44 6e 0c bb a9 6c 96 be 37 01 | b5 1f 29 f1 04 d9 72 59 0e 39 8e 3a 5d 32 b9 e8 | 03 b1 14 b9 3d c1 92 36 fe ed ee fc 32 15 ab 37 | ef 1c d2 8a 47 db 29 bf fc 0e dd 53 bf ad 8e 30 | 96 c2 f7 fd ac 6f d5 e4 72 1f 91 f7 14 0d 04 b0 | 59 87 1d 9e bc 93 a8 c6 19 fd 90 04 29 00 00 24 | d4 cb 89 fe 6f aa f1 9c f4 d3 ba d3 13 70 8a 2d | 20 56 40 bb 9f 6d 7f f2 84 f2 50 66 20 18 99 5b | 29 00 00 08 00 00 40 2e 29 00 00 0e 00 00 40 2f | 00 02 00 03 00 04 29 00 00 1c 00 00 40 04 04 e9 | f0 eb 5d 7d 0e b9 11 93 d8 fd cf 77 04 32 fc 7e | 85 af 00 00 00 1c 00 00 40 05 55 8f 5f a8 5c 0d | d2 f4 d2 5e 1e 31 fa d0 50 9b c2 db b8 01 | sent 1 messages | checking that a retransmit timeout_event was already | state #9 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17af748 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a3908 | delref logger@0x5634e17af668(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a1fd8(3->2) (in free_logger() at log.c:854) | resume sending helper answer back to state for #9 suppresed complete_v2_state_transition() | delref mdp@NULL (in resume_handler() at server.c:743) | #9 spent 0.717 (0.74) milliseconds in resume sending helper answer back to state | stop processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6a90004508 | spent 0.00288 (0.00292) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8ef8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17af668(0->1) (in read_message() at demux.c:103) | *received 454 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 21 20 22 20 00 00 00 00 00 00 01 c6 22 00 00 30 | 00 00 00 2c 01 01 00 04 03 00 00 0c 01 00 00 0c | 80 0e 01 00 03 00 00 08 02 00 00 02 03 00 00 08 | 03 00 00 02 00 00 00 08 04 00 00 0e 28 00 01 08 | 00 0e 00 00 a4 b0 2d a8 d6 67 a4 c5 87 e0 17 71 | cf e6 c7 43 f6 67 4a 68 d5 7a 2d 25 bf 38 1c c0 | a1 5f fd 93 e8 55 12 3b 81 a2 e7 cb 33 30 c8 60 | ce f1 d5 09 8c 23 97 66 d9 12 6e 5a f3 b5 37 db | b8 06 69 ab fb c4 25 cc 98 18 50 f8 11 26 e3 e5 | 58 5d 66 9b 1d 2c 54 39 9f 23 c0 39 9f 82 71 db | 29 10 a1 8a 12 3a e9 59 a8 b0 cf a2 1f 41 31 ab | 6a e6 33 94 85 bf e2 26 08 a0 d7 92 fc 97 4d 1e | b7 cb a8 04 b8 ce 70 5c 8f fe 77 e4 2d 9b f1 63 | cd fe 6b 09 0f a7 a0 b2 86 fc d0 63 f1 92 40 16 | a0 95 35 ea d1 09 a2 99 9b 25 2b 6c 35 c6 cb c8 | b5 20 b8 89 7c 4c 26 0e a2 58 75 fb ff 24 10 02 | 7a 25 8e 57 d6 db 0e d1 02 85 f4 ad e8 71 c3 8e | ca 74 e8 33 0c ef 3a 41 98 70 71 5b 3a 42 b5 66 | 8b ed c4 d9 f3 bf 34 a8 6a ee 26 79 31 a5 96 63 | 30 67 f0 b3 a5 bf 19 b0 d4 36 2e b3 99 ea 71 7c | 04 11 82 80 29 00 00 24 66 b1 a1 98 f3 a6 c8 d2 | 18 76 b1 9f b0 74 7f a3 18 7c e6 96 62 f9 65 a2 | 2f 64 71 e2 13 ea 32 46 29 00 00 08 00 00 40 2e | 29 00 00 0e 00 00 40 2f 00 02 00 03 00 04 29 00 | 00 1c 00 00 40 04 80 5d 73 59 c2 bc 51 c9 f8 b8 | 43 76 b1 02 c0 08 a8 9e 10 00 00 00 00 1c 00 00 | 40 05 4b a5 45 1d ec fe fa 3d 49 1e ec 4a af 34 | bc 01 db 14 09 bd | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SA (0x21) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_SA_INIT (0x22) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 0 (00 00 00 00) | length: 454 (00 00 01 c6) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_SA_INIT (34) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_SA_INIT response | State DB: found IKEv2 state #9 in PARENT_I1 (find_v2_ike_sa_by_initiator_spi) | #9 is idle | #9 idle | unpacking clear payloads | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | ***parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2KE (0x22) | flags: none (0x0) | length: 48 (00 30) | processing payload: ISAKMP_NEXT_v2SA (len=44) | Now let's proceed with payload (ISAKMP_NEXT_v2KE) | ***parse IKEv2 Key Exchange Payload: | next payload type: ISAKMP_NEXT_v2Ni (0x28) | flags: none (0x0) | length: 264 (01 08) | DH group: OAKLEY_GROUP_MODP2048 (0xe) | processing payload: ISAKMP_NEXT_v2KE (len=256) | Now let's proceed with payload (ISAKMP_NEXT_v2Ni) | ***parse IKEv2 Nonce Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 36 (00 24) | processing payload: ISAKMP_NEXT_v2Ni (len=32) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 8 (00 08) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_IKEV2_FRAGMENTATION_SUPPORTED (0x402e) | processing payload: ISAKMP_NEXT_v2N (len=0) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 14 (00 0e) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_SIGNATURE_HASH_ALGORITHMS (0x402f) | processing payload: ISAKMP_NEXT_v2N (len=6) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2N (0x29) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_SOURCE_IP (0x4004) | processing payload: ISAKMP_NEXT_v2N (len=20) | Now let's proceed with payload (ISAKMP_NEXT_v2N) | ***parse IKEv2 Notify Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 28 (00 1c) | Protocol ID: IKEv2_SEC_PROTO_NONE (0x0) | SPI size: 0 (00) | Notify Message Type: v2N_NAT_DETECTION_DESTINATION_IP (0x4005) | processing payload: ISAKMP_NEXT_v2N (len=20) | looking for message matching transition from STATE_PARENT_I1 | trying received anti-DDOS COOKIE notify response; resending IKE_SA_INIT request with cookie payload added | message has errors | trying received IKE_SA_INIT INVALID_KE_PAYLOAD notify response; resending IKE_SA_INIT with new KE payload | message has errors | trying received REDIRECT notify response; resending IKE_SA_INIT request to new destination | message has errors | trying Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | matched unencrypted message | start processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1848) | calling processor Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 02 | received HASH_ALGORITHM_SHA2_256 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 03 | received HASH_ALGORITHM_SHA2_384 which is allowed by local policy | parsing 2 raw bytes of IKEv2 Notify Payload into hash algorithm identifier (network ordered) | hash algorithm identifier (network ordered) | 00 04 | received HASH_ALGORITHM_SHA2_512 which is allowed by local policy | ikev2 parent inR1: calculating g^{xy} in order to send I2 | using existing local IKE proposals for connection westnet-eastnet-aes-mix-2 (IKE SA initiator accepting remote proposal): 1:IKE=AES_CBC_256-HMAC_SHA1-HMAC_SHA1_96-MODP2048+MODP3072+MODP4096+MODP8192+ECP_256+ECP_384+ECP_521+CURVE25519 | comparing remote proposals against IKE initiator (accepting) 1 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 1 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 8 transforms | local proposal 1 type ESN has 0 transforms | local proposal 1 transforms: required: ENCR+PRF+INTEG+DH; optional: none | ****parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 44 (00 2c) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_IKE (0x1) | spi size: 0 (00) | # transforms: 4 (04) | Comparing remote proposal 1 containing 4 transforms against local proposal [1..1] of 1 local proposals | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | ******parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 256 (01 00) | remote proposal 1 transform 0 (ENCR=AES_CBC_256) matches local proposal 1 type 1 (ENCR) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_PRF (0x2) | IKEv2 transform ID: PRF_HMAC_SHA1 (0x2) | remote proposal 1 transform 1 (PRF=HMAC_SHA1) matches local proposal 1 type 2 (PRF) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 2 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | *****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_DH (0x4) | IKEv2 transform ID: OAKLEY_GROUP_MODP2048 (0xe) | remote proposal 1 transform 3 (DH=MODP2048) matches local proposal 1 type 4 (DH) transform 0 | remote proposal 1 proposed transforms: ENCR+PRF+INTEG+DH; matched: ENCR+PRF+INTEG+DH; unmatched: none | comparing remote proposal 1 containing ENCR+PRF+INTEG+DH transforms to local proposal 1; required: ENCR+PRF+INTEG+DH; optional: none; matched: ENCR+PRF+INTEG+DH | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:IKE:ENCR=AES_CBC_256;PRF=HMAC_SHA1;INTEG=HMAC_SHA1_96;DH=MODP2048[first-match] | converting proposal to internal trans attrs | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 7c 3c a3 0a 2f 3b 2b ec | natd_hash: rcookie= | 64 9b 94 9e 8e 63 c9 78 | natd_hash: ip= | c0 01 02 2d | natd_hash: port= | 01 f4 | natd_hash: hash= | 4b a5 45 1d ec fe fa 3d 49 1e ec 4a af 34 bc 01 | db 14 09 bd | natd_hash: hasher=0x5634df9e7f80(20) | natd_hash: icookie= | 7c 3c a3 0a 2f 3b 2b ec | natd_hash: rcookie= | 64 9b 94 9e 8e 63 c9 78 | natd_hash: ip= | c0 01 02 17 | natd_hash: port= | 01 f4 | natd_hash: hash= | 80 5d 73 59 c2 bc 51 c9 f8 b8 43 76 b1 02 c0 08 | a8 9e 10 00 | NAT_TRAVERSAL encaps using auto-detect | NAT_TRAVERSAL this end is NOT behind NAT | NAT_TRAVERSAL that end is NOT behind NAT | NAT_TRAVERSAL nat-keepalive enabled 192.1.2.23 | offloading IKEv2 SKEYSEED using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey=AES_CBC | DH secret MODP2048@0x7f6a900046d8: transferring ownership from state #9 to helper IKEv2 DH | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a1fd8(2->3) (in clone_logger() at log.c:810) | newref clone logger@0x5634e1793e58(0->1) (in clone_logger() at log.c:817) | job 14 for #9: ikev2_inR1outI2 KE (compute dh (V2)): adding job to queue | state #9 has no .st_event to delete | #9 requesting EVENT_RETRANSMIT-pe@0x5634e17ae818 be deleted | libevent_free: delref ptr-libevent@0x5634e17aa978 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17ae818 | #9 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17aa978 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #9 | libevent_malloc: newref ptr-libevent@0x5634e17af748 size 128 | #9 spent 0.222 (0.223) milliseconds in processing: Initiator: process IKE_SA_INIT reply, initiate IKE_AUTH or IKE_INTERMEDIATE in v2_dispatch() | [RE]START processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | job 14 for #9: ikev2_inR1outI2 KE (compute dh (V2)): helper 7 starting job | #9 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | suspending state #9 and saving MD 0x5634e17a8ef8 | addref md@0x5634e17a8ef8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #9 is busy; has suspended MD 0x5634e17a8ef8 | stop processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1850) | #9 spent 0.468 (0.474) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8ef8(2->1) (in handle_packet_cb() at demux.c:318) | spent 0.476 (0.482) milliseconds in handle_packet_cb() reading and processing packet | calculating skeyseed using prf=HMAC_SHA1 integ=HMAC_SHA1_96 cipherkey-size=32 salt-size=0 | "westnet-eastnet-aes-mix-2" #9: spent 0.752 (0.788) milliseconds in helper 7 processing job 14 for state #9: ikev2_inR1outI2 KE (pcr) | job 14 for #9: ikev2_inR1outI2 KE (compute dh (V2)): helper thread 7 sending result back to state | scheduling resume sending helper answer back to state for #9 | libevent_malloc: newref ptr-libevent@0x7f6a94002b48 size 128 | helper thread 7 has nothing to do | processing resume sending helper answer back to state for #9 | start processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #9 MD 0x5634e17a8ef8 | job 14 for #9: ikev2_inR1outI2 KE (compute dh (V2)): processing response from helper 7 | job 14 for #9: ikev2_inR1outI2 KE (compute dh (V2)): calling continuation function 0x5634df8f5fe7 | ikev2_parent_inR1outI2_continue() for #9 STATE_PARENT_I1: g^{xy} calculated, sending I2 | DH secret MODP2048@0x7f6a900046d8: transferring ownership from helper IKEv2 DH to state #9 | State DB: re-hashing IKEv2 state #9 IKE SPIi and SPI[ir] | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | get_connection_private_key() using CKAID b49f1aac9e456e7929c881973a0c6ad37f0f0350 to find private key for @west->@east of kind RSA | trying secret PKK_RSA:AQOm9dY/4 | matched | secrets entry for ckaid already exists | connection westnet-eastnet-aes-mix-2's RSA private key found in NSS DB using CKAID | addref fd@NULL (in clone_logger() at log.c:809) | addref fd@0x5634e17a1fd8(3->4) (in clone_logger() at log.c:810) | newref clone logger@0x5634e17ae818(0->1) (in clone_logger() at log.c:817) | job 15 for #9: computing responder signature (signature): adding job to queue | state #9 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17af748 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17aa978 | #9 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a4a58 | inserting event EVENT_CRYPTO_TIMEOUT, timeout in 60 seconds for #9 | libevent_malloc: newref ptr-libevent@0x5634e17ae888 size 128 | [RE]START processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #9 complete_v2_state_transition() PARENT_I1->PARENT_I2 with status STF_SUSPEND; .st_v2_transition=PARENT_I0->PARENT_I1 | suspending state #9 and saving MD 0x5634e17a8ef8 | addref md@0x5634e17a8ef8(1->2) (in complete_v2_state_transition() at ikev2.c:3485) | #9 is busy; has suspended MD 0x5634e17a8ef8 | delref logger@0x5634e1793e58(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | job 15 for #9: computing responder signature (signature): helper 1 starting job | delref fd@0x5634e17a1fd8(4->3) (in free_logger() at log.c:854) | resume sending helper answer back to state for #9 suppresed complete_v2_state_transition() | delref mdp@0x5634e17a8ef8(2->1) (in resume_handler() at server.c:743) | hash to sign | d6 d9 28 79 be 87 74 91 a4 df af 84 d1 2f 3e ca | f6 9e d6 59 fc 2d 4d b3 da 3b 96 cd 55 a0 f3 39 | 36 00 a4 a9 31 ed 7b 71 6d 2e ae 18 b8 39 5e 90 | 39 a7 5f 34 df 0e 5d f2 e1 d4 b7 df c1 4e 8c c3 | #9 spent 0.133 (0.138) milliseconds in resume sending helper answer back to state | RSA_sign_hash: Started using NSS | stop processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6a94002b48 | RSA_sign_hash: Ended using NSS | "westnet-eastnet-aes-mix-2" #9: spent 3.36 (3.48) milliseconds in v2_auth_signature() calling sign_hash() | "westnet-eastnet-aes-mix-2" #9: spent 3.38 (3.51) milliseconds in v2_auth_signature() | "westnet-eastnet-aes-mix-2" #9: spent 3.4 (3.53) milliseconds in helper 1 processing job 15 for state #9: computing responder signature (signature) | job 15 for #9: computing responder signature (signature): helper thread 1 sending result back to state | scheduling resume sending helper answer back to state for #9 | libevent_malloc: newref ptr-libevent@0x7f6aa8002b48 size 128 | helper thread 1 has nothing to do | processing resume sending helper answer back to state for #9 | start processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in resume_handler() at server.c:641) | unsuspending #9 MD 0x5634e17a8ef8 | job 15 for #9: computing responder signature (signature): processing response from helper 1 | job 15 for #9: computing responder signature (signature): calling continuation function 0x5634df82477f | newref alloc logger@0x5634e1793e58(0->1) (in new_state() at state.c:576) | addref fd@0x5634e17a1fd8(3->4) (in new_state() at state.c:577) | creating state object #10 at 0x5634e17b1af8 | State DB: adding IKEv2 state #10 in UNDEFINED | pstats #10 ikev2.child started | duplicating state object #9 "westnet-eastnet-aes-mix-2" as #10 for IPSEC SA | #10 setting local endpoint to 192.1.2.45:500 from #9.st_localport (in duplicate_state() at state.c:1581) | Message ID: CHILD #9.#10 initializing (CHILD SA): ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744610.186835 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=0->-1 child.wip.responder=0->-1 | child state #10: UNDEFINED(ignore) => V2_IKE_AUTH_CHILD_I0(ignore) | #10.st_v2_transition NULL -> NULL (in new_v2_child_state() at state.c:1666) | Message ID: IKE #9 switching from IKE SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744610.186835 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=0->-1 ike.wip.responder=-1 | Message ID: CHILD #9.#10 switching to CHILD SA initiator message response 0: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744610.186835 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=-1->0 child.wip.responder=-1 | switching IKEv2 MD.ST from IKE #9 PARENT_I1 to CHILD #10 V2_IKE_AUTH_CHILD_I0 (in ikev2_parent_inR1outI2_auth_signature_continue() at ikev2_parent.c:2155) | state #9 deleting .st_event EVENT_CRYPTO_TIMEOUT | libevent_free: delref ptr-libevent@0x5634e17ae888 | free_event_entry: delref EVENT_CRYPTO_TIMEOUT-pe@0x5634e17a4a58 | #9 STATE_PARENT_I1: retransmits: cleared | event_schedule: newref EVENT_SA_REPLACE-pe@0x5634e17ae888 | inserting event EVENT_SA_REPLACE, timeout in 120 seconds for #9 | libevent_malloc: newref ptr-libevent@0x7f6a94002b48 size 128 | parent state #9: PARENT_I1(half-open IKE SA) => PARENT_I2(open IKE SA) | opening output PBS reply packet | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'reply packet' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | IKEv2 CERT: send a certificate? | IKEv2 CERT: no certificate to send | IDr payload will be sent | ****emit IKEv2 Identification - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Identification - Initiator - Payload (35:ISAKMP_NEXT_v2IDi) | next payload chain: saving location 'IKEv2 Identification - Initiator - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of my identity into IKEv2 Identification - Initiator - Payload | my identity: 77 65 73 74 | emitting length of IKEv2 Identification - Initiator - Payload: 12 | ****emit IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | next payload chain: setting previous 'IKEv2 Identification - Initiator - Payload'.'next payload type' to current IKEv2 Identification - Responder - Payload (36:ISAKMP_NEXT_v2IDr) | next payload chain: saving location 'IKEv2 Identification - Responder - Payload'.'next payload type' in 'reply packet' | emitting 4 raw bytes of their IDr into IKEv2 Identification - Responder - Payload | their IDr: 65 61 73 74 | emitting length of IKEv2 Identification - Responder - Payload: 12 | not sending INITIAL_CONTACT | ****emit IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | auth method: IKEv2_AUTH_DIGSIG (0xe) | next payload chain: setting previous 'IKEv2 Identification - Responder - Payload'.'next payload type' to current IKEv2 Authentication Payload (39:ISAKMP_NEXT_v2AUTH) | next payload chain: saving location 'IKEv2 Authentication Payload'.'next payload type' in 'reply packet' | emit hash algo NEGOTIATE_AUTH_HASH_SHA2_512 | emitting 68 raw bytes of OID of ASN.1 Algorithm Identifier into IKEv2 Authentication Payload | OID of ASN.1 Algorithm Identifier: | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | emitting 274 raw bytes of signature into IKEv2 Authentication Payload | signature: | 1c 5c 90 fb e1 76 40 37 3d 83 31 43 c8 2a fa 8f | 2b 7b 5a d6 84 0c cf 75 75 2a 07 d7 94 04 d0 8e | 94 6b 61 50 a8 07 4b b5 0e 57 1c 32 1e f6 8b 7f | 28 a4 ba 1b 32 5d bf 81 9e 38 33 c6 23 ff 24 ee | e4 47 8f 4a 38 69 3e 6f 6a 14 54 3b a1 3f c5 97 | 8b dd f8 ad a6 96 0c d7 b0 08 ba 03 f3 86 c8 d2 | 23 82 f6 5b a8 8c 49 ae 56 9d 73 66 03 5b 56 4e | b6 7d c1 59 19 59 30 ac b2 d7 aa 5d a1 2b 12 fc | 8a 07 bf a0 7d 56 52 b2 d7 11 0d c2 b2 8c c9 9e | 5b 63 83 34 2b 24 c9 f3 ac eb b8 aa 56 3e dd ab | 42 1b 41 51 33 03 da fc 82 3e 4c 02 bd 01 99 92 | aa f0 04 0f 1f d8 58 e0 e2 d9 86 39 55 15 b5 c8 | 12 2f b6 b3 6b b4 cc 75 81 ca 0f 1b 21 f7 7d f8 | e6 e2 51 4d 7f 74 d4 7f 77 6c 56 12 6b f2 a9 d3 | 91 34 c2 69 1e 5c d5 ff da 10 88 e9 c2 41 ff e5 | 8b 40 a5 b8 8a 99 a4 15 ef 93 82 27 08 4c 4d d6 | e5 58 ce c6 44 a4 8c 0f 1a 39 0a 50 b4 4b 6f 98 | d5 ef | emitting length of IKEv2 Authentication Payload: 350 | getting first pending from state #9 | delref fd@0x5634e17a1fd8(4->3) (in first_pending() at pending.c:318) | addref fd@0x5634e17a1fd8(3->4) (in first_pending() at pending.c:319) | netlink_get_spi: allocated 0x5cafef29 for esp.0@192.1.2.45 | constructing ESP/AH proposals with all DH removed for westnet-eastnet-aes-mix-2 (IKE SA initiator emitting ESP/AH proposals) | converting proposal AES_CBC_128-HMAC_SHA1_96 to ikev2 ... | ... ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA1_96-NONE-DISABLED "westnet-eastnet-aes-mix-2": local ESP/AH proposals (IKE SA initiator emitting ESP/AH proposals): "westnet-eastnet-aes-mix-2": 1:ESP=AES_CBC_128-HMAC_SHA1_96-NONE-DISABLED | Emitting ikev2_proposals ... | ****emit IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'IKEv2 Authentication Payload'.'next payload type' to current IKEv2 Security Association Payload (33:ISAKMP_NEXT_v2SA) | next payload chain: saving location 'IKEv2 Security Association Payload'.'next payload type' in 'reply packet' | discard DH=NONE when counting transforms (multiple 0; allow single 0) | *****emit IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | last substructure: saving location 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' | emitting 4 raw bytes of our spi into IKEv2 Proposal Substructure Payload | our spi: 5c af ef 29 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | *******emit IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | emitting length of IKEv2 Transform Substructure Payload: 12 | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | discard DH=NONE when emitting proposal (multiple 0; allow single 0) | ******emit IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' containing v2_TRANSFORM_NON_LAST (0x3) is v2_TRANSFORM_NON_LAST (0x3) | last substructure: saving location 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' | emitting length of IKEv2 Transform Substructure Payload: 8 | emitting length of IKEv2 Proposal Substructure Payload: 40 | last substructure: checking 'IKEv2 Proposal Substructure Payload'.'IKEv2 Transform Substructure Payload'.'last transform' is 0 | emitting length of IKEv2 Security Association Payload: 44 | last substructure: checking 'IKEv2 Security Association Payload'.'IKEv2 Proposal Substructure Payload'.'last proposal' is 0 | ****emit IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Security Association Payload'.'next payload type' to current IKEv2 Traffic Selector - Initiator - Payload (44:ISAKMP_NEXT_v2TSi) | next payload chain: saving location 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 01 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 01 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Initiator - Payload: 24 | ****emit IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | number of TS: 1 (01) | next payload chain: setting previous 'IKEv2 Traffic Selector - Initiator - Payload'.'next payload type' to current IKEv2 Traffic Selector - Responder - Payload (45:ISAKMP_NEXT_v2TSr) | next payload chain: saving location 'IKEv2 Traffic Selector - Responder - Payload'.'next payload type' in 'reply packet' | *****emit IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | start port: 0 (00 00) | end port: 65535 (ff ff) | emitting 4 raw bytes of IP start into IKEv2 Traffic Selector | IP start: c0 00 02 00 | emitting 4 raw bytes of IP end into IKEv2 Traffic Selector | IP end: c0 00 02 ff | emitting length of IKEv2 Traffic Selector: 16 | emitting length of IKEv2 Traffic Selector - Responder - Payload: 24 | Initiator child policy is tunnel mode, NOT sending v2N_USE_TRANSPORT_MODE | initiator child policy is compress=no, NOT sending v2N_IPCOMP_SUPPORTED | adding 14 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 512 | emitting length of ISAKMP Message: 540 | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | length: 540 (00 00 02 1c) | **parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | length: 512 (02 00) | opening output PBS reply frag packet | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 1 (00 00 00 01) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encrypted Fragment: | next payload type: ISAKMP_NEXT_v2IDi (0x23) | flags: none (0x0) | fragment number: 1 (00 01) | total fragments: 1 (00 01) | next payload chain: using supplied v2SKF 'IKEv2 Encrypted Fragment'.'next payload type' value 35:ISAKMP_NEXT_v2IDi | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encrypted Fragment (53:ISAKMP_NEXT_v2SKF) | next payload chain: saving location 'IKEv2 Encrypted Fragment'.'next payload type' in 'reply frag packet' | emitting 16 zero bytes of IV into IKEv2 Encrypted Fragment | emitting 466 raw bytes of cleartext fragment into IKEv2 Encrypted Fragment | cleartext fragment: | 24 00 00 0c 02 00 00 00 77 65 73 74 27 00 00 0c | 02 00 00 00 65 61 73 74 21 00 01 5e 0e 00 00 00 | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 1c 5c 90 fb e1 76 40 37 3d 83 31 43 | c8 2a fa 8f 2b 7b 5a d6 84 0c cf 75 75 2a 07 d7 | 94 04 d0 8e 94 6b 61 50 a8 07 4b b5 0e 57 1c 32 | 1e f6 8b 7f 28 a4 ba 1b 32 5d bf 81 9e 38 33 c6 | 23 ff 24 ee e4 47 8f 4a 38 69 3e 6f 6a 14 54 3b | a1 3f c5 97 8b dd f8 ad a6 96 0c d7 b0 08 ba 03 | f3 86 c8 d2 23 82 f6 5b a8 8c 49 ae 56 9d 73 66 | 03 5b 56 4e b6 7d c1 59 19 59 30 ac b2 d7 aa 5d | a1 2b 12 fc 8a 07 bf a0 7d 56 52 b2 d7 11 0d c2 | b2 8c c9 9e 5b 63 83 34 2b 24 c9 f3 ac eb b8 aa | 56 3e dd ab 42 1b 41 51 33 03 da fc 82 3e 4c 02 | bd 01 99 92 aa f0 04 0f 1f d8 58 e0 e2 d9 86 39 | 55 15 b5 c8 12 2f b6 b3 6b b4 cc 75 81 ca 0f 1b | 21 f7 7d f8 e6 e2 51 4d 7f 74 d4 7f 77 6c 56 12 | 6b f2 a9 d3 91 34 c2 69 1e 5c d5 ff da 10 88 e9 | c2 41 ff e5 8b 40 a5 b8 8a 99 a4 15 ef 93 82 27 | 08 4c 4d d6 e5 58 ce c6 44 a4 8c 0f 1a 39 0a 50 | b4 4b 6f 98 d5 ef 2c 00 00 2c 00 00 00 28 01 03 | 04 03 5c af ef 29 03 00 00 0c 01 00 00 0c 80 0e | 00 80 03 00 00 08 03 00 00 02 00 00 00 08 05 00 | 00 00 2d 00 00 18 01 00 00 00 07 00 00 10 00 00 | ff ff c0 00 01 00 c0 00 01 ff 00 00 00 18 01 00 | 00 00 07 00 00 10 00 00 ff ff c0 00 02 00 c0 00 | 02 ff | adding 14 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x08 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x09 repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0a repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0b repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0c repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 1 0x0d repeated bytes of padding and length into IKEv2 Encrypted Fragment | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encrypted Fragment | emitting length of IKEv2 Encrypted Fragment: 516 | emitting length of ISAKMP Message: 544 | recording fragment 1 | delref logger@0x5634e17ae818(1->0) (in handle_helper_answer() at pluto_crypt.c:658) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@0x5634e17a1fd8(4->3) (in free_logger() at log.c:854) | XXX: resume sending helper answer back to state for #9 switched MD.ST to #10 | suspend processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | start processing: state #10 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #10 complete_v2_state_transition() in state V2_IKE_AUTH_CHILD_I0 PARENT_I1->PARENT_I2 with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I1 to state STATE_PARENT_I2 | Message ID: updating counters for #10 | Message ID: CHILD #9.#10 XXX: no EVENT_RETRANSMIT to clear; suspect IKE->CHILD switch: ike.initiator.sent=0 ike.initiator.recv=-1 ike.initiator.last_contact=744610.186835 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: CHILD #9.#10 updating initiator received message response 0: ike.initiator.sent=0 ike.initiator.recv=-1->0 ike.initiator.last_contact=744610.186835->744610.198133 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=0->-1 child.wip.responder=-1 | Message ID: CHILD #9.#10 scheduling EVENT_RETRANSMIT: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744610.198133 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=1 child.wip.responder=-1 "westnet-eastnet-aes-mix-2" #10: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17ab988 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #10 | libevent_malloc: newref ptr-libevent@0x5634e17af718 size 128 | #10 STATE_V2_IKE_AUTH_CHILD_I0: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744610.198163 | Message ID: CHILD #9.#10 updating initiator sent message request 1: ike.initiator.sent=0->1 ike.initiator.recv=0 ike.initiator.last_contact=744610.198133 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=-1->1 child.wip.responder=-1 | Message ID: IKE #9 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744610.198133 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #10: V2_IKE_AUTH_CHILD_I0(ignore) => PARENT_I2(open IKE SA) | announcing the state transition "westnet-eastnet-aes-mix-2" #9: sent IKE_AUTH request {auth=IKEv2 cipher=AES_CBC_256 integ=HMAC_SHA1_96 prf=HMAC_SHA1 group=MODP2048} | sending 544 bytes for STATE_PARENT_I1 through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 35 20 23 08 00 00 00 01 00 00 02 20 23 00 02 04 | 00 01 00 01 73 1e 7f e8 4d fd 98 56 35 1e b1 f0 | 45 0b 50 73 37 86 df ce 2d 87 f2 7c ff b2 a5 b4 | 1e 23 5d 7e 86 7f dd e4 ad 3d 9e b4 52 2d 46 7a | 5f 54 a4 e1 71 4b 9e 05 eb 03 10 d5 72 af 53 ec | bc 84 79 25 c0 3b a7 29 a4 94 34 f4 cf 00 0a 19 | c8 1e be 70 27 00 a5 2d f1 a4 b9 83 9e 66 44 c1 | 06 3d f3 77 7d d4 29 ae 7a 62 7e 34 8c 9d c8 ab | fd 9c 36 91 6b ef 18 17 e8 cb 9c 0f de 81 db dc | f6 6f 09 6e b7 93 c3 1d a7 28 d6 66 c9 0b 7e 07 | 6f 71 56 05 42 bd 6f 5d f3 8a df cf 53 31 23 10 | 86 37 de 36 59 b1 c3 1c 79 c7 9a 5a 66 ad fe bc | 3d 7a 14 f5 2c bc 71 ba 43 b4 ac 37 a7 2c 2d fd | 9b 0e b8 93 17 d4 cd 06 44 41 16 2f b5 f9 b7 3a | de 60 e5 d3 e3 25 dc 6d 49 43 70 31 4f 44 b8 41 | bf 70 57 4b b2 90 22 cb 9b c3 fa 98 ca 59 16 3f | 95 89 6e 48 27 5f a6 4d 0c 6a a1 6d aa 53 40 f9 | 0a 2d 6c ce 61 bc 64 1c ac 15 c2 9c b2 fd 47 f1 | e0 47 e4 7e 12 58 8f 47 35 db a0 c2 4e b2 3a 26 | 7d f8 38 45 c9 41 6e 2c fe 4e eb 67 95 a3 1e 0d | c0 ed ca 2e d9 9a a7 5c 32 fa 36 41 b7 cb 59 51 | 1a 75 61 e1 c8 84 27 c0 90 f6 30 e1 36 63 8a 19 | 18 1f 0b 38 b3 be 86 bd fe d9 16 e7 4d dd 68 fa | 9c 71 42 22 9c ac 58 30 c7 f3 e2 f9 06 57 3d e1 | cd d5 fe d0 62 d9 25 5c 82 97 af 2d d9 c3 83 39 | 50 c5 b2 b5 dd 33 da 9e a0 52 2a 65 19 43 b5 aa | c2 48 0c 9f c8 c0 c8 7e d9 c9 71 a9 f9 4e 76 7b | 0f 9b c6 aa 9b 05 70 67 d1 76 a3 07 79 3f c7 64 | 69 e8 19 b6 1f 0f 84 50 bc 56 78 3d 89 8a 96 90 | d3 10 a1 2b 14 ec 63 29 80 a0 35 29 79 f3 3a a9 | 22 c0 2c 8f 18 d5 a0 68 30 86 45 01 4b 82 e7 ec | e8 be 01 df 6b 3b 16 70 3b ed 38 25 be 4a 67 10 | 45 e7 83 aa 8e 84 92 9b 42 27 82 d4 07 87 8a 2d | sent 1 messages | checking that a retransmit timeout_event was already | state #10 has no .st_event to delete | delref mdp@0x5634e17a8ef8(1->0) (in resume_handler() at server.c:743) | delref logger@0x5634e17af668(1->0) (in resume_handler() at server.c:743) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | #9 spent 0.915 (0.935) milliseconds in resume sending helper answer back to state | stop processing: state #10 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in resume_handler() at server.c:745) | libevent_free: delref ptr-libevent@0x7f6aa8002b48 | spent 0.00256 (0.00257) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a8ef8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e17ae818(0->1) (in read_message() at demux.c:103) | *received 524 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 23 20 00 00 00 01 00 00 02 0c 24 00 01 f0 | ac 61 cc df 5b c4 53 69 ed 6a aa ff 48 05 5a 92 | 43 33 ed ea f5 d7 83 e7 2d e9 8f 02 3c ca 6d 79 | eb fe e0 b3 bd da c5 1b b8 ab 5b 00 5c ec c3 7a | 32 a1 a7 12 9a 04 36 93 0a f4 9e 56 2d 27 f8 c9 | 1e fa 6b 71 8f e2 95 f0 cd 14 6d ab 17 43 23 32 | 34 15 9f ae 67 36 aa b6 f8 7b 80 b4 e6 8a df 2e | d8 b8 a1 7a a8 70 81 fe 6d 35 62 50 63 40 5b 6f | 6f 2f de 5d 22 e6 5a e7 06 1a 9c 10 65 c9 6e 6b | 74 d0 6a 45 b1 2b 65 aa c0 c2 ed 9b be 1d a9 6d | 11 f3 2f c4 25 7d f3 2a 71 f1 79 5e 2b 2e 0c 46 | c4 05 0b d6 37 e5 e8 a6 d2 16 12 1c 1b 54 b7 31 | e4 91 17 93 f8 f3 73 0f e6 90 c1 d8 04 25 b7 a6 | c5 cf e8 38 a6 7d 4b b4 ef f5 c6 f4 5f cf 3d 95 | 9f 9e 51 6d 4c 66 fa 66 02 cf 2e 4b 64 1d 6b 6a | 28 7b f2 b9 4b 28 e2 a0 eb 77 fe 7b d5 7a 01 d4 | df 9b 58 5c d0 30 f0 b6 bc 3b 65 af 18 cf 2a 87 | 24 dd 2a 54 5a 95 f0 e0 17 ff ea d7 be df 39 3d | e9 e7 e8 99 85 23 63 67 d7 d2 53 05 b6 16 95 a6 | 45 2b 2b 51 30 22 f6 1e 89 72 d3 ad 9b 70 67 4d | 90 d0 72 34 82 96 9f bb be 1a 45 5a 65 cb 29 99 | 26 db 0e 60 da be 30 20 73 9a d1 3f c6 ad 55 13 | 70 00 a3 fb f0 3a 0e da 4a 1d 1e 0d 18 19 1c 43 | bf 66 4a a5 46 af 1e 1e 99 71 d3 62 aa 8a 1e 04 | 92 90 c8 c7 c6 d8 64 91 26 e7 ef 9f f6 15 ca 7b | 8a 91 a7 e3 a8 ae b1 e0 28 e9 3b aa e2 e5 40 7d | ad 45 70 58 c3 33 22 7c 7e 65 7f 2a 26 a3 08 d7 | bb 66 74 0c 00 0a 32 12 0e 8f 0c cf 22 55 a4 20 | 89 9c c7 cd a6 d4 0b cb 34 36 a0 54 a0 08 10 03 | e8 58 57 d4 b7 11 5d ac 01 8e d3 78 61 52 92 bd | d4 d5 ea fe 5c 34 72 a5 8f fc ac 8f 41 17 13 6d | 39 8f ed f0 f1 61 4b 50 b9 c4 49 10 | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_IKE_AUTH (0x23) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 1 (00 00 00 01) | length: 524 (00 00 02 0c) | processing version=2.0 packet with exchange type=ISAKMP_v2_IKE_AUTH (35) | I am the IKE SA Original Initiator receiving an IKEv2 IKE_AUTH response | State DB: found IKEv2 state #9 in PARENT_I2 (find_v2_ike_sa) | start processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1902) | State DB: found IKEv2 state #10 in PARENT_I2 (find_v2_sa_by_initiator_wip) | #10 is idle | #10 idle | suspend processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | start processing: state #10 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in ike_process_packet() at ikev2.c:1983) | unpacking clear payload | Now let's proceed with payload (ISAKMP_NEXT_v2SK) | ***parse IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2IDr (0x24) | flags: none (0x0) | length: 496 (01 f0) | processing payload: ISAKMP_NEXT_v2SK (len=492) | #10 in state PARENT_I2: sent IKE_AUTH request | authenticator matched | #9 ikev2 ISAKMP_v2_IKE_AUTH decrypt success | Now let's proceed with payload (ISAKMP_NEXT_v2IDr) | **parse IKEv2 Identification - Responder - Payload: | next payload type: ISAKMP_NEXT_v2AUTH (0x27) | flags: none (0x0) | length: 12 (00 0c) | ID type: ID_FQDN (0x2) | reserved: 00 00 00 | processing payload: ISAKMP_NEXT_v2IDr (len=4) | Now let's proceed with payload (ISAKMP_NEXT_v2AUTH) | **parse IKEv2 Authentication Payload: | next payload type: ISAKMP_NEXT_v2SA (0x21) | flags: none (0x0) | length: 350 (01 5e) | auth method: IKEv2_AUTH_DIGSIG (0xe) | processing payload: ISAKMP_NEXT_v2AUTH (len=342) | Now let's proceed with payload (ISAKMP_NEXT_v2SA) | **parse IKEv2 Security Association Payload: | next payload type: ISAKMP_NEXT_v2TSi (0x2c) | flags: none (0x0) | length: 44 (00 2c) | processing payload: ISAKMP_NEXT_v2SA (len=40) | Now let's proceed with payload (ISAKMP_NEXT_v2TSi) | **parse IKEv2 Traffic Selector - Initiator - Payload: | next payload type: ISAKMP_NEXT_v2TSr (0x2d) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSi (len=16) | Now let's proceed with payload (ISAKMP_NEXT_v2TSr) | **parse IKEv2 Traffic Selector - Responder - Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | length: 24 (00 18) | number of TS: 1 (01) | processing payload: ISAKMP_NEXT_v2TSr (len=16) | selected state microcode Initiator: process IKE_AUTH response | calling processor Initiator: process IKE_AUTH response | no certs to decode | offered CA: '%none' "westnet-eastnet-aes-mix-2" #10: IKEv2 mode peer ID is ID_FQDN: '@east' | verifying AUTH payload | looking for ASN.1 blob for method rsasig for hash_algo SHA2_512 | parsing 68 raw bytes of IKEv2 Authentication Payload into ASN.1 blob for hash algo | ASN.1 blob for hash algo | 43 30 41 06 09 2a 86 48 86 f7 0d 01 01 0a 30 34 | a0 0f 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 | 00 a1 1c 30 1a 06 09 2a 86 48 86 f7 0d 01 01 08 | 30 0d 06 09 60 86 48 01 65 03 04 02 03 05 00 a2 | 03 02 01 40 | required RSA CA is '%any' | trying all remote certificates public keys for RSA key that matches ID: @east | trying all preloaded keys public keys for RSA key that matches ID: @east | trying '@east' issued by CA '%any' | NSS RSA: verifying that decrypted signature matches hash: | 3b 43 c4 a0 62 d0 e9 ba bf 3e cb 16 bf 3e de 81 | 8c 8b ed 0e e8 db 60 79 93 75 82 cb 5c 8b 74 db | bb 4d 68 b4 34 0c c9 2e a6 03 5c 73 cc 8b 1d 0b | 9d f9 0e 94 e3 a6 9b c0 93 e4 34 9e a4 42 85 07 | delref pkp@NULL (in try_RSA_signature_v2() at ikev2_rsa.c:170) | addref pk@0x5634e17ac278(1->2) (in try_RSA_signature_v2() at ikev2_rsa.c:171) | an RSA Sig check passed with *AQO9bJbr3 [preloaded keys] | #9 spent 0.0814 (0.0814) milliseconds in try_all_keys() trying a pubkey "westnet-eastnet-aes-mix-2" #9: authenticated using RSA with SHA2_512 | #9 spent 0.123 (0.123) milliseconds in ikev2_verify_rsa_hash() | parent state #9: PARENT_I2(open IKE SA) => ESTABLISHED_IKE_SA(established IKE SA) | #9 will start re-keying in 2911 seconds with margin of 689 seconds (attempting re-key) | state #9 deleting .st_event EVENT_SA_REPLACE | libevent_free: delref ptr-libevent@0x7f6a94002b48 | free_event_entry: delref EVENT_SA_REPLACE-pe@0x5634e17ae888 | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17ab818 | inserting event EVENT_SA_REKEY, timeout in 2911 seconds for #9 | libevent_malloc: newref ptr-libevent@0x7f6aa8002b48 size 128 | pstats #9 ikev2.ike established | TSi: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 01 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 01 ff | TSi: parsed 1 traffic selectors | TSr: parsing 1 traffic selectors | ***parse IKEv2 Traffic Selector: | TS type: IKEv2_TS_IPV4_ADDR_RANGE (0x7) | IP Protocol ID: ALL (0x0) | length: 16 (00 10) | start port: 0 (00 00) | end port: 65535 (ff ff) | parsing 4 raw bytes of IKEv2 Traffic Selector into TS low | TS low | c0 00 02 00 | parsing 4 raw bytes of IKEv2 Traffic Selector into TS high | TS high | c0 00 02 ff | TSr: parsed 1 traffic selectors | evaluating our conn="westnet-eastnet-aes-mix-2" I=192.0.1.0/24:0:0/0 R=192.0.2.0/24:0:0/0 to their: | TSi[0] .net=192.0.1.0-192.0.1.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.1.0/24 == TSi[0]net=192.0.1.0-192.0.1.255: YES fitness 32 | narrow port end=0..65535 == TSi[0]=0..65535: 0 | TSi[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSi[0]=*0: 0 | match end->protocol=*0 == TSi[0].ipprotoid=*0: YES fitness 255 | TSr[0] .net=192.0.2.0-192.0.2.255 .iporotoid=0 .{start,end}port=0..65535 | match address end->client=192.0.2.0/24 == TSr[0]net=192.0.2.0-192.0.2.255: YES fitness 32 | narrow port end=0..65535 == TSr[0]=0..65535: 0 | TSr[0] port match: YES fitness 65536 | narrow protocol end=*0 == TSr[0]=*0: 0 | match end->protocol=*0 == TSr[0].ipprotoid=*0: YES fitness 255 | best fit so far: TSi[0] TSr[0] | found an acceptable TSi/TSr Traffic Selector | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.1.0-192.0.1.255 | printing contents struct traffic_selector | ts_type: IKEv2_TS_IPV4_ADDR_RANGE | ipprotoid: 0 | port range: 0-65535 | ip range: 192.0.2.0-192.0.2.255 | using existing local ESP/AH proposals for westnet-eastnet-aes-mix-2 (IKE_AUTH initiator accepting remote ESP/AH proposal): 1:ESP=AES_CBC_128-HMAC_SHA1_96-NONE-DISABLED | comparing remote proposals against IKE_AUTH initiator accepting remote ESP/AH proposal 1 local proposals | local proposal 1 type ENCR has 1 transforms | local proposal 1 type PRF has 0 transforms | local proposal 1 type INTEG has 1 transforms | local proposal 1 type DH has 1 transforms | local proposal 1 type ESN has 1 transforms | local proposal 1 transforms: required: ENCR+INTEG+ESN; optional: DH | ***parse IKEv2 Proposal Substructure Payload: | last proposal: v2_PROPOSAL_LAST (0x0) | length: 40 (00 28) | prop #: 1 (01) | proto ID: IKEv2_SEC_PROTO_ESP (0x3) | spi size: 4 (04) | # transforms: 3 (03) | parsing 4 raw bytes of IKEv2 Proposal Substructure Payload into remote SPI | remote SPI | 07 af 83 f5 | Comparing remote proposal 1 containing 3 transforms against local proposal [1..1] of 1 local proposals | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 12 (00 0c) | IKEv2 transform type: TRANS_TYPE_ENCR (0x1) | IKEv2 transform ID: AES_CBC (0xc) | *****parse IKEv2 Attribute Substructure Payload: | af+type: AF+IKEv2_KEY_LENGTH (0x800e) | length/value: 128 (00 80) | remote proposal 1 transform 0 (ENCR=AES_CBC_128) matches local proposal 1 type 1 (ENCR) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_NON_LAST (0x3) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_INTEG (0x3) | IKEv2 transform ID: AUTH_HMAC_SHA1_96 (0x2) | remote proposal 1 transform 1 (INTEG=HMAC_SHA1_96) matches local proposal 1 type 3 (INTEG) transform 0 | ****parse IKEv2 Transform Substructure Payload: | last transform: v2_TRANSFORM_LAST (0x0) | length: 8 (00 08) | IKEv2 transform type: TRANS_TYPE_ESN (0x5) | IKEv2 transform ID: ESN_DISABLED (0x0) | remote proposal 1 transform 2 (ESN=DISABLED) matches local proposal 1 type 5 (ESN) transform 0 | remote proposal 1 proposed transforms: ENCR+INTEG+ESN; matched: ENCR+INTEG+ESN; unmatched: none | comparing remote proposal 1 containing ENCR+INTEG+ESN transforms to local proposal 1; required: ENCR+INTEG+ESN; optional: DH; matched: ENCR+INTEG+ESN | remote proposal 1 matches local proposal 1 | remote accepted the proposal 1:ESP:ENCR=AES_CBC_128;INTEG=HMAC_SHA1_96;ESN=DISABLED[first-match] | IKE_AUTH initiator accepting remote ESP/AH proposal ikev2_proposal: 1:ESP=AES_CBC_128-HMAC_SHA1_96-DISABLED SPI=07af83f5 | converting proposal to internal trans attrs | integ=HMAC_SHA1_96: .key_size=20 encrypt=AES_CBC: .key_size=16 .salt_size=0 keymat_len=36 | install_ipsec_sa() for #10: inbound and outbound | could_route called for westnet-eastnet-aes-mix-2; kind=CK_PERMANENT that.has_client=yes oppo=no this.host_port=500 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-mix-2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-mix-2 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-mix-2" unrouted: NULL; eroute owner: NULL | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-mix-2' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16405 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.7af83f5@192.1.2.23 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=0 owner=#0 mode=1 | set up outgoing SA, ref=0/0 | looking for alg with encrypt: AES_CBC keylen: 128 integ: HMAC_SHA1_96 | encrypt AES_CBC keylen=128 transid=12, key_size=16, encryptalg=12 | st->st_esp.keymat_len=36 is encrypt_keymat_size=16 + integ_keymat_size=20 | setting IPsec SA replay-window to 32 | NIC esp-hw-offload not for connection 'westnet-eastnet-aes-mix-2' not available on interface eth1 | netlink: enabling tunnel mode | XFRM: adding IPsec SA with reqid 16405 | netlink: setting IPsec SA replay-window to 32 using old-style req | netlink: esp-hw-offload not set for IPsec SA | netlink response for Add SA esp.5cafef29@192.1.2.45 included non-error error | setup_half_ipsec_sa() is installing inbound eroute? inbound=1 owner=#0 mode=1 | setup_half_ipsec_sa() is installing inbound eroute | setup_half_ipsec_sa() before proto 50 | setup_half_ipsec_sa() after proto 50 | setup_half_ipsec_sa() calling raw_eroute backwards (i.e., inbound) | priority calculation of connection "westnet-eastnet-aes-mix-2" is 2084814 (0x1fcfce) | add inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => tun.10000@192.1.2.45 using reqid 16405 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | set up incoming SA, ref=0/0 | sr for #10: unrouted | route_and_eroute() for proto 0, and source port 0 dest port 0 | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-mix-2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-mix-2 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-mix-2" unrouted: NULL; eroute owner: NULL | route_and_eroute with c: westnet-eastnet-aes-mix-2 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: #10 | priority calculation of connection "westnet-eastnet-aes-mix-2" is 2084814 (0x1fcfce) | eroute_connection add eroute 192.0.1.0/24:0 --0-> 192.0.2.0/24:0 => tun.0@192.1.2.23 using reqid 16405 (raw_eroute) proto=50 | IPsec SA SPD priority set to 2084814 | raw_eroute result=success | running updown command "ipsec _updown" for verb up | command executing up-client | get_sa_info esp.7af83f5@192.1.2.23 | get_sa_info esp.5cafef29@192.1.2.45 | executing up-client: PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFI... | popen cmd is 1145 chars long | cmd( 0):PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes: | cmd( 80):-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' : | cmd( 160):PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_C: | cmd( 240):LIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.2: | cmd( 320):55.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PLUTO_S: | cmd( 400):A_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='19: | cmd( 480):2.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.25: | cmd( 560):5.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='x: | cmd( 640):frm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+P: | cmd( 720):FS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANE: | cmd( 800):NT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PE: | cmd( 880):ER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER=': | cmd( 960):0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES: | cmd(1040):='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x7af83f5 SPI_OUT=0x5c: | cmd(1120):afef29 ipsec _updown 2>&1: | route_and_eroute: firewall_notified: true | running updown command "ipsec _updown" for verb prepare | command executing prepare-client | get_sa_info esp.7af83f5@192.1.2.23 | get_sa_info esp.5cafef29@192.1.2.45 | executing prepare-client: PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUT... | popen cmd is 1150 chars long | cmd( 0):PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUT: | cmd( 160):E='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO: | cmd( 240):_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK=': | cmd( 320):255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PL: | cmd( 400):UTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIEN: | cmd( 480):T='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.2: | cmd( 560):55.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STA: | cmd( 640):CK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUN: | cmd( 720):NEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PE: | cmd( 800):RMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLU: | cmd( 880):TO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SER: | cmd( 960):VER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUT: | cmd(1040):BYTES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x7af83f5 SPI_OUT: | cmd(1120):=0x5cafef29 ipsec _updown 2>&1: | running updown command "ipsec _updown" for verb route | command executing route-client | get_sa_info esp.7af83f5@192.1.2.23 | get_sa_info esp.5cafef29@192.1.2.45 | executing route-client: PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM... | popen cmd is 1148 chars long | cmd( 0):PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-: | cmd( 80):aes-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=: | cmd( 160):'' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_M: | cmd( 240):Y_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='25: | cmd( 320):5.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PLUT: | cmd( 400):O_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT=: | cmd( 480):'192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255: | cmd( 560):.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK: | cmd( 640):='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNE: | cmd( 720):L+PFS+UP+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERM: | cmd( 800):ANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO: | cmd( 880):_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVE: | cmd( 960):R='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBY: | cmd(1040):TES='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x7af83f5 SPI_OUT=0: | cmd(1120):x5cafef29 ipsec _updown 2>&1: "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. "westnet-eastnet-aes-mix-2" #10: route-client output: Error: Peer netns reference is invalid. | route_and_eroute: instance "westnet-eastnet-aes-mix-2", setting eroute_owner {spd=0x5634e17abc58,sr=0x5634e17abc58} to #10 (was #0) (newest_ipsec_sa=#0) | inR2: instance westnet-eastnet-aes-mix-2[0], setting IKEv2 newest_ipsec_sa to #10 (was #0) (spd.eroute=#10) cloned from #9 | #10 spent 1.76 (61.8) milliseconds in processing: Initiator: process IKE_AUTH response in v2_dispatch() | [RE]START processing: state #10 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in complete_v2_state_transition() at ikev2.c:3364) | #10 complete_v2_state_transition() PARENT_I2->ESTABLISHED_CHILD_SA with status STF_OK; .st_v2_transition=NULL | transitioning from state STATE_PARENT_I2 to state STATE_V2_ESTABLISHED_CHILD_SA | Message ID: updating counters for #10 | Message ID: CHILD #9.#10 clearing EVENT_RETRANSMIT as response received: ike.initiator.sent=1 ike.initiator.recv=0 ike.initiator.last_contact=744610.198133 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=-1 child.wip.responder=-1 | #10 requesting EVENT_RETRANSMIT-pe@0x5634e17ab988 be deleted | libevent_free: delref ptr-libevent@0x5634e17af718 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17ab988 | #10 STATE_PARENT_I2: retransmits: cleared | Message ID: CHILD #9.#10 updating initiator received message response 1: ike.initiator.sent=1 ike.initiator.recv=0->1 ike.initiator.last_contact=744610.198133->744610.281421 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=1->-1 child.wip.responder=-1 | Message ID: CHILD #9.#10 skipping update_send as nothing to send: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744610.281421 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 child.wip.initiator=-1 child.wip.responder=-1 | Message ID: IKE #9 no pending message initiators to schedule: ike.initiator.sent=1 ike.initiator.recv=1 ike.initiator.last_contact=744610.281421 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=-1 ike.wip.responder=-1 | child state #10: PARENT_I2(open IKE SA) => ESTABLISHED_CHILD_SA(established CHILD SA) | pstats #10 ikev2.child established | announcing the state transition "westnet-eastnet-aes-mix-2" #10: negotiated connection [192.0.1.0-192.0.1.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] | NAT-T: encaps is 'auto' "westnet-eastnet-aes-mix-2" #10: IPsec SA established tunnel mode {ESP=>0x07af83f5 <0x5cafef29 xfrm=AES_CBC_128-HMAC_SHA1_96 NATOA=none NATD=none DPD=passive} | releasing #10's fd-fd@0x5634e17a1fd8 because IKEv2 transitions finished | delref fd@0x5634e17a1fd8(3->2) (in success_v2_state_transition() at ikev2.c:3189) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3189) | unpending #10's IKE SA #9 | unpending state #9 connection "westnet-eastnet-aes-mix-2" | delete from pending Child SA with 192.1.2.23 "westnet-eastnet-aes-mix-2" | delref fd@0x5634e17a1fd8(2->1) (in delete_pending() at pending.c:218) | removing pending policy for no connection {0x5634e17a23a8} | releasing #9's fd-fd@0x5634e17a1fd8 because IKEv2 transitions finished so releaseing IKE SA | delref fd@0x5634e17a1fd8(1->0) (in success_v2_state_transition() at ikev2.c:3222) | freeref fd-fd@0x5634e17a1fd8 (in success_v2_state_transition() at ikev2.c:3222) | delref fd@NULL (in success_v2_state_transition() at ikev2.c:3222) | #10 will start re-keying in 27961 seconds with margin of 839 seconds (attempting re-key) | state #10 has no .st_event to delete | event_schedule: newref EVENT_SA_REKEY-pe@0x5634e17ab988 | inserting event EVENT_SA_REKEY, timeout in 27961 seconds for #10 | libevent_malloc: newref ptr-libevent@0x5634e17a4068 size 128 | stop processing: state #10 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in ikev2_process_packet() at ikev2.c:1904) | #9 spent 1.76 (61.9) milliseconds | #9 spent 2.25 (62.4) milliseconds in ikev2_process_packet() | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a8ef8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e17ae818(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 2.27 (62.4) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00456 (0.00453) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00286 (0.00282) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00289 (0.00287) milliseconds in signal handler PLUTO_SIGCHLD | newref struct fd@0x5634e17a1fd8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17a1fd8 (in whack_handle_cb() at rcv_whack.c:869) | whack: delete 'westnet-eastnet-aes-mix-2' | FOR_EACH_CONNECTION_... in conn_by_name "westnet-eastnet-aes-mix-2": terminating SAs using this connection | connection 'westnet-eastnet-aes-mix-2' -POLICY_UP | FOR_EACH_STATE_... in shared_phase1_connection | connection not shared - terminating IKE and IPsec SA | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #10 | start processing: state #10 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a1fd8(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #10 ikev2.child deleted completed | #10 main thread spent 1.76 (61.8) milliseconds helper thread spent 0 (0) milliseconds in total | [RE]START processing: state #10 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-mix-2" #10: deleting state (STATE_V2_ESTABLISHED_CHILD_SA) aged 0.147467s and sending notification | child state #10: ESTABLISHED_CHILD_SA(established CHILD SA) => delete | get_sa_info esp.7af83f5@192.1.2.23 | get_sa_info esp.5cafef29@192.1.2.45 "westnet-eastnet-aes-mix-2" #10: ESP traffic information: in=0B out=0B | unsuspending #10 MD (nil) | should_send_delete: yes | #10 send IKEv2 delete notification for STATE_V2_ESTABLISHED_CHILD_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 2 (00 00 00 02) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_ESP (0x3) | SPI size: 4 (04) | number of SPIs: 1 (00 01) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting 4 raw bytes of local spis into IKEv2 Delete Payload | local spis: 5c af ef 29 | emitting length of IKEv2 Delete Payload: 12 | adding 4 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 08 00 00 00 02 00 00 00 4c 2a 00 00 30 | 07 74 cb c0 b4 8c 87 b7 b6 bd b6 a7 01 d6 9e 11 | 40 e0 3a e5 28 c2 91 00 cf 47 7c 0f 77 0f 03 50 | df 5b c6 f9 4e 20 cb da b4 e8 33 97 | sent 1 messages | Message ID: IKE #9 sender #10 in send_delete hacking around record 'n' send | Message ID: IKE #9 scheduling EVENT_RETRANSMIT: ike.initiator.sent=2 ike.initiator.recv=1 ike.initiator.last_contact=744610.281421 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=2 ike.wip.responder=-1 "westnet-eastnet-aes-mix-2" #9: IMPAIR: suppressing retransmits; scheduling timeout in 60 seconds | event_schedule: newref EVENT_RETRANSMIT-pe@0x5634e17ae818 | inserting event EVENT_RETRANSMIT, timeout in 60 seconds for #9 | libevent_malloc: newref ptr-libevent@0x5634e17a1c08 size 128 | #9 STATE_V2_ESTABLISHED_IKE_SA: retransmits: first event in 60 seconds; timeout in 60 seconds; limit of 12 retransmits; current time is 744610.345211 | Message ID: IKE #9 updating initiator sent message request 2: ike.initiator.sent=1->2 ike.initiator.recv=1 ike.initiator.last_contact=744610.281421 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=-1->2 ike.wip.responder=-1 | state #10 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x5634e17a4068 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17ab988 | #10 STATE_V2_ESTABLISHED_CHILD_SA: retransmits: cleared | running updown command "ipsec _updown" for verb down | command executing down-client | get_sa_info esp.7af83f5@192.1.2.23 | get_sa_info esp.5cafef29@192.1.2.45 | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PLUTO_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONF... | popen cmd is 1144 chars long | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-a: | cmd( 80):es-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE=': | cmd( 160):' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY: | cmd( 240):_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255: | cmd( 320):.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PLUTO: | cmd( 400):_SA_TYPE='ESP' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT=': | cmd( 480):192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.: | cmd( 560):255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK=: | cmd( 640):'xfrm' PLUTO_ADDTIME='1604157935' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL: | cmd( 720):+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANEN: | cmd( 800):T' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEE: | cmd( 880):R_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0: | cmd( 960):' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='0' PLUTO_OUTBYTES=: | cmd(1040):'0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHARED='no' SPI_IN=0x7af83f5 SPI_OUT=0x5ca: | cmd(1120):fef29 ipsec _updown 2>&1: | shunt_eroute() called for connection 'westnet-eastnet-aes-mix-2' to 'replace with shunt' for rt_kind 'prospective erouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-mix-2" is 2084814 (0x1fcfce) | IPsec SA SPD priority set to 2084814 | delete esp.7af83f5@192.1.2.23 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.7af83f5@192.1.2.23 included non-error error | priority calculation of connection "westnet-eastnet-aes-mix-2" is 2084814 (0x1fcfce) | delete inbound eroute 192.0.2.0/24:0 --0-> 192.0.1.0/24:0 => unk.10000@192.1.2.45 using reqid 0 (raw_eroute) proto=50 | raw_eroute result=success | delete esp.5cafef29@192.1.2.45 | XFRM: deleting IPsec SA with reqid 0 | netlink response for Del SA esp.5cafef29@192.1.2.45 included non-error error | in connection_discard for connection westnet-eastnet-aes-mix-2 | State DB: deleting IKEv2 state #10 in ESTABLISHED_CHILD_SA | child state #10: ESTABLISHED_CHILD_SA(established CHILD SA) => UNDEFINED(ignore) | releasing #10's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a1fd8(2->1) (in delete_state() at state.c:1195) | delref pkp@NULL (in delete_state() at state.c:1202) | stop processing: state #10 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e1793e58(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | state #9 | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | state #9 | start processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in foreach_state_by_connection_func_delete() at state.c:1406) | delref fd@NULL (in foreach_state_by_connection_func_delete() at state.c:1408) | addref fd@0x5634e17a1fd8(1->2) (in foreach_state_by_connection_func_delete() at state.c:1409) | pstats #9 ikev2.ike deleted completed | #9 main thread spent 4.64 (64.8) milliseconds helper thread spent 5.85 (6.13) milliseconds in total | [RE]START processing: state #9 connection "westnet-eastnet-aes-mix-2" from 192.1.2.23:500 (in delete_state() at state.c:935) | should_send_delete: yes "westnet-eastnet-aes-mix-2" #9: deleting state (STATE_V2_ESTABLISHED_IKE_SA) aged 0.170135s and sending notification | parent state #9: ESTABLISHED_IKE_SA(established IKE SA) => delete | unsuspending #9 MD (nil) | should_send_delete: yes | #9 send IKEv2 delete notification for STATE_V2_ESTABLISHED_IKE_SA | opening output PBS informational exchange delete request | **emit ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_NONE (0x0) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_IKE_INIT (0x8) | Message ID: 3 (00 00 00 03) | next payload chain: saving message location 'ISAKMP Message'.'next payload type' | ***emit IKEv2 Encryption Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | next payload chain: setting previous 'ISAKMP Message'.'next payload type' to current IKEv2 Encryption Payload (46:ISAKMP_NEXT_v2SK) | next payload chain: saving location 'IKEv2 Encryption Payload'.'next payload type' in 'informational exchange delete request' | emitting 16 zero bytes of IV into IKEv2 Encryption Payload | ****emit IKEv2 Delete Payload: | next payload type: ISAKMP_NEXT_v2NONE (0x0) | flags: none (0x0) | protocol ID: IKEv2_SEC_PROTO_IKE (0x1) | SPI size: 0 (00) | number of SPIs: 0 (00 00) | next payload chain: setting previous 'IKEv2 Encryption Payload'.'next payload type' to current IKEv2 Delete Payload (42:ISAKMP_NEXT_v2D) | next payload chain: saving location 'IKEv2 Delete Payload'.'next payload type' in 'informational exchange delete request' | emitting length of IKEv2 Delete Payload: 8 | adding 8 bytes of padding (including 1 byte padding-length) | emitting 1 0x00 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x01 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x02 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x03 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x04 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x05 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x06 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 1 0x07 repeated bytes of padding and length into IKEv2 Encryption Payload | emitting 12 zero bytes of length of truncated HMAC/KEY into IKEv2 Encryption Payload | emitting length of IKEv2 Encryption Payload: 48 | emitting length of ISAKMP Message: 76 | sending 76 bytes for delete notification through eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP (for #9) | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 08 00 00 00 03 00 00 00 4c 2a 00 00 30 | 98 96 37 1d 9e 8a 43 af 46 ef fd c6 0d ea 0d 56 | a0 fd be 74 75 c3 a1 44 c4 9e 90 f4 28 9c 3b 74 | dc 80 a8 80 d9 c0 b4 bb 78 79 9a 1d | sent 1 messages | Message ID: IKE #9 sender #9 in send_delete hacking around record 'n' send | Message ID: IKE #9 XXX: expecting sender.wip.initiator 2 == -1 - suspect record'n'send out-of-order?): ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744610.281421 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #9 XXX: EVENT_RETRANSMIT already scheduled -- suspect record'n'send: ike.initiator.sent=3 ike.initiator.recv=1 ike.initiator.last_contact=744610.281421 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=3 ike.wip.responder=-1 | Message ID: IKE #9 updating initiator sent message request 3: ike.initiator.sent=2->3 ike.initiator.recv=1 ike.initiator.last_contact=744610.281421 ike.responder.sent=-1 ike.responder.recv=-1 ike.responder.last_contact=744610.186835 ike.wip.initiator=2->3 ike.wip.responder=-1 | state #9 deleting .st_event EVENT_SA_REKEY | libevent_free: delref ptr-libevent@0x7f6aa8002b48 | free_event_entry: delref EVENT_SA_REKEY-pe@0x5634e17ab818 | #9 requesting EVENT_RETRANSMIT-pe@0x5634e17ae818 be deleted | libevent_free: delref ptr-libevent@0x5634e17a1c08 | free_event_entry: delref EVENT_RETRANSMIT-pe@0x5634e17ae818 | #9 STATE_V2_ESTABLISHED_IKE_SA: retransmits: cleared | State DB: IKEv2 state not found (flush_incomplete_children) | in connection_discard for connection westnet-eastnet-aes-mix-2 | State DB: deleting IKEv2 state #9 in ESTABLISHED_IKE_SA | parent state #9: ESTABLISHED_IKE_SA(established IKE SA) => UNDEFINED(ignore) | releasing #9's fd-fd@(nil) because deleting state | delref fd@NULL (in delete_state() at state.c:1195) | delref fd@0x5634e17a1fd8(2->1) (in delete_state() at state.c:1195) | delref pkp@0x5634e17ac278(2->1) (in delete_state() at state.c:1202) | stop processing: state #9 from 192.1.2.23:500 (in delete_state() at state.c:1239) | delref logger@0x5634e1793f28(1->0) (in delete_state() at state.c:1306) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | processing: STOP state #0 (in foreach_state_by_connection_func_delete() at state.c:1411) | FOR_EACH_CONNECTION_... in conn_by_name | deleting states for connection - not including other IPsec SA's | pass 0 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | pass 1 | FOR_EACH_STATE_... in foreach_state_by_connection_func_delete | shunt_eroute() called for connection 'westnet-eastnet-aes-mix-2' to 'delete' for rt_kind 'unrouted' using protoports 192.0.1.0/24:0 --0->- 192.0.2.0/24:0 | netlink_shunt_eroute for proto 0, and source 192.0.1.0/24:0 dest 192.0.2.0/24:0 | priority calculation of connection "westnet-eastnet-aes-mix-2" is 2084814 (0x1fcfce) | priority calculation of connection "westnet-eastnet-aes-mix-2" is 2084814 (0x1fcfce) | FOR_EACH_CONNECTION_... in route_owner | conn westnet-eastnet-aes-mix-2 mark 0/00000000, 0/00000000 vs | conn westnet-eastnet-aes-mix-2 mark 0/00000000, 0/00000000 | route owner of "westnet-eastnet-aes-mix-2" unrouted: NULL | running updown command "ipsec _updown" for verb unroute | command executing unroute-client | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastnet-aes-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUTE='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK='255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PLUTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIENT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLUTO_CFG_CLIENT='0' PLUTO_NM_CONFIG... | popen cmd is 1089 chars long | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='westnet-eastne: | cmd( 80):t-aes-mix-2' PLUTO_VIRT_INTERFACE='NULL' PLUTO_INTERFACE='eth1' PLUTO_XFRMI_ROUT: | cmd( 160):E='' PLUTO_NEXT_HOP='192.1.2.23' PLUTO_ME='192.1.2.45' PLUTO_MY_ID='@west' PLUTO: | cmd( 240):_MY_CLIENT='192.0.1.0/24' PLUTO_MY_CLIENT_NET='192.0.1.0' PLUTO_MY_CLIENT_MASK=': | cmd( 320):255.255.255.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16404' PL: | cmd( 400):UTO_SA_TYPE='none' PLUTO_PEER='192.1.2.23' PLUTO_PEER_ID='@east' PLUTO_PEER_CLIE: | cmd( 480):NT='192.0.2.0/24' PLUTO_PEER_CLIENT_NET='192.0.2.0' PLUTO_PEER_CLIENT_MASK='255.: | cmd( 560):255.255.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_ST: | cmd( 640):ACK='xfrm' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='RSASIG+ECDSA+ENCRYPT+TUNNEL+PFS+: | cmd( 720):IKEV2_ALLOW+IKE_FRAG_ALLOW+ESN_NO+RSASIG_v1_5' PLUTO_CONN_KIND='CK_PERMANENT' PL: | cmd( 800):UTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS: | cmd( 880):_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_CFG_SERVER='0' PLU: | cmd( 960):TO_CFG_CLIENT='0' PLUTO_NM_CONFIGURED='0' VTI_IFACE='' VTI_ROUTING='no' VTI_SHAR: | cmd(1040):ED='no' SPI_IN=0x0 SPI_OUT=0x0 ipsec _updown 2>&1: unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. unroute-client output: Error: Peer netns reference is invalid. | addref fd@0x5634e17a1fd8(1->2) (in clone_logger() at log.c:809) | addref fd@NULL (in clone_logger() at log.c:810) | newref clone logger@0x5634e17ae888(0->1) (in clone_logger() at log.c:817) | delref hp@0x5634e17aac28(1->0) (in delete_oriented_hp() at hostpair.c:360) | flush revival: connection 'westnet-eastnet-aes-mix-2' wasn't on the list | delref vip@NULL (in discard_connection() at connections.c:262) | delref vip@NULL (in discard_connection() at connections.c:263) | Connection DB: deleting connection $5 | delref logger@0x5634e17ae888(1->0) (in delete_connection() at connections.c:214) | delref fd@0x5634e17a1fd8(2->1) (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | FOR_EACH_CONNECTION_... in conn_by_name | delref fd@0x5634e17a1fd8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17a1fd8 (in whack_handle_cb() at rcv_whack.c:903) | spent 1.74 (52.5) milliseconds in whack | spent 0.00224 (0.00225) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e1794058(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | d0 2e 30 6b 3d 98 c4 4e ab 05 f8 55 09 eb a0 0d | 8a 9d 75 23 68 a3 c0 b4 27 49 6a 72 4f 9b 07 f0 | 4d f8 f5 f5 aa 7e b6 0e 6a 6d be 55 | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e1794058(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0947 (0.0988) milliseconds in handle_packet_cb() reading and processing packet | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00489 (0.00476) milliseconds in signal handler PLUTO_SIGCHLD | processing signal PLUTO_SIGCHLD | waitpid returned ECHILD (no child processes left) | spent 0.00313 (0.00313) milliseconds in signal handler PLUTO_SIGCHLD | spent 0.0016 (0.00161) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e1794058(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 20 00 00 00 02 00 00 00 4c 2a 00 00 30 | d0 2e 30 6b 3d 98 c4 4e ab 05 f8 55 09 eb a0 0d | 8a 9d 75 23 68 a3 c0 b4 27 49 6a 72 4f 9b 07 f0 | 4d f8 f5 f5 aa 7e b6 0e 6a 6d be 55 | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 2 (00 00 00 02) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e1794058(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0755 (0.0756) milliseconds in handle_packet_cb() reading and processing packet | spent 0.00146 (0.00149) milliseconds in udp_read_packet() calling check_incoming_msg_errqueue() | newref struct msg_digest@0x5634e17a7bc8(0->1) (in read_message() at demux.c:103) | newref alloc logger@0x5634e1794058(0->1) (in read_message() at demux.c:103) | *received 76 bytes from 192.1.2.23:500 on eth1 192.1.2.45:500 using UDP | 7c 3c a3 0a 2f 3b 2b ec 64 9b 94 9e 8e 63 c9 78 | 2e 20 25 20 00 00 00 03 00 00 00 4c 00 00 00 30 | be 26 f2 17 75 ee 87 d3 25 f0 df 96 c1 e5 90 4f | 2b a8 7a 3d 58 3f 4d 1e 90 86 89 c0 d9 29 5d 7b | 3f d2 57 89 47 45 64 81 2d 2d cf ac | **parse ISAKMP Message: | initiator SPI: 7c 3c a3 0a 2f 3b 2b ec | responder SPI: 64 9b 94 9e 8e 63 c9 78 | next payload type: ISAKMP_NEXT_v2SK (0x2e) | ISAKMP version: IKEv2 version 2.0 (rfc4306/rfc5996) (0x20) | exchange type: ISAKMP_v2_INFORMATIONAL (0x25) | flags: ISAKMP_FLAG_v2_MSG_RESPONSE (0x20) | Message ID: 3 (00 00 00 03) | length: 76 (00 00 00 4c) | processing version=2.0 packet with exchange type=ISAKMP_v2_INFORMATIONAL (37) | I am the IKE SA Original Initiator receiving an IKEv2 INFORMATIONAL response | State DB: IKEv2 state not found (find_v2_ike_sa) packet from 192.1.2.23:500: INFORMATIONAL message response has no corresponding IKE SA | processing: STOP state #0 (in process_md() at demux.c:287) | delref mdp@0x5634e17a7bc8(1->0) (in handle_packet_cb() at demux.c:318) | delref logger@0x5634e1794058(1->0) (in handle_packet_cb() at demux.c:318) | delref fd@NULL (in free_logger() at log.c:853) | delref fd@NULL (in free_logger() at log.c:854) | spent 0.0765 (0.0765) milliseconds in handle_packet_cb() reading and processing packet | newref struct fd@0x5634e17af7b8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17af7b8 (in whack_handle_cb() at rcv_whack.c:869) | whack: status | FOR_EACH_CONNECTION_... in show_connections_status | FOR_EACH_STATE_... in show_states (sort_states) | delref fd@0x5634e17af7b8(1->0) (in whack_handle_cb() at rcv_whack.c:903) | freeref fd-fd@0x5634e17af7b8 (in whack_handle_cb() at rcv_whack.c:903) | spent 0.235 (0.234) milliseconds in whack | newref struct fd@0x5634e17af7b8(0->1) (in whack_handle_cb() at rcv_whack.c:869) | fd_accept: new fd-fd@0x5634e17af7b8 (in whack_handle_cb() at rcv_whack.c:869) shutting down | leaking fd-fd@0x5634e17af7b8's FD; will be closed when pluto exits (in whack_handle_cb() at rcv_whack.c:889) | delref fd@0x5634e17af7b8(1->0) (in whack_handle_cb() at rcv_whack.c:895) | freeref fd-fd@0x5634e17af7b8 (in whack_handle_cb() at rcv_whack.c:895) | shutting down helper thread 2 | helper thread 2 exited | shutting down helper thread 3 | helper thread 3 exited | shutting down helper thread 4 | helper thread 4 exited | shutting down helper thread 6 | helper thread 6 exited | shutting down helper thread 5 | helper thread 5 exited | shutting down helper thread 7 | helper thread 7 exited | shutting down helper thread 1 | helper thread 1 exited 7 helper threads shutdown | delref root_certs@NULL (in free_root_certs() at root_certs.c:127) | certs and keys locked by 'free_preshared_secrets' forgetting secrets | certs and keys unlocked by 'free_preshared_secrets' | delref pkp@0x5634e17ac278(1->0) (in free_public_keyentry() at secrets.c:1591) | delref pkp@0x5634e17a6848(1->0) (in free_public_keyentry() at secrets.c:1591) | crl fetch request list locked by 'free_crl_fetch' | crl fetch request list unlocked by 'free_crl_fetch' | iface: marking eth1 dead | iface: marking eth0 dead | iface: marking lo dead | updating interfaces - listing interfaces that are going down shutting down interface lo 127.0.0.1:4500 shutting down interface lo 127.0.0.1:500 shutting down interface eth0 192.0.1.254:4500 shutting down interface eth0 192.0.1.254:500 shutting down interface eth1 192.1.2.45:4500 shutting down interface eth1 192.1.2.45:500 | updating interfaces - deleting the dead | FOR_EACH_STATE_... in delete_states_dead_interfaces | libevent_free: delref ptr-libevent@0x5634e179cd18 | delref id@0x5634e17a0de8(3->2) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x5634e17601d8 | delref id@0x5634e17a0de8(2->1) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x5634e1755498 | delref id@0x5634e17a0d18(3->2) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x5634e17602d8 | delref id@0x5634e17a0d18(2->1) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x5634e175ccf8 | delref id@0x5634e17a0be8(3->2) (in release_iface_dev() at iface.c:125) | libevent_free: delref ptr-libevent@0x5634e175cc48 | delref id@0x5634e17a0be8(2->1) (in release_iface_dev() at iface.c:125) | delref id@0x5634e17a0be8(1->0) (in release_iface_dev() at iface.c:125) | delref id@0x5634e17a0d18(1->0) (in release_iface_dev() at iface.c:125) | delref id@0x5634e17a0de8(1->0) (in release_iface_dev() at iface.c:125) | updating interfaces - checking orientation | FOR_EACH_UNORIENTED_CONNECTION_... in check_orientations | libevent_free: delref ptr-libevent@0x5634e179cdc8 | free_event_entry: delref EVENT_NULL-pe@0x5634e17a0188 | libevent_free: delref ptr-libevent@0x5634e17600d8 | free_event_entry: delref EVENT_NULL-pe@0x5634e179ab18 | libevent_free: delref ptr-libevent@0x5634e1760028 | free_event_entry: delref EVENT_NULL-pe@0x5634e1794288 | global timer EVENT_REINIT_SECRET uninitialized | global timer EVENT_SHUNT_SCAN uninitialized | global timer EVENT_PENDING_DDNS uninitialized | global timer EVENT_PENDING_PHASE2 uninitialized | global timer EVENT_CHECK_CRLS uninitialized | global timer EVENT_REVIVE_CONNS uninitialized | global timer EVENT_FREE_ROOT_CERTS uninitialized | global timer EVENT_RESET_LOG_RATE_LIMIT uninitialized | global timer EVENT_NAT_T_KEEPALIVE uninitialized | libevent_free: delref ptr-libevent@0x5634e16f2578 | signal event handler PLUTO_SIGCHLD uninstalled | libevent_free: delref ptr-libevent@0x5634e16e1798 | signal event handler PLUTO_SIGTERM uninstalled | libevent_free: delref ptr-libevent@0x5634e17a03a8 | signal event handler PLUTO_SIGHUP uninstalled | libevent_free: delref ptr-libevent@0x5634e17a05e8 | signal event handler PLUTO_SIGSYS uninstalled | releasing event base | libevent_free: delref ptr-libevent@0x5634e17a04b8 | libevent_free: delref ptr-libevent@0x5634e178f738 | libevent_free: delref ptr-libevent@0x5634e178f6e8 | libevent_free: delref ptr-libevent@0x5634e1762898 | libevent_free: delref ptr-libevent@0x5634e178f8e8 | libevent_free: delref ptr-libevent@0x5634e1793b08 | libevent_free: delref ptr-libevent@0x5634e1793918 | libevent_free: delref ptr-libevent@0x5634e178f928 | libevent_free: delref ptr-libevent@0x5634e1793728 | libevent_free: delref ptr-libevent@0x5634e17930e8 | libevent_free: delref ptr-libevent@0x5634e17a18d8 | libevent_free: delref ptr-libevent@0x5634e17a1898 | libevent_free: delref ptr-libevent@0x5634e17a1858 | libevent_free: delref ptr-libevent@0x5634e17a1818 | libevent_free: delref ptr-libevent@0x5634e17a17d8 | libevent_free: delref ptr-libevent@0x5634e17a1798 | libevent_free: delref ptr-libevent@0x5634e1785eb8 | libevent_free: delref ptr-libevent@0x5634e17a0368 | libevent_free: delref ptr-libevent@0x5634e17a0328 | libevent_free: delref ptr-libevent@0x5634e1793768 | libevent_free: delref ptr-libevent@0x5634e17a0478 | libevent_free: delref ptr-libevent@0x5634e17a01f8 | libevent_free: delref ptr-libevent@0x5634e1762518 | libevent_free: delref ptr-libevent@0x5634e1761d78 | libevent_free: delref ptr-libevent@0x5634e1758d58 | releasing global libevent data | libevent_free: delref ptr-libevent@0x5634e17620b8 | libevent_free: delref ptr-libevent@0x5634e16e1738 | libevent_free: delref ptr-libevent@0x5634e1762598 leak detective found no leaks