API tools faq
paste
Advertisement
dynasticsearch

Untitled

dynasticsearch
Jan 28th, 2017
1,672
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 175.85 KB | None | 0 0
raw download clone embed print report
  1. Jan 27 09:12:06: | NSS ike_alg_nss_cbc: aes - enter
  2. Jan 27 09:12:06: | NSS ike_alg_nss_cbc: aes - exit
  3. Jan 27 09:12:06: | next IV: f5 e1 58 b8 e5 c1 e1 4c d3 ec 1e 2c ea d0 2d be
  4. Jan 27 09:12:06: | no IKEv1 message padding required
  5. Jan 27 09:12:06: | emitting length of ISAKMP Message: 92
  6. Jan 27 09:12:06: | sending 96 bytes for delete notify through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #535)
  7. Jan 27 09:12:06: | 00 00 00 00 88 1d 2f e5 6f 80 c6 c7 c4 1c f6 00
  8. Jan 27 09:12:06: | c7 c4 99 d4 08 10 05 01 70 85 89 85 00 00 00 5c
  9. Jan 27 09:12:06: | be d2 90 e4 3f f7 cd 4c 78 5f 0f 0a d6 b6 cd 76
  10. Jan 27 09:12:06: | 55 2c 2d 49 f5 72 00 11 87 c2 66 b8 e9 67 dd 26
  11. Jan 27 09:12:06: | f1 50 8e 09 e7 99 c0 35 70 fe bb 73 3b 78 3d d3
  12. Jan 27 09:12:06: | f5 e1 58 b8 e5 c1 e1 4c d3 ec 1e 2c ea d0 2d be
  13. Jan 27 09:12:06: | state: #535 requesting to delete non existing event
  14. Jan 27 09:12:06: | unhashing state object #535
  15. Jan 27 09:12:06: | removing state 0x7f410f6e5890 entry 0x7f410f6e5ef8 next (nil) prev-next 0x7f410f126300 from list
  16. Jan 27 09:12:06: | updated next entry is (nil)
  17. Jan 27 09:12:06: | removing state 0x7f410f6e5890 entry 0x7f410f6e5f10 next (nil) prev-next 0x7f410f126450 from list
  18. Jan 27 09:12:06: | updated next entry is (nil)
  19. Jan 27 09:12:06: | parent state #535: STATE_XAUTH_R0(established-authenticated-ike) > STATE_UNDEFINED(ignore)
  20. Jan 27 09:12:06: | ignore states: 0
  21. Jan 27 09:12:06: | half-open-ike states: 0
  22. Jan 27 09:12:06: | open-ike states: 0
  23. Jan 27 09:12:06: | established-anonymous-ike states: 0
  24. Jan 27 09:12:06: | established-authenticated-ike states: 1
  25. Jan 27 09:12:06: | anonymous-ipsec states: 0
  26. Jan 27 09:12:06: | authenticated-ipsec states: 2
  27. Jan 27 09:12:06: | informational states: 0
  28. Jan 27 09:12:06: | unknown states: 0
  29. Jan 27 09:12:06: | category states: 3 count states: 3
  30. Jan 27 09:12:06: | st->st_skeyseed_nss: free key 0x7f410f6da800
  31. Jan 27 09:12:06: | st->st_skey_d_nss: free key 0x7f410f6924c0
  32. Jan 27 09:12:06: | st->st_skey_ai_nss: free key 0x7f410f6bdfb0
  33. Jan 27 09:12:06: | st->st_skey_ar_nss: free key NULL
  34. Jan 27 09:12:06: | st->st_skey_ei_nss: free key 0x7f410f6d7370
  35. Jan 27 09:12:06: | st->st_skey_er_nss: free key NULL
  36. Jan 27 09:12:06: | st->st_skey_pi_nss: free key NULL
  37. Jan 27 09:12:06: | st->st_skey_pr_nss: free key NULL
  38. Jan 27 09:12:06: | st->st_enc_key_nss: free key 0x7f410f6d02d0
  39. Jan 27 09:12:07: | *received 848 bytes from aaa.bbb.ccc.ddd:500 on eth0 (port=500)
  40. Jan 27 09:12:07: | a2 7e 66 da e6 0b 70 e8 00 00 00 00 00 00 00 00
  41. Jan 27 09:12:07: | 01 10 02 00 00 00 00 00 00 00 03 50 0d 00 02 20
  42. Jan 27 09:12:07: | 00 00 00 01 00 00 00 01 00 00 02 14 01 01 00 0f
  43. Jan 27 09:12:07: | 03 00 00 24 01 01 00 00 80 0b 00 01 80 0c 0e 10
  44. Jan 27 09:12:07: | 80 01 00 07 80 0e 01 00 80 03 fd e9 80 02 00 04
  45. Jan 27 09:12:07: | 80 04 00 0e 03 00 00 24 02 01 00 00 80 0b 00 01
  46. Jan 27 09:12:07: | 80 0c 0e 10 80 01 00 07 80 0e 01 00 80 03 fd e9
  47. Jan 27 09:12:07: | 80 02 00 02 80 04 00 0e 03 00 00 24 03 01 00 00
  48. Jan 27 09:12:07: | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 0e 01 00
  49. Jan 27 09:12:07: | 80 03 fd e9 80 02 00 01 80 04 00 0e 03 00 00 24
  50. Jan 27 09:12:07: | 04 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07
  51. Jan 27 09:12:07: | 80 0e 01 00 80 03 fd e9 80 02 00 06 80 04 00 0e
  52. Jan 27 09:12:07: | 03 00 00 24 05 01 00 00 80 0b 00 01 80 0c 0e 10
  53. Jan 27 09:12:07: | 80 01 00 07 80 0e 01 00 80 03 fd e9 80 02 00 04
  54. Jan 27 09:12:07: | 80 04 00 05 03 00 00 24 06 01 00 00 80 0b 00 01
  55. Jan 27 09:12:07: | 80 0c 0e 10 80 01 00 07 80 0e 01 00 80 03 fd e9
  56. Jan 27 09:12:07: | 80 02 00 02 80 04 00 05 03 00 00 24 07 01 00 00
  57. Jan 27 09:12:07: | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 0e 01 00
  58. Jan 27 09:12:07: | 80 03 fd e9 80 02 00 01 80 04 00 05 03 00 00 24
  59. Jan 27 09:12:07: | 08 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07
  60. Jan 27 09:12:07: | 80 0e 01 00 80 03 fd e9 80 02 00 02 80 04 00 02
  61. Jan 27 09:12:07: | 03 00 00 24 09 01 00 00 80 0b 00 01 80 0c 0e 10
  62. Jan 27 09:12:07: | 80 01 00 07 80 0e 01 00 80 03 fd e9 80 02 00 01
  63. Jan 27 09:12:07: | 80 04 00 02 03 00 00 24 0a 01 00 00 80 0b 00 01
  64. Jan 27 09:12:07: | 80 0c 0e 10 80 01 00 07 80 0e 00 80 80 03 fd e9
  65. Jan 27 09:12:07: | 80 02 00 02 80 04 00 02 03 00 00 24 0b 01 00 00
  66. Jan 27 09:12:07: | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 0e 00 80
  67. Jan 27 09:12:07: | 80 03 fd e9 80 02 00 01 80 04 00 02 03 00 00 20
  68. Jan 27 09:12:07: | 0c 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 05
  69. Jan 27 09:12:07: | 80 03 fd e9 80 02 00 02 80 04 00 02 03 00 00 20
  70. Jan 27 09:12:07: | 0d 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 05
  71. Jan 27 09:12:07: | 80 03 fd e9 80 02 00 01 80 04 00 02 03 00 00 20
  72. Jan 27 09:12:07: | 0e 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 01
  73. Jan 27 09:12:07: | 80 03 fd e9 80 02 00 02 80 04 00 02 00 00 00 20
  74. Jan 27 09:12:07: | 0f 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 01
  75. Jan 27 09:12:07: | 80 03 fd e9 80 02 00 01 80 04 00 02 0d 00 00 14
  76. Jan 27 09:12:07: | 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  77. Jan 27 09:12:07: | 0d 00 00 14 4d f3 79 28 e9 fc 4f d1 b3 26 21 70
  78. Jan 27 09:12:07: | d5 15 c6 62 0d 00 00 14 8f 8d 83 82 6d 24 6b 6f
  79. Jan 27 09:12:07: | c7 a8 a6 a4 28 c1 1d e8 0d 00 00 14 43 9b 59 f8
  80. Jan 27 09:12:07: | ba 67 6c 4c 77 37 ae 22 ea b8 f5 82 0d 00 00 14
  81. Jan 27 09:12:07: | 4d 1e 0e 13 6d ea fa 34 c4 f3 ea 9f 02 ec 72 85
  82. Jan 27 09:12:07: | 0d 00 00 14 80 d0 bb 3d ef 54 56 5e e8 46 45 d4
  83. Jan 27 09:12:07: | c8 5c e3 ee 0d 00 00 14 99 09 b6 4e ed 93 7c 65
  84. Jan 27 09:12:07: | 73 de 52 ac e9 52 fa 6b 0d 00 00 14 7d 94 19 a6
  85. Jan 27 09:12:07: | 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14
  86. Jan 27 09:12:07: | cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48
  87. Jan 27 09:12:07: | 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5
  88. Jan 27 09:12:07: | ec 42 7b 1f 0d 00 00 0c 09 00 26 89 df d6 b7 12
  89. Jan 27 09:12:07: | 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d 9f e2
  90. Jan 27 09:12:07: | 74 cc 01 00 0d 00 00 18 40 48 b7 d5 6e bc e8 85
  91. Jan 27 09:12:07: | 25 e7 de 7f 00 d6 c2 d3 80 00 00 00 00 00 00 14
  92. Jan 27 09:12:07: | af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
  93. Jan 27 09:12:07: | **parse ISAKMP Message:
  94. Jan 27 09:12:07: | initiator cookie:
  95. Jan 27 09:12:07: | a2 7e 66 da e6 0b 70 e8
  96. Jan 27 09:12:07: | responder cookie:
  97. Jan 27 09:12:07: | 00 00 00 00 00 00 00 00
  98. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_SA (0x1)
  99. Jan 27 09:12:07: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  100. Jan 27 09:12:07: | exchange type: ISAKMP_XCHG_IDPROT (0x2)
  101. Jan 27 09:12:07: | flags: none (0x0)
  102. Jan 27 09:12:07: | message ID: 00 00 00 00
  103. Jan 27 09:12:07: | length: 848 (0x350)
  104. Jan 27 09:12:07: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2)
  105. Jan 27 09:12:07: | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x2opt: 0x2080
  106. Jan 27 09:12:07: | ***parse ISAKMP Security Association Payload:
  107. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_VID (0xd)
  108. Jan 27 09:12:07: | length: 544 (0x220)
  109. Jan 27 09:12:07: | DOI: ISAKMP_DOI_IPSEC (0x1)
  110. .
  111. .
  112. .
  113. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [RFC 3947]
  114. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike]
  115. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike]
  116. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-08]
  117. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-08]
  118. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-07]
  119. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-07]
  120. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-06]
  121. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-06]
  122. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-05]
  123. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-05]
  124. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-04]
  125. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-04]
  126. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-03]
  127. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
  128. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-02]
  129. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
  130. Jan 27 09:12:07: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-02_n]
  131. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
  132. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [XAUTH]
  133. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [Cisco-Unity]
  134. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [FRAGMENTATION 80000000]
  135. Jan 27 09:12:07: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [Dead Peer Detection]
  136. Jan 27 09:12:07: | find_host_connection me=ccc.ddd.eee.fff:500 him=aaa.bbb.ccc.ddd:500 policy=IKEV1_ALLOW
  137. Jan 27 09:12:07: | find_host_pair: comparing ccc.ddd.eee.fff:500 to aaa.bbb.ccc.ddd:500
  138. Jan 27 09:12:07: | find_host_pair_conn (find_host_connection): ccc.ddd.eee.fff:500 aaa.bbb.ccc.ddd:500 -> hp:xauth-psk
  139. Jan 27 09:12:07: | find_next_host_connection policy=IKEV1_ALLOW
  140. Jan 27 09:12:07: | found policy = PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW (xauth-psk)
  141. Jan 27 09:12:07: | find_next_host_connection returns xauth-psk
  142. Jan 27 09:12:07: | creating state object #536 at 0x7f410f6e7b40
  143. Jan 27 09:12:07: | parent state #536: new > STATE_UNDEFINED(ignore)
  144. Jan 27 09:12:07: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  145. Jan 27 09:12:07: | parent state #536: STATE_UNDEFINED(ignore) > STATE_MAIN_R0(half-open-ike)
  146. Jan 27 09:12:07: | ignore states: 0
  147. Jan 27 09:12:07: | half-open-ike states: 1
  148. Jan 27 09:12:07: | open-ike states: 0
  149. Jan 27 09:12:07: | established-anonymous-ike states: 0
  150. Jan 27 09:12:07: | established-authenticated-ike states: 1
  151. Jan 27 09:12:07: | anonymous-ipsec states: 0
  152. Jan 27 09:12:07: | authenticated-ipsec states: 2
  153. Jan 27 09:12:07: | informational states: 0
  154. Jan 27 09:12:07: | unknown states: 0
  155. Jan 27 09:12:07: | category states: 4 count states: 4
  156. Jan 27 09:12:07: | inserting state object #536
  157. Jan 27 09:12:07: | finding hash chain in state hash table
  158. Jan 27 09:12:07: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  159. Jan 27 09:12:07: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  160. Jan 27 09:12:07: | found hash chain 14
  161. Jan 27 09:12:07: | list 0x7f410f1262b8 first entry (nil)
  162. Jan 27 09:12:07: | inserted state 0x7f410f6e7b40 entry 0x7f410f6e81a8 next (nil) prev-next 0x7f410f1262b8 into list
  163. Jan 27 09:12:07: | updated next entry is (nil)
  164. Jan 27 09:12:07: | finding hash chain in icookie hash table
  165. Jan 27 09:12:07: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  166. Jan 27 09:12:07: | RCOOKIE: 00 00 00 00 00 00 00 00
  167. Jan 27 09:12:07: | found hash chain 13
  168. Jan 27 09:12:07: | list 0x7f410f1263d0 first entry (nil)
  169. Jan 27 09:12:07: | inserted state 0x7f410f6e7b40 entry 0x7f410f6e81c0 next (nil) prev-next 0x7f410f1263d0 into list
  170. Jan 27 09:12:07: | updated next entry is (nil)
  171. Jan 27 09:12:07: | event_schedule called for 0 seconds
  172. Jan 27 09:12:07: | event_schedule_tv called for about 0 seconds and change
  173. Jan 27 09:12:07: | inserting event EVENT_SO_DISCARD, timeout in 0.000000 seconds for #536
  174. Jan 27 09:12:07: | sender checking NAT-T: enabled and 86
  175. Jan 27 09:12:07: | returning NAT-T method NAT_TRAVERSAL_METHOD_IETF_RFC
  176. Jan 27 09:12:07: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
  177. Jan 27 09:12:07: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: responding to Main Mode from unknown peer aaa.bbb.ccc.ddd
  178. Jan 27 09:12:07: | **emit ISAKMP Message:
  179. Jan 27 09:12:07: | initiator cookie:
  180. Jan 27 09:12:07: | a2 7e 66 da e6 0b 70 e8
  181. Jan 27 09:12:07: | responder cookie:
  182. Jan 27 09:12:07: | db da 2a c5 c8 03 d1 6d
  183. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_SA (0x1)
  184. Jan 27 09:12:07: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  185. Jan 27 09:12:07: | exchange type: ISAKMP_XCHG_IDPROT (0x2)
  186. Jan 27 09:12:07: | flags: none (0x0)
  187. Jan 27 09:12:07: | message ID: 00 00 00 00
  188. Jan 27 09:12:07: | NAT-T VID detected, sending NAT-T VID
  189. .
  190. .
  191. .
  192. Jan 27 09:12:07: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
  193. Jan 27 09:12:07: | peer supports fragmentation
  194. Jan 27 09:12:07: | peer supports dpd
  195. Jan 27 09:12:07: | parent state #536: STATE_MAIN_R0(half-open-ike) > STATE_MAIN_R1(open-ike)
  196. Jan 27 09:12:07: | ignore states: 0
  197. Jan 27 09:12:07: | half-open-ike states: 0
  198. Jan 27 09:12:07: | open-ike states: 1
  199. Jan 27 09:12:07: | established-anonymous-ike states: 0
  200. Jan 27 09:12:07: | established-authenticated-ike states: 1
  201. Jan 27 09:12:07: | anonymous-ipsec states: 0
  202. Jan 27 09:12:07: | authenticated-ipsec states: 2
  203. Jan 27 09:12:07: | informational states: 0
  204. Jan 27 09:12:07: | unknown states: 0
  205. Jan 27 09:12:07: | category states: 4 count states: 4
  206. Jan 27 09:12:07: | state: #536 requesting EVENT_SO_DISCARD to be deleted
  207. Jan 27 09:12:07: | sending reply packet to aaa.bbb.ccc.ddd:500 (from port 500)
  208. Jan 27 09:12:07: | sending 156 bytes for STATE_MAIN_R0 through eth0:500 to aaa.bbb.ccc.ddd:500 (using #536)
  209. Jan 27 09:12:07: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  210. Jan 27 09:12:07: | 01 10 02 00 00 00 00 00 00 00 00 9c 0d 00 00 38
  211. Jan 27 09:12:07: | 00 00 00 01 00 00 00 01 00 00 00 2c 01 01 00 01
  212. Jan 27 09:12:07: | 00 00 00 24 01 01 00 00 80 0b 00 01 80 0c 0e 10
  213. Jan 27 09:12:07: | 80 01 00 07 80 0e 01 00 80 03 fd e9 80 02 00 04
  214. Jan 27 09:12:07: | 80 04 00 0e 0d 00 00 14 af ca d7 13 68 a1 f1 c9
  215. Jan 27 09:12:07: | 6b 86 96 fc 77 57 01 00 0d 00 00 14 40 48 b7 d5
  216. Jan 27 09:12:07: | 6e bc e8 85 25 e7 de 7f 00 d6 c2 d3 0d 00 00 0c
  217. Jan 27 09:12:07: | 09 00 26 89 df d6 b7 12 00 00 00 14 4a 13 1c 81
  218. Jan 27 09:12:07: | 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  219. Jan 27 09:12:07: | event_schedule_ms called for about 500 ms
  220. Jan 27 09:12:07: | event_schedule_tv called for about 0 seconds and change
  221. Jan 27 09:12:07: | inserting event EVENT_v1_RETRANSMIT, timeout in 0.500000 seconds for #536
  222. Jan 27 09:12:07: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: STATE_MAIN_R1: sent MR1, expecting MI2
  223. Jan 27 09:12:07: | modecfg pull: quirk-poll policy:pull not-client
  224. Jan 27 09:12:07: | phase 1 is done, looking for phase 2 to unpend
  225. Jan 27 09:12:07: | *received 380 bytes from aaa.bbb.ccc.ddd:500 on eth0 (port=500)
  226. Jan 27 09:12:07: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  227. Jan 27 09:12:07: | 04 10 02 00 00 00 00 00 00 00 01 7c 0a 00 01 04
  228. Jan 27 09:12:07: | 19 4c f9 0e bb ca dd 8b c2 c2 e2 85 c4 a7 25 c1
  229. Jan 27 09:12:07: | 86 ec 55 df ca aa a4 0d 71 aa d3 1d 07 80 b8 ae
  230. Jan 27 09:12:07: | be b2 71 37 8c 9d 3f f3 af 70 2e fa b8 5c ea 5f
  231. Jan 27 09:12:07: | 6b ef 0b 9d 09 af 34 cd 9f c6 f4 e5 a8 11 28 62
  232. Jan 27 09:12:07: | 35 3e 62 be c4 54 0c 79 af d7 e2 5d 2c 5a 00 ef
  233. Jan 27 09:12:07: | 3f 5a 42 06 18 e1 11 e9 c7 5d 0c 23 5c 31 c4 90
  234. Jan 27 09:12:07: | 88 6b c6 05 60 1a f6 c7 8d 9b 09 e7 f7 44 8a ac
  235. Jan 27 09:12:07: | 90 c9 4f f9 cb 55 70 38 f3 29 59 bb 4d 3a bd dc
  236. Jan 27 09:12:07: | ce c8 70 bf 7c bf 45 7f 47 c7 81 f9 01 52 2f d6
  237. Jan 27 09:12:07: | c3 a9 8c 54 87 7a d4 ad f6 ad c8 28 7b 83 a7 06
  238. Jan 27 09:12:07: | 62 52 7f d4 cd 98 20 98 0a eb 39 27 7a 91 ce a6
  239. Jan 27 09:12:07: | 58 c0 f5 79 53 d3 51 22 f0 ab 06 98 1d 23 55 0f
  240. Jan 27 09:12:07: | 0a 13 50 a4 f1 6d f4 67 94 9d 19 4a 93 8a de 60
  241. Jan 27 09:12:07: | 7d 65 b9 e9 34 8c 25 e5 1f 62 b2 11 fa 84 19 12
  242. Jan 27 09:12:07: | 1b 4a fe b7 3f 1d 7e 64 8d 02 03 cb a7 08 13 2f
  243. Jan 27 09:12:07: | e4 57 82 73 07 00 14 40 b2 a3 5e c0 97 7b d1 96
  244. Jan 27 09:12:07: | 14 00 00 14 08 70 34 98 c3 1b b5 26 73 00 72 c4
  245. Jan 27 09:12:07: | 50 a9 d1 9e 14 00 00 24 8a 31 1d 54 62 06 67 cf
  246. Jan 27 09:12:07: | d2 51 23 2b 0a 63 c3 f1 db 68 b8 b2 fc 7f 64 0a
  247. Jan 27 09:12:07: | 16 ff e8 84 ff 92 c7 62 00 00 00 24 64 ac 2b 94
  248. Jan 27 09:12:07: | bb d8 76 eb c3 51 ad 8f b6 49 98 d5 b4 44 23 f4
  249. Jan 27 09:12:07: | a8 1f b5 18 3b 3b 3e 91 c7 d9 63 37
  250. Jan 27 09:12:07: | **parse ISAKMP Message:
  251. Jan 27 09:12:07: | initiator cookie:
  252. Jan 27 09:12:07: | a2 7e 66 da e6 0b 70 e8
  253. Jan 27 09:12:07: | responder cookie:
  254. Jan 27 09:12:07: | db da 2a c5 c8 03 d1 6d
  255. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_KE (0x4)
  256. Jan 27 09:12:07: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  257. Jan 27 09:12:07: | exchange type: ISAKMP_XCHG_IDPROT (0x2)
  258. Jan 27 09:12:07: | flags: none (0x0)
  259. Jan 27 09:12:07: | message ID: 00 00 00 00
  260. Jan 27 09:12:07: | length: 380 (0x17c)
  261. Jan 27 09:12:07: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2)
  262. Jan 27 09:12:07: | finding hash chain in state hash table
  263. Jan 27 09:12:07: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  264. Jan 27 09:12:07: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  265. Jan 27 09:12:07: | found hash chain 14
  266. Jan 27 09:12:07: | v1 peer and cookies match on #536, provided msgid 00000000 == 00000000
  267. Jan 27 09:12:07: | v1 state object #536 found, in STATE_MAIN_R1
  268. Jan 27 09:12:07: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  269. Jan 27 09:12:07: | #536 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  270. Jan 27 09:12:07: | got payload 0x10 (ISAKMP_NEXT_KE) needed: 0x410opt: 0x102080
  271. Jan 27 09:12:07: | ***parse ISAKMP Key Exchange Payload:
  272. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_NONCE (0xa)
  273. Jan 27 09:12:07: | length: 260 (0x104)
  274. Jan 27 09:12:07: | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400opt: 0x102080
  275. Jan 27 09:12:07: | ***parse ISAKMP Nonce Payload:
  276. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14)
  277. Jan 27 09:12:07: | length: 20 (0x14)
  278. Jan 27 09:12:07: | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0opt: 0x102080
  279. Jan 27 09:12:07: | ***parse ISAKMP NAT-D Payload:
  280. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14)
  281. Jan 27 09:12:07: | length: 36 (0x24)
  282. Jan 27 09:12:07: | got payload 0x100000 (ISAKMP_NEXT_NATD_RFC) needed: 0x0opt: 0x102080
  283. Jan 27 09:12:07: | ***parse ISAKMP NAT-D Payload:
  284. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_NONE (0x0)
  285. Jan 27 09:12:07: | length: 36 (0x24)
  286. Jan 27 09:12:07: | DH public value received:
  287. Jan 27 09:12:07: | 19 4c f9 0e bb ca dd 8b c2 c2 e2 85 c4 a7 25 c1
  288. Jan 27 09:12:07: | 86 ec 55 df ca aa a4 0d 71 aa d3 1d 07 80 b8 ae
  289. Jan 27 09:12:07: | be b2 71 37 8c 9d 3f f3 af 70 2e fa b8 5c ea 5f
  290. Jan 27 09:12:07: | 6b ef 0b 9d 09 af 34 cd 9f c6 f4 e5 a8 11 28 62
  291. Jan 27 09:12:07: | 35 3e 62 be c4 54 0c 79 af d7 e2 5d 2c 5a 00 ef
  292. Jan 27 09:12:07: | 3f 5a 42 06 18 e1 11 e9 c7 5d 0c 23 5c 31 c4 90
  293. Jan 27 09:12:07: | 88 6b c6 05 60 1a f6 c7 8d 9b 09 e7 f7 44 8a ac
  294. Jan 27 09:12:07: | 90 c9 4f f9 cb 55 70 38 f3 29 59 bb 4d 3a bd dc
  295. Jan 27 09:12:07: | ce c8 70 bf 7c bf 45 7f 47 c7 81 f9 01 52 2f d6
  296. Jan 27 09:12:07: | c3 a9 8c 54 87 7a d4 ad f6 ad c8 28 7b 83 a7 06
  297. Jan 27 09:12:07: | 62 52 7f d4 cd 98 20 98 0a eb 39 27 7a 91 ce a6
  298. Jan 27 09:12:07: | 58 c0 f5 79 53 d3 51 22 f0 ab 06 98 1d 23 55 0f
  299. Jan 27 09:12:07: | 0a 13 50 a4 f1 6d f4 67 94 9d 19 4a 93 8a de 60
  300. Jan 27 09:12:07: | 7d 65 b9 e9 34 8c 25 e5 1f 62 b2 11 fa 84 19 12
  301. Jan 27 09:12:07: | 1b 4a fe b7 3f 1d 7e 64 8d 02 03 cb a7 08 13 2f
  302. Jan 27 09:12:07: | e4 57 82 73 07 00 14 40 b2 a3 5e c0 97 7b d1 96
  303. Jan 27 09:12:07: | checking NAT-t: enabled and RFC 3947 (NAT-Traversal)
  304. Jan 27 09:12:07: | natd_hash: hasher=0x7f410f12c980(32)
  305. Jan 27 09:12:07: | natd_hash: icookie= a2 7e 66 da e6 0b 70 e8
  306. Jan 27 09:12:07: | natd_hash: rcookie= db da 2a c5 c8 03 d1 6d
  307. Jan 27 09:12:07: | natd_hash: ip= ac 1f 23 ef
  308. Jan 27 09:12:07: | natd_hash: port=500
  309. Jan 27 09:12:07: | natd_hash: hash= e1 a6 85 25 27 86 76 a7 81 07 0c 05 f1 56 73 87
  310. Jan 27 09:12:07: | natd_hash: hash= b1 41 48 21 43 b2 75 87 79 6c 30 07 92 18 b7 66
  311. Jan 27 09:12:07: | natd_hash: hasher=0x7f410f12c980(32)
  312. Jan 27 09:12:07: | natd_hash: icookie= a2 7e 66 da e6 0b 70 e8
  313. Jan 27 09:12:07: | natd_hash: rcookie= db da 2a c5 c8 03 d1 6d
  314. Jan 27 09:12:07: | natd_hash: ip= 54 e5 1a 3b
  315. Jan 27 09:12:07: | natd_hash: port=500
  316. Jan 27 09:12:07: | natd_hash: hash= 92 e9 d3 3d 77 21 9b ad 4b ed 4a 58 7d f0 ef e3
  317. Jan 27 09:12:07: | natd_hash: hash= 60 f1 6f a2 a8 0d 2a 75 48 2a 35 73 07 9d 74 3e
  318. Jan 27 09:12:07: | expected NAT-D(me): e1 a6 85 25 27 86 76 a7 81 07 0c 05 f1 56 73 87
  319. Jan 27 09:12:07: | expected NAT-D(me): b1 41 48 21 43 b2 75 87 79 6c 30 07 92 18 b7 66
  320. Jan 27 09:12:07: | expected NAT-D(him):
  321. Jan 27 09:12:07: | 92 e9 d3 3d 77 21 9b ad 4b ed 4a 58 7d f0 ef e3
  322. Jan 27 09:12:07: | 60 f1 6f a2 a8 0d 2a 75 48 2a 35 73 07 9d 74 3e
  323. Jan 27 09:12:07: | received NAT-D: 8a 31 1d 54 62 06 67 cf d2 51 23 2b 0a 63 c3 f1
  324. Jan 27 09:12:07: | received NAT-D: db 68 b8 b2 fc 7f 64 0a 16 ff e8 84 ff 92 c7 62
  325. Jan 27 09:12:07: | received NAT-D: 64 ac 2b 94 bb d8 76 eb c3 51 ad 8f b6 49 98 d5
  326. Jan 27 09:12:07: | received NAT-D: b4 44 23 f4 a8 1f b5 18 3b 3b 3e 91 c7 d9 63 37
  327. Jan 27 09:12:07: | NAT_TRAVERSAL this end is behind NAT
  328. Jan 27 09:12:07: | NAT_TRAVERSAL that end is behind NAT aaa.bbb.ccc.ddd
  329. Jan 27 09:12:07: | NAT_TRAVERSAL nat_keepalive enabled aaa.bbb.ccc.ddd
  330. Jan 27 09:12:07: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: NAT-Traversal: Result using RFC 3947 (NAT-Traversal) sender port 500: I am behind NAT+peer behind NAT
  331. Jan 27 09:12:07: | NAT_T_WITH_KA detected
  332. Jan 27 09:12:07: | crypto helper 0: pcw_work: 0
  333. Jan 27 09:12:07: | asking crypto helper 0 to do build KE and nonce; request ID 844 (len=2776, pcw_work=0)
  334. Jan 27 09:12:07: | crypto helper 0 read fd: 11
  335. Jan 27 09:12:07: | crypto helper 0 doing build KE and nonce; request ID 844
  336. .
  337. .
  338. .
  339. Jan 27 09:12:07: | ***emit ISAKMP Nonce Payload:
  340. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_NONE (0x0)
  341. Jan 27 09:12:07: | emitting 16 raw bytes of Nr into ISAKMP Nonce Payload
  342. Jan 27 09:12:07: | Nr 0c 20 3f da 14 72 e1 31 f6 56 9a dd ed 09 fd 72
  343. Jan 27 09:12:07: | emitting length of ISAKMP Nonce Payload: 20
  344. Jan 27 09:12:07: | sending NAT-D payloads
  345. Jan 27 09:12:07: | natd_hash: hasher=0x7f410f12c980(32)
  346. Jan 27 09:12:07: | natd_hash: icookie= a2 7e 66 da e6 0b 70 e8
  347. Jan 27 09:12:07: | natd_hash: rcookie= db da 2a c5 c8 03 d1 6d
  348. Jan 27 09:12:07: | natd_hash: ip= 54 e5 1a 3b
  349. Jan 27 09:12:07: | natd_hash: port=500
  350. Jan 27 09:12:07: | natd_hash: hash= 92 e9 d3 3d 77 21 9b ad 4b ed 4a 58 7d f0 ef e3
  351. Jan 27 09:12:07: | natd_hash: hash= 60 f1 6f a2 a8 0d 2a 75 48 2a 35 73 07 9d 74 3e
  352. Jan 27 09:12:07: | ***emit ISAKMP NAT-D Payload:
  353. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_NATD_RFC (0x14)
  354. Jan 27 09:12:07: | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload
  355. Jan 27 09:12:07: | NAT-D 92 e9 d3 3d 77 21 9b ad 4b ed 4a 58 7d f0 ef e3
  356. Jan 27 09:12:07: | NAT-D 60 f1 6f a2 a8 0d 2a 75 48 2a 35 73 07 9d 74 3e
  357. Jan 27 09:12:07: | emitting length of ISAKMP NAT-D Payload: 36
  358. Jan 27 09:12:07: | natd_hash: hasher=0x7f410f12c980(32)
  359. Jan 27 09:12:07: | natd_hash: icookie= a2 7e 66 da e6 0b 70 e8
  360. Jan 27 09:12:07: | natd_hash: rcookie= db da 2a c5 c8 03 d1 6d
  361. Jan 27 09:12:07: | natd_hash: ip= ac 1f 23 ef
  362. Jan 27 09:12:07: | natd_hash: port=500
  363. Jan 27 09:12:07: | natd_hash: hash= e1 a6 85 25 27 86 76 a7 81 07 0c 05 f1 56 73 87
  364. Jan 27 09:12:07: | natd_hash: hash= b1 41 48 21 43 b2 75 87 79 6c 30 07 92 18 b7 66
  365. Jan 27 09:12:07: | ***emit ISAKMP NAT-D Payload:
  366. Jan 27 09:12:07: | next payload type: ISAKMP_NEXT_NONE (0x0)
  367. Jan 27 09:12:07: | emitting 32 raw bytes of NAT-D into ISAKMP NAT-D Payload
  368. Jan 27 09:12:07: | NAT-D e1 a6 85 25 27 86 76 a7 81 07 0c 05 f1 56 73 87
  369. Jan 27 09:12:07: | NAT-D b1 41 48 21 43 b2 75 87 79 6c 30 07 92 18 b7 66
  370. Jan 27 09:12:07: | emitting length of ISAKMP NAT-D Payload: 36
  371. .
  372. .
  373. .
  374. Jan 27 09:12:07: | prf outer hash key(0x7f410f6c2a40) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  375. Jan 27 09:12:07: | prf outer: free key 0x7f410f6c2670
  376. Jan 27 09:12:07: | prf final result key(0x7f410f6c2a40) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  377. Jan 27 09:12:07: | crypt key: symkey from symkey(0x7f410f6c2a40) - next-byte(0) key-size(32) flags(0x300) derive(EXTRACT_KEY_FROM_KEY) target(AES_CBC)
  378. Jan 27 09:12:07: | symkey: key(0x7f410f6c2a40) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  379. Jan 27 09:12:07: | crypt key: key(0x7f410f6c2670) length(32) type/mechanism(AES_CBC 0x00001082)
  380. Jan 27 09:12:07: | NSS: pointers skeyid_d 0x7f410f6da800, skeyid_a 0x7f410f6e4c80, skeyid_e 0x7f410f6c2a40, enc_key 0x7f410f6c2670
  381. Jan 27 09:12:07: | DH_i: 19 4c f9 0e bb ca dd 8b c2 c2 e2 85 c4 a7 25 c1
  382. Jan 27 09:12:07: | DH_i: 86 ec 55 df ca aa a4 0d 71 aa d3 1d 07 80 b8 ae
  383. Jan 27 09:12:07: | DH_i: be b2 71 37 8c 9d 3f f3 af 70 2e fa b8 5c ea 5f
  384. Jan 27 09:12:07: | DH_i: 6b ef 0b 9d 09 af 34 cd 9f c6 f4 e5 a8 11 28 62
  385. Jan 27 09:12:07: | DH_i: 35 3e 62 be c4 54 0c 79 af d7 e2 5d 2c 5a 00 ef
  386. Jan 27 09:12:07: | DH_i: 3f 5a 42 06 18 e1 11 e9 c7 5d 0c 23 5c 31 c4 90
  387. Jan 27 09:12:07: | DH_i: 88 6b c6 05 60 1a f6 c7 8d 9b 09 e7 f7 44 8a ac
  388. Jan 27 09:12:07: | DH_i: 90 c9 4f f9 cb 55 70 38 f3 29 59 bb 4d 3a bd dc
  389. Jan 27 09:12:07: | DH_i: ce c8 70 bf 7c bf 45 7f 47 c7 81 f9 01 52 2f d6
  390. Jan 27 09:12:07: | DH_i: c3 a9 8c 54 87 7a d4 ad f6 ad c8 28 7b 83 a7 06
  391. Jan 27 09:12:07: | DH_i: 62 52 7f d4 cd 98 20 98 0a eb 39 27 7a 91 ce a6
  392. Jan 27 09:12:07: | DH_i: 58 c0 f5 79 53 d3 51 22 f0 ab 06 98 1d 23 55 0f
  393. Jan 27 09:12:07: | DH_i: 0a 13 50 a4 f1 6d f4 67 94 9d 19 4a 93 8a de 60
  394. Jan 27 09:12:07: | DH_i: 7d 65 b9 e9 34 8c 25 e5 1f 62 b2 11 fa 84 19 12
  395. Jan 27 09:12:07: | DH_i: 1b 4a fe b7 3f 1d 7e 64 8d 02 03 cb a7 08 13 2f
  396. Jan 27 09:12:07: | DH_i: e4 57 82 73 07 00 14 40 b2 a3 5e c0 97 7b d1 96
  397. Jan 27 09:12:07: | DH_r: 9d 5a 5f 65 eb b0 65 4e eb 94 c6 df 0d 98 a9 d7
  398. Jan 27 09:12:07: | DH_r: 22 c3 72 25 ea 8e 07 33 85 5d 28 a8 f7 1d 54 95
  399. Jan 27 09:12:07: | DH_r: 06 ba f9 1e d7 b1 76 f2 f7 67 3e 0f 61 fa 59 e2
  400. Jan 27 09:12:07: | DH_r: d6 fa ed 19 24 d9 43 3b ad 60 82 30 16 0f d3 2c
  401. Jan 27 09:12:07: | DH_r: 4e b8 00 1d 43 dc b5 18 4d 12 80 5e 45 04 1f e1
  402. Jan 27 09:12:07: | DH_r: 39 fb 39 9c f2 c3 f3 6d 36 e3 6d 1b dc f4 8c 5e
  403. Jan 27 09:12:07: | DH_r: da fd 60 4a 11 47 92 ee 96 c9 59 df 71 de 87 2b
  404. Jan 27 09:12:07: | DH_r: ed 74 da c0 f3 33 d9 95 19 ed 1d 65 89 aa e7 0f
  405. Jan 27 09:12:07: | DH_r: 9c 69 09 49 e5 06 2b f9 48 c0 50 d4 8d 1d 0c 5b
  406. Jan 27 09:12:07: | DH_r: 72 b6 7b 57 f1 3d 92 28 07 9a 52 dd b2 e5 23 25
  407. Jan 27 09:12:07: | DH_r: 3c 6c 20 68 2c 96 a5 bb ee 0c b9 15 80 0e ae 54
  408. Jan 27 09:12:07: | DH_r: f3 9d 30 3a 02 cb b6 9f 2f c8 9f 5f 75 4e 80 48
  409. Jan 27 09:12:07: | DH_r: 2c 23 a5 21 ca 02 dd 48 5a 38 81 6f 28 79 43 a6
  410. Jan 27 09:12:07: | DH_r: 9e 85 ef 12 83 4a 9e 33 b8 3b 8f c2 72 e4 55 08
  411. Jan 27 09:12:07: | DH_r: 3e b2 04 83 cd c6 10 20 f2 34 22 98 af 1b 54 a9
  412. Jan 27 09:12:07: | DH_r: 72 19 3f 41 6b a3 b6 95 1e c8 b6 59 02 6e b7 34
  413. Jan 27 09:12:07: | end of IV generation
  414. Jan 27 09:12:07: | crypto helper 0 finished compute dh+iv (V1 Phase 1); request ID 845 time elapsed 2149 usec
  415. Jan 27 09:12:07: | #536 send_crypto_helper_request:613 st->st_calculating = TRUE;
  416. Jan 27 09:12:07: | state: #536 requesting EVENT_CRYPTO_FAILED to be deleted
  417. Jan 27 09:12:07: | event_schedule called for 60 seconds
  418. Jan 27 09:12:07: | event_schedule_tv called for about 60 seconds and change
  419. Jan 27 09:12:07: | inserting event EVENT_CRYPTO_FAILED, timeout in 60.000000 seconds for #536
  420. Jan 27 09:12:07: | started dh_secretiv, returned: stf=STF_SUSPEND
  421. Jan 27 09:12:07: | #536 main_inI2_outR2_tail:1367 st->st_calculating = FALSE;
  422. Jan 27 09:12:07: | complete v1 state transition with STF_OK
  423. Jan 27 09:12:07: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
  424. Jan 27 09:12:07: | parent state #536: STATE_MAIN_R1(open-ike) > STATE_MAIN_R2(open-ike)
  425. Jan 27 09:12:07: | ignore states: 0
  426. Jan 27 09:12:07: | half-open-ike states: 0
  427. Jan 27 09:12:07: | open-ike states: 1
  428. Jan 27 09:12:07: | established-anonymous-ike states: 0
  429. Jan 27 09:12:07: | established-authenticated-ike states: 1
  430. Jan 27 09:12:07: | anonymous-ipsec states: 0
  431. Jan 27 09:12:07: | authenticated-ipsec states: 2
  432. Jan 27 09:12:07: | informational states: 0
  433. Jan 27 09:12:07: | unknown states: 0
  434. Jan 27 09:12:07: | category states: 4 count states: 4
  435. Jan 27 09:12:07: | state: #536 requesting EVENT_CRYPTO_FAILED to be deleted
  436. Jan 27 09:12:07: | sending reply packet to aaa.bbb.ccc.ddd:500 (from port 500)
  437. Jan 27 09:12:07: | sending 380 bytes for STATE_MAIN_R1 through eth0:500 to aaa.bbb.ccc.ddd:500 (using #536)
  438. Jan 27 09:12:07: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  439. Jan 27 09:12:07: | 04 10 02 00 00 00 00 00 00 00 01 7c 0a 00 01 04
  440. Jan 27 09:12:07: | 9d 5a 5f 65 eb b0 65 4e eb 94 c6 df 0d 98 a9 d7
  441. Jan 27 09:12:07: | 22 c3 72 25 ea 8e 07 33 85 5d 28 a8 f7 1d 54 95
  442. Jan 27 09:12:07: | 06 ba f9 1e d7 b1 76 f2 f7 67 3e 0f 61 fa 59 e2
  443. Jan 27 09:12:07: | d6 fa ed 19 24 d9 43 3b ad 60 82 30 16 0f d3 2c
  444. Jan 27 09:12:07: | 4e b8 00 1d 43 dc b5 18 4d 12 80 5e 45 04 1f e1
  445. Jan 27 09:12:07: | 39 fb 39 9c f2 c3 f3 6d 36 e3 6d 1b dc f4 8c 5e
  446. Jan 27 09:12:07: | da fd 60 4a 11 47 92 ee 96 c9 59 df 71 de 87 2b
  447. Jan 27 09:12:07: | ed 74 da c0 f3 33 d9 95 19 ed 1d 65 89 aa e7 0f
  448. Jan 27 09:12:07: | 9c 69 09 49 e5 06 2b f9 48 c0 50 d4 8d 1d 0c 5b
  449. Jan 27 09:12:07: | 72 b6 7b 57 f1 3d 92 28 07 9a 52 dd b2 e5 23 25
  450. Jan 27 09:12:07: | 3c 6c 20 68 2c 96 a5 bb ee 0c b9 15 80 0e ae 54
  451. Jan 27 09:12:07: | f3 9d 30 3a 02 cb b6 9f 2f c8 9f 5f 75 4e 80 48
  452. Jan 27 09:12:07: | 2c 23 a5 21 ca 02 dd 48 5a 38 81 6f 28 79 43 a6
  453. Jan 27 09:12:07: | 9e 85 ef 12 83 4a 9e 33 b8 3b 8f c2 72 e4 55 08
  454. Jan 27 09:12:07: | 3e b2 04 83 cd c6 10 20 f2 34 22 98 af 1b 54 a9
  455. Jan 27 09:12:07: | 72 19 3f 41 6b a3 b6 95 1e c8 b6 59 02 6e b7 34
  456. Jan 27 09:12:07: | 14 00 00 14 0c 20 3f da 14 72 e1 31 f6 56 9a dd
  457. Jan 27 09:12:07: | ed 09 fd 72 14 00 00 24 92 e9 d3 3d 77 21 9b ad
  458. Jan 27 09:12:07: | 4b ed 4a 58 7d f0 ef e3 60 f1 6f a2 a8 0d 2a 75
  459. Jan 27 09:12:07: | 48 2a 35 73 07 9d 74 3e 00 00 00 24 e1 a6 85 25
  460. Jan 27 09:12:07: | 27 86 76 a7 81 07 0c 05 f1 56 73 87 b1 41 48 21
  461. Jan 27 09:12:07: | 43 b2 75 87 79 6c 30 07 92 18 b7 66
  462. Jan 27 09:12:07: | event_schedule_ms called for about 500 ms
  463. Jan 27 09:12:07: | event_schedule_tv called for about 0 seconds and change
  464. Jan 27 09:12:07: | inserting event EVENT_v1_RETRANSMIT, timeout in 0.500000 seconds for #536
  465. Jan 27 09:12:07: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: STATE_MAIN_R2: sent MR2, expecting MI3
  466. Jan 27 09:12:07: | modecfg pull: quirk-poll policy:pull not-client
  467. Jan 27 09:12:07: | phase 1 is done, looking for phase 2 to unpend
  468. Jan 27 09:12:07: | crypto helper 0 has finished work (pcw_work now 1)
  469. Jan 27 09:12:07: | crypto helper 0 replies to request ID 845
  470. Jan 27 09:12:07: | calling continuation function 0x7f410ee49180
  471. Jan 27 09:12:07: | main_inI2_outR2_calcdone for #536: calculate DH finished
  472. Jan 27 09:12:07: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  473. Jan 27 09:12:08: | *received 108 bytes from aaa.bbb.ccc.ddd:4500 on eth0 (port=4500)
  474. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  475. Jan 27 09:12:08: | 05 10 02 01 00 00 00 00 00 00 00 6c e9 df 5c bd
  476. Jan 27 09:12:08: | 1e d6 94 32 5b e9 1d 0d 7d a3 11 2e ec 33 84 ee
  477. Jan 27 09:12:08: | a9 13 11 fe 51 4c 1c 15 97 95 d7 5f 33 cd 7c de
  478. Jan 27 09:12:08: | 6e 71 bb 52 57 91 dd 67 26 5c af 25 16 71 a7 2f
  479. Jan 27 09:12:08: | 11 2e a5 f8 e6 10 3d e1 43 7a e8 61 76 cb 98 af
  480. Jan 27 09:12:08: | 42 38 3f be 8f dc 8f d3 4b 10 77 a7
  481. Jan 27 09:12:08: | **parse ISAKMP Message:
  482. Jan 27 09:12:08: | initiator cookie:
  483. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8
  484. Jan 27 09:12:08: | responder cookie:
  485. Jan 27 09:12:08: | db da 2a c5 c8 03 d1 6d
  486. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_ID (0x5)
  487. Jan 27 09:12:08: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  488. Jan 27 09:12:08: | exchange type: ISAKMP_XCHG_IDPROT (0x2)
  489. Jan 27 09:12:08: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  490. Jan 27 09:12:08: | message ID: 00 00 00 00
  491. Jan 27 09:12:08: | length: 108 (0x6c)
  492. Jan 27 09:12:08: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2)
  493. Jan 27 09:12:08: | finding hash chain in state hash table
  494. Jan 27 09:12:08: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  495. Jan 27 09:12:08: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  496. Jan 27 09:12:08: | found hash chain 14
  497. Jan 27 09:12:08: | v1 peer and cookies match on #536, provided msgid 00000000 == 00000000
  498. Jan 27 09:12:08: | v1 state object #536 found, in STATE_MAIN_R2
  499. Jan 27 09:12:08: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  500. Jan 27 09:12:08: | #536 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  501. Jan 27 09:12:08: | received encrypted packet from aaa.bbb.ccc.ddd:4500
  502. Jan 27 09:12:08: | decrypting 80 bytes using algorithm OAKLEY_AES_CBC
  503. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - enter
  504. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - exit
  505. Jan 27 09:12:08: | decrypted:
  506. Jan 27 09:12:08: | 08 00 00 0c 01 11 01 f4 c0 a8 01 0a 0b 00 00 24
  507. Jan 27 09:12:08: | 56 03 f6 40 e6 de ac 08 73 db f9 46 a6 9c f4 68
  508. Jan 27 09:12:08: | 2e 41 79 54 83 e5 42 d3 d2 ee 0f ee 2d a1 d7 4c
  509. Jan 27 09:12:08: | 00 00 00 1c 00 00 00 01 01 10 60 02 a2 7e 66 da
  510. Jan 27 09:12:08: | e6 0b 70 e8 db da 2a c5 c8 03 d1 6d 00 00 00 04
  511. Jan 27 09:12:08: | next IV: 76 cb 98 af 42 38 3f be 8f dc 8f d3 4b 10 77 a7
  512. Jan 27 09:12:08: | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x120opt: 0x2080
  513. Jan 27 09:12:08: | ***parse ISAKMP Identification Payload:
  514. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_HASH (0x8)
  515. Jan 27 09:12:08: | length: 12 (0xc)
  516. Jan 27 09:12:08: | ID type: ID_IPV4_ADDR (0x1)
  517. Jan 27 09:12:08: | DOI specific A: 17 (0x11)
  518. Jan 27 09:12:08: | DOI specific B: 500 (0x1f4)
  519. Jan 27 09:12:08: | obj: c0 a8 01 0a
  520. Jan 27 09:12:08: | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100opt: 0x2080
  521. Jan 27 09:12:08: | ***parse ISAKMP Hash Payload:
  522. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_N (0xb)
  523. Jan 27 09:12:08: | length: 36 (0x24)
  524. Jan 27 09:12:08: | got payload 0x800 (ISAKMP_NEXT_N) needed: 0x0opt: 0x2080
  525. Jan 27 09:12:08: | ***parse ISAKMP Notification Payload:
  526. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  527. Jan 27 09:12:08: | length: 28 (0x1c)
  528. Jan 27 09:12:08: | DOI: ISAKMP_DOI_IPSEC (0x1)
  529. Jan 27 09:12:08: | protocol ID: 1 (0x1)
  530. Jan 27 09:12:08: | SPI size: 16 (0x10)
  531. Jan 27 09:12:08: | Notify Message Type: IPSEC_INITIAL_CONTACT (0x6002)
  532. Jan 27 09:12:08: | removing 4 bytes of padding
  533. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: ignoring informational payload IPSEC_INITIAL_CONTACT, msgid=00000000, length=28
  534. Jan 27 09:12:08: | ISAKMP Notification Payload
  535. Jan 27 09:12:08: | 00 00 00 1c 00 00 00 01 01 10 60 02
  536. Jan 27 09:12:08: | info: a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  537. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.10'
  538. Jan 27 09:12:08: | refine_host_connection: starting with xauth-psk
  539. Jan 27 09:12:08: | match_id a=192.168.1.10
  540. Jan 27 09:12:08: | b=192.168.1.10
  541. Jan 27 09:12:08: | results matched
  542. Jan 27 09:12:08: | trusted_ca_nss called with a=(empty) b=(empty)
  543. Jan 27 09:12:08: | refine_host_connection: checking xauth-psk[232] aaa.bbb.ccc.ddd against xauth-psk[232] aaa.bbb.ccc.ddd, best=(none) with match=1(id=1/ca=1/reqca=1)
  544. Jan 27 09:12:08: | refine_host_connection: checked xauth-psk[232] aaa.bbb.ccc.ddd against xauth-psk[232] aaa.bbb.ccc.ddd, now for see if best
  545. Jan 27 09:12:08: | started looking for secret for ccc.ddd.eee.fff->192.168.1.10 of kind PPK_PSK
  546. Jan 27 09:12:08: | actually looking for secret for ccc.ddd.eee.fff->192.168.1.10 of kind PPK_PSK
  547. Jan 27 09:12:08: | line 1: key type PPK_PSK(ccc.ddd.eee.fff) to type PPK_PSK
  548. Jan 27 09:12:08: | 1: compared key (none) to ccc.ddd.eee.fff / 192.168.1.10 -> 2
  549. Jan 27 09:12:08: | 2: compared key (none) to ccc.ddd.eee.fff / 192.168.1.10 -> 2
  550. Jan 27 09:12:08: | line 1: match=2
  551. Jan 27 09:12:08: | best_match 0>2 best=0x7f410f43f470 (line=1)
  552. Jan 27 09:12:08: | concluding with best_match=2 best=0x7f410f43f470 (lineno=1)
  553. Jan 27 09:12:08: | offered CA: '%none'
  554. Jan 27 09:12:08: | hmac prf: init 0x7f410f521810
  555. Jan 27 09:12:08: | hmac prf: init symkey symkey 0x7f410f6d7370 (length 32)
  556. Jan 27 09:12:08: | hmac prf: update
  557. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6d7370) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  558. Jan 27 09:12:08: | symkey: key(0x7f410f6d7370) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  559. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  560. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  561. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6bdfb0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  562. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6bdfb0) bytes(0x7ffda297f1d0/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  563. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  564. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  565. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  566. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  567. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  568. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  569. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e5a20 (length 256)
  570. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6924c0) bytes(0x7f410f6e5a20/256) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  571. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  572. Jan 27 09:12:08: | bytes: 19 4c f9 0e bb ca dd 8b c2 c2 e2 85 c4 a7 25 c1
  573. Jan 27 09:12:08: | bytes: 86 ec 55 df ca aa a4 0d 71 aa d3 1d 07 80 b8 ae
  574. Jan 27 09:12:08: | bytes: be b2 71 37 8c 9d 3f f3 af 70 2e fa b8 5c ea 5f
  575. Jan 27 09:12:08: | bytes: 6b ef 0b 9d 09 af 34 cd 9f c6 f4 e5 a8 11 28 62
  576. Jan 27 09:12:08: | bytes: 35 3e 62 be c4 54 0c 79 af d7 e2 5d 2c 5a 00 ef
  577. Jan 27 09:12:08: | bytes: 3f 5a 42 06 18 e1 11 e9 c7 5d 0c 23 5c 31 c4 90
  578. Jan 27 09:12:08: | bytes: 88 6b c6 05 60 1a f6 c7 8d 9b 09 e7 f7 44 8a ac
  579. Jan 27 09:12:08: | bytes: 90 c9 4f f9 cb 55 70 38 f3 29 59 bb 4d 3a bd dc
  580. Jan 27 09:12:08: | bytes: ce c8 70 bf 7c bf 45 7f 47 c7 81 f9 01 52 2f d6
  581. Jan 27 09:12:08: | bytes: c3 a9 8c 54 87 7a d4 ad f6 ad c8 28 7b 83 a7 06
  582. Jan 27 09:12:08: | bytes: 62 52 7f d4 cd 98 20 98 0a eb 39 27 7a 91 ce a6
  583. Jan 27 09:12:08: | bytes: 58 c0 f5 79 53 d3 51 22 f0 ab 06 98 1d 23 55 0f
  584. Jan 27 09:12:08: | bytes: 0a 13 50 a4 f1 6d f4 67 94 9d 19 4a 93 8a de 60
  585. Jan 27 09:12:08: | bytes: 7d 65 b9 e9 34 8c 25 e5 1f 62 b2 11 fa 84 19 12
  586. Jan 27 09:12:08: | bytes: 1b 4a fe b7 3f 1d 7e 64 8d 02 03 cb a7 08 13 2f
  587. Jan 27 09:12:08: | bytes: e4 57 82 73 07 00 14 40 b2 a3 5e c0 97 7b d1 96
  588. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6b9e30) length(320) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  589. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6924c0
  590. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e4b20 (length 256)
  591. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6b9e30) bytes(0x7f410f6e4b20/256) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  592. Jan 27 09:12:08: | symkey: key(0x7f410f6b9e30) length(320) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  593. Jan 27 09:12:08: | bytes: 9d 5a 5f 65 eb b0 65 4e eb 94 c6 df 0d 98 a9 d7
  594. Jan 27 09:12:08: | bytes: 22 c3 72 25 ea 8e 07 33 85 5d 28 a8 f7 1d 54 95
  595. Jan 27 09:12:08: | bytes: 06 ba f9 1e d7 b1 76 f2 f7 67 3e 0f 61 fa 59 e2
  596. Jan 27 09:12:08: | bytes: d6 fa ed 19 24 d9 43 3b ad 60 82 30 16 0f d3 2c
  597. Jan 27 09:12:08: | bytes: 4e b8 00 1d 43 dc b5 18 4d 12 80 5e 45 04 1f e1
  598. Jan 27 09:12:08: | bytes: 39 fb 39 9c f2 c3 f3 6d 36 e3 6d 1b dc f4 8c 5e
  599. Jan 27 09:12:08: | bytes: da fd 60 4a 11 47 92 ee 96 c9 59 df 71 de 87 2b
  600. Jan 27 09:12:08: | bytes: ed 74 da c0 f3 33 d9 95 19 ed 1d 65 89 aa e7 0f
  601. Jan 27 09:12:08: | bytes: 9c 69 09 49 e5 06 2b f9 48 c0 50 d4 8d 1d 0c 5b
  602. Jan 27 09:12:08: | bytes: 72 b6 7b 57 f1 3d 92 28 07 9a 52 dd b2 e5 23 25
  603. Jan 27 09:12:08: | bytes: 3c 6c 20 68 2c 96 a5 bb ee 0c b9 15 80 0e ae 54
  604. Jan 27 09:12:08: | bytes: f3 9d 30 3a 02 cb b6 9f 2f c8 9f 5f 75 4e 80 48
  605. Jan 27 09:12:08: | bytes: 2c 23 a5 21 ca 02 dd 48 5a 38 81 6f 28 79 43 a6
  606. Jan 27 09:12:08: | bytes: 9e 85 ef 12 83 4a 9e 33 b8 3b 8f c2 72 e4 55 08
  607. Jan 27 09:12:08: | bytes: 3e b2 04 83 cd c6 10 20 f2 34 22 98 af 1b 54 a9
  608. Jan 27 09:12:08: | bytes: 72 19 3f 41 6b a3 b6 95 1e c8 b6 59 02 6e b7 34
  609. .
  610. .
  611. .
  612. Jan 27 09:12:08: | hmac prf: init 0x7f410f4dce40
  613. Jan 27 09:12:08: | hmac prf: init symkey symkey 0x7f410f6e4c80 (length 32)
  614. Jan 27 09:12:08: | hmac prf: update
  615. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e4c80) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  616. Jan 27 09:12:08: | symkey: key(0x7f410f6e4c80) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  617. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  618. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  619. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6bdfb0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  620. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6bdfb0) bytes(0x7ffda297f8b0/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  621. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  622. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  623. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  624. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  625. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  626. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  627. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e7e88 (length 4)
  628. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6924c0) bytes(0x7f410f6e7e88/4) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  629. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  630. Jan 27 09:12:08: | bytes: 7a 0d 16 1c
  631. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  632. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6924c0
  633. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f50d0c0 (length 32)
  634. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6b9e30) bytes(0x7f410f50d0c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  635. Jan 27 09:12:08: | symkey: key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  636. Jan 27 09:12:08: | bytes: 00 00 00 20 02 00 00 00 40 89 00 09 61 74 6f 64
  637. Jan 27 09:12:08: | bytes: 74 66 65 6c 64 40 8a 00 07 74 7a 69 74 7a 69 6d
  638. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6924c0) length(100) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  639. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6b9e30
  640. Jan 27 09:12:08: | hmac prf: final
  641. Jan 27 09:12:08: | prf inner hash: hash(OAKLEY_SHA2_256) symkey(0x7f410f6924c0) to symkey - derive(SHA256_KEY_DERIVATION)
  642. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(100) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  643. Jan 27 09:12:08: | prf inner hash: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  644. Jan 27 09:12:08: | prf inner:: free key 0x7f410f6924c0
  645. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6bdfb0) bytes(0x7ffda297f890/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  646. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  647. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  648. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  649. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  650. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  651. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  652. Jan 27 09:12:08: | concat: merge symkey(1: 0x7f410f6924c0) symkey(2: 0x7f410f6b9e30) - derive(CONCATENATE_BASE_AND_KEY) target(SHA256_KEY_DERIVATION)
  653. Jan 27 09:12:08: | symkey 1: key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  654. Jan 27 09:12:08: | symkey 2: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  655. Jan 27 09:12:08: | concat: key(0x7f410f6e5b30) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  656. Jan 27 09:12:08: | append_symkey_symkey: free key 0x7f410f6924c0
  657. Jan 27 09:12:08: | prf hashed inner:: free key 0x7f410f6b9e30
  658. Jan 27 09:12:08: | prf key: free key 0x7f410f6bdfb0
  659. Jan 27 09:12:08: | prf outer hash hash(OAKLEY_SHA2_256) symkey(0x7f410f6e5b30) to bytes
  660. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  661. Jan 27 09:12:08: | prf outer hash a0 3f 84 54 28 3f ff cf 04 dd 44 0d ec 0e de 1e
  662. Jan 27 09:12:08: | prf outer hash 53 47 01 9c ee eb e2 cd 39 88 59 c8 79 5e 12 5e
  663. Jan 27 09:12:08: | prf outer: free key 0x7f410f6e5b30
  664. Jan 27 09:12:08: | prf final bytes a0 3f 84 54 28 3f ff cf 04 dd 44 0d ec 0e de 1e
  665. Jan 27 09:12:08: | prf final bytes 53 47 01 9c ee eb e2 cd 39 88 59 c8 79 5e 12 5e
  666. Jan 27 09:12:08: | XAUTH: HASH computed:
  667. Jan 27 09:12:08: | a0 3f 84 54 28 3f ff cf 04 dd 44 0d ec 0e de 1e
  668. Jan 27 09:12:08: | 53 47 01 9c ee eb e2 cd 39 88 59 c8 79 5e 12 5e
  669. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  670. Jan 27 09:12:08: | ModeCfg attr type: XAUTH-USER-NAME (0x4089)
  671. Jan 27 09:12:08: | length/value: 9 (0x9)
  672. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  673. Jan 27 09:12:08: | ModeCfg attr type: XAUTH-USER-PASSWORD (0x408a)
  674. Jan 27 09:12:08: | length/value: 7 (0x7)
  675. Jan 27 09:12:08: | complete v1 state transition with STF_IGNORE
  676. Jan 27 09:12:08: XAUTH: User user1: Attempting to login
  677. Jan 27 09:12:08: XAUTH: passwd file authentication being called to authenticate user user1
  678. Jan 27 09:12:08: XAUTH: password file (/etc/ipsec.d/passwd) open.
  679. Jan 27 09:12:08: | XAUTH: found user(user1/user1) pass($1$TLfrUoXu$nEqigz7i37T9pMdbNjK01.) connid(xauth-psk/xauth-psk) addresspool()
  680. Jan 27 09:12:08: | XAUTH: checking user(user1:xauth-psk) pass $1$TLfrUoXu$nEqigz7i37T9pMdbNjK01. vs $1$TLfrUoXu$nEqigz7i37T9pMdbNjK01.
  681. Jan 27 09:12:08: XAUTH: User user1: Authentication Successful
  682. Jan 27 09:12:08: | **emit ISAKMP Message:
  683. Jan 27 09:12:08: | initiator cookie:
  684. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8
  685. Jan 27 09:12:08: | responder cookie:
  686. Jan 27 09:12:08: | db da 2a c5 c8 03 d1 6d
  687. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_HASH (0x8)
  688. Jan 27 09:12:08: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  689. Jan 27 09:12:08: | exchange type: ISAKMP_XCHG_MODE_CFG (0x6)
  690. Jan 27 09:12:08: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  691. Jan 27 09:12:08: | message ID: 57 11 cd 06
  692. Jan 27 09:12:08: | ***emit ISAKMP Hash Payload:
  693. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_MODECFG (0xe)
  694. Jan 27 09:12:08: | emitting 32 zero bytes of HASH into ISAKMP Hash Payload
  695. Jan 27 09:12:08: | emitting length of ISAKMP Hash Payload: 36
  696. Jan 27 09:12:08: | ***emit ISAKMP Mode Attribute:
  697. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  698. Jan 27 09:12:08: | Attr Msg Type: ISAKMP_CFG_SET (0x3)
  699. Jan 27 09:12:08: | Identifier: 0 (0x0)
  700. Jan 27 09:12:08: | ****emit ISAKMP ModeCfg attribute:
  701. Jan 27 09:12:08: | ModeCfg attr type: 49295?? (0xc08f)
  702. Jan 27 09:12:08: | length/value: 1 (0x1)
  703. Jan 27 09:12:08: | no IKEv1 message padding required
  704. Jan 27 09:12:08: | emitting length of ISAKMP Mode Attribute: 12
  705. Jan 27 09:12:08: | hmac prf: init 0x7f40f80009e0
  706. Jan 27 09:12:08: | hmac prf: init symkey symkey 0x7f410f6e4c80 (length 32)
  707. Jan 27 09:12:08: | hmac prf: update
  708. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e4c80) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  709. Jan 27 09:12:08: | symkey: key(0x7f410f6e4c80) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  710. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  711. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  712. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6e5b30) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  713. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6e5b30) bytes(0x7f4106bf5980/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  714. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  715. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  716. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  717. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  718. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  719. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6bdfb0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  720. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e7e88 (length 4)
  721. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6bdfb0) bytes(0x7f410f6e7e88/4) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  722. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  723. Jan 27 09:12:08: | bytes: 57 11 cd 06
  724. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  725. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6bdfb0
  726. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f4106bf5be0 (length 12)
  727. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6b9e30) bytes(0x7f4106bf5be0/12) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  728. Jan 27 09:12:08: | symkey: key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  729. Jan 27 09:12:08: | bytes: 00 00 00 0c 03 00 00 00 c0 8f 00 01
  730. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6bdfb0) length(80) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  731. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6b9e30
  732. Jan 27 09:12:08: | hmac prf: final
  733. Jan 27 09:12:08: | prf inner hash: hash(OAKLEY_SHA2_256) symkey(0x7f410f6bdfb0) to symkey - derive(SHA256_KEY_DERIVATION)
  734. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(80) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  735. Jan 27 09:12:08: | prf inner hash: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  736. Jan 27 09:12:08: | prf inner:: free key 0x7f410f6bdfb0
  737. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6e5b30) bytes(0x7f4106bf5960/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  738. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  739. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  740. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  741. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  742. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  743. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6bdfb0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  744. Jan 27 09:12:08: | concat: merge symkey(1: 0x7f410f6bdfb0) symkey(2: 0x7f410f6b9e30) - derive(CONCATENATE_BASE_AND_KEY) target(SHA256_KEY_DERIVATION)
  745. Jan 27 09:12:08: | symkey 1: key(0x7f410f6bdfb0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  746. Jan 27 09:12:08: | symkey 2: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  747. Jan 27 09:12:08: | concat: key(0x7f410f6924c0) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  748. Jan 27 09:12:08: | append_symkey_symkey: free key 0x7f410f6bdfb0
  749. Jan 27 09:12:08: | prf hashed inner:: free key 0x7f410f6b9e30
  750. Jan 27 09:12:08: | prf key: free key 0x7f410f6e5b30
  751. Jan 27 09:12:08: | prf outer hash hash(OAKLEY_SHA2_256) symkey(0x7f410f6924c0) to bytes
  752. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  753. Jan 27 09:12:08: | prf outer hash 23 d4 d4 65 77 5f 94 4f 1e 5e 33 2d 2e 89 a9 f4
  754. Jan 27 09:12:08: | prf outer hash 8b 8b 16 a5 95 f5 20 4a 3a 99 36 7e 98 f7 72 79
  755. Jan 27 09:12:08: | prf outer: free key 0x7f410f6924c0
  756. Jan 27 09:12:08: | prf final bytes 23 d4 d4 65 77 5f 94 4f 1e 5e 33 2d 2e 89 a9 f4
  757. Jan 27 09:12:08: | prf final bytes 8b 8b 16 a5 95 f5 20 4a 3a 99 36 7e 98 f7 72 79
  758. Jan 27 09:12:08: | XAUTH: HASH computed:
  759. Jan 27 09:12:08: | 23 d4 d4 65 77 5f 94 4f 1e 5e 33 2d 2e 89 a9 f4
  760. Jan 27 09:12:08: | 8b 8b 16 a5 95 f5 20 4a 3a 99 36 7e 98 f7 72 79
  761. Jan 27 09:12:08: | no IKEv1 message padding required
  762. Jan 27 09:12:08: | emitting length of ISAKMP Message: 76
  763. Jan 27 09:12:08: | last Phase 1 IV: 22 29 4e e5 e5 04 a4 d2 db 3f e3 e2 17 ef 14 c0
  764. Jan 27 09:12:08: | current Phase 1 IV: e0 02 12 c8 bb d9 52 9f 42 3d a1 ce be b2 60 de
  765. Jan 27 09:12:08: | computed Phase 2 IV:
  766. Jan 27 09:12:08: | 86 7f f1 ab df 81 4b 3a 1d 2d 14 7b 26 e0 f0 4f
  767. Jan 27 09:12:08: | 82 ac e2 f4 d9 8a dd 69 eb 1f 97 45 d3 93 2a 24
  768. Jan 27 09:12:08: | encrypting: 0e 00 00 24 23 d4 d4 65 77 5f 94 4f 1e 5e 33 2d
  769. Jan 27 09:12:08: | encrypting: 2e 89 a9 f4 8b 8b 16 a5 95 f5 20 4a 3a 99 36 7e
  770. Jan 27 09:12:08: | encrypting: 98 f7 72 79 00 00 00 0c 03 00 00 00 c0 8f 00 01
  771. Jan 27 09:12:08: | IV: 86 7f f1 ab df 81 4b 3a 1d 2d 14 7b 26 e0 f0 4f
  772. Jan 27 09:12:08: | IV: 82 ac e2 f4 d9 8a dd 69 eb 1f 97 45 d3 93 2a 24
  773. Jan 27 09:12:08: | unpadded size is: 48
  774. Jan 27 09:12:08: | encrypting 48 using OAKLEY_AES_CBC
  775. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - enter
  776. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - exit
  777. Jan 27 09:12:08: | next IV: ce 03 84 f2 b1 a1 97 1c 98 8e 71 3c 57 01 94 3a
  778. Jan 27 09:12:08: | no IKEv1 message padding required
  779. Jan 27 09:12:08: | emitting length of ISAKMP Message: 76
  780. Jan 27 09:12:08: | state: #536 requesting EVENT_v1_RETRANSMIT to be deleted
  781. Jan 27 09:12:08: | event_schedule_ms called for about 500 ms
  782. Jan 27 09:12:08: | event_schedule_tv called for about 0 seconds and change
  783. Jan 27 09:12:08: | inserting event EVENT_v1_RETRANSMIT, timeout in 0.500000 seconds for #536
  784. Jan 27 09:12:08: | sending 80 bytes for XAUTH: status through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #536)
  785. Jan 27 09:12:08: | 00 00 00 00 a2 7e 66 da e6 0b 70 e8 db da 2a c5
  786. Jan 27 09:12:08: | c8 03 d1 6d 08 10 06 01 57 11 cd 06 00 00 00 4c
  787. Jan 27 09:12:08: | 59 32 fe 4b 2b 36 c9 01 33 d1 29 85 7e 61 83 1d
  788. Jan 27 09:12:08: | b7 c8 42 4f d1 c7 d8 45 6f 13 f0 9a 0d 81 45 09
  789. Jan 27 09:12:08: | ce 03 84 f2 b1 a1 97 1c 98 8e 71 3c 57 01 94 3a
  790. Jan 27 09:12:08: | parent state #536: STATE_XAUTH_R0(established-authenticated-ike) > STATE_XAUTH_R1(established-authenticated-ike)
  791. Jan 27 09:12:08: | ignore states: 0
  792. Jan 27 09:12:08: | half-open-ike states: 0
  793. Jan 27 09:12:08: | open-ike states: 0
  794. Jan 27 09:12:08: | established-anonymous-ike states: 0
  795. Jan 27 09:12:08: | established-authenticated-ike states: 2
  796. Jan 27 09:12:08: | anonymous-ipsec states: 0
  797. Jan 27 09:12:08: | authenticated-ipsec states: 2
  798. Jan 27 09:12:08: | informational states: 0
  799. Jan 27 09:12:08: | unknown states: 0
  800. Jan 27 09:12:08: | category states: 4 count states: 4
  801. Jan 27 09:12:08: | *received 92 bytes from aaa.bbb.ccc.ddd:4500 on eth0 (port=4500)
  802. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  803. Jan 27 09:12:08: | 08 10 06 01 57 11 cd 06 00 00 00 5c 5c 4c 68 b0
  804. Jan 27 09:12:08: | 07 55 90 79 9e 06 09 97 55 ff cc eb c6 48 dc 9f
  805. Jan 27 09:12:08: | 71 a3 51 08 0a 2c ed 9a 85 0f 0f e1 aa c2 4a d2
  806. Jan 27 09:12:08: | e9 49 bd 3e 29 a5 81 cf ce 28 14 90 43 37 07 fc
  807. Jan 27 09:12:08: | f8 f1 58 70 7d 1c 9c 73 34 dd f4 5a
  808. Jan 27 09:12:08: | **parse ISAKMP Message:
  809. Jan 27 09:12:08: | initiator cookie:
  810. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8
  811. Jan 27 09:12:08: | responder cookie:
  812. Jan 27 09:12:08: | db da 2a c5 c8 03 d1 6d
  813. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_HASH (0x8)
  814. Jan 27 09:12:08: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  815. Jan 27 09:12:08: | exchange type: ISAKMP_XCHG_MODE_CFG (0x6)
  816. Jan 27 09:12:08: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  817. Jan 27 09:12:08: | message ID: 57 11 cd 06
  818. Jan 27 09:12:08: | length: 92 (0x5c)
  819. Jan 27 09:12:08: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6)
  820. Jan 27 09:12:08: | finding hash chain in state hash table
  821. Jan 27 09:12:08: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  822. Jan 27 09:12:08: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  823. Jan 27 09:12:08: | found hash chain 14
  824. Jan 27 09:12:08: | peer and cookies match on #536; msgid=5711cd06 st_msgid=00000000 st_msgid_phase15=5711cd06
  825. Jan 27 09:12:08: | p15 state object #536 found, in STATE_XAUTH_R1
  826. Jan 27 09:12:08: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  827. Jan 27 09:12:08: | #536 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  828. Jan 27 09:12:08: | received encrypted packet from aaa.bbb.ccc.ddd:4500
  829. Jan 27 09:12:08: | decrypting 64 bytes using algorithm OAKLEY_AES_CBC
  830. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - enter
  831. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - exit
  832. Jan 27 09:12:08: | decrypted:
  833. Jan 27 09:12:08: | 0e 00 00 24 7d ec 36 d8 0a e3 3f 3f 39 e5 ce 5c
  834. Jan 27 09:12:08: | d7 e3 4d af cc e4 5d 66 e5 0f a8 94 7f 0b 88 76
  835. Jan 27 09:12:08: | f9 7a 34 29 00 00 00 0c 04 00 00 00 c0 8f 00 00
  836. Jan 27 09:12:08: | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10
  837. Jan 27 09:12:08: | next IV: 43 37 07 fc f8 f1 58 70 7d 1c 9c 73 34 dd f4 5a
  838. Jan 27 09:12:08: | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x4100opt: 0x2000
  839. Jan 27 09:12:08: | ***parse ISAKMP Hash Payload:
  840. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_MODECFG (0xe)
  841. Jan 27 09:12:08: | length: 36 (0x24)
  842. Jan 27 09:12:08: | got payload 0x4000 (ISAKMP_NEXT_MODECFG) needed: 0x4000opt: 0x2000
  843. Jan 27 09:12:08: | ***parse ISAKMP Mode Attribute:
  844. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  845. Jan 27 09:12:08: | length: 12 (0xc)
  846. Jan 27 09:12:08: | Attr Msg Type: ISAKMP_CFG_ACK (0x4)
  847. Jan 27 09:12:08: | Identifier: 0 (0x0)
  848. Jan 27 09:12:08: | removing 16 bytes of padding
  849. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: XAUTH: xauth_inR1(STF_OK)
  850. Jan 27 09:12:08: | modecfg server, pull mode. Starting new exchange.
  851. Jan 27 09:12:08: | complete v1 state transition with STF_OK
  852. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: transition from state STATE_XAUTH_R1 to state STATE_MAIN_R3
  853. Jan 27 09:12:08: | parent state #536: STATE_XAUTH_R1(established-authenticated-ike) > STATE_MAIN_R3(established-authenticated-ike)
  854. Jan 27 09:12:08: | ignore states: 0
  855. Jan 27 09:12:08: | half-open-ike states: 0
  856. Jan 27 09:12:08: | open-ike states: 0
  857. Jan 27 09:12:08: | established-anonymous-ike states: 0
  858. Jan 27 09:12:08: | established-authenticated-ike states: 2
  859. Jan 27 09:12:08: | anonymous-ipsec states: 0
  860. Jan 27 09:12:08: | authenticated-ipsec states: 2
  861. Jan 27 09:12:08: | informational states: 0
  862. Jan 27 09:12:08: | unknown states: 0
  863. Jan 27 09:12:08: | category states: 4 count states: 4
  864. Jan 27 09:12:08: | state: #536 requesting EVENT_v1_RETRANSMIT to be deleted
  865. Jan 27 09:12:08: | event_schedule_ms called for about 3600000 ms
  866. Jan 27 09:12:08: | event_schedule_tv called for about 3600 seconds and change
  867. Jan 27 09:12:08: | inserting event EVENT_SA_EXPIRE, timeout in 3600.000000 seconds for #536
  868. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: STATE_MAIN_R3: sent MR3, ISAKMP SA established
  869. Jan 27 09:12:08: | modecfg pull: quirk-poll policy:pull not-client
  870. Jan 27 09:12:08: | phase 1 is done, looking for phase 2 to unpend
  871. Jan 27 09:12:08: | *received 188 bytes from aaa.bbb.ccc.ddd:4500 on eth0 (port=4500)
  872. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  873. Jan 27 09:12:08: | 08 10 06 01 9b 65 29 85 00 00 00 bc 4d 84 f0 80
  874. Jan 27 09:12:08: | 71 be c9 c0 48 16 d9 1b 8c 3f 46 9d 60 0d ee e8
  875. Jan 27 09:12:08: | ce bd 00 a0 57 d8 48 ae f5 98 d0 7e 95 30 16 7c
  876. Jan 27 09:12:08: | da 57 d8 8e e6 62 27 af 3f 9c f7 df 90 3d 1c 40
  877. Jan 27 09:12:08: | 48 fd 3b e7 93 cb f3 b8 d0 0e 12 52 3d a7 45 c5
  878. Jan 27 09:12:08: | 5a de a1 38 b3 26 5e eb 5a f0 27 61 a6 7f 76 4a
  879. Jan 27 09:12:08: | 82 54 15 14 2d 37 41 a0 32 ce 5d 06 cf b7 df 87
  880. Jan 27 09:12:08: | 35 b9 34 58 45 66 87 31 14 89 53 61 40 10 51 c3
  881. Jan 27 09:12:08: | 64 17 ff da ea 1c 3e 71 05 22 06 2c 2d c1 62 e7
  882. Jan 27 09:12:08: | 8f 0a 76 41 6a 30 63 16 16 05 87 6d f3 f4 5b d2
  883. Jan 27 09:12:08: | 99 1c 19 67 d9 54 7f 18 3c 76 af fe
  884. Jan 27 09:12:08: | **parse ISAKMP Message:
  885. Jan 27 09:12:08: | initiator cookie:
  886. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8
  887. Jan 27 09:12:08: | responder cookie:
  888. Jan 27 09:12:08: | db da 2a c5 c8 03 d1 6d
  889. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_HASH (0x8)
  890. Jan 27 09:12:08: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  891. Jan 27 09:12:08: | exchange type: ISAKMP_XCHG_MODE_CFG (0x6)
  892. Jan 27 09:12:08: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  893. Jan 27 09:12:08: | message ID: 9b 65 29 85
  894. Jan 27 09:12:08: | length: 188 (0xbc)
  895. Jan 27 09:12:08: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6)
  896. Jan 27 09:12:08: | finding hash chain in state hash table
  897. Jan 27 09:12:08: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  898. Jan 27 09:12:08: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  899. Jan 27 09:12:08: | found hash chain 14
  900. Jan 27 09:12:08: | peer and cookies match on #536; msgid=9b652985 st_msgid=00000000 st_msgid_phase15=00000000
  901. Jan 27 09:12:08: | p15 state object not found
  902. Jan 27 09:12:08: | No appropriate Mode Config state yet.See if we have a Main Mode state
  903. Jan 27 09:12:08: | finding hash chain in state hash table
  904. Jan 27 09:12:08: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  905. Jan 27 09:12:08: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  906. Jan 27 09:12:08: | found hash chain 14
  907. Jan 27 09:12:08: | peer and cookies match on #536; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000
  908. Jan 27 09:12:08: | p15 state object #536 found, in STATE_MAIN_R3
  909. Jan 27 09:12:08: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  910. Jan 27 09:12:08: | processing received isakmp_xchg_type ISAKMP_XCHG_MODE_CFG.
  911. Jan 27 09:12:08: | this is a xauthserver modecfgserver
  912. Jan 27 09:12:08: | call init_phase2_iv
  913. Jan 27 09:12:08: | last Phase 1 IV: 22 29 4e e5 e5 04 a4 d2 db 3f e3 e2 17 ef 14 c0
  914. Jan 27 09:12:08: | current Phase 1 IV: ce 03 84 f2 b1 a1 97 1c 98 8e 71 3c 57 01 94 3a
  915. Jan 27 09:12:08: | computed Phase 2 IV:
  916. Jan 27 09:12:08: | 97 88 32 6a a8 17 7b 8c 08 a6 6e d3 5a ad 03 00
  917. Jan 27 09:12:08: | 74 69 03 55 f5 c2 5b 33 c9 ef ef 42 76 88 21 79
  918. Jan 27 09:12:08: | set from_state to STATE_MAIN_R3 this is modecfgserver and IS_PHASE1() is TRUE
  919. Jan 27 09:12:08: | #536 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  920. Jan 27 09:12:08: | received encrypted packet from aaa.bbb.ccc.ddd:4500
  921. Jan 27 09:12:08: | decrypting 160 bytes using algorithm OAKLEY_AES_CBC
  922. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - enter
  923. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - exit
  924. Jan 27 09:12:08: | decrypted:
  925. Jan 27 09:12:08: | 0e 00 00 24 d7 7d cb ed 95 7e 08 78 1d df f6 9a
  926. Jan 27 09:12:08: | c0 ee 03 47 c9 72 b0 41 fb 3a 55 2a 7e 02 9d 7f
  927. Jan 27 09:12:08: | 2e 80 f3 7e 00 00 00 71 01 00 7d eb 00 01 00 00
  928. Jan 27 09:12:08: | 00 02 00 00 00 03 00 00 00 04 00 00 00 05 00 00
  929. Jan 27 09:12:08: | 00 07 00 29 43 69 73 63 6f 20 53 79 73 74 65 6d
  930. Jan 27 09:12:08: | 73 20 56 50 4e 20 43 6c 69 65 6e 74 20 31 30 2e
  931. Jan 27 09:12:08: | 31 2e 31 3a 69 50 68 6f 6e 65 20 4f 53 70 00 00
  932. Jan 27 09:12:08: | 00 70 02 00 00 70 03 00 00 70 04 00 00 70 06 00
  933. Jan 27 09:12:08: | 00 70 07 00 00 70 01 00 00 70 08 00 00 70 09 00
  934. Jan 27 09:12:08: | 00 70 0b 00 00 00 00 00 00 00 00 00 00 00 00 0b
  935. Jan 27 09:12:08: | next IV: f3 f4 5b d2 99 1c 19 67 d9 54 7f 18 3c 76 af fe
  936. Jan 27 09:12:08: | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x4100opt: 0x2000
  937. Jan 27 09:12:08: | ***parse ISAKMP Hash Payload:
  938. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_MODECFG (0xe)
  939. Jan 27 09:12:08: | length: 36 (0x24)
  940. Jan 27 09:12:08: | got payload 0x4000 (ISAKMP_NEXT_MODECFG) needed: 0x4000opt: 0x2000
  941. Jan 27 09:12:08: | ***parse ISAKMP Mode Attribute:
  942. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  943. Jan 27 09:12:08: | length: 113 (0x71)
  944. Jan 27 09:12:08: | Attr Msg Type: ISAKMP_CFG_REQUEST (0x1)
  945. Jan 27 09:12:08: | Identifier: 32235 (0x7deb)
  946. Jan 27 09:12:08: | removing 11 bytes of padding
  947. Jan 27 09:12:08: | **emit ISAKMP Message:
  948. Jan 27 09:12:08: | initiator cookie:
  949. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8
  950. Jan 27 09:12:08: | responder cookie:
  951. Jan 27 09:12:08: | db da 2a c5 c8 03 d1 6d
  952. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_HASH (0x8)
  953. Jan 27 09:12:08: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  954. Jan 27 09:12:08: | exchange type: ISAKMP_XCHG_MODE_CFG (0x6)
  955. Jan 27 09:12:08: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  956. Jan 27 09:12:08: | message ID: 9b 65 29 85
  957. Jan 27 09:12:08: | arrived in modecfg_inR0
  958. Jan 27 09:12:08: | hmac prf: init 0x7f410f4b38e0
  959. Jan 27 09:12:08: | hmac prf: init symkey symkey 0x7f410f6e4c80 (length 32)
  960. Jan 27 09:12:08: | hmac prf: update
  961. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e4c80) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  962. Jan 27 09:12:08: | symkey: key(0x7f410f6e4c80) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  963. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  964. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  965. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6924c0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  966. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6924c0) bytes(0x7ffda297f910/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  967. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  968. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  969. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  970. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  971. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  972. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6e5b30) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  973. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e7e88 (length 4)
  974. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e5b30) bytes(0x7f410f6e7e88/4) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  975. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  976. Jan 27 09:12:08: | bytes: 9b 65 29 85
  977. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  978. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6e5b30
  979. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e5d30 (length 113)
  980. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6b9e30) bytes(0x7f410f6e5d30/113) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  981. Jan 27 09:12:08: | symkey: key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  982. Jan 27 09:12:08: | bytes: 00 00 00 71 01 00 7d eb 00 01 00 00 00 02 00 00
  983. Jan 27 09:12:08: | bytes: 00 03 00 00 00 04 00 00 00 05 00 00 00 07 00 29
  984. Jan 27 09:12:08: | bytes: 43 69 73 63 6f 20 53 79 73 74 65 6d 73 20 56 50
  985. Jan 27 09:12:08: | bytes: 4e 20 43 6c 69 65 6e 74 20 31 30 2e 31 2e 31 3a
  986. Jan 27 09:12:08: | bytes: 69 50 68 6f 6e 65 20 4f 53 70 00 00 00 70 02 00
  987. Jan 27 09:12:08: | bytes: 00 70 03 00 00 70 04 00 00 70 06 00 00 70 07 00
  988. Jan 27 09:12:08: | bytes: 00 70 01 00 00 70 08 00 00 70 09 00 00 70 0b 00
  989. Jan 27 09:12:08: | bytes: 00
  990. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6e5b30) length(181) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  991. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6b9e30
  992. Jan 27 09:12:08: | hmac prf: final
  993. Jan 27 09:12:08: | prf inner hash: hash(OAKLEY_SHA2_256) symkey(0x7f410f6e5b30) to symkey - derive(SHA256_KEY_DERIVATION)
  994. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(181) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  995. Jan 27 09:12:08: | prf inner hash: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  996. Jan 27 09:12:08: | prf inner:: free key 0x7f410f6e5b30
  997. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6924c0) bytes(0x7ffda297f8f0/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  998. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  999. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1000. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1001. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1002. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1003. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6e5b30) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1004. Jan 27 09:12:08: | concat: merge symkey(1: 0x7f410f6e5b30) symkey(2: 0x7f410f6b9e30) - derive(CONCATENATE_BASE_AND_KEY) target(SHA256_KEY_DERIVATION)
  1005. Jan 27 09:12:08: | symkey 1: key(0x7f410f6e5b30) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1006. Jan 27 09:12:08: | symkey 2: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1007. Jan 27 09:12:08: | concat: key(0x7f410f6bdfb0) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1008. Jan 27 09:12:08: | append_symkey_symkey: free key 0x7f410f6e5b30
  1009. Jan 27 09:12:08: | prf hashed inner:: free key 0x7f410f6b9e30
  1010. Jan 27 09:12:08: | prf key: free key 0x7f410f6924c0
  1011. Jan 27 09:12:08: | prf outer hash hash(OAKLEY_SHA2_256) symkey(0x7f410f6bdfb0) to bytes
  1012. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1013. Jan 27 09:12:08: | prf outer hash d7 7d cb ed 95 7e 08 78 1d df f6 9a c0 ee 03 47
  1014. Jan 27 09:12:08: | prf outer hash c9 72 b0 41 fb 3a 55 2a 7e 02 9d 7f 2e 80 f3 7e
  1015. Jan 27 09:12:08: | prf outer: free key 0x7f410f6bdfb0
  1016. Jan 27 09:12:08: | prf final bytes d7 7d cb ed 95 7e 08 78 1d df f6 9a c0 ee 03 47
  1017. Jan 27 09:12:08: | prf final bytes c9 72 b0 41 fb 3a 55 2a 7e 02 9d 7f 2e 80 f3 7e
  1018. Jan 27 09:12:08: | XAUTH: HASH computed:
  1019. Jan 27 09:12:08: | d7 7d cb ed 95 7e 08 78 1d df f6 9a c0 ee 03 47
  1020. Jan 27 09:12:08: | c9 72 b0 41 fb 3a 55 2a 7e 02 9d 7f 2e 80 f3 7e
  1021. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1022. Jan 27 09:12:08: | ModeCfg attr type: INTERNAL_IP4_ADDRESS (0x1)
  1023. Jan 27 09:12:08: | length/value: 0 (0x0)
  1024. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1025. Jan 27 09:12:08: | ModeCfg attr type: INTERNAL_IP4_NETMASK (0x2)
  1026. Jan 27 09:12:08: | length/value: 0 (0x0)
  1027. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1028. Jan 27 09:12:08: | ModeCfg attr type: INTERNAL_IP4_DNS (0x3)
  1029. Jan 27 09:12:08: | length/value: 0 (0x0)
  1030. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1031. Jan 27 09:12:08: | ModeCfg attr type: INTERNAL_IP4_NBNS (0x4)
  1032. Jan 27 09:12:08: | length/value: 0 (0x0)
  1033. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1034. Jan 27 09:12:08: | ModeCfg attr type: INTERNAL_ADDRESS_EXPIRY (0x5)
  1035. Jan 27 09:12:08: | length/value: 0 (0x0)
  1036. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute INTERNAL_ADDRESS_EXPIRY received.
  1037. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1038. Jan 27 09:12:08: | ModeCfg attr type: APPLICATION_VERSION (0x7)
  1039. Jan 27 09:12:08: | length/value: 41 (0x29)
  1040. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute APPLICATION_VERSION received.
  1041. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1042. Jan 27 09:12:08: | ModeCfg attr type: MODECFG_BANNER (0x7000)
  1043. Jan 27 09:12:08: | length/value: 0 (0x0)
  1044. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute MODECFG_BANNER received.
  1045. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1046. Jan 27 09:12:08: | ModeCfg attr type: MODECFG_DOMAIN (0x7002)
  1047. Jan 27 09:12:08: | length/value: 0 (0x0)
  1048. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute MODECFG_DOMAIN received.
  1049. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1050. Jan 27 09:12:08: | ModeCfg attr type: CISCO_SPLIT_DNS (0x7003)
  1051. Jan 27 09:12:08: | length/value: 0 (0x0)
  1052. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute CISCO_SPLIT_DNS received.
  1053. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1054. Jan 27 09:12:08: | ModeCfg attr type: CISCO_SPLIT_INC (0x7004)
  1055. Jan 27 09:12:08: | length/value: 0 (0x0)
  1056. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute CISCO_SPLIT_INC received.
  1057. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1058. Jan 27 09:12:08: | ModeCfg attr type: CISCO_SPLIT_EXCLUDE (0x7006)
  1059. Jan 27 09:12:08: | length/value: 0 (0x0)
  1060. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute CISCO_SPLIT_EXCLUDE received.
  1061. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1062. Jan 27 09:12:08: | ModeCfg attr type: CISCO_DO_PFS (0x7007)
  1063. Jan 27 09:12:08: | length/value: 0 (0x0)
  1064. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute CISCO_DO_PFS received.
  1065. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1066. Jan 27 09:12:08: | ModeCfg attr type: CISCO_SAVE_PW (0x7001)
  1067. Jan 27 09:12:08: | length/value: 0 (0x0)
  1068. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute CISCO_SAVE_PW received.
  1069. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1070. Jan 27 09:12:08: | ModeCfg attr type: CISCO_FW_TYPE (0x7008)
  1071. Jan 27 09:12:08: | length/value: 0 (0x0)
  1072. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute CISCO_FW_TYPE received.
  1073. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1074. Jan 27 09:12:08: | ModeCfg attr type: CISCO_BACKUP_SERVER (0x7009)
  1075. Jan 27 09:12:08: | length/value: 0 (0x0)
  1076. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute CISCO_BACKUP_SERVER received.
  1077. Jan 27 09:12:08: | ****parse ISAKMP ModeCfg attribute:
  1078. Jan 27 09:12:08: | ModeCfg attr type: CISCO_UNKNOWN_SEEN_ON_IPHONE (0x700b)
  1079. Jan 27 09:12:08: | length/value: 0 (0x0)
  1080. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: Unsupported modecfg long attribute CISCO_UNKNOWN_SEEN_ON_IPHONE received.
  1081. Jan 27 09:12:08: | ***emit ISAKMP Hash Payload:
  1082. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_MODECFG (0xe)
  1083. Jan 27 09:12:08: | emitting 32 zero bytes of HASH into ISAKMP Hash Payload
  1084. Jan 27 09:12:08: | emitting length of ISAKMP Hash Payload: 36
  1085. Jan 27 09:12:08: | ***emit ISAKMP Mode Attribute:
  1086. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  1087. Jan 27 09:12:08: | Attr Msg Type: ISAKMP_CFG_REPLY (0x2)
  1088. Jan 27 09:12:08: | Identifier: 32235 (0x7deb)
  1089. Jan 27 09:12:08: | request lease from addresspool eee.fff.ggg.hhh-eee.fff.ggg.xxx reference count 502 thatid '192.168.1.10' that.client.addr eee.fff.ggg.rrr
  1090. Jan 27 09:12:08: | New lease from addresspool index 12
  1091. Jan 27 09:12:08: | new lease 10.231.247.22 from addresspool eee.fff.ggg.hhh-eee.fff.ggg.xxx to that.client.addr eee.fff.ggg.rrr thatid '192.168.1.10'
  1092. Jan 27 09:12:08: | ****emit ISAKMP ModeCfg attribute:
  1093. Jan 27 09:12:08: | ModeCfg attr type: INTERNAL_IP4_ADDRESS (0x1)
  1094. Jan 27 09:12:08: | emitting 4 raw bytes of IP4_addr into ISAKMP ModeCfg attribute
  1095. Jan 27 09:12:08: | IP4_addr 0a e7 f7 16
  1096. Jan 27 09:12:08: | emitting length of ISAKMP ModeCfg attribute: 4
  1097. Jan 27 09:12:08: | ****emit ISAKMP ModeCfg attribute:
  1098. Jan 27 09:12:08: | ModeCfg attr type: INTERNAL_IP4_NETMASK (0x2)
  1099. Jan 27 09:12:08: | emitting 4 raw bytes of IP4_submsk into ISAKMP ModeCfg attribute
  1100. Jan 27 09:12:08: | IP4_submsk 00 00 00 00
  1101. Jan 27 09:12:08: | emitting length of ISAKMP ModeCfg attribute: 4
  1102. Jan 27 09:12:08: | ****emit ISAKMP ModeCfg attribute:
  1103. Jan 27 09:12:08: | ModeCfg attr type: INTERNAL_IP4_DNS (0x3)
  1104. Jan 27 09:12:08: | emitting 4 raw bytes of IP4_dns into ISAKMP ModeCfg attribute
  1105. Jan 27 09:12:08: | IP4_dns ac 1f 23 ef
  1106. Jan 27 09:12:08: | emitting length of ISAKMP ModeCfg attribute: 4
  1107. Jan 27 09:12:08: | no IKEv1 message padding required
  1108. Jan 27 09:12:08: | emitting length of ISAKMP Mode Attribute: 32
  1109. Jan 27 09:12:08: | hmac prf: init 0x7f410f4b38e0
  1110. Jan 27 09:12:08: | hmac prf: init symkey symkey 0x7f410f6e4c80 (length 32)
  1111. Jan 27 09:12:08: | hmac prf: update
  1112. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e4c80) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1113. Jan 27 09:12:08: | symkey: key(0x7f410f6e4c80) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1114. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  1115. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  1116. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6bdfb0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1117. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6bdfb0) bytes(0x7ffda297f760/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  1118. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1119. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1120. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1121. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1122. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1123. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1124. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e7e88 (length 4)
  1125. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6924c0) bytes(0x7f410f6e7e88/4) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1126. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1127. Jan 27 09:12:08: | bytes: 9b 65 29 85
  1128. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1129. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6924c0
  1130. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f1365a0 (length 32)
  1131. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6b9e30) bytes(0x7f410f1365a0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1132. Jan 27 09:12:08: | symkey: key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1133. Jan 27 09:12:08: | bytes: 00 00 00 20 02 00 7d eb 00 01 00 04 0a e7 f7 16
  1134. Jan 27 09:12:08: | bytes: 00 02 00 04 00 00 00 00 00 03 00 04 ac 1f 23 ef
  1135. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6924c0) length(100) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1136. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6b9e30
  1137. Jan 27 09:12:08: | hmac prf: final
  1138. Jan 27 09:12:08: | prf inner hash: hash(OAKLEY_SHA2_256) symkey(0x7f410f6924c0) to symkey - derive(SHA256_KEY_DERIVATION)
  1139. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(100) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1140. Jan 27 09:12:08: | prf inner hash: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1141. Jan 27 09:12:08: | prf inner:: free key 0x7f410f6924c0
  1142. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6bdfb0) bytes(0x7ffda297f740/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  1143. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1144. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1145. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1146. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1147. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1148. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1149. Jan 27 09:12:08: | concat: merge symkey(1: 0x7f410f6924c0) symkey(2: 0x7f410f6b9e30) - derive(CONCATENATE_BASE_AND_KEY) target(SHA256_KEY_DERIVATION)
  1150. Jan 27 09:12:08: | symkey 1: key(0x7f410f6924c0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1151. Jan 27 09:12:08: | symkey 2: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1152. Jan 27 09:12:08: | concat: key(0x7f410f6e5b30) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1153. Jan 27 09:12:08: | append_symkey_symkey: free key 0x7f410f6924c0
  1154. Jan 27 09:12:08: | prf hashed inner:: free key 0x7f410f6b9e30
  1155. Jan 27 09:12:08: | prf key: free key 0x7f410f6bdfb0
  1156. Jan 27 09:12:08: | prf outer hash hash(OAKLEY_SHA2_256) symkey(0x7f410f6e5b30) to bytes
  1157. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1158. Jan 27 09:12:08: | prf outer hash ea 47 06 a8 34 80 5a ce 18 c2 ac 7b f9 50 3e 47
  1159. Jan 27 09:12:08: | prf outer hash 62 0c e9 7d 1e 1b b5 d7 8d 68 3d 58 49 c3 ce 1d
  1160. Jan 27 09:12:08: | prf outer: free key 0x7f410f6e5b30
  1161. Jan 27 09:12:08: | prf final bytes ea 47 06 a8 34 80 5a ce 18 c2 ac 7b f9 50 3e 47
  1162. Jan 27 09:12:08: | prf final bytes 62 0c e9 7d 1e 1b b5 d7 8d 68 3d 58 49 c3 ce 1d
  1163. Jan 27 09:12:08: | XAUTH: HASH computed:
  1164. Jan 27 09:12:08: | ea 47 06 a8 34 80 5a ce 18 c2 ac 7b f9 50 3e 47
  1165. Jan 27 09:12:08: | 62 0c e9 7d 1e 1b b5 d7 8d 68 3d 58 49 c3 ce 1d
  1166. Jan 27 09:12:08: | no IKEv1 message padding required
  1167. Jan 27 09:12:08: | emitting length of ISAKMP Message: 96
  1168. Jan 27 09:12:08: | encrypting: 0e 00 00 24 ea 47 06 a8 34 80 5a ce 18 c2 ac 7b
  1169. Jan 27 09:12:08: | encrypting: f9 50 3e 47 62 0c e9 7d 1e 1b b5 d7 8d 68 3d 58
  1170. Jan 27 09:12:08: | encrypting: 49 c3 ce 1d 00 00 00 20 02 00 7d eb 00 01 00 04
  1171. Jan 27 09:12:08: | encrypting: 0a e7 f7 16 00 02 00 04 00 00 00 00 00 03 00 04
  1172. Jan 27 09:12:08: | encrypting: ac 1f 23 ef
  1173. Jan 27 09:12:08: | IV: f3 f4 5b d2 99 1c 19 67 d9 54 7f 18 3c 76 af fe
  1174. Jan 27 09:12:08: | unpadded size is: 68
  1175. Jan 27 09:12:08: | emitting 12 zero bytes of encryption padding into ISAKMP Message
  1176. Jan 27 09:12:08: | encrypting 80 using OAKLEY_AES_CBC
  1177. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - enter
  1178. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - exit
  1179. Jan 27 09:12:08: | next IV: a5 f9 09 88 45 a4 1a d6 a7 9b 4a 1d dc f2 b9 34
  1180. Jan 27 09:12:08: | no IKEv1 message padding required
  1181. Jan 27 09:12:08: | emitting length of ISAKMP Message: 108
  1182. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: modecfg_inR0(STF_OK)
  1183. Jan 27 09:12:08: | complete v1 state transition with STF_OK
  1184. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: transition from state STATE_MODE_CFG_R0 to state STATE_MODE_CFG_R1
  1185. Jan 27 09:12:08: | parent state #536: STATE_MAIN_R3(established-authenticated-ike) > STATE_MODE_CFG_R1(established-authenticated-ike)
  1186. Jan 27 09:12:08: | ignore states: 0
  1187. Jan 27 09:12:08: | half-open-ike states: 0
  1188. Jan 27 09:12:08: | open-ike states: 0
  1189. Jan 27 09:12:08: | established-anonymous-ike states: 0
  1190. Jan 27 09:12:08: | established-authenticated-ike states: 2
  1191. Jan 27 09:12:08: | anonymous-ipsec states: 0
  1192. Jan 27 09:12:08: | authenticated-ipsec states: 2
  1193. Jan 27 09:12:08: | informational states: 0
  1194. Jan 27 09:12:08: | unknown states: 0
  1195. Jan 27 09:12:08: | category states: 4 count states: 4
  1196. Jan 27 09:12:08: | state: #536 requesting EVENT_SA_EXPIRE to be deleted
  1197. Jan 27 09:12:08: | sending reply packet to aaa.bbb.ccc.ddd:4500 (from port 4500)
  1198. Jan 27 09:12:08: | sending 112 bytes for STATE_MODE_CFG_R0 through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #536)
  1199. Jan 27 09:12:08: | 00 00 00 00 a2 7e 66 da e6 0b 70 e8 db da 2a c5
  1200. Jan 27 09:12:08: | c8 03 d1 6d 08 10 06 01 9b 65 29 85 00 00 00 6c
  1201. Jan 27 09:12:08: | 24 d5 c1 34 97 ea ea f7 84 a5 ac c4 43 6f 1c e8
  1202. Jan 27 09:12:08: | cb e4 6d b3 4b 99 94 cd dc 64 b6 a2 4a e8 39 c4
  1203. Jan 27 09:12:08: | 5f 96 36 f9 31 10 9b 4f 77 9a a6 62 1a b6 62 cc
  1204. Jan 27 09:12:08: | e5 a0 72 c6 3d ba c1 81 08 bd 01 61 12 1b aa 4e
  1205. Jan 27 09:12:08: | a5 f9 09 88 45 a4 1a d6 a7 9b 4a 1d dc f2 b9 34
  1206. Jan 27 09:12:08: | event_schedule_ms called for about 3600000 ms
  1207. Jan 27 09:12:08: | event_schedule_tv called for about 3600 seconds and change
  1208. Jan 27 09:12:08: | inserting event EVENT_SA_EXPIRE, timeout in 3600.000000 seconds for #536
  1209. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: STATE_MODE_CFG_R1: ModeCfg Set sent, expecting Ack
  1210. Jan 27 09:12:08: | modecfg pull: quirk-poll policy:pull not-client
  1211. Jan 27 09:12:08: | phase 1 is done, looking for phase 2 to unpend
  1212. Jan 27 09:12:08: | *received 300 bytes from aaa.bbb.ccc.ddd:4500 on eth0 (port=4500)
  1213. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  1214. Jan 27 09:12:08: | 08 10 20 01 b2 6d de 8a 00 00 01 2c de 50 62 66
  1215. Jan 27 09:12:08: | 3c ca 43 55 83 d4 22 7e 29 81 b9 d4 4c 29 e4 bf
  1216. Jan 27 09:12:08: | d3 c5 1d 40 ee c0 3f 71 80 69 be e9 3b f6 51 14
  1217. Jan 27 09:12:08: | ed d9 43 92 79 96 fc ee ea 53 2f f3 87 30 11 db
  1218. Jan 27 09:12:08: | 28 ca b0 45 00 e2 95 dc 51 68 5b aa 2c a3 cf 72
  1219. Jan 27 09:12:08: | 33 e4 14 f0 fe a3 06 5c 41 2f 27 a0 47 49 e5 aa
  1220. Jan 27 09:12:08: | ff 06 1b 77 b8 df 79 2c 48 16 77 34 3b 75 24 56
  1221. Jan 27 09:12:08: | 65 53 65 4a d0 89 19 5b 74 af f3 42 08 61 dd c9
  1222. Jan 27 09:12:08: | 34 2a 91 15 30 e9 97 3b ba 6d 43 c9 63 d8 c4 fe
  1223. Jan 27 09:12:08: | d1 14 2e 86 c4 bb 85 5c 48 ce ce e7 e0 db 91 ee
  1224. Jan 27 09:12:08: | 6d 0a 22 37 8b 28 dc 7f 84 be b4 62 6a 3f b2 dc
  1225. Jan 27 09:12:08: | 24 8b 4a 01 f4 bd ef fb 52 c8 4c 9f 02 83 96 14
  1226. Jan 27 09:12:08: | 21 e8 da 55 8c c1 4f f1 23 49 ae d8 83 fc 31 03
  1227. Jan 27 09:12:08: | 29 2e b8 08 cb 1d 12 f7 93 27 e8 38 d5 f0 2f 39
  1228. Jan 27 09:12:08: | 13 ce 7a 1e 13 a8 f4 65 83 98 50 f1 0b e9 c5 88
  1229. Jan 27 09:12:08: | fb 87 31 d3 ca 9a 71 80 9f b6 31 76 9a 8d 55 c5
  1230. Jan 27 09:12:08: | dc 9c 8c 8c 0f ea dd 62 e9 b8 eb 33 2c 9e 34 5e
  1231. Jan 27 09:12:08: | 74 ba ee c6 2c 4d cb e3 6b b2 4c 0a
  1232. Jan 27 09:12:08: | **parse ISAKMP Message:
  1233. Jan 27 09:12:08: | initiator cookie:
  1234. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8
  1235. Jan 27 09:12:08: | responder cookie:
  1236. Jan 27 09:12:08: | db da 2a c5 c8 03 d1 6d
  1237. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_HASH (0x8)
  1238. Jan 27 09:12:08: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  1239. Jan 27 09:12:08: | exchange type: ISAKMP_XCHG_QUICK (0x20)
  1240. Jan 27 09:12:08: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  1241. Jan 27 09:12:08: | message ID: b2 6d de 8a
  1242. Jan 27 09:12:08: | length: 300 (0x12c)
  1243. Jan 27 09:12:08: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32)
  1244. Jan 27 09:12:08: | finding hash chain in state hash table
  1245. Jan 27 09:12:08: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  1246. Jan 27 09:12:08: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  1247. Jan 27 09:12:08: | found hash chain 14
  1248. Jan 27 09:12:08: | v1 peer and cookies match on #536, provided msgid b26dde8a == 00000000
  1249. Jan 27 09:12:08: | v1 state object not found
  1250. Jan 27 09:12:08: | finding hash chain in state hash table
  1251. Jan 27 09:12:08: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  1252. Jan 27 09:12:08: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  1253. Jan 27 09:12:08: | found hash chain 14
  1254. Jan 27 09:12:08: | v1 peer and cookies match on #536, provided msgid 00000000 == 00000000
  1255. Jan 27 09:12:08: | v1 state object #536 found, in STATE_MODE_CFG_R1
  1256. Jan 27 09:12:08: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1257. Jan 27 09:12:08: | last Phase 1 IV: 22 29 4e e5 e5 04 a4 d2 db 3f e3 e2 17 ef 14 c0
  1258. Jan 27 09:12:08: | current Phase 1 IV: a5 f9 09 88 45 a4 1a d6 a7 9b 4a 1d dc f2 b9 34
  1259. Jan 27 09:12:08: | computed Phase 2 IV:
  1260. Jan 27 09:12:08: | df 25 63 0d d0 62 46 7c 16 ef 4f 85 22 c9 8c 55
  1261. Jan 27 09:12:08: | 2a f3 f4 be 97 fa b2 c7 ae 5a 79 50 23 55 93 bc
  1262. Jan 27 09:12:08: | #536 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  1263. Jan 27 09:12:08: | received encrypted packet from aaa.bbb.ccc.ddd:4500
  1264. Jan 27 09:12:08: | decrypting 272 bytes using algorithm OAKLEY_AES_CBC
  1265. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - enter
  1266. Jan 27 09:12:08: | NSS ike_alg_nss_cbc: aes - exit
  1267. Jan 27 09:12:08: | decrypted:
  1268. Jan 27 09:12:08: | 01 00 00 24 16 c5 6b 1f 9b 12 a3 35 9d 1d 50 90
  1269. Jan 27 09:12:08: | 83 92 ca 6b fd 2c 61 39 c4 b7 32 6f 13 44 e4 ed
  1270. Jan 27 09:12:08: | 46 2f f1 77 0a 00 00 b8 00 00 00 01 00 00 00 01
  1271. Jan 27 09:12:08: | 00 00 00 ac 01 03 04 06 03 fb 8b a5 03 00 00 1c
  1272. Jan 27 09:12:08: | 01 0c 00 00 80 01 00 01 80 02 0e 10 80 04 00 03
  1273. Jan 27 09:12:08: | 80 06 01 00 80 05 00 02 03 00 00 1c 02 0c 00 00
  1274. Jan 27 09:12:08: | 80 01 00 01 80 02 0e 10 80 04 00 03 80 06 01 00
  1275. Jan 27 09:12:08: | 80 05 00 01 03 00 00 1c 03 0c 00 00 80 01 00 01
  1276. Jan 27 09:12:08: | 80 02 0e 10 80 04 00 03 80 06 00 80 80 05 00 02
  1277. Jan 27 09:12:08: | 03 00 00 1c 04 0c 00 00 80 01 00 01 80 02 0e 10
  1278. Jan 27 09:12:08: | 80 04 00 03 80 06 00 80 80 05 00 01 03 00 00 18
  1279. Jan 27 09:12:08: | 05 03 00 00 80 01 00 01 80 02 0e 10 80 04 00 03
  1280. Jan 27 09:12:08: | 80 05 00 02 00 00 00 18 06 03 00 00 80 01 00 01
  1281. Jan 27 09:12:08: | 80 02 0e 10 80 04 00 03 80 05 00 01 05 00 00 14
  1282. Jan 27 09:12:08: | 7b 39 96 76 84 f2 dc cb a4 26 d4 62 f9 fa 18 ed
  1283. Jan 27 09:12:08: | 05 00 00 0c 01 00 00 00 0a e7 f7 16 00 00 00 10
  1284. Jan 27 09:12:08: | 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04
  1285. Jan 27 09:12:08: | next IV: 2c 9e 34 5e 74 ba ee c6 2c 4d cb e3 6b b2 4c 0a
  1286. Jan 27 09:12:08: | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x502opt: 0x200030
  1287. Jan 27 09:12:08: | ***parse ISAKMP Hash Payload:
  1288. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_SA (0x1)
  1289. Jan 27 09:12:08: | length: 36 (0x24)
  1290. Jan 27 09:12:08: | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x402opt: 0x200030
  1291. Jan 27 09:12:08: | ***parse ISAKMP Security Association Payload:
  1292. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONCE (0xa)
  1293. Jan 27 09:12:08: | length: 184 (0xb8)
  1294. Jan 27 09:12:08: | DOI: ISAKMP_DOI_IPSEC (0x1)
  1295. Jan 27 09:12:08: | got payload 0x400 (ISAKMP_NEXT_NONCE) needed: 0x400opt: 0x200030
  1296. Jan 27 09:12:08: | ***parse ISAKMP Nonce Payload:
  1297. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_ID (0x5)
  1298. Jan 27 09:12:08: | length: 20 (0x14)
  1299. Jan 27 09:12:08: | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0opt: 0x200030
  1300. Jan 27 09:12:08: | ***parse ISAKMP Identification Payload (IPsec DOI):
  1301. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_ID (0x5)
  1302. Jan 27 09:12:08: | length: 12 (0xc)
  1303. Jan 27 09:12:08: | ID type: ID_IPV4_ADDR (0x1)
  1304. Jan 27 09:12:08: | Protocol ID: 0 (0x0)
  1305. Jan 27 09:12:08: | port: 0 (0x0)
  1306. Jan 27 09:12:08: | obj: 0a e7 f7 16
  1307. Jan 27 09:12:08: | got payload 0x20 (ISAKMP_NEXT_ID) needed: 0x0opt: 0x200030
  1308. Jan 27 09:12:08: | ***parse ISAKMP Identification Payload (IPsec DOI):
  1309. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  1310. Jan 27 09:12:08: | length: 16 (0x10)
  1311. Jan 27 09:12:08: | ID type: ID_USER_FQDN (0x4)
  1312. Jan 27 09:12:08: | Protocol ID: 0 (0x0)
  1313. Jan 27 09:12:08: | port: 0 (0x0)
  1314. Jan 27 09:12:08: | obj: 00 00 00 00 00 00 00 00
  1315. Jan 27 09:12:08: | removing 4 bytes of padding
  1316. Jan 27 09:12:08: | hmac prf: init 0x7f410f565c70
  1317. Jan 27 09:12:08: | hmac prf: init symkey symkey 0x7f410f6e4c80 (length 32)
  1318. Jan 27 09:12:08: | hmac prf: update
  1319. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e4c80) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1320. Jan 27 09:12:08: | symkey: key(0x7f410f6e4c80) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1321. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  1322. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  1323. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6e5b30) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1324. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6e5b30) bytes(0x7ffda297f620/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  1325. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1326. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1327. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1328. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1329. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1330. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6bdfb0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1331. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f43f9a4 (length 4)
  1332. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6bdfb0) bytes(0x7f410f43f9a4/4) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1333. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1334. Jan 27 09:12:08: | bytes: b2 6d de 8a
  1335. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1336. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6bdfb0
  1337. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e9890 (length 232)
  1338. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6b9e30) bytes(0x7f410f6e9890/232) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1339. Jan 27 09:12:08: | symkey: key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1340. Jan 27 09:12:08: | bytes: 0a 00 00 b8 00 00 00 01 00 00 00 01 00 00 00 ac
  1341. Jan 27 09:12:08: | bytes: 01 03 04 06 03 fb 8b a5 03 00 00 1c 01 0c 00 00
  1342. Jan 27 09:12:08: | bytes: 80 01 00 01 80 02 0e 10 80 04 00 03 80 06 01 00
  1343. Jan 27 09:12:08: | bytes: 80 05 00 02 03 00 00 1c 02 0c 00 00 80 01 00 01
  1344. Jan 27 09:12:08: | bytes: 80 02 0e 10 80 04 00 03 80 06 01 00 80 05 00 01
  1345. Jan 27 09:12:08: | bytes: 03 00 00 1c 03 0c 00 00 80 01 00 01 80 02 0e 10
  1346. Jan 27 09:12:08: | bytes: 80 04 00 03 80 06 00 80 80 05 00 02 03 00 00 1c
  1347. Jan 27 09:12:08: | bytes: 04 0c 00 00 80 01 00 01 80 02 0e 10 80 04 00 03
  1348. Jan 27 09:12:08: | bytes: 80 06 00 80 80 05 00 01 03 00 00 18 05 03 00 00
  1349. Jan 27 09:12:08: | bytes: 80 01 00 01 80 02 0e 10 80 04 00 03 80 05 00 02
  1350. Jan 27 09:12:08: | bytes: 00 00 00 18 06 03 00 00 80 01 00 01 80 02 0e 10
  1351. Jan 27 09:12:08: | bytes: 80 04 00 03 80 05 00 01 05 00 00 14 7b 39 96 76
  1352. Jan 27 09:12:08: | bytes: 84 f2 dc cb a4 26 d4 62 f9 fa 18 ed 05 00 00 0c
  1353. Jan 27 09:12:08: | bytes: 01 00 00 00 0a e7 f7 16 00 00 00 10 04 00 00 00
  1354. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00
  1355. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6bdfb0) length(300) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1356. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6b9e30
  1357. Jan 27 09:12:08: | hmac prf: final
  1358. Jan 27 09:12:08: | prf inner hash: hash(OAKLEY_SHA2_256) symkey(0x7f410f6bdfb0) to symkey - derive(SHA256_KEY_DERIVATION)
  1359. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(300) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1360. Jan 27 09:12:08: | prf inner hash: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1361. Jan 27 09:12:08: | prf inner:: free key 0x7f410f6bdfb0
  1362. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6e5b30) bytes(0x7ffda297f600/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  1363. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1364. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1365. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1366. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1367. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1368. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6bdfb0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1369. Jan 27 09:12:08: | concat: merge symkey(1: 0x7f410f6bdfb0) symkey(2: 0x7f410f6b9e30) - derive(CONCATENATE_BASE_AND_KEY) target(SHA256_KEY_DERIVATION)
  1370. Jan 27 09:12:08: | symkey 1: key(0x7f410f6bdfb0) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1371. Jan 27 09:12:08: | symkey 2: key(0x7f410f6b9e30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1372. Jan 27 09:12:08: | concat: key(0x7f410f6924c0) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1373. Jan 27 09:12:08: | append_symkey_symkey: free key 0x7f410f6bdfb0
  1374. Jan 27 09:12:08: | prf hashed inner:: free key 0x7f410f6b9e30
  1375. Jan 27 09:12:08: | prf key: free key 0x7f410f6e5b30
  1376. Jan 27 09:12:08: | prf outer hash hash(OAKLEY_SHA2_256) symkey(0x7f410f6924c0) to bytes
  1377. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1378. Jan 27 09:12:08: | prf outer hash 16 c5 6b 1f 9b 12 a3 35 9d 1d 50 90 83 92 ca 6b
  1379. Jan 27 09:12:08: | prf outer hash fd 2c 61 39 c4 b7 32 6f 13 44 e4 ed 46 2f f1 77
  1380. Jan 27 09:12:08: | prf outer: free key 0x7f410f6924c0
  1381. Jan 27 09:12:08: | prf final bytes 16 c5 6b 1f 9b 12 a3 35 9d 1d 50 90 83 92 ca 6b
  1382. Jan 27 09:12:08: | prf final bytes fd 2c 61 39 c4 b7 32 6f 13 44 e4 ed 46 2f f1 77
  1383. Jan 27 09:12:08: | HASH(1) computed:
  1384. Jan 27 09:12:08: | 16 c5 6b 1f 9b 12 a3 35 9d 1d 50 90 83 92 ca 6b
  1385. Jan 27 09:12:08: | fd 2c 61 39 c4 b7 32 6f 13 44 e4 ed 46 2f f1 77
  1386. Jan 27 09:12:08: | peer client is 10.231.247.22
  1387. Jan 27 09:12:08: | peer client protocol/port is 0/0
  1388. Jan 27 09:12:08: | our client is subnet 0.0.0.0/0
  1389. Jan 27 09:12:08: | our client protocol/port is 0/0
  1390. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: the peer proposed: 0.0.0.0/0:0/0 -> 10.231.247.22/32:0/0
  1391. Jan 27 09:12:08: | find_client_connection starting with xauth-psk
  1392. Jan 27 09:12:08: | looking for 0.0.0.0/0:0/0 -> 10.231.247.22/32:0/0
  1393. Jan 27 09:12:08: | concrete checking against sr#0 0.0.0.0/0 -> 10.231.247.22/32
  1394. Jan 27 09:12:08: | client wildcard: no port wildcard: no virtual: no
  1395. Jan 27 09:12:08: | NAT-Traversal: received 0 NAT-OA.
  1396. Jan 27 09:12:08: | creating state object #537 at 0x7f410f6e9ad0
  1397. Jan 27 09:12:08: | parent state #537: new > STATE_UNDEFINED(ignore)
  1398. Jan 27 09:12:08: | duplicating state object #536 as #537
  1399. Jan 27 09:12:08: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1400. Jan 27 09:12:08: | child state #537: STATE_UNDEFINED(ignore) > STATE_QUICK_R0(authenticated-ipsec)
  1401. Jan 27 09:12:08: | ignore states: 0
  1402. Jan 27 09:12:08: | half-open-ike states: 0
  1403. Jan 27 09:12:08: | open-ike states: 0
  1404. Jan 27 09:12:08: | established-anonymous-ike states: 0
  1405. Jan 27 09:12:08: | established-authenticated-ike states: 2
  1406. Jan 27 09:12:08: | anonymous-ipsec states: 0
  1407. Jan 27 09:12:08: | authenticated-ipsec states: 3
  1408. Jan 27 09:12:08: | informational states: 0
  1409. Jan 27 09:12:08: | unknown states: 0
  1410. Jan 27 09:12:08: | category states: 5 count states: 5
  1411. Jan 27 09:12:08: | inserting state object #537
  1412. Jan 27 09:12:08: | finding hash chain in state hash table
  1413. Jan 27 09:12:08: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  1414. Jan 27 09:12:08: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  1415. Jan 27 09:12:08: | found hash chain 14
  1416. Jan 27 09:12:08: | list 0x7f410f1262b8 first entry 0x7f410f6e81a8
  1417. Jan 27 09:12:08: | inserted state 0x7f410f6e9ad0 entry 0x7f410f6ea138 next 0x7f410f6e81a8 prev-next 0x7f410f1262b8 into list
  1418. Jan 27 09:12:08: | updated next state 0x7f410f6e7b40 entry 0x7f410f6e81a8 next (nil) prev-next 0x7f410f6ea138
  1419. Jan 27 09:12:08: | finding hash chain in icookie hash table
  1420. Jan 27 09:12:08: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  1421. Jan 27 09:12:08: | RCOOKIE: 00 00 00 00 00 00 00 00
  1422. Jan 27 09:12:08: | found hash chain 13
  1423. Jan 27 09:12:08: | list 0x7f410f1263d0 first entry 0x7f410f6e81c0
  1424. Jan 27 09:12:08: | inserted state 0x7f410f6e9ad0 entry 0x7f410f6ea150 next 0x7f410f6e81c0 prev-next 0x7f410f1263d0 into list
  1425. Jan 27 09:12:08: | updated next state 0x7f410f6e7b40 entry 0x7f410f6e81c0 next (nil) prev-next 0x7f410f6ea150
  1426. Jan 27 09:12:08: | event_schedule called for 0 seconds
  1427. Jan 27 09:12:08: | event_schedule_tv called for about 0 seconds and change
  1428. Jan 27 09:12:08: | inserting event EVENT_SO_DISCARD, timeout in 0.000000 seconds for #537
  1429. Jan 27 09:12:08: | ****parse IPsec DOI SIT:
  1430. Jan 27 09:12:08: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1)
  1431. Jan 27 09:12:08: | ****parse ISAKMP Proposal Payload:
  1432. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  1433. Jan 27 09:12:08: | length: 172 (0xac)
  1434. Jan 27 09:12:08: | proposal number: 1 (0x1)
  1435. Jan 27 09:12:08: | protocol ID: PROTO_IPSEC_ESP (0x3)
  1436. Jan 27 09:12:08: | SPI size: 4 (0x4)
  1437. Jan 27 09:12:08: | number of transforms: 6 (0x6)
  1438. Jan 27 09:12:08: | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI
  1439. Jan 27 09:12:08: | SPI 03 fb 8b a5
  1440. Jan 27 09:12:08: | *****parse ISAKMP Transform Payload (ESP):
  1441. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_T (0x3)
  1442. Jan 27 09:12:08: | length: 28 (0x1c)
  1443. Jan 27 09:12:08: | ESP transform number: 1 (0x1)
  1444. Jan 27 09:12:08: | ESP transform ID: ESP_AES (0xc)
  1445. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1446. Jan 27 09:12:08: | af+type: SA_LIFE_TYPE (0x8001)
  1447. Jan 27 09:12:08: | length/value: 1 (0x1)
  1448. Jan 27 09:12:08: | [1 is SA_LIFE_TYPE_SECONDS]
  1449. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1450. Jan 27 09:12:08: | af+type: SA_LIFE_DURATION (0x8002)
  1451. Jan 27 09:12:08: | length/value: 3600 (0xe10)
  1452. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1453. Jan 27 09:12:08: | af+type: ENCAPSULATION_MODE (0x8004)
  1454. Jan 27 09:12:08: | length/value: 3 (0x3)
  1455. Jan 27 09:12:08: | [3 is ENCAPSULATION_MODE_UDP_TUNNEL_RFC]
  1456. Jan 27 09:12:08: | NAT-T RFC: Installing IPsec SA with ENCAP, st->hidden_variables.st_nat_traversal is RFC 3947 (NAT-Traversal)+I am behind NAT+peer behind NAT
  1457. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1458. Jan 27 09:12:08: | af+type: KEY_LENGTH (0x8006)
  1459. Jan 27 09:12:08: | length/value: 256 (0x100)
  1460. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1461. Jan 27 09:12:08: | af+type: AUTH_ALGORITHM (0x8005)
  1462. Jan 27 09:12:08: | length/value: 2 (0x2)
  1463. Jan 27 09:12:08: | [2 is AUTH_ALGORITHM_HMAC_SHA1]
  1464. Jan 27 09:12:08: | check_kernel_encrypt_alg(12,256): OK
  1465. Jan 27 09:12:08: | crypto helper 0: pcw_work: 0
  1466. Jan 27 09:12:08: | asking crypto helper 0 to do build nonce; request ID 846 (len=2776, pcw_work=0)
  1467. Jan 27 09:12:08: | crypto helper 0 read fd: 11
  1468. Jan 27 09:12:08: | crypto helper 0 doing build nonce; request ID 846
  1469. Jan 27 09:12:08: | Generated nonce: f4 1b 63 6e 1c 7e 98 7f 9b 38 64 51 ab 52 6e b6
  1470. Jan 27 09:12:08: | crypto helper 0 finished build nonce; request ID 846 time elapsed 11 usec
  1471. Jan 27 09:12:08: | #537 send_crypto_helper_request:613 st->st_calculating = TRUE;
  1472. Jan 27 09:12:08: | state: #537 requesting EVENT_SO_DISCARD to be deleted
  1473. Jan 27 09:12:08: | event_schedule called for 60 seconds
  1474. Jan 27 09:12:08: | event_schedule_tv called for about 60 seconds and change
  1475. Jan 27 09:12:08: | inserting event EVENT_CRYPTO_FAILED, timeout in 60.000000 seconds for #537
  1476. Jan 27 09:12:08: | complete v1 state transition with STF_SUSPEND
  1477. Jan 27 09:12:08: | crypto helper 0 has finished work (pcw_work now 1)
  1478. Jan 27 09:12:08: | crypto helper 0 replies to request ID 846
  1479. Jan 27 09:12:08: | calling continuation function 0x7f410ee50290
  1480. Jan 27 09:12:08: | quick_inI1_outR1_cryptocontinue1 for #537: calculated ke+nonce, calculating DH
  1481. Jan 27 09:12:08: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1482. Jan 27 09:12:08: | #537 quick_inI1_outR1_cryptocontinue1:2202 st->st_calculating = FALSE;
  1483. Jan 27 09:12:08: | **emit ISAKMP Message:
  1484. Jan 27 09:12:08: | initiator cookie:
  1485. Jan 27 09:12:08: | a2 7e 66 da e6 0b 70 e8
  1486. Jan 27 09:12:08: | responder cookie:
  1487. Jan 27 09:12:08: | db da 2a c5 c8 03 d1 6d
  1488. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_HASH (0x8)
  1489. Jan 27 09:12:08: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  1490. Jan 27 09:12:08: | exchange type: ISAKMP_XCHG_QUICK (0x20)
  1491. Jan 27 09:12:08: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  1492. Jan 27 09:12:08: | message ID: b2 6d de 8a
  1493. Jan 27 09:12:08: | ***emit ISAKMP Hash Payload:
  1494. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_SA (0x1)
  1495. Jan 27 09:12:08: | emitting 32 zero bytes of HASH into ISAKMP Hash Payload
  1496. Jan 27 09:12:08: | emitting length of ISAKMP Hash Payload: 36
  1497. Jan 27 09:12:08: | ***emit ISAKMP Security Association Payload:
  1498. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONCE (0xa)
  1499. Jan 27 09:12:08: | DOI: ISAKMP_DOI_IPSEC (0x1)
  1500. Jan 27 09:12:08: | ****parse IPsec DOI SIT:
  1501. Jan 27 09:12:08: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1)
  1502. Jan 27 09:12:08: | ****parse ISAKMP Proposal Payload:
  1503. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  1504. Jan 27 09:12:08: | length: 172 (0xac)
  1505. Jan 27 09:12:08: | proposal number: 1 (0x1)
  1506. Jan 27 09:12:08: | protocol ID: PROTO_IPSEC_ESP (0x3)
  1507. Jan 27 09:12:08: | SPI size: 4 (0x4)
  1508. Jan 27 09:12:08: | number of transforms: 6 (0x6)
  1509. Jan 27 09:12:08: | parsing 4 raw bytes of ISAKMP Proposal Payload into SPI
  1510. Jan 27 09:12:08: | SPI 03 fb 8b a5
  1511. Jan 27 09:12:08: | *****parse ISAKMP Transform Payload (ESP):
  1512. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_T (0x3)
  1513. Jan 27 09:12:08: | length: 28 (0x1c)
  1514. Jan 27 09:12:08: | ESP transform number: 1 (0x1)
  1515. Jan 27 09:12:08: | ESP transform ID: ESP_AES (0xc)
  1516. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1517. Jan 27 09:12:08: | af+type: SA_LIFE_TYPE (0x8001)
  1518. Jan 27 09:12:08: | length/value: 1 (0x1)
  1519. Jan 27 09:12:08: | [1 is SA_LIFE_TYPE_SECONDS]
  1520. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1521. Jan 27 09:12:08: | af+type: SA_LIFE_DURATION (0x8002)
  1522. Jan 27 09:12:08: | length/value: 3600 (0xe10)
  1523. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1524. Jan 27 09:12:08: | af+type: ENCAPSULATION_MODE (0x8004)
  1525. Jan 27 09:12:08: | length/value: 3 (0x3)
  1526. Jan 27 09:12:08: | [3 is ENCAPSULATION_MODE_UDP_TUNNEL_RFC]
  1527. Jan 27 09:12:08: | NAT-T RFC: Installing IPsec SA with ENCAP, st->hidden_variables.st_nat_traversal is RFC 3947 (NAT-Traversal)+I am behind NAT+peer behind NAT
  1528. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1529. Jan 27 09:12:08: | af+type: KEY_LENGTH (0x8006)
  1530. Jan 27 09:12:08: | length/value: 256 (0x100)
  1531. Jan 27 09:12:08: | ******parse ISAKMP IPsec DOI attribute:
  1532. Jan 27 09:12:08: | af+type: AUTH_ALGORITHM (0x8005)
  1533. Jan 27 09:12:08: | length/value: 2 (0x2)
  1534. Jan 27 09:12:08: | [2 is AUTH_ALGORITHM_HMAC_SHA1]
  1535. Jan 27 09:12:08: | check_kernel_encrypt_alg(12,256): OK
  1536. Jan 27 09:12:08: | ****emit IPsec DOI SIT:
  1537. Jan 27 09:12:08: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1)
  1538. Jan 27 09:12:08: | ****emit ISAKMP Proposal Payload:
  1539. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  1540. Jan 27 09:12:08: | proposal number: 1 (0x1)
  1541. Jan 27 09:12:08: | protocol ID: PROTO_IPSEC_ESP (0x3)
  1542. Jan 27 09:12:08: | SPI size: 4 (0x4)
  1543. Jan 27 09:12:08: | number of transforms: 1 (0x1)
  1544. Jan 27 09:12:08: | netlink_get_spi: allocated 0xb85cae98 for esp.0@ccc.ddd.eee.fff
  1545. Jan 27 09:12:08: | emitting 4 raw bytes of SPI into ISAKMP Proposal Payload
  1546. Jan 27 09:12:08: | SPI b8 5c ae 98
  1547. Jan 27 09:12:08: | *****emit ISAKMP Transform Payload (ESP):
  1548. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_NONE (0x0)
  1549. Jan 27 09:12:08: | ESP transform number: 1 (0x1)
  1550. Jan 27 09:12:08: | ESP transform ID: ESP_AES (0xc)
  1551. Jan 27 09:12:08: | emitting 20 raw bytes of attributes into ISAKMP Transform Payload (ESP)
  1552. Jan 27 09:12:08: | attributes 80 01 00 01 80 02 0e 10 80 04 00 03 80 06 01 00
  1553. Jan 27 09:12:08: | attributes 80 05 00 02
  1554. Jan 27 09:12:08: | emitting length of ISAKMP Transform Payload (ESP): 28
  1555. Jan 27 09:12:08: | emitting length of ISAKMP Proposal Payload: 40
  1556. Jan 27 09:12:08: | emitting length of ISAKMP Security Association Payload: 52
  1557. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #537: responding to Quick Mode proposal {msgid:8ade6db2}
  1558. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #537: us: 0.0.0.0/0===ccc.ddd.eee.fff[MS+XS+S=C]
  1559. Jan 27 09:12:08: "xauth-psk"[232] aaa.bbb.ccc.ddd #537: them: aaa.bbb.ccc.ddd[192.168.1.10,+MC+XC+S=C]===10.231.247.22/32
  1560. Jan 27 09:12:08: | ***emit ISAKMP Nonce Payload:
  1561. Jan 27 09:12:08: | next payload type: ISAKMP_NEXT_ID (0x5)
  1562. Jan 27 09:12:08: | emitting 16 raw bytes of Nr into ISAKMP Nonce Payload
  1563. Jan 27 09:12:08: | Nr f4 1b 63 6e 1c 7e 98 7f 9b 38 64 51 ab 52 6e b6
  1564. Jan 27 09:12:08: | emitting length of ISAKMP Nonce Payload: 20
  1565. Jan 27 09:12:08: | emitting 12 raw bytes of IDci into ISAKMP Message
  1566. Jan 27 09:12:08: | IDci 05 00 00 0c 01 00 00 00 0a e7 f7 16
  1567. Jan 27 09:12:08: | emitting 16 raw bytes of IDcr into ISAKMP Message
  1568. Jan 27 09:12:08: | IDcr 00 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00
  1569. Jan 27 09:12:08: | hmac prf: init 0x7f410f51d460
  1570. Jan 27 09:12:08: | hmac prf: init symkey symkey 0x7f410f6e4c80 (length 32)
  1571. Jan 27 09:12:08: | hmac prf: update
  1572. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e4c80) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1573. Jan 27 09:12:08: | symkey: key(0x7f410f6e4c80) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1574. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  1575. Jan 27 09:12:08: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  1576. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6924c0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1577. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6924c0) bytes(0x7ffda297ece0/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  1578. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1579. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1580. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1581. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1582. Jan 27 09:12:08: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  1583. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6e5b30) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1584. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6e9e10 (length 4)
  1585. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e5b30) bytes(0x7f410f6e9e10/4) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1586. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1587. Jan 27 09:12:08: | bytes: b2 6d de 8a
  1588. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1589. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6e5b30
  1590. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f6bdab0 (length 16)
  1591. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6b9e30) bytes(0x7f410f6bdab0/16) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1592. Jan 27 09:12:08: | symkey: key(0x7f410f6b9e30) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1593. Jan 27 09:12:08: | bytes: 7b 39 96 76 84 f2 dc cb a4 26 d4 62 f9 fa 18 ed
  1594. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6e5b30) length(84) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1595. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6b9e30
  1596. Jan 27 09:12:08: | hmac prf: update bytes data 0x7f410f1365a0 (length 100)
  1597. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6e5b30) bytes(0x7f410f1365a0/100) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1598. Jan 27 09:12:08: | symkey: key(0x7f410f6e5b30) length(84) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1599. Jan 27 09:12:08: | bytes: 0a 00 00 34 00 00 00 01 00 00 00 01 00 00 00 28
  1600. Jan 27 09:12:08: | bytes: 01 03 04 01 b8 5c ae 98 00 00 00 1c 01 0c 00 00
  1601. Jan 27 09:12:08: | bytes: 80 01 00 01 80 02 0e 10 80 04 00 03 80 06 01 00
  1602. Jan 27 09:12:08: | bytes: 80 05 00 02 05 00 00 14 f4 1b 63 6e 1c 7e 98 7f
  1603. Jan 27 09:12:08: | bytes: 9b 38 64 51 ab 52 6e b6 05 00 00 0c 01 00 00 00
  1604. Jan 27 09:12:08: | bytes: 0a e7 f7 16 00 00 00 10 04 00 00 00 00 00 00 00
  1605. Jan 27 09:12:08: | bytes: 00 00 00 00
  1606. Jan 27 09:12:08: | concat_symkey_bytes key(0x7f410f6b9e30) length(184) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1607. Jan 27 09:12:08: | append_symkey_bytes: free key 0x7f410f6e5b30
  1608. Jan 27 09:12:08: | hmac prf: final
  1609. Jan 27 09:12:08: | prf inner hash: hash(OAKLEY_SHA2_256) symkey(0x7f410f6b9e30) to symkey - derive(SHA256_KEY_DERIVATION)
  1610. Jan 27 09:12:08: | symkey: key(0x7f410f6b9e30) length(184) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1611. Jan 27 09:12:08: | prf inner hash: key(0x7f410f6e5b30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1612. Jan 27 09:12:08: | prf inner:: free key 0x7f410f6b9e30
  1613. Jan 27 09:12:08: | xor_symkey_chunk merge symkey(0x7f410f6924c0) bytes(0x7ffda297ecc0/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  1614. Jan 27 09:12:08: | symkey: key(0x7f410f6924c0) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1615. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1616. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1617. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1618. Jan 27 09:12:08: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  1619. Jan 27 09:12:08: | xor_symkey_chunk key(0x7f410f6b9e30) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1620. Jan 27 09:12:08: | concat: merge symkey(1: 0x7f410f6b9e30) symkey(2: 0x7f410f6e5b30) - derive(CONCATENATE_BASE_AND_KEY) target(SHA256_KEY_DERIVATION)
  1621. Jan 27 09:12:08: | symkey 1: key(0x7f410f6b9e30) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  1622. Jan 27 09:12:08: | symkey 2: key(0x7f410f6e5b30) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  1623. Jan 27 09:12:08: | concat: key(0x7f410f6bdfb0) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1624. Jan 27 09:12:08: | append_symkey_symkey: free key 0x7f410f6b9e30
  1625. Jan 27 09:12:08: | prf hashed inner:: free key 0x7f410f6e5b30
  1626. Jan 27 09:12:08: | prf key: free key 0x7f410f6924c0
  1627. Jan 27 09:12:08: | prf outer hash hash(OAKLEY_SHA2_256) symkey(0x7f410f6bdfb0) to bytes
  1628. Jan 27 09:12:08: | symkey: key(0x7f410f6bdfb0) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1629. Jan 27 09:12:08: | prf outer hash 8c b2 a4 e1 23 a0 e3 0c 4f cf d8 50 d9 64 28 97
  1630. Jan 27 09:12:08: | prf outer hash c6 1e 38 eb e9 3e 29 8d 9a d9 b1 31 21 c6 0f 8b
  1631. Jan 27 09:12:08: | prf outer: free key 0x7f410f6bdfb0
  1632. Jan 27 09:12:08: | prf final bytes 8c b2 a4 e1 23 a0 e3 0c 4f cf d8 50 d9 64 28 97
  1633. Jan 27 09:12:08: | prf final bytes c6 1e 38 eb e9 3e 29 8d 9a d9 b1 31 21 c6 0f 8b
  1634. Jan 27 09:12:08: | HASH(2) computed:
  1635. Jan 27 09:12:08: | 8c b2 a4 e1 23 a0 e3 0c 4f cf d8 50 d9 64 28 97
  1636. Jan 27 09:12:08: | c6 1e 38 eb e9 3e 29 8d 9a d9 b1 31 21 c6 0f 8b
  1637. Jan 27 09:12:08: | compute_proto_keymat:needed_len (after ESP enc)=32
  1638. Jan 27 09:12:08: | compute_proto_keymat:needed_len (after ESP auth)=52
  1639. Jan 27 09:12:08: | hmac prf: init 0x7f410f51d460
  1640. Jan 27 09:12:08: | hmac prf: init symkey symkey 0x7f410f6da800 (length 32)
  1641. Jan 27 09:12:08: | hmac prf: update
  1642. Jan 27 09:12:08: | concat_symkey_bytes merge symkey(0x7f410f6da800) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  1643. .
  1644. .
  1645. .
  1646. Jan 27 09:12:11: | prf key: free key 0x7f410f6b9e30
  1647. Jan 27 09:12:11: | prf outer hash hash(OAKLEY_SHA2_256) symkey(0x7f410f6ebb20) to bytes
  1648. Jan 27 09:12:11: | symkey: key(0x7f410f6ebb20) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  1649. Jan 27 09:12:11: | prf outer hash 13 89 24 17 38 bd c3 2d 07 82 e9 b5 6e 89 dd 6a
  1650. Jan 27 09:12:11: | prf outer hash 27 24 f5 78 08 d4 f9 5c 96 36 1f 5b b9 d7 68 81
  1651. Jan 27 09:12:11: | prf outer: free key 0x7f410f6ebb20
  1652. Jan 27 09:12:11: | prf final bytes 13 89 24 17 38 bd c3 2d 07 82 e9 b5 6e 89 dd 6a
  1653. Jan 27 09:12:11: | prf final bytes 27 24 f5 78 08 d4 f9 5c 96 36 1f 5b b9 d7 68 81
  1654. Jan 27 09:12:11: | HASH(1) computed:
  1655. Jan 27 09:12:11: | 13 89 24 17 38 bd c3 2d 07 82 e9 b5 6e 89 dd 6a
  1656. Jan 27 09:12:11: | 27 24 f5 78 08 d4 f9 5c 96 36 1f 5b b9 d7 68 81
  1657. Jan 27 09:12:11: | last Phase 1 IV: 23 0b ee 0e 81 e6 03 ae bd 6f c8 9c 95 9f e2 2f
  1658. Jan 27 09:12:11: | current Phase 1 IV: 30 e6 33 60 c4 f7 23 f4 47 cd ad 16 04 c0 3d 81
  1659. Jan 27 09:12:11: | computed Phase 2 IV:
  1660. Jan 27 09:12:11: | c6 b7 f5 1d 90 ee 56 bb c8 39 c0 b1 8e 09 67 19
  1661. Jan 27 09:12:11: | 84 a6 75 8a d0 38 0a 6e 5d 5c 79 ea 91 cc 79 22
  1662. Jan 27 09:12:11: | encrypting: 0c 00 00 24 13 89 24 17 38 bd c3 2d 07 82 e9 b5
  1663. Jan 27 09:12:11: | encrypting: 6e 89 dd 6a 27 24 f5 78 08 d4 f9 5c 96 36 1f 5b
  1664. Jan 27 09:12:11: | encrypting: b9 d7 68 81 00 00 00 10 00 00 00 01 03 04 00 01
  1665. Jan 27 09:12:11: | encrypting: 49 a6 cb a6
  1666. Jan 27 09:12:11: | IV: c6 b7 f5 1d 90 ee 56 bb c8 39 c0 b1 8e 09 67 19
  1667. Jan 27 09:12:11: | IV: 84 a6 75 8a d0 38 0a 6e 5d 5c 79 ea 91 cc 79 22
  1668. Jan 27 09:12:11: | unpadded size is: 52
  1669. Jan 27 09:12:11: | emitting 12 zero bytes of encryption padding into ISAKMP Message
  1670. Jan 27 09:12:11: | encrypting 64 using OAKLEY_AES_CBC
  1671. Jan 27 09:12:11: | NSS ike_alg_nss_cbc: aes - enter
  1672. Jan 27 09:12:11: | NSS ike_alg_nss_cbc: aes - exit
  1673. Jan 27 09:12:11: | next IV: 37 25 70 96 16 d5 00 d8 a1 0e a8 ad 88 03 5f 91
  1674. Jan 27 09:12:11: | no IKEv1 message padding required
  1675. Jan 27 09:12:11: | emitting length of ISAKMP Message: 92
  1676. Jan 27 09:12:11: | sending 96 bytes for delete notify through eth0:4500 to bbb.ccc.ddd.eee:4500 (using #531)
  1677. Jan 27 09:12:11: | 00 00 00 00 14 24 85 61 42 b2 d3 dc 03 c4 02 58
  1678. Jan 27 09:12:11: | f8 bb 64 0c 08 10 05 01 5c 06 fe a3 00 00 00 5c
  1679. Jan 27 09:12:11: | 6c 84 93 80 18 7b 87 6c ac 35 45 d4 34 2d a7 2b
  1680. Jan 27 09:12:11: | 47 99 48 a8 b1 f0 0a 67 08 f4 2a a6 65 c7 08 06
  1681. Jan 27 09:12:11: | 84 c7 c6 f9 76 15 97 4e 47 d9 55 d9 f7 b8 37 96
  1682. Jan 27 09:12:11: | 37 25 70 96 16 d5 00 d8 a1 0e a8 ad 88 03 5f 91
  1683. Jan 27 09:12:11: | state: #532 requesting EVENT_SA_EXPIRE to be deleted
  1684. Jan 27 09:12:11: | unhashing state object #532
  1685. Jan 27 09:12:11: | removing state 0x7f410f6e1300 entry 0x7f410f6e1968 next 0x7f410f6ccfb8 prev-next 0x7f410f1262c0 from list
  1686. Jan 27 09:12:11: | updated next state 0x7f410f6cc950 entry 0x7f410f6ccfb8 next (nil) prev-next 0x7f410f1262c0
  1687. Jan 27 09:12:11: | removing state 0x7f410f6e1300 entry 0x7f410f6e1980 next 0x7f410f6ccfd0 prev-next 0x7f410f126410 from list
  1688. Jan 27 09:12:11: | updated next state 0x7f410f6cc950 entry 0x7f410f6ccfd0 next (nil) prev-next 0x7f410f126410
  1689. Jan 27 09:12:11: | command executing down-client
  1690. Jan 27 09:12:11: | get esp.95d908c@bbb.ccc.ddd.eee
  1691. Jan 27 09:12:11: | get esp.49a6cba6@ccc.ddd.eee.fff
  1692. Jan 27 09:12:11: | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='xauth-psk' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='ddd.eee.fff.ggg' PLUTO_ME='ccc.ddd.eee.fff' PLUTO_MY_ID='ccc.ddd.eee.fff' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='bbb.ccc.ddd.eee' PLUTO_PEER_ID='fff.ggg.hhh.iii' PLUTO_PEER_CLIENT='eee.fff.ggg.iii/32' PLUTO_PEER_CLIENT_NET='eee.fff.ggg.iii' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1485508114' PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERNAME='user2' PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='20744' PLUTO_OUTBYTES='9633' ipsec _updown 2>&1
  1693. Jan 27 09:12:11: | popen cmd is 992 chars long
  1694. Jan 27 09:12:11: | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='xauth-psk' PLUTO_:
  1695. Jan 27 09:12:11: | cmd( 80):INTERFACE='eth0' PLUTO_NEXT_HOP='ddd.eee.fff.ggg' PLUTO_ME='ccc.ddd.eee.fff' PLUTO_MY_:
  1696. Jan 27 09:12:11: | cmd( 160):ID='ccc.ddd.eee.fff' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLU:
  1697. Jan 27 09:12:11: | cmd( 240):TO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQ:
  1698. Jan 27 09:12:11: | cmd( 320):ID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='bbb.ccc.ddd.eee' PLUTO_PEER_ID='fff.ggg.:
  1699. Jan 27 09:12:11: | cmd( 400):hhh.iii' PLUTO_PEER_CLIENT='eee.fff.ggg.iii/32' PLUTO_PEER_CLIENT_NET='eee.fff.ggg.iii' :
  1700. Jan 27 09:12:11: | cmd( 480):PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL:
  1701. Jan 27 09:12:11: | cmd( 560):='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1485508114' PLUTO_CONN:
  1702. Jan 27 09:12:11: | cmd( 640):_POLICY='PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRAC:
  1703. Jan 27 09:12:11: | cmd( 720):K+IKE_FRAG_ALLOW' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERNA:
  1704. Jan 27 09:12:11: | cmd( 800):ME='user2' PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INF:
  1705. Jan 27 09:12:11: | cmd( 880):O='' PLUTO_PEER_BANNER='' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='20744' PLUTO_OU:
  1706. Jan 27 09:12:11: | cmd( 960):TBYTES='9633' ipsec _updown 2>&1:
  1707. Jan 27 09:12:11: | shunt_eroute() called for connection 'xauth-psk' to 'delete' for rt_kind 'unrouted'
  1708. Jan 27 09:12:11: | route owner of "xauth-psk"[498] bbb.ccc.ddd.eee unrouted: NULL
  1709. Jan 27 09:12:11: | command executing unroute-client
  1710. Jan 27 09:12:11: | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='xauth-psk' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='ddd.eee.fff.ggg' PLUTO_ME='ccc.ddd.eee.fff' PLUTO_MY_ID='ccc.ddd.eee.fff' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='bbb.ccc.ddd.eee' PLUTO_PEER_ID='fff.ggg.hhh.iii' PLUTO_PEER_CLIENT='eee.fff.ggg.iii/32' PLUTO_PEER_CLIENT_NET='eee.fff.ggg.iii' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM_CONFIGURED='0' ipsec _updown 2>&1
  1711. Jan 27 09:12:11: | popen cmd is 913 chars long
  1712. Jan 27 09:12:11: | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='xauth-psk' PLU:
  1713. Jan 27 09:12:11: | cmd( 80):TO_INTERFACE='eth0' PLUTO_NEXT_HOP='ddd.eee.fff.ggg' PLUTO_ME='ccc.ddd.eee.fff' PLUTO_:
  1714. Jan 27 09:12:11: | cmd( 160):MY_ID='ccc.ddd.eee.fff' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' :
  1715. Jan 27 09:12:11: | cmd( 240):PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_:
  1716. Jan 27 09:12:11: | cmd( 320):REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='bbb.ccc.ddd.eee' PLUTO_PEER_ID='1:
  1717. Jan 27 09:12:11: | cmd( 400):0.0.0.3' PLUTO_PEER_CLIENT='eee.fff.ggg.iii/32' PLUTO_PEER_CLIENT_NET='eee.fff.ggg.:
  1718. Jan 27 09:12:11: | cmd( 480):iii' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROT:
  1719. Jan 27 09:12:11: | cmd( 560):OCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLI:
  1720. Jan 27 09:12:11: | cmd( 640):CY='PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE:
  1721. Jan 27 09:12:11: | cmd( 720):_FRAG_ALLOW' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0':
  1722. Jan 27 09:12:11: | cmd( 800): PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM_:
  1723. Jan 27 09:12:11: | cmd( 880):CONFIGURED='0' ipsec _updown 2>&1:
  1724. Jan 27 09:12:11: | delete esp.95d908c@bbb.ccc.ddd.eee
  1725. Jan 27 09:12:11: | delete inbound eroute eee.fff.ggg.iii/32:0 --0-> 0.0.0.0/0:0 => unk255.10000@ccc.ddd.eee.fff (raw_eroute)
  1726. Jan 27 09:12:11: | raw_eroute result=success
  1727. Jan 27 09:12:11: | delete esp.49a6cba6@ccc.ddd.eee.fff
  1728. Jan 27 09:12:11: | child state #532: STATE_QUICK_R2(authenticated-ipsec) > STATE_UNDEFINED(ignore)
  1729. Jan 27 09:12:11: | ignore states: 0
  1730. Jan 27 09:12:11: | half-open-ike states: 0
  1731. Jan 27 09:12:11: | open-ike states: 0
  1732. Jan 27 09:12:11: | established-anonymous-ike states: 0
  1733. Jan 27 09:12:11: | established-authenticated-ike states: 2
  1734. Jan 27 09:12:11: | anonymous-ipsec states: 0
  1735. Jan 27 09:12:11: | authenticated-ipsec states: 2
  1736. Jan 27 09:12:11: | informational states: 0
  1737. Jan 27 09:12:11: | unknown states: 0
  1738. Jan 27 09:12:11: | category states: 4 count states: 4
  1739. Jan 27 09:12:11: | st->st_skeyseed_nss: free key 0x7f410f6d1190
  1740. Jan 27 09:12:11: | st->st_skey_d_nss: free key 0x7f410f6c6d10
  1741. Jan 27 09:12:11: | st->st_skey_ai_nss: free key 0x7f410f64e8b0
  1742. Jan 27 09:12:11: | st->st_skey_ar_nss: free key NULL
  1743. Jan 27 09:12:11: | st->st_skey_ei_nss: free key 0x7f410f6db630
  1744. Jan 27 09:12:11: | st->st_skey_er_nss: free key NULL
  1745. Jan 27 09:12:11: | st->st_skey_pi_nss: free key NULL
  1746. Jan 27 09:12:11: | st->st_skey_pr_nss: free key NULL
  1747. Jan 27 09:12:11: | st->st_enc_key_nss: free key 0x7f410f6b6930
  1748. Jan 27 09:12:11: | del:
  1749. Jan 27 09:12:11: "xauth-psk"[498] bbb.ccc.ddd.eee #531: received and ignored empty informational notification payload
  1750. Jan 27 09:12:11: | complete v1 state transition with STF_IGNORE
  1751. Jan 27 09:12:11: | *received 108 bytes from bbb.ccc.ddd.eee:4500 on eth0 (port=4500)
  1752. Jan 27 09:12:11: | 14 24 85 61 42 b2 d3 dc 03 c4 02 58 f8 bb 64 0c
  1753. Jan 27 09:12:11: | 08 10 05 01 83 ea 0c e6 00 00 00 6c e3 ae 14 e0
  1754. Jan 27 09:12:11: | e1 c0 ee 4a 20 48 03 2d 7d a9 b9 65 05 79 4c 20
  1755. Jan 27 09:12:11: | 19 51 8a 95 c4 69 4f 40 56 96 b9 ad 70 bd 69 84
  1756. Jan 27 09:12:11: | 7c c7 5b e8 b2 9a 3b 8e f5 3f e0 c6 71 e2 03 f2
  1757. Jan 27 09:12:11: | 81 e9 15 47 19 42 19 cd 96 4d 9f 57 6c 80 e1 84
  1758. Jan 27 09:12:11: | 3d 72 0c 56 90 26 14 16 9c 71 17 6b
  1759. Jan 27 09:12:11: | **parse ISAKMP Message:
  1760. Jan 27 09:12:11: | initiator cookie:
  1761. Jan 27 09:12:11: | 14 24 85 61 42 b2 d3 dc
  1762. Jan 27 09:12:11: | responder cookie:
  1763. Jan 27 09:12:11: | 03 c4 02 58 f8 bb 64 0c
  1764. Jan 27 09:12:11: | next payload type: ISAKMP_NEXT_HASH (0x8)
  1765. Jan 27 09:12:11: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  1766. Jan 27 09:12:11: | exchange type: ISAKMP_XCHG_INFO (0x5)
  1767. Jan 27 09:12:11: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  1768. Jan 27 09:12:11: | message ID: 83 ea 0c e6
  1769. Jan 27 09:12:11: | length: 108 (0x6c)
  1770. Jan 27 09:12:11: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5)
  1771. Jan 27 09:12:11: | finding hash chain in state hash table
  1772. Jan 27 09:12:11: | ICOOKIE: 14 24 85 61 42 b2 d3 dc
  1773. Jan 27 09:12:11: | RCOOKIE: 03 c4 02 58 f8 bb 64 0c
  1774. Jan 27 09:12:11: | found hash chain 15
  1775. Jan 27 09:12:11: | peer and cookies match on #531; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000
  1776. Jan 27 09:12:11: | p15 state object #531 found, in STATE_MODE_CFG_R1
  1777. Jan 27 09:12:11: | processing connection "xauth-psk"[498] bbb.ccc.ddd.eee
  1778. Jan 27 09:12:11: | last Phase 1 IV: 23 0b ee 0e 81 e6 03 ae bd 6f c8 9c 95 9f e2 2f
  1779. Jan 27 09:12:11: | current Phase 1 IV: 30 e6 33 60 c4 f7 23 f4 47 cd ad 16 04 c0 3d 81
  1780. Jan 27 09:12:11: | computed Phase 2 IV:
  1781. Jan 27 09:12:11: | 17 0e 4c be 6b 88 ec bb 05 d3 95 ed 6a b5 d7 d7
  1782. Jan 27 09:12:11: | 33 16 01 08 0b c8 ac e9 81 86 0f e5 77 67 11 5a
  1783. Jan 27 09:12:11: | #531 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  1784. .
  1785. .
  1786. .
  1787. Jan 27 09:12:29: | processing connection "xauth-psk"[500] bbb.ccc.ddd.eee
  1788. Jan 27 09:12:29: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1789. Jan 27 09:12:29: | processing connection "xauth-psk"[500] bbb.ccc.ddd.eee
  1790. Jan 27 09:12:29: | ka_event: send NAT-KA to bbb.ccc.ddd.eee:4500 (state=#538)
  1791. Jan 27 09:12:29: | sending NAT-T Keep Alive
  1792. Jan 27 09:12:29: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to bbb.ccc.ddd.eee:4500 (using #538)
  1793. Jan 27 09:12:29: | ff
  1794. Jan 27 09:12:29: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1795. Jan 27 09:12:29: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1796. Jan 27 09:12:29: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1797. Jan 27 09:12:29: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1798. Jan 27 09:12:29: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1799. Jan 27 09:12:29: | ka_event: send NAT-KA to aaa.bbb.ccc.ddd:4500 (state=#537)
  1800. Jan 27 09:12:29: | sending NAT-T Keep Alive
  1801. Jan 27 09:12:29: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #537)
  1802. Jan 27 09:12:29: | ff
  1803. Jan 27 09:12:29: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1804. Jan 27 09:12:29: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1805. Jan 27 09:12:29: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1806. Jan 27 09:12:29: | ka_event: send NAT-KA to aaa.bbb.ccc.ddd:4500 (state=#536)
  1807. Jan 27 09:12:29: | sending NAT-T Keep Alive
  1808. Jan 27 09:12:29: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #536)
  1809. Jan 27 09:12:29: | ff
  1810. Jan 27 09:12:29: | event_schedule called for 20 seconds
  1811. Jan 27 09:12:29: | event_schedule_tv called for about 20 seconds and change
  1812. Jan 27 09:12:29: | inserting event EVENT_NAT_T_KEEPALIVE, timeout in 20.000000 seconds
  1813. Jan 27 09:12:30: | *received 108 bytes from aaa.bbb.ccc.ddd:4500 on eth0 (port=4500)
  1814. Jan 27 09:12:30: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  1815. Jan 27 09:12:30: | 08 10 05 01 16 87 b2 7b 00 00 00 6c 88 4a 14 3a
  1816. Jan 27 09:12:30: | c9 75 8c c6 d3 6e a6 e6 0b 79 a9 40 cf 2b 84 e0
  1817. Jan 27 09:12:30: | bd 6a bd 18 1b b4 1e 5d eb 33 7d 72 72 bc 91 33
  1818. Jan 27 09:12:30: | e5 f3 e3 c5 76 5f f2 8d f2 6f 10 03 4c 3b 51 71
  1819. Jan 27 09:12:30: | a1 16 52 28 cc 16 91 5d 67 64 30 4b 41 18 cf b4
  1820. Jan 27 09:12:30: | 9c f4 4b 34 20 34 0d 58 44 a1 da 56
  1821. Jan 27 09:12:30: | **parse ISAKMP Message:
  1822. Jan 27 09:12:30: | initiator cookie:
  1823. Jan 27 09:12:30: | a2 7e 66 da e6 0b 70 e8
  1824. Jan 27 09:12:30: | responder cookie:
  1825. Jan 27 09:12:30: | db da 2a c5 c8 03 d1 6d
  1826. Jan 27 09:12:30: | next payload type: ISAKMP_NEXT_HASH (0x8)
  1827. Jan 27 09:12:30: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  1828. Jan 27 09:12:30: | exchange type: ISAKMP_XCHG_INFO (0x5)
  1829. Jan 27 09:12:30: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  1830. Jan 27 09:12:30: | message ID: 16 87 b2 7b
  1831. Jan 27 09:12:30: | length: 108 (0x6c)
  1832. Jan 27 09:12:30: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5)
  1833. Jan 27 09:12:30: | finding hash chain in state hash table
  1834. Jan 27 09:12:30: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  1835. Jan 27 09:12:30: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  1836. Jan 27 09:12:30: | found hash chain 14
  1837. Jan 27 09:12:30: | peer and cookies match on #537; msgid=00000000 st_msgid=b26dde8a st_msgid_phase15=00000000
  1838. Jan 27 09:12:30: | peer and cookies match on #536; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000
  1839. Jan 27 09:12:30: | p15 state object #536 found, in STATE_MODE_CFG_R1
  1840. Jan 27 09:12:30: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1841. Jan 27 09:12:30: | last Phase 1 IV: 22 29 4e e5 e5 04 a4 d2 db 3f e3 e2 17 ef 14 c0
  1842. Jan 27 09:12:30: | current Phase 1 IV: a5 f9 09 88 45 a4 1a d6 a7 9b 4a 1d dc f2 b9 34
  1843. Jan 27 09:12:30: | computed Phase 2 IV:
  1844. Jan 27 09:12:30: | f7 2b 2b 7a 58 fa 90 2d aa cb 62 48 b8 c1 fd 41
  1845. Jan 27 09:12:30: | bf 09 a5 45 5b de f8 6a 88 58 d8 e6 cc d1 27 4a
  1846. Jan 27 09:12:30: | #536 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  1847. Jan 27 09:12:30: | received encrypted packet from aaa.bbb.ccc.ddd:4500
  1848. Jan 27 09:12:30: | decrypting 80 bytes using algorithm OAKLEY_AES_CBC
  1849. Jan 27 09:12:30: | NSS ike_alg_nss_cbc: aes - enter
  1850. Jan 27 09:12:30: | NSS ike_alg_nss_cbc: aes - exit
  1851. Jan 27 09:12:30: | decrypted:
  1852. Jan 27 09:12:30: | 0b 00 00 24 40 78 ab a6 73 66 a6 cb 26 92 19 fa
  1853. Jan 27 09:12:30: | 31 c6 86 96 74 87 30 3b cd e9 a3 7e a2 b4 92 f3
  1854. Jan 27 09:12:30: | ac 64 31 ab 00 00 00 20 00 00 00 01 01 10 8d 28
  1855. Jan 27 09:12:30: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  1856. Jan 27 09:12:30: | 00 00 01 75 00 00 00 00 00 00 00 00 00 00 00 0c
  1857. Jan 27 09:12:30: | next IV: 41 18 cf b4 9c f4 4b 34 20 34 0d 58 44 a1 da 56
  1858. Jan 27 09:12:30: | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100opt: 0x0
  1859. Jan 27 09:12:30: | ***parse ISAKMP Hash Payload:
  1860. Jan 27 09:12:30: | next payload type: ISAKMP_NEXT_N (0xb)
  1861. Jan 27 09:12:30: | length: 36 (0x24)
  1862. Jan 27 09:12:30: | got payload 0x800 (ISAKMP_NEXT_N) needed: 0x0opt: 0x0
  1863. Jan 27 09:12:30: | ***parse ISAKMP Notification Payload:
  1864. Jan 27 09:12:30: | next payload type: ISAKMP_NEXT_NONE (0x0)
  1865. Jan 27 09:12:30: | length: 32 (0x20)
  1866. Jan 27 09:12:30: | DOI: ISAKMP_DOI_IPSEC (0x1)
  1867. Jan 27 09:12:30: | protocol ID: 1 (0x1)
  1868. Jan 27 09:12:30: | SPI size: 16 (0x10)
  1869. Jan 27 09:12:30: | Notify Message Type: R_U_THERE (0x8d28)
  1870. Jan 27 09:12:30: | removing 12 bytes of padding
  1871. Jan 27 09:12:30: | info: a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  1872. Jan 27 09:12:30: | info: 00 00 01 75
  1873. Jan 27 09:12:30: | processing informational R_U_THERE (36136)
  1874. Jan 27 09:12:30: | DPD: received R_U_THERE seq:373 monotime:1485508350 (state=#536 name="xauth-psk")
  1875. Jan 27 09:12:30: | **emit ISAKMP Message:
  1876. Jan 27 09:12:30: | initiator cookie:
  1877. Jan 27 09:12:30: | a2 7e 66 da e6 0b 70 e8
  1878. Jan 27 09:12:30: | responder cookie:
  1879. Jan 27 09:12:30: | db da 2a c5 c8 03 d1 6d
  1880. Jan 27 09:12:30: | next payload type: ISAKMP_NEXT_HASH (0x8)
  1881. Jan 27 09:12:30: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  1882. Jan 27 09:12:30: | exchange type: ISAKMP_XCHG_INFO (0x5)
  1883. Jan 27 09:12:30: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  1884. Jan 27 09:12:30: | message ID: 66 d6 60 0e
  1885. Jan 27 09:12:30: | ***emit ISAKMP Hash Payload:
  1886. Jan 27 09:12:30: | next payload type: ISAKMP_NEXT_N (0xb)
  1887. Jan 27 09:12:30: | emitting 32 zero bytes of HASH into ISAKMP Hash Payload
  1888. Jan 27 09:12:30: | emitting length of ISAKMP Hash Payload: 36
  1889. Jan 27 09:12:30: | ***emit ISAKMP Notification Payload:
  1890. Jan 27 09:12:30: | next payload type: ISAKMP_NEXT_NONE (0x0)
  1891. Jan 27 09:12:30: | DOI: ISAKMP_DOI_IPSEC (0x1)
  1892. Jan 27 09:12:30: | protocol ID: 1 (0x1)
  1893. Jan 27 09:12:30: | SPI size: 16 (0x10)
  1894. Jan 27 09:12:30: | Notify Message Type: R_U_THERE_ACK (0x8d29)
  1895. Jan 27 09:12:30: | emitting 8 raw bytes of notify icookie into ISAKMP Notification Payload
  1896. Jan 27 09:12:30: | notify icookie a2 7e 66 da e6 0b 70 e8
  1897. Jan 27 09:12:30: | emitting 8 raw bytes of notify rcookie into ISAKMP Notification Payload
  1898. Jan 27 09:12:30: | notify rcookie db da 2a c5 c8 03 d1 6d
  1899. Jan 27 09:12:30: | emitting 4 raw bytes of notify data into ISAKMP Notification Payload
  1900. Jan 27 09:12:30: | notify data 00 00 01 75
  1901. Jan 27 09:12:30: | emitting length of ISAKMP Notification Payload: 32
  1902. Jan 27 09:12:30: | hmac prf: init 0x7f410f5d4910
  1903. Jan 27 09:12:30: | hmac prf: init symkey symkey 0x7f410f6e4c80 (length 32)
  1904. Jan 27 09:12:30: | hmac prf: update
  1905. .
  1906. .
  1907. .
  1908. Jan 27 09:31:10: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1909. Jan 27 09:31:10: | processing connection "xauth-psk"[508] bbb.ccc.ddd.eee
  1910. Jan 27 09:31:10: | ka_event: send NAT-KA to bbb.ccc.ddd.eee:4500 (state=#546)
  1911. Jan 27 09:31:10: | sending NAT-T Keep Alive
  1912. Jan 27 09:31:10: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to bbb.ccc.ddd.eee:4500 (using #546)
  1913. Jan 27 09:31:10: | ff
  1914. Jan 27 09:31:10: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1915. Jan 27 09:31:10: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1916. Jan 27 09:31:10: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1917. Jan 27 09:31:10: | ka_event: send NAT-KA to aaa.bbb.ccc.ddd:4500 (state=#537)
  1918. Jan 27 09:31:10: | sending NAT-T Keep Alive
  1919. Jan 27 09:31:10: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #537)
  1920. Jan 27 09:31:10: | ff
  1921. Jan 27 09:31:10: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1922. Jan 27 09:31:10: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1923. Jan 27 09:31:10: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1924. Jan 27 09:31:10: | ka_event: send NAT-KA to aaa.bbb.ccc.ddd:4500 (state=#536)
  1925. Jan 27 09:31:10: | sending NAT-T Keep Alive
  1926. Jan 27 09:31:10: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #536)
  1927. Jan 27 09:31:10: | ff
  1928. Jan 27 09:31:10: | event_schedule called for 20 seconds
  1929. Jan 27 09:31:10: | event_schedule_tv called for about 20 seconds and change
  1930. Jan 27 09:31:10: | inserting event EVENT_NAT_T_KEEPALIVE, timeout in 20.000000 seconds
  1931. Jan 27 09:31:30: | handling event EVENT_SHUNT_SCAN
  1932. Jan 27 09:31:30: | expiring aged bare shunts
  1933. Jan 27 09:31:30: | event_schedule called for 20 seconds
  1934. Jan 27 09:31:30: | event_schedule_tv called for about 20 seconds and change
  1935. Jan 27 09:31:30: | inserting event EVENT_SHUNT_SCAN, timeout in 20.000000 seconds
  1936. Jan 27 09:31:30: | handling event EVENT_NAT_T_KEEPALIVE
  1937. Jan 27 09:31:30: | processing connection "xauth-psk"[508] bbb.ccc.ddd.eee
  1938. Jan 27 09:31:30: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1939. Jan 27 09:31:30: | processing connection "xauth-psk"[508] bbb.ccc.ddd.eee
  1940. Jan 27 09:31:30: | ka_event: send NAT-KA to bbb.ccc.ddd.eee:4500 (state=#547)
  1941. Jan 27 09:31:30: | sending NAT-T Keep Alive
  1942. Jan 27 09:31:30: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to bbb.ccc.ddd.eee:4500 (using #547)
  1943. Jan 27 09:31:30: | ff
  1944. Jan 27 09:31:30: | processing connection "xauth-psk"[508] bbb.ccc.ddd.eee
  1945. Jan 27 09:31:30: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1946. Jan 27 09:31:30: | processing connection "xauth-psk"[508] bbb.ccc.ddd.eee
  1947. Jan 27 09:31:30: | ka_event: send NAT-KA to bbb.ccc.ddd.eee:4500 (state=#546)
  1948. Jan 27 09:31:30: | sending NAT-T Keep Alive
  1949. Jan 27 09:31:30: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to bbb.ccc.ddd.eee:4500 (using #546)
  1950. Jan 27 09:31:30: | ff
  1951. Jan 27 09:31:30: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1952. Jan 27 09:31:30: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1953. Jan 27 09:31:30: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1954. Jan 27 09:31:30: | ka_event: send NAT-KA to aaa.bbb.ccc.ddd:4500 (state=#537)
  1955. Jan 27 09:31:30: | sending NAT-T Keep Alive
  1956. Jan 27 09:31:30: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #537)
  1957. Jan 27 09:31:30: | ff
  1958. Jan 27 09:31:30: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1959. Jan 27 09:31:30: | Sending of NAT-T KEEP-ALIVE enabled by per-conn configuration (nat_keepalive=yes)
  1960. Jan 27 09:31:30: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  1961. Jan 27 09:31:30: | ka_event: send NAT-KA to aaa.bbb.ccc.ddd:4500 (state=#536)
  1962. Jan 27 09:31:30: | sending NAT-T Keep Alive
  1963. Jan 27 09:31:30: | sending 1 bytes for NAT-T Keep Alive through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #536)
  1964. Jan 27 09:31:30: | ff
  1965. Jan 27 09:31:30: | event_schedule called for 20 seconds
  1966. Jan 27 09:31:30: | event_schedule_tv called for about 20 seconds and change
  1967. Jan 27 09:31:30: | inserting event EVENT_NAT_T_KEEPALIVE, timeout in 20.000000 seconds
  1968. Jan 27 09:31:42: | handling event EVENT_PENDING_PHASE2
  1969. Jan 27 09:31:42: | event_schedule called for 120 seconds
  1970. Jan 27 09:31:42: | event_schedule_tv called for about 120 seconds and change
  1971. Jan 27 09:31:42: | inserting event EVENT_PENDING_PHASE2, timeout in 120.000000 seconds
  1972. Jan 27 09:31:42: | pending review: connection "xauth-psk" was not up, skipped
  1973. Jan 27 09:31:42: | pending review: connection "xauth-psk" was not up, skipped
  1974. Jan 27 09:31:42: | pending review: connection "xauth-psk" was not up, skipped
  1975. Jan 27 09:31:43: | handling event EVENT_PENDING_DDNS
  1976. Jan 27 09:31:43: | event_schedule called for 60 seconds
  1977. Jan 27 09:31:43: | event_schedule_tv called for about 60 seconds and change
  1978. Jan 27 09:31:43: | inserting event EVENT_PENDING_DDNS, timeout in 60.000000 seconds
  1979. Jan 27 09:31:43: | elapsed time in connection_check_ddns for hostname lookup 0.000000
  1980. Jan 27 09:31:45: | *received 92 bytes from aaa.bbb.ccc.ddd:4500 on eth0 (port=4500)
  1981. Jan 27 09:31:45: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  1982. Jan 27 09:31:45: | 08 10 05 01 82 be c8 3e 00 00 00 5c 0f 7e 27 59
  1983. Jan 27 09:31:45: | 0c 30 a0 cf 35 58 51 92 4e 92 d5 18 7c 84 5f 98
  1984. Jan 27 09:31:45: | d8 15 34 df b5 f2 c8 ba f2 0d 50 de 61 5e b0 ec
  1985. Jan 27 09:31:45: | d7 70 79 ac 43 e9 f3 fc 74 89 af 7f bc 3d eb cd
  1986. Jan 27 09:31:45: | 46 78 7e 78 ba 0e d4 77 cb 28 30 7e
  1987. Jan 27 09:31:45: | **parse ISAKMP Message:
  1988. Jan 27 09:31:45: | initiator cookie:
  1989. Jan 27 09:31:45: | a2 7e 66 da e6 0b 70 e8
  1990. Jan 27 09:31:45: | responder cookie:
  1991. Jan 27 09:31:45: | db da 2a c5 c8 03 d1 6d
  1992. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_HASH (0x8)
  1993. Jan 27 09:31:45: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  1994. Jan 27 09:31:45: | exchange type: ISAKMP_XCHG_INFO (0x5)
  1995. Jan 27 09:31:45: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  1996. Jan 27 09:31:45: | message ID: 82 be c8 3e
  1997. Jan 27 09:31:45: | length: 92 (0x5c)
  1998. Jan 27 09:31:45: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5)
  1999. Jan 27 09:31:45: | finding hash chain in state hash table
  2000. Jan 27 09:31:45: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  2001. Jan 27 09:31:45: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  2002. Jan 27 09:31:45: | found hash chain 14
  2003. Jan 27 09:31:45: | peer and cookies match on #537; msgid=00000000 st_msgid=b26dde8a st_msgid_phase15=00000000
  2004. Jan 27 09:31:45: | peer and cookies match on #536; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000
  2005. Jan 27 09:31:45: | p15 state object #536 found, in STATE_MODE_CFG_R1
  2006. Jan 27 09:31:45: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  2007. Jan 27 09:31:45: | last Phase 1 IV: 22 29 4e e5 e5 04 a4 d2 db 3f e3 e2 17 ef 14 c0
  2008. Jan 27 09:31:45: | current Phase 1 IV: a5 f9 09 88 45 a4 1a d6 a7 9b 4a 1d dc f2 b9 34
  2009. Jan 27 09:31:45: | computed Phase 2 IV:
  2010. Jan 27 09:31:45: | 03 91 ec a9 cd 8f 08 62 90 9e 91 66 1a 91 b8 90
  2011. Jan 27 09:31:45: | 59 7f ef 92 c6 af 3d 34 ad 58 9e bd 22 83 64 4b
  2012. Jan 27 09:31:45: | #536 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  2013. Jan 27 09:31:45: | received encrypted packet from aaa.bbb.ccc.ddd:4500
  2014. Jan 27 09:31:45: | decrypting 64 bytes using algorithm OAKLEY_AES_CBC
  2015. Jan 27 09:31:45: | NSS ike_alg_nss_cbc: aes - enter
  2016. Jan 27 09:31:45: | NSS ike_alg_nss_cbc: aes - exit
  2017. Jan 27 09:31:45: | decrypted:
  2018. Jan 27 09:31:45: | 0c 00 00 24 28 a2 1e be f4 87 76 c0 34 25 bf 67
  2019. Jan 27 09:31:45: | 05 ac 11 67 ff 72 68 1d 63 f4 38 6a 5e 67 f9 07
  2020. Jan 27 09:31:45: | dd 42 42 1a 00 00 00 10 00 00 00 01 03 04 00 01
  2021. Jan 27 09:31:45: | 03 fb 8b a5 00 00 00 00 00 00 00 00 00 00 00 0c
  2022. Jan 27 09:31:45: | next IV: bc 3d eb cd 46 78 7e 78 ba 0e d4 77 cb 28 30 7e
  2023. Jan 27 09:31:45: | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100opt: 0x0
  2024. Jan 27 09:31:45: | ***parse ISAKMP Hash Payload:
  2025. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_D (0xc)
  2026. Jan 27 09:31:45: | length: 36 (0x24)
  2027. Jan 27 09:31:45: | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0opt: 0x0
  2028. Jan 27 09:31:45: | ***parse ISAKMP Delete Payload:
  2029. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_NONE (0x0)
  2030. Jan 27 09:31:45: | length: 16 (0x10)
  2031. Jan 27 09:31:45: | DOI: ISAKMP_DOI_IPSEC (0x1)
  2032. Jan 27 09:31:45: | protocol ID: 3 (0x3)
  2033. Jan 27 09:31:45: | SPI size: 4 (0x4)
  2034. Jan 27 09:31:45: | number of SPIs: 1 (0x1)
  2035. Jan 27 09:31:45: | removing 12 bytes of padding
  2036. Jan 27 09:31:45: | parsing 4 raw bytes of ISAKMP Delete Payload into SPI
  2037. Jan 27 09:31:45: | SPI 03 fb 8b a5
  2038. Jan 27 09:31:45: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  2039. Jan 27 09:31:45: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: received Delete SA(0x03fb8ba5) payload: deleting IPSEC State #537
  2040. Jan 27 09:31:45: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: deleting state #537 (STATE_QUICK_R2)
  2041. Jan 27 09:31:45: | child state #537: STATE_QUICK_R2(authenticated-ipsec) > delete
  2042. Jan 27 09:31:45: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: ESP traffic information: in=0B out=0B XAUTHuser=user1
  2043. Jan 27 09:31:45: | **emit ISAKMP Message:
  2044. Jan 27 09:31:45: | initiator cookie:
  2045. Jan 27 09:31:45: | a2 7e 66 da e6 0b 70 e8
  2046. Jan 27 09:31:45: | responder cookie:
  2047. Jan 27 09:31:45: | db da 2a c5 c8 03 d1 6d
  2048. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_HASH (0x8)
  2049. Jan 27 09:31:45: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  2050. Jan 27 09:31:45: | exchange type: ISAKMP_XCHG_INFO (0x5)
  2051. Jan 27 09:31:45: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  2052. Jan 27 09:31:45: | message ID: 72 9d 4a 60
  2053. Jan 27 09:31:45: | ***emit ISAKMP Hash Payload:
  2054. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_D (0xc)
  2055. Jan 27 09:31:45: | emitting 32 zero bytes of HASH(1) into ISAKMP Hash Payload
  2056. Jan 27 09:31:45: | emitting length of ISAKMP Hash Payload: 36
  2057. Jan 27 09:31:45: | ***emit ISAKMP Delete Payload:
  2058. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_NONE (0x0)
  2059. Jan 27 09:31:45: | DOI: ISAKMP_DOI_IPSEC (0x1)
  2060. Jan 27 09:31:45: | protocol ID: 3 (0x3)
  2061. Jan 27 09:31:45: | SPI size: 4 (0x4)
  2062. Jan 27 09:31:45: | number of SPIs: 1 (0x1)
  2063. Jan 27 09:31:45: | emitting 4 raw bytes of delete payload into ISAKMP Delete Payload
  2064. Jan 27 09:31:45: | delete payload b8 5c ae 98
  2065. Jan 27 09:31:45: | emitting length of ISAKMP Delete Payload: 16
  2066. Jan 27 09:31:45: | hmac prf: init 0x7f410f595500
  2067. Jan 27 09:31:45: | hmac prf: init symkey symkey 0x7f410f6e4c80 (length 32)
  2068. Jan 27 09:31:45: | hmac prf: update
  2069. Jan 27 09:31:45: | concat_symkey_bytes merge symkey(0x7f410f6e4c80) bytes(0x7f410f12e1c0/32) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  2070. Jan 27 09:31:45: | symkey: key(0x7f410f6e4c80) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  2071. Jan 27 09:31:45: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  2072. Jan 27 09:31:45: | bytes: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  2073. Jan 27 09:31:45: | concat_symkey_bytes key(0x7f410f6d1190) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2074. Jan 27 09:31:45: | xor_symkey_chunk merge symkey(0x7f410f6d1190) bytes(0x7ffda297d300/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  2075. Jan 27 09:31:45: | symkey: key(0x7f410f6d1190) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2076. Jan 27 09:31:45: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  2077. Jan 27 09:31:45: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  2078. Jan 27 09:31:45: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  2079. Jan 27 09:31:45: | bytes: 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36 36
  2080. Jan 27 09:31:45: | xor_symkey_chunk key(0x7f410f624b70) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  2081. Jan 27 09:31:45: | hmac prf: update bytes data 0x7ffda297d3ec (length 4)
  2082. Jan 27 09:31:45: | concat_symkey_bytes merge symkey(0x7f410f624b70) bytes(0x7ffda297d3ec/4) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  2083. Jan 27 09:31:45: | symkey: key(0x7f410f624b70) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  2084. Jan 27 09:31:45: | bytes: 72 9d 4a 60
  2085. Jan 27 09:31:45: | concat_symkey_bytes key(0x7f410f6d53c0) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2086. Jan 27 09:31:45: | append_symkey_bytes: free key 0x7f410f624b70
  2087. Jan 27 09:31:45: | hmac prf: update bytes data 0x7ffda297d5f0 (length 16)
  2088. Jan 27 09:31:45: | concat_symkey_bytes merge symkey(0x7f410f6d53c0) bytes(0x7ffda297d5f0/16) - derive(CONCATENATE_BASE_AND_DATA) target(SHA256_KEY_DERIVATION)
  2089. Jan 27 09:31:45: | symkey: key(0x7f410f6d53c0) length(68) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2090. Jan 27 09:31:45: | bytes: 00 00 00 10 00 00 00 01 03 04 00 01 b8 5c ae 98
  2091. Jan 27 09:31:45: | concat_symkey_bytes key(0x7f410f624b70) length(84) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2092. Jan 27 09:31:45: | append_symkey_bytes: free key 0x7f410f6d53c0
  2093. Jan 27 09:31:45: | hmac prf: final
  2094. Jan 27 09:31:45: | prf inner hash: hash(OAKLEY_SHA2_256) symkey(0x7f410f624b70) to symkey - derive(SHA256_KEY_DERIVATION)
  2095. Jan 27 09:31:45: | symkey: key(0x7f410f624b70) length(84) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2096. Jan 27 09:31:45: | prf inner hash: key(0x7f410f6d53c0) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  2097. Jan 27 09:31:45: | prf inner:: free key 0x7f410f624b70
  2098. Jan 27 09:31:45: | xor_symkey_chunk merge symkey(0x7f410f6d1190) bytes(0x7ffda297d2e0/64) - derive(XOR_BASE_AND_DATA) target(CONCATENATE_BASE_AND_DATA)
  2099. Jan 27 09:31:45: | symkey: key(0x7f410f6d1190) length(64) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2100. Jan 27 09:31:45: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  2101. Jan 27 09:31:45: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  2102. Jan 27 09:31:45: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  2103. Jan 27 09:31:45: | bytes: 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c
  2104. Jan 27 09:31:45: | xor_symkey_chunk key(0x7f410f624b70) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  2105. Jan 27 09:31:45: | concat: merge symkey(1: 0x7f410f624b70) symkey(2: 0x7f410f6d53c0) - derive(CONCATENATE_BASE_AND_KEY) target(SHA256_KEY_DERIVATION)
  2106. Jan 27 09:31:45: | symkey 1: key(0x7f410f624b70) length(64) type/mechanism(CONCATENATE_BASE_AND_DATA 0x00000362)
  2107. Jan 27 09:31:45: | symkey 2: key(0x7f410f6d53c0) length(32) type/mechanism(CONCATENATE_BASE_AND_KEY 0x00000360)
  2108. Jan 27 09:31:45: | concat: key(0x7f410f63b730) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2109. Jan 27 09:31:45: | append_symkey_symkey: free key 0x7f410f624b70
  2110. Jan 27 09:31:45: | prf hashed inner:: free key 0x7f410f6d53c0
  2111. Jan 27 09:31:45: | prf key: free key 0x7f410f6d1190
  2112. Jan 27 09:31:45: | prf outer hash hash(OAKLEY_SHA2_256) symkey(0x7f410f63b730) to bytes
  2113. Jan 27 09:31:45: | symkey: key(0x7f410f63b730) length(96) type/mechanism(SHA256_KEY_DERIVATION 0x00000393)
  2114. Jan 27 09:31:45: | prf outer hash 3a 53 89 0e a4 88 9a 10 72 39 91 c6 ba 82 2d 77
  2115. Jan 27 09:31:45: | prf outer hash 6f 62 cb 1d a5 ad d0 48 b7 d9 8d 61 79 69 e3 19
  2116. Jan 27 09:31:45: | prf outer: free key 0x7f410f63b730
  2117. Jan 27 09:31:45: | prf final bytes 3a 53 89 0e a4 88 9a 10 72 39 91 c6 ba 82 2d 77
  2118. Jan 27 09:31:45: | prf final bytes 6f 62 cb 1d a5 ad d0 48 b7 d9 8d 61 79 69 e3 19
  2119. Jan 27 09:31:45: | HASH(1) computed:
  2120. Jan 27 09:31:45: | 3a 53 89 0e a4 88 9a 10 72 39 91 c6 ba 82 2d 77
  2121. Jan 27 09:31:45: | 6f 62 cb 1d a5 ad d0 48 b7 d9 8d 61 79 69 e3 19
  2122. Jan 27 09:31:45: | last Phase 1 IV: 22 29 4e e5 e5 04 a4 d2 db 3f e3 e2 17 ef 14 c0
  2123. Jan 27 09:31:45: | current Phase 1 IV: a5 f9 09 88 45 a4 1a d6 a7 9b 4a 1d dc f2 b9 34
  2124. Jan 27 09:31:45: | computed Phase 2 IV:
  2125. Jan 27 09:31:45: | 29 d2 2f 45 c0 8d 66 1c 12 bb dd a5 8b 01 39 fc
  2126. Jan 27 09:31:45: | 15 f2 53 fe af 53 db 6f 36 8c c3 34 8c 3f f6 26
  2127. Jan 27 09:31:45: | encrypting: 0c 00 00 24 3a 53 89 0e a4 88 9a 10 72 39 91 c6
  2128. Jan 27 09:31:45: | encrypting: ba 82 2d 77 6f 62 cb 1d a5 ad d0 48 b7 d9 8d 61
  2129. Jan 27 09:31:45: | encrypting: 79 69 e3 19 00 00 00 10 00 00 00 01 03 04 00 01
  2130. Jan 27 09:31:45: | encrypting: b8 5c ae 98
  2131. Jan 27 09:31:45: | IV: 29 d2 2f 45 c0 8d 66 1c 12 bb dd a5 8b 01 39 fc
  2132. Jan 27 09:31:45: | IV: 15 f2 53 fe af 53 db 6f 36 8c c3 34 8c 3f f6 26
  2133. Jan 27 09:31:45: | unpadded size is: 52
  2134. Jan 27 09:31:45: | emitting 12 zero bytes of encryption padding into ISAKMP Message
  2135. Jan 27 09:31:45: | encrypting 64 using OAKLEY_AES_CBC
  2136. Jan 27 09:31:45: | NSS ike_alg_nss_cbc: aes - enter
  2137. Jan 27 09:31:45: | NSS ike_alg_nss_cbc: aes - exit
  2138. Jan 27 09:31:45: | next IV: 6e cb 7e 01 5b b2 00 84 ef 8a 80 ed 94 f8 79 82
  2139. Jan 27 09:31:45: | no IKEv1 message padding required
  2140. Jan 27 09:31:45: | emitting length of ISAKMP Message: 92
  2141. Jan 27 09:31:45: | sending 96 bytes for delete notify through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #536)
  2142. Jan 27 09:31:45: | 00 00 00 00 a2 7e 66 da e6 0b 70 e8 db da 2a c5
  2143. Jan 27 09:31:45: | c8 03 d1 6d 08 10 05 01 72 9d 4a 60 00 00 00 5c
  2144. Jan 27 09:31:45: | 1d 8a 91 70 d2 73 2e 52 47 c0 d3 02 e2 bd a9 3f
  2145. Jan 27 09:31:45: | 98 d8 4b 75 11 c0 94 3a b4 18 c7 fa a9 21 f7 e9
  2146. Jan 27 09:31:45: | b3 00 83 cb 60 53 bb 5e e5 49 78 e2 02 1a 3c 59
  2147. Jan 27 09:31:45: | 6e cb 7e 01 5b b2 00 84 ef 8a 80 ed 94 f8 79 82
  2148. Jan 27 09:31:45: | state: #537 requesting EVENT_SA_EXPIRE to be deleted
  2149. Jan 27 09:31:45: | unhashing state object #537
  2150. Jan 27 09:31:45: | removing state 0x7f410f6e9ad0 entry 0x7f410f6ea138 next 0x7f410f6e81a8 prev-next 0x7f410f1262b8 from list
  2151. Jan 27 09:31:45: | updated next state 0x7f410f6e7b40 entry 0x7f410f6e81a8 next (nil) prev-next 0x7f410f1262b8
  2152. Jan 27 09:31:45: | removing state 0x7f410f6e9ad0 entry 0x7f410f6ea150 next 0x7f410f6e81c0 prev-next 0x7f410f1263d0 from list
  2153. Jan 27 09:31:45: | updated next state 0x7f410f6e7b40 entry 0x7f410f6e81c0 next (nil) prev-next 0x7f410f1263d0
  2154. Jan 27 09:31:45: | command executing down-client
  2155. Jan 27 09:31:45: | get esp.3fb8ba5@aaa.bbb.ccc.ddd
  2156. Jan 27 09:31:45: | get esp.b85cae98@ccc.ddd.eee.fff
  2157. Jan 27 09:31:45: | executing down-client: PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='xauth-psk' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='ddd.eee.fff.ggg' PLUTO_ME='ccc.ddd.eee.fff' PLUTO_MY_ID='ccc.ddd.eee.fff' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='aaa.bbb.ccc.ddd' PLUTO_PEER_ID='192.168.1.10' PLUTO_PEER_CLIENT='10.231.247.22/32' PLUTO_PEER_CLIENT_NET='10.231.247.22' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1485508328' PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERNAME='user1' PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='2509' PLUTO_OUTBYTES='18250' ipsec _updown 2>&1
  2158. Jan 27 09:31:45: | popen cmd is 996 chars long
  2159. Jan 27 09:31:45: | cmd( 0):PLUTO_VERB='down-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='xauth-psk' PLUTO_:
  2160. Jan 27 09:31:45: | cmd( 80):INTERFACE='eth0' PLUTO_NEXT_HOP='ddd.eee.fff.ggg' PLUTO_ME='ccc.ddd.eee.fff' PLUTO_MY_:
  2161. Jan 27 09:31:45: | cmd( 160):ID='ccc.ddd.eee.fff' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLU:
  2162. Jan 27 09:31:45: | cmd( 240):TO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQ:
  2163. Jan 27 09:31:45: | cmd( 320):ID='16388' PLUTO_SA_TYPE='ESP' PLUTO_PEER='aaa.bbb.ccc.ddd' PLUTO_PEER_ID='192.168.:
  2164. Jan 27 09:31:45: | cmd( 400):1.10' PLUTO_PEER_CLIENT='10.231.247.22/32' PLUTO_PEER_CLIENT_NET='10.231.247.22':
  2165. Jan 27 09:31:45: | cmd( 480): PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCO:
  2166. Jan 27 09:31:45: | cmd( 560):L='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='1485508328' PLUTO_CON:
  2167. Jan 27 09:31:45: | cmd( 640):N_POLICY='PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRA:
  2168. Jan 27 09:31:45: | cmd( 720):CK+IKE_FRAG_ALLOW' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERN:
  2169. Jan 27 09:31:45: | cmd( 800):AME='user1' PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN:
  2170. Jan 27 09:31:45: | cmd( 880):_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM_CONFIGURED='0' PLUTO_INBYTES='2509' PLUTO:
  2171. Jan 27 09:31:45: | cmd( 960):_OUTBYTES='18250' ipsec _updown 2>&1:
  2172. Jan 27 09:31:45: | shunt_eroute() called for connection 'xauth-psk' to 'delete' for rt_kind 'unrouted'
  2173. Jan 27 09:31:45: | route owner of "xauth-psk"[232] aaa.bbb.ccc.ddd unrouted: NULL
  2174. Jan 27 09:31:45: | command executing unroute-client
  2175. Jan 27 09:31:45: | executing unroute-client: PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='xauth-psk' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='ddd.eee.fff.ggg' PLUTO_ME='ccc.ddd.eee.fff' PLUTO_MY_ID='ccc.ddd.eee.fff' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='aaa.bbb.ccc.ddd' PLUTO_PEER_ID='192.168.1.10' PLUTO_PEER_CLIENT='10.231.247.22/32' PLUTO_PEER_CLIENT_NET='10.231.247.22' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM_CONFIGURED='0' ipsec _updown 2>&1
  2176. Jan 27 09:31:45: | popen cmd is 914 chars long
  2177. Jan 27 09:31:45: | cmd( 0):PLUTO_VERB='unroute-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='xauth-psk' PLU:
  2178. Jan 27 09:31:45: | cmd( 80):TO_INTERFACE='eth0' PLUTO_NEXT_HOP='ddd.eee.fff.ggg' PLUTO_ME='ccc.ddd.eee.fff' PLUTO_:
  2179. Jan 27 09:31:45: | cmd( 160):MY_ID='ccc.ddd.eee.fff' PLUTO_MY_CLIENT='0.0.0.0/0' PLUTO_MY_CLIENT_NET='0.0.0.0' :
  2180. Jan 27 09:31:45: | cmd( 240):PLUTO_MY_CLIENT_MASK='0.0.0.0' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_:
  2181. Jan 27 09:31:45: | cmd( 320):REQID='16388' PLUTO_SA_TYPE='none' PLUTO_PEER='aaa.bbb.ccc.ddd' PLUTO_PEER_ID='192.:
  2182. Jan 27 09:31:45: | cmd( 400):168.1.10' PLUTO_PEER_CLIENT='10.231.247.22/32' PLUTO_PEER_CLIENT_NET='10.231.247:
  2183. Jan 27 09:31:45: | cmd( 480):.22' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PRO:
  2184. Jan 27 09:31:45: | cmd( 560):TOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey' PLUTO_ADDTIME='0' PLUTO_CONN_POL:
  2185. Jan 27 09:31:45: | cmd( 640):ICY='PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+IKEV1_ALLOW+SAREF_TRACK+IK:
  2186. Jan 27 09:31:45: | cmd( 720):E_FRAG_ALLOW' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_IS_PEER_CISCO='0:
  2187. Jan 27 09:31:45: | cmd( 800):' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM:
  2188. Jan 27 09:31:45: | cmd( 880):_CONFIGURED='0' ipsec _updown 2>&1:
  2189. Jan 27 09:31:45: | delete esp.3fb8ba5@aaa.bbb.ccc.ddd
  2190. Jan 27 09:31:45: | delete inbound eroute 10.231.247.22/32:0 --0-> 0.0.0.0/0:0 => unk255.10000@ccc.ddd.eee.fff (raw_eroute)
  2191. Jan 27 09:31:45: | raw_eroute result=success
  2192. Jan 27 09:31:45: | delete esp.b85cae98@ccc.ddd.eee.fff
  2193. Jan 27 09:31:45: | child state #537: STATE_QUICK_R2(authenticated-ipsec) > STATE_UNDEFINED(ignore)
  2194. Jan 27 09:31:45: | ignore states: 0
  2195. Jan 27 09:31:45: | half-open-ike states: 0
  2196. Jan 27 09:31:45: | open-ike states: 0
  2197. Jan 27 09:31:45: | established-anonymous-ike states: 0
  2198. Jan 27 09:31:45: | established-authenticated-ike states: 2
  2199. Jan 27 09:31:45: | anonymous-ipsec states: 0
  2200. Jan 27 09:31:45: | authenticated-ipsec states: 1
  2201. Jan 27 09:31:45: | informational states: 0
  2202. Jan 27 09:31:45: | unknown states: 0
  2203. Jan 27 09:31:45: | category states: 3 count states: 3
  2204. Jan 27 09:31:45: | st->st_skeyseed_nss: free key 0x7f410f6d7370
  2205. Jan 27 09:31:45: | st->st_skey_d_nss: free key 0x7f410f6da800
  2206. Jan 27 09:31:45: | st->st_skey_ai_nss: free key 0x7f410f6e4c80
  2207. Jan 27 09:31:45: | st->st_skey_ar_nss: free key NULL
  2208. Jan 27 09:31:45: | st->st_skey_ei_nss: free key 0x7f410f6c2a40
  2209. Jan 27 09:31:45: | st->st_skey_er_nss: free key NULL
  2210. Jan 27 09:31:45: | st->st_skey_pi_nss: free key NULL
  2211. Jan 27 09:31:45: | st->st_skey_pr_nss: free key NULL
  2212. Jan 27 09:31:45: | st->st_enc_key_nss: free key 0x7f410f6c2670
  2213. Jan 27 09:31:45: | del:
  2214. Jan 27 09:31:45: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: received and ignored empty informational notification payload
  2215. Jan 27 09:31:45: | complete v1 state transition with STF_IGNORE
  2216. Jan 27 09:31:45: | *received 108 bytes from aaa.bbb.ccc.ddd:4500 on eth0 (port=4500)
  2217. Jan 27 09:31:45: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  2218. Jan 27 09:31:45: | 08 10 05 01 ab 23 b8 2f 00 00 00 6c 61 d6 3b 94
  2219. Jan 27 09:31:45: | cc 0a ee 90 28 b0 ee a9 09 94 40 87 0c a0 f3 aa
  2220. Jan 27 09:31:45: | 4c e3 ee f4 9e a4 b6 70 6c 89 9d 0d ee 40 4e 5d
  2221. Jan 27 09:31:45: | 34 8e 17 62 bc 30 65 b8 cf ed 53 48 39 a1 9c b8
  2222. Jan 27 09:31:45: | c4 80 bd 9c 9f d3 1b d4 60 ba ca e3 40 d7 9d 42
  2223. Jan 27 09:31:45: | 49 a8 36 57 21 a5 90 cb 96 32 82 59
  2224. Jan 27 09:31:45: | **parse ISAKMP Message:
  2225. Jan 27 09:31:45: | initiator cookie:
  2226. Jan 27 09:31:45: | a2 7e 66 da e6 0b 70 e8
  2227. Jan 27 09:31:45: | responder cookie:
  2228. Jan 27 09:31:45: | db da 2a c5 c8 03 d1 6d
  2229. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_HASH (0x8)
  2230. Jan 27 09:31:45: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  2231. Jan 27 09:31:45: | exchange type: ISAKMP_XCHG_INFO (0x5)
  2232. Jan 27 09:31:45: | flags: ISAKMP_FLAG_v1_ENCRYPTION (0x1)
  2233. Jan 27 09:31:45: | message ID: ab 23 b8 2f
  2234. Jan 27 09:31:45: | length: 108 (0x6c)
  2235. Jan 27 09:31:45: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_INFO (5)
  2236. Jan 27 09:31:45: | finding hash chain in state hash table
  2237. Jan 27 09:31:45: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  2238. Jan 27 09:31:45: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  2239. Jan 27 09:31:45: | found hash chain 14
  2240. Jan 27 09:31:45: | peer and cookies match on #536; msgid=00000000 st_msgid=00000000 st_msgid_phase15=00000000
  2241. Jan 27 09:31:45: | p15 state object #536 found, in STATE_MODE_CFG_R1
  2242. Jan 27 09:31:45: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  2243. Jan 27 09:31:45: | last Phase 1 IV: 22 29 4e e5 e5 04 a4 d2 db 3f e3 e2 17 ef 14 c0
  2244. Jan 27 09:31:45: | current Phase 1 IV: a5 f9 09 88 45 a4 1a d6 a7 9b 4a 1d dc f2 b9 34
  2245. Jan 27 09:31:45: | computed Phase 2 IV:
  2246. Jan 27 09:31:45: | 25 05 00 d8 0a 67 f4 7d 8c 5c 3f 96 f4 85 d7 2f
  2247. Jan 27 09:31:45: | e0 a8 4f 85 db ba 62 84 29 46 94 3f 47 5e bb 53
  2248. Jan 27 09:31:45: | #536 state_busy:2221 st != NULL && st->st_calculating == FALSE;
  2249. Jan 27 09:31:45: | received encrypted packet from aaa.bbb.ccc.ddd:4500
  2250. Jan 27 09:31:45: | decrypting 80 bytes using algorithm OAKLEY_AES_CBC
  2251. Jan 27 09:31:45: | NSS ike_alg_nss_cbc: aes - enter
  2252. Jan 27 09:31:45: | NSS ike_alg_nss_cbc: aes - exit
  2253. Jan 27 09:31:45: | decrypted:
  2254. Jan 27 09:31:45: | 0c 00 00 24 90 35 c7 e8 fd cd 63 6c e9 10 17 76
  2255. Jan 27 09:31:45: | 37 4f 1e b5 b6 df 54 10 00 00 8d 5d 78 72 2b 8d
  2256. Jan 27 09:31:45: | 1f ce 1d 12 00 00 00 1c 00 00 00 01 01 10 00 01
  2257. Jan 27 09:31:45: | a2 7e 66 da e6 0b 70 e8 db da 2a c5 c8 03 d1 6d
  2258. Jan 27 09:31:45: | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10
  2259. Jan 27 09:31:45: | next IV: 40 d7 9d 42 49 a8 36 57 21 a5 90 cb 96 32 82 59
  2260. Jan 27 09:31:45: | got payload 0x100 (ISAKMP_NEXT_HASH) needed: 0x100opt: 0x0
  2261. Jan 27 09:31:45: | ***parse ISAKMP Hash Payload:
  2262. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_D (0xc)
  2263. Jan 27 09:31:45: | length: 36 (0x24)
  2264. Jan 27 09:31:45: | got payload 0x1000 (ISAKMP_NEXT_D) needed: 0x0opt: 0x0
  2265. Jan 27 09:31:45: | ***parse ISAKMP Delete Payload:
  2266. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_NONE (0x0)
  2267. Jan 27 09:31:45: | length: 28 (0x1c)
  2268. Jan 27 09:31:45: | DOI: ISAKMP_DOI_IPSEC (0x1)
  2269. Jan 27 09:31:45: | protocol ID: 1 (0x1)
  2270. Jan 27 09:31:45: | SPI size: 16 (0x10)
  2271. Jan 27 09:31:45: | number of SPIs: 1 (0x1)
  2272. Jan 27 09:31:45: | removing 16 bytes of padding
  2273. Jan 27 09:31:45: | parsing 8 raw bytes of ISAKMP Delete Payload into iCookie
  2274. Jan 27 09:31:45: | iCookie a2 7e 66 da e6 0b 70 e8
  2275. Jan 27 09:31:45: | parsing 8 raw bytes of ISAKMP Delete Payload into rCookie
  2276. Jan 27 09:31:45: | rCookie db da 2a c5 c8 03 d1 6d
  2277. Jan 27 09:31:45: | finding hash chain in state hash table
  2278. Jan 27 09:31:45: | ICOOKIE: a2 7e 66 da e6 0b 70 e8
  2279. Jan 27 09:31:45: | RCOOKIE: db da 2a c5 c8 03 d1 6d
  2280. Jan 27 09:31:45: | found hash chain 14
  2281. Jan 27 09:31:45: | v1 peer and cookies match on #536, provided msgid 00000000 == 00000000
  2282. Jan 27 09:31:45: | v1 state object #536 found, in STATE_MODE_CFG_R1
  2283. Jan 27 09:31:45: | del:
  2284. Jan 27 09:31:45: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: received Delete SA payload: self-deleting ISAKMP State #536
  2285. Jan 27 09:31:45: "xauth-psk"[232] aaa.bbb.ccc.ddd #536: deleting state #536 (STATE_MODE_CFG_R1)
  2286. .
  2287. .
  2288. .
  2289. Jan 27 09:31:45: | sending 96 bytes for delete notify through eth0:4500 to aaa.bbb.ccc.ddd:4500 (using #536)
  2290. Jan 27 09:31:45: | 00 00 00 00 a2 7e 66 da e6 0b 70 e8 db da 2a c5
  2291. Jan 27 09:31:45: | c8 03 d1 6d 08 10 05 01 66 f4 2f 50 00 00 00 5c
  2292. Jan 27 09:31:45: | 7e 96 03 17 4d 7c 7b e5 0f d8 6f 1d 09 93 f5 62
  2293. Jan 27 09:31:45: | 46 6e 10 ac ee ec 94 9e 4a 80 a3 ab fe 72 8a ac
  2294. Jan 27 09:31:45: | dc cd dd d9 9a 58 13 83 4f 5f 55 4c c7 2b 27 8f
  2295. Jan 27 09:31:45: | dd b2 fc 1e c5 37 1d fb 25 11 c1 0e db e7 8f 7a
  2296. Jan 27 09:31:45: | state: #536 requesting EVENT_SA_EXPIRE to be deleted
  2297. Jan 27 09:31:45: | unhashing state object #536
  2298. Jan 27 09:31:45: | removing state 0x7f410f6e7b40 entry 0x7f410f6e81a8 next (nil) prev-next 0x7f410f1262b8 from list
  2299. Jan 27 09:31:45: | updated next entry is (nil)
  2300. Jan 27 09:31:45: | removing state 0x7f410f6e7b40 entry 0x7f410f6e81c0 next (nil) prev-next 0x7f410f1263d0 from list
  2301. Jan 27 09:31:45: | updated next entry is (nil)
  2302. Jan 27 09:31:45: | processing connection "xauth-psk"[232] aaa.bbb.ccc.ddd
  2303. Jan 27 09:31:45: "xauth-psk"[232] aaa.bbb.ccc.ddd: deleting connection "xauth-psk" instance with peer aaa.bbb.ccc.ddd {isakmp=#0/ipsec=#0}
  2304. Jan 27 09:31:45: | addresspool free lease entry ptr 0x7f410f49b890 refcnt 0
  2305. Jan 27 09:31:45: | freed lease refcnt 0 10.231.247.22 from addresspool eee.fff.ggg.hhh-eee.fff.ggg.xxx index=12. pool size 245 used 12 lingering=0 address
  2306. Jan 27 09:31:45: | Deleting states for connection
  2307. Jan 27 09:31:45: | pass 0
  2308. Jan 27 09:31:45: | index 7 state #547
  2309. Jan 27 09:31:45: | index 7 state #546
  2310. Jan 27 09:31:45: | pass 1
  2311. Jan 27 09:31:45: | index 7 state #547
  2312. Jan 27 09:31:45: | index 7 state #546
  2313. Jan 27 09:31:45: | unreference addresspool of conn xauth-psk[232] kind CK_GOING_AWAY refcnt 512
  2314. Jan 27 09:31:45: | parent state #536: STATE_MODE_CFG_R1(established-authenticated-ike) > STATE_UNDEFINED(ignore)
  2315. Jan 27 09:31:45: | ignore states: 0
  2316. Jan 27 09:31:45: | half-open-ike states: 0
  2317. Jan 27 09:31:45: | open-ike states: 0
  2318. Jan 27 09:31:45: | established-anonymous-ike states: 0
  2319. Jan 27 09:31:45: | established-authenticated-ike states: 1
  2320. Jan 27 09:31:45: | anonymous-ipsec states: 0
  2321. Jan 27 09:31:45: | authenticated-ipsec states: 1
  2322. Jan 27 09:31:45: | informational states: 0
  2323. Jan 27 09:31:45: | unknown states: 0
  2324. Jan 27 09:31:45: | category states: 2 count states: 2
  2325. Jan 27 09:31:45: | st->st_skeyseed_nss: free key 0x7f410f6d7370
  2326. Jan 27 09:31:45: | st->st_skey_d_nss: free key 0x7f410f6da800
  2327. Jan 27 09:31:45: | st->st_skey_ai_nss: free key 0x7f410f6e4c80
  2328. Jan 27 09:31:45: | st->st_skey_ar_nss: free key NULL
  2329. Jan 27 09:31:45: | st->st_skey_ei_nss: free key 0x7f410f6c2a40
  2330. Jan 27 09:31:45: | st->st_skey_er_nss: free key NULL
  2331. Jan 27 09:31:45: | st->st_skey_pi_nss: free key NULL
  2332. Jan 27 09:31:45: | st->st_skey_pr_nss: free key NULL
  2333. Jan 27 09:31:45: | st->st_enc_key_nss: free key 0x7f410f6c2670
  2334. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:4500: received and ignored empty informational notification payload
  2335. Jan 27 09:31:45: | complete v1 state transition with STF_IGNORE
  2336. Jan 27 09:31:45: | *received 848 bytes from aaa.bbb.ccc.ddd:500 on eth0 (port=500)
  2337. Jan 27 09:31:45: | 2c 8a 42 6d 37 68 e4 35 00 00 00 00 00 00 00 00
  2338. Jan 27 09:31:45: | 01 10 02 00 00 00 00 00 00 00 03 50 0d 00 02 20
  2339. Jan 27 09:31:45: | 00 00 00 01 00 00 00 01 00 00 02 14 01 01 00 0f
  2340. Jan 27 09:31:45: | 03 00 00 24 01 01 00 00 80 0b 00 01 80 0c 0e 10
  2341. Jan 27 09:31:45: | 80 01 00 07 80 0e 01 00 80 03 fd e9 80 02 00 04
  2342. Jan 27 09:31:45: | 80 04 00 0e 03 00 00 24 02 01 00 00 80 0b 00 01
  2343. Jan 27 09:31:45: | 80 0c 0e 10 80 01 00 07 80 0e 01 00 80 03 fd e9
  2344. Jan 27 09:31:45: | 80 02 00 02 80 04 00 0e 03 00 00 24 03 01 00 00
  2345. Jan 27 09:31:45: | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 0e 01 00
  2346. Jan 27 09:31:45: | 80 03 fd e9 80 02 00 01 80 04 00 0e 03 00 00 24
  2347. Jan 27 09:31:45: | 04 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07
  2348. Jan 27 09:31:45: | 80 0e 01 00 80 03 fd e9 80 02 00 06 80 04 00 0e
  2349. Jan 27 09:31:45: | 03 00 00 24 05 01 00 00 80 0b 00 01 80 0c 0e 10
  2350. Jan 27 09:31:45: | 80 01 00 07 80 0e 01 00 80 03 fd e9 80 02 00 04
  2351. Jan 27 09:31:45: | 80 04 00 05 03 00 00 24 06 01 00 00 80 0b 00 01
  2352. Jan 27 09:31:45: | 80 0c 0e 10 80 01 00 07 80 0e 01 00 80 03 fd e9
  2353. Jan 27 09:31:45: | 80 02 00 02 80 04 00 05 03 00 00 24 07 01 00 00
  2354. Jan 27 09:31:45: | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 0e 01 00
  2355. Jan 27 09:31:45: | 80 03 fd e9 80 02 00 01 80 04 00 05 03 00 00 24
  2356. Jan 27 09:31:45: | 08 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 07
  2357. Jan 27 09:31:45: | 80 0e 01 00 80 03 fd e9 80 02 00 02 80 04 00 02
  2358. Jan 27 09:31:45: | 03 00 00 24 09 01 00 00 80 0b 00 01 80 0c 0e 10
  2359. Jan 27 09:31:45: | 80 01 00 07 80 0e 01 00 80 03 fd e9 80 02 00 01
  2360. Jan 27 09:31:45: | 80 04 00 02 03 00 00 24 0a 01 00 00 80 0b 00 01
  2361. Jan 27 09:31:45: | 80 0c 0e 10 80 01 00 07 80 0e 00 80 80 03 fd e9
  2362. Jan 27 09:31:45: | 80 02 00 02 80 04 00 02 03 00 00 24 0b 01 00 00
  2363. Jan 27 09:31:45: | 80 0b 00 01 80 0c 0e 10 80 01 00 07 80 0e 00 80
  2364. Jan 27 09:31:45: | 80 03 fd e9 80 02 00 01 80 04 00 02 03 00 00 20
  2365. Jan 27 09:31:45: | 0c 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 05
  2366. Jan 27 09:31:45: | 80 03 fd e9 80 02 00 02 80 04 00 02 03 00 00 20
  2367. Jan 27 09:31:45: | 0d 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 05
  2368. Jan 27 09:31:45: | 80 03 fd e9 80 02 00 01 80 04 00 02 03 00 00 20
  2369. Jan 27 09:31:45: | 0e 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 01
  2370. Jan 27 09:31:45: | 80 03 fd e9 80 02 00 02 80 04 00 02 00 00 00 20
  2371. Jan 27 09:31:45: | 0f 01 00 00 80 0b 00 01 80 0c 0e 10 80 01 00 01
  2372. Jan 27 09:31:45: | 80 03 fd e9 80 02 00 01 80 04 00 02 0d 00 00 14
  2373. Jan 27 09:31:45: | 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
  2374. Jan 27 09:31:45: | 0d 00 00 14 4d f3 79 28 e9 fc 4f d1 b3 26 21 70
  2375. Jan 27 09:31:45: | d5 15 c6 62 0d 00 00 14 8f 8d 83 82 6d 24 6b 6f
  2376. Jan 27 09:31:45: | c7 a8 a6 a4 28 c1 1d e8 0d 00 00 14 43 9b 59 f8
  2377. Jan 27 09:31:45: | ba 67 6c 4c 77 37 ae 22 ea b8 f5 82 0d 00 00 14
  2378. Jan 27 09:31:45: | 4d 1e 0e 13 6d ea fa 34 c4 f3 ea 9f 02 ec 72 85
  2379. Jan 27 09:31:45: | 0d 00 00 14 80 d0 bb 3d ef 54 56 5e e8 46 45 d4
  2380. Jan 27 09:31:45: | c8 5c e3 ee 0d 00 00 14 99 09 b6 4e ed 93 7c 65
  2381. Jan 27 09:31:45: | 73 de 52 ac e9 52 fa 6b 0d 00 00 14 7d 94 19 a6
  2382. Jan 27 09:31:45: | 53 10 ca 6f 2c 17 9d 92 15 52 9d 56 0d 00 00 14
  2383. Jan 27 09:31:45: | cd 60 46 43 35 df 21 f8 7c fd b2 fc 68 b6 a4 48
  2384. Jan 27 09:31:45: | 0d 00 00 14 90 cb 80 91 3e bb 69 6e 08 63 81 b5
  2385. Jan 27 09:31:45: | ec 42 7b 1f 0d 00 00 0c 09 00 26 89 df d6 b7 12
  2386. Jan 27 09:31:45: | 0d 00 00 14 12 f5 f2 8c 45 71 68 a9 70 2d 9f e2
  2387. Jan 27 09:31:45: | 74 cc 01 00 0d 00 00 18 40 48 b7 d5 6e bc e8 85
  2388. Jan 27 09:31:45: | 25 e7 de 7f 00 d6 c2 d3 80 00 00 00 00 00 00 14
  2389. Jan 27 09:31:45: | af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
  2390. Jan 27 09:31:45: | **parse ISAKMP Message:
  2391. Jan 27 09:31:45: | initiator cookie:
  2392. Jan 27 09:31:45: | 2c 8a 42 6d 37 68 e4 35
  2393. Jan 27 09:31:45: | responder cookie:
  2394. Jan 27 09:31:45: | 00 00 00 00 00 00 00 00
  2395. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_SA (0x1)
  2396. Jan 27 09:31:45: | ISAKMP version: ISAKMP Version 1.0 (rfc2407) (0x10)
  2397. Jan 27 09:31:45: | exchange type: ISAKMP_XCHG_IDPROT (0x2)
  2398. Jan 27 09:31:45: | flags: none (0x0)
  2399. Jan 27 09:31:45: | message ID: 00 00 00 00
  2400. Jan 27 09:31:45: | length: 848 (0x350)
  2401. Jan 27 09:31:45: | processing version=1.0 packet with exchange type=ISAKMP_XCHG_IDPROT (2)
  2402. Jan 27 09:31:45: | got payload 0x2 (ISAKMP_NEXT_SA) needed: 0x2opt: 0x2080
  2403. Jan 27 09:31:45: | ***parse ISAKMP Security Association Payload:
  2404. Jan 27 09:31:45: | next payload type: ISAKMP_NEXT_VID (0xd)
  2405. Jan 27 09:31:45: | length: 544 (0x220)
  2406. Jan 27 09:31:45: | DOI: ISAKMP_DOI_IPSEC (0x1)
  2407. .
  2408. .
  2409. .
  2410. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [RFC 3947]
  2411. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike]
  2412. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike]
  2413. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-08]
  2414. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-08]
  2415. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-07]
  2416. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-07]
  2417. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-06]
  2418. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-06]
  2419. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-05]
  2420. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-05]
  2421. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-04]
  2422. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-04]
  2423. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-03]
  2424. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
  2425. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-02]
  2426. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
  2427. Jan 27 09:31:45: | Ignoring older NAT-T Vendor ID paylad [draft-ietf-ipsec-nat-t-ike-02_n]
  2428. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
  2429. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [XAUTH]
  2430. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [Cisco-Unity]
  2431. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [FRAGMENTATION 80000000]
  2432. Jan 27 09:31:45: packet from aaa.bbb.ccc.ddd:500: received Vendor ID payload [Dead Peer Detection]
  2433. Jan 27 09:31:45: | find_host_connection me=ccc.ddd.eee.fff:500 him=aaa.bbb.ccc.ddd:500 policy=IKEV1_ALLOW
  2434. Jan 27 09:31:45: | find_host_pair: comparing ccc.ddd.eee.fff:500 to bbb.ccc.ddd.eee:500
  2435. Jan 27 09:31:45: | find_host_pair: comparing ccc.ddd.eee.fff:500 to 0.0.0.0:500
  2436. Jan 27 09:31:45: | find_host_pair_conn (find_host_connection): ccc.ddd.eee.fff:500 aaa.bbb.ccc.ddd:500 -> hp:none
  2437. Jan 27 09:31:45: | find_next_host_connection policy=IKEV1_ALLOW
  2438. Jan 27 09:31:45: | find_next_host_connection returns empty
  2439. Jan 27 09:31:45: | ****parse IPsec DOI SIT:
  2440. Jan 27 09:31:45: | IPsec DOI SIT: SIT_IDENTITY_ONLY (0x1)
  2441. Jan 27 09:31:45: | ****parse ISAKMP Proposal Payload:
  2442. .
  2443. .
  2444. .
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!