Attachment 887117 Details for Bug 1088038 – Pluto logs - enforcing

Pluto logs - enforcing

pluto_enforcing.log (text/x-log), 109.54 KB, created by Ján Rusnačko on 2014-04-17 08:58:03 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ján Rusnačko

Created: 2014-04-17 08:58:03 UTC

Size: 109.54 KB

patch

obsolete

>nss directory plutomain: /etc/ipsec.d
>NSS Initialized
>FIPS HMAC integrity verification test passed
>FIPS: pluto daemon NOT running in FIPS mode
>libcap-ng support [enabled]
>Linux audit support [disabled]
>Starting Pluto (Libreswan Version 3.8 XFRM(netkey) KLIPS NSS DNSSEC FIPS_CHECK LABELED_IPSEC LIBCAP_NG XAUTH_PAM NETWORKMANAGER KLIPS_MAST CURL(non-NSS) LDAP(non-NSS)) pid:12469
>core dump dir: /var/run/pluto/
>secrets file: /etc/ipsec.secrets
>LEAK_DETECTIVE support [disabled]
>OCF support for IKE [disabled]
>SAref support [disabled]: Protocol not available
>SAbind support [disabled]: Protocol not available
>NSS crypto [enabled]
>XAUTH PAM support [enabled]
>Setting NAT-Traversal port-4500 floating to on
>   port floating activation criteria nat_t=1/port_float=1
>   NAT-Traversal support  [enabled]
>| inserting event EVENT_REINIT_SECRET, timeout in 3600 seconds
>| event added at head of queue
>| inserting event EVENT_PENDING_DDNS, timeout in 60 seconds
>| event added at head of queue
>| inserting event EVENT_PENDING_PHASE2, timeout in 120 seconds
>| event added after event EVENT_PENDING_DDNS
>ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)
>ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)
>ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
>ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
>ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
>ike_alg_register_hash(): Activating OAKLEY_SHA2_384: Ok (ret=0)
>ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
>starting up 3 cryptographic helpers
>started helper (thread) pid=139794072897280 (fd:7)
>| status value returned by setting the priority of this thread (id=0) 22
>| helper 0 waiting on fd: 8
>| status value returned by setting the priority of this thread (id=1) 22
>| helper 1 waiting on fd: 10
>started helper (thread) pid=139794064504576 (fd:9)
>started helper (thread) pid=139794056111872 (fd:11)
>| status value returned by setting the priority of this thread (id=2) 22
>| helper 2 waiting on fd: 13
>Using Linux XFRM/NETKEY IPsec interface code on 3.10.0-121.el7.x86_64
>| process 12469 listening for PF_KEY_V2 on file descriptor 16
>| finish_pfkey_msg: K_SADB_REGISTER message 1 for AH 
>|   02 07 00 02  02 00 00 00  01 00 00 00  b5 30 00 00
>| pfkey_get: K_SADB_REGISTER message 1
>| AH registered with kernel.
>| finish_pfkey_msg: K_SADB_REGISTER message 2 for ESP 
>|   02 07 00 03  02 00 00 00  02 00 00 00  b5 30 00 00
>| pfkey_get: K_SADB_REGISTER message 2
>| alg_init():memset(0x7f245f2d7580, 0, 2048) memset(0x7f245f2d7d80, 0, 2048) 
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: sadb_msg_len=22 sadb_supported_len=72
>| kernel_alg_add():satype=3, exttype=14, alg_id=251(ESP_KAME_NULL)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[0], exttype=14, satype=3, alg_id=251, alg_ivlen=0, alg_minbits=0, alg_maxbits=0, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=14, alg_id=2(ESP_DES)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[1], exttype=14, satype=3, alg_id=2, alg_ivlen=0, alg_minbits=128, alg_maxbits=128, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=14, alg_id=3(ESP_3DES)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[2], exttype=14, satype=3, alg_id=3, alg_ivlen=0, alg_minbits=160, alg_maxbits=160, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=14, alg_id=5(ESP_IDEA)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[3], exttype=14, satype=3, alg_id=5, alg_ivlen=0, alg_minbits=256, alg_maxbits=256, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=14, alg_id=6(ESP_CAST)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[4], exttype=14, satype=3, alg_id=6, alg_ivlen=0, alg_minbits=384, alg_maxbits=384, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=14, alg_id=7(ESP_BLOWFISH)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[5], exttype=14, satype=3, alg_id=7, alg_ivlen=0, alg_minbits=512, alg_maxbits=512, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=14, alg_id=8(ESP_3IDEA)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[6], exttype=14, satype=3, alg_id=8, alg_ivlen=0, alg_minbits=160, alg_maxbits=160, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=14, alg_id=9(ESP_DES_IV32)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[7], exttype=14, satype=3, alg_id=9, alg_ivlen=0, alg_minbits=128, alg_maxbits=128, res=0, ret=1
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: sadb_msg_len=22 sadb_supported_len=88
>| kernel_alg_add():satype=3, exttype=15, alg_id=11(ESP_NULL)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[8], exttype=15, satype=3, alg_id=11, alg_ivlen=0, alg_minbits=0, alg_maxbits=0, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=2(ESP_DES)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[9], exttype=15, satype=3, alg_id=2, alg_ivlen=8, alg_minbits=64, alg_maxbits=64, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=3(ESP_3DES)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[10], exttype=15, satype=3, alg_id=3, alg_ivlen=8, alg_minbits=192, alg_maxbits=192, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=6(ESP_CAST)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[11], exttype=15, satype=3, alg_id=6, alg_ivlen=8, alg_minbits=40, alg_maxbits=128, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=7(ESP_BLOWFISH)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[12], exttype=15, satype=3, alg_id=7, alg_ivlen=8, alg_minbits=40, alg_maxbits=448, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=12(ESP_AES)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[13], exttype=15, satype=3, alg_id=12, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=252(ESP_SERPENT)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[14], exttype=15, satype=3, alg_id=252, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=22(ESP_CAMELLIA)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[15], exttype=15, satype=3, alg_id=22, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=253(ESP_TWOFISH)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[16], exttype=15, satype=3, alg_id=253, alg_ivlen=8, alg_minbits=128, alg_maxbits=256, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=13(ESP_AES_CTR)
>| kernel_alg_register_pfkey(): SADB_SATYPE_ESP: alg[17], exttype=15, satype=3, alg_id=13, alg_ivlen=8, alg_minbits=160, alg_maxbits=288, res=0, ret=1
>| kernel_alg_add():satype=3, exttype=15, alg_id=18(ESP_AES_GCM_A)
>| kernel_alg_add():satype=3, exttype=15, alg_id=19(ESP_AES_GCM_B)
>| kernel_alg_add():satype=3, exttype=15, alg_id=20(ESP_AES_GCM_C)
>| kernel_alg_add():satype=3, exttype=15, alg_id=14(ESP_AES_CCM_A)
>| kernel_alg_add():satype=3, exttype=15, alg_id=15(ESP_AES_CCM_B)
>| kernel_alg_add():satype=3, exttype=15, alg_id=16(ESP_AES_CCM_C)
>ike_alg_register_enc(): Activating aes_ccm_8: Ok (ret=0)
>Warning: failed to register algo_aes_ccm_8 for IKE
>ike_alg_register_enc(): Activating aes_ccm_12: Ok (ret=0)
>Warning: failed to register algo_aes_ccm_12 for IKE
>ike_alg_register_enc(): Activating aes_ccm_16: Ok (ret=0)
>Warning: failed to register algo_aes_ccm_16 for IKE
>ike_alg_register_enc(): Activating aes_gcm_8: Ok (ret=0)
>Warning: failed to register algo_aes_gcm_8 for IKE
>ike_alg_register_enc(): Activating aes_gcm_12: Ok (ret=0)
>Warning: failed to register algo_aes_gcm_12 for IKE
>ike_alg_register_enc(): Activating aes_gcm_16: Ok (ret=0)
>Warning: failed to register algo_aes_gcm_16 for IKE
>| Registered AEAD AES CCM/GCM algorithms
>| ESP registered with kernel.
>| finish_pfkey_msg: K_SADB_REGISTER message 3 for IPCOMP 
>|   02 07 00 09  02 00 00 00  03 00 00 00  b5 30 00 00
>| pfkey_get: K_SADB_REGISTER message 3
>| IPCOMP registered with kernel.
>| Registered AH, ESP and IPCOMP
>| Changed path to directory '/etc/ipsec.d/cacerts'
>| Changing to directory '/etc/ipsec.d/crls'
>| selinux support is enabled. 
>| inserting event EVENT_LOG_DAILY, timeout in 47504 seconds
>| event added after event EVENT_REINIT_SECRET
>listening for IKE messages
>| Inspecting interface lo 
>| found lo with address 127.0.0.1
>| Inspecting interface wlp3s0 
>| found wlp3s0 with address 10.200.138.69
>| Inspecting interface virbr0 
>| found virbr0 with address 192.168.122.1
>| NAT-Traversal: Trying new style NAT-T
>| NAT-Traversal: ESPINUDP(1) setup failed for new style NAT-T family IPv4 (errno=19)
>| NAT-Traversal: Trying old style NAT-T
>| NAT-Traversal: ESPINUDP(1) setup succeeded for new style NAT-T family IPv4
>adding interface virbr0/virbr0 192.168.122.1:500
>| NAT-Traversal: Trying new style NAT-T
>| NAT-Traversal: ESPINUDP(2) setup failed for new style NAT-T family IPv4 (errno=19)
>| NAT-Traversal: Trying old style NAT-T
>| NAT-Traversal: ESPINUDP(2) setup succeeded for new style NAT-T family IPv4
>adding interface virbr0/virbr0 192.168.122.1:4500
>| NAT-Traversal: Trying new style NAT-T
>| NAT-Traversal: ESPINUDP(1) setup failed for new style NAT-T family IPv4 (errno=19)
>| NAT-Traversal: Trying old style NAT-T
>| NAT-Traversal: ESPINUDP(1) setup succeeded for new style NAT-T family IPv4
>adding interface wlp3s0/wlp3s0 10.200.138.69:500
>| NAT-Traversal: Trying new style NAT-T
>| NAT-Traversal: ESPINUDP(2) setup failed for new style NAT-T family IPv4 (errno=19)
>| NAT-Traversal: Trying old style NAT-T
>| NAT-Traversal: ESPINUDP(2) setup succeeded for new style NAT-T family IPv4
>adding interface wlp3s0/wlp3s0 10.200.138.69:4500
>| NAT-Traversal: Trying new style NAT-T
>| NAT-Traversal: ESPINUDP(1) setup failed for new style NAT-T family IPv4 (errno=19)
>| NAT-Traversal: Trying old style NAT-T
>| NAT-Traversal: ESPINUDP(1) setup succeeded for new style NAT-T family IPv4
>adding interface lo/lo 127.0.0.1:500
>| NAT-Traversal: Trying new style NAT-T
>| NAT-Traversal: ESPINUDP(2) setup failed for new style NAT-T family IPv4 (errno=19)
>| NAT-Traversal: Trying old style NAT-T
>| NAT-Traversal: ESPINUDP(2) setup succeeded for new style NAT-T family IPv4
>adding interface lo/lo 127.0.0.1:4500
>| found lo with address 0000:0000:0000:0000:0000:0000:0000:0001
>adding interface lo/lo ::1:500
>| certs and keys locked by 'free_preshared_secrets'
>| certs and keys unlocked by 'free_preshard_secrets'
>loading secrets from "/etc/ipsec.secrets"
>loading secrets from "/etc/ipsec.d/ipsec-nm-conn1.secrets"
>| id type added to secret(0x7f2460f90340) PPK_PSK: @RH-standard
>| Processing PSK at line 1: passed
>| certs and keys locked by 'process_secret'
>| certs and keys unlocked by 'process_secret'
>| next event EVENT_PENDING_DDNS in 60 seconds
>| calling addconn helper using execve
>| next event EVENT_PENDING_DDNS in 59 seconds
>| reaped addconn helper child
>|  
>| *received whack message
>| alg_info_parse_str() ealg_buf=aes aalg_buf=sha1 eklen=0  aklen=0
>| alg_enum_search_prefix() calling enum_search(0x7f245f2a9e40, "OAKLEY_AES")
>| enum_search_ppfixi () calling enum_search(0x7f245f2a9e40, "OAKLEY_AES_CBC")
>| parser_alg_info_add() ealg_getbyname("aes")=7
>| entering aalg_getbyname_ike()
>| alg_enum_search_prefix() calling enum_search(0x7f245f2a9de0, "OAKLEY_SHA1")
>| parser_alg_info_add() aalg_getbyname("sha1")=2
>| raw_alg_info_ike_add() ealg=7 aalg=2 modp_id=5, cnt=1
>| raw_alg_info_ike_add() ealg=7 aalg=2 modp_id=2, cnt=2
>| Added new connection nm-conn1 with policy PSK+ENCRYPT+TUNNEL+PFS+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG
>| from whack: got --esp=aes-sha1;modp1024
>| alg_enum_search_prefix() calling enum_search(0x7f245f2a9b40, "OAKLEY_GROUP_MODP1024")
>| alg_info_parse_str() ealg_buf=aes aalg_buf=sha1 eklen=0  aklen=0
>| alg_enum_search_prefix() calling enum_search(0x7f245f2aa7e0, "ESP_AES")
>| parser_alg_info_add() ealg_getbyname("aes")=12
>| entering aalg_getbyname_esp()
>| alg_enum_search_prefix() calling enum_search(0x7f245f2aa1e0, "AUTH_ALGORITHM_HMAC_SHA1")
>| parser_alg_info_add() aalg_getbyname("sha1")=2
>| raw_alg_info_esp_add() ealg=12 aalg=2 cnt=1
>| esp string values: AES(12)_000-SHA1(2)_000; pfsgroup=MODP1024(2)
>| ike (phase1) algorihtm values: AES_CBC(7)_000-SHA1(2)_000-MODP1536(5), AES_CBC(7)_000-SHA1(2)_000-MODP1024(2)
>| loopback=0, labeled_ipsec=0;
>| policy_label=(null);
>| counting wild cards for @RH-standard is 0
>| counting wild cards for 66.187.233.55 is 0
>| modecfgdomain=(null);
>| modecfgbanner=(null);
>| alg_info_addref() alg_info->ref_cnt=1
>| alg_info_addref() alg_info->ref_cnt=1
>| connect_to_host_pair: 10.200.138.69:500 66.187.233.55:500 -> hp:none 
>added connection description "nm-conn1"
>| 10.200.138.69[@RH-standard,+MC+XC+S=C]...66.187.233.55<66.187.233.55>[MS+XS+S=C]
>| ike_life: 86400s; ipsec_life: 86400s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1; policy: PSK+ENCRYPT+TUNNEL+PFS+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG
>| * processed 0 messages from cryptographic helpers 
>| next event EVENT_PENDING_DDNS in 58 seconds
>| next event EVENT_PENDING_DDNS in 58 seconds
>|  
>| *received whack message
>| processing connection nm-conn1
>| kernel_alg_db_new() initial trans_cnt=128
>| kernel_alg_db_new() will return p_new->protoid=3, p_new->trans_cnt=1
>| kernel_alg_db_new()     trans[0]: transid=12, attr_cnt=2, attrs[0].type=5, attrs[0].val=2
>| returning new proposal from esp_info
>| creating state object #1 at 0x7f2460f923d0
>| processing connection nm-conn1
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  00 00 00 00  00 00 00 00
>| state hash entry 5
>| inserting state object #1
>| inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #1
>| event added at head of queue
>"nm-conn1" #1: multiple DH groups were set in aggressive mode. Only first one used.
>"nm-conn1" #1: transform (7,2,2,0) ignored.
>| initiating aggressive mode with IKE=E=7-H=2-M=5
>| Queuing pending Quick Mode with 66.187.233.55 "nm-conn1"
>"nm-conn1" #1: initiating Aggressive Mode #1, connection "nm-conn1"
>| 1: w->pcw_dead: 0 w->pcw_work: 0 cnt: 3
>| asking helper 1 to do build_kenonce op on seq: 1 (len=2776, pcw_work=1)
>| crypto helper write of request: cnt=2776<wlen=2776.  
>| deleting event for #1
>| inserting event EVENT_CRYPTO_FAILED, timeout in 300 seconds for #1
>| event added after event EVENT_PENDING_PHASE2
>| * processed 0 messages from cryptographic helpers 
>| next event EVENT_PENDING_DDNS in 58 seconds
>| next event EVENT_PENDING_DDNS in 58 seconds
>| helper 1 read 2768+4/2776 bytes fd: 10
>| helper 1 doing build_kenonce op id: 1
>| NSS: Value of Prime:
>|   ff ff ff ff  ff ff ff ff  c9 0f da a2  21 68 c2 34
>|   c4 c6 62 8b  80 dc 1c d1  29 02 4e 08  8a 67 cc 74
>|   02 0b be a6  3b 13 9b 22  51 4a 08 79  8e 34 04 dd
>|   ef 95 19 b3  cd 3a 43 1b  30 2b 0a 6d  f2 5f 14 37
>|   4f e1 35 6d  6d 51 c2 45  e4 85 b5 76  62 5e 7e c6
>|   f4 4c 42 e9  a6 37 ed 6b  0b ff 5c b6  f4 06 b7 ed
>|   ee 38 6b fb  5a 89 9f a5  ae 9f 24 11  7c 4b 1f e6
>|   49 28 66 51  ec e4 5b 3d  c2 00 7c b8  a1 63 bf 05
>|   98 da 48 36  1c 55 d3 9a  69 16 3f a8  fd 24 cf 5f
>|   83 65 5d 23  dc a3 ad 96  1c 62 f3 56  20 85 52 bb
>|   9e d5 29 07  70 96 96 6d  67 0c 35 4e  4a bc 98 04
>|   f1 74 6c 08  ca 23 73 27  ff ff ff ff  ff ff ff ff
>| NSS: Value of base:
>|   02
>| NSS: generated dh priv and pub keys: 192 
>| NSS: Local DH secret (pointer):
>|   60 5c 00 48  24 7f 00 00
>| NSS: Public DH value sent(computed in NSS):
>|   7c 54 ed e2  73 bb a4 4d  b2 ba d0 c9  79 7b 0f 4f
>|   51 c9 ae 1a  b6 84 37 89  41 4c 7a 0a  ed fe 2a bc
>|   0d 90 13 7f  66 5c 8b 9e  f3 c2 ce 13  0c 56 16 41
>|   35 64 6c a0  ca e5 31 c2  d8 bc f6 66  f9 f0 dd 07
>|   db 0c cc 72  07 42 64 1c  64 a5 7c 1f  ea 33 b7 20
>|   5c 47 62 13  ce 80 dc a5  26 7a 6e f5  6d 28 ff ff
>|   22 f0 fe 06  85 8e 79 46  a1 12 e7 d9  f4 d7 9b f6
>|   a9 c4 6e 93  cd 60 a3 f7  30 46 48 6c  f2 29 35 a7
>|   66 77 d7 84  ce 60 d3 52  55 97 e9 9e  48 33 65 43
>|   72 d7 da 18  5b 23 ac 70  13 fb 9b d0  05 12 8a 35
>|   8f 02 70 1b  74 2d 09 cd  22 ca 9f 11  8a f9 fb fa
>|   05 f9 2b ab  48 d7 d9 00  e6 e3 26 9e  47 47 88 2c
>| NSS: Local DH public value (pointer):
>|   50 54 00 48  24 7f 00 00
>| Generated nonce:
>|   16 6c f2 5b  c8 9c c5 c1  8d be 8f 5d  0a 3b 01 fd
>|  
>| helper 1 has finished work (cnt now 1)
>| helper 1 replies to id: q#1
>| calling callback function 0x7f245f01b980
>| aggr outI1: calculated ke+nonce, sending I1
>| processing connection nm-conn1
>| **emit ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   00 00 00 00  00 00 00 00
>|    next payload type: ISAKMP_NEXT_SA
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_AGGR
>|    flags: none
>|    message ID:  00 00 00 00
>"nm-conn1" #1: multiple DH groups were set in aggressive mode. Only first one used.
>"nm-conn1" #1: transform (7,2,2,0) ignored.
>| ***emit ISAKMP Security Association Payload:
>|    next payload type: ISAKMP_NEXT_KE
>|    DOI: ISAKMP_DOI_IPSEC
>| ****emit IPsec DOI SIT:
>|    IPsec DOI SIT: SIT_IDENTITY_ONLY
>| out_sa pcn: 0 has 1 valid proposals
>| out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 1
>| ****emit ISAKMP Proposal Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>|    proposal number: 0
>|    protocol ID: PROTO_ISAKMP
>|    SPI size: 0
>|    number of transforms: 1
>| *****emit ISAKMP Transform Payload (ISAKMP):
>|    next payload type: ISAKMP_NEXT_NONE
>|    ISAKMP transform number: 0
>|    ISAKMP transform ID: KEY_IKE
>| ******emit ISAKMP Oakley attribute:
>|    af+type: OAKLEY_LIFE_TYPE
>|    length/value: 1
>|     [1 is OAKLEY_LIFE_SECONDS]
>| ******emit ISAKMP Oakley attribute:
>|    af+type: OAKLEY_LIFE_DURATION (variable length)
>| emitting 4 raw bytes of long attribute value into ISAKMP Oakley attribute
>| long attribute value
>|   00 01 51 80
>| emitting length of ISAKMP Oakley attribute: 4
>| ******emit ISAKMP Oakley attribute:
>|    af+type: OAKLEY_ENCRYPTION_ALGORITHM
>|    length/value: 7
>|     [7 is OAKLEY_AES_CBC]
>| ******emit ISAKMP Oakley attribute:
>|    af+type: OAKLEY_HASH_ALGORITHM
>|    length/value: 2
>|     [2 is OAKLEY_SHA1]
>| ******emit ISAKMP Oakley attribute:
>|    af+type: OAKLEY_AUTHENTICATION_METHOD
>|    length/value: 65001
>|     [65001 is XAUTHInitPreShared]
>| ******emit ISAKMP Oakley attribute:
>|    af+type: OAKLEY_GROUP_DESCRIPTION
>|    length/value: 5
>|     [5 is OAKLEY_GROUP_MODP1536]
>| emitting length of ISAKMP Transform Payload (ISAKMP): 36
>| emitting length of ISAKMP Proposal Payload: 44
>| emitting length of ISAKMP Security Association Payload: 56
>| saving DH priv (local secret) and pub key into state struc
>| ***emit ISAKMP Key Exchange Payload:
>|    next payload type: ISAKMP_NEXT_NONCE
>| emitting 192 raw bytes of keyex value into ISAKMP Key Exchange Payload
>| keyex value  7c 54 ed e2  73 bb a4 4d  b2 ba d0 c9  79 7b 0f 4f
>| keyex value  51 c9 ae 1a  b6 84 37 89  41 4c 7a 0a  ed fe 2a bc
>| keyex value  0d 90 13 7f  66 5c 8b 9e  f3 c2 ce 13  0c 56 16 41
>| keyex value  35 64 6c a0  ca e5 31 c2  d8 bc f6 66  f9 f0 dd 07
>| keyex value  db 0c cc 72  07 42 64 1c  64 a5 7c 1f  ea 33 b7 20
>| keyex value  5c 47 62 13  ce 80 dc a5  26 7a 6e f5  6d 28 ff ff
>| keyex value  22 f0 fe 06  85 8e 79 46  a1 12 e7 d9  f4 d7 9b f6
>| keyex value  a9 c4 6e 93  cd 60 a3 f7  30 46 48 6c  f2 29 35 a7
>| keyex value  66 77 d7 84  ce 60 d3 52  55 97 e9 9e  48 33 65 43
>| keyex value  72 d7 da 18  5b 23 ac 70  13 fb 9b d0  05 12 8a 35
>| keyex value  8f 02 70 1b  74 2d 09 cd  22 ca 9f 11  8a f9 fb fa
>| keyex value  05 f9 2b ab  48 d7 d9 00  e6 e3 26 9e  47 47 88 2c
>| emitting length of ISAKMP Key Exchange Payload: 196
>| ***emit ISAKMP Nonce Payload:
>|    next payload type: ISAKMP_NEXT_ID
>| emitting 16 raw bytes of Ni into ISAKMP Nonce Payload
>| Ni  16 6c f2 5b  c8 9c c5 c1  8d be 8f 5d  0a 3b 01 fd
>| emitting length of ISAKMP Nonce Payload: 20
>| setting sec: 1
>| ***emit ISAKMP Identification Payload (IPsec DOI):
>|    next payload type: ISAKMP_NEXT_VID
>|    ID type: ID_FQDN
>|    Protocol ID: 0
>|    port: 0
>| emitting 11 raw bytes of my identity into ISAKMP Identification Payload (IPsec DOI)
>| my identity  52 48 2d 73  74 61 6e 64  61 72 64
>| emitting length of ISAKMP Identification Payload (IPsec DOI): 19
>| out_vid(): sending [Dead Peer Detection]
>| ***emit ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>| emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
>| V_ID  af ca d7 13  68 a1 f1 c9  6b 86 96 fc  77 57 01 00
>| emitting length of ISAKMP Vendor ID Payload: 20
>| nat add vid. port: 1 nonike: 1
>| out_vid(): sending [RFC 3947]
>| ***emit ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>| emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
>| V_ID  4a 13 1c 81  07 03 58 45  5c 57 28 f2  0e 95 45 2f
>| emitting length of ISAKMP Vendor ID Payload: 20
>| out_vid(): sending [draft-ietf-ipsec-nat-t-ike-03]
>| ***emit ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>| emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
>| V_ID  7d 94 19 a6  53 10 ca 6f  2c 17 9d 92  15 52 9d 56
>| emitting length of ISAKMP Vendor ID Payload: 20
>| out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02_n]
>| ***emit ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>| emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
>| V_ID  90 cb 80 91  3e bb 69 6e  08 63 81 b5  ec 42 7b 1f
>| emitting length of ISAKMP Vendor ID Payload: 20
>| out_vid(): sending [draft-ietf-ipsec-nat-t-ike-02]
>| ***emit ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>| emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
>| V_ID  cd 60 46 43  35 df 21 f8  7c fd b2 fc  68 b6 a4 48
>| emitting length of ISAKMP Vendor ID Payload: 20
>| out_vid(): sending [draft-ietf-ipsec-nat-t-ike-00]
>| ***emit ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>| emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
>| V_ID  44 85 15 2d  18 b6 bb cd  0b e8 a8 46  95 79 dd cc
>| emitting length of ISAKMP Vendor ID Payload: 20
>| out_vid(): sending [XAUTH]
>| ***emit ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>| emitting 8 raw bytes of V_ID into ISAKMP Vendor ID Payload
>| V_ID  09 00 26 89  df d6 b7 12
>| emitting length of ISAKMP Vendor ID Payload: 12
>| out_vid(): sending [FRAGMENTATION]
>| ***emit ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>| emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
>| V_ID  40 48 b7 d5  6e bc e8 85  25 e7 de 7f  00 d6 c2 d3
>| emitting length of ISAKMP Vendor ID Payload: 20
>| padding IKE message with 1 bytes
>| emitting 1 zero bytes of message padding into ISAKMP Message
>| emitting length of ISAKMP Message: 472
>| sending:
>|   ff d8 a9 fb  b4 2c 8d c7  00 00 00 00  00 00 00 00
>|   01 10 04 00  00 00 00 00  00 00 01 d8  04 00 00 38
>|   00 00 00 01  00 00 00 01  00 00 00 2c  00 01 00 01
>|   00 00 00 24  00 01 00 00  80 0b 00 01  00 0c 00 04
>|   00 01 51 80  80 01 00 07  80 02 00 02  80 03 fd e9
>|   80 04 00 05  0a 00 00 c4  7c 54 ed e2  73 bb a4 4d
>|   b2 ba d0 c9  79 7b 0f 4f  51 c9 ae 1a  b6 84 37 89
>|   41 4c 7a 0a  ed fe 2a bc  0d 90 13 7f  66 5c 8b 9e
>|   f3 c2 ce 13  0c 56 16 41  35 64 6c a0  ca e5 31 c2
>|   d8 bc f6 66  f9 f0 dd 07  db 0c cc 72  07 42 64 1c
>|   64 a5 7c 1f  ea 33 b7 20  5c 47 62 13  ce 80 dc a5
>|   26 7a 6e f5  6d 28 ff ff  22 f0 fe 06  85 8e 79 46
>|   a1 12 e7 d9  f4 d7 9b f6  a9 c4 6e 93  cd 60 a3 f7
>|   30 46 48 6c  f2 29 35 a7  66 77 d7 84  ce 60 d3 52
>|   55 97 e9 9e  48 33 65 43  72 d7 da 18  5b 23 ac 70
>|   13 fb 9b d0  05 12 8a 35  8f 02 70 1b  74 2d 09 cd
>|   22 ca 9f 11  8a f9 fb fa  05 f9 2b ab  48 d7 d9 00
>|   e6 e3 26 9e  47 47 88 2c  05 00 00 14  16 6c f2 5b
>|   c8 9c c5 c1  8d be 8f 5d  0a 3b 01 fd  0d 00 00 13
>|   02 00 00 00  52 48 2d 73  74 61 6e 64  61 72 64 0d
>|   00 00 14 af  ca d7 13 68  a1 f1 c9 6b  86 96 fc 77
>|   57 01 00 0d  00 00 14 4a  13 1c 81 07  03 58 45 5c
>|   57 28 f2 0e  95 45 2f 0d  00 00 14 7d  94 19 a6 53
>|   10 ca 6f 2c  17 9d 92 15  52 9d 56 0d  00 00 14 90
>|   cb 80 91 3e  bb 69 6e 08  63 81 b5 ec  42 7b 1f 0d
>|   00 00 14 cd  60 46 43 35  df 21 f8 7c  fd b2 fc 68
>|   b6 a4 48 0d  00 00 14 44  85 15 2d 18  b6 bb cd 0b
>|   e8 a8 46 95  79 dd cc 0d  00 00 0c 09  00 26 89 df
>|   d6 b7 12 00  00 00 14 40  48 b7 d5 6e  bc e8 85 25
>|   e7 de 7f 00  d6 c2 d3 00
>| sending 472 bytes for aggr_outI1 through wlp3s0:500 to 66.187.233.55:500 (using #1)
>|   ff d8 a9 fb  b4 2c 8d c7  00 00 00 00  00 00 00 00
>|   01 10 04 00  00 00 00 00  00 00 01 d8  04 00 00 38
>|   00 00 00 01  00 00 00 01  00 00 00 2c  00 01 00 01
>|   00 00 00 24  00 01 00 00  80 0b 00 01  00 0c 00 04
>|   00 01 51 80  80 01 00 07  80 02 00 02  80 03 fd e9
>|   80 04 00 05  0a 00 00 c4  7c 54 ed e2  73 bb a4 4d
>|   b2 ba d0 c9  79 7b 0f 4f  51 c9 ae 1a  b6 84 37 89
>|   41 4c 7a 0a  ed fe 2a bc  0d 90 13 7f  66 5c 8b 9e
>|   f3 c2 ce 13  0c 56 16 41  35 64 6c a0  ca e5 31 c2
>|   d8 bc f6 66  f9 f0 dd 07  db 0c cc 72  07 42 64 1c
>|   64 a5 7c 1f  ea 33 b7 20  5c 47 62 13  ce 80 dc a5
>|   26 7a 6e f5  6d 28 ff ff  22 f0 fe 06  85 8e 79 46
>|   a1 12 e7 d9  f4 d7 9b f6  a9 c4 6e 93  cd 60 a3 f7
>|   30 46 48 6c  f2 29 35 a7  66 77 d7 84  ce 60 d3 52
>|   55 97 e9 9e  48 33 65 43  72 d7 da 18  5b 23 ac 70
>|   13 fb 9b d0  05 12 8a 35  8f 02 70 1b  74 2d 09 cd
>|   22 ca 9f 11  8a f9 fb fa  05 f9 2b ab  48 d7 d9 00
>|   e6 e3 26 9e  47 47 88 2c  05 00 00 14  16 6c f2 5b
>|   c8 9c c5 c1  8d be 8f 5d  0a 3b 01 fd  0d 00 00 13
>|   02 00 00 00  52 48 2d 73  74 61 6e 64  61 72 64 0d
>|   00 00 14 af  ca d7 13 68  a1 f1 c9 6b  86 96 fc 77
>|   57 01 00 0d  00 00 14 4a  13 1c 81 07  03 58 45 5c
>|   57 28 f2 0e  95 45 2f 0d  00 00 14 7d  94 19 a6 53
>|   10 ca 6f 2c  17 9d 92 15  52 9d 56 0d  00 00 14 90
>|   cb 80 91 3e  bb 69 6e 08  63 81 b5 ec  42 7b 1f 0d
>|   00 00 14 cd  60 46 43 35  df 21 f8 7c  fd b2 fc 68
>|   b6 a4 48 0d  00 00 14 44  85 15 2d 18  b6 bb cd 0b
>|   e8 a8 46 95  79 dd cc 0d  00 00 0c 09  00 26 89 df
>|   d6 b7 12 00  00 00 14 40  48 b7 d5 6e  bc e8 85 25
>|   e7 de 7f 00  d6 c2 d3 00
>| deleting event for #1
>| inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #1
>| event added at head of queue
>| complete state transition with STF_IGNORE
>| * processed 1 messages from cryptographic helpers 
>| next event EVENT_RETRANSMIT in 10 seconds for #1
>| next event EVENT_RETRANSMIT in 10 seconds for #1
>|  
>| *received 528 bytes from 66.187.233.55:500 on wlp3s0 (port=500)
>|   ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1  55 1e fb 18
>|   01 10 04 00  00 00 00 00  00 00 02 10  04 00 00 3c
>|   00 00 00 01  00 00 00 01  00 00 00 30  01 01 00 01
>|   00 00 00 28  00 01 00 00  80 01 00 07  80 0e 00 80
>|   80 02 00 02  80 04 00 05  80 03 fd e9  80 0b 00 01
>|   00 0c 00 04  00 01 51 80  0a 00 00 c4  d4 14 93 9d
>|   ad 3c 14 2d  96 84 45 b7  49 b6 5a 19  6e d7 2c 34
>|   71 dc c4 91  81 df 75 e7  0a df cf 2d  76 67 8c e0
>|   12 d6 bd cb  bc f6 cf 82  5e 3a f1 f8  9c c5 bd b4
>|   e3 02 eb c3  ec b6 51 02  a9 32 b5 b3  49 2d 52 8b
>|   d0 8b 95 47  c3 ee 71 22  c0 7b 05 3c  36 80 b2 40
>|   6a 73 04 89  c3 39 39 3d  fc 67 3a f9  33 21 21 8f
>|   6b 0a 49 49  85 66 03 20  4a 5d 97 25  e9 d4 a4 3e
>|   32 7f dd d2  8d 64 c4 95  7d 2a 76 cc  cc 2d a9 55
>|   cc 55 b4 5b  1d 3e 31 d2  14 d1 bc 5b  f5 a0 6c 75
>|   de 7b 4f 62  fa e4 0b 54  77 8b 87 12  6c 6e 3d 57
>|   8c af 19 b3  20 d3 97 51  a2 f8 84 50  c2 b6 ba 5e
>|   18 f2 96 21  f5 8f b8 ad  74 50 82 c4  05 00 00 18
>|   b4 63 85 7e  1c df 69 25  95 e8 cd 83  86 0d 13 1c
>|   a6 66 94 dd  08 00 00 0c  01 11 00 00  42 bb e9 37
>|   0d 00 00 18  3e 6a 1f aa  e8 44 a3 b6  74 4f 15 ec
>|   af d7 10 40  75 5a eb 04  0d 00 00 14  12 f5 f2 8c
>|   45 71 68 a9  70 2d 9f e2  74 cc 01 00  0d 00 00 0c
>|   09 00 26 89  df d6 b7 12  0d 00 00 14  af ca d7 13
>|   68 a1 f1 c9  6b 86 96 fc  77 57 01 00  14 00 00 14
>|   4a 13 1c 81  07 03 58 45  5c 57 28 f2  0e 95 45 2f
>|   14 00 00 18  75 af b9 25  ea df 63 13  3f 59 63 ef
>|   39 9a 8f f2  b0 53 d7 23  0d 00 00 18  31 80 64 c0
>|   7d b3 bc ed  de a3 65 75  0d a3 ae de  f5 f5 91 9e
>|   0d 00 00 18  40 48 b7 d5  6e bc e8 85  25 e7 de 7f
>|   00 d6 c2 d3  c0 00 00 00  0d 00 00 14  7a 34 c0 cc
>|   55 1f fb 18  24 87 6b 27  c8 84 55 7b  00 00 00 14
>|   1f 07 f7 0e  aa 65 14 d3  b0 fa 96 54  2a 50 01 00
>| **parse ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_SA
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_AGGR
>|    flags: none
>|    message ID:  00 00 00 00
>|    length: 528
>|  processing version=1.0 packet with exchange type=ISAKMP_XCHG_AGGR (4)
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| v1 state object not found
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  00 00 00 00  00 00 00 00
>| state hash entry 5
>| v1 peer and cookies match on #1, provided msgid 00000000 vs 00000000
>| v1 state object #1 found, in STATE_AGGR_I1
>| processing connection nm-conn1
>| got payload 0x2  (ISAKMP_NEXT_SA) needed: 0x532opt: 0x102000
>| ***parse ISAKMP Security Association Payload:
>|    next payload type: ISAKMP_NEXT_KE
>|    length: 60
>|    DOI: ISAKMP_DOI_IPSEC
>| got payload 0x10  (ISAKMP_NEXT_KE) needed: 0x530opt: 0x102000
>| ***parse ISAKMP Key Exchange Payload:
>|    next payload type: ISAKMP_NEXT_NONCE
>|    length: 196
>| got payload 0x400  (ISAKMP_NEXT_NONCE) needed: 0x520opt: 0x102000
>| ***parse ISAKMP Nonce Payload:
>|    next payload type: ISAKMP_NEXT_ID
>|    length: 24
>| got payload 0x20  (ISAKMP_NEXT_ID) needed: 0x120opt: 0x102000
>| ***parse ISAKMP Identification Payload:
>|    next payload type: ISAKMP_NEXT_HASH
>|    length: 12
>|    ID type: ID_IPV4_ADDR
>|    DOI specific A: 17
>|    DOI specific B: 0
>|      obj:   42 bb e9 37
>| got payload 0x100  (ISAKMP_NEXT_HASH) needed: 0x100opt: 0x102000
>| ***parse ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_VID
>|    length: 24
>| got payload 0x2000  (ISAKMP_NEXT_VID) needed: 0x0opt: 0x102000
>| ***parse ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>|    length: 20
>| got payload 0x2000  (ISAKMP_NEXT_VID) needed: 0x0opt: 0x102000
>| ***parse ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>|    length: 12
>| got payload 0x2000  (ISAKMP_NEXT_VID) needed: 0x0opt: 0x102000
>| ***parse ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>|    length: 20
>| got payload 0x2000  (ISAKMP_NEXT_VID) needed: 0x0opt: 0x102000
>| ***parse ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_NATD_RFC
>|    length: 20
>| got payload 0x100000  (ISAKMP_NEXT_NATD_RFC) needed: 0x0opt: 0x102000
>| ***parse ISAKMP NAT-D Payload:
>|    next payload type: ISAKMP_NEXT_NATD_RFC
>|    length: 24
>| got payload 0x100000  (ISAKMP_NEXT_NATD_RFC) needed: 0x0opt: 0x102000
>| ***parse ISAKMP NAT-D Payload:
>|    next payload type: ISAKMP_NEXT_VID
>|    length: 24
>| got payload 0x2000  (ISAKMP_NEXT_VID) needed: 0x0opt: 0x102000
>| ***parse ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>|    length: 24
>| got payload 0x2000  (ISAKMP_NEXT_VID) needed: 0x0opt: 0x102000
>| ***parse ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_VID
>|    length: 20
>| got payload 0x2000  (ISAKMP_NEXT_VID) needed: 0x0opt: 0x102000
>| ***parse ISAKMP Vendor ID Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 20
>"nm-conn1" #1: received Vendor ID payload [Cisco-Unity]
>"nm-conn1" #1: received Vendor ID payload [XAUTH]
>"nm-conn1" #1: received Vendor ID payload [Dead Peer Detection]
>| returning NATT method NAT_TRAVERSAL_METHOD_IETF_RFC
>|  method set to=RFC 3947 (NAT-Traversal) 
>"nm-conn1" #1: received Vendor ID payload [RFC 3947]
>"nm-conn1" #1: received Vendor ID payload [FRAGMENTATION c0000000]
>"nm-conn1" #1: ignoring unknown Vendor ID payload [7a34c0cc551ffb1824876b27c884557b]
>"nm-conn1" #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]
>"nm-conn1" #1: protocol/port in Phase 1 ID Payload MUST be 0/0 or 17/500 but are 17/0 (attempting to continue)
>"nm-conn1" #1: Aggressive mode peer ID is ID_IPV4_ADDR: '66.187.233.55'
>| refine_connection: starting with nm-conn1
>|    match_id a=66.187.233.55
>|             b=66.187.233.55
>|    results  matched
>|   trusted_ca called with a=(empty) b=(empty)
>| refine_connection: checking nm-conn1 against nm-conn1, best=(none) with match=1(id=1/ca=1/reqca=1)
>| refine_connection: checked nm-conn1 against nm-conn1, now for see if best
>| started looking for secret for @RH-standard->66.187.233.55 of kind PPK_PSK
>| actually looking for secret for @RH-standard->66.187.233.55 of kind PPK_PSK
>| line 1: key type PPK_PSK(@RH-standard) to type PPK_PSK 
>| 1: compared key @RH-standard to @RH-standard / 66.187.233.55 -> 8
>| line 1: match=9 
>| best_match 0>9 best=0x7f2460f90340 (line=1)
>| concluding with best_match=9 best=0x7f2460f90340 (lineno=1)
>| offered CA: '%none'
>| ****parse IPsec DOI SIT:
>|    IPsec DOI SIT: SIT_IDENTITY_ONLY
>| ****parse ISAKMP Proposal Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 48
>|    proposal number: 1
>|    protocol ID: PROTO_ISAKMP
>|    SPI size: 0
>|    number of transforms: 1
>| *****parse ISAKMP Transform Payload (ISAKMP):
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 40
>|    ISAKMP transform number: 0
>|    ISAKMP transform ID: KEY_IKE
>| ******parse ISAKMP Oakley attribute:
>|    af+type: OAKLEY_ENCRYPTION_ALGORITHM
>|    length/value: 7
>|    [7 is OAKLEY_AES_CBC]
>| ike_alg_enc_ok(ealg=7,key_len=0): blocksize=16, keyminlen=128, keydeflen=128, keymaxlen=256, ret=1
>| ******parse ISAKMP Oakley attribute:
>|    af+type: OAKLEY_KEY_LENGTH
>|    length/value: 128
>| ike_alg_enc_ok(ealg=7,key_len=128): blocksize=16, keyminlen=128, keydeflen=128, keymaxlen=256, ret=1
>| ******parse ISAKMP Oakley attribute:
>|    af+type: OAKLEY_HASH_ALGORITHM
>|    length/value: 2
>|    [2 is OAKLEY_SHA1]
>| ******parse ISAKMP Oakley attribute:
>|    af+type: OAKLEY_GROUP_DESCRIPTION
>|    length/value: 5
>|    [5 is OAKLEY_GROUP_MODP1536]
>| ******parse ISAKMP Oakley attribute:
>|    af+type: OAKLEY_AUTHENTICATION_METHOD
>|    length/value: 65001
>|    [65001 is XAUTHInitPreShared]
>| started looking for secret for @RH-standard->66.187.233.55 of kind PPK_PSK
>| actually looking for secret for @RH-standard->66.187.233.55 of kind PPK_PSK
>| line 1: key type PPK_PSK(@RH-standard) to type PPK_PSK 
>| 1: compared key @RH-standard to @RH-standard / 66.187.233.55 -> 8
>| line 1: match=9 
>| best_match 0>9 best=0x7f2460f90340 (line=1)
>| concluding with best_match=9 best=0x7f2460f90340 (lineno=1)
>| ******parse ISAKMP Oakley attribute:
>|    af+type: OAKLEY_LIFE_TYPE
>|    length/value: 1
>|    [1 is OAKLEY_LIFE_SECONDS]
>| ******parse ISAKMP Oakley attribute:
>|    af+type: OAKLEY_LIFE_DURATION (variable length)
>|    length/value: 4
>|    long duration: 86400
>| Oakley Transform 0 accepted
>| returning NATT method NAT_TRAVERSAL_METHOD_IETF_RFC
>| DH public value received:
>|   d4 14 93 9d  ad 3c 14 2d  96 84 45 b7  49 b6 5a 19
>|   6e d7 2c 34  71 dc c4 91  81 df 75 e7  0a df cf 2d
>|   76 67 8c e0  12 d6 bd cb  bc f6 cf 82  5e 3a f1 f8
>|   9c c5 bd b4  e3 02 eb c3  ec b6 51 02  a9 32 b5 b3
>|   49 2d 52 8b  d0 8b 95 47  c3 ee 71 22  c0 7b 05 3c
>|   36 80 b2 40  6a 73 04 89  c3 39 39 3d  fc 67 3a f9
>|   33 21 21 8f  6b 0a 49 49  85 66 03 20  4a 5d 97 25
>|   e9 d4 a4 3e  32 7f dd d2  8d 64 c4 95  7d 2a 76 cc
>|   cc 2d a9 55  cc 55 b4 5b  1d 3e 31 d2  14 d1 bc 5b
>|   f5 a0 6c 75  de 7b 4f 62  fa e4 0b 54  77 8b 87 12
>|   6c 6e 3d 57  8c af 19 b3  20 d3 97 51  a2 f8 84 50
>|   c2 b6 ba 5e  18 f2 96 21  f5 8f b8 ad  74 50 82 c4
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  00 00 00 00  00 00 00 00
>| state hash entry 5
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| inserting state object #1
>| inR1: checking NAT-t: 1 and 16
>| natd_hash: hasher=0x7f245f2b71a0(20)
>| natd_hash: icookie=  ff d8 a9 fb  b4 2c 8d c7
>| natd_hash: rcookie=  8f f3 67 d1  55 1e fb 18
>| natd_hash: ip=  0a c8 8a 45
>| natd_hash: port=500
>| natd_hash: hash=  3f 0c 28 16  1c 88 28 42  f4 87 46 30  f3 be 91 cc
>| natd_hash: hash=  24 fc e2 b7
>| natd_hash: hasher=0x7f245f2b71a0(20)
>| natd_hash: icookie=  ff d8 a9 fb  b4 2c 8d c7
>| natd_hash: rcookie=  8f f3 67 d1  55 1e fb 18
>| natd_hash: ip=  42 bb e9 37
>| natd_hash: port=500
>| natd_hash: hash=  31 80 64 c0  7d b3 bc ed  de a3 65 75  0d a3 ae de
>| natd_hash: hash=  f5 f5 91 9e
>| NAT_TRAVERSAL hash=0 (me:0) (him:0)
>| expected NAT-D(me):  3f 0c 28 16  1c 88 28 42  f4 87 46 30  f3 be 91 cc
>| expected NAT-D(me):  24 fc e2 b7
>| expected NAT-D(him):
>|   31 80 64 c0  7d b3 bc ed  de a3 65 75  0d a3 ae de
>|   f5 f5 91 9e
>| received NAT-D:  75 af b9 25  ea df 63 13  3f 59 63 ef  39 9a 8f f2
>| received NAT-D:  b0 53 d7 23
>| NAT_TRAVERSAL hash=1 (me:0) (him:0)
>| expected NAT-D(me):  3f 0c 28 16  1c 88 28 42  f4 87 46 30  f3 be 91 cc
>| expected NAT-D(me):  24 fc e2 b7
>| expected NAT-D(him):
>|   31 80 64 c0  7d b3 bc ed  de a3 65 75  0d a3 ae de
>|   f5 f5 91 9e
>| received NAT-D:  31 80 64 c0  7d b3 bc ed  de a3 65 75  0d a3 ae de
>| received NAT-D:  f5 f5 91 9e
>| NAT_TRAVERSAL hash=2 (me:0) (him:1)
>| NAT_TRAVERSAL nat_keepalive enabled
>"nm-conn1" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): i am NATed
>| inserting event EVENT_NAT_T_KEEPALIVE, timeout in 20 seconds
>| event added after event EVENT_RETRANSMIT for #1
>| started looking for secret for @RH-standard->66.187.233.55 of kind PPK_PSK
>| actually looking for secret for @RH-standard->66.187.233.55 of kind PPK_PSK
>| line 1: key type PPK_PSK(@RH-standard) to type PPK_PSK 
>| 1: compared key @RH-standard to @RH-standard / 66.187.233.55 -> 8
>| line 1: match=9 
>| best_match 0>9 best=0x7f2460f90340 (line=1)
>| concluding with best_match=9 best=0x7f2460f90340 (lineno=1)
>| parent1 type: 7 group: 5 len: 2776 
>| Copying DH pub key pointer to be sent to a thread helper
>| 2: w->pcw_dead: 0 w->pcw_work: 0 cnt: 3
>| asking helper 2 to do compute dh+iv op on seq: 2 (len=2776, pcw_work=1)
>| crypto helper write of request: cnt=2776<wlen=2776.  
>| deleting event for #1
>| inserting event EVENT_CRYPTO_FAILED, timeout in 300 seconds for #1
>| event added after event EVENT_PENDING_PHASE2
>| peer supports fragmentation
>| peer supports dpd
>| complete state transition with STF_SUSPEND
>| helper 2 read 2768+4/2776 bytes fd: 13
>| helper 2 doing compute dh+iv op id: 2
>| * processed 0 messages from cryptographic helpers 
>| next event EVENT_NAT_T_KEEPALIVE in 20 seconds
>| next event EVENT_NAT_T_KEEPALIVE in 20 seconds
>| peer's g:   d4 14 93 9d  ad 3c 14 2d  96 84 45 b7  49 b6 5a 19
>| peer's g:   6e d7 2c 34  71 dc c4 91  81 df 75 e7  0a df cf 2d
>| peer's g:   76 67 8c e0  12 d6 bd cb  bc f6 cf 82  5e 3a f1 f8
>| peer's g:   9c c5 bd b4  e3 02 eb c3  ec b6 51 02  a9 32 b5 b3
>| peer's g:   49 2d 52 8b  d0 8b 95 47  c3 ee 71 22  c0 7b 05 3c
>| peer's g:   36 80 b2 40  6a 73 04 89  c3 39 39 3d  fc 67 3a f9
>| peer's g:   33 21 21 8f  6b 0a 49 49  85 66 03 20  4a 5d 97 25
>| peer's g:   e9 d4 a4 3e  32 7f dd d2  8d 64 c4 95  7d 2a 76 cc
>| peer's g:   cc 2d a9 55  cc 55 b4 5b  1d 3e 31 d2  14 d1 bc 5b
>| peer's g:   f5 a0 6c 75  de 7b 4f 62  fa e4 0b 54  77 8b 87 12
>| peer's g:   6c 6e 3d 57  8c af 19 b3  20 d3 97 51  a2 f8 84 50
>| peer's g:   c2 b6 ba 5e  18 f2 96 21  f5 8f b8 ad  74 50 82 c4
>| Started DH shared-secret computation in NSS: 
>| Dropped no leading zeros 192
>| calc_dh_shared(): time elapsed (OAKLEY_GROUP_MODP1536): 645 usec
>| DH shared-secret (pointer):
>|   e0 16 00 4c  24 7f 00 00
>| NSS: skeyid inputs (pss+NI+NR+shared-secret) hasher: oakley_sha
>| shared-secret (pointer in chunk_t): 
>|   e0 16 00 4c  24 7f 00 00
>| ni:   16 6c f2 5b  c8 9c c5 c1  8d be 8f 5d  0a 3b 01 fd
>| nr:   b4 63 85 7e  1c df 69 25  95 e8 cd 83  86 0d 13 1c
>| nr:   a6 66 94 dd
>| NSS: st_skeyid in skeyid_preshared() (pointer): 
>|   f0 ac 00 4c  24 7f 00 00
>| NSS: Started key computation 
>| NSS: dh shared param len=8 
>| NSS: enc keysize=16 
>| NSS: copied skeyid_d_chunk 
>| NSS: copied skeyid_a_chunk 
>| NSS: copied skeyid_e_chunk 
>| NSS: copied enc_key_chunk 
>| NSS: Freed symkeys 1-23 
>| NSS: Freed padding chunks 
>| DH_i:  7c 54 ed e2  73 bb a4 4d  b2 ba d0 c9  79 7b 0f 4f
>| DH_i:  51 c9 ae 1a  b6 84 37 89  41 4c 7a 0a  ed fe 2a bc
>| DH_i:  0d 90 13 7f  66 5c 8b 9e  f3 c2 ce 13  0c 56 16 41
>| DH_i:  35 64 6c a0  ca e5 31 c2  d8 bc f6 66  f9 f0 dd 07
>| DH_i:  db 0c cc 72  07 42 64 1c  64 a5 7c 1f  ea 33 b7 20
>| DH_i:  5c 47 62 13  ce 80 dc a5  26 7a 6e f5  6d 28 ff ff
>| DH_i:  22 f0 fe 06  85 8e 79 46  a1 12 e7 d9  f4 d7 9b f6
>| DH_i:  a9 c4 6e 93  cd 60 a3 f7  30 46 48 6c  f2 29 35 a7
>| DH_i:  66 77 d7 84  ce 60 d3 52  55 97 e9 9e  48 33 65 43
>| DH_i:  72 d7 da 18  5b 23 ac 70  13 fb 9b d0  05 12 8a 35
>| DH_i:  8f 02 70 1b  74 2d 09 cd  22 ca 9f 11  8a f9 fb fa
>| DH_i:  05 f9 2b ab  48 d7 d9 00  e6 e3 26 9e  47 47 88 2c
>| DH_r:  d4 14 93 9d  ad 3c 14 2d  96 84 45 b7  49 b6 5a 19
>| DH_r:  6e d7 2c 34  71 dc c4 91  81 df 75 e7  0a df cf 2d
>| DH_r:  76 67 8c e0  12 d6 bd cb  bc f6 cf 82  5e 3a f1 f8
>| DH_r:  9c c5 bd b4  e3 02 eb c3  ec b6 51 02  a9 32 b5 b3
>| DH_r:  49 2d 52 8b  d0 8b 95 47  c3 ee 71 22  c0 7b 05 3c
>| DH_r:  36 80 b2 40  6a 73 04 89  c3 39 39 3d  fc 67 3a f9
>| DH_r:  33 21 21 8f  6b 0a 49 49  85 66 03 20  4a 5d 97 25
>| DH_r:  e9 d4 a4 3e  32 7f dd d2  8d 64 c4 95  7d 2a 76 cc
>| DH_r:  cc 2d a9 55  cc 55 b4 5b  1d 3e 31 d2  14 d1 bc 5b
>| DH_r:  f5 a0 6c 75  de 7b 4f 62  fa e4 0b 54  77 8b 87 12
>| DH_r:  6c 6e 3d 57  8c af 19 b3  20 d3 97 51  a2 f8 84 50
>| DH_r:  c2 b6 ba 5e  18 f2 96 21  f5 8f b8 ad  74 50 82 c4
>| end of IV generation 
>|  
>| helper 2 has finished work (cnt now 1)
>| helper 2 replies to id: q#2
>| calling callback function 0x7f245f019f20
>| aggr inR1_outI2: calculated DH, sending I2
>| processing connection nm-conn1
>| hmac_update data value: 
>|   d4 14 93 9d  ad 3c 14 2d  96 84 45 b7  49 b6 5a 19
>|   6e d7 2c 34  71 dc c4 91  81 df 75 e7  0a df cf 2d
>|   76 67 8c e0  12 d6 bd cb  bc f6 cf 82  5e 3a f1 f8
>|   9c c5 bd b4  e3 02 eb c3  ec b6 51 02  a9 32 b5 b3
>|   49 2d 52 8b  d0 8b 95 47  c3 ee 71 22  c0 7b 05 3c
>|   36 80 b2 40  6a 73 04 89  c3 39 39 3d  fc 67 3a f9
>|   33 21 21 8f  6b 0a 49 49  85 66 03 20  4a 5d 97 25
>|   e9 d4 a4 3e  32 7f dd d2  8d 64 c4 95  7d 2a 76 cc
>|   cc 2d a9 55  cc 55 b4 5b  1d 3e 31 d2  14 d1 bc 5b
>|   f5 a0 6c 75  de 7b 4f 62  fa e4 0b 54  77 8b 87 12
>|   6c 6e 3d 57  8c af 19 b3  20 d3 97 51  a2 f8 84 50
>|   c2 b6 ba 5e  18 f2 96 21  f5 8f b8 ad  74 50 82 c4
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   7c 54 ed e2  73 bb a4 4d  b2 ba d0 c9  79 7b 0f 4f
>|   51 c9 ae 1a  b6 84 37 89  41 4c 7a 0a  ed fe 2a bc
>|   0d 90 13 7f  66 5c 8b 9e  f3 c2 ce 13  0c 56 16 41
>|   35 64 6c a0  ca e5 31 c2  d8 bc f6 66  f9 f0 dd 07
>|   db 0c cc 72  07 42 64 1c  64 a5 7c 1f  ea 33 b7 20
>|   5c 47 62 13  ce 80 dc a5  26 7a 6e f5  6d 28 ff ff
>|   22 f0 fe 06  85 8e 79 46  a1 12 e7 d9  f4 d7 9b f6
>|   a9 c4 6e 93  cd 60 a3 f7  30 46 48 6c  f2 29 35 a7
>|   66 77 d7 84  ce 60 d3 52  55 97 e9 9e  48 33 65 43
>|   72 d7 da 18  5b 23 ac 70  13 fb 9b d0  05 12 8a 35
>|   8f 02 70 1b  74 2d 09 cd  22 ca 9f 11  8a f9 fb fa
>|   05 f9 2b ab  48 d7 d9 00  e6 e3 26 9e  47 47 88 2c
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   8f f3 67 d1  55 1e fb 18
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   ff d8 a9 fb  b4 2c 8d c7
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hashing 52 bytes of SA
>| hmac_update data value: 
>|   00 00 00 01  00 00 00 01  00 00 00 2c  00 01 00 01
>|   00 00 00 24  00 01 00 00  80 0b 00 01  00 0c 00 04
>|   00 01 51 80  80 01 00 07  80 02 00 02  80 03 fd e9
>|   80 04 00 05
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   01 11 00 00  42 bb e9 37
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| authentication succeeded
>| **emit ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_AGGR
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  00 00 00 00
>| sending NAT-D payloads
>| natd_hash: hasher=0x7f245f2b71a0(20)
>| natd_hash: icookie=  ff d8 a9 fb  b4 2c 8d c7
>| natd_hash: rcookie=  8f f3 67 d1  55 1e fb 18
>| natd_hash: ip=  42 bb e9 37
>| natd_hash: port=500
>| natd_hash: hash=  31 80 64 c0  7d b3 bc ed  de a3 65 75  0d a3 ae de
>| natd_hash: hash=  f5 f5 91 9e
>| ***emit ISAKMP NAT-D Payload:
>|    next payload type: ISAKMP_NEXT_NATD_RFC
>| emitting 20 raw bytes of NAT-D into ISAKMP NAT-D Payload
>| NAT-D  31 80 64 c0  7d b3 bc ed  de a3 65 75  0d a3 ae de
>| NAT-D  f5 f5 91 9e
>| emitting length of ISAKMP NAT-D Payload: 24
>| natd_hash: hasher=0x7f245f2b71a0(20)
>| natd_hash: icookie=  ff d8 a9 fb  b4 2c 8d c7
>| natd_hash: rcookie=  8f f3 67 d1  55 1e fb 18
>| natd_hash: ip=  0a c8 8a 45
>| natd_hash: port=500
>| natd_hash: hash=  3f 0c 28 16  1c 88 28 42  f4 87 46 30  f3 be 91 cc
>| natd_hash: hash=  24 fc e2 b7
>| ***emit ISAKMP NAT-D Payload:
>|    next payload type: ISAKMP_NEXT_HASH
>| emitting 20 raw bytes of NAT-D into ISAKMP NAT-D Payload
>| NAT-D  3f 0c 28 16  1c 88 28 42  f4 87 46 30  f3 be 91 cc
>| NAT-D  24 fc e2 b7
>| emitting length of ISAKMP NAT-D Payload: 24
>| **emit ISAKMP Identification Payload (IPsec DOI):
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 0
>|    ID type: ID_FQDN
>|    Protocol ID: 0
>|    port: 0
>| emitting length of ISAKMP Identification Payload (IPsec DOI): 8
>| emitting 11 raw bytes of my identity into identity payload
>| my identity  52 48 2d 73  74 61 6e 64  61 72 64
>| hmac_update data value: 
>|   7c 54 ed e2  73 bb a4 4d  b2 ba d0 c9  79 7b 0f 4f
>|   51 c9 ae 1a  b6 84 37 89  41 4c 7a 0a  ed fe 2a bc
>|   0d 90 13 7f  66 5c 8b 9e  f3 c2 ce 13  0c 56 16 41
>|   35 64 6c a0  ca e5 31 c2  d8 bc f6 66  f9 f0 dd 07
>|   db 0c cc 72  07 42 64 1c  64 a5 7c 1f  ea 33 b7 20
>|   5c 47 62 13  ce 80 dc a5  26 7a 6e f5  6d 28 ff ff
>|   22 f0 fe 06  85 8e 79 46  a1 12 e7 d9  f4 d7 9b f6
>|   a9 c4 6e 93  cd 60 a3 f7  30 46 48 6c  f2 29 35 a7
>|   66 77 d7 84  ce 60 d3 52  55 97 e9 9e  48 33 65 43
>|   72 d7 da 18  5b 23 ac 70  13 fb 9b d0  05 12 8a 35
>|   8f 02 70 1b  74 2d 09 cd  22 ca 9f 11  8a f9 fb fa
>|   05 f9 2b ab  48 d7 d9 00  e6 e3 26 9e  47 47 88 2c
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   d4 14 93 9d  ad 3c 14 2d  96 84 45 b7  49 b6 5a 19
>|   6e d7 2c 34  71 dc c4 91  81 df 75 e7  0a df cf 2d
>|   76 67 8c e0  12 d6 bd cb  bc f6 cf 82  5e 3a f1 f8
>|   9c c5 bd b4  e3 02 eb c3  ec b6 51 02  a9 32 b5 b3
>|   49 2d 52 8b  d0 8b 95 47  c3 ee 71 22  c0 7b 05 3c
>|   36 80 b2 40  6a 73 04 89  c3 39 39 3d  fc 67 3a f9
>|   33 21 21 8f  6b 0a 49 49  85 66 03 20  4a 5d 97 25
>|   e9 d4 a4 3e  32 7f dd d2  8d 64 c4 95  7d 2a 76 cc
>|   cc 2d a9 55  cc 55 b4 5b  1d 3e 31 d2  14 d1 bc 5b
>|   f5 a0 6c 75  de 7b 4f 62  fa e4 0b 54  77 8b 87 12
>|   6c 6e 3d 57  8c af 19 b3  20 d3 97 51  a2 f8 84 50
>|   c2 b6 ba 5e  18 f2 96 21  f5 8f b8 ad  74 50 82 c4
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   ff d8 a9 fb  b4 2c 8d c7
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   8f f3 67 d1  55 1e fb 18
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hashing 52 bytes of SA
>| hmac_update data value: 
>|   00 00 00 01  00 00 00 01  00 00 00 2c  00 01 00 01
>|   00 00 00 24  00 01 00 00  80 0b 00 01  00 0c 00 04
>|   00 01 51 80  80 01 00 07  80 02 00 02  80 03 fd e9
>|   80 04 00 05
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   02 00 00 00  52 48 2d 73  74 61 6e 64  61 72 64
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| ***emit ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>| emitting 20 raw bytes of HASH_I into ISAKMP Hash Payload
>| HASH_I  20 fd ee 2c  1e 21 d1 34  e7 b6 c9 91  89 90 3b c9
>| HASH_I  d4 5f 62 60
>| emitting length of ISAKMP Hash Payload: 24
>| encrypting:
>|   14 00 00 18  31 80 64 c0  7d b3 bc ed  de a3 65 75
>|   0d a3 ae de  f5 f5 91 9e  08 00 00 18  3f 0c 28 16
>|   1c 88 28 42  f4 87 46 30  f3 be 91 cc  24 fc e2 b7
>|   00 00 00 18  20 fd ee 2c  1e 21 d1 34  e7 b6 c9 91
>|   89 90 3b c9  d4 5f 62 60
>| IV:
>|   a1 ea 9d 9f  50 93 0f e5  1f a5 6c a1  dd a7 23 76
>|   f0 e5 6a 1a
>| unpadded size is: 72
>| emitting 8 zero bytes of encryption padding into ISAKMP Message
>| encrypting 80 using OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| next IV:  12 68 c0 bf  06 2a a5 c2  03 92 fb 2a  22 4c 3d 34
>| no IKE message padding required
>| emitting length of ISAKMP Message: 108
>| peer supports fragmentation
>| complete state transition with STF_OK
>"nm-conn1" #1: transition from state STATE_AGGR_I1 to state STATE_AGGR_I2
>| deleting event for #1
>| NAT-T: floating to port 4500
>| NAT-T connection has wrong interface definition 10.200.138.69:4500 vs 10.200.138.69:500
>| NAT-T: using interface wlp3s0:4500
>| sending reply packet to 66.187.233.55:4500 (from port 4500)
>| sending 112 bytes for STATE_AGGR_I1 through wlp3s0:4500 to 66.187.233.55:4500 (using #1)
>|   00 00 00 00  ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1
>|   55 1e fb 18  14 10 04 01  00 00 00 00  00 00 00 6c
>|   bb c7 ed 40  b1 ab d1 80  19 1a 34 e7  57 5c 44 51
>|   04 cb c4 07  99 02 fc 35  90 32 e7 68  fa 4f d9 e6
>|   0a 66 f2 bf  00 7c 84 c8  d0 76 89 d6  7c 81 98 64
>|   51 21 bb c8  2b a3 98 05  d1 d7 3c 46  b6 80 ab a6
>|   12 68 c0 bf  06 2a a5 c2  03 92 fb 2a  22 4c 3d 34
>| inserting event EVENT_SA_REPLACE, timeout in 85407 seconds for #1
>| event added after event EVENT_LOG_DAILY
>"nm-conn1" #1: STATE_AGGR_I2: sent AI2, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_128 prf=oakley_sha group=modp1536}
>| XAUTH client is not yet authenticated
>| * processed 1 messages from cryptographic helpers 
>| next event EVENT_NAT_T_KEEPALIVE in 20 seconds
>| next event EVENT_NAT_T_KEEPALIVE in 20 seconds
>|  
>| *received 108 bytes from 66.187.233.55:4500 on wlp3s0 (port=4500)
>|   ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1  55 1e fb 18
>|   08 10 06 01  09 be c4 38  00 00 00 6c  50 89 c4 ab
>|   ed 6b 31 e0  15 23 52 08  e3 e8 0e 9a  9b e0 9a a9
>|   1e d4 9b dd  41 d1 c0 3a  63 9d b7 b1  94 f0 86 12
>|   62 a0 6e fa  30 82 31 78  0c a0 82 51  f7 26 7a ba
>|   b7 16 51 e8  58 7b 6b 86  4b 76 02 dd  b3 6e b4 92
>|   e3 f4 36 33  58 9e ea 3d  16 72 11 38
>| **parse ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_MODE_CFG
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  09 be c4 38
>|    length: 108
>|  processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6)
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| peer and cookies match on #1, provided msgid 09bec438 vs 00000000/00000000
>| p15 state object not found
>|  in process_v1_packet:1295 No appropriate Mode Config state yet.See if we have a Main Mode state
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| peer and cookies match on #1, provided msgid 00000000 vs 00000000/00000000
>| p15 state object #1 found, in STATE_AGGR_I2
>| processing connection nm-conn1
>|  processing received isakmp_xchg_type ISAKMP_XCHG_MODE_CFG.
>|  this is a xauthclient modecfgclient
>|  call  init_phase2_iv
>| last Phase 1 IV:  12 68 c0 bf  06 2a a5 c2  03 92 fb 2a  22 4c 3d 34
>| current Phase 1 IV:  12 68 c0 bf  06 2a a5 c2  03 92 fb 2a  22 4c 3d 34
>| computed Phase 2 IV:
>|   f4 23 7f 0a  c9 8f 64 a4  f1 57 c3 4d  4c 31 cc 6d
>|   b0 a8 da aa
>|  set from_state to STATE_AGGR_I2 this is xauthclient and IS_PHASE1() is TRUE
>| received encrypted packet from 66.187.233.55:4500
>| decrypting 80 bytes using algorithm OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| decrypted:
>|   0e 00 00 18  d7 83 3b c0  fd 4a 3c 00  e9 a1 c2 c0
>|   fb 15 bd e7  33 2b 5d c3  00 00 00 34  01 00 00 00
>|   c0 88 00 00  40 89 00 00  40 8a 00 00  40 8c 00 1c
>|   45 6e 74 65  72 20 55 73  65 72 6e 61  6d 65 20 61
>|   6e 64 20 50  61 73 73 77  6f 72 64 2e  00 00 00 00
>| next IV:  b3 6e b4 92  e3 f4 36 33  58 9e ea 3d  16 72 11 38
>| got payload 0x100  (ISAKMP_NEXT_HASH) needed: 0x4100opt: 0x2000
>| ***parse ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_MODECFG
>|    length: 24
>| got payload 0x4000  (ISAKMP_NEXT_MODECFG) needed: 0x4000opt: 0x2000
>| ***parse ISAKMP Mode Attribute:
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 52
>|    Attr Msg Type: ISAKMP_CFG_REQUEST
>|    Identifier: 0
>| removing 4 bytes of padding
>| **emit ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_MODE_CFG
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  09 be c4 38
>| arrived in xauth_inI0
>| hmac_update data value: 
>|   09 be c4 38
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   00 00 00 34  01 00 00 00  c0 88 00 00  40 89 00 00
>|   40 8a 00 00  40 8c 00 1c  45 6e 74 65  72 20 55 73
>|   65 72 6e 61  6d 65 20 61  6e 64 20 50  61 73 73 77
>|   6f 72 64 2e
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| XAUTH: HASH computed:
>|   d7 83 3b c0  fd 4a 3c 00  e9 a1 c2 c0  fb 15 bd e7
>|   33 2b 5d c3
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 49288??
>|    length/value: 0
>| Received Cisco XAUTH type: Generic
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 16521??
>|    length/value: 0
>| Received Cisco XAUTH username
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 16522??
>|    length/value: 0
>| Received Cisco XAUTH password
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 16524??
>|    length/value: 28
>| Received Cisco XAUTH message
>"nm-conn1" #1: XAUTH Message: Enter Username and Password.
>| XAUTH: Username or password request received
>| ***emit ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_MODECFG
>| emitting 20 zero bytes of HASH into ISAKMP Hash Payload
>| emitting length of ISAKMP Hash Payload: 24
>| ***emit ISAKMP Mode Attribute:
>|    next payload type: ISAKMP_NEXT_NONE
>|    Attr Msg Type: ISAKMP_CFG_REPLY
>|    Identifier: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 49288??
>|    length/value: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 16521??
>| emitting 8 raw bytes of XAUTH username into ISAKMP ModeCfg attribute
>| XAUTH username  6a 72 75 73  6e 61 63 6b
>| emitting length of ISAKMP ModeCfg attribute: 8
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 16522??
>| started looking for xauth secret for jrusnack
>| line 1: key type PPK_XAUTH(@jrusnack) to type PPK_PSK 
>| concluding with best_match=0 best=(nil) (lineno=-1)
>| looked up username=jrusnack, got=(nil)
>| prompting for Password:
>| emitting 14 raw bytes of XAUTH password into ISAKMP ModeCfg attribute
>| XAUTH password  67 77 61 69  68 69 72 32  35 34 39 38  32 35
>| emitting length of ISAKMP ModeCfg attribute: 14
>| emitting length of ISAKMP Mode Attribute: 42
>"nm-conn1" #1: XAUTH: Answering XAUTH challenge with user='jrusnack'
>| hmac_update data value: 
>|   09 be c4 38
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   00 00 00 2a  02 00 00 00  c0 88 00 00  40 89 00 08
>|   6a 72 75 73  6e 61 63 6b  40 8a 00 0e  67 77 61 69
>|   68 69 72 32  35 34 39 38  32 35
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| XAUTH: HASH computed:
>|   cd 79 45 21  36 47 57 ea  04 ba 84 87  53 88 3f 8c
>|   95 af f2 d6
>| padding IKE message with 2 bytes
>| emitting 2 zero bytes of message padding into ISAKMP Message
>| emitting length of ISAKMP Message: 96
>| encrypting:
>|   0e 00 00 18  cd 79 45 21  36 47 57 ea  04 ba 84 87
>|   53 88 3f 8c  95 af f2 d6  00 00 00 2a  02 00 00 00
>|   c0 88 00 00  40 89 00 08  6a 72 75 73  6e 61 63 6b
>|   40 8a 00 0e  67 77 61 69  68 69 72 32  35 34 39 38
>|   32 35 00 00
>| IV:
>|   b3 6e b4 92  e3 f4 36 33  58 9e ea 3d  16 72 11 38
>| unpadded size is: 68
>| emitting 12 zero bytes of encryption padding into ISAKMP Message
>| encrypting 80 using OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| next IV:  f5 69 3c 3d  e2 6d de 0f  7d 4b 1a c9  cd 44 7f 1c
>| no IKE message padding required
>| emitting length of ISAKMP Message: 108
>| xauth_inI0(STF_OK)
>| complete state transition with STF_OK
>"nm-conn1" #1: transition from state STATE_XAUTH_I0 to state STATE_XAUTH_I1
>| deleting event for #1
>| sending reply packet to 66.187.233.55:4500 (from port 4500)
>| sending 112 bytes for STATE_XAUTH_I0 through wlp3s0:4500 to 66.187.233.55:4500 (using #1)
>|   00 00 00 00  ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1
>|   55 1e fb 18  08 10 06 01  09 be c4 38  00 00 00 6c
>|   f5 19 5c 28  bd 7e d3 77  b9 95 b2 64  65 8a c9 20
>|   ea 11 58 cb  f6 aa 7a 46  c0 4e 9d fd  d9 87 d4 1a
>|   7f 7a cd f6  26 9b eb 8e  f6 48 af 05  c6 a4 f9 3b
>|   9f 14 f6 4f  45 70 eb 98  eb d7 d5 63  ed f0 cb ea
>|   f5 69 3c 3d  e2 6d de 0f  7d 4b 1a c9  cd 44 7f 1c
>| inserting event EVENT_SA_REPLACE, timeout in 86130 seconds for #1
>| event added after event EVENT_LOG_DAILY
>"nm-conn1" #1: STATE_XAUTH_I1: XAUTH client - awaiting CFG_set
>| XAUTH client is not yet authenticated
>| * processed 0 messages from cryptographic helpers 
>| next event EVENT_NAT_T_KEEPALIVE in 20 seconds
>| next event EVENT_NAT_T_KEEPALIVE in 20 seconds
>|  
>| *received 76 bytes from 66.187.233.55:4500 on wlp3s0 (port=4500)
>|   ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1  55 1e fb 18
>|   08 10 06 01  b8 29 f4 01  00 00 00 4c  fb 42 20 24
>|   89 91 02 ec  d7 c1 d4 d7  8b b6 74 e4  c6 87 e2 49
>|   f3 5e 90 3c  b5 18 11 2d  e1 23 d4 49  7c f2 cf 22
>|   41 81 f9 41  21 db ec 9f  42 13 49 3b
>| **parse ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_MODE_CFG
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  b8 29 f4 01
>|    length: 76
>|  processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6)
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| peer and cookies match on #1, provided msgid b829f401 vs 00000000/00000000
>| p15 state object not found
>|  in process_v1_packet:1295 No appropriate Mode Config state yet.See if we have a Main Mode state
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| peer and cookies match on #1, provided msgid 00000000 vs 00000000/00000000
>| p15 state object #1 found, in STATE_XAUTH_I1
>| processing connection nm-conn1
>|  processing received isakmp_xchg_type ISAKMP_XCHG_MODE_CFG.
>|  this is a xauthclient modecfgclient
>|  call  init_phase2_iv
>| last Phase 1 IV:  12 68 c0 bf  06 2a a5 c2  03 92 fb 2a  22 4c 3d 34
>| current Phase 1 IV:  f5 69 3c 3d  e2 6d de 0f  7d 4b 1a c9  cd 44 7f 1c
>| computed Phase 2 IV:
>|   60 4c cf c7  16 c4 f0 2f  9e ed f1 be  05 8e 46 d8
>|   c9 54 1f 07
>|  set from_state to STATE_XAUTH_I1 this is xauthclient and state == STATE_XAUTH_I1
>| received encrypted packet from 66.187.233.55:4500
>| decrypting 48 bytes using algorithm OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| decrypted:
>|   0e 00 00 18  f2 c5 08 11  c9 f7 58 a5  8e 5f c0 a5
>|   d3 59 ab 3d  50 61 9d f9  00 00 00 0c  03 00 00 00
>|   c0 8f 00 01  00 00 00 00  00 00 00 00  00 00 00 00
>| next IV:  7c f2 cf 22  41 81 f9 41  21 db ec 9f  42 13 49 3b
>| got payload 0x100  (ISAKMP_NEXT_HASH) needed: 0x4100opt: 0x2000
>| ***parse ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_MODECFG
>|    length: 24
>| got payload 0x4000  (ISAKMP_NEXT_MODECFG) needed: 0x4000opt: 0x2000
>| ***parse ISAKMP Mode Attribute:
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 12
>|    Attr Msg Type: ISAKMP_CFG_SET
>|    Identifier: 0
>| removing 12 bytes of padding
>| **emit ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_MODE_CFG
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  b8 29 f4 01
>| arrived in xauth_inI0
>| hmac_update data value: 
>|   b8 29 f4 01
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   00 00 00 0c  03 00 00 00  c0 8f 00 01
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| XAUTH: HASH computed:
>|   f2 c5 08 11  c9 f7 58 a5  8e 5f c0 a5  d3 59 ab 3d
>|   50 61 9d f9
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 49295??
>|    length/value: 1
>| Received Cisco XAUTH status
>| ***emit ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_MODECFG
>| emitting 20 zero bytes of HASH into ISAKMP Hash Payload
>| emitting length of ISAKMP Hash Payload: 24
>| ***emit ISAKMP Mode Attribute:
>|    next payload type: ISAKMP_NEXT_NONE
>|    Attr Msg Type: ISAKMP_CFG_ACK
>|    Identifier: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: 49295??
>|    length/value: 1
>| no IKE message padding required
>| emitting length of ISAKMP Mode Attribute: 12
>| hmac_update data value: 
>|   b8 29 f4 01
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   00 00 00 0c  04 00 00 00  c0 8f 00 01
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| XAUTH: HASH computed:
>|   0e 7a 3d bf  2d 19 a7 f2  3f 0d 4b 0e  25 87 8e 7d
>|   bc 1e eb d6
>| no IKE message padding required
>| emitting length of ISAKMP Message: 64
>| encrypting:
>|   0e 00 00 18  0e 7a 3d bf  2d 19 a7 f2  3f 0d 4b 0e
>|   25 87 8e 7d  bc 1e eb d6  00 00 00 0c  04 00 00 00
>|   c0 8f 00 01
>| IV:
>|   7c f2 cf 22  41 81 f9 41  21 db ec 9f  42 13 49 3b
>| unpadded size is: 36
>| emitting 12 zero bytes of encryption padding into ISAKMP Message
>| encrypting 48 using OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| next IV:  04 99 ca 8f  14 5b c0 ba  d1 2d be da  55 cc 8b 89
>| no IKE message padding required
>| emitting length of ISAKMP Message: 76
>"nm-conn1" #1: XAUTH: Successfully Authenticated
>| complete state transition with STF_OK
>"nm-conn1" #1: transition from state STATE_XAUTH_I0 to state STATE_XAUTH_I1
>| deleting event for #1
>| sending reply packet to 66.187.233.55:4500 (from port 4500)
>| sending 80 bytes for STATE_XAUTH_I0 through wlp3s0:4500 to 66.187.233.55:4500 (using #1)
>|   00 00 00 00  ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1
>|   55 1e fb 18  08 10 06 01  b8 29 f4 01  00 00 00 4c
>|   eb 5a 03 a2  46 37 0f 05  48 ce 8c 77  09 e8 62 2c
>|   6f a8 a1 09  3e 2c c7 71  7e 2a b1 2b  b3 bf bf d6
>|   04 99 ca 8f  14 5b c0 ba  d1 2d be da  55 cc 8b 89
>| inserting event EVENT_SA_REPLACE, timeout in 86130 seconds for #1
>| event added after event EVENT_LOG_DAILY
>"nm-conn1" #1: STATE_XAUTH_I1: XAUTH client - awaiting CFG_set
>| modecfg pull: quirk-poll policy:push modecfg-client
>| modecfg client is starting due to quirk
>"nm-conn1" #1: modecfg: Sending IP request (MODECFG_I1)
>| **emit ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_MODE_CFG
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  d2 b9 89 d8
>| ***emit ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_MODECFG
>| emitting 20 zero bytes of HASH into ISAKMP Hash Payload
>| emitting length of ISAKMP Hash Payload: 24
>| ***emit ISAKMP Mode Attribute:
>|    next payload type: ISAKMP_NEXT_NONE
>|    Attr Msg Type: ISAKMP_CFG_REQUEST
>|    Identifier: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: INTERNAL_IP4_ADDRESS
>|    length/value: 0
>| emitting length of ISAKMP ModeCfg attribute: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: INTERNAL_IP4_NETMASK
>|    length/value: 0
>| emitting length of ISAKMP ModeCfg attribute: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: INTERNAL_IP4_DNS
>|    length/value: 0
>| emitting length of ISAKMP ModeCfg attribute: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: MODECFG_BANNER
>|    length/value: 0
>| emitting length of ISAKMP ModeCfg attribute: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: MODECFG_DOMAIN
>|    length/value: 0
>| emitting length of ISAKMP ModeCfg attribute: 0
>| ****emit ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: CISCO_SPLIT_INC
>|    length/value: 0
>| emitting length of ISAKMP ModeCfg attribute: 0
>| no IKE message padding required
>| emitting length of ISAKMP Mode Attribute: 32
>| hmac_update data value: 
>|   d2 b9 89 d8
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   00 00 00 20  01 00 00 00  00 01 00 00  00 02 00 00
>|   00 03 00 00  70 00 00 00  70 02 00 00  70 04 00 00
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| XAUTH: HASH computed:
>|   71 59 37 95  b2 39 26 8f  e4 23 3a ab  e6 00 9f 65
>|   cf d3 3e 0d
>| no IKE message padding required
>| emitting length of ISAKMP Message: 84
>| last Phase 1 IV:  12 68 c0 bf  06 2a a5 c2  03 92 fb 2a  22 4c 3d 34
>| current Phase 1 IV:  04 99 ca 8f  14 5b c0 ba  d1 2d be da  55 cc 8b 89
>| computed Phase 2 IV:
>|   c7 2f e5 80  ac 52 48 64  dc 15 f7 e4  04 9a 85 99
>|   23 93 ff df
>| encrypting:
>|   0e 00 00 18  71 59 37 95  b2 39 26 8f  e4 23 3a ab
>|   e6 00 9f 65  cf d3 3e 0d  00 00 00 20  01 00 00 00
>|   00 01 00 00  00 02 00 00  00 03 00 00  70 00 00 00
>|   70 02 00 00  70 04 00 00
>| IV:
>|   c7 2f e5 80  ac 52 48 64  dc 15 f7 e4  04 9a 85 99
>|   23 93 ff df
>| unpadded size is: 56
>| emitting 8 zero bytes of encryption padding into ISAKMP Message
>| encrypting 64 using OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| next IV:  d1 74 25 c3  e1 68 aa 40  be ff 1b c4  7b dd 76 c3
>| no IKE message padding required
>| emitting length of ISAKMP Message: 92
>| sending 96 bytes for modecfg: req through wlp3s0:4500 to 66.187.233.55:4500 (using #1)
>|   00 00 00 00  ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1
>|   55 1e fb 18  08 10 06 01  d2 b9 89 d8  00 00 00 5c
>|   d2 31 c4 cd  fe 41 db 50  5d 00 11 12  9a 2e 78 5c
>|   96 f2 76 02  c9 cd f8 7b  87 54 9a b3  16 ac 49 bc
>|   ad 70 40 c2  81 9c f5 91  e1 9b 11 aa  bb f1 62 67
>|   d1 74 25 c3  e1 68 aa 40  be ff 1b c4  7b dd 76 c3
>| deleting event for #1
>| inserting event EVENT_RETRANSMIT, timeout in 30 seconds for #1
>| event added after event EVENT_NAT_T_KEEPALIVE
>| * processed 0 messages from cryptographic helpers 
>| next event EVENT_NAT_T_KEEPALIVE in 19 seconds
>| next event EVENT_NAT_T_KEEPALIVE in 19 seconds
>|  
>| *received 252 bytes from 66.187.233.55:4500 on wlp3s0 (port=4500)
>|   ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1  55 1e fb 18
>|   08 10 06 01  d2 b9 89 d8  00 00 00 fc  e6 76 51 52
>|   85 3c bd b5  02 bc 9a 4f  e9 df 4e fa  45 9d 25 25
>|   9b 4f 67 dd  9a 37 c7 f8  6a c7 7c 70  f3 59 0f 8f
>|   de 93 da a5  98 34 43 45  a7 e0 19 cc  8e 5d df dd
>|   2e bc 29 de  6c 86 9f 1f  e7 34 35 05  3e 56 e8 3b
>|   75 a2 8f b6  07 7b 9b d6  34 b1 e0 aa  f9 a7 c6 18
>|   33 5a 43 d9  5f 52 37 62  44 15 5b e2  07 0e 92 3f
>|   cf 4b c7 6d  68 5b 16 b0  c9 e4 98 23  0e 35 f4 f5
>|   4c 2e c6 90  67 81 8e 2a  ee 08 d8 a1  f4 ca 74 0b
>|   e3 9f c8 ef  0e 5a 41 be  81 06 19 3c  b3 9f 4c 81
>|   2a 75 41 bb  57 28 eb 9d  32 f9 d7 3b  2c 75 5e 30
>|   a1 d5 0d ca  35 63 58 ac  62 a7 64 f1  b7 ee e7 dd
>|   ee 2e 96 9c  19 82 2b 78  90 ea 3f 2b  eb 0f f8 a4
>|   f8 8b 44 fb  6d 6c c2 5f  d8 bf a9 f8  ec c2 5e 95
>|   d0 27 fc 64  f3 7e 3d 8c  76 58 60 f5
>| **parse ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_MODE_CFG
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  d2 b9 89 d8
>|    length: 252
>|  processing version=1.0 packet with exchange type=ISAKMP_XCHG_MODE_CFG (6)
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| peer and cookies match on #1, provided msgid d2b989d8 vs 00000000/d2b989d8
>| p15 state object #1 found, in STATE_MODE_CFG_I1
>| processing connection nm-conn1
>| received encrypted packet from 66.187.233.55:4500
>| decrypting 224 bytes using algorithm OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| decrypted:
>|   0e 00 00 18  70 92 86 2a  58 ec 7d b8  2e 44 84 15
>|   a0 83 de dc  80 55 c9 e6  00 00 00 bf  02 00 00 00
>|   00 01 00 04  0a 0a 3f 2d  00 02 00 04  ff ff ff ff
>|   00 03 00 04  0a 0b 05 13  00 03 00 04  0a 05 1e a0
>|   70 00 00 73  55 6e 61 75  74 68 6f 72  69 7a 65 64
>|   20 41 63 63  65 73 73 20  74 6f 20 74  68 69 73 20
>|   6f 72 20 61  6e 79 20 6f  74 68 65 72  20 52 65 64
>|   20 48 61 74  20 49 6e 63  2e 20 64 65  76 69 63 65
>|   0a 69 73 20  73 74 72 69  63 74 6c 79  20 70 72 6f
>|   68 69 62 69  74 65 64 2e  20 56 69 6f  6c 61 74 6f
>|   72 73 20 77  69 6c 6c 20  62 65 20 70  72 6f 73 65
>|   63 75 74 65  64 2e 0a 70  04 00 0e 0a  00 00 00 ff
>|   00 00 00 00  00 00 00 00  00 70 02 00  0a 72 65 64
>|   68 61 74 2e  63 6f 6d 00  00 00 00 00  00 00 00 00
>| next IV:  ec c2 5e 95  d0 27 fc 64  f3 7e 3d 8c  76 58 60 f5
>| got payload 0x100  (ISAKMP_NEXT_HASH) needed: 0x4100opt: 0x2000
>| ***parse ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_MODECFG
>|    length: 24
>| got payload 0x4000  (ISAKMP_NEXT_MODECFG) needed: 0x4000opt: 0x2000
>| ***parse ISAKMP Mode Attribute:
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 191
>|    Attr Msg Type: ISAKMP_CFG_REPLY
>|    Identifier: 0
>| removing 9 bytes of padding
>| **emit ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_MODE_CFG
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  d2 b9 89 d8
>| modecfg_inR1
>"nm-conn1" #1: received mode cfg reply
>| hmac_update data value: 
>|   d2 b9 89 d8
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   00 00 00 bf  02 00 00 00  00 01 00 04  0a 0a 3f 2d
>|   00 02 00 04  ff ff ff ff  00 03 00 04  0a 0b 05 13
>|   00 03 00 04  0a 05 1e a0  70 00 00 73  55 6e 61 75
>|   74 68 6f 72  69 7a 65 64  20 41 63 63  65 73 73 20
>|   74 6f 20 74  68 69 73 20  6f 72 20 61  6e 79 20 6f
>|   74 68 65 72  20 52 65 64  20 48 61 74  20 49 6e 63
>|   2e 20 64 65  76 69 63 65  0a 69 73 20  73 74 72 69
>|   63 74 6c 79  20 70 72 6f  68 69 62 69  74 65 64 2e
>|   20 56 69 6f  6c 61 74 6f  72 73 20 77  69 6c 6c 20
>|   62 65 20 70  72 6f 73 65  63 75 74 65  64 2e 0a 70
>|   04 00 0e 0a  00 00 00 ff  00 00 00 00  00 00 00 00
>|   00 70 02 00  0a 72 65 64  68 61 74 2e  63 6f 6d
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| XAUTH: HASH computed:
>|   70 92 86 2a  58 ec 7d b8  2e 44 84 15  a0 83 de dc
>|   80 55 c9 e6
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: INTERNAL_IP4_ADDRESS
>|    length/value: 4
>"nm-conn1" #1: Received IPv4 address: 10.10.63.45/32
>"nm-conn1" #1: setting ip source address to 10.10.63.45/32
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: INTERNAL_IP4_NETMASK
>|    length/value: 4
>"nm-conn1" #1: Received IP4 NETMASK 255.255.255.255
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: INTERNAL_IP4_DNS
>|    length/value: 4
>"nm-conn1" #1: Received DNS 10.11.5.19
>| ModeCFG DNS info: 10.11.5.19, len=10
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: INTERNAL_IP4_DNS
>|    length/value: 4
>"nm-conn1" #1: Received DNS 10.5.30.160
>| ModeCFG DNS info: 10.11.5.19 10.5.30.160, len=22
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: MODECFG_BANNER
>|    length/value: 115
>"nm-conn1" #1: Received Cisco ModeCFG Banner: Unauthorized Access to this or any other Red Hat Inc. device is strictly prohibited. Violators will be prosecuted. 
>"nm-conn1" #1: Received Banner: Unauthorized Access to this or any other Red Hat Inc. device is strictly prohibited. Violators will be prosecuted. 
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: CISCO_SPLIT_INC
>|    length/value: 14
>| Received Cisco Split tunnel route(s)
>"nm-conn1" #1: Received subnet 10.0.0.0/8, maskbits 8
>| ****parse ISAKMP ModeCfg attribute:
>|    ModeCfg attr type: MODECFG_DOMAIN
>|    length/value: 10
>"nm-conn1" #1: Received Cisco ModeCFG Domain: redhat.com
>"nm-conn1" #1: Received Domain: redhat.com
>| modecfg_inR1(STF_OK)
>| complete state transition with STF_OK
>"nm-conn1" #1: transition from state STATE_MODE_CFG_I1 to state STATE_MAIN_I4
>| deleting event for #1
>| inserting event EVENT_SA_REPLACE, timeout in 86130 seconds for #1
>| event added after event EVENT_LOG_DAILY
>"nm-conn1" #1: STATE_MAIN_I4: ISAKMP SA established
>| modecfg pull: quirk-poll policy:push modecfg-client
>| phase 1 is done, looking for phase 2 to unpend
>| unpending state #1
>| unqueuing pending Quick Mode with 66.187.233.55 "nm-conn1" import:admin initiate
>| duplicating state object #1
>| creating state object #2 at 0x7f2460f94440
>| processing connection nm-conn1
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| inserting state object #2
>| inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #2
>| event added at head of queue
>| kernel_alg_esp_enc_ok(12,0): OK
>| kernel_alg_esp_enc_max_keylen():alg_id=12, keylen=32
>| kernel_alg_esp_auth_keylen(auth=2, sadb_aalg=3): a_keylen=20
>"nm-conn1" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG {using isakmp#1 msgid:8535c904 proposal=AES(12)_256-SHA1(2)_160 pfsgroup=OAKLEY_GROUP_MODP1024}
>| 0: w->pcw_dead: 0 w->pcw_work: 0 cnt: 3
>| asking helper 0 to do build_kenonce op on seq: 3 (len=2776, pcw_work=1)
>| crypto helper write of request: cnt=2776<wlen=2776.  
>| deleting event for #2
>| inserting event EVENT_CRYPTO_FAILED, timeout in 300 seconds for #2
>| event added after event EVENT_PENDING_PHASE2
>| removing pending policy for "none" {0x7f2460f92be0}
>| * processed 0 messages from cryptographic helpers 
>| next event EVENT_NAT_T_KEEPALIVE in 19 seconds
>| next event EVENT_NAT_T_KEEPALIVE in 19 seconds
>| helper 0 read 2768+4/2776 bytes fd: 8
>| helper 0 doing build_kenonce op id: 3
>| NSS: Value of Prime:
>|   ff ff ff ff  ff ff ff ff  c9 0f da a2  21 68 c2 34
>|   c4 c6 62 8b  80 dc 1c d1  29 02 4e 08  8a 67 cc 74
>|   02 0b be a6  3b 13 9b 22  51 4a 08 79  8e 34 04 dd
>|   ef 95 19 b3  cd 3a 43 1b  30 2b 0a 6d  f2 5f 14 37
>|   4f e1 35 6d  6d 51 c2 45  e4 85 b5 76  62 5e 7e c6
>|   f4 4c 42 e9  a6 37 ed 6b  0b ff 5c b6  f4 06 b7 ed
>|   ee 38 6b fb  5a 89 9f a5  ae 9f 24 11  7c 4b 1f e6
>|   49 28 66 51  ec e6 53 81  ff ff ff ff  ff ff ff ff
>| NSS: Value of base:
>|   02
>| NSS: generated dh priv and pub keys: 128 
>| NSS: Local DH secret (pointer):
>|   10 53 00 50  24 7f 00 00
>| NSS: Public DH value sent(computed in NSS):
>|   38 0c e6 48  da b5 d3 59  1e 1a ad e3  43 10 af 0e
>|   50 ef 4e e6  87 62 6c 2b  86 62 0d 15  a1 9b e7 17
>|   44 35 97 b6  6e d5 14 4c  99 b4 91 74  2a d4 06 66
>|   7b 1f 27 f5  8e 5b a6 d4  b0 ce 94 8e  24 dd 0d c8
>|   4a 62 70 27  ae 8f 9b 22  a2 2a 4e 18  27 6c 86 00
>|   ed 75 65 70  8f 3e 72 31  89 5a 1a ba  d5 e3 c9 51
>|   ce 59 67 87  cc a3 97 cf  12 12 46 d4  a1 46 4f aa
>|   d3 49 a3 57  a2 94 ba 90  b4 a8 13 13  90 78 1d 96
>| NSS: Local DH public value (pointer):
>|   00 4b 00 50  24 7f 00 00
>| Generated nonce:
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>|  
>| helper 0 has finished work (cnt now 1)
>| helper 0 replies to id: q#3
>| calling callback function 0x7f245efe0580
>| quick outI1: calculated ke+nonce, sending I1
>| processing connection nm-conn1
>| **emit ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_QUICK
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  04 c9 35 85
>| ***emit ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_SA
>| emitting 20 zero bytes of HASH into ISAKMP Hash Payload
>| emitting length of ISAKMP Hash Payload: 24
>| kernel_alg_db_new() initial trans_cnt=128
>| kernel_alg_db_new() will return p_new->protoid=3, p_new->trans_cnt=1
>| kernel_alg_db_new()     trans[0]: transid=12, attr_cnt=2, attrs[0].type=5, attrs[0].val=2
>| returning new proposal from esp_info
>| ***emit ISAKMP Security Association Payload:
>|    next payload type: ISAKMP_NEXT_NONCE
>|    DOI: ISAKMP_DOI_IPSEC
>| ****emit IPsec DOI SIT:
>|    IPsec DOI SIT: SIT_IDENTITY_ONLY
>| out_sa pcn: 0 has 1 valid proposals
>| out_sa pcn: 0 pn: 0<1 valid_count: 1 trans_cnt: 1
>| ****emit ISAKMP Proposal Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>|    proposal number: 0
>|    protocol ID: PROTO_IPSEC_ESP
>|    SPI size: 4
>|    number of transforms: 1
>| netlink_get_spi: allocated 0x1c341b1b for esp.0@10.200.138.69
>| emitting 4 raw bytes of SPI into ISAKMP Proposal Payload
>| SPI  1c 34 1b 1b
>| *****emit ISAKMP Transform Payload (ESP):
>|    next payload type: ISAKMP_NEXT_NONE
>|    ESP transform number: 0
>|    ESP transform ID: ESP_AES
>| ******emit ISAKMP IPsec DOI attribute:
>|    af+type: GROUP_DESCRIPTION
>|    length/value: 2
>|     [2 is OAKLEY_GROUP_MODP1024]
>| ******emit ISAKMP IPsec DOI attribute:
>|    af+type: ENCAPSULATION_MODE
>|    length/value: 3
>|     [3 is ENCAPSULATION_MODE_UDP_TUNNEL_RFC]
>| ******emit ISAKMP IPsec DOI attribute:
>|    af+type: SA_LIFE_TYPE
>|    length/value: 1
>|     [1 is SA_LIFE_TYPE_SECONDS]
>| ******emit ISAKMP IPsec DOI attribute:
>|    af+type: SA_LIFE_DURATION
>| emitting 4 raw bytes of long attribute value into ISAKMP IPsec DOI attribute
>| long attribute value
>|   00 01 51 80
>| emitting length of ISAKMP IPsec DOI attribute: 4
>| ******emit ISAKMP IPsec DOI attribute:
>|    af+type: AUTH_ALGORITHM
>|    length/value: 2
>|     [2 is AUTH_ALGORITHM_HMAC_SHA1]
>| ******emit ISAKMP IPsec DOI attribute:
>|    af+type: KEY_LENGTH
>|    length/value: 256
>| emitting length of ISAKMP Transform Payload (ESP): 36
>| emitting length of ISAKMP Proposal Payload: 48
>| emitting length of ISAKMP Security Association Payload: 60
>| ***emit ISAKMP Nonce Payload:
>|    next payload type: ISAKMP_NEXT_KE
>| emitting 16 raw bytes of Ni into ISAKMP Nonce Payload
>| Ni  af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| emitting length of ISAKMP Nonce Payload: 20
>| saving DH priv (local secret) and pub key into state struc
>| ***emit ISAKMP Key Exchange Payload:
>|    next payload type: ISAKMP_NEXT_ID
>| emitting 128 raw bytes of keyex value into ISAKMP Key Exchange Payload
>| keyex value  38 0c e6 48  da b5 d3 59  1e 1a ad e3  43 10 af 0e
>| keyex value  50 ef 4e e6  87 62 6c 2b  86 62 0d 15  a1 9b e7 17
>| keyex value  44 35 97 b6  6e d5 14 4c  99 b4 91 74  2a d4 06 66
>| keyex value  7b 1f 27 f5  8e 5b a6 d4  b0 ce 94 8e  24 dd 0d c8
>| keyex value  4a 62 70 27  ae 8f 9b 22  a2 2a 4e 18  27 6c 86 00
>| keyex value  ed 75 65 70  8f 3e 72 31  89 5a 1a ba  d5 e3 c9 51
>| keyex value  ce 59 67 87  cc a3 97 cf  12 12 46 d4  a1 46 4f aa
>| keyex value  d3 49 a3 57  a2 94 ba 90  b4 a8 13 13  90 78 1d 96
>| emitting length of ISAKMP Key Exchange Payload: 132
>| ***emit ISAKMP Identification Payload (IPsec DOI):
>|    next payload type: ISAKMP_NEXT_ID
>|    ID type: ID_IPV4_ADDR
>|    Protocol ID: 0
>|    port: 0
>| emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI)
>| client network  0a 0a 3f 2d
>| emitting length of ISAKMP Identification Payload (IPsec DOI): 12
>| ***emit ISAKMP Identification Payload (IPsec DOI):
>|    next payload type: ISAKMP_NEXT_NONE
>|    ID type: ID_IPV4_ADDR_SUBNET
>|    Protocol ID: 0
>|    port: 0
>| emitting 4 raw bytes of client network into ISAKMP Identification Payload (IPsec DOI)
>| client network  00 00 00 00
>| emitting 4 raw bytes of client mask into ISAKMP Identification Payload (IPsec DOI)
>| client mask  00 00 00 00
>| emitting length of ISAKMP Identification Payload (IPsec DOI): 16
>| hmac_update data value: 
>|   04 c9 35 85
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   0a 00 00 3c  00 00 00 01  00 00 00 01  00 00 00 30
>|   00 03 04 01  1c 34 1b 1b  00 00 00 24  00 0c 00 00
>|   80 03 00 02  80 04 00 03  80 01 00 01  00 02 00 04
>|   00 01 51 80  80 05 00 02  80 06 01 00  04 00 00 14
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>|   05 00 00 84  38 0c e6 48  da b5 d3 59  1e 1a ad e3
>|   43 10 af 0e  50 ef 4e e6  87 62 6c 2b  86 62 0d 15
>|   a1 9b e7 17  44 35 97 b6  6e d5 14 4c  99 b4 91 74
>|   2a d4 06 66  7b 1f 27 f5  8e 5b a6 d4  b0 ce 94 8e
>|   24 dd 0d c8  4a 62 70 27  ae 8f 9b 22  a2 2a 4e 18
>|   27 6c 86 00  ed 75 65 70  8f 3e 72 31  89 5a 1a ba
>|   d5 e3 c9 51  ce 59 67 87  cc a3 97 cf  12 12 46 d4
>|   a1 46 4f aa  d3 49 a3 57  a2 94 ba 90  b4 a8 13 13
>|   90 78 1d 96  05 00 00 0c  01 00 00 00  0a 0a 3f 2d
>|   00 00 00 10  04 00 00 00  00 00 00 00  00 00 00 00
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| HASH(1) computed:
>|   5b 02 41 cf  42 3d 28 24  5f dd 86 50  81 cb 18 6d
>|   28 84 83 7d
>| last Phase 1 IV:  12 68 c0 bf  06 2a a5 c2  03 92 fb 2a  22 4c 3d 34
>| current Phase 1 IV:  d1 74 25 c3  e1 68 aa 40  be ff 1b c4  7b dd 76 c3
>| computed Phase 2 IV:
>|   d8 6b a5 3f  83 24 d6 b8  09 7c c6 b7  10 fb 42 cb
>|   87 cc 74 3a
>| encrypting:
>|   01 00 00 18  5b 02 41 cf  42 3d 28 24  5f dd 86 50
>|   81 cb 18 6d  28 84 83 7d  0a 00 00 3c  00 00 00 01
>|   00 00 00 01  00 00 00 30  00 03 04 01  1c 34 1b 1b
>|   00 00 00 24  00 0c 00 00  80 03 00 02  80 04 00 03
>|   80 01 00 01  00 02 00 04  00 01 51 80  80 05 00 02
>|   80 06 01 00  04 00 00 14  af e4 4e 92  4f 9f 16 20
>|   40 f3 a0 5d  cf a6 c3 1a  05 00 00 84  38 0c e6 48
>|   da b5 d3 59  1e 1a ad e3  43 10 af 0e  50 ef 4e e6
>|   87 62 6c 2b  86 62 0d 15  a1 9b e7 17  44 35 97 b6
>|   6e d5 14 4c  99 b4 91 74  2a d4 06 66  7b 1f 27 f5
>|   8e 5b a6 d4  b0 ce 94 8e  24 dd 0d c8  4a 62 70 27
>|   ae 8f 9b 22  a2 2a 4e 18  27 6c 86 00  ed 75 65 70
>|   8f 3e 72 31  89 5a 1a ba  d5 e3 c9 51  ce 59 67 87
>|   cc a3 97 cf  12 12 46 d4  a1 46 4f aa  d3 49 a3 57
>|   a2 94 ba 90  b4 a8 13 13  90 78 1d 96  05 00 00 0c
>|   01 00 00 00  0a 0a 3f 2d  00 00 00 10  04 00 00 00
>|   00 00 00 00  00 00 00 00
>| IV:
>|   d8 6b a5 3f  83 24 d6 b8  09 7c c6 b7  10 fb 42 cb
>|   87 cc 74 3a
>| unpadded size is: 264
>| emitting 8 zero bytes of encryption padding into ISAKMP Message
>| encrypting 272 using OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| next IV:  90 9f 5b 48  74 67 bb 42  9f b7 4c a2  51 ca 7c c7
>| no IKE message padding required
>| emitting length of ISAKMP Message: 300
>| sending 304 bytes for quick_outI1 through wlp3s0:4500 to 66.187.233.55:4500 (using #2)
>|   00 00 00 00  ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1
>|   55 1e fb 18  08 10 20 01  04 c9 35 85  00 00 01 2c
>|   98 be d1 78  f8 00 b4 be  a6 89 b3 ce  a2 08 df 68
>|   6a 08 ca 37  d2 e0 dc e2  fd 04 e6 bb  1f 24 91 a2
>|   47 44 4e 66  7d 85 53 90  71 fc 6d bf  25 6c 48 2c
>|   99 31 93 ca  1e 39 cd ec  c7 63 2e af  40 86 00 42
>|   25 c3 e3 cc  0b cd e9 4e  25 49 11 e2  e0 c9 1d f6
>|   80 7c 10 0f  34 9d 0c 62  5a 2d f8 6a  dd a4 4f c9
>|   97 58 7e f1  a4 8e e8 89  e0 9f b5 1a  51 d6 75 f9
>|   c4 99 d9 a2  de e6 c5 81  de 35 cf 50  86 a3 9d d7
>|   49 36 a2 47  14 ec 56 9c  5d 2b fc 2d  b1 41 1c 7a
>|   e8 f3 e8 9d  97 13 db 03  a0 8f 86 00  1a 3a 14 36
>|   53 41 c5 a7  04 e6 49 4d  9f 60 be 53  73 43 99 cf
>|   72 59 99 f9  b5 f4 4a 57  94 65 41 34  30 89 e9 46
>|   c1 3e 1c 80  77 c7 9d 1c  97 7b a8 9b  5b 1f 29 3c
>|   0c c7 fd 9e  b7 b5 55 3a  fd aa cb 70  f2 0c e9 42
>|   7d 2d 6e 7b  e0 b2 d9 a0  1e ba 69 82  ea f5 3c a0
>|   a1 1f 2e 6e  8d fd 92 8f  94 ce ff f4  15 8a bf d4
>|   90 9f 5b 48  74 67 bb 42  9f b7 4c a2  51 ca 7c c7
>| deleting event for #2
>| inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #2
>| event added at head of queue
>| * processed 1 messages from cryptographic helpers 
>| next event EVENT_RETRANSMIT in 10 seconds for #2
>| next event EVENT_RETRANSMIT in 10 seconds for #2
>|  
>| *received 332 bytes from 66.187.233.55:4500 on wlp3s0 (port=4500)
>|   ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1  55 1e fb 18
>|   08 10 20 01  04 c9 35 85  00 00 01 4c  03 0c 20 18
>|   88 16 15 b0  fd f1 4a 7c  25 26 7b 89  9f f4 a8 be
>|   1a 36 39 ba  27 4e f9 8c  bc a0 bd 27  ca 94 2f 19
>|   bb a3 4f 59  be 98 8c 84  46 d4 af f9  3c bc 44 6f
>|   96 77 ae 87  8e 23 9d 64  5a f9 7c 4f  4e 45 04 17
>|   7b f0 f7 8b  74 96 a1 7d  c9 37 82 be  5e be 76 70
>|   d6 6a f4 f5  27 93 7f 4c  5e ce 2a f6  1d 75 ed 55
>|   cc b5 8b b9  26 6d ef 7f  05 31 05 ea  c8 31 a3 1a
>|   34 f5 57 d8  b7 f3 cb 89  3f 2a 46 2f  8c 88 93 75
>|   02 36 13 bd  16 9e be 91  17 a5 b6 60  17 b9 cc da
>|   fc 04 bd d7  39 fb 2c 19  c2 c1 1f 25  72 9d cc aa
>|   0a ed eb 34  f1 8c d6 3e  d4 b2 dd 78  2a c5 10 62
>|   77 cb 77 03  48 0f e1 f3  82 cd ed 69  75 d0 12 de
>|   82 a2 5a d6  47 cb 5b c0  cb 21 86 65  37 62 3c 02
>|   50 cf 4c a1  73 f5 86 2c  73 fa 4c 6f  97 02 b8 3d
>|   f2 1e d7 79  72 c4 e8 ae  be 8f c0 be  68 b7 76 31
>|   e7 50 19 a6  ff ea 18 79  5c 45 6f 13  21 3a 7c db
>|   6e 5d 39 a6  02 4b c0 72  23 92 4a 04  8d 1a 7f 9f
>|   9d 70 6a 1a  f5 be 6e 41  be 34 12 ba  f2 a1 60 8d
>|   9c 7a e5 eb  1a 46 99 7b  eb 27 27 e1
>| **parse ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_QUICK
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  04 c9 35 85
>|    length: 332
>|  processing version=1.0 packet with exchange type=ISAKMP_XCHG_QUICK (32)
>| ICOOKIE:  ff d8 a9 fb  b4 2c 8d c7
>| RCOOKIE:  8f f3 67 d1  55 1e fb 18
>| state hash entry 25
>| v1 peer and cookies match on #2, provided msgid 04c93585 vs 04c93585
>| v1 state object #2 found, in STATE_QUICK_I1
>| processing connection nm-conn1
>| received encrypted packet from 66.187.233.55:4500
>| decrypting 304 bytes using algorithm OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| decrypted:
>|   01 00 00 18  b0 01 39 0c  5e 27 77 c9  64 e9 fb a9
>|   fd 87 83 12  b5 fc 03 2a  0a 00 00 3c  00 00 00 01
>|   00 00 00 01  00 00 00 30  01 03 04 01  b6 d4 51 09
>|   00 00 00 24  01 0c 00 00  80 01 00 01  00 02 00 04
>|   00 01 51 80  80 04 00 03  80 05 00 02  80 03 00 02
>|   80 06 01 00  04 00 00 18  78 a3 11 d9  0c 1a e1 fc
>|   43 ba ba b5  45 fb 8b 1a  dc be 16 d2  05 00 00 84
>|   21 d7 94 41  62 54 20 4b  68 3a 89 d1  37 53 1b 23
>|   a5 d6 69 0a  c6 24 fa 8b  f2 78 58 17  97 8a f5 88
>|   a1 f1 e1 53  7b a4 67 ce  b3 d1 67 15  0d 09 05 d3
>|   20 0d 36 f2  34 eb 77 fa  b6 e4 2e 12  12 df 4f e4
>|   19 7b 6f a8  e0 e8 88 28  34 f2 66 25  3b e3 b2 8e
>|   18 fb 20 82  21 d3 c2 50  87 73 dd 72  40 60 b9 09
>|   d3 a5 98 13  1b e2 d3 a3  6b 62 48 62  81 cf de 71
>|   b3 ba 98 44  96 46 79 83  ec 9d f7 09  7c 3b 79 f7
>|   05 00 00 0c  01 00 00 00  0a 0a 3f 2d  0b 00 00 10
>|   04 00 00 00  00 00 00 00  00 00 00 00  00 00 00 24
>|   00 00 00 01  03 04 60 00  b6 d4 51 09  80 01 00 01
>|   80 02 e1 00  80 01 00 02  00 02 00 04  04 00 00 00
>| next IV:  f2 a1 60 8d  9c 7a e5 eb  1a 46 99 7b  eb 27 27 e1
>| got payload 0x100  (ISAKMP_NEXT_HASH) needed: 0x502opt: 0x200030
>| ***parse ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_SA
>|    length: 24
>| got payload 0x2  (ISAKMP_NEXT_SA) needed: 0x402opt: 0x200030
>| ***parse ISAKMP Security Association Payload:
>|    next payload type: ISAKMP_NEXT_NONCE
>|    length: 60
>|    DOI: ISAKMP_DOI_IPSEC
>| got payload 0x400  (ISAKMP_NEXT_NONCE) needed: 0x400opt: 0x200030
>| ***parse ISAKMP Nonce Payload:
>|    next payload type: ISAKMP_NEXT_KE
>|    length: 24
>| got payload 0x10  (ISAKMP_NEXT_KE) needed: 0x0opt: 0x200030
>| ***parse ISAKMP Key Exchange Payload:
>|    next payload type: ISAKMP_NEXT_ID
>|    length: 132
>| got payload 0x20  (ISAKMP_NEXT_ID) needed: 0x0opt: 0x200030
>| ***parse ISAKMP Identification Payload (IPsec DOI):
>|    next payload type: ISAKMP_NEXT_ID
>|    length: 12
>|    ID type: ID_IPV4_ADDR
>|    Protocol ID: 0
>|    port: 0
>|      obj:   0a 0a 3f 2d
>| got payload 0x20  (ISAKMP_NEXT_ID) needed: 0x0opt: 0x200030
>| ***parse ISAKMP Identification Payload (IPsec DOI):
>|    next payload type: ISAKMP_NEXT_N
>|    length: 16
>|    ID type: ID_IPV4_ADDR_SUBNET
>|    Protocol ID: 0
>|    port: 0
>|      obj:   00 00 00 00  00 00 00 00
>| got payload 0x800  (ISAKMP_NEXT_N) needed: 0x0opt: 0x200030
>| ***parse ISAKMP Notification Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 36
>|    DOI: ISAKMP_DOI_IPSEC
>|    protocol ID: 3
>|    SPI size: 4
>|    Notify Message Type: IPSEC_RESPONDER_LIFETIME
>"nm-conn1" #2: ignoring informational payload IPSEC_RESPONDER_LIFETIME, msgid=8535c904, length=36
>| ISAKMP Notification Payload
>|   00 00 00 24  00 00 00 01  03 04 60 00
>| info:  b6 d4 51 09  80 01 00 01  80 02 e1 00  80 01 00 02
>| info:  00 02 00 04  04 00 00 00
>| **emit ISAKMP Message:
>|    initiator cookie:
>|   ff d8 a9 fb  b4 2c 8d c7
>|    responder cookie:
>|   8f f3 67 d1  55 1e fb 18
>|    next payload type: ISAKMP_NEXT_HASH
>|    ISAKMP version: ISAKMP Version 1.0 (rfc2407)
>|    exchange type: ISAKMP_XCHG_QUICK
>|    flags: ISAKMP_FLAG_ENCRYPTION
>|    message ID:  04 c9 35 85
>| hmac_update data value: 
>|   04 c9 35 85
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   0a 00 00 3c  00 00 00 01  00 00 00 01  00 00 00 30
>|   01 03 04 01  b6 d4 51 09  00 00 00 24  01 0c 00 00
>|   80 01 00 01  00 02 00 04  00 01 51 80  80 04 00 03
>|   80 05 00 02  80 03 00 02  80 06 01 00  04 00 00 18
>|   78 a3 11 d9  0c 1a e1 fc  43 ba ba b5  45 fb 8b 1a
>|   dc be 16 d2  05 00 00 84  21 d7 94 41  62 54 20 4b
>|   68 3a 89 d1  37 53 1b 23  a5 d6 69 0a  c6 24 fa 8b
>|   f2 78 58 17  97 8a f5 88  a1 f1 e1 53  7b a4 67 ce
>|   b3 d1 67 15  0d 09 05 d3  20 0d 36 f2  34 eb 77 fa
>|   b6 e4 2e 12  12 df 4f e4  19 7b 6f a8  e0 e8 88 28
>|   34 f2 66 25  3b e3 b2 8e  18 fb 20 82  21 d3 c2 50
>|   87 73 dd 72  40 60 b9 09  d3 a5 98 13  1b e2 d3 a3
>|   6b 62 48 62  81 cf de 71  b3 ba 98 44  96 46 79 83
>|   ec 9d f7 09  7c 3b 79 f7  05 00 00 0c  01 00 00 00
>|   0a 0a 3f 2d  0b 00 00 10  04 00 00 00  00 00 00 00
>|   00 00 00 00  00 00 00 24  00 00 00 01  03 04 60 00
>|   b6 d4 51 09  80 01 00 01  80 02 e1 00  80 01 00 02
>|   00 02 00 04  04 00 00 00
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| HASH(2) computed:
>|   b0 01 39 0c  5e 27 77 c9  64 e9 fb a9  fd 87 83 12
>|   b5 fc 03 2a
>| ****parse IPsec DOI SIT:
>|    IPsec DOI SIT: SIT_IDENTITY_ONLY
>| ****parse ISAKMP Proposal Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 48
>|    proposal number: 1
>|    protocol ID: PROTO_IPSEC_ESP
>|    SPI size: 4
>|    number of transforms: 1
>| parsing 4 raw bytes of ISAKMP Proposal Payload into SPI
>| SPI  b6 d4 51 09
>| *****parse ISAKMP Transform Payload (ESP):
>|    next payload type: ISAKMP_NEXT_NONE
>|    length: 36
>|    ESP transform number: 1
>|    ESP transform ID: ESP_AES
>| ******parse ISAKMP IPsec DOI attribute:
>|    af+type: SA_LIFE_TYPE
>|    length/value: 1
>| ******parse ISAKMP IPsec DOI attribute:
>|    af+type: SA_LIFE_DURATION
>|    length/value: 4
>|    long duration: 86400
>| ******parse ISAKMP IPsec DOI attribute:
>|    af+type: ENCAPSULATION_MODE
>|    length/value: 3
>|    [3 is ENCAPSULATION_MODE_UDP_TUNNEL_RFC]
>| NAT-T RFC: Installing IPsec SA with ENCAP, st->hidden_variables.st_nat_traversal is '1073741840'
>| ******parse ISAKMP IPsec DOI attribute:
>|    af+type: AUTH_ALGORITHM
>|    length/value: 2
>| ******parse ISAKMP IPsec DOI attribute:
>|    af+type: GROUP_DESCRIPTION
>|    length/value: 2
>| ******parse ISAKMP IPsec DOI attribute:
>|    af+type: KEY_LENGTH
>|    length/value: 256
>| kernel_alg_esp_enc_ok(12,256): OK
>| DH public value received:
>|   21 d7 94 41  62 54 20 4b  68 3a 89 d1  37 53 1b 23
>|   a5 d6 69 0a  c6 24 fa 8b  f2 78 58 17  97 8a f5 88
>|   a1 f1 e1 53  7b a4 67 ce  b3 d1 67 15  0d 09 05 d3
>|   20 0d 36 f2  34 eb 77 fa  b6 e4 2e 12  12 df 4f e4
>|   19 7b 6f a8  e0 e8 88 28  34 f2 66 25  3b e3 b2 8e
>|   18 fb 20 82  21 d3 c2 50  87 73 dd 72  40 60 b9 09
>|   d3 a5 98 13  1b e2 d3 a3  6b 62 48 62  81 cf de 71
>|   b3 ba 98 44  96 46 79 83  ec 9d f7 09  7c 3b 79 f7
>| started looking for secret for @RH-standard->66.187.233.55 of kind PPK_PSK
>| actually looking for secret for @RH-standard->66.187.233.55 of kind PPK_PSK
>| line 1: key type PPK_PSK(@RH-standard) to type PPK_PSK 
>| 1: compared key @RH-standard to @RH-standard / 66.187.233.55 -> 8
>| line 1: match=9 
>| best_match 0>9 best=0x7f2460f90340 (line=1)
>| concluding with best_match=9 best=0x7f2460f90340 (lineno=1)
>| Copying DH pub key pointer to be sent to a thread helper
>| 1: w->pcw_dead: 0 w->pcw_work: 0 cnt: 3
>| asking helper 1 to do compute dh(p2) op on seq: 4 (len=2776, pcw_work=1)
>| helper 1 read 2768+4/2776 bytes fd: 10
>| helper 1 doing compute dh(p2) op id: 4
>| peer's g:   21 d7 94 41  62 54 20 4b  68 3a 89 d1  37 53 1b 23
>| peer's g:   a5 d6 69 0a  c6 24 fa 8b  f2 78 58 17  97 8a f5 88
>| peer's g:   a1 f1 e1 53  7b a4 67 ce  b3 d1 67 15  0d 09 05 d3
>| peer's g:   20 0d 36 f2  34 eb 77 fa  b6 e4 2e 12  12 df 4f e4
>| peer's g:   19 7b 6f a8  e0 e8 88 28  34 f2 66 25  3b e3 b2 8e
>| peer's g:   18 fb 20 82  21 d3 c2 50  87 73 dd 72  40 60 b9 09
>| peer's g:   d3 a5 98 13  1b e2 d3 a3  6b 62 48 62  81 cf de 71
>| peer's g:   b3 ba 98 44  96 46 79 83  ec 9d f7 09  7c 3b 79 f7
>| Started DH shared-secret computation in NSS: 
>| Dropped no leading zeros 128
>| calc_dh_shared(): time elapsed (OAKLEY_GROUP_MODP1024): 323 usec
>| DH shared-secret (pointer):
>|   30 8e 02 4c  24 7f 00 00
>| crypto helper write of request: cnt=2776<wlen=2776.  
>| deleting event for #2
>| inserting event EVENT_CRYPTO_FAILED, timeout in 300 seconds for #2
>| event added after event EVENT_PENDING_PHASE2
>| complete state transition with STF_SUSPEND
>| * processed 0 messages from cryptographic helpers 
>| next event EVENT_NAT_T_KEEPALIVE in 18 seconds
>| next event EVENT_NAT_T_KEEPALIVE in 18 seconds
>|  
>| helper 1 has finished work (cnt now 1)
>| helper 1 replies to id: q#4
>| calling callback function 0x7f245efe0240
>| quick inI1_outR1: calculated ke+nonce, calculating DH
>| processing connection nm-conn1
>| NAT-Traversal: received 0 NAT-OA.
>| our client is 10.10.63.45
>| our client protocol/port is 0/0
>| peer client is subnet 0.0.0.0/0
>| peer client protocol/port is 0/0
>| ***emit ISAKMP Hash Payload:
>|    next payload type: ISAKMP_NEXT_NONE
>| emitting 20 zero bytes of HASH into ISAKMP Hash Payload
>| emitting length of ISAKMP Hash Payload: 24
>| hmac_update data value: 
>|   00
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   04 c9 35 85
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   78 a3 11 d9  0c 1a e1 fc  43 ba ba b5  45 fb 8b 1a
>|   dc be 16 d2
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| HASH(3) computed:  c4 36 a3 fe  81 d3 56 bd  2c 7f 89 4b  ba c1 7c 72
>| HASH(3) computed:  b2 e7 c2 69
>| compute_proto_keymat:needed_len (after ESP enc)=32
>| compute_proto_keymat:needed_len (after ESP auth)=52
>| hmac_update data value: 
>|   03
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   03
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   1c 34 1b 1b
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   b6 d4 51 09
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   78 a3 11 d9  0c 1a e1 fc  43 ba ba b5  45 fb 8b 1a
>|   dc be 16 d2
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   78 a3 11 d9  0c 1a e1 fc  43 ba ba b5  45 fb 8b 1a
>|   dc be 16 d2
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   5b 44 50 43  fb 29 d4 4f  5a 05 f4 83  93 54 02 d8
>|   01 00 73 c3
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   71 37 df fa  a6 a6 9c 85  7a 61 5d d1  f7 fe 78 b7
>|   71 ed 46 4c
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   03
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   03
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   1c 34 1b 1b
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   b6 d4 51 09
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   78 a3 11 d9  0c 1a e1 fc  43 ba ba b5  45 fb 8b 1a
>|   dc be 16 d2
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   78 a3 11 d9  0c 1a e1 fc  43 ba ba b5  45 fb 8b 1a
>|   dc be 16 d2
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   05 67 13 fd  a1 a8 65 14  2c 50 5c 61  55 74 a2 04
>|   6c 9d f9 7f
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   ed 05 31 4a  1d 88 46 bd  44 63 aa 58  e1 d7 a8 e3
>|   0c 22 f0 78
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   03
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   03
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   1c 34 1b 1b
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   b6 d4 51 09
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   af e4 4e 92  4f 9f 16 20  40 f3 a0 5d  cf a6 c3 1a
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   78 a3 11 d9  0c 1a e1 fc  43 ba ba b5  45 fb 8b 1a
>|   dc be 16 d2
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| hmac_update data value: 
>|   78 a3 11 d9  0c 1a e1 fc  43 ba ba b5  45 fb 8b 1a
>|   dc be 16 d2
>| hmac_update: inside if
>| hmac_update: after digest
>| hmac_update: after assert
>| ESP KEYMAT 
>|   KEYMAT computed:
>|   5b 44 50 43  fb 29 d4 4f  5a 05 f4 83  93 54 02 d8
>|   01 00 73 c3  05 67 13 fd  a1 a8 65 14  2c 50 5c 61
>|   55 74 a2 04  6c 9d f9 7f  90 12 b5 36  c9 49 2e a4
>|   62 83 41 2c
>|   Peer KEYMAT computed:
>|   71 37 df fa  a6 a6 9c 85  7a 61 5d d1  f7 fe 78 b7
>|   71 ed 46 4c  ed 05 31 4a  1d 88 46 bd  44 63 aa 58
>|   e1 d7 a8 e3  0c 22 f0 78  3a b1 91 8e  b4 af 38 5c
>|   30 b5 ee 98
>| install_ipsec_sa() for #2: inbound and outbound
>| route owner of "nm-conn1" unrouted: NULL; eroute owner: NULL
>| could_route called for nm-conn1 (kind=CK_PERMANENT)
>| looking for alg with transid: 12 keylen: 256 auth: 2 
>| checking transid: 11 keylen: 0 auth: 1 
>| checking transid: 11 keylen: 0 auth: 2 
>| checking transid: 3 keylen: 24 auth: 0 
>| checking transid: 3 keylen: 24 auth: 1 
>| checking transid: 3 keylen: 24 auth: 2 
>| checking transid: 12 keylen: 16 auth: 0 
>| checking transid: 12 keylen: 16 auth: 1 
>| checking transid: 12 keylen: 16 auth: 2 
>| kernel_alg_esp_info():transid=12, auth=2, ei=0x7f245f2c2920, enckeylen=32, authkeylen=20, encryptalg=12, authalg=3
>| esp enckey:  71 37 df fa  a6 a6 9c 85  7a 61 5d d1  f7 fe 78 b7
>| esp enckey:  71 ed 46 4c  ed 05 31 4a  1d 88 46 bd  44 63 aa 58
>| esp authkey:  e1 d7 a8 e3  0c 22 f0 78  3a b1 91 8e  b4 af 38 5c
>| esp authkey:  30 b5 ee 98
>| set up outgoing SA, ref=0/4294901761
>| looking for alg with transid: 12 keylen: 256 auth: 2 
>| checking transid: 11 keylen: 0 auth: 1 
>| checking transid: 11 keylen: 0 auth: 2 
>| checking transid: 3 keylen: 24 auth: 0 
>| checking transid: 3 keylen: 24 auth: 1 
>| checking transid: 3 keylen: 24 auth: 2 
>| checking transid: 12 keylen: 16 auth: 0 
>| checking transid: 12 keylen: 16 auth: 1 
>| checking transid: 12 keylen: 16 auth: 2 
>| kernel_alg_esp_info():transid=12, auth=2, ei=0x7f245f2c2920, enckeylen=32, authkeylen=20, encryptalg=12, authalg=3
>| esp enckey:  5b 44 50 43  fb 29 d4 4f  5a 05 f4 83  93 54 02 d8
>| esp enckey:  01 00 73 c3  05 67 13 fd  a1 a8 65 14  2c 50 5c 61
>| esp authkey:  55 74 a2 04  6c 9d f9 7f  90 12 b5 36  c9 49 2e a4
>| esp authkey:  62 83 41 2c
>| add inbound eroute 0.0.0.0/0:0 --0-> 10.10.63.45/32:0 => tun.10000@10.200.138.69 (raw_eroute)
>| satype(9) is not used in netlink_raw_eroute.
>| raw_eroute result=1 
>| set up incoming SA, ref=0/4294901761
>| sr for #2: unrouted
>| route owner of "nm-conn1" unrouted: NULL; eroute owner: NULL
>| route_and_eroute with c: nm-conn1 (next: none) ero:null esr:{(nil)} ro:null rosr:{(nil)} and state: 2
>| eroute_connection add eroute 10.10.63.45/32:0 --0-> 10.0.0.0/8:0 => tun.0@66.187.233.55 (raw_eroute)
>| satype(9) is not used in netlink_raw_eroute.
>| raw_eroute result=1 
>| command executing up-client
>| executing up-client: 2>&1 PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='nm-conn1' PLUTO_INTERFACE='wlp3s0' PLUTO_NEXT_HOP='66.187.233.55' PLUTO_ME='10.200.138.69' PLUTO_MY_ID='@' PLUTO_MY_CLIENT='10.10.63.45/32' PLUTO_MY_CLIENT_NET='10.10.63.45' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16384' PLUTO_PEER='66.187.233.55' PLUTO_PEER_ID='66.187.233.55' PLUTO_PEER_CLIENT='10.0.0.0/8' PLUTO_PEER_CLIENT_NET='10.0.0.0' PLUTO_PEER_CLIENT_MASK='255.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey'   PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+PFS+UP+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERNAME='jrusnack' PLUTO_MY_SOURCEIP='10.10.63.45' PLUTO_IS_PEER_CISCO='1' PLUTO_PEER_DNS_INFO='10.11.5.19 10.5.30.160' PLUTO_PEER_DOMAIN_INFO='redhat.com' PLUTO_PEER_BANNER='Unauthorized Access to this or any other Red Hat Inc. device is strictly prohibited. Violat
>| popen cmd is 1062 chars long
>| cmd(   0):2>&1 PLUTO_VERB='up-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='nm-conn1' PLUT:
>| cmd(  80):O_INTERFACE='wlp3s0' PLUTO_NEXT_HOP='66.187.233.55' PLUTO_ME='10.200.138.69' PLU:
>| cmd( 160):TO_MY_ID='@' PLUTO_MY_CLIENT='10.10.63.45/32' PLUTO_MY_CLIENT_NET='10.10.63.45' :
>| cmd( 240):PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' P:
>| cmd( 320):LUTO_SA_REQID='16384' PLUTO_PEER='66.187.233.55' PLUTO_PEER_ID='66.187.233.55' P:
>| cmd( 400):LUTO_PEER_CLIENT='10.0.0.0/8' PLUTO_PEER_CLIENT_NET='10.0.0.0' PLUTO_PEER_CLIENT:
>| cmd( 480):_MASK='255.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' P:
>| cmd( 560):LUTO_STACK='netkey'   PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+PFS+UP+XAUTH+AGGRESS:
>| cmd( 640):IVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 :
>| cmd( 720):PLUTO_XAUTH_USERNAME='jrusnack' PLUTO_MY_SOURCEIP='10.10.63.45' PLUTO_IS_PEER_CI:
>| cmd( 800):SCO='1' PLUTO_PEER_DNS_INFO='10.11.5.19 10.5.30.160' PLUTO_PEER_DOMAIN_INFO='red:
>| cmd( 880):hat.com' PLUTO_PEER_BANNER='Unauthorized Access to this or any other Red Hat Inc:
>| cmd( 960):. device is strictly prohibited. Violators will be prosecuted. ' PLUTO_NM_CONFIG:
>| cmd(1040):URED='1' ipsec _updown:
>"nm-conn1" #2: up-client output: Updating resolv.conf is controlled by Network Manager
>| route_and_eroute: firewall_notified: true
>| command executing prepare-client
>| executing prepare-client: 2>&1 PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='nm-conn1' PLUTO_INTERFACE='wlp3s0' PLUTO_NEXT_HOP='66.187.233.55' PLUTO_ME='10.200.138.69' PLUTO_MY_ID='@' PLUTO_MY_CLIENT='10.10.63.45/32' PLUTO_MY_CLIENT_NET='10.10.63.45' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16384' PLUTO_PEER='66.187.233.55' PLUTO_PEER_ID='66.187.233.55' PLUTO_PEER_CLIENT='10.0.0.0/8' PLUTO_PEER_CLIENT_NET='10.0.0.0' PLUTO_PEER_CLIENT_MASK='255.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey'   PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+PFS+UP+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERNAME='jrusnack' PLUTO_MY_SOURCEIP='10.10.63.45' PLUTO_IS_PEER_CISCO='1' PLUTO_PEER_DNS_INFO='10.11.5.19 10.5.30.160' PLUTO_PEER_DOMAIN_INFO='redhat.com' PLUTO_PEER_BANNER='Unauthorized Access to this or any other Red Hat Inc. device is strictly prohibit
>| popen cmd is 1067 chars long
>| cmd(   0):2>&1 PLUTO_VERB='prepare-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='nm-conn1':
>| cmd(  80): PLUTO_INTERFACE='wlp3s0' PLUTO_NEXT_HOP='66.187.233.55' PLUTO_ME='10.200.138.69:
>| cmd( 160):' PLUTO_MY_ID='@' PLUTO_MY_CLIENT='10.10.63.45/32' PLUTO_MY_CLIENT_NET='10.10.63:
>| cmd( 240):.45' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL=:
>| cmd( 320):'0' PLUTO_SA_REQID='16384' PLUTO_PEER='66.187.233.55' PLUTO_PEER_ID='66.187.233.:
>| cmd( 400):55' PLUTO_PEER_CLIENT='10.0.0.0/8' PLUTO_PEER_CLIENT_NET='10.0.0.0' PLUTO_PEER_C:
>| cmd( 480):LIENT_MASK='255.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA:
>| cmd( 560):='' PLUTO_STACK='netkey'   PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+PFS+UP+XAUTH+AG:
>| cmd( 640):GRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAIL:
>| cmd( 720):ED=0 PLUTO_XAUTH_USERNAME='jrusnack' PLUTO_MY_SOURCEIP='10.10.63.45' PLUTO_IS_PE:
>| cmd( 800):ER_CISCO='1' PLUTO_PEER_DNS_INFO='10.11.5.19 10.5.30.160' PLUTO_PEER_DOMAIN_INFO:
>| cmd( 880):='redhat.com' PLUTO_PEER_BANNER='Unauthorized Access to this or any other Red Ha:
>| cmd( 960):t Inc. device is strictly prohibited. Violators will be prosecuted. ' PLUTO_NM_C:
>| cmd(1040):ONFIGURED='1' ipsec _updown:
>| command executing route-client
>| executing route-client: 2>&1 PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='nm-conn1' PLUTO_INTERFACE='wlp3s0' PLUTO_NEXT_HOP='66.187.233.55' PLUTO_ME='10.200.138.69' PLUTO_MY_ID='@' PLUTO_MY_CLIENT='10.10.63.45/32' PLUTO_MY_CLIENT_NET='10.10.63.45' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0' PLUTO_SA_REQID='16384' PLUTO_PEER='66.187.233.55' PLUTO_PEER_ID='66.187.233.55' PLUTO_PEER_CLIENT='10.0.0.0/8' PLUTO_PEER_CLIENT_NET='10.0.0.0' PLUTO_PEER_CLIENT_MASK='255.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA='' PLUTO_STACK='netkey'   PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+PFS+UP+XAUTH+AGGRESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERNAME='jrusnack' PLUTO_MY_SOURCEIP='10.10.63.45' PLUTO_IS_PEER_CISCO='1' PLUTO_PEER_DNS_INFO='10.11.5.19 10.5.30.160' PLUTO_PEER_DOMAIN_INFO='redhat.com' PLUTO_PEER_BANNER='Unauthorized Access to this or any other Red Hat Inc. device is strictly prohibited. 
>| popen cmd is 1065 chars long
>| cmd(   0):2>&1 PLUTO_VERB='route-client' PLUTO_VERSION='2.0' PLUTO_CONNECTION='nm-conn1' P:
>| cmd(  80):LUTO_INTERFACE='wlp3s0' PLUTO_NEXT_HOP='66.187.233.55' PLUTO_ME='10.200.138.69' :
>| cmd( 160):PLUTO_MY_ID='@' PLUTO_MY_CLIENT='10.10.63.45/32' PLUTO_MY_CLIENT_NET='10.10.63.4:
>| cmd( 240):5' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='0' PLUTO_MY_PROTOCOL='0:
>| cmd( 320):' PLUTO_SA_REQID='16384' PLUTO_PEER='66.187.233.55' PLUTO_PEER_ID='66.187.233.55:
>| cmd( 400):' PLUTO_PEER_CLIENT='10.0.0.0/8' PLUTO_PEER_CLIENT_NET='10.0.0.0' PLUTO_PEER_CLI:
>| cmd( 480):ENT_MASK='255.0.0.0' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='0' PLUTO_PEER_CA=':
>| cmd( 560):' PLUTO_STACK='netkey'   PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+PFS+UP+XAUTH+AGGR:
>| cmd( 640):ESSIVE+IKEv2ALLOW+SAREFTRACK+IKE_FRAG' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED:
>| cmd( 720):=0 PLUTO_XAUTH_USERNAME='jrusnack' PLUTO_MY_SOURCEIP='10.10.63.45' PLUTO_IS_PEER:
>| cmd( 800):_CISCO='1' PLUTO_PEER_DNS_INFO='10.11.5.19 10.5.30.160' PLUTO_PEER_DOMAIN_INFO=':
>| cmd( 880):redhat.com' PLUTO_PEER_BANNER='Unauthorized Access to this or any other Red Hat :
>| cmd( 960):Inc. device is strictly prohibited. Violators will be prosecuted. ' PLUTO_NM_CON:
>| cmd(1040):FIGURED='1' ipsec _updown:
>| route_and_eroute: instance "nm-conn1", setting eroute_owner {spd=0x7f2460f915a0,sr=0x7f2460f93ff0} to #2 (was #0) (newest_ipsec_sa=#0)
>| encrypting:
>|   00 00 00 18  c4 36 a3 fe  81 d3 56 bd  2c 7f 89 4b
>|   ba c1 7c 72  b2 e7 c2 69
>| IV:
>|   f2 a1 60 8d  9c 7a e5 eb  1a 46 99 7b  eb 27 27 e1
>| unpadded size is: 24
>| emitting 8 zero bytes of encryption padding into ISAKMP Message
>| encrypting 32 using OAKLEY_AES_CBC
>| NSS do_aes: enter
>| NSS do_aes: exit
>| next IV:  74 c8 e2 66  50 2e 1f 4b  4f 69 2a ef  80 9b db 01
>| no IKE message padding required
>| emitting length of ISAKMP Message: 60
>| inR1_outI2: instance nm-conn1[0], setting newest_ipsec_sa to #2 (was #0) (spd.eroute=#2)
>| complete state transition with STF_OK
>"nm-conn1" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
>| deleting event for #2
>| sending reply packet to 66.187.233.55:4500 (from port 4500)
>| sending 64 bytes for STATE_QUICK_I1 through wlp3s0:4500 to 66.187.233.55:4500 (using #2)
>|   00 00 00 00  ff d8 a9 fb  b4 2c 8d c7  8f f3 67 d1
>|   55 1e fb 18  08 10 20 01  04 c9 35 85  00 00 00 3c
>|   4f bf 98 de  ba 35 76 f6  61 5c a2 a7  5a 44 cd d5
>|   74 c8 e2 66  50 2e 1f 4b  4f 69 2a ef  80 9b db 01
>| inserting event EVENT_SA_REPLACE, timeout in 85648 seconds for #2
>| event added after event EVENT_LOG_DAILY
>| NAT-T: their IKE port is '500'
>| NAT-T: forceencaps is 'disabled'
>"nm-conn1" #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=>0xb6d45109 <0x1c341b1b xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=none DPD=none XAUTHuser=jrusnack}
>| modecfg pull: quirk-poll policy:push modecfg-client
>| phase 1 is done, looking for phase 2 to unpend
>| * processed 1 messages from cryptographic helpers 
>| next event EVENT_NAT_T_KEEPALIVE in 18 seconds
>| next event EVENT_NAT_T_KEEPALIVE in 18 seconds

Actions: View

Attachments on bug 1088038: 887115 | 887116 | 887117 | 887118