Hi everyone:<div><br clear="all">I have a strange problem,IPSEC SA can established,but can only forward package through NAT.</div><div><br></div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">1.WITHOUT NAT NetWork </span><a class="explain" href="javascript:void(0)"><span class="Apple-style-span" style="font-weight: bold;">topology:</span></a></div>
<div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">PC A:</span></div><div>eth0:192.168.100.234</div><div>eth1:192.168.1.234</div><div><span class="Apple-style-span" style="font-weight: bold;">PC B:</span></div>
<div>eth0:192.168.111.231</div><div>eth1:192.168.1.231</div><div><br></div><div>My pc(Windows XP,trying to access 192.168.111.231,set 192.168.100.234 as gateway):</div><div>eth0:192.168.100.10</div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">2.ipsec.conf (PC A)</span></div>
<div><div>-bash-3.2$ cat /etc/ipsec.conf </div><div>version 2.0 # conforms to second version of ipsec.conf specification<br></div><div>config setup<br></div><div> plutodebug = all</div><div> klipsdebug = all</div>
<div> nat_traversal=no<br></div><div> interfaces = "ipsec0=eth1"<br></div><div>include /etc/ipsec.d/examples/no_oe.conf <br></div><div><div>conn aa</div><div> type = tunnel</div><div> auto = start</div>
<div> keyexchange = ike</div><div> authby = secret</div><div> auth = esp</div><div> esp = 3DES-SHA1</div><div> ike = 3DES-SHA1-MODP1024</div><div> aggrmode = yes</div><div> pfs = yes</div>
<div> pfsgroup = MODP1024</div><div> left = 192.168.1.234</div><div> leftsubnet = <a href="http://192.168.100.0/255.255.255.0">192.168.100.0/255.255.255.0</a></div><div> right = 192.168.1.132</div>
<div> rightsubnet = <a href="http://192.168.111.0/255.255.255.0">192.168.111.0/255.255.255.0</a></div><div> leftid = @aaa</div><div> rightid = @bbb</div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">3.tcp dump result on PC A</span></div>
<div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">From eth1,there is result from peer node,<a href="http://192.168.1.132">192.168.1.132</a>:</span></div><div><br></div><div><div>-bash-3.2$ sudo ./tcpdump -i eth1 host 192.168.1.132 -vv</div>
<div>tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes</div><div>14:16:32.753634 IP (tos 0x0, ttl 64, id 51990, offset 0, flags [none], proto ESP (50), length 112) 192.168.1.234 > <a href="http://192.168.1.132">192.168.1.132</a>: ESP(spi=0xa1015406,seq=0x2), length 92</div>
<div>14:16:52.764378 IP (tos 0x0, ttl 64, id 32957, offset 0, flags [none], proto ESP (50), length 112) 192.168.1.132 > <a href="http://192.168.1.234">192.168.1.234</a>: ESP(spi=0x1c703a00,seq=0x2), length 92</div><div>
14:16:37.729272 arp who-has 192.168.1.132 tell 192.168.1.234</div><div>14:16:37.729482 arp reply 192.168.1.132 is-at 00:19:db:47:0c:60 (oui Unknown)</div><div><br></div><div>4 packets captured</div><div>4 packets received by filter</div>
<div>0 packets dropped by kernel</div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">But no result for ipsec0(192.168.100.10 is my IP)</span></div><div><div>-bash-3.2$ sudo ./tcpdump -i ipsec0 -vv</div>
<div>tcpdump: listening on ipsec0, link-type EN10MB (Ethernet), capture size 96 bytes</div><div>14:16:32.744483 IP (tos 0x0, ttl 127, id 31949, offset 0, flags [none], proto ICMP (1), length 60) 192.168.100.10 > <a href="http://192.168.111.132">192.168.111.132</a>: ICMP echo request, id 768, seq 35072, length 40</div>
<div>14:16:32.747816 IP (tos 0x0, ttl 64, id 7320, offset 0, flags [DF], proto UDP (17), length 74) 192.168.1.234.filenet-pa > 192.168.111.1.domain: [udp sum ok] 3304+ PTR? 132.111.168.192.in-addr.arpa. (46)</div><div>
<br></div><div>2 packets captured</div><div>13 packets received by filter</div><div>0 packets dropped by kernel</div><div>-bash-3.2$ </div></div></div></div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">4.ipsec log file(can only see message send out)</span></div>
<div><span class="Apple-style-span" style="font-weight: bold;"><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_tunnel_hard_header: skb->dev=ipsec0 dev=ipsec0.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_tunnel_hard_header: Revectored 0p00000000->0pdc883a24 len=84 type=2048 dev=ipsec0->eth1 dev_addr=00:50:c2:1c:97:92 ip=c0a864ea->c0a86f01</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_strip_hard_header: >>> skb->len=98 hard_header_len:14 00:50:c2:1c:97:92:00:50:c2:1c:97:92:08:00 </span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:84 id:0 DF frag_off:0 ttl:64 proto:1 (ICMP) chk:58732 saddr:192.168.100.234 daddr:192.168.111.1 type:code=8:0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_strip_hard_header: Original head,tailroom: 2,28</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_findroute: 192.168.100.234:0-><a href="http://192.168.111.1:0">192.168.111.1:0</a> 1</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: * See if we match exactly as a host destination</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: ** try to match a leaf, t=0pde630180</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_SAlookup: checking for local udp/500 IKE packet saddr=c0a864ea, er=0pde630180, daddr=c0a86f01, er_dst=c0a80184, proto=1 sport=0 dport=0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_sa_getbyid: linked entry in ipsec_sa table for hash=168 of <a href="mailto:SA%3Atun.1002@192.168.1.132">SA:tun.1002@192.168.1.132</a> requested.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: found ipsec_sa -- SA:<IPIP> <a href="mailto:tun.1002@192.168.1.132">tun.1002@192.168.1.132</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: calling room for <IPIP>, <a href="mailto:SA%3Atun.1002@192.168.1.132">SA:tun.1002@192.168.1.132</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: Required head,tailroom: 20,0</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: calling room for <ESP_3DES_HMAC_SHA1>, <a href="mailto:SA%3Aesp.1867139c@192.168.1.132">SA:esp.1867139c@192.168.1.132</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: Required head,tailroom: 16,16</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: existing head,tailroom: 2,28 before applying xforms with head,tailroom: 36,16 .</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: mtu:1500 physmtu:1500 tothr:36 tottr:16 mtudiff:52 ippkttotlen:84</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_info:ipsec_xmit_encap_bundle: dev ipsec0 mtu of 1500 decreased by 57 to 1443</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: allocating 14 bytes for hardheader.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: head,tailroom: 16,28 after hard_header stripped.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:84 id:0 DF frag_off:0 ttl:64 proto:1 (ICMP) chk:58732 saddr:192.168.100.234 daddr:192.168.111.1 type:code=8:0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: head,tailroom: 68,104 after allocation</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:84 id:0 DF frag_off:0 ttl:64 proto:1 (ICMP) chk:58732 saddr:192.168.100.234 daddr:192.168.111.1 type:code=8:0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: calling output for <IPIP>, <a href="mailto:SA%3Atun.1002@192.168.1.132">SA:tun.1002@192.168.1.132</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: pushing 20 bytes, putting 0, proto 4.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: head,tailroom: 48,104 before xform.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: after <IPIP>, <a href="mailto:SA%3Atun.1002@192.168.1.132">SA:tun.1002@192.168.1.132</a>:</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:104 id:46843 frag_off:0 ttl:64 proto:4 chk:16088 saddr:192.168.1.234 daddr:192.168.1.132</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:104 id:46843 frag_off:0 ttl:64 proto:4 chk:16088 saddr:192.168.1.234 daddr:192.168.1.132</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: calling output for <ESP_3DES_HMAC_SHA1>, <a href="mailto:SA%3Aesp.1867139c@192.168.1.132">SA:esp.1867139c@192.168.1.132</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: pushing 16 bytes, putting 16, proto 50.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: head,tailroom: 32,88 before xform.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_dmp: at pre-encrypt, len=136:</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @000: 45 00 00 88 b6 fb 00 00 40 32 3e d8 c0 a8 01 ea</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @010: c0 a8 01 84 18 67 13 9c 00 00 00 02 c0 a8 01 ea</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @020: c0 a8 01 84 45 00 00 54 00 00 40 00 40 01 e5 6c</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @030: c0 a8 64 ea c0 a8 6f 01 08 00 38 4f 3a 37 00 00</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @040: 0d 20 35 2d 00 00 00 00 00 00 00 00 00 00 00 00</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @060: 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @070: 68 8d 0c 08 34 c7 99 bf 01 02 02 04 04 00 00 00</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: @080: 50 e5 74 64 64 ed 07 00</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: entering with encalg=3, ixt_e=df0c3bc0</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: calling cbc_encrypt encalg=3 ips_key_e=d26c5400 idat=de5f6644 ilen=88 iv=de5f663c, encrypt=1</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: returned ret=1</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: after <ESP_3DES_HMAC_SHA1>, <a href="mailto:SA%3Aesp.1867139c@192.168.1.132">SA:esp.1867139c@192.168.1.132</a>:</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:136 id:46843 frag_off:0 ttl:64 proto:50 (ESP) chk:16010 saddr:192.168.1.234 daddr:192.168.1.132</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:136 id:46843 frag_off:0 ttl:64 proto:50 (ESP) chk:16010 saddr:192.168.1.234 daddr:192.168.1.132</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_error:ipsec_sa_put: null pointer passed in!</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_findroute: 192.168.1.234:0-><a href="http://192.168.1.132:0">192.168.1.132:0</a> 50</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: * See if we match exactly as a host destination</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: ** try to match a leaf, t=0pde630180</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: *** start searching up the tree, t=0pde630180</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: **** t=0pde630198</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: **** t=0pdc8838c0</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: ***** cp2=0pd5f31d68 cp3=0pd8d998d0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:rj_match: ***** not found.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_restore_hard_header: After recursive xforms -- head,tailroom: 32,88</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_restore_hard_header: With hard_header, final head,tailroom: 18,88</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug:ipsec_xmit_send: ...done, calling ip_send() on device:eth1</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 12:49:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:136 id:46843 frag_off:0 ttl:64 proto:50 (ESP) chk:16010 saddr:192.168.1.234 daddr:192.168.1.132</span></div>
<div><br></div></span></div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold; ">5.WITH NAT NetWork </span><span class="Apple-style-span" style="font-weight: bold; "><a class="explain" href="javascript:void(0)">topology:</a></span><br>
</div><div><span class="Apple-style-span" style="font-weight: bold;">PC A</span></div><div>eth0:192.168.100.234</div><div>eth1:192.168.111.234</div><div>Gateway: 192.168.111.1(<span class="Apple-style-span" style="font-weight: bold;">udp port 500,4500 natted to PC A</span>)</div>
<div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">Server B:</span></div><div>ppp0--->pppoe</div><div>eth1:192.168.80.1</div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">6.ipsec.conf (PC A)</span></div>
<div><div>version 2.0 # conforms to second version of ipsec.conf specification</div><div>config setup<br></div><div> plutodebug = all</div><div> klipsdebug = all</div><div> nat_traversal=yes<br></div>
<div> interfaces = "%defaultroute"<br></div><div>include /etc/ipsec.d/examples/no_oe.conf <br></div><div><div>conn cylan</div><div> type = tunnel</div><div> auto = start</div><div> keyexchange = ike</div>
<div> authby = secret</div><div> auth = esp</div><div> esp = 3DES-SHA1</div><div> ike = 3DES-SHA1-MODP1024</div><div> aggrmode = yes</div><div> pfs = yes</div><div> pfsgroup = MODP1024</div>
<div> left = %defaultroute</div><div> leftsubnet = <a href="http://192.168.100.0/255.255.255.0">192.168.100.0/255.255.255.0</a></div><div> right = 219.133.245.113</div><div> rightsubnet = <a href="http://192.168.80.0/255.255.255.0">192.168.80.0/255.255.255.0</a></div>
<div> leftid = @bbb</div><div> rightid = @aaa</div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold; ">7.tcp dump result on PC A</span><br></div><div><div>-bash-3.2$ sudo ./tcpdump -i eth1 host 219.133.245.113</div>
<div>tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</div><div>listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes</div><div>14:55:14.424375 IP 192.168.111.234.ipsec-nat-t > 113.245.133.219.broad.sz.gd.dynamic.163data.com.cn.ipsec-nat-t: UDP-encap: ESP(spi=0x4f6ec270,seq=0x2), length 92</div>
<div>14:55:23.105922 IP 192.168.111.234.ipsec-nat-t > 113.245.133.219.broad.sz.gd.dynamic.163data.com.cn.ipsec-nat-t: UDP-encap: ESP(spi=0x4f6ec270,seq=0x3), length 92</div><div>14:55:25.115728 IP 192.168.111.234.ipsec-nat-t > 113.245.133.219.broad.sz.gd.dynamic.163data.com.cn.ipsec-nat-t: isakmp-nat-keep-alive</div>
<div>14:55:25.117799 IP 192.168.111.234.ipsec-nat-t > 113.245.133.219.broad.sz.gd.dynamic.163data.com.cn.ipsec-nat-t: isakmp-nat-keep-alive</div><div><br></div><div>4 packets captured</div><div>4 packets received by filter</div>
<div>0 packets dropped by kernel</div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold;">ipsec0 got ICMP echo replys,it's ok</span></div><div>-bash-3.2$ sudo ./tcpdump -i ipsec0 -vv </div>
<div>tcpdump: listening on ipsec0, link-type EN10MB (Ethernet), capture size 96 bytes</div><div>14:56:34.183178 IP (tos 0x0, ttl 127, id 44881, offset 0, flags [none], proto ICMP (1), length 60) 192.168.100.10 > <a href="http://192.168.80.1">192.168.80.1</a>: ICMP echo request, id 768, seq 36352, length 40</div>
<div>14:56:34.207201 IP (tos 0x0, ttl 64, id 50421, offset 0, flags [none], proto ICMP (1), length 60) 192.168.80.1 > <a href="http://192.168.100.10">192.168.100.10</a>: ICMP echo reply, id 768, seq 36352, length 40</div>
<div><br></div><div>2 packets captured</div><div>2 packets received by filter</div><div>0 packets dropped by kernel</div><div>-bash-3.2$ </div><div><br></div><div><span class="Apple-style-span" style="font-weight: bold; ">8.ipsec log file(with icmp result)</span><br>
</div><div><span class="Apple-style-span" style="font-weight: bold;"><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_tunnel_neigh_setup:</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_tunnel_hard_header: skb->dev=ipsec0 dev=ipsec0.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_tunnel_hard_header: Revectored 0p00000000->0pd80e4a24 len=60 type=2048 dev=ipsec0->eth1 dev_addr=00:50:c2:1c:97:92 ip=c0a8640a->c0a85001</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_strip_hard_header: >>> skb->len=74 hard_header_len:14 00:50:c2:1c:97:92:00:50:c2:1c:97:92:08:00 </span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:60 id:48219 frag_off:0 ttl:127 proto:1 (ICMP) chk:18953 saddr:192.168.100.10 daddr:192.168.80.1 type:code=8:0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_strip_hard_header: Original head,tailroom: 18,36</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_findroute: 192.168.100.10:0-><a href="http://192.168.80.1:0">192.168.80.1:0</a> 1</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: * See if we match exactly as a host destination</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: ** try to match a leaf, t=0pd85d0e40</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_SAlookup: checking for local udp/500 IKE packet saddr=c0a8640a, er=0pd85d0e40, daddr=c0a85001, er_dst=db85f571, proto=1 sport=0 dport=0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_sa_getbyid: linked entry in ipsec_sa table for hash=234 of <a href="mailto:SA%3Atun.1004@219.133.245.113">SA:tun.1004@219.133.245.113</a> requested.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: found ipsec_sa -- SA:<IPIP> <a href="mailto:tun.1004@219.133.245.113">tun.1004@219.133.245.113</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: calling room for <IPIP>, <a href="mailto:SA%3Atun.1004@219.133.245.113">SA:tun.1004@219.133.245.113</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: Required head,tailroom: 20,0</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: calling room for <ESP_3DES_HMAC_SHA1>, <a href="mailto:SA%3Aesp.4f6ec270@219.133.245.113">SA:esp.4f6ec270@219.133.245.113</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: Required head,tailroom: 16,24</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: existing head,tailroom: 18,36 before applying xforms with head,tailroom: 36,24 .</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: mtu:1500 physmtu:1500 tothr:36 tottr:24 mtudiff:60 ippkttotlen:60</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_info:ipsec_xmit_encap_bundle: dev ipsec0 mtu of 1500 decreased by 65 to 1435</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: allocating 14 bytes for hardheader.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: head,tailroom: 32,36 after hard_header stripped.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:60 id:48219 frag_off:0 ttl:127 proto:1 (ICMP) chk:18953 saddr:192.168.100.10 daddr:192.168.80.1 type:code=8:0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_bundle: head,tailroom: 68,128 after allocation</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:60 id:48219 frag_off:0 ttl:127 proto:1 (ICMP) chk:18953 saddr:192.168.100.10 daddr:192.168.80.1 type:code=8:0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: calling output for <IPIP>, <a href="mailto:SA%3Atun.1004@219.133.245.113">SA:tun.1004@219.133.245.113</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: pushing 20 bytes, putting 0, proto 4.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: head,tailroom: 48,128 before xform.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: after <IPIP>, <a href="mailto:SA%3Atun.1004@219.133.245.113">SA:tun.1004@219.133.245.113</a>:</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:80 id:43802 frag_off:0 ttl:64 proto:4 chk:52741 saddr:192.168.111.234 daddr:219.133.245.113</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:80 id:43802 frag_off:0 ttl:64 proto:4 chk:52741 saddr:192.168.111.234 daddr:219.133.245.113</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: calling output for <ESP_3DES_HMAC_SHA1>, <a href="mailto:SA%3Aesp.4f6ec270@219.133.245.113">SA:esp.4f6ec270@219.133.245.113</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: pushing 16 bytes, putting 16, proto 50.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: head,tailroom: 32,112 before xform.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_dmp: at pre-encrypt, len=112:</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: @000: 45 00 00 70 ab 1a 00 00 40 32 ce 05 c0 a8 6f ea</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: @010: db 85 f5 71 4f 6e c2 70 00 00 00 08 c0 a8 6f ea</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: @020: db 85 f5 71 45 00 00 3c bc 5b 00 00 7f 01 4a 09</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: @030: c0 a8 64 0a c0 a8 50 01 08 00 ba 5b 03 00 90 00</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: @040: 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: @050: 71 72 73 74 75 76 77 61 62 63 64 65 66 67 68 69</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: @060: 01 02 02 04 00 00 00 00 00 00 00 00 00 00 00 00</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: entering with encalg=3, ixt_e=df0c3bc0</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: calling cbc_encrypt encalg=3 ips_key_e=de5f6800 idat=d1f03c44 ilen=64 iv=d1f03c3c, encrypt=1</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: returned ret=1</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_encap_once: after <ESP_3DES_HMAC_SHA1>, <a href="mailto:SA%3Aesp.4f6ec270@219.133.245.113">SA:esp.4f6ec270@219.133.245.113</a>:</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:112 id:43802 frag_off:0 ttl:64 proto:50 (ESP) chk:52663 saddr:192.168.111.234 daddr:219.133.245.113</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:112 id:43802 frag_off:0 ttl:64 proto:50 (ESP) chk:52663 saddr:192.168.111.234 daddr:219.133.245.113</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_error:ipsec_sa_put: null pointer passed in!</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_findroute: 192.168.111.234:0-><a href="http://219.133.245.113:0">219.133.245.113:0</a> 50</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: * See if we match exactly as a host destination</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: ** try to match a leaf, t=0pd85d0e40</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: *** start searching up the tree, t=0pd85d0e40</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: **** t=0pd85d0e58</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: **** t=0pd80e4f40</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: ***** cp2=0pd94d9aa8 cp3=0pd8d99990</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:rj_match: ***** not found.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_restore_hard_header: After recursive xforms -- head,tailroom: 32,112</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_tunnel_start_xmit: encapsuling packet into UDP (NAT-Traversal) (2 8)</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_restore_hard_header: With hard_header, final head,tailroom: 18,104</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_xmit_send: ...done, calling ip_send() on device:eth1</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:120 id:43802 frag_off:0 ttl:64 proto:17 (UDP) chk:52688 saddr:<a href="http://192.168.111.234:4500">192.168.111.234:4500</a> daddr:<a href="http://219.133.245.113:4500">219.133.245.113:4500</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:112 id:50426 frag_off:0 ttl:62 proto:50 (ESP) chk:46576 saddr:219.133.245.113 daddr:192.168.111.234</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv_decap_once: decap (50) from 219.133.245.113 -> 192.168.111.234</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_sa_getbyid: linked entry in ipsec_sa table for hash=113 of <a href="mailto:SA%3Aesp.a4cc5288@192.168.111.234">SA:esp.a4cc5288@192.168.111.234</a> requested.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: <a href="mailto:SA%3Aesp.a4cc5288@192.168.111.234">SA:esp.a4cc5288@192.168.111.234</a>, src=219.133.245.113 of pkt agrees with expected SA source address policy.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: <a href="mailto:SA%3Aesp.a4cc5288@192.168.111.234">SA:esp.a4cc5288@192.168.111.234</a> First SA in group.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: natt_type=2 tdbp->ips_natt_type=2 : ok</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: packet from 219.133.245.113 received with seq=8 (iv)=0x528c134e3bcb1e22 iplen=92 esplen=80 sa=<a href="mailto:esp.a4cc5288@192.168.111.234">esp.a4cc5288@192.168.111.234</a></span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: encalg = 3, authalg = 3.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: authentication successful.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: encalg=3 esphlen=16</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: entering with encalg=3, ixt_e=df0c3bc0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: calling cbc_encrypt encalg=3 ips_key_e=d88e4000 idat=d1f03c4c ilen=64 iv=d1f03c44, encrypt=0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_alg_esp_encrypt: returned ret=1</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: padlen=2, contents: 0x<offset>: 0x<value> 0x<value> ...</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: 00: 01 02</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: packet decrypted from <a href="http://219.133.245.113">219.133.245.113</a>: next_header = 4, padding = 2</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: trimming to 60.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: after <ESP_3DES_HMAC_SHA1>, <a href="mailto:SA%3Aesp.a4cc5288@192.168.111.234">SA:esp.a4cc5288@192.168.111.234</a>:</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:80 id:50426 frag_off:0 ttl:62 proto:4 chk:46629 saddr:219.133.245.113 daddr:192.168.111.234</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: <a href="mailto:SA%3Aesp.a4cc5288@192.168.111.234">SA:esp.a4cc5288@192.168.111.234</a>, Another IPSEC header to process.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: ESP SA sets skb->nfmark=0x170000.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: IPIP tunnel stripped.</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug: IP: ihl:20 ver:4 tos:0 tlen:60 id:50425 frag_off:0 ttl:64 proto:1 (ICMP) chk:32875 saddr:192.168.80.1 daddr:192.168.100.10 type:code=0:0</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: IPIP SA sets skb->nfmark=0x170000.</span></div><div><span class="Apple-style-span" style="font-weight: normal;">Mar 16 15:10:32 SSLVPN kernel: klips_debug:ipsec_rcv: netif_rx() called.</span></div>
<div><br></div><div><br></div><div>9.udp.c manully patched...</div><div><div><span class="Apple-style-span" style="font-weight: normal;">start line:1097</span></div><div><span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;">if (ret < 0) {</span></div>
<div><span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;">if(xfrm4_rcv_encap_func != NULL) {</span></div>
<div><span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;"> ret = (*xfrm4_rcv_encap_func)(skb, up->encap_type);</span></div>
<div><span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;"> UDP_INC_STATS_BH(UDP_MIB_INDATAGRAMS,up->pcflag);</span></div>
<div><span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;">} else {</span></div><div>
<span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;"> UDP_INC_STATS_BH(UDP_MIB_INERRORS,up->pcflag);</span></div>
<div><span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;"> ret = 1;</span></div><div>
<span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;">}</span></div><div><span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;">return ret;</span></div>
<div><span class="Apple-style-span" style="font-weight: normal;"><br></span></div><div><span class="Apple-tab-span" style="white-space:pre"><span class="Apple-style-span" style="font-weight: normal;"> </span></span><span class="Apple-style-span" style="font-weight: normal;">}</span></div>
<div><br></div></div></span></div><div><br></div></div></div></div>-- <br>from Romeo<br>
</div>