adopt to recent changes

38 files changed, 60 insertions, 88 deletions

diff --git a/regress/sbin/ipsecctl/Makefile b/regress/sbin/ipsecctl/Makefile
index 23398b546d5..a0e6e3a57d3 100644
--- a/regress/sbin/ipsecctl/Makefile
+++ b/regress/sbin/ipsecctl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.34 2006/06/15 17:03:21 hshoexer Exp $
+# $OpenBSD: Makefile,v 1.35 2006/06/18 18:18:23 hshoexer Exp $
 
 # TARGETS
 # ipsec: feed ipsecNN.in through ipsecctl and check wether the output matches
@@ -18,12 +18,12 @@ IKEFAIL=1 3 4 5
 IKETESTS=1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
 IKETESTS+=16 17 18 19 20 21 22 23
 IKETESTS+=29 30 31 32 33 34 35 36 37 38 39 40
-IKETESTS+=41 42 43 46 47
+IKETESTS+=41 42 43 46 49
 
 IKEDELTESTS=1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
 IKEDELTESTS+=16 17 18 19 20 21 22 23
 IKEDELTESTS+=29 30 31 32 33 34 35 36 37 38 39 40
-IKEDELTESTS+=41 42 43 46 47
+IKEDELTESTS+=41 42 43 46 47 48 49 50
 
 SHELL=/bin/sh
 
diff --git a/regress/sbin/ipsecctl/ike1.ok b/regress/sbin/ipsecctl/ike1.ok
index d0477799084..6dd25d7df47 100644
--- a/regress/sbin/ipsecctl/ike1.ok
+++ b/regress/sbin/ipsecctl/ike1.ok
@@ -10,7 +10,7 @@ C set [IPsec-131.188.33.51-131.188.33.29]:Configuration=qm-131.188.33.51-131.188
 C set [IPsec-131.188.33.51-131.188.33.29]:Local-ID=lid-131.188.33.51 force
 C set [IPsec-131.188.33.51-131.188.33.29]:Remote-ID=rid-131.188.33.29 force
 C set [qm-131.188.33.51-131.188.33.29]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-131.188.33.51-131.188.33.29]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-131.188.33.51-131.188.33.29]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-131.188.33.51]:ID-type=IPV4_ADDR force
 C set [lid-131.188.33.51]:Address=131.188.33.51 force
 C set [rid-131.188.33.29]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike10.ok b/regress/sbin/ipsecctl/ike10.ok
index 6e0f43e75df..f85b51d3de8 100644
--- a/regress/sbin/ipsecctl/ike10.ok
+++ b/regress/sbin/ipsecctl/ike10.ok
@@ -10,7 +10,7 @@ C set [IPsec-192.168.100.1-192.168.200.1]:Configuration=qm-192.168.100.1-192.168
 C set [IPsec-192.168.100.1-192.168.200.1]:Local-ID=lid-192.168.100.1 force
 C set [IPsec-192.168.100.1-192.168.200.1]:Remote-ID=rid-192.168.200.1 force
 C set [qm-192.168.100.1-192.168.200.1]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-192.168.100.1-192.168.200.1]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-192.168.100.1-192.168.200.1]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-192.168.100.1]:ID-type=IPV4_ADDR force
 C set [lid-192.168.100.1]:Address=192.168.100.1 force
 C set [rid-192.168.200.1]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike11.ok b/regress/sbin/ipsecctl/ike11.ok
index efb364da6c9..e4d181ed6f2 100644
--- a/regress/sbin/ipsecctl/ike11.ok
+++ b/regress/sbin/ipsecctl/ike11.ok
@@ -11,7 +11,7 @@ C set [IPsec-1.1.1.1-0.0.0.0/0]:Configuration=qm-1.1.1.1-0.0.0.0/0 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Remote-ID=rid-0.0.0.0/0 force
 C set [qm-1.1.1.1-0.0.0.0/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-0.0.0.0/0]:ID-type=IPV4_ADDR_SUBNET force
@@ -31,7 +31,7 @@ C set [IPsec-1.1.1.1-0.0.0.0/0]:Configuration=qm-1.1.1.1-0.0.0.0/0 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Remote-ID=rid-0.0.0.0/0 force
 C set [qm-1.1.1.1-0.0.0.0/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-0.0.0.0/0]:ID-type=IPV4_ADDR_SUBNET force
diff --git a/regress/sbin/ipsecctl/ike12.ok b/regress/sbin/ipsecctl/ike12.ok
index 2d582593515..717fae039db 100644
--- a/regress/sbin/ipsecctl/ike12.ok
+++ b/regress/sbin/ipsecctl/ike12.ok
@@ -11,7 +11,7 @@ C set [IPsec-1.1.1.1-2.2.2.0/24]:Configuration=qm-1.1.1.1-2.2.2.0/24 force
 C set [IPsec-1.1.1.1-2.2.2.0/24]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-2.2.2.0/24]:Remote-ID=rid-2.2.2.0/24 force
 C set [qm-1.1.1.1-2.2.2.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-2.2.2.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-2.2.2.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-2.2.2.0/24]:ID-type=IPV4_ADDR_SUBNET force
@@ -30,7 +30,7 @@ C set [IPsec-1.1.1.1-3.3.3.0/24]:Configuration=qm-1.1.1.1-3.3.3.0/24 force
 C set [IPsec-1.1.1.1-3.3.3.0/24]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-3.3.3.0/24]:Remote-ID=rid-3.3.3.0/24 force
 C set [qm-1.1.1.1-3.3.3.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-3.3.3.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-3.3.3.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-3.3.3.0/24]:ID-type=IPV4_ADDR_SUBNET force
@@ -49,7 +49,7 @@ C set [IPsec-1.1.1.1-4.4.4.0/24]:Configuration=qm-1.1.1.1-4.4.4.0/24 force
 C set [IPsec-1.1.1.1-4.4.4.0/24]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-4.4.4.0/24]:Remote-ID=rid-4.4.4.0/24 force
 C set [qm-1.1.1.1-4.4.4.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-4.4.4.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-4.4.4.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-4.4.4.0/24]:ID-type=IPV4_ADDR_SUBNET force
diff --git a/regress/sbin/ipsecctl/ike13.ok b/regress/sbin/ipsecctl/ike13.ok
index 309be6371ca..9e8900effb5 100644
--- a/regress/sbin/ipsecctl/ike13.ok
+++ b/regress/sbin/ipsecctl/ike13.ok
@@ -11,7 +11,7 @@ C set [IPsec-2.2.2.0/24-1.1.1.1]:Configuration=qm-2.2.2.0/24-1.1.1.1 force
 C set [IPsec-2.2.2.0/24-1.1.1.1]:Local-ID=lid-2.2.2.0/24 force
 C set [IPsec-2.2.2.0/24-1.1.1.1]:Remote-ID=rid-1.1.1.1 force
 C set [qm-2.2.2.0/24-1.1.1.1]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-2.2.2.0/24-1.1.1.1]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-2.2.2.0/24-1.1.1.1]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-2.2.2.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-2.2.2.0/24]:Network=2.2.2.0 force
 C set [lid-2.2.2.0/24]:Netmask=255.255.255.0 force
@@ -30,7 +30,7 @@ C set [IPsec-3.3.3.0/24-1.1.1.1]:Configuration=qm-3.3.3.0/24-1.1.1.1 force
 C set [IPsec-3.3.3.0/24-1.1.1.1]:Local-ID=lid-3.3.3.0/24 force
 C set [IPsec-3.3.3.0/24-1.1.1.1]:Remote-ID=rid-1.1.1.1 force
 C set [qm-3.3.3.0/24-1.1.1.1]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3.3.3.0/24-1.1.1.1]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3.3.3.0/24-1.1.1.1]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3.3.3.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-3.3.3.0/24]:Network=3.3.3.0 force
 C set [lid-3.3.3.0/24]:Netmask=255.255.255.0 force
@@ -49,7 +49,7 @@ C set [IPsec-4.4.4.0/24-1.1.1.1]:Configuration=qm-4.4.4.0/24-1.1.1.1 force
 C set [IPsec-4.4.4.0/24-1.1.1.1]:Local-ID=lid-4.4.4.0/24 force
 C set [IPsec-4.4.4.0/24-1.1.1.1]:Remote-ID=rid-1.1.1.1 force
 C set [qm-4.4.4.0/24-1.1.1.1]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-4.4.4.0/24-1.1.1.1]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-4.4.4.0/24-1.1.1.1]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-4.4.4.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-4.4.4.0/24]:Network=4.4.4.0 force
 C set [lid-4.4.4.0/24]:Netmask=255.255.255.0 force
diff --git a/regress/sbin/ipsecctl/ike14.ok b/regress/sbin/ipsecctl/ike14.ok
index 6e95f4da0b6..b43b0124466 100644
--- a/regress/sbin/ipsecctl/ike14.ok
+++ b/regress/sbin/ipsecctl/ike14.ok
@@ -12,7 +12,7 @@ C set [IPsec-2.2.2.0/24-5.5.5.0/24]:Configuration=qm-2.2.2.0/24-5.5.5.0/24 force
 C set [IPsec-2.2.2.0/24-5.5.5.0/24]:Local-ID=lid-2.2.2.0/24 force
 C set [IPsec-2.2.2.0/24-5.5.5.0/24]:Remote-ID=rid-5.5.5.0/24 force
 C set [qm-2.2.2.0/24-5.5.5.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-2.2.2.0/24-5.5.5.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-2.2.2.0/24-5.5.5.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-2.2.2.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-2.2.2.0/24]:Network=2.2.2.0 force
 C set [lid-2.2.2.0/24]:Netmask=255.255.255.0 force
@@ -32,7 +32,7 @@ C set [IPsec-2.2.2.0/24-6.6.6.0/24]:Configuration=qm-2.2.2.0/24-6.6.6.0/24 force
 C set [IPsec-2.2.2.0/24-6.6.6.0/24]:Local-ID=lid-2.2.2.0/24 force
 C set [IPsec-2.2.2.0/24-6.6.6.0/24]:Remote-ID=rid-6.6.6.0/24 force
 C set [qm-2.2.2.0/24-6.6.6.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-2.2.2.0/24-6.6.6.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-2.2.2.0/24-6.6.6.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-2.2.2.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-2.2.2.0/24]:Network=2.2.2.0 force
 C set [lid-2.2.2.0/24]:Netmask=255.255.255.0 force
@@ -52,7 +52,7 @@ C set [IPsec-2.2.2.0/24-7.7.7.0/24]:Configuration=qm-2.2.2.0/24-7.7.7.0/24 force
 C set [IPsec-2.2.2.0/24-7.7.7.0/24]:Local-ID=lid-2.2.2.0/24 force
 C set [IPsec-2.2.2.0/24-7.7.7.0/24]:Remote-ID=rid-7.7.7.0/24 force
 C set [qm-2.2.2.0/24-7.7.7.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-2.2.2.0/24-7.7.7.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-2.2.2.0/24-7.7.7.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-2.2.2.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-2.2.2.0/24]:Network=2.2.2.0 force
 C set [lid-2.2.2.0/24]:Netmask=255.255.255.0 force
@@ -72,7 +72,7 @@ C set [IPsec-3.3.3.0/24-5.5.5.0/24]:Configuration=qm-3.3.3.0/24-5.5.5.0/24 force
 C set [IPsec-3.3.3.0/24-5.5.5.0/24]:Local-ID=lid-3.3.3.0/24 force
 C set [IPsec-3.3.3.0/24-5.5.5.0/24]:Remote-ID=rid-5.5.5.0/24 force
 C set [qm-3.3.3.0/24-5.5.5.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3.3.3.0/24-5.5.5.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3.3.3.0/24-5.5.5.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3.3.3.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-3.3.3.0/24]:Network=3.3.3.0 force
 C set [lid-3.3.3.0/24]:Netmask=255.255.255.0 force
@@ -92,7 +92,7 @@ C set [IPsec-3.3.3.0/24-6.6.6.0/24]:Configuration=qm-3.3.3.0/24-6.6.6.0/24 force
 C set [IPsec-3.3.3.0/24-6.6.6.0/24]:Local-ID=lid-3.3.3.0/24 force
 C set [IPsec-3.3.3.0/24-6.6.6.0/24]:Remote-ID=rid-6.6.6.0/24 force
 C set [qm-3.3.3.0/24-6.6.6.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3.3.3.0/24-6.6.6.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3.3.3.0/24-6.6.6.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3.3.3.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-3.3.3.0/24]:Network=3.3.3.0 force
 C set [lid-3.3.3.0/24]:Netmask=255.255.255.0 force
@@ -112,7 +112,7 @@ C set [IPsec-3.3.3.0/24-7.7.7.0/24]:Configuration=qm-3.3.3.0/24-7.7.7.0/24 force
 C set [IPsec-3.3.3.0/24-7.7.7.0/24]:Local-ID=lid-3.3.3.0/24 force
 C set [IPsec-3.3.3.0/24-7.7.7.0/24]:Remote-ID=rid-7.7.7.0/24 force
 C set [qm-3.3.3.0/24-7.7.7.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3.3.3.0/24-7.7.7.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3.3.3.0/24-7.7.7.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3.3.3.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-3.3.3.0/24]:Network=3.3.3.0 force
 C set [lid-3.3.3.0/24]:Netmask=255.255.255.0 force
@@ -132,7 +132,7 @@ C set [IPsec-4.4.4.0/24-5.5.5.0/24]:Configuration=qm-4.4.4.0/24-5.5.5.0/24 force
 C set [IPsec-4.4.4.0/24-5.5.5.0/24]:Local-ID=lid-4.4.4.0/24 force
 C set [IPsec-4.4.4.0/24-5.5.5.0/24]:Remote-ID=rid-5.5.5.0/24 force
 C set [qm-4.4.4.0/24-5.5.5.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-4.4.4.0/24-5.5.5.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-4.4.4.0/24-5.5.5.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-4.4.4.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-4.4.4.0/24]:Network=4.4.4.0 force
 C set [lid-4.4.4.0/24]:Netmask=255.255.255.0 force
@@ -152,7 +152,7 @@ C set [IPsec-4.4.4.0/24-6.6.6.0/24]:Configuration=qm-4.4.4.0/24-6.6.6.0/24 force
 C set [IPsec-4.4.4.0/24-6.6.6.0/24]:Local-ID=lid-4.4.4.0/24 force
 C set [IPsec-4.4.4.0/24-6.6.6.0/24]:Remote-ID=rid-6.6.6.0/24 force
 C set [qm-4.4.4.0/24-6.6.6.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-4.4.4.0/24-6.6.6.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-4.4.4.0/24-6.6.6.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-4.4.4.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-4.4.4.0/24]:Network=4.4.4.0 force
 C set [lid-4.4.4.0/24]:Netmask=255.255.255.0 force
@@ -172,7 +172,7 @@ C set [IPsec-4.4.4.0/24-7.7.7.0/24]:Configuration=qm-4.4.4.0/24-7.7.7.0/24 force
 C set [IPsec-4.4.4.0/24-7.7.7.0/24]:Local-ID=lid-4.4.4.0/24 force
 C set [IPsec-4.4.4.0/24-7.7.7.0/24]:Remote-ID=rid-7.7.7.0/24 force
 C set [qm-4.4.4.0/24-7.7.7.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-4.4.4.0/24-7.7.7.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-4.4.4.0/24-7.7.7.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-4.4.4.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-4.4.4.0/24]:Network=4.4.4.0 force
 C set [lid-4.4.4.0/24]:Netmask=255.255.255.0 force
diff --git a/regress/sbin/ipsecctl/ike15.ok b/regress/sbin/ipsecctl/ike15.ok
index 778ea1f594b..0e545f5f52d 100644
--- a/regress/sbin/ipsecctl/ike15.ok
+++ b/regress/sbin/ipsecctl/ike15.ok
@@ -16,7 +16,7 @@ C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Configuration=qm-10.1.1.0/24-10.1.2.0/24 f
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Local-ID=lid-10.1.1.0/24 force
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Remote-ID=rid-10.1.2.0/24 force
 C set [qm-10.1.1.0/24-10.1.2.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-10.1.1.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-10.1.1.0/24]:Network=10.1.1.0 force
 C set [lid-10.1.1.0/24]:Netmask=255.255.255.0 force
diff --git a/regress/sbin/ipsecctl/ike17.ok b/regress/sbin/ipsecctl/ike17.ok
index 765f90222e7..2907516ed91 100644
--- a/regress/sbin/ipsecctl/ike17.ok
+++ b/regress/sbin/ipsecctl/ike17.ok
@@ -10,7 +10,7 @@ C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Configuration=qm-10.1.1.0/24-10.1.2.0/24 f
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Local-ID=lid-10.1.1.0/24 force
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Remote-ID=rid-10.1.2.0/24 force
 C set [qm-10.1.1.0/24-10.1.2.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-10.1.1.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-10.1.1.0/24]:Network=10.1.1.0 force
 C set [lid-10.1.1.0/24]:Netmask=255.255.255.0 force
@@ -30,7 +30,7 @@ C set [IPsec-3ffe::51-3ffe::29]:Configuration=qm-3ffe::51-3ffe::29 force
 C set [IPsec-3ffe::51-3ffe::29]:Local-ID=lid-3ffe::51 force
 C set [IPsec-3ffe::51-3ffe::29]:Remote-ID=rid-3ffe::29 force
 C set [qm-3ffe::51-3ffe::29]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::51-3ffe::29]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::51-3ffe::29]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::51]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::51]:Address=3ffe::51 force
 C set [rid-3ffe::29]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike18.ok b/regress/sbin/ipsecctl/ike18.ok
index 36bd8a67ac0..921141fe4a5 100644
--- a/regress/sbin/ipsecctl/ike18.ok
+++ b/regress/sbin/ipsecctl/ike18.ok
@@ -10,7 +10,7 @@ C set [IPsec-10.1.2.0/24-10.1.1.0/24]:Configuration=qm-10.1.2.0/24-10.1.1.0/24 f
 C set [IPsec-10.1.2.0/24-10.1.1.0/24]:Local-ID=lid-10.1.2.0/24 force
 C set [IPsec-10.1.2.0/24-10.1.1.0/24]:Remote-ID=rid-10.1.1.0/24 force
 C set [qm-10.1.2.0/24-10.1.1.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-10.1.2.0/24-10.1.1.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-10.1.2.0/24-10.1.1.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-10.1.2.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-10.1.2.0/24]:Network=10.1.2.0 force
 C set [lid-10.1.2.0/24]:Netmask=255.255.255.0 force
@@ -30,7 +30,7 @@ C set [IPsec-3ffe::29-3ffe::51]:Configuration=qm-3ffe::29-3ffe::51 force
 C set [IPsec-3ffe::29-3ffe::51]:Local-ID=lid-3ffe::29 force
 C set [IPsec-3ffe::29-3ffe::51]:Remote-ID=rid-3ffe::51 force
 C set [qm-3ffe::29-3ffe::51]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::29-3ffe::51]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::29-3ffe::51]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::29]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::29]:Address=3ffe::29 force
 C set [rid-3ffe::51]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike19.ok b/regress/sbin/ipsecctl/ike19.ok
index d440bbc0629..983ee8e92b2 100644
--- a/regress/sbin/ipsecctl/ike19.ok
+++ b/regress/sbin/ipsecctl/ike19.ok
@@ -10,7 +10,7 @@ C set [IPsec-1.1.1.1-0.0.0.0/0]:Configuration=qm-1.1.1.1-0.0.0.0/0 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Remote-ID=rid-0.0.0.0/0 force
 C set [qm-1.1.1.1-0.0.0.0/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-0.0.0.0/0]:ID-type=IPV4_ADDR_SUBNET force
diff --git a/regress/sbin/ipsecctl/ike2.ok b/regress/sbin/ipsecctl/ike2.ok
index 11112ea8e12..6642e436d06 100644
--- a/regress/sbin/ipsecctl/ike2.ok
+++ b/regress/sbin/ipsecctl/ike2.ok
@@ -10,7 +10,7 @@ C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Configuration=qm-10.1.1.0/24-10.1.2.0/24 f
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Local-ID=lid-10.1.1.0/24 force
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Remote-ID=rid-10.1.2.0/24 force
 C set [qm-10.1.1.0/24-10.1.2.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-10.1.1.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-10.1.1.0/24]:Network=10.1.1.0 force
 C set [lid-10.1.1.0/24]:Netmask=255.255.255.0 force
diff --git a/regress/sbin/ipsecctl/ike20.ok b/regress/sbin/ipsecctl/ike20.ok
index efb364da6c9..e4d181ed6f2 100644
--- a/regress/sbin/ipsecctl/ike20.ok
+++ b/regress/sbin/ipsecctl/ike20.ok
@@ -11,7 +11,7 @@ C set [IPsec-1.1.1.1-0.0.0.0/0]:Configuration=qm-1.1.1.1-0.0.0.0/0 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Remote-ID=rid-0.0.0.0/0 force
 C set [qm-1.1.1.1-0.0.0.0/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-0.0.0.0/0]:ID-type=IPV4_ADDR_SUBNET force
@@ -31,7 +31,7 @@ C set [IPsec-1.1.1.1-0.0.0.0/0]:Configuration=qm-1.1.1.1-0.0.0.0/0 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Remote-ID=rid-0.0.0.0/0 force
 C set [qm-1.1.1.1-0.0.0.0/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-0.0.0.0/0]:ID-type=IPV4_ADDR_SUBNET force
diff --git a/regress/sbin/ipsecctl/ike21.ok b/regress/sbin/ipsecctl/ike21.ok
index 14dd3a6ee16..80082e5178c 100644
--- a/regress/sbin/ipsecctl/ike21.ok
+++ b/regress/sbin/ipsecctl/ike21.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe::1-3ffe::2]:Configuration=qm-3ffe::1-3ffe::2 force
 C set [IPsec-3ffe::1-3ffe::2]:Local-ID=lid-3ffe::1 force
 C set [IPsec-3ffe::1-3ffe::2]:Remote-ID=rid-3ffe::2 force
 C set [qm-3ffe::1-3ffe::2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::1-3ffe::2]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::1-3ffe::2]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::1]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::1]:Address=3ffe::1 force
 C set [rid-3ffe::2]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike22.ok b/regress/sbin/ipsecctl/ike22.ok
index 92465e7b950..b83f728152f 100644
--- a/regress/sbin/ipsecctl/ike22.ok
+++ b/regress/sbin/ipsecctl/ike22.ok
@@ -10,7 +10,7 @@ C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Configuration=qm-10.1.1.0/24-10.1.2.0/24 f
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Local-ID=lid-10.1.1.0/24 force
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Remote-ID=rid-10.1.2.0/24 force
 C set [qm-10.1.1.0/24-10.1.2.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-10.1.1.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-10.1.1.0/24]:Network=10.1.1.0 force
 C set [lid-10.1.1.0/24]:Netmask=255.255.255.0 force
diff --git a/regress/sbin/ipsecctl/ike23.ok b/regress/sbin/ipsecctl/ike23.ok
index 93a411fff95..757db5a7315 100644
--- a/regress/sbin/ipsecctl/ike23.ok
+++ b/regress/sbin/ipsecctl/ike23.ok
@@ -16,7 +16,7 @@ C set [IPsec-3ffe::51-3ffe::29]:Configuration=qm-3ffe::51-3ffe::29 force
 C set [IPsec-3ffe::51-3ffe::29]:Local-ID=lid-3ffe::51 force
 C set [IPsec-3ffe::51-3ffe::29]:Remote-ID=rid-3ffe::29 force
 C set [qm-3ffe::51-3ffe::29]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::51-3ffe::29]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::51-3ffe::29]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::51]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::51]:Address=3ffe::51 force
 C set [rid-3ffe::29]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike29.ok b/regress/sbin/ipsecctl/ike29.ok
index 4675d4f4f9f..ba6e2875e00 100644
--- a/regress/sbin/ipsecctl/ike29.ok
+++ b/regress/sbin/ipsecctl/ike29.ok
@@ -15,7 +15,7 @@ C set [IPsec-3ffe:3::/64-3ffe:4::/64]:Configuration=qm-3ffe:3::/64-3ffe:4::/64 f
 C set [IPsec-3ffe:3::/64-3ffe:4::/64]:Local-ID=lid-3ffe:3::/64 force
 C set [IPsec-3ffe:3::/64-3ffe:4::/64]:Remote-ID=rid-3ffe:4::/64 force
 C set [qm-3ffe:3::/64-3ffe:4::/64]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe:3::/64-3ffe:4::/64]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe:3::/64-3ffe:4::/64]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe:3::/64]:ID-type=IPV6_ADDR_SUBNET force
 C set [lid-3ffe:3::/64]:Network=3ffe:3:: force
 C set [lid-3ffe:3::/64]:Netmask=ffff:ffff:ffff:ffff:: force
diff --git a/regress/sbin/ipsecctl/ike3.ok b/regress/sbin/ipsecctl/ike3.ok
index fc7c3916764..be6f28aebb5 100644
--- a/regress/sbin/ipsecctl/ike3.ok
+++ b/regress/sbin/ipsecctl/ike3.ok
@@ -16,7 +16,7 @@ C set [IPsec-131.188.33.51-131.188.33.29]:Configuration=qm-131.188.33.51-131.188
 C set [IPsec-131.188.33.51-131.188.33.29]:Local-ID=lid-131.188.33.51 force
 C set [IPsec-131.188.33.51-131.188.33.29]:Remote-ID=rid-131.188.33.29 force
 C set [qm-131.188.33.51-131.188.33.29]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-131.188.33.51-131.188.33.29]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-131.188.33.51-131.188.33.29]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-131.188.33.51]:ID-type=IPV4_ADDR force
 C set [lid-131.188.33.51]:Address=131.188.33.51 force
 C set [rid-131.188.33.29]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike30.ok b/regress/sbin/ipsecctl/ike30.ok
index f1df19d02d7..ed191a4b8ab 100644
--- a/regress/sbin/ipsecctl/ike30.ok
+++ b/regress/sbin/ipsecctl/ike30.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe::1-3ffe::2]:Configuration=qm-3ffe::1-3ffe::2 force
 C set [IPsec-3ffe::1-3ffe::2]:Local-ID=lid-3ffe::1 force
 C set [IPsec-3ffe::1-3ffe::2]:Remote-ID=rid-3ffe::2 force
 C set [qm-3ffe::1-3ffe::2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::1-3ffe::2]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::1-3ffe::2]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::1]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::1]:Address=3ffe::1 force
 C set [rid-3ffe::2]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike31.ok b/regress/sbin/ipsecctl/ike31.ok
index 4a35e8c65c1..8ece3d3eddf 100644
--- a/regress/sbin/ipsecctl/ike31.ok
+++ b/regress/sbin/ipsecctl/ike31.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe:2::1-::/0]:Configuration=qm-3ffe:2::1-::/0 force
 C set [IPsec-3ffe:2::1-::/0]:Local-ID=lid-3ffe:2::1 force
 C set [IPsec-3ffe:2::1-::/0]:Remote-ID=rid-::/0 force
 C set [qm-3ffe:2::1-::/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe:2::1-::/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe:2::1-::/0]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe:2::1]:ID-type=IPV6_ADDR force
 C set [lid-3ffe:2::1]:Address=3ffe:2::1 force
 C set [rid-::/0]:ID-type=IPV6_ADDR_SUBNET force
diff --git a/regress/sbin/ipsecctl/ike32.ok b/regress/sbin/ipsecctl/ike32.ok
index 97f4022303e..f45965c03ca 100644
--- a/regress/sbin/ipsecctl/ike32.ok
+++ b/regress/sbin/ipsecctl/ike32.ok
@@ -11,7 +11,7 @@ C set [IPsec-1.1.1.1-2.2.2.2]:Configuration=qm-1.1.1.1-2.2.2.2 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Remote-ID=rid-2.2.2.2 force
 C set [qm-1.1.1.1-2.2.2.2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-2.2.2.2]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike33.ok b/regress/sbin/ipsecctl/ike33.ok
index e11446041fb..ce33fbe4545 100644
--- a/regress/sbin/ipsecctl/ike33.ok
+++ b/regress/sbin/ipsecctl/ike33.ok
@@ -11,7 +11,7 @@ C set [IPsec-1.1.1.1-2.2.2.2]:Configuration=qm-1.1.1.1-2.2.2.2 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Remote-ID=rid-2.2.2.2 force
 C set [qm-1.1.1.1-2.2.2.2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-2.2.2.2]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike34.ok b/regress/sbin/ipsecctl/ike34.ok
index cb7d9897b06..48b30a40058 100644
--- a/regress/sbin/ipsecctl/ike34.ok
+++ b/regress/sbin/ipsecctl/ike34.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe::1/24-3ffe:2::/24]:Configuration=qm-3ffe::1/24-3ffe:2::/24 for
 C set [IPsec-3ffe::1/24-3ffe:2::/24]:Local-ID=lid-3ffe::1/24 force
 C set [IPsec-3ffe::1/24-3ffe:2::/24]:Remote-ID=rid-3ffe:2::/24 force
 C set [qm-3ffe::1/24-3ffe:2::/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::1/24-3ffe:2::/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::1/24-3ffe:2::/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::1/24]:ID-type=IPV6_ADDR_SUBNET force
 C set [lid-3ffe::1/24]:Network=3ffe::1 force
 C set [lid-3ffe::1/24]:Netmask=ffff:ff00:: force
diff --git a/regress/sbin/ipsecctl/ike35.ok b/regress/sbin/ipsecctl/ike35.ok
index 92d2fc9a4bd..50f6a5f2d04 100644
--- a/regress/sbin/ipsecctl/ike35.ok
+++ b/regress/sbin/ipsecctl/ike35.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe:2::/24-3ffe::1/24]:Configuration=qm-3ffe:2::/24-3ffe::1/24 for
 C set [IPsec-3ffe:2::/24-3ffe::1/24]:Local-ID=lid-3ffe:2::/24 force
 C set [IPsec-3ffe:2::/24-3ffe::1/24]:Remote-ID=rid-3ffe::1/24 force
 C set [qm-3ffe:2::/24-3ffe::1/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe:2::/24-3ffe::1/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe:2::/24-3ffe::1/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe:2::/24]:ID-type=IPV6_ADDR_SUBNET force
 C set [lid-3ffe:2::/24]:Network=3ffe:2:: force
 C set [lid-3ffe:2::/24]:Netmask=ffff:ff00:: force
diff --git a/regress/sbin/ipsecctl/ike36.ok b/regress/sbin/ipsecctl/ike36.ok
index 69e3b7b4d6d..7e20d273efe 100644
--- a/regress/sbin/ipsecctl/ike36.ok
+++ b/regress/sbin/ipsecctl/ike36.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe::3-3ffe::4]:Configuration=qm-3ffe::3-3ffe::4 force
 C set [IPsec-3ffe::3-3ffe::4]:Local-ID=lid-3ffe::3 force
 C set [IPsec-3ffe::3-3ffe::4]:Remote-ID=rid-3ffe::4 force
 C set [qm-3ffe::3-3ffe::4]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::3-3ffe::4]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::3-3ffe::4]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::3]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::3]:Address=3ffe::3 force
 C set [rid-3ffe::4]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike37.ok b/regress/sbin/ipsecctl/ike37.ok
index c6fdb02dc42..1968145afff 100644
--- a/regress/sbin/ipsecctl/ike37.ok
+++ b/regress/sbin/ipsecctl/ike37.ok
@@ -16,7 +16,7 @@ C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Configuration=qm-3ffe:1::/64-3ffe:2::/64 f
 C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Local-ID=lid-3ffe:1::/64 force
 C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Remote-ID=rid-3ffe:2::/64 force
 C set [qm-3ffe:1::/64-3ffe:2::/64]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe:1::/64-3ffe:2::/64]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe:1::/64-3ffe:2::/64]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe:1::/64]:ID-type=IPV6_ADDR_SUBNET force
 C set [lid-3ffe:1::/64]:Network=3ffe:1:: force
 C set [lid-3ffe:1::/64]:Netmask=ffff:ffff:ffff:ffff:: force
diff --git a/regress/sbin/ipsecctl/ike39.ok b/regress/sbin/ipsecctl/ike39.ok
index 0dc8d0f5093..c8506d80108 100644
--- a/regress/sbin/ipsecctl/ike39.ok
+++ b/regress/sbin/ipsecctl/ike39.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Configuration=qm-3ffe:1::/64-3ffe:2::/64 f
 C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Local-ID=lid-3ffe:1::/64 force
 C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Remote-ID=rid-3ffe:2::/64 force
 C set [qm-3ffe:1::/64-3ffe:2::/64]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe:1::/64-3ffe:2::/64]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe:1::/64-3ffe:2::/64]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe:1::/64]:ID-type=IPV6_ADDR_SUBNET force
 C set [lid-3ffe:1::/64]:Network=3ffe:1:: force
 C set [lid-3ffe:1::/64]:Netmask=ffff:ffff:ffff:ffff:: force
@@ -30,7 +30,7 @@ C set [IPsec-3ffe::51-3ffe::29]:Configuration=qm-3ffe::51-3ffe::29 force
 C set [IPsec-3ffe::51-3ffe::29]:Local-ID=lid-3ffe::51 force
 C set [IPsec-3ffe::51-3ffe::29]:Remote-ID=rid-3ffe::29 force
 C set [qm-3ffe::51-3ffe::29]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::51-3ffe::29]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::51-3ffe::29]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::51]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::51]:Address=3ffe::51 force
 C set [rid-3ffe::29]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike4.ok b/regress/sbin/ipsecctl/ike4.ok
index a3e698ce51a..b9a2bf786ec 100644
--- a/regress/sbin/ipsecctl/ike4.ok
+++ b/regress/sbin/ipsecctl/ike4.ok
@@ -16,7 +16,7 @@ C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Configuration=qm-10.1.1.0/24-10.1.2.0/24 f
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Local-ID=lid-10.1.1.0/24 force
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Remote-ID=rid-10.1.2.0/24 force
 C set [qm-10.1.1.0/24-10.1.2.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-10.1.1.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-10.1.1.0/24]:Network=10.1.1.0 force
 C set [lid-10.1.1.0/24]:Netmask=255.255.255.0 force
diff --git a/regress/sbin/ipsecctl/ike40.ok b/regress/sbin/ipsecctl/ike40.ok
index 62389eaea1e..6422f0fc840 100644
--- a/regress/sbin/ipsecctl/ike40.ok
+++ b/regress/sbin/ipsecctl/ike40.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Configuration=qm-3ffe:1::/64-3ffe:2::/64 f
 C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Local-ID=lid-3ffe:1::/64 force
 C set [IPsec-3ffe:1::/64-3ffe:2::/64]:Remote-ID=rid-3ffe:2::/64 force
 C set [qm-3ffe:1::/64-3ffe:2::/64]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe:1::/64-3ffe:2::/64]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe:1::/64-3ffe:2::/64]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe:1::/64]:ID-type=IPV6_ADDR_SUBNET force
 C set [lid-3ffe:1::/64]:Network=3ffe:1:: force
 C set [lid-3ffe:1::/64]:Netmask=ffff:ffff:ffff:ffff:: force
@@ -30,7 +30,7 @@ C set [IPsec-3ffe::29-3ffe::51]:Configuration=qm-3ffe::29-3ffe::51 force
 C set [IPsec-3ffe::29-3ffe::51]:Local-ID=lid-3ffe::29 force
 C set [IPsec-3ffe::29-3ffe::51]:Remote-ID=rid-3ffe::51 force
 C set [qm-3ffe::29-3ffe::51]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::29-3ffe::51]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::29-3ffe::51]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::29]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::29]:Address=3ffe::29 force
 C set [rid-3ffe::51]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike41.ok b/regress/sbin/ipsecctl/ike41.ok
index 9816d8e4097..bd56c47c595 100644
--- a/regress/sbin/ipsecctl/ike41.ok
+++ b/regress/sbin/ipsecctl/ike41.ok
@@ -12,7 +12,7 @@ C set [IPsec-1.1.1.1-2.2.2.2]:Configuration=qm-1.1.1.1-2.2.2.2 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Remote-ID=rid-2.2.2.2 force
 C set [qm-1.1.1.1-2.2.2.2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-2.2.2.2]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike42.ok b/regress/sbin/ipsecctl/ike42.ok
index 323637044c6..8f9233b54ea 100644
--- a/regress/sbin/ipsecctl/ike42.ok
+++ b/regress/sbin/ipsecctl/ike42.ok
@@ -10,7 +10,7 @@ C set [IPsec-1.1.1.1-2.2.2.2]:Configuration=qm-1.1.1.1-2.2.2.2 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Remote-ID=rid-2.2.2.2 force
 C set [qm-1.1.1.1-2.2.2.2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-2.2.2.2]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike43.ok b/regress/sbin/ipsecctl/ike43.ok
index e745d5310bf..c4034c8ef41 100644
--- a/regress/sbin/ipsecctl/ike43.ok
+++ b/regress/sbin/ipsecctl/ike43.ok
@@ -10,7 +10,7 @@ C set [IPsec-3ffe::1-3ffe::2]:Configuration=qm-3ffe::1-3ffe::2 force
 C set [IPsec-3ffe::1-3ffe::2]:Local-ID=lid-3ffe::1 force
 C set [IPsec-3ffe::1-3ffe::2]:Remote-ID=rid-3ffe::2 force
 C set [qm-3ffe::1-3ffe::2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3ffe::1-3ffe::2]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3ffe::1-3ffe::2]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3ffe::1]:ID-type=IPV6_ADDR force
 C set [lid-3ffe::1]:Address=3ffe::1 force
 C set [rid-3ffe::2]:ID-type=IPV6_ADDR force
diff --git a/regress/sbin/ipsecctl/ike46.ok b/regress/sbin/ipsecctl/ike46.ok
index b122e11231d..0b85fe1216f 100644
--- a/regress/sbin/ipsecctl/ike46.ok
+++ b/regress/sbin/ipsecctl/ike46.ok
@@ -10,7 +10,7 @@ C set [IPsec-1.1.1.1-2.2.2.2]:Configuration=qm-1.1.1.1-2.2.2.2 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Remote-ID=rid-2.2.2.2 force
 C set [qm-1.1.1.1-2.2.2.2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-2.2.2.2]:ID-type=IPV4_ADDR force
@@ -28,7 +28,7 @@ C set [IPsec-1.1.1.1-2.2.2.2]:Configuration=qm-1.1.1.1-2.2.2.2 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-2.2.2.2]:Remote-ID=rid-2.2.2.2 force
 C set [qm-1.1.1.1-2.2.2.2]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-TRP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-2.2.2.2]:Suites=QM-ESP-TRP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-2.2.2.2]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike47.ok b/regress/sbin/ipsecctl/ike47.ok
index a7ddfb5f5a2..acf3ca56e7c 100644
--- a/regress/sbin/ipsecctl/ike47.ok
+++ b/regress/sbin/ipsecctl/ike47.ok
@@ -3,36 +3,8 @@ C set [peer-default]:Phase=1 force
 C set [peer-default]:Configuration=mm-default force
 C set [mm-default]:EXCHANGE_TYPE=ID_PROT force
 C add [mm-default]:Transforms=AES-SHA-RSA_SIG force
-C set [IPsec-0.0.0.0/0-0.0.0.0/0]:Phase=2 force
-C set [IPsec-0.0.0.0/0-0.0.0.0/0]:ISAKMP-peer=peer-default force
-C set [IPsec-0.0.0.0/0-0.0.0.0/0]:Configuration=qm-0.0.0.0/0-0.0.0.0/0 force
-C set [IPsec-0.0.0.0/0-0.0.0.0/0]:Local-ID=lid-0.0.0.0/0 force
-C set [IPsec-0.0.0.0/0-0.0.0.0/0]:Remote-ID=rid-0.0.0.0/0 force
-C set [qm-0.0.0.0/0-0.0.0.0/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-0.0.0.0/0-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
-C set [lid-0.0.0.0/0]:ID-type=IPV4_ADDR_SUBNET force
-C set [lid-0.0.0.0/0]:Network=0.0.0.0 force
-C set [lid-0.0.0.0/0]:Netmask=0.0.0.0 force
-C set [rid-0.0.0.0/0]:ID-type=IPV4_ADDR_SUBNET force
-C set [rid-0.0.0.0/0]:Network=0.0.0.0 force
-C set [rid-0.0.0.0/0]:Netmask=0.0.0.0 force
-C add [Phase 2]:Connections=IPsec-0.0.0.0/0-0.0.0.0/0
 C set [Phase 1]:Default=peer-default force
 C set [peer-default]:Phase=1 force
 C set [peer-default]:Configuration=mm-default force
 C set [mm-default]:EXCHANGE_TYPE=ID_PROT force
 C add [mm-default]:Transforms=AES-SHA-RSA_SIG force
-C set [IPsec-::/0-::/0]:Phase=2 force
-C set [IPsec-::/0-::/0]:ISAKMP-peer=peer-default force
-C set [IPsec-::/0-::/0]:Configuration=qm-::/0-::/0 force
-C set [IPsec-::/0-::/0]:Local-ID=lid-::/0 force
-C set [IPsec-::/0-::/0]:Remote-ID=rid-::/0 force
-C set [qm-::/0-::/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-::/0-::/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
-C set [lid-::/0]:ID-type=IPV6_ADDR_SUBNET force
-C set [lid-::/0]:Network=:: force
-C set [lid-::/0]:Netmask=:: force
-C set [rid-::/0]:ID-type=IPV6_ADDR_SUBNET force
-C set [rid-::/0]:Network=:: force
-C set [rid-::/0]:Netmask=:: force
-C add [Phase 2]:Connections=IPsec-::/0-::/0
diff --git a/regress/sbin/ipsecctl/ike6.ok b/regress/sbin/ipsecctl/ike6.ok
index 80006b1a5d3..6e46035c7c2 100644
--- a/regress/sbin/ipsecctl/ike6.ok
+++ b/regress/sbin/ipsecctl/ike6.ok
@@ -10,7 +10,7 @@ C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Configuration=qm-10.1.1.0/24-10.1.2.0/24 f
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Local-ID=lid-10.1.1.0/24 force
 C set [IPsec-10.1.1.0/24-10.1.2.0/24]:Remote-ID=rid-10.1.2.0/24 force
 C set [qm-10.1.1.0/24-10.1.2.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-10.1.1.0/24-10.1.2.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-10.1.1.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-10.1.1.0/24]:Network=10.1.1.0 force
 C set [lid-10.1.1.0/24]:Netmask=255.255.255.0 force
@@ -30,7 +30,7 @@ C set [IPsec-131.188.33.51-131.188.33.29]:Configuration=qm-131.188.33.51-131.188
 C set [IPsec-131.188.33.51-131.188.33.29]:Local-ID=lid-131.188.33.51 force
 C set [IPsec-131.188.33.51-131.188.33.29]:Remote-ID=rid-131.188.33.29 force
 C set [qm-131.188.33.51-131.188.33.29]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-131.188.33.51-131.188.33.29]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-131.188.33.51-131.188.33.29]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-131.188.33.51]:ID-type=IPV4_ADDR force
 C set [lid-131.188.33.51]:Address=131.188.33.51 force
 C set [rid-131.188.33.29]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike7.ok b/regress/sbin/ipsecctl/ike7.ok
index 4fd969cbee4..a39f1b37ba5 100644
--- a/regress/sbin/ipsecctl/ike7.ok
+++ b/regress/sbin/ipsecctl/ike7.ok
@@ -10,7 +10,7 @@ C set [IPsec-10.1.2.0/24-10.1.1.0/24]:Configuration=qm-10.1.2.0/24-10.1.1.0/24 f
 C set [IPsec-10.1.2.0/24-10.1.1.0/24]:Local-ID=lid-10.1.2.0/24 force
 C set [IPsec-10.1.2.0/24-10.1.1.0/24]:Remote-ID=rid-10.1.1.0/24 force
 C set [qm-10.1.2.0/24-10.1.1.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-10.1.2.0/24-10.1.1.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-10.1.2.0/24-10.1.1.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-10.1.2.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-10.1.2.0/24]:Network=10.1.2.0 force
 C set [lid-10.1.2.0/24]:Netmask=255.255.255.0 force
@@ -30,7 +30,7 @@ C set [IPsec-131.188.33.29-131.188.33.51]:Configuration=qm-131.188.33.29-131.188
 C set [IPsec-131.188.33.29-131.188.33.51]:Local-ID=lid-131.188.33.29 force
 C set [IPsec-131.188.33.29-131.188.33.51]:Remote-ID=rid-131.188.33.51 force
 C set [qm-131.188.33.29-131.188.33.51]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-131.188.33.29-131.188.33.51]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-131.188.33.29-131.188.33.51]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-131.188.33.29]:ID-type=IPV4_ADDR force
 C set [lid-131.188.33.29]:Address=131.188.33.29 force
 C set [rid-131.188.33.51]:ID-type=IPV4_ADDR force
diff --git a/regress/sbin/ipsecctl/ike8.ok b/regress/sbin/ipsecctl/ike8.ok
index 44c91e112b2..45612b98e44 100644
--- a/regress/sbin/ipsecctl/ike8.ok
+++ b/regress/sbin/ipsecctl/ike8.ok
@@ -10,7 +10,7 @@ C set [IPsec-1.1.1.1-0.0.0.0/0]:Configuration=qm-1.1.1.1-0.0.0.0/0 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Local-ID=lid-1.1.1.1 force
 C set [IPsec-1.1.1.1-0.0.0.0/0]:Remote-ID=rid-0.0.0.0/0 force
 C set [qm-1.1.1.1-0.0.0.0/0]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-1.1.1.1-0.0.0.0/0]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-1.1.1.1]:ID-type=IPV4_ADDR force
 C set [lid-1.1.1.1]:Address=1.1.1.1 force
 C set [rid-0.0.0.0/0]:ID-type=IPV4_ADDR_SUBNET force
diff --git a/regress/sbin/ipsecctl/ike9.ok b/regress/sbin/ipsecctl/ike9.ok
index 71a038dae5b..4d5c8f75294 100644
--- a/regress/sbin/ipsecctl/ike9.ok
+++ b/regress/sbin/ipsecctl/ike9.ok
@@ -15,7 +15,7 @@ C set [IPsec-3.3.3.0/24-4.4.4.0/24]:Configuration=qm-3.3.3.0/24-4.4.4.0/24 force
 C set [IPsec-3.3.3.0/24-4.4.4.0/24]:Local-ID=lid-3.3.3.0/24 force
 C set [IPsec-3.3.3.0/24-4.4.4.0/24]:Remote-ID=rid-4.4.4.0/24 force
 C set [qm-3.3.3.0/24-4.4.4.0/24]:EXCHANGE_TYPE=QUICK_MODE force
-C set [qm-3.3.3.0/24-4.4.4.0/24]:Suites=QM-ESP-AES-SHA2-256-SUITE force
+C set [qm-3.3.3.0/24-4.4.4.0/24]:Suites=QM-ESP-AES-SHA2-256-PFS-SUITE force
 C set [lid-3.3.3.0/24]:ID-type=IPV4_ADDR_SUBNET force
 C set [lid-3.3.3.0/24]:Network=3.3.3.0 force
 C set [lid-3.3.3.0/24]:Netmask=255.255.255.0 force