master
Teach ipsecctl to control isakmpd.
mop up P-192/Group 25 remnants
Support collapsing flow outputs.
Tweak previous. Passing "dns" to pledge(2) is suitable for the purpose.
Print at most pkgsize - hdrsize bytes for pfkey tag and identity to prevent out-of-bounds read in strlen().
Add pledge("stdio") before parsing pfkey messages. This applies to ipsecctl -m and ipsecctl -s. Refactor ipsecctl_show_*() to setup all sysctls first before dropping privileges and finally parsing and printing IPsec SAs and flows.
sort SAs by spi; ok hshoexer