spdadd A B -P in ipsec esp/tunnel/C-D/use ah/tunnel/C-D/require; does not work due to 1-bit validation bit we are using with inbound policy checking. Submitted by: itojun Obtained from: KAME MFC after: 1 week