signed vs unsigned, some void * arithmetic, from -pedantic. niklas@ ok.

19 files changed, 97 insertions, 91 deletions

diff --git a/sbin/isakmpd/conf.c b/sbin/isakmpd/conf.c
index 78d8286b86f..71ab6dca83c 100644
--- a/sbin/isakmpd/conf.c
+++ b/sbin/isakmpd/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.44 2002/08/07 13:19:20 ho Exp $	*/
+/*	$OpenBSD: conf.c,v 1.45 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: conf.c,v 1.48 2000/12/04 02:04:29 angelos Exp $	*/
 
 /*
@@ -828,7 +828,7 @@ conf_decode_base64 (u_int8_t *out, u_int32_t *len, u_char *buf)
 	  if (c2 & 0xF)
 	    return 0;
 
-	  if (strcmp (buf, "==") == 0)
+	  if (strcmp ((char *)buf, "==") == 0)
 	    buf++;
 	  else
 	    return 0;
@@ -846,7 +846,7 @@ conf_decode_base64 (u_int8_t *out, u_int32_t *len, u_char *buf)
 	      if (c3 & 3)
 		return 0;
 
-	      if (strcmp (buf, "="))
+	      if (strcmp ((char *)buf, "="))
 		return 0;
 
 	    }
diff --git a/sbin/isakmpd/doi.h b/sbin/isakmpd/doi.h
index 07d2798f432..743594085fc 100644
--- a/sbin/isakmpd/doi.h
+++ b/sbin/isakmpd/doi.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: doi.h,v 1.9 2000/08/03 07:23:00 niklas Exp $	*/
+/*	$OpenBSD: doi.h,v 1.10 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: doi.h,v 1.29 2000/07/02 18:47:15 provos Exp $	*/
 
 /*
@@ -65,7 +65,7 @@ struct doi {
   int (*debug_attribute) (u_int16_t, u_int8_t *, u_int16_t, void *);
 #endif
   void (*delete_spi) (struct sa *, struct proto *, int);
-  u_int16_t *(*exchange_script) (u_int8_t);
+  int16_t *(*exchange_script) (u_int8_t);
   void (*finalize_exchange) (struct message *);
   void (*free_exchange_data) (void *);
   void (*free_proto_data) (void *);
diff --git a/sbin/isakmpd/exchange.c b/sbin/isakmpd/exchange.c
index a7f2245f109..592fbee1e31 100644
--- a/sbin/isakmpd/exchange.c
+++ b/sbin/isakmpd/exchange.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exchange.c,v 1.69 2002/09/05 17:30:03 ho Exp $	*/
+/*	$OpenBSD: exchange.c,v 1.70 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: exchange.c,v 1.143 2000/12/04 00:02:25 angelos Exp $	*/
 
 /*
@@ -171,7 +171,7 @@ int16_t script_informational[] = {
  * Check what exchange SA is negotiated with and return a suitable validation
  * script.
  */
-u_int16_t *
+int16_t *
 exchange_script (struct exchange *exchange)
 {
   switch (exchange->type)
diff --git a/sbin/isakmpd/exchange.h b/sbin/isakmpd/exchange.h
index c29c54f2480..cded98939c4 100644
--- a/sbin/isakmpd/exchange.h
+++ b/sbin/isakmpd/exchange.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: exchange.h,v 1.21 2002/06/09 08:13:06 todd Exp $	*/
+/*	$OpenBSD: exchange.h,v 1.22 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: exchange.h,v 1.28 2000/09/28 12:54:28 niklas Exp $	*/
 
 /*
@@ -233,7 +233,7 @@ extern void exchange_report (void);
 extern void exchange_run (struct message *);
 extern int exchange_save_nonce (struct message *);
 extern int exchange_save_certreq (struct message *);
-extern u_int16_t *exchange_script (struct exchange *);
+extern int16_t *exchange_script (struct exchange *);
 extern struct exchange *exchange_setup_p1 (struct message *, u_int32_t);
 extern struct exchange *exchange_setup_p2 (struct message *, u_int8_t);
 extern void exchange_upgrade_p1 (struct message *);
diff --git a/sbin/isakmpd/hash.h b/sbin/isakmpd/hash.h
index c33b8cb2187..9f1c9544220 100644
--- a/sbin/isakmpd/hash.h
+++ b/sbin/isakmpd/hash.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hash.h,v 1.3 1998/11/17 11:10:11 niklas Exp $	*/
+/*	$OpenBSD: hash.h,v 1.4 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: hash.h,v 1.6 1998/07/25 22:04:36 niklas Exp $	*/
 
 /*
@@ -53,7 +53,7 @@ struct hash {
   int id;			/* ISAKMP/Oakley ID */
   u_int8_t hashsize;		/* Size of the hash */
   void *ctx;			/* Pointer to a context, for HMAC ictx */
-  char *digest;			/* Pointer to a digest */
+  unsigned char *digest;	/* Pointer to a digest */
   int ctxsize;
   void *ctx2;			/* Pointer to a 2nd context, for HMAC octx */
   void (*Init) (void *);
diff --git a/sbin/isakmpd/ike_auth.c b/sbin/isakmpd/ike_auth.c
index 5fac75637d1..ad49b8e4045 100644
--- a/sbin/isakmpd/ike_auth.c
+++ b/sbin/isakmpd/ike_auth.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ike_auth.c,v 1.65 2002/06/10 18:08:58 ho Exp $	*/
+/*	$OpenBSD: ike_auth.c,v 1.66 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: ike_auth.c,v 1.59 2000/11/21 00:21:31 angelos Exp $	*/
 
 /*
@@ -180,7 +180,7 @@ ike_auth_get_key (int type, char *id, char *local_id, size_t *keylen)
 		(unsigned long)*keylen);
 	      return 0;
 	    }
-	  if (hex2raw (key + 2, buf, *keylen))
+	  if (hex2raw (key + 2, (unsigned char *)buf, *keylen))
 	    {
 	      free (buf);
 	      log_print ("ike_auth_get_key: invalid hex key %s", key);
@@ -337,8 +337,8 @@ pre_shared_gen_skeyid (struct exchange *exchange, size_t *sz)
   struct prf *prf;
   struct ipsec_exch *ie = exchange->data;
   u_int8_t *skeyid;
-  u_int8_t *key;
   u_int8_t *buf = 0;
+  unsigned char *key;
   size_t keylen;
 
   /*
@@ -386,7 +386,8 @@ pre_shared_gen_skeyid (struct exchange *exchange, size_t *sz)
    * Get the pre-shared key for our peer. This will work even if the key
    * has been passed to us through a mechanism like PFKEYv2.
    */
-  key = ike_auth_get_key (IKE_AUTH_PRE_SHARED, exchange->name, buf, &keylen);
+  key = ike_auth_get_key (IKE_AUTH_PRE_SHARED, exchange->name, (char *)buf,
+			  &keylen);
   if (buf)
     free (buf);
 
@@ -436,7 +437,8 @@ sig_gen_skeyid (struct exchange *exchange, size_t *sz)
 {
   struct prf *prf;
   struct ipsec_exch *ie = exchange->data;
-  u_int8_t *skeyid, *key;
+  u_int8_t *skeyid;
+  unsigned char *key;
 
   key = malloc (exchange->nonce_i_len + exchange->nonce_r_len);
   if (!key)
@@ -448,7 +450,7 @@ sig_gen_skeyid (struct exchange *exchange, size_t *sz)
   LOG_DBG((LOG_NEGOTIATION, 80, "sig_gen_skeyid: PRF type %d, hash %d",
       ie->prf_type, ie->hash->type));
   LOG_DBG_BUF((LOG_NEGOTIATION, 80, "sig_gen_skeyid: SKEYID initialized with",
-      key, exchange->nonce_i_len + exchange->nonce_r_len));
+      (u_int8_t *)key, exchange->nonce_i_len + exchange->nonce_r_len));
 
   prf = prf_alloc (ie->prf_type, ie->hash->type, key,
 		   exchange->nonce_i_len + exchange->nonce_r_len);
@@ -916,7 +918,7 @@ rsa_sig_encode_hash (struct message *msg)
   id_len = initiator ? exchange->id_i_len : exchange->id_r_len;
 
   /* We may have been provided these by the kernel */
-  buf = conf_get_str (exchange->name, "Credentials");
+  buf = (u_int8_t *)conf_get_str (exchange->name, "Credentials");
   if (buf
       && (idtype = conf_get_num (exchange->name, "Credential_Type", -1) != -1))
     {
@@ -928,7 +930,7 @@ rsa_sig_encode_hash (struct message *msg)
 	  return -1;
 	}
 
-      exchange->sent_cert = handler->cert_from_printable (buf);
+      exchange->sent_cert = handler->cert_from_printable ((char *)buf);
       if (!exchange->sent_cert)
 	{
 	  log_print ("rsa_sig_encode_hash: failed to retrieve certificate");
@@ -1053,11 +1055,11 @@ rsa_sig_encode_hash (struct message *msg)
     }
 
   /* Again, we may have these from the kernel */
-  buf = conf_get_str (exchange->name, "OKAuthentication");
+  buf = (u_int8_t *)conf_get_str (exchange->name, "OKAuthentication");
   if (buf)
     {
-      key_from_printable (ISAKMP_KEY_RSA, ISAKMP_KEYTYPE_PRIVATE, buf, &data,
-			  &datalen);
+      key_from_printable (ISAKMP_KEY_RSA, ISAKMP_KEYTYPE_PRIVATE, (char *)buf,
+			  &data, &datalen);
       if (!data || datalen == -1)
 	{
 	  log_print ("rsa_sig_encode_hash: badly formatted RSA private key");
@@ -1078,7 +1080,7 @@ rsa_sig_encode_hash (struct message *msg)
   else /* Try through the regular means.  */
     {
       exchange->sent_key = ike_auth_get_key (IKE_AUTH_RSA_SIG, exchange->name,
-					     buf2, 0);
+					     (char *)buf2, 0);
       free (buf2);
 
       /* Did we find a key?  */
diff --git a/sbin/isakmpd/ike_phase_1.c b/sbin/isakmpd/ike_phase_1.c
index d2caa60151e..76c43d62e8c 100644
--- a/sbin/isakmpd/ike_phase_1.c
+++ b/sbin/isakmpd/ike_phase_1.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ike_phase_1.c,v 1.34 2002/07/04 17:00:35 ho Exp $	*/
+/*	$OpenBSD: ike_phase_1.c,v 1.35 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: ike_phase_1.c,v 1.31 2000/12/11 23:47:56 niklas Exp $	*/
 
 /*
@@ -201,7 +201,8 @@ ike_phase_1_initiator_send_SA (struct message *msg)
                     {
                       value = htonl (value);
 		      attr = attribute_set_var (attr, IKE_ATTR_LIFE_DURATION,
-                                                (char *)&value, sizeof value);
+                                                (u_int8_t *)&value,
+						sizeof value);
                     }
                 }
 	    }
@@ -233,9 +234,9 @@ ike_phase_1_initiator_send_SA (struct message *msg)
 	   * Make sure that if a group description is specified, it is
 	   * specified for all transforms equally.
 	   */
-	  attr = conf_get_str (xf->field, "GROUP_DESCRIPTION");
+	  attr = (u_int8_t *)conf_get_str (xf->field, "GROUP_DESCRIPTION");
 	  new_group_desc
-	    = attr ? constant_value (ike_group_desc_cst, attr) : 0;
+	    = attr ? constant_value (ike_group_desc_cst, (char *)attr) : 0;
 	  if (group_desc == -1)
 	    group_desc = new_group_desc;
 	  else if (group_desc != new_group_desc)
@@ -634,7 +635,7 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
   prf->Init (prf->prfctx);
   prf->Update (prf->prfctx, ie->g_xy, ie->g_x_len);
   prf->Update (prf->prfctx, exchange->cookies, ISAKMP_HDR_COOKIES_LEN);
-  prf->Update (prf->prfctx, "\0", 1);
+  prf->Update (prf->prfctx, (unsigned char *)"\0", 1);
   prf->Final (ie->skeyid_d, prf->prfctx);
   LOG_DBG_BUF ((LOG_NEGOTIATION, 80,
 		"ike_phase_1_post_exchange_KE_NONCE: SKEYID_d",	ie->skeyid_d,
@@ -653,7 +654,7 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
   prf->Update (prf->prfctx, ie->skeyid_d, ie->skeyid_len);
   prf->Update (prf->prfctx, ie->g_xy, ie->g_x_len);
   prf->Update (prf->prfctx, exchange->cookies, ISAKMP_HDR_COOKIES_LEN);
-  prf->Update (prf->prfctx, "\1", 1);
+  prf->Update (prf->prfctx, (unsigned char *)"\1", 1);
   prf->Final (ie->skeyid_a, prf->prfctx);
   LOG_DBG_BUF ((LOG_NEGOTIATION, 80,
 		"ike_phase_1_post_exchange_KE_NONCE: SKEYID_a",	ie->skeyid_a,
@@ -673,7 +674,7 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
   prf->Update (prf->prfctx, ie->skeyid_a, ie->skeyid_len);
   prf->Update (prf->prfctx, ie->g_xy, ie->g_x_len);
   prf->Update (prf->prfctx, exchange->cookies, ISAKMP_HDR_COOKIES_LEN);
-  prf->Update (prf->prfctx, "\2", 1);
+  prf->Update (prf->prfctx, (unsigned char *)"\2", 1);
   prf->Final (ie->skeyid_e, prf->prfctx);
   prf_free (prf);
   LOG_DBG_BUF ((LOG_NEGOTIATION, 80,
@@ -712,7 +713,7 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
 	}
 
       prf->Init (prf->prfctx);
-      prf->Update (prf->prfctx, "\0", 1);
+      prf->Update (prf->prfctx, (unsigned char *)"\0", 1);
       prf->Final (key, prf->prfctx);
 
       for (len = prf->blocksize, p = key; len < exchange->key_length;
diff --git a/sbin/isakmpd/ike_quick_mode.c b/sbin/isakmpd/ike_quick_mode.c
index e92885dbe5b..2a2484cc07e 100644
--- a/sbin/isakmpd/ike_quick_mode.c
+++ b/sbin/isakmpd/ike_quick_mode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ike_quick_mode.c,v 1.66 2002/06/14 12:43:11 ho Exp $	*/
+/*	$OpenBSD: ike_quick_mode.c,v 1.67 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: ike_quick_mode.c,v 1.139 2001/01/26 10:43:17 niklas Exp $	*/
 
 /*
@@ -652,7 +652,7 @@ initiator_send_HASH_SA_NONCE (struct message *msg)
                               attr =
                                 attribute_set_var (attr,
                                                    IPSEC_ATTR_SA_LIFE_DURATION,
-                                                   (char *)&value,
+                                                   (u_int8_t *)&value,
 						   sizeof value);
                             }
                         }
@@ -718,9 +718,11 @@ initiator_send_HASH_SA_NONCE (struct message *msg)
 		   * Make sure that if a group description is specified, it is
 		   * specified for all transforms equally.
 		   */
-		  attr = conf_get_str (xf->field, "GROUP_DESCRIPTION");
+		  attr = (u_int8_t *)conf_get_str (xf->field,
+						   "GROUP_DESCRIPTION");
 		  new_group_desc
-		    = attr ? constant_value (ike_group_desc_cst, attr) : 0;
+		    = attr ? constant_value (ike_group_desc_cst,
+					     (char *)attr) : 0;
 		  if (group_desc == -1)
 		    group_desc = new_group_desc;
 		  else if (group_desc != new_group_desc)
@@ -1044,7 +1046,7 @@ initiator_recv_HASH_SA_NONCE (struct message *msg)
 
   /* Allocate the prf and start calculating our HASH(1).  XXX Share?  */
   LOG_DBG_BUF ((LOG_NEGOTIATION, 90, "initiator_recv_HASH_SA_NONCE: SKEYID_a",
-		isa->skeyid_a, isa->skeyid_len));
+		(u_int8_t *)isa->skeyid_a, isa->skeyid_len));
   prf = prf_alloc (isa->prf_type, hash->type, isa->skeyid_a, isa->skeyid_len);
   if (!prf)
     return -1;
@@ -1299,7 +1301,7 @@ initiator_send_HASH (struct message *msg)
   if (!prf)
     return -1;
   prf->Init (prf->prfctx);
-  prf->Update (prf->prfctx, "\0", 1);
+  prf->Update (prf->prfctx, (unsigned char *)"\0", 1);
   LOG_DBG_BUF ((LOG_NEGOTIATION, 90, "initiator_send_HASH: message_id",
 		exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN));
   prf->Update (prf->prfctx, exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN);
@@ -1933,7 +1935,7 @@ responder_recv_HASH (struct message *msg)
   if (!prf)
     goto cleanup;
   prf->Init (prf->prfctx);
-  prf->Update (prf->prfctx, "\0", 1);
+  prf->Update (prf->prfctx, (unsigned char *)"\0", 1);
   LOG_DBG_BUF ((LOG_NEGOTIATION, 90, "responder_recv_HASH: message_id",
 		exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN));
   prf->Update (prf->prfctx, exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN);
diff --git a/sbin/isakmpd/ipsec.c b/sbin/isakmpd/ipsec.c
index fb801ad6319..762f9f1b3ce 100644
--- a/sbin/isakmpd/ipsec.c
+++ b/sbin/isakmpd/ipsec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ipsec.c,v 1.70 2002/09/08 12:38:04 ho Exp $	*/
+/*	$OpenBSD: ipsec.c,v 1.71 2002/09/11 09:50:43 ho Exp $	*/
 /*	$EOM: ipsec.c,v 1.143 2000/12/11 23:57:42 niklas Exp $	*/
 
 /*
@@ -102,7 +102,7 @@ static int ipsec_contacted (struct message *msg);
 static int ipsec_debug_attribute (u_int16_t, u_int8_t *, u_int16_t, void *);
 #endif
 static void ipsec_delete_spi (struct sa *, struct proto *, int);
-static u_int16_t *ipsec_exchange_script (u_int8_t);
+static int16_t *ipsec_exchange_script (u_int8_t);
 static void ipsec_finalize_exchange (struct message *);
 static void ipsec_free_exchange_data (void *);
 static void ipsec_free_proto_data (void *);
@@ -643,7 +643,7 @@ ipsec_free_proto_data (void *viproto)
 }
 
 /* Return exchange script based on TYPE.  */
-static u_int16_t *
+static int16_t *
 ipsec_exchange_script (u_int8_t type)
 {
   switch (type)
@@ -1880,7 +1880,7 @@ ipsec_get_id (char *section, int *id, struct sockaddr **addr,
  * we cannot fit the information in the supplied buffer.
  */
 static void
-ipsec_decode_id (u_int8_t *buf, int size, u_int8_t *id, size_t id_len,
+ipsec_decode_id (char *buf, int size, u_int8_t *id, size_t id_len,
 		 int isakmpform)
 {
   int id_type;
@@ -2010,7 +2010,7 @@ ipsec_build_id (char *section, size_t *sz)
     }
 
   SET_ISAKMP_ID_TYPE (p, id);
-  SET_ISAKMP_ID_DOI_DATA (p, "\000\000\000");
+  SET_ISAKMP_ID_DOI_DATA (p, (unsigned char *)"\000\000\000");
 
   memcpy (p + ISAKMP_ID_DATA_OFF, sockaddr_addrdata (addr),
 	  sockaddr_addrlen (addr));
diff --git a/sbin/isakmpd/key.c b/sbin/isakmpd/key.c
index eb717907be6..ca0f7a003c0 100644
--- a/sbin/isakmpd/key.c
+++ b/sbin/isakmpd/key.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: key.c,v 1.11 2002/06/10 18:08:58 ho Exp $	*/
+/*	$OpenBSD: key.c,v 1.12 2002/09/11 09:50:44 ho Exp $	*/
 /*
  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
  *
@@ -58,7 +58,7 @@ key_serialize (int type, int private, void *key, u_int8_t **data, size_t *datale
     {
     case ISAKMP_KEY_PASSPHRASE:
       *datalen = strlen ((char *)key);
-      *data = strdup ((char *)key);
+      *data = (u_int8_t *)strdup ((char *)key);
       break;
     case ISAKMP_KEY_RSA:
       switch (private)
@@ -130,7 +130,7 @@ key_internalize (int type, int private, u_int8_t *data, int datalen)
   switch (type)
     {
     case ISAKMP_KEY_PASSPHRASE:
-      return strdup (data);
+      return strdup ((char *)data);
     case ISAKMP_KEY_RSA:
       switch (private)
 	{
@@ -161,13 +161,13 @@ key_internalize (int type, int private, u_int8_t *data, int datalen)
 /* Convert from printable to serialized */
 void
 key_from_printable (int type, int private, char *key, u_int8_t **data,
-		    int *datalen)
+		    u_int32_t *datalen)
 {
   switch (type)
     {
     case ISAKMP_KEY_PASSPHRASE:
       *datalen = strlen (key);
-      *data = strdup (key);
+      *data = (u_int8_t *)strdup (key);
       break;
 
     case ISAKMP_KEY_RSA:
diff --git a/sbin/isakmpd/key.h b/sbin/isakmpd/key.h
index 711d9783dbb..b31c7c92397 100644
--- a/sbin/isakmpd/key.h
+++ b/sbin/isakmpd/key.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: key.h,v 1.5 2002/03/06 13:55:12 ho Exp $	*/
+/*	$OpenBSD: key.h,v 1.6 2002/09/11 09:50:44 ho Exp $	*/
 /*
  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
  *
@@ -34,6 +34,6 @@
 void key_free (int, int, void *);
 void key_serialize (int, int, void *, u_int8_t **, size_t *);
 char *key_printable (int, int, u_int8_t *, int);
-void key_from_printable (int, int, char *, u_int8_t **, int *);
+void key_from_printable (int, int, char *, u_int8_t **, u_int32_t *);
 void *key_internalize (int, int, u_int8_t *, int);
 #endif /* _KEY_H_ */
diff --git a/sbin/isakmpd/message.c b/sbin/isakmpd/message.c
index fcb585fc2a7..f24467a01c4 100644
--- a/sbin/isakmpd/message.c
+++ b/sbin/isakmpd/message.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: message.c,v 1.56 2002/07/09 14:31:45 ho Exp $	*/
+/*	$OpenBSD: message.c,v 1.57 2002/09/11 09:50:44 ho Exp $	*/
 /*	$EOM: message.c,v 1.156 2000/10/10 12:36:39 provos Exp $	*/
 
 /*
@@ -154,7 +154,7 @@ message_alloc (struct transport *t, u_int8_t *buf, size_t sz)
   msg->iovlen = 1;
   if (buf)
     memcpy (msg->iov[0].iov_base, buf, sz);
-  msg->nextp = msg->iov[0].iov_base + ISAKMP_HDR_NEXT_PAYLOAD_OFF;
+  msg->nextp = (u_int8_t *)msg->iov[0].iov_base + ISAKMP_HDR_NEXT_PAYLOAD_OFF;
   msg->transport = t;
   transport_reference (t);
   for (i = ISAKMP_PAYLOAD_SA; i < ISAKMP_PAYLOAD_RESERVED_MIN; i++)
@@ -379,8 +379,8 @@ message_validate_attribute (struct message *msg, struct payload *p)
   /* If we don't have an exchange yet, create one.  */
   if (!msg->exchange)
     {
-      if (zero_test (msg->iov[0].iov_base + ISAKMP_HDR_MESSAGE_ID_OFF,
-		     ISAKMP_HDR_MESSAGE_ID_LEN))
+      if (zero_test ((u_int8_t *)msg->iov[0].iov_base
+		     + ISAKMP_HDR_MESSAGE_ID_OFF, ISAKMP_HDR_MESSAGE_ID_LEN))
 	msg->exchange = exchange_setup_p1 (msg, IPSEC_DOI_IPSEC);
       else
 	msg->exchange = exchange_setup_p2 (msg, IPSEC_DOI_IPSEC);
@@ -456,8 +456,8 @@ message_validate_delete (struct message *msg, struct payload *p)
   /* If we don't have an exchange yet, create one.  */
   if (!msg->exchange)
     {
-      if (zero_test (msg->iov[0].iov_base + ISAKMP_HDR_MESSAGE_ID_OFF,
-		     ISAKMP_HDR_MESSAGE_ID_LEN))
+      if (zero_test ((u_int8_t *)msg->iov[0].iov_base
+		     + ISAKMP_HDR_MESSAGE_ID_OFF, ISAKMP_HDR_MESSAGE_ID_LEN))
 	msg->exchange = exchange_setup_p1 (msg, doi->id);
       else
 	msg->exchange = exchange_setup_p2 (msg, doi->id);
@@ -581,8 +581,8 @@ message_validate_notify (struct message *msg, struct payload *p)
   /* If we don't have an exchange yet, create one.  */
   if (!msg->exchange)
     {
-      if (zero_test (msg->iov[0].iov_base + ISAKMP_HDR_MESSAGE_ID_OFF,
-		     ISAKMP_HDR_MESSAGE_ID_LEN))
+      if (zero_test ((u_int8_t *)msg->iov[0].iov_base
+		     + ISAKMP_HDR_MESSAGE_ID_OFF, ISAKMP_HDR_MESSAGE_ID_LEN))
 	msg->exchange = exchange_setup_p1 (msg, doi->id);
       else
 	msg->exchange = exchange_setup_p2 (msg, doi->id);
@@ -893,9 +893,10 @@ message_sort_payloads (struct message *msg, u_int8_t next)
   for (i = ISAKMP_PAYLOAD_SA; i < ISAKMP_PAYLOAD_RESERVED_MIN; i++)
     if (i != ISAKMP_PAYLOAD_PROPOSAL && i != ISAKMP_PAYLOAD_TRANSFORM)
       SET (i, &payload_set);
-  sz = message_parse_payloads (msg, 0, next,
-			       msg->iov[0].iov_base + ISAKMP_HDR_SZ,
-			       &payload_set, message_index_payload);
+  sz =
+    message_parse_payloads (msg, 0, next,
+			    (u_int8_t *)msg->iov[0].iov_base + ISAKMP_HDR_SZ,
+			    &payload_set, message_index_payload);
   if (sz == -1)
     return -1;
   msg->iov[0].iov_len = ISAKMP_HDR_SZ + sz;
@@ -2161,7 +2162,8 @@ message_copy (struct message *msg, size_t offset, size_t *szp)
   p = buf;
   for (i = skip + 1; i < msg->iovlen; i++)
     {
-      memcpy (p, msg->iov[i].iov_base + start, msg->iov[i].iov_len - start);
+      memcpy (p, (u_int8_t *)msg->iov[i].iov_base + start,
+	      msg->iov[i].iov_len - start);
       p += msg->iov[i].iov_len - start;
       start = 0;
     }
diff --git a/sbin/isakmpd/pf_key_v2.c b/sbin/isakmpd/pf_key_v2.c
index 94d9be5afcd..39017710287 100644
--- a/sbin/isakmpd/pf_key_v2.c
+++ b/sbin/isakmpd/pf_key_v2.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: pf_key_v2.c,v 1.116 2002/08/29 15:15:45 itojun Exp $  */
+/*      $OpenBSD: pf_key_v2.c,v 1.117 2002/09/11 09:50:44 ho Exp $  */
 /*	$EOM: pf_key_v2.c,v 1.79 2000/12/12 00:33:19 niklas Exp $	*/
 
 /*
@@ -876,7 +876,7 @@ pf_key_v2_set_spi (struct sa *sa, struct proto *proto, int incoming,
   size_t len;
   int keylen, hashlen, err;
 #ifndef KAME
-  char *pp;
+  u_int8_t *pp;
   int idtype;
 #else /* KAME */
   struct sadb_x_sa2 ssa2;
@@ -2159,9 +2159,8 @@ pf_key_v2_flow (struct sockaddr *laddr, struct sockaddr *lmask,
 static u_int8_t *
 pf_key_v2_convert_id (u_int8_t *id, int idlen, size_t *reslen, int *idtype)
 {
-  u_int8_t *res = 0;
+  u_int8_t *addr, *res = 0;
   char addrbuf[ADDRESS_MAX + 5];
-  char *addr;
 
   switch (id[0])
     {
@@ -2195,7 +2194,7 @@ pf_key_v2_convert_id (u_int8_t *id, int idlen, size_t *reslen, int *idtype)
 	return 0;
       *reslen = strlen (addrbuf) + 3;
       strlcat (addrbuf, "/32", ADDRESS_MAX + 5);
-      res = strdup (addrbuf);
+      res = (u_int8_t *)strdup (addrbuf);
       if (!res)
 	return 0;
       *idtype = SADB_IDENTTYPE_PREFIX;
@@ -2208,7 +2207,7 @@ pf_key_v2_convert_id (u_int8_t *id, int idlen, size_t *reslen, int *idtype)
 	return 0;
       *reslen = strlen (addrbuf) + 4;
       strlcat (addrbuf, "/128", ADDRESS_MAX + 5);
-      res = strdup (addrbuf);
+      res = (u_int8_t *)strdup (addrbuf);
       if (!res)
 	return 0;
       LOG_DBG ((LOG_SYSDEP, 40, "pf_key_v2_convert_id: IPv6 address %s", res));
@@ -2224,7 +2223,7 @@ pf_key_v2_convert_id (u_int8_t *id, int idlen, size_t *reslen, int *idtype)
 					       *(addr +
 						 sizeof (struct in_addr))));
       *reslen = strlen (addrbuf);
-      res = strdup (addrbuf);
+      res = (u_int8_t *)strdup (addrbuf);
       if (!res)
 	return 0;
       *idtype = SADB_IDENTTYPE_PREFIX;
@@ -2239,7 +2238,7 @@ pf_key_v2_convert_id (u_int8_t *id, int idlen, size_t *reslen, int *idtype)
 		"/%d", pf_key_v2_mask6_to_bits (addr +
 						sizeof (struct in6_addr)));
       *reslen = strlen (addrbuf);
-      res = strdup (addrbuf);
+      res = (u_int8_t *)strdup (addrbuf);
       if (!res)
 	return 0;
       LOG_DBG ((LOG_SYSDEP, 40, "pf_key_v2_convert_id: IPv6 subnet %s", res));
@@ -2358,7 +2357,7 @@ pf_key_v2_enable_sa (struct sa *sa, struct sa *isakmp_sa)
 static int
 pf_key_v2_conf_refinc (int af, char *section)
 {
-  unsigned char conn[22];
+  char conn[22];
   int num;
 
   if (!section)
@@ -2381,7 +2380,7 @@ pf_key_v2_conf_refinc (int af, char *section)
 static int
 pf_key_v2_conf_refhandle (int af, char *section)
 {
-  unsigned char conn[22];
+  char conn[22];
   int num;
 
   if (!section)
@@ -3795,7 +3794,7 @@ pf_key_v2_acquire (struct pf_key_v2_msg *pmsg)
 	  /* We may have been provided with authentication material. */
 	  if (sauth)
 	    {
-	      u_int8_t *authm;
+	      char *authm;
 
 	      /* Convert to bytes in-place. */
 	      sauth->sadb_x_cred_len *= PF_KEY_V2_CHUNK;
diff --git a/sbin/isakmpd/policy.c b/sbin/isakmpd/policy.c
index 32156b739b4..f43a3418cec 100644
--- a/sbin/isakmpd/policy.c
+++ b/sbin/isakmpd/policy.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: policy.c,v 1.55 2002/06/15 19:27:06 angelos Exp $	*/
+/*	$OpenBSD: policy.c,v 1.56 2002/09/11 09:50:44 ho Exp $	*/
 /*	$EOM: policy.c,v 1.49 2000/10/24 13:33:39 niklas Exp $ */
 
 /*
@@ -781,13 +781,13 @@ policy_callback (char *name)
 	  for (i = 0; i < 16; i++)
 	    net.s6_addr[i] &= mask.s6_addr[i];
 
-	  my_inet_ntop6 ((char *) &net, remote_id_addr_lower,
+	  my_inet_ntop6 ((unsigned char *) &net, remote_id_addr_lower,
 			 sizeof remote_id_addr_lower - 1);
 
 	  for (i = 0; i < 16; i++)
 	    net.s6_addr[i] |= ~mask.s6_addr[i];
 
-	  my_inet_ntop6 ((char *) &net, remote_id_addr_upper,
+	  my_inet_ntop6 ((unsigned char *) &net, remote_id_addr_upper,
 			 sizeof remote_id_addr_upper - 1);
 
 	  len = strlen (remote_id_addr_upper) + strlen (remote_id_addr_lower)
@@ -1058,13 +1058,13 @@ policy_callback (char *name)
 	      for (i = 0; i < 16; i++)
 		net.s6_addr[i] &= mask.s6_addr[i];
 
-	      my_inet_ntop6 ((char *) &net, remote_filter_addr_lower,
+	      my_inet_ntop6 ((unsigned char *) &net, remote_filter_addr_lower,
 			     sizeof remote_filter_addr_lower - 1);
 
 	      for (i = 0; i < 16; i++)
 		net.s6_addr[i] |= ~mask.s6_addr[i];
 
-	      my_inet_ntop6 ((char *) &net, remote_filter_addr_upper,
+	      my_inet_ntop6 ((unsigned char *) &net, remote_filter_addr_upper,
 			     sizeof remote_filter_addr_upper - 1);
 
 	      len = strlen (remote_filter_addr_upper)
@@ -1350,13 +1350,13 @@ policy_callback (char *name)
 	      for (i = 0; i < 16; i++)
 		net.s6_addr[i] &= mask.s6_addr[i];
 
-	      my_inet_ntop6 ((char *) &net, local_filter_addr_lower,
+	      my_inet_ntop6 ((unsigned char *) &net, local_filter_addr_lower,
 			     sizeof local_filter_addr_lower - 1);
 
 	      for (i = 0; i < 16; i++)
 		net.s6_addr[i] |= ~mask.s6_addr[i];
 
-	      my_inet_ntop6 ((char *) &net, local_filter_addr_upper,
+	      my_inet_ntop6 ((unsigned char *) &net, local_filter_addr_upper,
 			     sizeof local_filter_addr_upper - 1);
 
 	      len = strlen (local_filter_addr_upper)
@@ -2169,7 +2169,7 @@ void
 keynote_serialize (void *cert, u_int8_t **data, u_int32_t *datalen)
 {
   *datalen = strlen ((char *)cert) + 1;
-  *data = strdup (cert); /* So we allocate an extra character at the end... */
+  *data = (u_int8_t *)strdup (cert); /* i.e an extra character at the end... */
   if (*data == NULL)
     log_error ("keynote_serialize: malloc (%d) failed", *datalen);
 }
diff --git a/sbin/isakmpd/prf.c b/sbin/isakmpd/prf.c
index da1768e4731..a3d1b7e5a69 100644
--- a/sbin/isakmpd/prf.c
+++ b/sbin/isakmpd/prf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: prf.c,v 1.9 2002/06/06 02:15:27 ho Exp $	*/
+/*	$OpenBSD: prf.c,v 1.10 2002/09/11 09:50:44 ho Exp $	*/
 /*	$EOM: prf.c,v 1.7 1999/05/02 12:50:29 niklas Exp $	*/
 
 /*
@@ -76,7 +76,7 @@ prf_hash_final (unsigned char *digest, struct prf_hash_ctx *ctx)
  * the HMAC version of a hash. See RFC-2104 for reference.
  */
 struct prf *
-prf_alloc (enum prfs type, int subtype, char *shared, int sharedsize)
+prf_alloc (enum prfs type, int subtype, unsigned char *shared, int sharedsize)
 {
   struct hash *hash;
   struct prf *prf;
diff --git a/sbin/isakmpd/prf.h b/sbin/isakmpd/prf.h
index 7f8c50212eb..b19c40b41e4 100644
--- a/sbin/isakmpd/prf.h
+++ b/sbin/isakmpd/prf.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: prf.h,v 1.6 2002/09/06 21:36:52 deraadt Exp $	*/
+/*	$OpenBSD: prf.h,v 1.7 2002/09/11 09:50:44 ho Exp $	*/
 /*	$EOM: prf.h,v 1.1 1998/07/11 20:06:22 provos Exp $	*/
 
 /*
@@ -57,7 +57,7 @@ struct prf_hash_ctx {
   void *ctx, *ctx2;		/* Contexts we need for later */
 };
 
-struct prf *prf_alloc (enum prfs, int, char *, int);
+struct prf *prf_alloc (enum prfs, int, unsigned char *, int);
 void prf_free (struct prf *);
 
 #endif /* _PRF_H_ */
diff --git a/sbin/isakmpd/sysdep/openbsd/sysdep.c b/sbin/isakmpd/sysdep/openbsd/sysdep.c
index 5fda1cf9456..57f6c7838ec 100644
--- a/sbin/isakmpd/sysdep/openbsd/sysdep.c
+++ b/sbin/isakmpd/sysdep/openbsd/sysdep.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sysdep.c,v 1.22 2002/06/09 08:13:07 todd Exp $	*/
+/*	$OpenBSD: sysdep.c,v 1.23 2002/09/11 09:50:44 ho Exp $	*/
 /*	$EOM: sysdep.c,v 1.9 2000/12/04 04:46:35 angelos Exp $	*/
 
 /*
@@ -129,7 +129,7 @@ sysdep_ipsec_get_spi (size_t *sz, u_int8_t proto, struct sockaddr *src,
     {
       *sz = IPSEC_SPI_SIZE;
       /* XXX should be random instead I think.  */
-      return strdup ("\x12\x34\x56\x78");
+      return (u_int8_t *)strdup ("\x12\x34\x56\x78");
     }
   return KEY_API (get_spi) (sz, proto, src, dst, seq);
 }
diff --git a/sbin/isakmpd/udp.c b/sbin/isakmpd/udp.c
index 56ca6b131d4..342881ffd47 100644
--- a/sbin/isakmpd/udp.c
+++ b/sbin/isakmpd/udp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp.c,v 1.55 2002/06/01 07:44:22 deraadt Exp $	*/
+/*	$OpenBSD: udp.c,v 1.56 2002/09/11 09:50:44 ho Exp $	*/
 /*	$EOM: udp.c,v 1.57 2001/01/26 10:09:57 niklas Exp $	*/
 
 /*
@@ -713,7 +713,7 @@ udp_handle_message (struct transport *t)
   struct udp_transport *u = (struct udp_transport *)t;
   u_int8_t buf[UDP_SIZE];
   struct sockaddr_storage from;
-  int len = sizeof from;
+  u_int32_t len = sizeof from;
   ssize_t n;
   struct message *msg;
 
diff --git a/sbin/isakmpd/x509.c b/sbin/isakmpd/x509.c
index f9448864eb4..3214d5c23a4 100644
--- a/sbin/isakmpd/x509.c
+++ b/sbin/isakmpd/x509.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: x509.c,v 1.76 2002/09/05 15:47:22 ho Exp $	*/
+/*	$OpenBSD: x509.c,v 1.77 2002/09/11 09:50:44 ho Exp $	*/
 /*	$EOM: x509.c,v 1.54 2001/01/16 18:42:16 ho Exp $	*/
 
 /*
@@ -1280,7 +1280,7 @@ x509_cert_get_subjects (void *scert, int *cnt, u_int8_t ***id,
   int type;
   u_int8_t *altname;
   u_int32_t altlen;
-  char *buf = 0;
+  u_int8_t *buf = 0;
   unsigned char *ubuf;
   int i;