More Style police, but also sane checking of address

family vs stated ID-type.

2 files changed, 112 insertions, 87 deletions

diff --git a/sbin/isakmpd/ike_phase_1.c b/sbin/isakmpd/ike_phase_1.c
index dbf908b7fb0..02865ff4197 100644
--- a/sbin/isakmpd/ike_phase_1.c
+++ b/sbin/isakmpd/ike_phase_1.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ike_phase_1.c,v 1.29 2001/07/01 18:46:33 angelos Exp $	*/
+/*	$OpenBSD: ike_phase_1.c,v 1.30 2001/07/01 20:11:53 niklas Exp $	*/
 /*	$EOM: ike_phase_1.c,v 1.31 2000/12/11 23:47:56 niklas Exp $	*/
 
 /*
@@ -600,8 +600,8 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
 		 "dh_create_shared failed");
       return -1;
     }
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 80, 
-		"ike_phase_1_post_exchange_KE_NONCE: g^xy", ie->g_xy, 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 80,
+		"ike_phase_1_post_exchange_KE_NONCE: g^xy", ie->g_xy,
 		ie->g_x_len));
 
   /* Compute the SKEYID depending on the authentication method.  */
@@ -611,7 +611,7 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
       /* XXX Log and teardown?  */
       return -1;
     }
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 80, 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 80,
 		"ike_phase_1_post_exchange_KE_NONCE: SKEYID", ie->skeyid,
 		ie->skeyid_len));
 
@@ -635,7 +635,7 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
   prf->Update (prf->prfctx, exchange->cookies, ISAKMP_HDR_COOKIES_LEN);
   prf->Update (prf->prfctx, "\0", 1);
   prf->Final (ie->skeyid_d, prf->prfctx);
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 80, 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 80,
 		"ike_phase_1_post_exchange_KE_NONCE: SKEYID_d",	ie->skeyid_d,
 		ie->skeyid_len));
 
@@ -654,7 +654,7 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
   prf->Update (prf->prfctx, exchange->cookies, ISAKMP_HDR_COOKIES_LEN);
   prf->Update (prf->prfctx, "\1", 1);
   prf->Final (ie->skeyid_a, prf->prfctx);
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 80, 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 80,
 		"ike_phase_1_post_exchange_KE_NONCE: SKEYID_a",	ie->skeyid_a,
 		ie->skeyid_len));
 
@@ -675,8 +675,8 @@ ike_phase_1_post_exchange_KE_NONCE (struct message *msg)
   prf->Update (prf->prfctx, "\2", 1);
   prf->Final (ie->skeyid_e, prf->prfctx);
   prf_free (prf);
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 80, 
-		"ike_phase_1_post_exchange_KE_NONCE: SKEYID_e",	ie->skeyid_e, 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 80,
+		"ike_phase_1_post_exchange_KE_NONCE: SKEYID_e",	ie->skeyid_e,
 		ie->skeyid_len));
 
   /* Key length determination.  */
@@ -823,18 +823,18 @@ ike_phase_1_send_ID (struct message *msg)
 	{
 	case IPSEC_ID_IPV4_ADDR:
 	case IPSEC_ID_IPV6_ADDR:
-      	  msg->transport->vtbl->get_src (msg->transport, &src);
-
       	  /* Already in network byteorder.  */
-      	  memcpy (buf + ISAKMP_ID_DATA_OFF, sockaddr_data (src), 
+      	  memcpy (buf + ISAKMP_ID_DATA_OFF, sockaddr_data (src),
 		  sockaddr_len (src));
 	  break;
+
 	case IPSEC_ID_FQDN:
 	case IPSEC_ID_USER_FQDN:
 	case IPSEC_ID_KEY_ID:
 	  memcpy (buf + ISAKMP_ID_DATA_OFF, conf_get_str (my_id, "Name"),
 		  sz - ISAKMP_ID_DATA_OFF);
 	  break;
+
 	default:
 	  log_print ("ike_phase_1_send_ID: unsupported ID type %d", id_type);
 	  free (buf);
@@ -843,7 +843,6 @@ ike_phase_1_send_ID (struct message *msg)
     }
   else
     {
-      msg->transport->vtbl->get_src (msg->transport, &src);
       switch (src->sa_family)
 	{
 	case AF_INET:
@@ -854,7 +853,7 @@ ike_phase_1_send_ID (struct message *msg)
 	  break;
 	}
       /* Already in network byteorder.  */
-      memcpy (buf + ISAKMP_ID_DATA_OFF, sockaddr_data (src), 
+      memcpy (buf + ISAKMP_ID_DATA_OFF, sockaddr_data (src),
 	      sockaddr_len (src));
     }
 
@@ -922,6 +921,7 @@ ike_phase_1_recv_ID (struct message *msg)
   int initiator = exchange->initiator;
   u_int8_t **id, id_type;
   size_t *id_len, sz;
+  struct sockaddr *sa;
 
   payload = TAILQ_FIRST (&msg->payload[ISAKMP_PAYLOAD_ID]);
 
@@ -948,35 +948,53 @@ ike_phase_1_recv_ID (struct message *msg)
       switch (id_type)
 	{
 	case IPSEC_ID_IPV4_ADDR:
+	case IPSEC_ID_IPV6_ADDR:
 	  p = conf_get_str (rs, "Address");
 	  if (!p)
 	    {
-	      log_print ("ike_phase_1_recv_ID: failed to get Address in "
-			 "Remote-ID section [%s]", rs);
+	      log_print ("ike_phase_1_recv_ID: "
+			 "failed to get Address in Remote-ID section [%s]",
+			 rs);
 	      free (rid);
 	      return -1;
 	    }
 
-	  inet_pton (AF_INET, p, rid);
-	  break;
-	case IPSEC_ID_IPV6_ADDR:
-	  p = conf_get_str (rs, "Address");
-	  if (!p)
+	  if (text2sockaddr (p, 0, &sa) == -1)
+	    {
+	      log_print ("ike_phase_1_recv_ID: failed to parse address %s", p);
+	      free (rid);
+	      return -1;
+	    }
+
+	  if ((id_type == IPSEC_ID_IPV4_ADDR && sa->sa_family != AF_INET)
+	      || (id_type == IPSEC_ID_IPV6_ADDR && sa->sa_family != AF_INET6))
 	    {
-	      log_print ("ike_phase_1_recv_ID: failed to get Address in "
-			 "Remote-ID section [%s]", rs);
+	      log_print ("ike_phase_1_recv_ID: "
+			 "address %s not of expected family", p);
 	      free (rid);
+	      free (sa);
 	      return -1;
 	    }
 
-	  inet_pton (AF_INET6, p, rid);
+	  memcpy (rid, sockaddr_data (sa), sockaddr_len (sa));
+	  free (sa);
 	  break;
+
 	case IPSEC_ID_FQDN:
 	case IPSEC_ID_USER_FQDN:
 	case IPSEC_ID_KEY_ID:
 	  p = conf_get_str (rs, "Name");
+	  if (!p)
+	    {
+	      log_print ("ike_phase_1_recv_ID: "
+			 "failed to get Name in Remote-ID section [%s]", rs);
+	      free (rid);
+	      return -1;
+	    }
+
 	  memcpy (rid, p, sz);
 	  break;
+
 	default:
 	  log_print ("ike_phase_1_recv_ID: unsupported ID type %d", id_type);
 	  free (rid);
@@ -987,8 +1005,8 @@ ike_phase_1_recv_ID (struct message *msg)
       if (bcmp(rid, payload->p + ISAKMP_ID_DATA_OFF, sz))
 	{
 	  free (rid);
-	  log_print ("ike_phase_1_recv_ID: received remote ID other than "
-		     "expected %s", p);
+	  log_print ("ike_phase_1_recv_ID: "
+		     "received remote ID other than expected %s", p);
 	  return -1;
 	}
 
@@ -1195,7 +1213,7 @@ attribute_unacceptable (u_int16_t type, u_int8_t *value, u_int16_t len,
 
   if (!tag)
     {
-      LOG_DBG ((LOG_NEGOTIATION, 60, 
+      LOG_DBG ((LOG_NEGOTIATION, 60,
 		"attribute_unacceptable: attribute type %d not known", type));
       return 1;
     }
@@ -1237,8 +1255,8 @@ attribute_unacceptable (u_int16_t type, u_int8_t *value, u_int16_t len,
 	  LIST_INSERT_HEAD (&vs->attrs, node, link);
 	  return 0;
 	}
-      LOG_DBG ((LOG_NEGOTIATION, 70, 
-		"attribute_unacceptable: %s: got %s, expected %s", tag, 
+      LOG_DBG ((LOG_NEGOTIATION, 70,
+		"attribute_unacceptable: %s: got %s, expected %s", tag,
 		constant_lookup (map, decode_16 (value)), str));
       return 1;
 
@@ -1295,7 +1313,7 @@ attribute_unacceptable (u_int16_t type, u_int8_t *value, u_int16_t len,
 		  goto bail_out;
 		}
 	    }
-	  LOG_DBG ((LOG_NEGOTIATION, 70, 
+	  LOG_DBG ((LOG_NEGOTIATION, 70,
 		    "attribute_unacceptable: unrecognized LIFE_TYPE %d",
 		    decode_16 (value)));
 	  vs->life = 0;
diff --git a/sbin/isakmpd/ike_quick_mode.c b/sbin/isakmpd/ike_quick_mode.c
index 8ad5053671c..e6786e250e7 100644
--- a/sbin/isakmpd/ike_quick_mode.c
+++ b/sbin/isakmpd/ike_quick_mode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ike_quick_mode.c,v 1.52 2001/06/29 18:52:16 ho Exp $	*/
+/*	$OpenBSD: ike_quick_mode.c,v 1.53 2001/07/01 20:11:53 niklas Exp $	*/
 /*	$EOM: ike_quick_mode.c,v 1.139 2001/01/26 10:43:17 niklas Exp $	*/
 
 /*
@@ -108,9 +108,9 @@ static int
 check_policy (struct exchange *exchange, struct sa *sa, struct sa *isakmp_sa)
 {
   char *return_values[RETVALUES_NUM];
-  char **principal = NULL;
+  char **principal = 0;
   int i, result = 0, nprinc = 0;
-  int *x509_ids = NULL, *keynote_ids = NULL;
+  int *x509_ids = 0, *keynote_ids = 0;
   unsigned char hashbuf[20]; /* Set to the largest digest result */
 #ifdef USE_X509
   struct keynote_deckey dc;
@@ -179,55 +179,56 @@ check_policy (struct exchange *exchange, struct sa *sa, struct sa *isakmp_sa)
        */
       nprinc = 3;
       principal = calloc (nprinc, sizeof *principal);
-      if (principal == NULL)
+      if (!principal)
         {
-	  log_error ("check_policy: failed to allocate %d bytes",
-		     nprinc * sizeof *principal);
+	  log_error ("check_policy: calloc (%d, %d) failed", nprinc,
+		     sizeof *principal);
 	  goto policydone;
 	}
 
-      principal[0] = calloc (strlen (isakmp_sa->recv_key) + 1 +
-			     strlen ("passphrase:"), sizeof (char));
-      if (principal[0] == NULL)
+      principal[0] = calloc (strlen (isakmp_sa->recv_key)
+			     + sizeof "passphrase:", sizeof (char));
+      if (!principal[0])
         {
-	  log_error ("check_policy: failed to allocate %d bytes",
-		     strlen (isakmp_sa->recv_key) + 1 +
-		     strlen ("passphrase:"));
+	  log_error ("check_policy: calloc (%d, %d) failed",
+		     strlen (isakmp_sa->recv_key) + sizeof "passphrase:",
+		     sizeof (char));
 	  goto policydone;
 	}
 
+      /* XXX Consider changing the magic hash lengths with constants.  */
       strcpy (principal[0], "passphrase:");
-      memcpy (principal[0] + strlen ("passphrase:"), isakmp_sa->recv_key,
+      memcpy (principal[0] + sizeof "passphrase:" - 1, isakmp_sa->recv_key,
 	      strlen (isakmp_sa->recv_key));
 
-      principal[1] = calloc (strlen ("passphrase-md5-hex:") +
-			     32 + 1, sizeof (char));
-      if (principal[1] == NULL)
+      principal[1] = calloc (sizeof "passphrase-md5-hex:" + 2 * 16,
+			     sizeof (char));
+      if (!principal[1])
         {
-	  log_error ("check_policy: failed to allocate %d bytes",
-		     strlen ("passphrase-md5-hex:") + 33);
+	  log_error ("check_policy: calloc (%d, %d) failed",
+		     sizeof "passphrase-md5-hex:" + 2 * 16, sizeof (char));
 	  goto policydone;
 	}
 
       strcpy (principal[1], "passphrase-md5-hex:");
       MD5 (isakmp_sa->recv_key, strlen (isakmp_sa->recv_key), hashbuf);
       for (i = 0; i < 16; i++)
-	sprintf (principal[1] + (2 * i) + strlen ("passphrase-md5-hex:"),
+	sprintf (principal[1] + 2 * i + sizeof "passphrase-md5-hex:" - 1,
 		 "%02x", hashbuf[i]);
-      
-      principal[2] = calloc (strlen ("passphrase-sha1-hex:") +
-			     32 + 1, sizeof (char));
-      if (principal[2] == NULL)
+
+      principal[2] = calloc (sizeof "passphrase-sha1-hex:" + 2 * 20,
+			     sizeof (char));
+      if (!principal[2])
         {
-	  log_error ("check_policy: failed to allocate %d bytes",
-		     strlen ("passphrase-sha1-hex:") + 33);
+	  log_error ("check_policy: calloc (%d, %d) failed",
+		     sizeof "passphrase-sha1-hex:" + 2 * 20, sizeof (char));
 	  goto policydone;
 	}
 
       strcpy (principal[2], "passphrase-sha1-hex:");
       SHA1 (isakmp_sa->recv_key, strlen (isakmp_sa->recv_key), hashbuf);
       for (i = 0; i < 20; i++)
-	sprintf (principal[2] + (2 * i) + strlen ("passphrase-sha1-hex:"),
+	sprintf (principal[2] + 2 * i + sizeof "passphrase-sha1-hex:" - 1,
 		 "%02x", hashbuf[i]);
       break;
 
@@ -236,19 +237,19 @@ check_policy (struct exchange *exchange, struct sa *sa, struct sa *isakmp_sa)
       nprinc = 1;
 
       principal = calloc (nprinc, sizeof *principal);
-      if (principal == NULL)
+      if (!principal)
         {
-	  log_error ("check_policy: failed to allocate %d bytes",
-		     nprinc * sizeof *principal);
+	  log_error ("check_policy: calloc (%d, %d) failed", nprinc,
+		     sizeof *principal);
 	  goto policydone;
 	}
 
       /* Dup the keys */
       principal[0] = strdup (isakmp_sa->keynote_key);
-      if (principal[0] == NULL)
+      if (!principal[0])
         {
-	  log_error ("check_policy: failed to allocate %d bytes",
-		     strlen (isakmp_sa->keynote_key));
+	  log_error ("check_policy: calloc (%d, %d) failed",
+		     strlen (isakmp_sa->keynote_key), sizeof (char));
 	  goto policydone;
 	}
 #endif
@@ -257,9 +258,9 @@ check_policy (struct exchange *exchange, struct sa *sa, struct sa *isakmp_sa)
     case ISAKMP_CERTENC_X509_SIG:
 #ifdef USE_X509
       principal = calloc (2, sizeof *principal);
-      if (principal == NULL)
+      if (!principal)
         {
-	  log_error ("check_policy: failed to get memory for principal");
+	  log_error ("check_policy: calloc (2, %d) failed", sizeof *principal);
 	  goto policydone;
 	}
 
@@ -281,34 +282,35 @@ check_policy (struct exchange *exchange, struct sa *sa, struct sa *isakmp_sa)
 	  goto policydone;
 	}
 
-      if (principal[0] == NULL)
+      if (!principal[0])
 	{
 	  log_print ("check_policy: failed to allocate memory for principal");
 	  goto policydone;
 	}
 
-      principal[1] = calloc (strlen (principal[0]) + strlen ("rsa-hex:") + 1,
+      principal[1] = calloc (strlen (principal[0]) + sizeof "rsa-hex:",
 			     sizeof (char));
-      if (principal[1] == NULL)
+      if (!principal[1])
 	{
-	  log_error ("check_policy: failed to allocate memory for principal");
+	  log_error ("check_policy: calloc (%d, %d) failed",
+		     strlen (principal[0]) + sizeof "rsa-hex:", sizeof (char));
 	  goto policydone;
 	}
 
-      strcpy (principal[1], "rsa-hex:");
-      strcpy (principal[1] + strlen ("rsa-hex:"), principal[0]);
+      sprintf (principal[1], "rsa-hex:%s", principal[0]);
       free (principal[0]);
       principal[0] = principal[1];
-      principal[1] = NULL;
+      principal[1] = 0;
 
-      /* Generate a "DN:" principal */
+      /* Generate a "DN:" principal.  */
       subject = LC (X509_get_subject_name, (isakmp_sa->recv_cert));
       if (subject)
 	{
           principal[1] = calloc (259, sizeof (char));
-          if (principal[1] == NULL)
+          if (!principal[1])
             {
-	      log_error ("check_policy: failed to allocate memory for principal[1]");
+	      log_error ("check_policy: calloc (259, %d) failed",
+			 sizeof (char));
 	      goto policydone;
             }
 	  strcpy (principal[1], "DN:");
@@ -374,7 +376,7 @@ check_policy (struct exchange *exchange, struct sa *sa, struct sa *isakmp_sa)
     }
 
   free (principal);
-  principal = NULL;
+  principal = 0;
   nprinc = 0;
 
   /* Check what policy said.  */
@@ -877,10 +879,10 @@ initiator_send_HASH_SA_NONCE (struct message *msg)
 	       exchange->name);
   else if (remote_id)
     /* This code supports the "road warrior" case, where the initiator doesn't
-     * have a fixed IP address, but wants to specify a particular remote 
+     * have a fixed IP address, but wants to specify a particular remote
      * network to talk to.
      * -- Adrian Close <adrian@esec.com.au>
-     */ 
+     */
     {
       log_print ("initiator_send_HASH_SA_NONCE: "
 	       "Remote-ID given without Local-ID for \"%s\"",
@@ -912,7 +914,7 @@ initiator_send_HASH_SA_NONCE (struct message *msg)
 	  free (id);
 	  return -1;
 	}
-      memcpy (id + ISAKMP_ID_DATA_OFF, sockaddr_data (src), 
+      memcpy (id + ISAKMP_ID_DATA_OFF, sockaddr_data (src),
 	      sockaddr_len (src));
 
       LOG_DBG_BUF ((LOG_NEGOTIATION, 90, "initiator_send_HASH_SA_NONCE: IDic",
@@ -1014,7 +1016,7 @@ initiator_recv_HASH_SA_NONCE (struct message *msg)
     return -1;
 
   prf->Init (prf->prfctx);
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 90, 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 90,
 		"initiator_recv_HASH_SA_NONCE: message_id",
 		exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN));
   prf->Update (prf->prfctx, exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN);
@@ -1153,10 +1155,12 @@ initiator_recv_HASH_SA_NONCE (struct message *msg)
 	  SET_ISAKMP_ID_TYPE (ie->id_ci, IPSEC_ID_IPV4_ADDR);
 	  SET_ISAKMP_ID_TYPE (ie->id_cr, IPSEC_ID_IPV4_ADDR);
 	  break;
+
 	case AF_INET6:
 	  SET_ISAKMP_ID_TYPE (ie->id_ci, IPSEC_ID_IPV6_ADDR);
 	  SET_ISAKMP_ID_TYPE (ie->id_cr, IPSEC_ID_IPV6_ADDR);
 	  break;
+
 	default:
 	  log_error ("initiator_recv_HASH_SA_NONCE: unknown sa_family %d",
 		     src->sa_family);
@@ -1166,7 +1170,7 @@ initiator_recv_HASH_SA_NONCE (struct message *msg)
 	}
       memcpy (ie->id_ci + ISAKMP_ID_DATA_OFF, sockaddr_data (src),
 	      sockaddr_len (src));
-      memcpy (ie->id_cr + ISAKMP_ID_DATA_OFF, sockaddr_data (dst), 
+      memcpy (ie->id_cr + ISAKMP_ID_DATA_OFF, sockaddr_data (dst),
 	      sockaddr_len (dst));
     }
 
@@ -1255,7 +1259,7 @@ initiator_send_HASH (struct message *msg)
     }
 
   /* Allocate the prf and start calculating our HASH(3).  XXX Share?  */
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 90, "initiator_send_HASH: SKEYID_a", 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 90, "initiator_send_HASH: SKEYID_a",
 		isa->skeyid_a, isa->skeyid_len));
   prf = prf_alloc (isa->prf_type, isa->hash, isa->skeyid_a, isa->skeyid_len);
   if (!prf)
@@ -1362,8 +1366,8 @@ post_quick_mode (struct message *msg)
 		  /* If PFS is used hash in g^xy.  */
 		  if (ie->g_xy)
 		    {
-		      LOG_DBG_BUF ((LOG_NEGOTIATION, 90, 
-				    "post_quick_mode: g^xy", ie->g_xy, 
+		      LOG_DBG_BUF ((LOG_NEGOTIATION, 90,
+				    "post_quick_mode: g^xy", ie->g_xy,
 				    ie->g_x_len));
 		      prf->Update (prf->prfctx, ie->g_xy, ie->g_x_len);
 		    }
@@ -1446,7 +1450,7 @@ responder_recv_HASH_SA_NONCE (struct message *msg)
   if (!prf)
     goto cleanup;
   prf->Init (prf->prfctx);
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 90, 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 90,
 		"responder_recv_HASH_SA_NONCE: message_id",
 		exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN));
   prf->Update (prf->prfctx, exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN);
@@ -1544,7 +1548,7 @@ responder_recv_HASH_SA_NONCE (struct message *msg)
 	{
 	  log_error ("responder_recv_HASH_SA_NONCE: malloc (%d) failed",
 		     ie->id_ci_sz);
-	  goto cleanup; 
+	  goto cleanup;
 	}
 
       if (src->sa_family != dst->sa_family)
@@ -1559,18 +1563,21 @@ responder_recv_HASH_SA_NONCE (struct message *msg)
 	  SET_ISAKMP_ID_TYPE (ie->id_ci, IPSEC_ID_IPV4_ADDR);
 	  SET_ISAKMP_ID_TYPE (ie->id_cr, IPSEC_ID_IPV4_ADDR);
 	  break;
+
 	case AF_INET6:
 	  SET_ISAKMP_ID_TYPE (ie->id_ci, IPSEC_ID_IPV6_ADDR);
 	  SET_ISAKMP_ID_TYPE (ie->id_cr, IPSEC_ID_IPV6_ADDR);
 	  break;
+
 	default:
 	  log_error ("initiator_recv_HASH_SA_NONCE: unknown sa_family %d",
 		     src->sa_family);
 	  goto cleanup;
 	}
+
       memcpy (ie->id_cr + ISAKMP_ID_DATA_OFF, sockaddr_data (src),
 	      sockaddr_len (src));
-      memcpy (ie->id_ci + ISAKMP_ID_DATA_OFF, sockaddr_data (dst), 
+      memcpy (ie->id_ci + ISAKMP_ID_DATA_OFF, sockaddr_data (dst),
 	      sockaddr_len (dst));
     }
 
@@ -1802,8 +1809,8 @@ responder_send_HASH_SA_NONCE (struct message *msg)
   if (!prf)
     return -1;
   prf->Init (prf->prfctx);
-  LOG_DBG_BUF ((LOG_NEGOTIATION, 90, 
-		"responder_send_HASH_SA_NONCE: message_id", 
+  LOG_DBG_BUF ((LOG_NEGOTIATION, 90,
+		"responder_send_HASH_SA_NONCE: message_id",
 		exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN));
   prf->Update (prf->prfctx, exchange->message_id, ISAKMP_HDR_MESSAGE_ID_LEN);
   LOG_DBG_BUF ((LOG_NEGOTIATION, 90, "responder_send_HASH_SA_NONCE: NONCE_I_b",