Merge upstream version 4.5.2

8 files changed, 48 insertions, 151 deletions

diff --git a/src/libfreeswan/Makefile.am b/src/libfreeswan/Makefile.am
index d4571ccc7..09f5fe2cd 100644
--- a/src/libfreeswan/Makefile.am
+++ b/src/libfreeswan/Makefile.am
@@ -1,18 +1,10 @@
 noinst_LIBRARIES = libfreeswan.a
 libfreeswan_a_SOURCES = addrtoa.c addrtot.c addrtypeof.c anyaddr.c atoaddr.c atoasr.c \
-<<<<<<< HEAD
-			atosa.c atosubnet.c atoul.c copyright.c datatot.c freeswan.h \
-			goodmask.c initaddr.c initsaid.c initsubnet.c internal.h ipsec_param.h \
-			keyblobtoid.c pfkey_v2_build.c pfkey_v2_debug.c \
-			pfkey_v2_ext_bits.c pfkey_v2_parse.c portof.c prng.c rangetoa.c \
-			pfkey.h pfkeyv2.h rangetosubnet.c sameaddr.c satoa.c \
-=======
 			atosubnet.c atoul.c copyright.c datatot.c freeswan.h \
 			goodmask.c initaddr.c initsaid.c initsubnet.c internal.h ipsec_param.h \
 			pfkey_v2_build.c pfkey_v2_debug.c \
 			pfkey_v2_ext_bits.c pfkey_v2_parse.c portof.c rangetoa.c \
 			pfkey.h pfkeyv2.h rangetosubnet.c sameaddr.c \
->>>>>>> upstream/4.5.1
 			satot.c subnetof.c subnettoa.c subnettot.c \
 			subnettypeof.c ttoaddr.c ttodata.c ttoprotoport.c ttosa.c ttosubnet.c ttoul.c \
 			ultoa.c ultot.c
@@ -22,12 +14,7 @@ INCLUDES = \
 -I$(top_srcdir)/src/libhydra \
 -I$(top_srcdir)/src/pluto
 
-<<<<<<< HEAD
-dist_man3_MANS = anyaddr.3 atoaddr.3 atoasr.3 atosa.3 atoul.3 goodmask.3 initaddr.3 initsubnet.3 \
-                 keyblobtoid.3 portof.3 prng.3 rangetosubnet.3 sameaddr.3 subnetof.3 \
-=======
 dist_man3_MANS = anyaddr.3 atoaddr.3 atoasr.3 atoul.3 goodmask.3 initaddr.3 initsubnet.3 \
                  portof.3 rangetosubnet.3 sameaddr.3 subnetof.3 \
->>>>>>> upstream/4.5.1
                  ttoaddr.3 ttodata.3 ttosa.3 ttoul.3
 
diff --git a/src/libfreeswan/Makefile.in b/src/libfreeswan/Makefile.in
index 693ead287..d00ae91e0 100644
--- a/src/libfreeswan/Makefile.in
+++ b/src/libfreeswan/Makefile.in
@@ -58,21 +58,6 @@ libfreeswan_a_AR = $(AR) $(ARFLAGS)
 libfreeswan_a_LIBADD =
 am_libfreeswan_a_OBJECTS = addrtoa.$(OBJEXT) addrtot.$(OBJEXT) \
 	addrtypeof.$(OBJEXT) anyaddr.$(OBJEXT) atoaddr.$(OBJEXT) \
-<<<<<<< HEAD
-	atoasr.$(OBJEXT) atosa.$(OBJEXT) atosubnet.$(OBJEXT) \
-	atoul.$(OBJEXT) copyright.$(OBJEXT) datatot.$(OBJEXT) \
-	goodmask.$(OBJEXT) initaddr.$(OBJEXT) initsaid.$(OBJEXT) \
-	initsubnet.$(OBJEXT) keyblobtoid.$(OBJEXT) \
-	pfkey_v2_build.$(OBJEXT) pfkey_v2_debug.$(OBJEXT) \
-	pfkey_v2_ext_bits.$(OBJEXT) pfkey_v2_parse.$(OBJEXT) \
-	portof.$(OBJEXT) prng.$(OBJEXT) rangetoa.$(OBJEXT) \
-	rangetosubnet.$(OBJEXT) sameaddr.$(OBJEXT) satoa.$(OBJEXT) \
-	satot.$(OBJEXT) subnetof.$(OBJEXT) subnettoa.$(OBJEXT) \
-	subnettot.$(OBJEXT) subnettypeof.$(OBJEXT) ttoaddr.$(OBJEXT) \
-	ttodata.$(OBJEXT) ttoprotoport.$(OBJEXT) ttosa.$(OBJEXT) \
-	ttosubnet.$(OBJEXT) ttoul.$(OBJEXT) ultoa.$(OBJEXT) \
-	ultot.$(OBJEXT)
-=======
 	atoasr.$(OBJEXT) atosubnet.$(OBJEXT) atoul.$(OBJEXT) \
 	copyright.$(OBJEXT) datatot.$(OBJEXT) goodmask.$(OBJEXT) \
 	initaddr.$(OBJEXT) initsaid.$(OBJEXT) initsubnet.$(OBJEXT) \
@@ -84,7 +69,6 @@ am_libfreeswan_a_OBJECTS = addrtoa.$(OBJEXT) addrtot.$(OBJEXT) \
 	ttoaddr.$(OBJEXT) ttodata.$(OBJEXT) ttoprotoport.$(OBJEXT) \
 	ttosa.$(OBJEXT) ttosubnet.$(OBJEXT) ttoul.$(OBJEXT) \
 	ultoa.$(OBJEXT) ultot.$(OBJEXT)
->>>>>>> upstream/4.5.1
 libfreeswan_a_OBJECTS = $(am_libfreeswan_a_OBJECTS)
 DEFAULT_INCLUDES = -I.@am__isrc@
 depcomp = $(SHELL) $(top_srcdir)/depcomp
@@ -248,13 +232,7 @@ includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
 ipsecdir = @ipsecdir@
-<<<<<<< HEAD
-ipsecgid = @ipsecgid@
 ipsecgroup = @ipsecgroup@
-ipsecuid = @ipsecuid@
-=======
-ipsecgroup = @ipsecgroup@
->>>>>>> upstream/4.5.1
 ipsecuser = @ipsecuser@
 libcharon_plugins = @libcharon_plugins@
 libdir = @libdir@
@@ -275,6 +253,8 @@ nm_ca_dir = @nm_ca_dir@
 oldincludedir = @oldincludedir@
 openac_plugins = @openac_plugins@
 p_plugins = @p_plugins@
+pcsclite_CFLAGS = @pcsclite_CFLAGS@
+pcsclite_LIBS = @pcsclite_LIBS@
 pdfdir = @pdfdir@
 piddir = @piddir@
 pki_plugins = @pki_plugins@
@@ -293,14 +273,12 @@ sbindir = @sbindir@
 scepclient_plugins = @scepclient_plugins@
 scripts_plugins = @scripts_plugins@
 sharedstatedir = @sharedstatedir@
-<<<<<<< HEAD
-=======
 soup_CFLAGS = @soup_CFLAGS@
 soup_LIBS = @soup_LIBS@
->>>>>>> upstream/4.5.1
 srcdir = @srcdir@
 strongswan_conf = @strongswan_conf@
 sysconfdir = @sysconfdir@
+systemdsystemunitdir = @systemdsystemunitdir@
 target_alias = @target_alias@
 top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
@@ -310,19 +288,11 @@ xml_CFLAGS = @xml_CFLAGS@
 xml_LIBS = @xml_LIBS@
 noinst_LIBRARIES = libfreeswan.a
 libfreeswan_a_SOURCES = addrtoa.c addrtot.c addrtypeof.c anyaddr.c atoaddr.c atoasr.c \
-<<<<<<< HEAD
-			atosa.c atosubnet.c atoul.c copyright.c datatot.c freeswan.h \
-			goodmask.c initaddr.c initsaid.c initsubnet.c internal.h ipsec_param.h \
-			keyblobtoid.c pfkey_v2_build.c pfkey_v2_debug.c \
-			pfkey_v2_ext_bits.c pfkey_v2_parse.c portof.c prng.c rangetoa.c \
-			pfkey.h pfkeyv2.h rangetosubnet.c sameaddr.c satoa.c \
-=======
 			atosubnet.c atoul.c copyright.c datatot.c freeswan.h \
 			goodmask.c initaddr.c initsaid.c initsubnet.c internal.h ipsec_param.h \
 			pfkey_v2_build.c pfkey_v2_debug.c \
 			pfkey_v2_ext_bits.c pfkey_v2_parse.c portof.c rangetoa.c \
 			pfkey.h pfkeyv2.h rangetosubnet.c sameaddr.c \
->>>>>>> upstream/4.5.1
 			satot.c subnetof.c subnettoa.c subnettot.c \
 			subnettypeof.c ttoaddr.c ttodata.c ttoprotoport.c ttosa.c ttosubnet.c ttoul.c \
 			ultoa.c ultot.c
@@ -332,13 +302,8 @@ INCLUDES = \
 -I$(top_srcdir)/src/libhydra \
 -I$(top_srcdir)/src/pluto
 
-<<<<<<< HEAD
-dist_man3_MANS = anyaddr.3 atoaddr.3 atoasr.3 atosa.3 atoul.3 goodmask.3 initaddr.3 initsubnet.3 \
-                 keyblobtoid.3 portof.3 prng.3 rangetosubnet.3 sameaddr.3 subnetof.3 \
-=======
 dist_man3_MANS = anyaddr.3 atoaddr.3 atoasr.3 atoul.3 goodmask.3 initaddr.3 initsubnet.3 \
                  portof.3 rangetosubnet.3 sameaddr.3 subnetof.3 \
->>>>>>> upstream/4.5.1
                  ttoaddr.3 ttodata.3 ttosa.3 ttoul.3
 
 all: all-am
@@ -395,10 +360,6 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/anyaddr.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/atoaddr.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/atoasr.Po@am__quote@
-<<<<<<< HEAD
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/atosa.Po@am__quote@
-=======
->>>>>>> upstream/4.5.1
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/atosubnet.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/atoul.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/copyright.Po@am__quote@
@@ -407,26 +368,14 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/initaddr.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/initsaid.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/initsubnet.Po@am__quote@
-<<<<<<< HEAD
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/keyblobtoid.Po@am__quote@
-=======
->>>>>>> upstream/4.5.1
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pfkey_v2_build.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pfkey_v2_debug.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pfkey_v2_ext_bits.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pfkey_v2_parse.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/portof.Po@am__quote@
-<<<<<<< HEAD
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/prng.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rangetoa.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rangetosubnet.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sameaddr.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/satoa.Po@am__quote@
-=======
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rangetoa.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rangetosubnet.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sameaddr.Po@am__quote@
->>>>>>> upstream/4.5.1
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/satot.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/subnetof.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/subnettoa.Po@am__quote@
diff --git a/src/libfreeswan/atoaddr.c b/src/libfreeswan/atoaddr.c
index 8f1be0a84..a3643801e 100644
--- a/src/libfreeswan/atoaddr.c
+++ b/src/libfreeswan/atoaddr.c
@@ -45,7 +45,7 @@ struct in_addr *addrp;
 {
 	struct addrinfo hints, *res;
 	struct netent *ne = NULL;
-	const char *oops;
+	const char *oops, *msg = NULL;
 #	define	HEXLEN	10	/* strlen("0x11223344") */
 #	ifndef ATOADDRBUF
 #	define	ATOADDRBUF	100
@@ -84,10 +84,18 @@ struct in_addr *addrp;
 
 	/* next, check that it's a vaguely legal name */
 	for (q = p; *q != '\0'; q++)
+	{
 		if (!isprint(*q))
-			return "unprintable character in name";
+		{
+			msg = "unprintable character in name";
+			goto error;
+		}
+	}
 	if (strspn(p, namechars) != srclen)
-		return "illegal (non-DNS-name) character in name";
+	{
+		msg = "illegal (non-DNS-name) character in name";
+		goto error;
+	}
 
 	/* try as host name, failing that as /etc/networks network name */
 	memset(&hints, 0, sizeof(hints));
@@ -98,11 +106,8 @@ struct in_addr *addrp;
 		ne = getnetbyname(p);
 		if (ne == NULL)
 		{
-			if (p != namebuf)
-			{
-				FREE(p);
-			}
-			return "name lookup failed";
+			msg = "name lookup failed";
+			goto error;
 		}
 		addrp->s_addr = htonl(ne->n_net);
 	}
@@ -113,12 +118,13 @@ struct in_addr *addrp;
 		freeaddrinfo(res);
 	}
 
+error:
 	if (p != namebuf)
 	{
 		FREE(p);
 	}
 
-	return NULL;
+	return msg;
 }
 
 /*
diff --git a/src/libfreeswan/copyright.c b/src/libfreeswan/copyright.c
index ff4575add..e55e849f7 100644
--- a/src/libfreeswan/copyright.c
+++ b/src/libfreeswan/copyright.c
@@ -27,15 +27,6 @@ static const char *co[] = {
  "    Christoph Gysin, Andreas Hess, Patric Lichtsteiner, Michael Meier,",
  "    Andreas Schleiss, Ariane Seiler, Mario Strasser, Lukas Suter,",
  "    Roger Wegmann, Simon Zwahlen,",
-<<<<<<< HEAD
- "    Zuercher Hochschule Winterthur (Switzerland).",
- "",
- "    Philip Boetschi, Tobias Brunner, Adrian Doerig, Andreas Eigenmann,",
- "    Fabian Hartmann, Noah Heusser, Jan Hutter, Thomas Kallenberg,",
- "    Daniel Roethlisberger, Joel Stillhart, Martin Willi, Daniel Wydler,",
- "    Andreas Steffen,",
- "    Hochschule fuer Technik Rapperswil (Switzerland).",
-=======
  "    ZHW Zuercher Hochschule Winterthur (Switzerland).",
  "",
  "    Philip Boetschi, Tobias Brunner, Sansar Choinyambuu, Adrian Doerig,",
@@ -43,7 +34,6 @@ static const char *co[] = {
  "    Thomas Kallenberg, Daniel Roethlisberger, Joel Stillhart, Martin Willi,",
  "    Daniel Wydler, Andreas Steffen,",
  "    HSR Hochschule fuer Technik Rapperswil (Switzerland).",
->>>>>>> upstream/4.5.1
  "",
  "This program is free software; you can redistribute it and/or modify it",
  "under the terms of the GNU General Public License as published by the",
diff --git a/src/libfreeswan/freeswan.h b/src/libfreeswan/freeswan.h
index 94a8a5266..724165bde 100644
--- a/src/libfreeswan/freeswan.h
+++ b/src/libfreeswan/freeswan.h
@@ -158,14 +158,6 @@ err_t ttodatav(const char *src, size_t srclen, int base,
 
 size_t datatot(const char *src, size_t srclen, int format, char *buf,
 								size_t buflen);
-<<<<<<< HEAD
-size_t keyblobtoid(const unsigned char *src, size_t srclen, char *dst,
-								size_t dstlen);
-size_t splitkeytoid(const unsigned char *e, size_t elen, const unsigned char *m,
-					size_t mlen, char *dst, size_t dstlen);
-#define	KEYID_BUF		10	/* up to 9 text digits plus NUL */
-=======
->>>>>>> upstream/4.5.1
 err_t ttoprotoport(char *src, size_t src_len, u_int8_t *proto, u_int16_t *port,
 							bool *has_port_wildcard);
 
@@ -209,15 +201,6 @@ void setportof(int port, ip_address *dst);
 struct sockaddr *sockaddrof(ip_address *src);
 size_t sockaddrlenof(const ip_address *src);
 
-<<<<<<< HEAD
-/* PRNG */
-void prng_init(struct prng *prng, const unsigned char *key, size_t keylen);
-void prng_bytes(struct prng *prng, unsigned char *dst, size_t dstlen);
-unsigned long prng_count(struct prng *prng);
-void prng_final(struct prng *prng);
-
-=======
->>>>>>> upstream/4.5.1
 /* odds and ends */
 const char **ipsec_copyright_notice(void);
 
@@ -300,27 +283,6 @@ rangetoa(
 );
 #define	RANGETOA_BUF	34	/* large enough for worst case result */
 
-<<<<<<< HEAD
-/* data types for SA conversion functions */
-
-/* SAs */
-const char *			/* NULL for success, else string literal */
-atosa(
-	const char *src,
-	size_t srclen,		/* 0 means strlen(src) */
-	struct sa_id *sa
-);
-size_t				/* space needed for full conversion */
-satoa(
-	struct sa_id sa,
-	int format,		/* character; 0 means default */
-	char *dst,
-	size_t dstlen
-);
-#define	SATOA_BUF	(3+ULTOA_BUF+ADDRTOA_BUF)
-
-=======
->>>>>>> upstream/4.5.1
 /* generic data, e.g. keys */
 const char *			/* NULL for success, else string literal */
 atobytes(
diff --git a/src/libfreeswan/pfkey_v2_debug.c b/src/libfreeswan/pfkey_v2_debug.c
index 0217538a0..0762d8f2b 100644
--- a/src/libfreeswan/pfkey_v2_debug.c
+++ b/src/libfreeswan/pfkey_v2_debug.c
@@ -54,10 +54,11 @@ static char *pfkey_sadb_ext_strings[]={
   "X-source-mask",                /* SADB_X_EXT_ADDRESS_SRC_MASK   23 */
   "X-dest-mask",                  /* SADB_X_EXT_ADDRESS_DST_MASK   24 */
   "X-set-debug",                  /* SADB_X_EXT_DEBUG              25 */
-  "X-NAT-T-type",                 /* SADB_X_EXT_NAT_T_TYPE         26 */
-  "X-NAT-T-sport",                /* SADB_X_EXT_NAT_T_SPORT        27 */
-  "X-NAT-T-dport",                /* SADB_X_EXT_NAT_T_DPORT        28 */
-  "X-NAT-T-OA",                   /* SADB_X_EXT_NAT_T_OA           29 */
+  "X-protocol",                   /* SADB_X_EXT_PROTOCOL           26 */
+  "X-NAT-T-type",                 /* SADB_X_EXT_NAT_T_TYPE         27 */
+  "X-NAT-T-sport",                /* SADB_X_EXT_NAT_T_SPORT        28 */
+  "X-NAT-T-dport",                /* SADB_X_EXT_NAT_T_DPORT        29 */
+  "X-NAT-T-OA",                   /* SADB_X_EXT_NAT_T_OA           30 */
 };
 
 const char *
@@ -72,23 +73,24 @@ pfkey_v2_sadb_ext_string(int ext)
 
 
 static char *pfkey_sadb_type_strings[]={
-	"reserved",                     /* SADB_RESERVED      */
-	"getspi",                       /* SADB_GETSPI        */
-	"update",                       /* SADB_UPDATE        */
-	"add",                          /* SADB_ADD           */
-	"delete",                       /* SADB_DELETE        */
-	"get",                          /* SADB_GET           */
-	"acquire",                      /* SADB_ACQUIRE       */
-	"register",                     /* SADB_REGISTER      */
-	"expire",                       /* SADB_EXPIRE        */
-	"flush",                        /* SADB_FLUSH         */
-	"dump",                         /* SADB_DUMP          */
-	"x-promisc",                    /* SADB_X_PROMISC     */
-	"x-pchange",                    /* SADB_X_PCHANGE     */
-	"x-groupsa",                    /* SADB_X_GRPSA       */
-	"x-addflow(eroute)",            /* SADB_X_ADDFLOW     */
-	"x-delflow(eroute)",            /* SADB_X_DELFLOW     */
-	"x-debug",                      /* SADB_X_DEBUG       */
+	"reserved",                     /* SADB_RESERVED            */
+	"getspi",                       /* SADB_GETSPI              */
+	"update",                       /* SADB_UPDATE              */
+	"add",                          /* SADB_ADD                 */
+	"delete",                       /* SADB_DELETE              */
+	"get",                          /* SADB_GET                 */
+	"acquire",                      /* SADB_ACQUIRE             */
+	"register",                     /* SADB_REGISTER            */
+	"expire",                       /* SADB_EXPIRE              */
+	"flush",                        /* SADB_FLUSH               */
+	"dump",                         /* SADB_DUMP                */
+	"x-promisc",                    /* SADB_X_PROMISC           */
+	"x-pchange",                    /* SADB_X_PCHANGE           */
+	"x-groupsa",                    /* SADB_X_GRPSA             */
+	"x-addflow(eroute)",            /* SADB_X_ADDFLOW           */
+	"x-delflow(eroute)",            /* SADB_X_DELFLOW           */
+	"x-debug",                      /* SADB_X_DEBUG             */
+	"x-nat-t-new-mapping",          /* SADB_X_NAT_T_NEW_MAPPING */
 };
 
 const char *
diff --git a/src/libfreeswan/pfkey_v2_parse.c b/src/libfreeswan/pfkey_v2_parse.c
index 49d5cdf4a..a143003b3 100644
--- a/src/libfreeswan/pfkey_v2_parse.c
+++ b/src/libfreeswan/pfkey_v2_parse.c
@@ -1247,6 +1247,7 @@ pfkey_msg_parse(struct sadb_msg *pfkey_msg,
 				  pfkey_msg->sadb_msg_type,
 				  pfkey_v2_sadb_type_string(pfkey_msg->sadb_msg_type));
 		}
+		/* fall through */
 	case SADB_ACQUIRE:
 	case SADB_REGISTER:
 	case SADB_EXPIRE:
diff --git a/src/libfreeswan/satot.c b/src/libfreeswan/satot.c
index e70036482..a3feb1591 100644
--- a/src/libfreeswan/satot.c
+++ b/src/libfreeswan/satot.c
@@ -77,7 +77,7 @@ size_t dstlen;
 			break;			/* NOTE BREAK OUT */
 		}
 	if (pre == NULL) {		/* unknown protocol */
-		strcpy(unk, "unk");
+		strncpy(unk, "unk", sizeof(unk));
 		(void) ultot((unsigned char)sa->proto, 10, unk+strlen(unk),
 						sizeof(unk)-strlen(unk));
 		pre = unk;
@@ -86,9 +86,9 @@ size_t dstlen;
 	if (strcmp(pre, PASSTHROUGHTYPE) == 0 &&
 					sa->spi == PASSTHROUGHSPI &&
 					isunspecaddr(&sa->dst)) {
-		strcpy(buf, (addrtypeof(&sa->dst) == AF_INET) ?
+		strncpy(buf, (addrtypeof(&sa->dst) == AF_INET) ?
 							PASSTHROUGH4NAME :
-							PASSTHROUGH6NAME);
+							PASSTHROUGH6NAME, sizeof(buf));
 		len = strlen(buf);
 	}
 
@@ -104,13 +104,13 @@ size_t dstlen;
 		default:	p = NULL;	break;
 		}
 		if (p != NULL) {
-			strcpy(buf, p);
+			strncpy(buf, p, sizeof(buf));
 			len = strlen(buf);
 		}
 	}
 
 	if (len == 0) {			/* general case needed */
-		strcpy(buf, pre);
+		strncpy(buf, pre, sizeof(buf));
 		len = strlen(buf);
 		if (showversion) {
 			*(buf+len) = (addrtypeof(&sa->dst) == AF_INET) ? '.' :
@@ -126,7 +126,7 @@ size_t dstlen;
 	if (dst != NULL) {
 		if (len > dstlen)
 			*(buf+dstlen-1) = '\0';
-		strcpy(dst, buf);
+		strncpy(dst, buf, dstlen);
 	}
 	return len;
 }