make ipsp_address thread safe; ok mpi

8 files changed, 201 insertions, 111 deletions

diff --git a/sys/netinet/ip_ah.c b/sys/netinet/ip_ah.c
index f66ea31c495..64d6ee09832 100644
--- a/sys/netinet/ip_ah.c
+++ b/sys/netinet/ip_ah.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ah.c,v 1.114 2014/12/28 10:02:37 tedu Exp $ */
+/*	$OpenBSD: ip_ah.c,v 1.115 2015/04/14 14:20:01 mikeb Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
@@ -533,6 +533,9 @@ ah_input(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
 	u_int32_t btsx, esn;
 	u_int8_t hl;
 	int rplen;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	struct cryptodesc *crda = NULL;
 	struct cryptop *crp;
@@ -555,29 +558,30 @@ ah_input(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
 		case 1:
 			m_freem(m);
 			DPRINTF(("ah_input(): replay counter wrapped for "
-			    "SA %s/%08x\n", ipsp_address(tdb->tdb_dst),
-			    ntohl(tdb->tdb_spi)));
+			    "SA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			ahstat.ahs_wrap++;
 			return ENOBUFS;
 		case 2:
 			m_freem(m);
 			DPRINTF(("ah_input(): old packet received in "
-			    "SA %s/%08x\n", ipsp_address(tdb->tdb_dst),
-			    ntohl(tdb->tdb_spi)));
+			    "SA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			ahstat.ahs_replay++;
 			return ENOBUFS;
 		case 3:
 			m_freem(m);
 			DPRINTF(("ah_input(): duplicate packet received in "
-			    "SA %s/%08x\n", ipsp_address(tdb->tdb_dst),
-			    ntohl(tdb->tdb_spi)));
+			    "SA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			ahstat.ahs_replay++;
 			return ENOBUFS;
 		default:
 			m_freem(m);
 			DPRINTF(("ah_input(): bogus value from "
 			    "checkreplaywindow() in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			ahstat.ahs_replay++;
 			return ENOBUFS;
 		}
@@ -585,9 +589,10 @@ ah_input(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
 
 	/* Verify AH header length. */
 	if (hl * sizeof(u_int32_t) != ahx->authsize + rplen - AH_FLENGTH) {
-		DPRINTF(("ah_input(): bad authenticator length %d for packet "
+		DPRINTF(("ah_input(): bad authenticator length %ld for packet "
 		    "in SA %s/%08x\n", hl * sizeof(u_int32_t),
-		    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi)));
 
 		ahstat.ahs_badauthl++;
 		m_freem(m);
@@ -738,6 +743,9 @@ ah_input_cb(void *op)
 	u_int32_t btsx, esn;
 	u_int8_t prot;
 	caddr_t ptr;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	crp = (struct cryptop *) op;
 
@@ -807,7 +815,8 @@ ah_input_cb(void *op)
 
 			DPRINTF(("ah_input(): authentication failed for "
 			    "packet in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 
 			ahstat.ahs_badauth++;
 			error = EACCES;
@@ -841,29 +850,30 @@ ah_input_cb(void *op)
 			break;
 		case 1:
 			DPRINTF(("ah_input(): replay counter wrapped for "
-			    "SA %s/%08x\n", ipsp_address(tdb->tdb_dst),
-			    ntohl(tdb->tdb_spi)));
+			    "SA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			ahstat.ahs_wrap++;
 			error = ENOBUFS;
 			goto baddone;
 		case 2:
 			DPRINTF(("ah_input_cb(): old packet received in "
-			    "SA %s/%08x\n", ipsp_address(tdb->tdb_dst),
-			    ntohl(tdb->tdb_spi)));
+			    "SA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			ahstat.ahs_replay++;
 			error = ENOBUFS;
 			goto baddone;
 		case 3:
 			DPRINTF(("ah_input_cb(): duplicate packet received in "
-			    "SA %s/%08x\n", ipsp_address(tdb->tdb_dst),
-			    ntohl(tdb->tdb_spi)));
+			    "SA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			ahstat.ahs_replay++;
 			error = ENOBUFS;
 			goto baddone;
 		default:
 			DPRINTF(("ah_input_cb(): bogus value from "
 			    "checkreplaywindow() in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			ahstat.ahs_replay++;
 			error = ENOBUFS;
 			goto baddone;
@@ -878,7 +888,7 @@ ah_input_cb(void *op)
 		m_freem(m);
 
 		DPRINTF(("ah_input(): bad mbuf chain for packet in SA "
-		    "%s/%08x\n", ipsp_address(tdb->tdb_dst),
+		    "%s/%08x\n", ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
 		    ntohl(tdb->tdb_spi)));
 
 		return EINVAL;
@@ -976,6 +986,9 @@ ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 	struct ah *ah;
 #if NBPFILTER > 0
 	struct ifnet *encif;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	if ((encif = enc_getif(tdb->tdb_rdomain, tdb->tdb_tap)) != NULL) {
 		encif->if_opackets++;
@@ -1004,7 +1017,8 @@ ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 	 */
 	if ((tdb->tdb_rpl == 0) && (tdb->tdb_wnd > 0)) {
 		DPRINTF(("ah_output(): SA %s/%08x should have expired\n",
-		    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		ahstat.ahs_wrap++;
 		return EINVAL;
@@ -1018,7 +1032,8 @@ ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 		if (rplen + ahx->authsize + m->m_pkthdr.len > IP_MAXPACKET) {
 			DPRINTF(("ah_output(): packet in SA %s/%08x got too "
 			    "big\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			m_freem(m);
 			ahstat.ahs_toobig++;
 			return EMSGSIZE;
@@ -1030,8 +1045,8 @@ ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 		/* Check for IPv6 maximum packet size violations. */
 		if (rplen + ahx->authsize + m->m_pkthdr.len > IPV6_MAXPACKET) {
 			DPRINTF(("ah_output(): packet in SA %s/%08x "
-			    "got too big\n", ipsp_address(tdb->tdb_dst),
-			    ntohl(tdb->tdb_spi)));
+			    "got too big\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			m_freem(m);
 			ahstat.ahs_toobig++;
 			return EMSGSIZE;
@@ -1042,7 +1057,8 @@ ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 	default:
 		DPRINTF(("ah_output(): unknown/unsupported protocol "
 		    "family %d, SA %s/%08x\n", tdb->tdb_dst.sa.sa_family,
-		    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		ahstat.ahs_nopf++;
 		return EPFNOSUPPORT;
@@ -1101,7 +1117,7 @@ ah_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 	mi = m_inject(m, skip, rplen + ahx->authsize, M_DONTWAIT);
 	if (mi == NULL) {
 		DPRINTF(("ah_output(): failed to inject AH header for SA "
-		    "%s/%08x\n", ipsp_address(tdb->tdb_dst),
+		    "%s/%08x\n", ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
 		    ntohl(tdb->tdb_spi)));
 
 		m_freem(m);
diff --git a/sys/netinet/ip_esp.c b/sys/netinet/ip_esp.c
index 69a23037d6a..863b2622da1 100644
--- a/sys/netinet/ip_esp.c
+++ b/sys/netinet/ip_esp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_esp.c,v 1.129 2014/12/19 17:14:40 tedu Exp $ */
+/*	$OpenBSD: ip_esp.c,v 1.130 2015/04/14 14:20:01 mikeb Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
@@ -144,17 +144,22 @@ esp_init(struct tdb *tdbp, struct xformsw *xsp, struct ipsecinit *ii)
 			break;
 
 		default:
-			DPRINTF(("esp_init(): unsupported encryption algorithm %d specified\n", ii->ii_encalg));
+			DPRINTF(("esp_init(): unsupported encryption "
+			    "algorithm %d specified\n", ii->ii_encalg));
 			return EINVAL;
 		}
 
 		if (ii->ii_enckeylen < txform->minkey) {
-			DPRINTF(("esp_init(): keylength %d too small (min length is %d) for algorithm %s\n", ii->ii_enckeylen, txform->minkey, txform->name));
+			DPRINTF(("esp_init(): keylength %d too small "
+			    "(min length is %d) for algorithm %s\n",
+			    ii->ii_enckeylen, txform->minkey, txform->name));
 			return EINVAL;
 		}
 
 		if (ii->ii_enckeylen > txform->maxkey) {
-			DPRINTF(("esp_init(): keylength %d too large (max length is %d) for algorithm %s\n", ii->ii_enckeylen, txform->maxkey, txform->name));
+			DPRINTF(("esp_init(): keylength %d too large "
+			    "(max length is %d) for algorithm %s\n",
+			    ii->ii_enckeylen, txform->maxkey, txform->name));
 			return EINVAL;
 		}
 
@@ -222,12 +227,15 @@ esp_init(struct tdb *tdbp, struct xformsw *xsp, struct ipsecinit *ii)
 			break;
 
 		default:
-			DPRINTF(("esp_init(): unsupported authentication algorithm %d specified\n", ii->ii_authalg));
+			DPRINTF(("esp_init(): unsupported authentication "
+			    "algorithm %d specified\n", ii->ii_authalg));
 			return EINVAL;
 		}
 
 		if (ii->ii_authkeylen != thash->keysize) {
-			DPRINTF(("esp_init(): keylength %d doesn't match algorithm %s keysize (%d)\n", ii->ii_authkeylen, thash->name, thash->keysize));
+			DPRINTF(("esp_init(): keylength %d doesn't match "
+			    "algorithm %s keysize (%d)\n", ii->ii_authkeylen,
+			    thash->name, thash->keysize));
 			return EINVAL;
 		}
 
@@ -328,6 +336,9 @@ esp_input(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
 	int plen, alen, hlen;
 	struct m_tag *mtag;
 	u_int32_t btsx, esn;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	/* Determine the ESP header length */
 	hlen = 2 * sizeof(u_int32_t) + tdb->tdb_ivlen; /* "new" ESP */
@@ -346,7 +357,10 @@ esp_input(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
 		 * block size.
 		 */
 		if (plen & (espx->blocksize - 1)) {
-			DPRINTF(("esp_input(): payload of %d octets not a multiple of %d octets, SA %s/%08x\n", plen, espx->blocksize, ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			DPRINTF(("esp_input(): payload of %d octets "
+			    "not a multiple of %d octets, SA %s/%08x\n",
+			    plen, espx->blocksize, ipsp_address(&tdb->tdb_dst,
+			    buf, sizeof(buf)), ntohl(tdb->tdb_spi)));
 			espstat.esps_badilen++;
 			m_freem(m);
 			return EINVAL;
@@ -366,28 +380,32 @@ esp_input(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
 			m_freem(m);
 			DPRINTF(("esp_input(): replay counter wrapped"
 			    " for SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_wrap++;
 			return EACCES;
 		case 2:
 			m_freem(m);
 			DPRINTF(("esp_input(): old packet received"
 			    " in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_replay++;
 			return EACCES;
 		case 3:
 			m_freem(m);
 			DPRINTF(("esp_input(): duplicate packet received"
 			    " in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_replay++;
 			return EACCES;
 		default:
 			m_freem(m);
 			DPRINTF(("esp_input(): bogus value from"
 			    " checkreplaywindow() in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_replay++;
 			return EACCES;
 		}
@@ -479,7 +497,8 @@ esp_input(struct mbuf *m, struct tdb *tdb, int skip, int protoff)
 
 		/* Copy the authenticator */
 		if (mtag == NULL)
-			m_copydata(m, m->m_pkthdr.len - alen, alen, (caddr_t) (tc + 1));
+			m_copydata(m, m->m_pkthdr.len - alen, alen,
+			    (caddr_t)(tc + 1));
 	} else
 		crde = crp->crp_desc;
 
@@ -536,6 +555,9 @@ esp_input_cb(void *op)
 	struct tdb *tdb;
 	u_int32_t btsx, esn;
 	caddr_t ptr;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	crp = (struct cryptop *) op;
 
@@ -586,8 +608,8 @@ esp_input_cb(void *op)
 	/* If authentication was performed, check now. */
 	if (esph != NULL) {
 		/*
-		 * If we have a tag, it means an IPsec-aware NIC did the verification
-		 * for us.
+		 * If we have a tag, it means an IPsec-aware NIC did the
+		 * verification for us.
 		 */
 		if (mtag == NULL) {
 			/* Copy the authenticator from the packet */
@@ -599,7 +621,10 @@ esp_input_cb(void *op)
 			/* Verify authenticator */
 			if (timingsafe_bcmp(ptr, aalg, esph->authsize)) {
 				free(tc, M_XDATA, 0);
-				DPRINTF(("esp_input_cb(): authentication failed for packet in SA %s/%08x\n", ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+				DPRINTF(("esp_input_cb(): authentication "
+				    "failed for packet in SA %s/%08x\n",
+				    ipsp_address(&tdb->tdb_dst, buf,
+				    sizeof(buf)), ntohl(tdb->tdb_spi)));
 				espstat.esps_badauth++;
 				error = EACCES;
 				goto baddone;
@@ -627,28 +652,32 @@ esp_input_cb(void *op)
 		case 1:
 			DPRINTF(("esp_input_cb(): replay counter wrapped"
 			    " for SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_wrap++;
 			error = EACCES;
 			goto baddone;
 		case 2:
 			DPRINTF(("esp_input_cb(): old packet received"
 			    " in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_replay++;
 			error = EACCES;
 			goto baddone;
 		case 3:
 			DPRINTF(("esp_input_cb(): duplicate packet received"
 			    " in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_replay++;
 			error = EACCES;
 			goto baddone;
 		default:
 			DPRINTF(("esp_input_cb(): bogus value from"
 			    " checkreplaywindow() in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_replay++;
 			error = EACCES;
 			goto baddone;
@@ -667,7 +696,8 @@ esp_input_cb(void *op)
 		espstat.esps_hdrops++;
 		splx(s);
 		DPRINTF(("esp_input_cb(): bad mbuf chain, SA %s/%08x\n",
-		    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		return EINVAL;
 	}
@@ -688,7 +718,7 @@ esp_input_cb(void *op)
 			/* Adjust the next mbuf by the remainder */
 			m_adj(m1->m_next, roff + hlen - m1->m_len);
 
-			/* The second mbuf is guaranteed not to have a pkthdr... */
+			/* The second mbuf is guaranteed not to have a pkthdr */
 			m->m_pkthdr.len -= (roff + hlen - m1->m_len);
 		}
 
@@ -722,7 +752,10 @@ esp_input_cb(void *op)
 	if (lastthree[1] + 2 > m->m_pkthdr.len - skip) {
 		espstat.esps_badilen++;
 		splx(s);
-		DPRINTF(("esp_input_cb(): invalid padding length %d for packet in SA %s/%08x\n", lastthree[1], ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		DPRINTF(("esp_input_cb(): invalid padding length %d for "
+		    "packet in SA %s/%08x\n", lastthree[1],
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		return EINVAL;
 	}
@@ -731,7 +764,9 @@ esp_input_cb(void *op)
 	if ((lastthree[1] != lastthree[0]) && (lastthree[1] != 0)) {
 		espstat.esps_badenc++;
 		splx(s);
-		DPRINTF(("esp_input(): decryption failed for packet in SA %s/%08x\n", ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		DPRINTF(("esp_input(): decryption failed for packet in "
+		    "SA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+		    sizeof(buf)), ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		return EINVAL;
 	}
@@ -773,7 +808,9 @@ esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 	struct tdb_crypto *tc;
 	unsigned char *pad;
 	u_int8_t prot;
-
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 	struct cryptodesc *crde = NULL, *crda = NULL;
 	struct cryptop *crp;
 #if NBPFILTER > 0
@@ -819,7 +856,8 @@ esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 		/* Check for IP maximum packet size violations. */
 		if (skip + hlen + rlen + padding + alen > IP_MAXPACKET)	{
 			DPRINTF(("esp_output(): packet in SA %s/%08x got "
-			    "too big\n", ipsp_address(tdb->tdb_dst),
+			    "too big\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)),
 			    ntohl(tdb->tdb_spi)));
 			m_freem(m);
 			espstat.esps_toobig++;
@@ -832,8 +870,8 @@ esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 		/* Check for IPv6 maximum packet size violations. */
 		if (skip + hlen + rlen + padding + alen > IPV6_MAXPACKET) {
 			DPRINTF(("esp_output(): packet in SA %s/%08x got too "
-			    "big\n", ipsp_address(tdb->tdb_dst),
-			    ntohl(tdb->tdb_spi)));
+			    "big\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			m_freem(m);
 			espstat.esps_toobig++;
 			return EMSGSIZE;
@@ -843,8 +881,9 @@ esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 
 	default:
 		DPRINTF(("esp_output(): unknown/unsupported protocol "
-		    "family %d, SA %s/%08x\n", tdb->tdb_dst.sa.sa_family
-		    , ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		    "family %d, SA %s/%08x\n", tdb->tdb_dst.sa.sa_family,
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		espstat.esps_nopf++;
 		return EPFNOSUPPORT;
@@ -887,7 +926,8 @@ esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 
 		if (n == NULL) {
 			DPRINTF(("esp_output(): bad mbuf chain, SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			espstat.esps_hdrops++;
 			m_freem(m);
 			return ENOBUFS;
@@ -905,8 +945,8 @@ esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 	mo = m_inject(m, skip, hlen, M_DONTWAIT);
 	if (mo == NULL) {
 		DPRINTF(("esp_output(): failed to inject ESP header for "
-		    "SA %s/%08x\n", ipsp_address(tdb->tdb_dst),
-		    ntohl(tdb->tdb_spi)));
+		    "SA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+		    sizeof(buf)), ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		espstat.esps_hdrops++;
 		return ENOBUFS;
@@ -930,7 +970,8 @@ esp_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int skip,
 	mo = m_inject(m, m->m_pkthdr.len, padding + alen, M_DONTWAIT);
 	if (mo == NULL) {
 		DPRINTF(("esp_output(): m_inject failed for SA %s/%08x\n",
-		    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		return ENOBUFS;
 	}
diff --git a/sys/netinet/ip_ipcomp.c b/sys/netinet/ip_ipcomp.c
index e9680c12ebb..8c75c7a34c3 100644
--- a/sys/netinet/ip_ipcomp.c
+++ b/sys/netinet/ip_ipcomp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ip_ipcomp.c,v 1.40 2015/03/14 03:38:52 jsg Exp $ */
+/* $OpenBSD: ip_ipcomp.c,v 1.41 2015/04/14 14:20:01 mikeb Exp $ */
 
 /*
  * Copyright (c) 2001 Jean-Jacques Bernard-Gundol (jj@wabbitt.org)
@@ -211,6 +211,9 @@ ipcomp_input_cb(op)
 	struct tdb *tdb;
 	struct ipcomp  *ipcomp;
 	caddr_t addr;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	crp = (struct cryptop *) op;
 
@@ -293,7 +296,8 @@ ipcomp_input_cb(op)
 	if (m1 == NULL) {
 		ipcompstat.ipcomps_hdrops++;
 		DPRINTF(("ipcomp_input_cb(): bad mbuf chain, IPCA %s/%08x\n",
-		    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi)));
 		error = EINVAL;
 		goto baddone;
 	}
@@ -377,6 +381,9 @@ ipcomp_output(m, tdb, mp, skip, protoff)
 	struct cryptop *crp;
 	struct tdb_crypto *tc;
 	struct mbuf    *mi, *mo;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 #if NBPFILTER > 0
 	struct ifnet *encif;
 
@@ -409,8 +416,9 @@ ipcomp_output(m, tdb, mp, skip, protoff)
 		 * worry
 		 */
 		if (m->m_pkthdr.len + hlen > IP_MAXPACKET) {
-			DPRINTF(("ipcomp_output(): packet in IPCA %s/%08x got too big\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			DPRINTF(("ipcomp_output(): packet in IPCA %s/%08x "
+			    "got too big\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			m_freem(m);
 			ipcompstat.ipcomps_toobig++;
 			return EMSGSIZE;
@@ -421,8 +429,9 @@ ipcomp_output(m, tdb, mp, skip, protoff)
 	case AF_INET6:
 		/* Check for IPv6 maximum packet size violations */
 		if (m->m_pkthdr.len + hlen > IPV6_MAXPACKET) {
-			DPRINTF(("ipcomp_output(): packet in IPCA %s/%08x got too big\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			DPRINTF(("ipcomp_output(): packet in IPCA %s/%08x "
+			    "got too big\n", ipsp_address(&tdb->tdb_dst, buf,
+			    sizeof(buf)), ntohl(tdb->tdb_spi)));
 			m_freem(m);
 			ipcompstat.ipcomps_toobig++;
 			return EMSGSIZE;
@@ -430,8 +439,9 @@ ipcomp_output(m, tdb, mp, skip, protoff)
 #endif /* INET6 */
 
 	default:
-		DPRINTF(("ipcomp_output(): unknown/unsupported protocol family %d, IPCA %s/%08x\n",
-		    tdb->tdb_dst.sa.sa_family, ipsp_address(tdb->tdb_dst),
+		DPRINTF(("ipcomp_output(): unknown/unsupported protocol "
+		    "family %d, IPCA %s/%08x\n", tdb->tdb_dst.sa.sa_family,
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
 		    ntohl(tdb->tdb_spi)));
 		m_freem(m);
 		ipcompstat.ipcomps_nopf++;
@@ -474,7 +484,8 @@ ipcomp_output(m, tdb, mp, skip, protoff)
 
 		if (n == NULL) {
 			DPRINTF(("ipcomp_output(): bad mbuf chain, IPCA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 			ipcompstat.ipcomps_hdrops++;
 			m_freem(m);
 			return ENOBUFS;
@@ -552,6 +563,9 @@ ipcomp_output_cb(cp)
 	struct ip6_hdr *ip6;
 #endif
 	struct ipcomp  *ipcomp;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	tc = (struct tdb_crypto *) crp->crp_opaque;
 	skip = tc->tc_skip;
@@ -610,8 +624,8 @@ ipcomp_output_cb(cp)
 	mo = m_inject(m, skip, IPCOMP_HLENGTH, M_DONTWAIT);
 	if (mo == NULL) {
 		DPRINTF(("ipcomp_output_cb(): failed to inject IPCOMP header "
-		    "for IPCA %s/%08x\n",
-		    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+		    "for IPCA %s/%08x\n", ipsp_address(&tdb->tdb_dst, buf,
+		     sizeof(buf)), ntohl(tdb->tdb_spi)));
 		ipcompstat.ipcomps_wrap++;
 		error = ENOBUFS;
 		goto baddone;
@@ -639,8 +653,8 @@ ipcomp_output_cb(cp)
 #endif
 	default:
 		DPRINTF(("ipcomp_output_cb(): unsupported protocol family %d, "
-		    "IPCA %s/%08x\n",
-		    tdb->tdb_dst.sa.sa_family, ipsp_address(tdb->tdb_dst),
+		    "IPCA %s/%08x\n", tdb->tdb_dst.sa.sa_family,
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
 		    ntohl(tdb->tdb_spi)));
 		ipcompstat.ipcomps_nopf++;
 		error = EPFNOSUPPORT;
diff --git a/sys/netinet/ip_ipip.c b/sys/netinet/ip_ipip.c
index 4128e3d3990..7f104257f66 100644
--- a/sys/netinet/ip_ipip.c
+++ b/sys/netinet/ip_ipip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ipip.c,v 1.57 2015/04/10 13:58:20 dlg Exp $ */
+/*	$OpenBSD: ip_ipip.c,v 1.58 2015/04/14 14:20:01 mikeb Exp $ */
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
@@ -391,6 +391,9 @@ ipip_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int dummy,
 #ifdef INET6
 	struct ip6_hdr *ip6, *ip6o;
 #endif /* INET6 */
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	/* XXX Deal with empty TDB source/destination addresses. */
 
@@ -405,7 +408,8 @@ ipip_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int dummy,
 
 			DPRINTF(("ipip_output(): unspecified tunnel endpoind "
 			    "address in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 
 			ipipstat.ipips_unspec++;
 			m_freem(m);
@@ -490,7 +494,8 @@ ipip_output(struct mbuf *m, struct tdb *tdb, struct mbuf **mp, int dummy,
 
 			DPRINTF(("ipip_output(): unspecified tunnel endpoind "
 			    "address in SA %s/%08x\n",
-			    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi)));
+			    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+			    ntohl(tdb->tdb_spi)));
 
 			ipipstat.ipips_unspec++;
 			m_freem(m);
diff --git a/sys/netinet/ip_ipsp.c b/sys/netinet/ip_ipsp.c
index 0cf6b7148aa..a6923459502 100644
--- a/sys/netinet/ip_ipsp.c
+++ b/sys/netinet/ip_ipsp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ipsp.c,v 1.209 2015/04/14 12:22:15 mikeb Exp $	*/
+/*	$OpenBSD: ip_ipsp.c,v 1.210 2015/04/14 14:20:01 mikeb Exp $	*/
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr),
@@ -845,6 +845,9 @@ tdb_init(struct tdb *tdbp, u_int16_t alg, struct ipsecinit *ii)
 {
 	struct xformsw *xsp;
 	int err;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	for (xsp = xformsw; xsp < xformswNXFORMSW; xsp++) {
 		if (xsp->xf_type == alg) {
@@ -854,8 +857,8 @@ tdb_init(struct tdb *tdbp, u_int16_t alg, struct ipsecinit *ii)
 	}
 
 	DPRINTF(("tdb_init(): no alg %d for spi %08x, addr %s, proto %d\n",
-	    alg, ntohl(tdbp->tdb_spi), ipsp_address(tdbp->tdb_dst),
-	    tdbp->tdb_sproto));
+	    alg, ntohl(tdbp->tdb_spi), ipsp_address(&tdbp->tdb_dst, buf,
+	    sizeof(buf)), tdbp->tdb_sproto));
 
 	return EINVAL;
 }
@@ -925,24 +928,17 @@ tdb_add_inp(struct tdb *tdb, struct inpcb *inp, int inout)
 #ifdef ENCDEBUG
 /* Return a printable string for the address. */
 const char *
-ipsp_address(union sockaddr_union sa)
+ipsp_address(union sockaddr_union *sa, char *buf, socklen_t size)
 {
-	static char ipspbuf[4][INET6_ADDRSTRLEN];
-	static int ipspround = 0;
-	char *buf;
-
-	ipspround = (ipspround + 1) % 4;
-	buf = ipspbuf[ipspround];
-
-	switch (sa.sa.sa_family) {
+	switch (sa->sa.sa_family) {
 	case AF_INET:
-		return inet_ntop(AF_INET, &sa.sin.sin_addr,
-		    buf, INET_ADDRSTRLEN);
+		return inet_ntop(AF_INET, &sa->sin.sin_addr,
+		    buf, (size_t)size);
 
 #ifdef INET6
 	case AF_INET6:
-		return inet_ntop(AF_INET6, &sa.sin6.sin6_addr,
-		    buf, INET6_ADDRSTRLEN);
+		return inet_ntop(AF_INET6, &sa->sin6.sin6_addr,
+		    buf, (size_t)size);
 #endif /* INET6 */
 
 	default:
diff --git a/sys/netinet/ip_ipsp.h b/sys/netinet/ip_ipsp.h
index 5c3e2665947..471ed45a1c9 100644
--- a/sys/netinet/ip_ipsp.h
+++ b/sys/netinet/ip_ipsp.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_ipsp.h,v 1.164 2015/04/14 12:22:15 mikeb Exp $	*/
+/*	$OpenBSD: ip_ipsp.h,v 1.165 2015/04/14 14:20:01 mikeb Exp $	*/
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr),
@@ -480,7 +480,7 @@ do {									\
 /* Misc. */
 uint8_t	get_sa_require(struct inpcb *);
 #ifdef ENCDEBUG
-const char *ipsp_address(union sockaddr_union);
+const char *ipsp_address(union sockaddr_union *, char *, socklen_t);
 #endif /* ENCDEBUG */
 
 /* TDB management routines */
diff --git a/sys/netinet/ipsec_input.c b/sys/netinet/ipsec_input.c
index 498c940bd33..5e05a3a3213 100644
--- a/sys/netinet/ipsec_input.c
+++ b/sys/netinet/ipsec_input.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ipsec_input.c,v 1.128 2015/04/10 13:58:20 dlg Exp $	*/
+/*	$OpenBSD: ipsec_input.c,v 1.129 2015/04/14 14:20:01 mikeb Exp $	*/
 /*
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
@@ -125,6 +125,9 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
 	u_int32_t spi;
 	u_int16_t cpi;
 	int s, error;
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
 
 	IPSEC_ISTAT(espstat.esps_input, ahstat.ahs_input,
 	    ipcompstat.ipcomps_input);
@@ -232,7 +235,7 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
 		splx(s);
 		DPRINTF(("ipsec_common_input(): could not find SA for "
 		    "packet to %s, spi %08x\n",
-		    ipsp_address(dst_address), ntohl(spi)));
+		    ipsp_address(&dst_address, buf, sizeof(buf)), ntohl(spi)));
 		m_freem(m);
 		IPSEC_ISTAT(espstat.esps_notdb, ahstat.ahs_notdb,
 		    ipcompstat.ipcomps_notdb);
@@ -241,7 +244,9 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
 
 	if (tdbp->tdb_flags & TDBF_INVALID) {
 		splx(s);
-		DPRINTF(("ipsec_common_input(): attempted to use invalid SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
+		DPRINTF(("ipsec_common_input(): attempted to use invalid "
+		    "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf,
+		    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
 		m_freem(m);
 		IPSEC_ISTAT(espstat.esps_invalid, ahstat.ahs_invalid,
 		    ipcompstat.ipcomps_invalid);
@@ -250,7 +255,9 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
 
 	if (udpencap && !(tdbp->tdb_flags & TDBF_UDPENCAP)) {
 		splx(s);
-		DPRINTF(("ipsec_common_input(): attempted to use non-udpencap SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
+		DPRINTF(("ipsec_common_input(): attempted to use non-udpencap "
+		    "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf,
+		    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
 		m_freem(m);
 		espstat.esps_udpinval++;
 		return EINVAL;
@@ -258,7 +265,9 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
 
 	if (tdbp->tdb_xform == NULL) {
 		splx(s);
-		DPRINTF(("ipsec_common_input(): attempted to use uninitialized SA %s/%08x/%u\n", ipsp_address(dst_address), ntohl(spi), tdbp->tdb_sproto));
+		DPRINTF(("ipsec_common_input(): attempted to use uninitialized "
+		    "SA %s/%08x/%u\n", ipsp_address(&dst_address, buf,
+		    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
 		m_freem(m);
 		IPSEC_ISTAT(espstat.esps_noxform, ahstat.ahs_noxform,
 		    ipcompstat.ipcomps_noxform);
@@ -271,8 +280,8 @@ ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto,
 			splx(s);
 			DPRINTF(("ipsec_common_input(): "
 			    "no enc%u interface for SA %s/%08x/%u\n",
-			    tdbp->tdb_tap, ipsp_address(dst_address),
-			    ntohl(spi), tdbp->tdb_sproto));
+			    tdbp->tdb_tap, ipsp_address(&dst_address, buf,
+			    sizeof(buf)), ntohl(spi), tdbp->tdb_sproto));
 			m_freem(m);
 
 			IPSEC_ISTAT(espstat.esps_pdrops,
@@ -332,6 +341,10 @@ ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff,
 	struct m_tag *mtag;
 	struct tdb_ident *tdbi;
 
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
+
 	af = tdbp->tdb_dst.sa.sa_family;
 	sproto = tdbp->tdb_sproto;
 
@@ -349,8 +362,8 @@ ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff,
 	if (af == AF_INET) {
 		if ((m->m_len < skip) && ((m = m_pullup(m, skip)) == NULL)) {
 			DPRINTF(("ipsec_common_input_cb(): processing failed "
-			    "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst),
-			    ntohl(tdbp->tdb_spi)));
+			    "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst,
+			    buf, sizeof(buf)), ntohl(tdbp->tdb_spi)));
 			IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
 			    ipcompstat.ipcomps_hdrops);
 			return ENOBUFS;
@@ -401,8 +414,8 @@ ipsec_common_input_cb(struct mbuf *m, struct tdb *tdbp, int skip, int protoff,
 		    (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
 
 			DPRINTF(("ipsec_common_input_cb(): processing failed "
-			    "for SA %s/%08x\n", ipsp_address(tdbp->tdb_dst),
-			    ntohl(tdbp->tdb_spi)));
+			    "for SA %s/%08x\n", ipsp_address(&tdbp->tdb_dst,
+			    buf, sizeof(buf)), ntohl(tdbp->tdb_spi)));
 
 			IPSEC_ISTAT(espstat.esps_hdrops, ahstat.ahs_hdrops,
 			    ipcompstat.ipcomps_hdrops);
@@ -856,7 +869,7 @@ ipsec_common_ctlinput(u_int rdomain, int cmd, struct sockaddr *sa,
 			tdbp->tdb_mtutimeout = time_second +
 			    ip_mtudisc_timeout;
 			DPRINTF(("ipsec_common_ctlinput: "
-			    "spi %08x mtu %d adjust %d\n",
+			    "spi %08x mtu %d adjust %ld\n",
 			    ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
 			    adjust));
 		}
@@ -915,7 +928,7 @@ udpencap_ctlinput(int cmd, struct sockaddr *sa, u_int rdomain, void *v)
 				tdbp->tdb_mtutimeout = time_second +
 				    ip_mtudisc_timeout;
 				DPRINTF(("udpencap_ctlinput: "
-				    "spi %08x mtu %d adjust %d\n",
+				    "spi %08x mtu %d adjust %ld\n",
 				    ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
 				    adjust));
 			}
diff --git a/sys/netinet/ipsec_output.c b/sys/netinet/ipsec_output.c
index 95717a3627b..2814ec0327a 100644
--- a/sys/netinet/ipsec_output.c
+++ b/sys/netinet/ipsec_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ipsec_output.c,v 1.56 2015/01/24 00:29:06 deraadt Exp $ */
+/*	$OpenBSD: ipsec_output.c,v 1.57 2015/04/14 14:20:01 mikeb Exp $ */
 /*
  * The author of this code is Angelos D. Keromytis (angelos@cis.upenn.edu)
  *
@@ -80,6 +80,10 @@ ipsp_process_packet(struct mbuf *m, struct tdb *tdb, int af, int tunalready)
 	struct ip6_hdr *ip6;
 #endif /* INET6 */
 
+#ifdef ENCDEBUG
+	char buf[INET6_ADDRSTRLEN];
+#endif
+
 	/* Check that the transform is allowed by the administrator. */
 	if ((tdb->tdb_sproto == IPPROTO_ESP && !esp_enable) ||
 	    (tdb->tdb_sproto == IPPROTO_AH && !ah_enable) ||
@@ -100,8 +104,8 @@ ipsp_process_packet(struct mbuf *m, struct tdb *tdb, int af, int tunalready)
 	/* Check if the SPI is invalid. */
 	if (tdb->tdb_flags & TDBF_INVALID) {
 		DPRINTF(("ipsp_process_packet(): attempt to use invalid "
-		    "SA %s/%08x/%u\n", ipsp_address(tdb->tdb_dst),
-		    ntohl(tdb->tdb_spi), tdb->tdb_sproto));
+		    "SA %s/%08x/%u\n", ipsp_address(&tdb->tdb_dst, buf,
+		    sizeof(buf)), ntohl(tdb->tdb_spi), tdb->tdb_sproto));
 		m_freem(m);
 		return ENXIO;
 	}
@@ -119,8 +123,9 @@ ipsp_process_packet(struct mbuf *m, struct tdb *tdb, int af, int tunalready)
 	default:
 		DPRINTF(("ipsp_process_packet(): attempt to use "
 		    "SA %s/%08x/%u for protocol family %d\n",
-		    ipsp_address(tdb->tdb_dst), ntohl(tdb->tdb_spi),
-		    tdb->tdb_sproto, tdb->tdb_dst.sa.sa_family));
+		    ipsp_address(&tdb->tdb_dst, buf, sizeof(buf)),
+		    ntohl(tdb->tdb_spi), tdb->tdb_sproto,
+		    tdb->tdb_dst.sa.sa_family));
 		m_freem(m);
 		return ENXIO;
 	}
@@ -576,7 +581,7 @@ ipsec_adjust_mtu(struct mbuf *m, u_int32_t mtu)
 		tdbp->tdb_mtu = mtu;
 		tdbp->tdb_mtutimeout = time_second + ip_mtudisc_timeout;
 		DPRINTF(("ipsec_adjust_mtu: "
-		    "spi %08x mtu %d adjust %d mbuf %p\n",
+		    "spi %08x mtu %d adjust %ld mbuf %p\n",
 		    ntohl(tdbp->tdb_spi), tdbp->tdb_mtu,
 		    adjust, m));
 	}