From 7ee306b6bcf1d8762416392a01a440aa8c210081 Mon Sep 17 00:00:00 2001
From: Hakan Olsson <ho@cvs.openbsd.org>
Date: Fri, 7 Jun 2002 04:56:14 +0000
Subject: This should solve PR#2729.

---
 sbin/isakmpd/ipsec.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/sbin/isakmpd/ipsec.c b/sbin/isakmpd/ipsec.c
index 13cc462b22f..d539f1cff9f 100644
--- a/sbin/isakmpd/ipsec.c
+++ b/sbin/isakmpd/ipsec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ipsec.c,v 1.65 2002/06/01 07:44:21 deraadt Exp $	*/
+/*	$OpenBSD: ipsec.c,v 1.66 2002/06/07 04:56:13 ho Exp $	*/
 /*	$EOM: ipsec.c,v 1.143 2000/12/11 23:57:42 niklas Exp $	*/
 
 /*
@@ -325,22 +325,6 @@ ipsec_finalize_exchange (struct message *msg)
 	  for (sa = TAILQ_FIRST (&exchange->sa_list); sa;
 	       sa = TAILQ_NEXT (sa, next))
 	    {
-	      for (proto = TAILQ_FIRST (&sa->protos), last_proto = 0; proto;
-		   proto = TAILQ_NEXT (proto, link))
-		{
-		  if (sysdep_ipsec_set_spi (sa, proto, 0, isakmp_sa)
-		      || (last_proto
-			  && sysdep_ipsec_group_spis (sa, last_proto, proto,
-						      0))
-		      || sysdep_ipsec_set_spi (sa, proto, 1, isakmp_sa)
-		      || (last_proto
-			  && sysdep_ipsec_group_spis (sa, last_proto, proto,
-						      1)))
-		    /* XXX Tear down this exchange.  */
-		    return;
-		  last_proto = proto;
-		}
-
 	      isa = sa->data;
 
 	      if (exchange->initiator)
@@ -364,6 +348,22 @@ ipsec_finalize_exchange (struct message *msg)
 		    }
 		}
 
+	      for (proto = TAILQ_FIRST (&sa->protos), last_proto = 0; proto;
+		   proto = TAILQ_NEXT (proto, link))
+		{
+		  if (sysdep_ipsec_set_spi (sa, proto, 0, isakmp_sa)
+		      || (last_proto
+			  && sysdep_ipsec_group_spis (sa, last_proto, proto,
+						      0))
+		      || sysdep_ipsec_set_spi (sa, proto, 1, isakmp_sa)
+		      || (last_proto
+			  && sysdep_ipsec_group_spis (sa, last_proto, proto,
+						      1)))
+		    /* XXX Tear down this exchange.  */
+		    return;
+		  last_proto = proto;
+		}
+
 #ifdef USE_DEBUG
 	      if (sockaddr2text (isa->src_net, &addr1, 0))
 		addr1 = 0;
-- 
cgit v1.2.3