From 4cd176d525fbf20159e22d7cd4baeeb0c2e7ad1b Mon Sep 17 00:00:00 2001
From: Martin Willi <martin@revosec.ch>
Date: Wed, 29 Feb 2012 10:10:45 +0100
Subject: [PATCH] Invoke ike_updown hook on authentication failure not before
 response sent

---
 src/libcharon/sa/task_manager.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/libcharon/sa/task_manager.c b/src/libcharon/sa/task_manager.c
index 7cdcf7052..77d36f975 100644
--- a/src/libcharon/sa/task_manager.c
+++ b/src/libcharon/sa/task_manager.c
@@ -641,11 +641,9 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
 												   enumerator);
 				}
 				break;
+			case DESTROY_ME:
 			case FAILED:
 			default:
-				charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
-				/* FALL */
-			case DESTROY_ME:
 				/* destroy IKE_SA, but SEND response first */
 				delete = TRUE;
 				break;
@@ -680,6 +678,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
 						 this->responding.packet->clone(this->responding.packet));
 	if (delete)
 	{
+		charon->bus->ike_updown(charon->bus, this->ike_sa, FALSE);
 		return DESTROY_ME;
 	}
 	return SUCCESS;