From 2c64a07a657e7e879037f0ecfc7ca39233c8c33a Mon Sep 17 00:00:00 2001
From: Seth Mos <seth.mos@xs4all.nl>
Date: Fri, 16 Jan 2009 08:28:27 +0000
Subject: [PATCH] Make sure we match the right SPI to src and dst address,
 otherwise the purge of the old spi fails.

---
 etc/inc/vpn.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 2cd4043754..30bcc1bf73 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -1260,10 +1260,10 @@ function reload_tunnel_spd_policy($tunnel, $oldtunnel) {
 	/* zap any existing SA entries beforehand */
 	foreach($sad_arr as $sad) {
 		if(($sad['dst'] == $ep) && ($sad['src'] == $rgip)) {
-			$spdconf .= "delete {$ep} {$rgip} {$tunnel['p2']['protocol']} 0x{$sad['spi']};\n";
+			$spdconf .= "delete {$rgip} {$ep} {$tunnel['p2']['protocol']} 0x{$sad['spi']};\n";
 		}
 		if(($sad['src'] == $ep) && ($sad['dst'] == $rgip)) {
-			$spdconf .= "delete {$rgip} {$ep} {$tunnel['p2']['protocol']} 0x{$sad['spi']};\n";
+			$spdconf .= "delete {$ep} {$rgip} {$tunnel['p2']['protocol']} 0x{$sad['spi']};\n";
 		}
 	}
 	/* add new SPD policies to replace them */