int flag = 0;
ipsec_handle_leftover_payload (struct message *msg, u_int8_t type,			       struct payload *payload){  struct sockaddr *dst;  socklen_t dstlen;  struct sa *sa;  int flag = 0;  /* So far, the only thing we handle is an INITIAL-CONTACT NOTIFY.  */  switch (type)    {    case ISAKMP_PAYLOAD_NOTIFY:      switch (GET_ISAKMP_NOTIFY_MSG_TYPE (payload->p))	{	case IPSEC_NOTIFY_INITIAL_CONTACT:	  /*	   * Find out who is sending this and then delete every SA that is	   * ready.  Exchanges will timeout themselves and then the	   * non-ready SAs will disappear too.	   */	  msg->transport->vtbl->get_dst (msg->transport, &dst, &dstlen);	  while ((sa = sa_lookup_by_peer (dst, dstlen)) != 0)	    {	      /*	       * Don't delete the current SA -- we received the notification	       * over it, so it's obviously still active. We temporarily need               * to remove the SA from the list to avoid an endless loop.	       */	      if (sa == msg->isakmp_sa)	        {                  LIST_REMOVE (sa, link);                  flag = 1;		  continue;		}	      LOG_DBG ((LOG_SA, 30,			"ipsec_handle_leftover_payload: "			"INITIAL-CONTACT made us delete SA %p",			sa));	      sa_delete (sa, 0);	    }          if (flag)            sa_enter (msg->isakmp_sa);	  payload->flags |= PL_MARK;	  return 0;	  break;	}    }  return -1;}