Commit 4d2d665d3d for strongswan.org

commit 4d2d665d3d0144ab05c777a1ea760aa07d3b0764
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Tue Nov 3 19:33:19 2026 +0100

    ha: Don't sync VIPs with a separate message for IKEv2

    Since 5ce1c91b58a2 ("ikev2: Trigger ike_updown() event after all
    IKE-specific tasks ran"), the event is triggered after the virtual
    IPs have been assigned, so we don't need that separate message anymore.

    This also fixes reintegrating a node after an IKE SA has been rekeyed
    as the new SA (and pool) would otherwise miss the VIPs.

    Closes strongswan/strongswan#3197

diff --git a/src/libcharon/plugins/ha/ha_ike.c b/src/libcharon/plugins/ha/ha_ike.c
index 56c79a7b06..df0ad25d9a 100644
--- a/src/libcharon/plugins/ha/ha_ike.c
+++ b/src/libcharon/plugins/ha/ha_ike.c
@@ -223,6 +223,12 @@ METHOD(listener_t, ike_updown, bool,
 			m->add_attribute(m, HA_PEER_ADDR, addr);
 		}
 		enumerator->destroy(enumerator);
+		enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
+		while (enumerator->enumerate(enumerator, &addr))
+		{
+			m->add_attribute(m, HA_REMOTE_VIP, addr);
+		}
+		enumerator->destroy(enumerator);
 	}
 	else
 	{
@@ -268,7 +274,7 @@ METHOD(listener_t, ike_state_change, bool,
 }

 /**
- * Send a virtual IP sync message for remote VIPs
+ * Send a virtual IP sync message for remote VIPs (IKEv1 only)
  */
 static void sync_vips(private_ha_ike_t *this, ike_sa_t *ike_sa)
 {
@@ -324,14 +330,6 @@ METHOD(listener_t, message_hook, bool,
 			this->socket->push(this->socket, m);
 			this->cache->cache(this->cache, ike_sa, m);
 		}
-		if (ike_sa->get_state(ike_sa) == IKE_ESTABLISHED &&
-			message->get_exchange_type(message) == IKE_AUTH &&
-			!message->get_request(message))
-		{	/* After IKE_SA has been established, sync peers virtual IP.
-			 * We cannot sync it in the state_change hook, it is installed later.
-			 * TODO: where to sync local VIP? */
-			sync_vips(this, ike_sa);
-		}
 	}
 	if (ike_sa->get_version(ike_sa) == IKEV1)
 	{