4 files changed, 50 insertions, 30 deletions

diff --git a/src/libcharon/plugins/ha/ha_attribute.c b/src/libcharon/plugins/ha/ha_attribute.c
index 64bd2b8b7..f18c58b6a 100644
--- a/src/libcharon/plugins/ha/ha_attribute.c
+++ b/src/libcharon/plugins/ha/ha_attribute.c
@@ -181,6 +181,12 @@ METHOD(attribute_provider_t, acquire_address, host_t*,
 	pool = get_pool(this, name);
 	if (pool)
 	{
+		if (pool->base->get_family(pool->base) !=
+			requested->get_family(requested))
+		{
+			this->mutex->unlock(this->mutex);
+			return NULL;
+		}
 		for (byte = 0; byte < pool->size / 8; byte++)
 		{
 			if (pool->mask[byte] != 0xFF)
diff --git a/src/libcharon/plugins/ha/ha_dispatcher.c b/src/libcharon/plugins/ha/ha_dispatcher.c
index 8b6ec9180..f07b4ea21 100644
--- a/src/libcharon/plugins/ha/ha_dispatcher.c
+++ b/src/libcharon/plugins/ha/ha_dispatcher.c
@@ -344,10 +344,10 @@ static void process_ike_update(private_ha_dispatcher_t *this,
 				ike_sa->set_other_host(ike_sa, value.host->clone(value.host));
 				break;
 			case HA_LOCAL_VIP:
-				ike_sa->set_virtual_ip(ike_sa, TRUE, value.host);
+				ike_sa->add_virtual_ip(ike_sa, TRUE, value.host);
 				break;
 			case HA_REMOTE_VIP:
-				ike_sa->set_virtual_ip(ike_sa, FALSE, value.host);
+				ike_sa->add_virtual_ip(ike_sa, FALSE, value.host);
 				received_vip = TRUE;
 				break;
 			case HA_PEER_ADDR:
@@ -413,18 +413,24 @@ static void process_ike_update(private_ha_dispatcher_t *this,
 		}
 		if (received_vip)
 		{
+			enumerator_t *pools, *vips;
 			host_t *vip;
 			char *pool;
 
 			peer_cfg = ike_sa->get_peer_cfg(ike_sa);
-			vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
-			if (peer_cfg && vip)
+			if (peer_cfg)
 			{
-				pool = peer_cfg->get_pool(peer_cfg);
-				if (pool)
+				pools = peer_cfg->create_pool_enumerator(peer_cfg);
+				while (pools->enumerate(pools, &pool))
 				{
-					this->attr->reserve(this->attr, pool, vip);
+					vips = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
+					while (vips->enumerate(vips, &vip))
+					{
+						this->attr->reserve(this->attr, pool, vip);
+					}
+					vips->destroy(vips);
 				}
+				pools->destroy(pools);
 			}
 		}
 		if (ike_sa->get_version(ike_sa) == IKEV1)
diff --git a/src/libcharon/plugins/ha/ha_ike.c b/src/libcharon/plugins/ha/ha_ike.c
index d523e8919..442a3a23d 100644
--- a/src/libcharon/plugins/ha/ha_ike.c
+++ b/src/libcharon/plugins/ha/ha_ike.c
@@ -241,6 +241,34 @@ METHOD(listener_t, ike_state_change, bool,
 	return TRUE;
 }
 
+/**
+ * Send a virtual IP sync message for remote VIPs
+ */
+static void sync_vips(private_ha_ike_t *this, ike_sa_t *ike_sa)
+{
+	ha_message_t *m = NULL;
+	enumerator_t *enumerator;
+	host_t *vip;
+
+	enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, FALSE);
+	while (enumerator->enumerate(enumerator, &vip))
+	{
+		if (!m)
+		{
+			m = ha_message_create(HA_IKE_UPDATE);
+			m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
+		}
+		m->add_attribute(m, HA_REMOTE_VIP, vip);
+	}
+	enumerator->destroy(enumerator);
+
+	if (m)
+	{
+		this->socket->push(this->socket, m);
+		this->cache->cache(this->cache, ike_sa, m);
+	}
+}
+
 METHOD(listener_t, message_hook, bool,
 	private_ha_ike_t *this, ike_sa_t *ike_sa, message_t *message,
 	bool incoming, bool plain)
@@ -276,18 +304,7 @@ METHOD(listener_t, message_hook, bool,
 		{	/* After IKE_SA has been established, sync peers virtual IP.
 			 * We cannot sync it in the state_change hook, it is installed later.
 			 * TODO: where to sync local VIP? */
-			ha_message_t *m;
-			host_t *vip;
-
-			vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
-			if (vip)
-			{
-				m = ha_message_create(HA_IKE_UPDATE);
-				m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
-				m->add_attribute(m, HA_REMOTE_VIP, vip);
-				this->socket->push(this->socket, m);
-				this->cache->cache(this->cache, ike_sa, m);
-			}
+			sync_vips(this, ike_sa);
 		}
 	}
 	if (!plain && ike_sa->get_version(ike_sa) == IKEV1)
@@ -296,7 +313,6 @@ METHOD(listener_t, message_hook, bool,
 		keymat_v1_t *keymat;
 		u_int32_t mid;
 		chunk_t iv;
-		host_t *vip;
 
 		mid = message->get_message_id(message);
 		if (mid == 0)
@@ -313,15 +329,7 @@ METHOD(listener_t, message_hook, bool,
 		}
 		if (!incoming && message->get_exchange_type(message) == TRANSACTION)
 		{
-			vip = ike_sa->get_virtual_ip(ike_sa, FALSE);
-			if (vip)
-			{
-				m = ha_message_create(HA_IKE_UPDATE);
-				m->add_attribute(m, HA_IKE_ID, ike_sa->get_id(ike_sa));
-				m->add_attribute(m, HA_REMOTE_VIP, vip);
-				this->socket->push(this->socket, m);
-				this->cache->cache(this->cache, ike_sa, m);
-			}
+			sync_vips(this, ike_sa);
 		}
 	}
 	if (plain && ike_sa->get_version(ike_sa) == IKEV1 &&
diff --git a/src/libcharon/plugins/ha/ha_tunnel.c b/src/libcharon/plugins/ha/ha_tunnel.c
index ad458caad..541dd9313 100644
--- a/src/libcharon/plugins/ha/ha_tunnel.c
+++ b/src/libcharon/plugins/ha/ha_tunnel.c
@@ -209,7 +209,7 @@ static void setup_tunnel(private_ha_tunnel_t *this,
 	ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
 	peer_cfg = peer_cfg_create("ha", IKEV2, ike_cfg, CERT_NEVER_SEND,
 						UNIQUE_KEEP, 0, 86400, 0, 7200, 3600, FALSE, FALSE, 30,
-						0, NULL, NULL, FALSE, NULL, NULL);
+						0, FALSE, NULL, NULL);
 
 	auth_cfg = auth_cfg_create();
 	auth_cfg->add(auth_cfg, AUTH_RULE_AUTH_CLASS, AUTH_CLASS_PSK);