ipvsadm: restrict different address family

Now real server can have different address family only
for tunneling. For other modes it must match the service.

Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>

1 files changed, 6 insertions, 0 deletions

diff --git a/ipvsadm.c b/ipvsadm.c
index d12070e..3000117 100644
--- a/ipvsadm.c
+++ b/ipvsadm.c
@@ -788,6 +788,12 @@ static int process_options(int argc, char **argv, int reading_stdin)
 		    (ce.dest.conn_flags == IP_VS_CONN_F_TUNNEL
 		     || ce.dest.conn_flags == IP_VS_CONN_F_DROUTE))
 			ce.dest.port = ce.svc.port;
+
+		/* Tunneling allows different address family */
+		if (ce.dest.af != ce.svc.af &&
+		    ce.dest.conn_flags != IP_VS_CONN_F_TUNNEL)
+			fail(2, "Different address family is allowed only "
+			     "for tunneling servers");
 	}
 
 	switch (ce.cmd) {