diff options
| author | kp <kp@FreeBSD.org> | 2016-08-19 11:31:30 +0000 |
|---|---|---|
| committer | kp <kp@FreeBSD.org> | 2016-08-19 11:31:30 +0000 |
| commit | db4376841c9b776b8b5fc1f182a7d264596775d8 (patch) | |
| tree | f552949f9ba2afe5081ab3f0403beaaada0986ba /sys/netpfil | |
| parent | 615cc359491e49a6c377ee5033e3ef4e5865b8c9 (diff) | |
| download | FreeBSD-src-db4376841c9b776b8b5fc1f182a7d264596775d8.zip FreeBSD-src-db4376841c9b776b8b5fc1f182a7d264596775d8.tar.gz | |
MFC r304152:
pf: Add missing byte-order swap to pf_match_addr_range
Without this, rules using address ranges (e.g. "10.1.1.1 - 10.1.1.5") did not
match addresses correctly on little-endian systems.
PR: 211796
Obtained from: OpenBSD (sthen)
Diffstat (limited to 'sys/netpfil')
| -rw-r--r-- | sys/netpfil/pf/pf.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/sys/netpfil/pf/pf.c b/sys/netpfil/pf/pf.c index 0efc396..2d32b7a 100644 --- a/sys/netpfil/pf/pf.c +++ b/sys/netpfil/pf/pf.c @@ -2600,8 +2600,8 @@ pf_match_addr_range(struct pf_addr *b, struct pf_addr *e, switch (af) { #ifdef INET case AF_INET: - if ((a->addr32[0] < b->addr32[0]) || - (a->addr32[0] > e->addr32[0])) + if ((ntohl(a->addr32[0]) < ntohl(b->addr32[0])) || + (ntohl(a->addr32[0]) > ntohl(e->addr32[0]))) return (0); break; #endif /* INET */ @@ -2611,15 +2611,15 @@ pf_match_addr_range(struct pf_addr *b, struct pf_addr *e, /* check a >= b */ for (i = 0; i < 4; ++i) - if (a->addr32[i] > b->addr32[i]) + if (ntohl(a->addr32[i]) > ntohl(b->addr32[i])) break; - else if (a->addr32[i] < b->addr32[i]) + else if (ntohl(a->addr32[i]) < ntohl(b->addr32[i])) return (0); /* check a <= e */ for (i = 0; i < 4; ++i) - if (a->addr32[i] < e->addr32[i]) + if (ntohl(a->addr32[i]) < ntohl(e->addr32[i])) break; - else if (a->addr32[i] > e->addr32[i]) + else if (ntohl(a->addr32[i]) > ntohl(e->addr32[i])) return (0); break; } |
