svn commit: r304463 - stable/10/sys/netpfil/pf

[Kristof Provost]

Author: kp
Date: Fri Aug 19 11:36:00 2016
New Revision: 304463
URL: https://svnweb.freebsd.org/changeset/base/304463

Log:
  MFC r304152:
  
  pf: Add missing byte-order swap to pf_match_addr_range
  
  Without this, rules using address ranges (e.g. "10.1.1.1 - 10.1.1.5") did not
  match addresses correctly on little-endian systems.
  
  PR:       211796
  Obtained from:    OpenBSD (sthen)

Modified:
  stable/10/sys/netpfil/pf/pf.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netpfil/pf/pf.c
==============================================================================
--- stable/10/sys/netpfil/pf/pf.c	Fri Aug 19 11:31:30 2016	(r304462)
+++ stable/10/sys/netpfil/pf/pf.c	Fri Aug 19 11:36:00 2016	(r304463)
@@ -2564,8 +2564,8 @@ pf_match_addr_range(struct pf_addr *b, s
 	switch (af) {
 #ifdef INET
 	case AF_INET:
-		if ((a->addr32[0] < b->addr32[0]) ||
-		    (a->addr32[0] > e->addr32[0]))
+		if ((ntohl(a->addr32[0]) < ntohl(b->addr32[0])) ||
+		    (ntohl(a->addr32[0]) > ntohl(e->addr32[0])))
 			return (0);
 		break;
 #endif /* INET */
@@ -2575,15 +2575,15 @@ pf_match_addr_range(struct pf_addr *b, s
 
 		/* check a >= b */
 		for (i = 0; i < 4; ++i)
-			if (a->addr32[i] > b->addr32[i])
+			if (ntohl(a->addr32[i]) > ntohl(b->addr32[i]))
 				break;
-			else if (a->addr32[i] < b->addr32[i])
+			else if (ntohl(a->addr32[i]) < ntohl(b->addr32[i]))
 				return (0);
 		/* check a <= e */
 		for (i = 0; i < 4; ++i)
-			if (a->addr32[i] < e->addr32[i])
+			if (ntohl(a->addr32[i]) < ntohl(e->addr32[i]))
 				break;
-			else if (a->addr32[i] > e->addr32[i])
+			else if (ntohl(a->addr32[i]) > ntohl(e->addr32[i]))
 				return (0);
 		break;
 	}