Date: Mon, 03 Aug 2026 16:02:24 +0000 Message-ID: <6a70bb90.3ef6d.21170ce2@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=d13dffa150d17dc239e164ea42ddab91e6fab466 commit d13dffa150d17dc239e164ea42ddab91e6fab466 Author: Kristof Provost <kp@FreeBSD.org> AuthorDate: 2026-07-21 13:03:24 +0000 Commit: Kristof Provost <kp@FreeBSD.org> CommitDate: 2026-08-03 16:00:04 +0000 pf: fix securelevel off-by-one cmd_securelevel is the securelevel at which the call should be denied. pf (write) calls should be denied at level 3 or up (not at 2 or up as it was), so increment these all by one. PR: 296838 MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D58377 --- sys/netpfil/pf/pf_nl.c | 94 +++++++++++++++++++++++++------------------------- 1 file changed, 47 insertions(+), 47 deletions(-) diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index 0e1c77864615..200f1dfca81a 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2916,7 +2916,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getstates, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GETCREATORS, @@ -2924,7 +2924,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getcreators, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_START, @@ -2932,7 +2932,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_start, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_STOP, @@ -2940,7 +2940,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_stop, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_ADDRULE, @@ -2948,7 +2948,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_addrule, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GETRULES, @@ -2956,7 +2956,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getrules, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GETRULE, @@ -2964,7 +2964,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getrule, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLRSTATES, @@ -2972,7 +2972,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_states, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_KILLSTATES, @@ -2980,7 +2980,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_kill_states, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_SET_STATUSIF, @@ -2988,7 +2988,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_statusif, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_STATUS, @@ -2996,7 +2996,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_status, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLEAR_STATUS, @@ -3004,7 +3004,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_status, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_NATLOOK, @@ -3012,7 +3012,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_natlook, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SET_DEBUG, @@ -3020,7 +3020,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_debug, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_SET_TIMEOUT, @@ -3028,7 +3028,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_timeout, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_TIMEOUT, @@ -3036,7 +3036,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_timeout, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SET_LIMIT, @@ -3044,7 +3044,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_limit, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_LIMIT, @@ -3052,7 +3052,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_limit, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_BEGIN_ADDRS, @@ -3060,7 +3060,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_begin_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_ADD_ADDR, @@ -3068,7 +3068,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_add_addr, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_ADDRS, @@ -3076,7 +3076,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_addrs, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_ADDR, @@ -3084,7 +3084,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_addr, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_RULESETS, @@ -3092,7 +3092,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_rulesets, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_RULESET, @@ -3100,7 +3100,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_ruleset, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_SRCNODES, @@ -3108,7 +3108,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_srcnodes, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLEAR_TABLES, @@ -3116,7 +3116,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_tables, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_ADD_TABLE, @@ -3124,7 +3124,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_add_table, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_DEL_TABLE, @@ -3132,7 +3132,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_del_table, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_TSTATS, @@ -3140,7 +3140,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_tstats, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLR_TSTATS, @@ -3148,7 +3148,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_tstats, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLR_ADDRS, @@ -3156,7 +3156,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_ADD_ADDR, @@ -3164,7 +3164,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_add_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_DEL_ADDR, @@ -3172,7 +3172,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_del_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_SET_ADDR, @@ -3180,7 +3180,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_set_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_GET_ADDR, @@ -3188,7 +3188,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_get_addrs, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_GET_ASTATS, @@ -3196,7 +3196,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_get_astats, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_CLEAR_ASTATS, @@ -3204,7 +3204,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_clear_astats, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_STATE_LIMITER_ADD, @@ -3212,7 +3212,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_state_limiter_add, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_STATE_LIMITER_GET, @@ -3220,7 +3220,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_state_limiter_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_STATE_LIMITER_NGET, @@ -3228,7 +3228,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_state_limiter_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_LIMITER_ADD, @@ -3236,7 +3236,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_limiter_add, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_SOURCE_LIMITER_GET, @@ -3244,7 +3244,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_limiter_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_LIMITER_NGET, @@ -3252,7 +3252,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_limiter_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_GET, @@ -3260,7 +3260,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_NGET, @@ -3268,7 +3268,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_get, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SOURCE_CLEAR, @@ -3276,7 +3276,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_source_clear, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_TEST_ADDRS, @@ -3284,7 +3284,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_test_addrs, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, };home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a70bb90.3ef6d.21170ce2>