From nobody Tue Apr 28 16:05:09 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4g4ldL2GqLz6bhh7 for ; Tue, 28 Apr 2026 16:05:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4g4ldK6W2nz3QGH for ; Tue, 28 Apr 2026 16:05:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777392309; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qRtpy722JSowpXYTo05tBmCw4nfrEwgWGIeGpfsDYyI=; b=TMC5Yq9R+vnbOVG95tQ7IZjR8ezIEPvVhoOY0P4zOPnDvTNJ09xbfvE7KmVyJ+UqSPvvL7 ugwJoGDV2GBbiMGySJl8p8uHMy8fNTdcg3JX5APtG3dv3b+apgI9mfs+2r5X1wzlohkI5J Ic3iiBC3++8B6ypnarZXLZEJKrYohm1hZM8eOhkpVQ8FAOSdbqLvTIUWpPGakyEo+vZBuL Q/nb67ZXJCv7VNwcreI0t0IT9ZLiekK3Ft22VSOC2HqeFF8CU2Tm++5GXMmLPxm7jHeN1u yV7RzDe5sTFqhXWWGHHVVcDVWJ+yHhP48iLCMFALnfeswp7wvyMi3akT9SsbqA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1777392309; a=rsa-sha256; cv=none; b=Ka4cyLkFg96e73aEOrPF1/u3hQRBNmMkGTKUtidsUOVRpcrLCSsDgE2GuvEnuyqiJ5g11r EcO8VRJ4SjBnWHDghn0e7Varon9/naMqxbRc1XBZsBrVowP19pKko1oBxQuk3a1iPJZPIZ 8ufezaMlf0+++hOCRdGdkmfiNJgabhQoX38bUzhixXhPKE07+KfjdMdxyls/isxNzwAEMw jgJ+83mZl+q+D5lj/Ln3ySiGBS0AtXBOrX6CRrnuoDlPWqkhclPRUHPgHH4lu/GF2vPzeK 4gRoZ9JCwX++tvyg+pDcFRe7FYG3xIz2y/bSuIVu5S64u7r5DCDMw1kU7ODJRA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1777392309; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qRtpy722JSowpXYTo05tBmCw4nfrEwgWGIeGpfsDYyI=; b=J7fx1D8lIvgWxRuooTjxRPfl01Whh+tzhgNcDdUOCMZ+ya8ADbrpVhbAgsnn1gE4UHA80b x7QzQ45e+QFN/IaFuvFAXTYDpUB251SgMCQnRjGtnuSg5faZMY9fbQ9GkfTv/LqTtCFajd EsyGHAasj5XHYnYndcm+mHaIiB33IAAsCbNX6ETuTkouZEEO46pClyeYVe60gD693AXqqV Vffv+5s0n6LR2Li+LVDH3YIjOj9j3cenK7tGUIkxrFLVzpzjfhaj+znF5qfknw8AgO2VIp +0w7xSz3P34K/tu3kV7xkqfiEHC3wEO4oFiIzPKw1SyF7ZUPS+vmf7g/+zFeKg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4g4ldK5lwWz10wG for ; Tue, 28 Apr 2026 16:05:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 446a2 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 28 Apr 2026 16:05:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kristof Provost Subject: git: ff141ea17cb7 - stable/15 - pf: do not allow flags to be changed with securelevel set List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kp X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: ff141ea17cb7d60806625423ddc855d40f7e1d06 Auto-Submitted: auto-generated Date: Tue, 28 Apr 2026 16:05:09 +0000 Message-Id: <69f0dab5.446a2.3615aee9@gitrepo.freebsd.org> The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=ff141ea17cb7d60806625423ddc855d40f7e1d06 commit ff141ea17cb7d60806625423ddc855d40f7e1d06 Author: Kristof Provost AuthorDate: 2026-04-13 13:48:39 +0000 Commit: Kristof Provost CommitDate: 2026-04-28 15:33:57 +0000 pf: do not allow flags to be changed with securelevel set With securelevel set (for pf that means >= 3) we're expected to reject rule changes. However, we allowed interface flags to be changed, which would allow 'set skip on X' to be changed. Remove DIOCSETIFFLAG and DIOCCLRIFFLAG from the securelevel whitelist. MFC after: 1 week Reported by: cyberkittens Sponsored by: Rubicon Communications, LLC ("Netgate") (cherry picked from commit d5ca00f2d8743f0885c17f50c8c011cae285fbdb) --- sys/netpfil/pf/pf_ioctl.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/sys/netpfil/pf/pf_ioctl.c b/sys/netpfil/pf/pf_ioctl.c index 46197a97dae4..0825a69b8f63 100644 --- a/sys/netpfil/pf/pf_ioctl.c +++ b/sys/netpfil/pf/pf_ioctl.c @@ -3113,8 +3113,6 @@ pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td case DIOCIGETIFACES: case DIOCGIFSPEEDV0: case DIOCGIFSPEEDV1: - case DIOCSETIFFLAG: - case DIOCCLRIFFLAG: case DIOCGETETHRULES: case DIOCGETETHRULE: case DIOCGETETHRULESETS: