git: d13dffa150d1 - main - pf: fix securelevel off-by-one
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 03 Aug 2026 16:02:24 UTC
The branch main has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=d13dffa150d17dc239e164ea42ddab91e6fab466
commit d13dffa150d17dc239e164ea42ddab91e6fab466
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-07-21 13:03:24 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-08-03 16:00:04 +0000
pf: fix securelevel off-by-one
cmd_securelevel is the securelevel at which the call should be denied.
pf (write) calls should be denied at level 3 or up (not at 2 or up as it
was), so increment these all by one.
PR: 296838
MFC after: 4 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D58377
---
sys/netpfil/pf/pf_nl.c | 94 +++++++++++++++++++++++++-------------------------
1 file changed, 47 insertions(+), 47 deletions(-)
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 0e1c77864615..200f1dfca81a 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -2916,7 +2916,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_getstates,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GETCREATORS,
@@ -2924,7 +2924,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_getcreators,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_START,
@@ -2932,7 +2932,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_start,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_STOP,
@@ -2940,7 +2940,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_stop,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_ADDRULE,
@@ -2948,7 +2948,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_addrule,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GETRULES,
@@ -2956,7 +2956,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_getrules,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GETRULE,
@@ -2964,7 +2964,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_getrule,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLRSTATES,
@@ -2972,7 +2972,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_states,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_KILLSTATES,
@@ -2980,7 +2980,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_kill_states,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_SET_STATUSIF,
@@ -2988,7 +2988,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_set_statusif,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GET_STATUS,
@@ -2996,7 +2996,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_status,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLEAR_STATUS,
@@ -3004,7 +3004,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_status,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_NATLOOK,
@@ -3012,7 +3012,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_natlook,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SET_DEBUG,
@@ -3020,7 +3020,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_set_debug,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_SET_TIMEOUT,
@@ -3028,7 +3028,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_set_timeout,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GET_TIMEOUT,
@@ -3036,7 +3036,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_timeout,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SET_LIMIT,
@@ -3044,7 +3044,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_set_limit,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GET_LIMIT,
@@ -3052,7 +3052,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_limit,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_BEGIN_ADDRS,
@@ -3060,7 +3060,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_begin_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_ADD_ADDR,
@@ -3068,7 +3068,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_add_addr,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_ADDRS,
@@ -3076,7 +3076,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_addrs,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_ADDR,
@@ -3084,7 +3084,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_addr,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_RULESETS,
@@ -3092,7 +3092,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_rulesets,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_RULESET,
@@ -3100,7 +3100,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_ruleset,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_SRCNODES,
@@ -3108,7 +3108,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_srcnodes,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLEAR_TABLES,
@@ -3116,7 +3116,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_tables,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_ADD_TABLE,
@@ -3124,7 +3124,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_add_table,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_DEL_TABLE,
@@ -3132,7 +3132,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_del_table,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GET_TSTATS,
@@ -3140,7 +3140,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_tstats,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLR_TSTATS,
@@ -3148,7 +3148,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_tstats,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLR_ADDRS,
@@ -3156,7 +3156,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_ADD_ADDR,
@@ -3164,7 +3164,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_add_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_DEL_ADDR,
@@ -3172,7 +3172,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_del_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_SET_ADDR,
@@ -3180,7 +3180,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_set_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_GET_ADDR,
@@ -3188,7 +3188,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_get_addrs,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_GET_ASTATS,
@@ -3196,7 +3196,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_get_astats,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_CLEAR_ASTATS,
@@ -3204,7 +3204,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_clear_astats,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_STATE_LIMITER_ADD,
@@ -3212,7 +3212,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_state_limiter_add,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_STATE_LIMITER_GET,
@@ -3220,7 +3220,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_state_limiter_get,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_STATE_LIMITER_NGET,
@@ -3228,7 +3228,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_state_limiter_get,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SOURCE_LIMITER_ADD,
@@ -3236,7 +3236,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_source_limiter_add,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_SOURCE_LIMITER_GET,
@@ -3244,7 +3244,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_source_limiter_get,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SOURCE_LIMITER_NGET,
@@ -3252,7 +3252,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_source_limiter_get,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SOURCE_GET,
@@ -3260,7 +3260,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_source_get,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SOURCE_NGET,
@@ -3268,7 +3268,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_source_get,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SOURCE_CLEAR,
@@ -3276,7 +3276,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_source_clear,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_TEST_ADDRS,
@@ -3284,7 +3284,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_test_addrs,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
};