git: 8b10eb844c4b - stable/15 - pf: fix securelevel off-by-one
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 31 Aug 2026 16:01:29 UTC
The branch stable/15 has been updated by kp:
URL: https://cgit.FreeBSD.org/src/commit/?id=8b10eb844c4b3205683fa5a4599c274fd89c52d8
commit 8b10eb844c4b3205683fa5a4599c274fd89c52d8
Author: Kristof Provost <kp@FreeBSD.org>
AuthorDate: 2026-07-21 13:03:24 +0000
Commit: Kristof Provost <kp@FreeBSD.org>
CommitDate: 2026-08-31 07:45:39 +0000
pf: fix securelevel off-by-one
cmd_securelevel is the securelevel at which the call should be denied.
pf (write) calls should be denied at level 3 or up (not at 2 or up as it
was), so increment these all by one.
PR: 296838
MFC after: 4 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D58377
(cherry picked from commit d13dffa150d17dc239e164ea42ddab91e6fab466)
---
sys/netpfil/pf/pf_nl.c | 66 +++++++++++++++++++++++++-------------------------
1 file changed, 33 insertions(+), 33 deletions(-)
diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index c09b204bcc66..5df1457594e7 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -2248,7 +2248,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_getstates,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GETCREATORS,
@@ -2256,7 +2256,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_getcreators,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_START,
@@ -2264,7 +2264,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_start,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_STOP,
@@ -2272,7 +2272,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_stop,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_ADDRULE,
@@ -2280,7 +2280,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_addrule,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GETRULES,
@@ -2288,7 +2288,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_getrules,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GETRULE,
@@ -2296,7 +2296,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_getrule,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLRSTATES,
@@ -2304,7 +2304,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_states,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_KILLSTATES,
@@ -2312,7 +2312,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_kill_states,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_SET_STATUSIF,
@@ -2320,7 +2320,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_set_statusif,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GET_STATUS,
@@ -2328,7 +2328,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_status,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLEAR_STATUS,
@@ -2336,7 +2336,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_status,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_NATLOOK,
@@ -2344,7 +2344,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_natlook,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SET_DEBUG,
@@ -2352,7 +2352,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_set_debug,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_SET_TIMEOUT,
@@ -2360,7 +2360,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_set_timeout,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GET_TIMEOUT,
@@ -2368,7 +2368,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_timeout,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_SET_LIMIT,
@@ -2376,7 +2376,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_set_limit,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GET_LIMIT,
@@ -2384,7 +2384,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_limit,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_BEGIN_ADDRS,
@@ -2392,7 +2392,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_begin_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_ADD_ADDR,
@@ -2400,7 +2400,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_add_addr,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_ADDRS,
@@ -2408,7 +2408,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_addrs,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_ADDR,
@@ -2416,7 +2416,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_addr,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_RULESETS,
@@ -2424,7 +2424,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_rulesets,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_RULESET,
@@ -2432,7 +2432,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_ruleset,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_GET_SRCNODES,
@@ -2440,7 +2440,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_srcnodes,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLEAR_TABLES,
@@ -2448,7 +2448,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_tables,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_ADD_TABLE,
@@ -2456,7 +2456,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_add_table,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_DEL_TABLE,
@@ -2464,7 +2464,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_del_table,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 2,
+ .cmd_securelevel = 3,
},
{
.cmd_num = PFNL_CMD_GET_TSTATS,
@@ -2472,7 +2472,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_get_tstats,
.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLR_TSTATS,
@@ -2480,7 +2480,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_tstats,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_CLR_ADDRS,
@@ -2488,7 +2488,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_clear_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_ADD_ADDR,
@@ -2496,7 +2496,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_add_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
{
.cmd_num = PFNL_CMD_TABLE_DEL_ADDR,
@@ -2504,7 +2504,7 @@ static const struct genl_cmd pf_cmds[] = {
.cmd_cb = pf_handle_table_del_addrs,
.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
.cmd_priv = PRIV_NETINET_PF,
- .cmd_securelevel = 3,
+ .cmd_securelevel = 4,
},
};