The branch stable/15 has been updated by kp: URL: https://cgit.FreeBSD.org/src/commit/?id=8b10eb844c4b3205683fa5a4599c274fd89c52d8
commit 8b10eb844c4b3205683fa5a4599c274fd89c52d8 Author: Kristof Provost <[email protected]> AuthorDate: 2026-07-21 13:03:24 +0000 Commit: Kristof Provost <[email protected]> CommitDate: 2026-08-31 07:45:39 +0000 pf: fix securelevel off-by-one cmd_securelevel is the securelevel at which the call should be denied. pf (write) calls should be denied at level 3 or up (not at 2 or up as it was), so increment these all by one. PR: 296838 MFC after: 4 weeks Sponsored by: Rubicon Communications, LLC ("Netgate") Differential Revision: https://reviews.freebsd.org/D58377 (cherry picked from commit d13dffa150d17dc239e164ea42ddab91e6fab466) --- sys/netpfil/pf/pf_nl.c | 66 +++++++++++++++++++++++++------------------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c index c09b204bcc66..5df1457594e7 100644 --- a/sys/netpfil/pf/pf_nl.c +++ b/sys/netpfil/pf/pf_nl.c @@ -2248,7 +2248,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getstates, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GETCREATORS, @@ -2256,7 +2256,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getcreators, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_START, @@ -2264,7 +2264,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_start, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_STOP, @@ -2272,7 +2272,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_stop, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_ADDRULE, @@ -2280,7 +2280,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_addrule, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GETRULES, @@ -2288,7 +2288,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getrules, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GETRULE, @@ -2296,7 +2296,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_getrule, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLRSTATES, @@ -2304,7 +2304,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_states, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_KILLSTATES, @@ -2312,7 +2312,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_kill_states, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_SET_STATUSIF, @@ -2320,7 +2320,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_statusif, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_STATUS, @@ -2328,7 +2328,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_status, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLEAR_STATUS, @@ -2336,7 +2336,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_status, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_NATLOOK, @@ -2344,7 +2344,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_natlook, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SET_DEBUG, @@ -2352,7 +2352,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_debug, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_SET_TIMEOUT, @@ -2360,7 +2360,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_timeout, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_TIMEOUT, @@ -2368,7 +2368,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_timeout, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_SET_LIMIT, @@ -2376,7 +2376,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_set_limit, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_LIMIT, @@ -2384,7 +2384,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_limit, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_BEGIN_ADDRS, @@ -2392,7 +2392,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_begin_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_ADD_ADDR, @@ -2400,7 +2400,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_add_addr, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_ADDRS, @@ -2408,7 +2408,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_addrs, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_ADDR, @@ -2416,7 +2416,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_addr, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_RULESETS, @@ -2424,7 +2424,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_rulesets, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_RULESET, @@ -2432,7 +2432,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_ruleset, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_GET_SRCNODES, @@ -2440,7 +2440,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_srcnodes, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLEAR_TABLES, @@ -2448,7 +2448,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_tables, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_ADD_TABLE, @@ -2456,7 +2456,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_add_table, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_DEL_TABLE, @@ -2464,7 +2464,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_del_table, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 2, + .cmd_securelevel = 3, }, { .cmd_num = PFNL_CMD_GET_TSTATS, @@ -2472,7 +2472,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_get_tstats, .cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLR_TSTATS, @@ -2480,7 +2480,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_tstats, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_CLR_ADDRS, @@ -2488,7 +2488,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_clear_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_ADD_ADDR, @@ -2496,7 +2496,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_add_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, { .cmd_num = PFNL_CMD_TABLE_DEL_ADDR, @@ -2504,7 +2504,7 @@ static const struct genl_cmd pf_cmds[] = { .cmd_cb = pf_handle_table_del_addrs, .cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL, .cmd_priv = PRIV_NETINET_PF, - .cmd_securelevel = 3, + .cmd_securelevel = 4, }, };
