pf: fix securelevel off-by-one

cmd_securelevel is the securelevel at which the call should be denied.
pf (write) calls should be denied at level 3 or up (not at 2 or up as it
was), so increment these all by one.

PR:		296838
MFC after:	4 weeks
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision:	https://reviews.freebsd.org/D58377

1 files changed, 47 insertions, 47 deletions

diff --git a/sys/netpfil/pf/pf_nl.c b/sys/netpfil/pf/pf_nl.c
index 0e1c77864615..200f1dfca81a 100644
--- a/sys/netpfil/pf/pf_nl.c
+++ b/sys/netpfil/pf/pf_nl.c
@@ -2916,7 +2916,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_getstates,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_GETCREATORS,
@@ -2924,7 +2924,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_getcreators,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_START,
@@ -2932,7 +2932,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_start,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_STOP,
@@ -2940,7 +2940,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_stop,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_ADDRULE,
@@ -2948,7 +2948,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_addrule,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_GETRULES,
@@ -2956,7 +2956,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_getrules,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_GETRULE,
@@ -2964,7 +2964,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_getrule,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_CLRSTATES,
@@ -2972,7 +2972,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_clear_states,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_KILLSTATES,
@@ -2980,7 +2980,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_kill_states,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_SET_STATUSIF,
@@ -2988,7 +2988,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_set_statusif,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_STATUS,
@@ -2996,7 +2996,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_status,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_CLEAR_STATUS,
@@ -3004,7 +3004,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_clear_status,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_NATLOOK,
@@ -3012,7 +3012,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_natlook,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_SET_DEBUG,
@@ -3020,7 +3020,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_set_debug,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_SET_TIMEOUT,
@@ -3028,7 +3028,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_set_timeout,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_TIMEOUT,
@@ -3036,7 +3036,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_timeout,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_SET_LIMIT,
@@ -3044,7 +3044,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_set_limit,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_LIMIT,
@@ -3052,7 +3052,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_limit,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_BEGIN_ADDRS,
@@ -3060,7 +3060,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_begin_addrs,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_ADD_ADDR,
@@ -3068,7 +3068,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_add_addr,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_ADDRS,
@@ -3076,7 +3076,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_addrs,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_ADDR,
@@ -3084,7 +3084,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_addr,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_RULESETS,
@@ -3092,7 +3092,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_rulesets,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_RULESET,
@@ -3100,7 +3100,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_ruleset,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_SRCNODES,
@@ -3108,7 +3108,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_srcnodes,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_CLEAR_TABLES,
@@ -3116,7 +3116,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_clear_tables,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_ADD_TABLE,
@@ -3124,7 +3124,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_add_table,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_DEL_TABLE,
@@ -3132,7 +3132,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_del_table,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_GET_TSTATS,
@@ -3140,7 +3140,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_get_tstats,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_CLR_TSTATS,
@@ -3148,7 +3148,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_clear_tstats,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_CLR_ADDRS,
@@ -3156,7 +3156,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_clear_addrs,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_TABLE_ADD_ADDR,
@@ -3164,7 +3164,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_table_add_addrs,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_TABLE_DEL_ADDR,
@@ -3172,7 +3172,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_table_del_addrs,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_TABLE_SET_ADDR,
@@ -3180,7 +3180,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_table_set_addrs,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_TABLE_GET_ADDR,
@@ -3188,7 +3188,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_table_get_addrs,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_TABLE_GET_ASTATS,
@@ -3196,7 +3196,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_table_get_astats,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_TABLE_CLEAR_ASTATS,
@@ -3204,7 +3204,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_table_clear_astats,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_STATE_LIMITER_ADD,
@@ -3212,7 +3212,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_state_limiter_add,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_STATE_LIMITER_GET,
@@ -3220,7 +3220,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_state_limiter_get,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_STATE_LIMITER_NGET,
@@ -3228,7 +3228,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_state_limiter_get,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_SOURCE_LIMITER_ADD,
@@ -3236,7 +3236,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_source_limiter_add,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 2,
+		.cmd_securelevel = 3,
 	},
 	{
 		.cmd_num = PFNL_CMD_SOURCE_LIMITER_GET,
@@ -3244,7 +3244,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_source_limiter_get,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_SOURCE_LIMITER_NGET,
@@ -3252,7 +3252,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_source_limiter_get,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_SOURCE_GET,
@@ -3260,7 +3260,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_source_get,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_SOURCE_NGET,
@@ -3268,7 +3268,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_source_get,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_SOURCE_CLEAR,
@@ -3276,7 +3276,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_source_clear,
 		.cmd_flags = GENL_CMD_CAP_DO | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 	{
 		.cmd_num = PFNL_CMD_TABLE_TEST_ADDRS,
@@ -3284,7 +3284,7 @@ static const struct genl_cmd pf_cmds[] = {
 		.cmd_cb = pf_handle_table_test_addrs,
 		.cmd_flags = GENL_CMD_CAP_DUMP | GENL_CMD_CAP_HASPOL,
 		.cmd_priv = PRIV_NETINET_PF,
-		.cmd_securelevel = 3,
+		.cmd_securelevel = 4,
 	},
 };