Re: Testing stable backports for netfilter

[Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>]

On 11/06/24 03:29, Pablo Neira Ayuso wrote:
> On Mon, Jun 10, 2024 at 11:51:53PM +0530, Harshit Mogalapalli wrote:
>> Hello netfilter developers,
>>
>> Do we have any tests that we could run before sending a stable backport in
>> netfilter/ subsystem to stable@vger ?
>>
>> Let us say we have a CVE fix which is only backported till 5.10.y but it is
>> needed is 5.4.y and 4.19.y, the backport might need to easy to make, just
>> fixing some conflicts due to contextual changes or missing commits.
> 
> Which one in particular is missing?

I was planning to backport the fix for CVE-2023-52628 onto 5.4.y and 
4.19.y trees.

lts-5.10       : v5.10.198             - a7d86a77c33b netfilter: 
nftables: exthdr: fix 4-byte stack OOB write
   lts-5.15       : v5.15.132             - 1ad7b189cc14 netfilter: 
nftables: exthdr: fix 4-byte stack OOB write
   lts-6.1        : v6.1.54               - d9ebfc0f2137 netfilter: 
nftables: exthdr: fix 4-byte stack OOB write
   mainline       : v6.6-rc1              - fd94d9dadee5 netfilter: 
nftables: exthdr: fix 4-byte stack OOB write


> 
>> One question that comes in my mind is did I test that particular code, often
>> testing that particular code is tough unless the reproducer is public. So I
>> thought it would be good to learn about any netfilter test suite(set of
>> tests) to run before sending a backport to stable kernel which might ensure
>> we don't introduce regressions.
> 
> There is tests/shell under the nftables userspace tree, it also
> detected the features that are available in your kernel.
> 

Thanks a lot for sharing. Will try running these before sending any 
netfilter backports to stable.

Regards,
Harshit