samba - Aug 2022 - Security patch 4.13 (was 4.12) backport

On 7/28/22 19:12, Rowland Penny via samba wrote:
> It sounds like you are trying to build Samba 4.12.x with the new
> Patches, the supplied patches are for 4.14.14, 4.15.9 and 4.16.4, they
> may not apply to your version and will
Hello.

I'm trying to backport the patches to 4.13, instead (on FreeBSD).
They apply cleanly, compile and so far, after a little (insufficient) 
testing, everything seems to work.

Is there a tool/command/way I can use to check the vulnerabilities are 
closed?

  bye & Thanks
	av.

On Fri, 2022-07-29 at 08:40 +0200, Andrea Venturoli via samba
wrote:
> On 7/28/22 19:12, Rowland Penny via samba wrote:
> 
> > It sounds like you are trying to build Samba 4.12.x with the new
> > Patches, the supplied patches are for 4.14.14, 4.15.9 and 4.16.4,
> > they
> > may not apply to your version and will
> 
> Hello.
> 
> I'm trying to backport the patches to 4.13, instead (on FreeBSD).
> They apply cleanly, compile and so far, after a little
> (insufficient) 
> testing, everything seems to work.
> 
> Is there a tool/command/way I can use to check the vulnerabilities
> are 
> closed?
Fully tested patches for Samba 4.13 were posted to the bugs, thanks to
my colleague Joseph Sutton of Catalyst. 

(We also thank our customers, including Univention, who funded our
backport work). 

Running 'make test' will confirm the testing, but isn't reliable on
small hardware (and is normally tested in parts, I can't promise it
would pass anyway), but you can test some tests with 'make test
TESTS=samba.tests.krb5' would run a subset that should confirm things.

Andrew Bartlett
-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions

On 7/31/22 22:03, Andrew Bartlett wrote:

Hello.

> Fully tested patches for Samba 4.13 were posted to the bugs, thanks to
> my colleague Joseph Sutton of Catalyst.
Could you be more specific, please?
I see patches scattered through several places: is there a single patch 
that covers all the security fixes made to 4.14?
I'd like to compare that to what I've used.


> Running 'make test' will confirm the testing,
This only works partially.
It complains because the FreeBSD port is compiled without --enable-selftest.
Unfortunately, enabling this leads to compilation errors.

In any case, I was thinking more about an 'external' test (such as a 
script to run against an installation to see if the exploits succeed or 
not): does such a thing exist?

  bye & Thanks
	av.