From: Stefan Metzmacher <metze@samba.org>
Date: Thu, 22 Feb 2018 09:40:19 +0000 (+0100)
Subject: winbind: let cm_connect_netlogon_transport() only work against direct trust as AD DC
X-Git-Tag: ldb-1.3.2~38
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=532a14dc684e7a6d8c584d5671a4ebbad00aa4fc;p=thirdparty%2Fsamba.git

winbind: let cm_connect_netlogon_transport() only work against direct trust as AD DC

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13278

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index b6a54d0a12b..a88e05cac23 100644
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -3212,6 +3212,17 @@ static NTSTATUS cm_connect_netlogon_transport(struct winbindd_domain *domain,
 
 	*cli = NULL;
 
+	if (IS_AD_DC) {
+		if (domain->secure_channel_type == SEC_CHAN_NULL) {
+			/*
+			 * Make sure we don't even try to
+			 * connect to a foreign domain
+			 * without a direct outbound trust.
+			 */
+			return NT_STATUS_NO_TRUST_LSA_SECRET;
+		}
+	}
+
 	result = init_dc_connection_rpc(domain, domain->rodc);
 	if (!NT_STATUS_IS_OK(result)) {
 		return result;