From d0a813a173be630c2def93cc55e4514204d265a2 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 1 Feb 2018 11:10:14 +0100 Subject: [PATCH] s4:kdc: only support LSA_TRUST_TYPE_UPLEVEL domains in samba_kdc_trust_message2entry() BUG: https://bugzilla.samba.org/show_bug.cgi?id=13299 Signed-off-by: Stefan Metzmacher Reviewed-by: Ralph Boehme --- source4/kdc/db-glue.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c index 5ca2c067585..9d633a6e528 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -1215,6 +1215,16 @@ static krb5_error_code samba_kdc_trust_message2entry(krb5_context context, goto out; } + if (tdo->trust_type != LSA_TRUST_TYPE_UPLEVEL) { + /* + * Only UPLEVEL domains support kerberos here, + * as we don't support LSA_TRUST_TYPE_MIT. + */ + krb5_clear_error_message(context); + ret = SDB_ERR_NOENTRY; + goto out; + } + if (tdo->domain_name.string == NULL) { krb5_clear_error_message(context); ret = SDB_ERR_NOENTRY; -- 2.34.1