dcerpc: Support Samba 4.23

Samba 4.23 ignores trust to PIM and 'within the forest' domains. It
didn't know what to do with them in past as well but starting with 4.23
the domain trust entries which have trust attributes with
LSA_TRUST_ATTRIBUTE_PIM_TRUST and LSA_TRUST_ATTRIBUTE_WITHIN_FOREST bits
set will be ignored.

FreeIPA did default to LSA_TRUST_ATTRIBUTE_WITHIN_FOREST for domains
stored with trusted attributes set to 0 or missing. This was behavior in
past for Samba as well. Since FreeIPA only supports forest trust and an
external trust, in both cases we should set explicit LSA trust attribute
bits:
 - LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE for the forest trust
 - LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE for the external trust

Fixes: https://pagure.io/freeipa/issue/9852

Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>
Reviewed-By: Julien Rische <jrische@redhat.com>

daemons/ipa-sam/ipa_sam.c

@@ -2594,10 +2594,10 @@ static bool fill_pdb_trusted_domain(TALLOC_CTX *mem_ctx,
 		TALLOC_FREE(td);
 		return false;
 	}
-	if (td->trust_attributes == 0) {
-		/* attribute wasn't present, this is a subdomain within the
-		 * parent forest */
-		td->trust_attributes = LSA_TRUST_ATTRIBUTE_WITHIN_FOREST;
+	if (td->trust_attributes == 0 && (td->domain_name != dns_domain)) {
+                /* attribute wasn't present and this is not a subdomain within
+                 * the parent forest */
+		td->trust_attributes = LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE;
 	}
 
 	res = get_uint32_t_from_ldap_msg(ipasam_state, entry,

ipaserver/dcerpc.py

@@ -1362,6 +1362,8 @@ class TrustDomainInstance:
         info.trust_attributes = 0
         if trust_external:
             info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE
+        else:
+            info.trust_attributes |= lsa.LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
 
         try:
             dname = lsa.String()