One Hat Cyber Team
Your IP :
10.30.1.1
Server IP :
103.148.201.5
Server :
Linux web-olt 5.15.0-161-generic #171-Ubuntu SMP Sat Oct 11 08:17:01 UTC 2025 x86_64
Server Software :
Apache/2.4.52 (Ubuntu)
PHP Version :
8.1.29
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
samba
/
kcc
/
__pycache__
/
Edit File:
__init__.cpython-310.pyc
o �/a�� � @ sP d dl Z d dlZd dlmZ d dlZd dlmZmZ d dlmZm Z m Z d dl m Z d dl mZ d dlmZmZ d dlmZmZmZmZ d d lmZmZmZmZ d d lmZm Z m Z d d l m Z d d l m!Z! d d l"m#Z# d dl$m%Z% d dl m&Z&m'Z' d dl m(Z( d dl)m*Z*m+Z+m,Z, d dl$m-Z- d dl.m/Z/ dd� Z0dd� Z1G dd� de2�Z3dS )� N)� cmp_to_key)� unix2nttime� nttime2unix)�ldb�dsdb� drs_utils)�system_session)�SamDB)�drsuapi�misc)�Site� Partition� Transport�SiteLink)� NCReplica�NCType� nctype_lut� GraphNode)� RepsFromTo�KCCError�KCCFailedObject)� convert_schedule_to_repltimes)�ndr_pack)�verify_and_dot)�ldif_import_export)� setup_graph�get_spanning_tree_edges)�Vertex)�DEBUG�DEBUG_FN�logger)�debug)�cmpc C s> | � � r |� � s dS | � � s|� � rdS tt| j�t|j��S )a Helper to sort DSAs by guid global catalog status GC DSAs come before non-GC DSAs, other than that, the guids are sorted in NDR form. :param dsa1: A DSA object :param dsa2: Another DSA :return: -1, 0, or 1, indicating sort order. ���� )�is_gcr" r �dsa_guid)�dsa1�dsa2� r) �4/usr/lib/python3/dist-packages/samba/kcc/__init__.py�sort_dsa_by_gc_and_guid2 s r+ c C s dS )z�Can the KCC use SMTP replication? Currently always returns false because Samba doesn't implement SMTP transfer for NC changes between DCs. :return: Boolean (always False) Fr) r) r) r) r* � is_smtp_replication_availableC s r, c @ sl e Zd ZdZ dVdd�Zdd� Zdd � Zd d � Zd d � Zdd� Z dd� Z dd� Z dWdd�Z dd� Z dd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� ZdWd*d+�ZdWd,d-�Zd.d/� Zd0d1� Zd2d3� Zd4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z d>d?� Z!dXdAdB�Z"dCdD� Z#dEdF� Z$dGdH� Z%dIdJ� Z&dYdKdL�Z'dZdNdO�Z( d[dPdQ�Z)dWdRdS�Z*dTdU� Z+dS )\�KCCa; The Knowledge Consistency Checker class. A container for objects and methods allowing a run of the KCC. Produces a set of connections in the samdb for which the Distributed Replication Service can then utilize to replicate naming contexts :param unix_now: The putative current time in seconds since 1970. :param readonly: Don't write to the database. :param verify: Check topological invariants for the generated graphs :param debug: Write verbosely to stderr. :param dot_file_dir: write diagnostic Graphviz files in this directory FNc C s� i | _ i | _d| _i | _i | _i | _| jj| _| jj| _i | _ t � | _ t � | _ d| _ d| _d| _d| _d| _|| _t|�| _|| _|| _|| _|| _dS )z�Initializes the partitions class which can hold our local DCs partitions or all the partitions in the forest N)� part_table� site_table� ip_transport�sitelink_table� dsa_by_dnstr� dsa_by_guid�get�get_dsa_by_guidstr�get_dsa�kcc_failed_links�set�kcc_failed_connections�kept_connections� my_dsa_dnstr�my_dsa� my_site_dnstr�my_site�samdb�unix_nowr �nt_now�readonly�verifyr! � dot_file_dir)�selfr@ rB rC r! rD r) r) r* �__init__[ s, z KCC.__init__c C s� z| j jd| j �� tjdd�}W n tjy) } z |j\}}td| ��d}~ww |D ].}t|j �}t |�}|� | j � |j dkrF|| _ q,|j dkrQt�d� q,t�d |j f � q,| j du rdtd ��dS ) z�Loads the inter-site transport objects for Sites :return: None :raise KCCError: if no IP transport is found �$CN=Inter-Site Transports,CN=Sites,%sz (objectClass=interSiteTransport)��scope� expressionz+Unable to find inter-site transports - (%s)N�IP�SMTPz2Samba KCC is ignoring the obsolete SMTP transport.z3Samba KCC does not support the transport called %r.z(there doesn't seem to be an IP transport)r? �search�get_config_basednr � SCOPE_SUBTREE�LdbError�argsr �str�dnr �load_transport�namer0 r r! �warning)rE �res�e2�enum�estr�msg�dnstr� transportr) r) r* �load_ip_transport� s8 � � ��� � �zKCC.load_ip_transportc C � z| j jd| j �� tjdd�}W n tjy) } z |j\}}td| ��d}~ww |D ] }t|j �}|| j v r9q,t |�}|� | j � || j |< q,dS )zyLoads the inter-site siteLink objects :return: None :raise KCCError: if site-links aren't found rG z(objectClass=siteLink)rH z*Unable to find inter-site siteLinks - (%s)N) r? rM rN r rO rP rQ r rR rS r1 r � load_sitelink)rE rW �e3rY rZ r[ r\ �sitelinkr) r) r* �load_all_sitelinks� s( � � �� �zKCC.load_all_sitelinksc C sj t || j�}|�| j� t|j�}|| jvr0|| j|< | j�|j � | j �dd� |j � � D �� | j| S )z�Helper for load_my_site and load_all_sites. Put all the site's DSAs into the KCC indices. :param dn_str: a site dn_str :return: the Site object pertaining to the dn_str c s s � | ] }t |j�|fV qd S �N�rR r& ��.0�xr) r) r* � <genexpr>� s � �z KCC.load_site.<locals>.<genexpr>) r r@ � load_siter? rR � site_guidr/ r2 �update� dsa_tabler3 �values)rE �dn_str�site�guidr) r) r* rj � s � z KCC.load_sitec C s, d| j �� | j �� f | _| �| j�| _dS )zGLoad the Site object for the local DSA. :return: None zCN=%s,CN=Sites,%sN)r? �server_site_namerN r= rj r> �rE r) r) r* � load_my_site� s �zKCC.load_my_sitec C sv z| j jd| j �� tjdd�}W n tjy) } z |j\}}td| ��d}~ww |D ] }t|j �}| � |� q,dS )z|Discover all sites and create Site objects. :return: None :raise: KCCError if sites can't be found z CN=Sites,%sz(objectClass=site)rH zUnable to find sites - (%s)N) r? rM rN r rO rP rQ r rR rS rj )rE rW �e4rY rZ r[ �sitestrr) r) r* �load_all_sites� s � � �� �zKCC.load_all_sitesc C s� d| j �� }t�| j |�}z | j j|tjdgd�}W nb tjy} } zU|j\}}td|||f � z(| j jdtjdgd�}t�| j |d d d � d��}| j j|tjdgd�}W n tjyr } z |j\}}t d | ��d }~ww W Y d }~nd }~ww t |�d kr�t d |� � ��t �| j �� �} t �|d d d �| kr�t d ��t|d j�| _| j�| j�| _| j| jvr�t�d| j � | j| j| j< | j| jt| jj�< d S d S )z|Discover my nTDSDSA dn thru the rootDSE entry :return: None :raise: KCCError if DSA can't be found z <GUID=%s>� objectGUID)�baserI �attrszsSearch for dn '%s' [from %s] failed: %s. This typically happens in --importldif mode due to lack of module support.� � dsServiceNamer �utf8z Unable to find my nTDSDSA - (%s)Nr$ z Unable to find my nTDSDSA at %sz>Did not find the GUID we expected, perhaps due to --importldifz�my_dsa %s isn't in self.dsas_by_dnstr: it must be RODC. Let's add it, because my_dsa is special! (likewise for self.dsa_by_guid))r? � get_ntds_GUIDr �DnrM � SCOPE_BASErP rQ r �decoder �len� extended_strr �GUIDrR rS r; r> r6 r< r2 r! �DEBUG_DARK_YELLOWr3 r& ) rE �dn_queryrS rW �e5rY rZ �service_name_res�e� ntds_guidr) r) r* � load_my_dsa� s\ � ��� � �� ��� � ��zKCC.load_my_dsac C r_ )z�Discover and load all partitions. Each NC is inserted into the part_table by partition dn string (not the nCName dn string) :return: None :raise: KCCError if partitions can't be found zCN=Partitions,%sz(objectClass=crossRef)rH z Unable to find partitions - (%s)N) r? rM rN r rO rP rQ r rR rS r. r �load_partition)rE rW �e6rY rZ r[ �partstr�partr) r) r* �load_all_partitions5 s( � � �� �zKCC.load_all_partitionsc C s i | _ | j�� \}}|�� D ]G}|jD ]A}|j}|dkr qt|j�}|j}|j } |j } | j � |�} | du rCt |||| | �} | | j |< qt | j|�| _t| j|�| _| | _qqt� } |durztd� | jD ]} || j�rq| �| � qd| jd7 _qdntd� | j�| � dS )z�Ensure the failed links list is up to date Based on MS-ADTS 6.2.2.1 :param ping: An oracle function of remote site availability :return: None r Nz6refresh_failed_links: checking if links are still downr$ zdrefresh_failed_links: not checking live links because we weren't asked to --attempt-live-connections)r7 r< �get_rep_tablesrn � rep_repsFrom�consecutive_sync_failuresrR �source_dsa_obj_guid� last_success� last_attempt� dns_name1r4 r �max� failure_count�min�time_first_failure� last_resultr8 r r9 �dns_name�add�difference_update)rE �ping�current�needed�replica� reps_fromr� r& r� r� r� �f�restore_connections� connectionr) r) r* � refresh_failed_links_connectionsS sD � �� �z$KCC.refresh_failed_links_connectionsc C sT | j �t|j��}|r(|jdkr(t|j�}|| jkr t� d� | j| dkr(dS dS )aL Check whether a link to a remote DSA is stale Used in MS-ADTS 6.2.2.2 Intrasite Connection Creation Returns True if the remote seems to have been down for at least two hours, otherwise False. :param target_dsa: the remote DSA object :return: True if link is stale, otherwise False r z_The last success time attribute for repsFrom is in the future!i TF) r7 r4 rR r& r� r r� r@ r �error)rE � target_dsa� failed_link�unix_first_failurer) r) r* �is_stale_link_connection� s � z KCC.is_stale_link_connectionc C s d S rd r) rs r) r) r* �(remove_unneeded_failed_links_connections� s z,KCC.remove_unneeded_failed_links_connectionsc C sH |D ] }|j du r!| jrt�tt�� ��|_ | j|_q|� | j � qdS )aT Load or fake-load NTDSConnections lacking GUIDs New connections don't have GUIDs and created times which are needed for sorting. If we're in read-only mode, we make fake GUIDs, otherwise we ask SamDB to do it for us. :param connections: an iterable of NTDSConnection objects. :return: None N) rq rB r r� rR �uuid�uuid4rA � whenCreated�load_connectionr? )rE � connections�cn_connr) r) r* � _ensure_connections_are_loaded� s ��z"KCC._ensure_connections_are_loadedc C s> | j j�� D ]}|�� }|du r td| j |f � d|_qdS )z�Find NTDS Connections that lack a remote I'm not sure how they appear. Let's be rid of them by marking them with the to_be_deleted attribute. :return: None Nz %s has phantom connection %sT)r< � connect_tablern �get_from_dnstrr � to_be_deleted)rE r� �s_dnstrr) r) r* �_mark_broken_ntdsconn� s ���zKCC._mark_broken_ntdsconnc C s" | j �� rtd| j � dS | j}z | �|j�� � W n ty+ |�� r)Y dS Y nw g }|j�� D ]#}|� � }|| j j v rV|� � pF|� � }t |j�}|�||||f� q3t|�dk r_dS t�|d�D ])\}}|\}}}}|\} } } } |r�|| kr�|j| jk s�|j| jkr�|| k r�d|_qedS )a Find unneeded intrasite NTDS Connections for removal Based on MS-ADTS 6.2.2.4 Removing Unnecessary Connections. Every DC removes its own unnecessary intrasite connections. This function tags them with the to_be_deleted attribute. :return: None z>not doing ntdsconn cleanup for site %s, because it is disabledN� T)r> � is_cleanup_ntdsconn_disabledr r< r� r� rn r �is_ror� rm � is_generated�is_rodc_topologyr rq �appendr� � itertools� permutationsr� r� ) rE �mydsa�local_connectionsr� r� � removable� packed_guid�a�b�cn_conn2�s_dnstr2� packed_guid2� removable2r) r) r* � _mark_unneeded_local_ntdsconn� sL � �� � �� ��z!KCC._mark_unneeded_local_ntdsconnc C s@ | j �� rdS | jj}g }|�� D ];}|j�� D ]3}|jr q|�� }|du r'q||vrK| �|�}|du s8d|v rCt � d| � d|_q|� |||f� qq| � dd� |D �� |D ]D\}}}|� � rf|�� rgqY|| jv ry| �|d�sy| �|d�syqY|j}| j�� D ]} || jv r�|D ]\} } } || ur�| | jv r�d|_q�q�qYdS )a( find unneeded intersite NTDS Connections for removal Based on MS-ADTS 6.2.2.4 Removing Unnecessary Connections. The intersite topology generator removes links for all DCs in its site. Here we just tag them with the to_be_deleted attribute. :return: None N�\0ADELz+DSA appears deleted, removing connection %sTc s s � | ]}|d V qdS )r Nr) rf r) r) r* ri ' s � z8KCC._mark_unneeded_intersite_ntdsconn.<locals>.<genexpr>)r< r� r> rm rn r� r� r� r6 r �infor� r� r� r� r: �is_bridgehead_failed� dsa_dnstrr/ � rw_dsa_table) rE � local_dsas�connections_and_dsas�dsa�cnr� �from_dsa�to_dsa� from_dnstrrp �cn2�to_dsa2� from_dsa2r) r) r* �!_mark_unneeded_intersite_ntdsconn sT ��� � � ���z%KCC._mark_unneeded_intersite_ntdsconnc C s~ |� � s| jr7|j�� D ] }|jrt�d| � |jr"t�d| � |jr,t�d| � q |j | j dd� d S |� | j � d S )N�TO BE DELETED: %s�TO BE ADDED: %s�TO BE MODIFIED: %sT��ro) r� rB r� rn r� r r� � to_be_added�to_be_modified�commit_connectionsr? )rE r� �connectr) r) r* �_commit_changes> s �zKCC._commit_changesc C sF | � � | �� | j�� r|r| �� | jj�� D ]}| �|� qdS )z�Remove unneeded NTDS Connections once topology is calculated Based on MS-ADTS 6.2.2.4 Removing Unnecessary Connections :param all_connected: indicates whether all sites are connected :return: None N) r� r� r< �is_istgr� r> rm rn r� )rE � all_connectedr� r) r) r* �remove_unneeded_ntdsconnO s �z KCC.remove_unneeded_ntdsconnc C sB |j }|| jjv }t|j�}||jkr||_|jtj@ dkr&| jtjO _|�� r:|jtj @ dkr:| jtj O _|sA|� |�rQ|jtj @ dkrQ| jtj O _|j t j@ dkrr|j t j@ dkrq|jtj@ dkrq| jtjO _n|s�|jtj@ dkr�| jtjO _|s�|j t j@ dkr�|jtj@ dkr�| jtjO _|j t j@ dkr�|jtj@ dkr�| jtjO _|�� s�|jtj@ dkr�| jtjO _|jtj@ dkr�| jtjO _d|j| j�� f } |jtj@ dkr�| jtj M _t � � |_ |j | k�r| |_ |j dk�r|j!| k�r| |_!|�"� �r t#d| � dS dS )a$ Update an repsFrom object if required. Part of MS-ADTS 6.2.2.5. Update t_repsFrom if necessary to satisfy requirements. Such updates are typically required when the IDL_DRSGetNCChanges server has moved from one site to another--for example, to enable compression when the server is moved from the client's site to another site. The repsFrom.update_flags bit field may be modified auto-magically if any changes are made here. See kcc_utils.RepsFromTo for gory details. :param n_rep: NC replica we need :param t_repsFrom: repsFrom tuple to modify :param s_rep: NC replica at source DSA :param s_dsa: source DSA :param cn_conn: Local DSA NTDSConnection child :return: None r z %s._msdcs.%sr$ zmodify_repsFrom(): %sN)$r� r> rm r �schedule� replica_flagsr �DRSUAPI_DRS_ADD_REF�!is_schedule_minimum_once_per_week�DRSUAPI_DRS_PER_SYNC�is_fsmo_role_owner�DRSUAPI_DRS_INIT_SYNC�optionsr �$NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT�NTDSCONN_OPT_USE_NOTIFY�DRSUAPI_DRS_NEVER_NOTIFY�*NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION�DRSUAPI_DRS_USE_COMPRESSION�NTDSCONN_OPT_TWOWAY_SYNC�DRSUAPI_DRS_TWOWAY_SYNC� is_enabled� DRSUAPI_DRS_DISABLE_AUTO_SYNC�!DRSUAPI_DRS_DISABLE_PERIODIC_SYNCr& r? �forest_dns_name�DRSUAPI_DRS_MAIL_REPr r� �transport_guidr� �version� dns_name2� is_modifiedr ) rE �n_rep� t_repsFrom�s_rep�s_dsar� r� � same_site�times�nastrr) r) r* �modify_repsFroma s� �������� ������������������?�� �zKCC.modify_repsFromc C sf |� � r|�� r dS |�� }| �|�}|du rdS |�|j�}|dur1|�� r1|�� r/|�� r1|S dS )a� If a connection imply a replica, find the relevant DSA Given a NC replica and NTDS Connection, determine if the connection implies a repsFrom tuple should be present from the source DSA listed in the connection to the naming context. If it should be, return the DSA; otherwise return None. Based on part of MS-ADTS 6.2.2.5 :param n_rep: NC replica :param cn_conn: NTDS Connection :return: source DSA or None N) r� r� r� r6 �get_current_replica�nc_dnstr� is_presentr� � is_partial)rE r r� r� r r r) r) r* �get_dsa_for_implied_replica0 s ���z KCC.get_dsa_for_implied_replicac C s� d}|du r | j }|�� rd}|�� rtd� dS td� |�� \}}t� }|D ]>}|r]|| }|�| j� |jD ]}t j t j B t j B t j B t jB } |j| krR| |_q9|j| j| jd� q(||vrf|�|� q(tdt|�t|�t|�f � |r�td| � |D ]}||= q�|�� D ]�} | �| j� | �| j� | jD ]U}t|j�} | �| �} | du r�t�d | � d|_ q�| j } |� | �}|D ]}|� � s� nq�d|_ q�| � | j!�}|du s�|�"� r�| �� s�|�#� r�d|_ q�| �$| ||| |� q�|j%�� D ]O}| �&| |�} | du �rq�| jD ]}t|j�} | | �| �u �rd} n�q| du �r"q�t'| j!�}| j(|_| � | j!�}| �$| ||| |� |�)� �rE| j�*|� q�| j�sM|�rr| �+� }|�r[t�,d | � | �-� }|�rit�,d | � | j| jdd� q�| �| j� q�|�r~dS |�� D ]w} | �.| j� | j/D ]D}t|j�} | �| �} | du �r�t�d | � d|_ �q�| j } d | v �r�t�d| � d|_ �q�| � | j0�}t|�dk�r͐q�d|_ �q�| j�r�| j/D ]}|j �r�t�,d| � �q�| j1| jdd� �q�| �1| j� �q�dS )a[ Adjust repsFrom to match NTDSConnections This function adjusts values of repsFrom abstract attributes of NC replicas on the local DC to match those implied by nTDSConnection objects. Based on [MS-ADTS] 6.2.2.5 :param current_dsa: optional DSA on whose behalf we are acting. :return: None FNTz;skipping translate_ntdsconn() because disabling flag is setztranslate_ntdsconn(): enterr� z current %d needed %d delete %dzdeleting these reps: %sz'repsFrom source DSA guid (%s) not foundr� r� z%repsTo source DSA guid (%s) not foundr� z+repsTo source DSA guid (%s) appears deletedr zREMOVING REPS-TO: %s)2r< r� � is_translate_ntdsconn_disabledr r� r8 � load_repsFromr? r� r r� r� r� �%DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING�DRSUAPI_DRS_NONGC_RO_REPr� �commit_repsFromrB r� r� r rn �load_fsmo_rolesrR r� r5 r rV r� r� � get_connection_by_from_dnstrr� r r r r r r� r r r& r r� �dumpstr_to_be_deletedr� �dumpstr_to_be_modified� load_repsTo� rep_repsTor; � commit_repsTo)rE � current_dsar� �current_rep_table�needed_rep_table� delete_repsr\ �c_repr r� r �guidstrr r� r� r� r �text�t_repsTo�rtr) r) r* �translate_ntdsconnW s ���� � � � � � �� � � � � ��zKCC.translate_ntdsconnc C s" |dur t �d� dS td� dS )a� Merge of kCCFailedLinks and kCCFailedLinks from bridgeheads. The KCC on a writable DC attempts to merge the link and connection failure information from bridgehead DCs in its own site to help it identify failed bridgehead DCs. Based on MS-ADTS 6.2.2.3.2 "Merge of kCCFailedLinks and kCCFailedLinks from Bridgeheads" :param ping: An oracle of current bridgehead availability :return: None Nz'merge_failed_links() is NOT IMPLEMENTEDz}skipping merge_failed_links() because it requires real network connections and we weren't asked to --attempt-live-connections)r! � DEBUG_REDr )rE r� r) r) r* �merge_failed_linksV s zKCC.merge_failed_linksc C s� | j jd@ dk}t| jj�}t|| j|| j|�}| js | j durUg }|j D ]}t � |j d�D ]\}}|�|jj|jjf� q.q%d} d|j } t| |d| j| t| j| j d� |S ) a� Set up an intersite graph An intersite graph has a Vertex for each site object, a MultiEdge for each SiteLink object, and a MutliEdgeSet for each siteLinkBridge object (or implied siteLinkBridge). It reflects the intersite topology in a slightly more abstract graph form. Roughly corresponds to MS-ADTS 6.2.2.3.4.3 :param part: a Partition object :returns: an InterSiteGraph object i r Nr� r) z site_edges_%sF��directed�label� propertiesr! rC rD )r> � site_optionsrR r0 rq r r/ r1 rC rD �edgesr� � combinations�verticesr� rp � site_dnstrr� r r; r ) rE r� �bridges_requiredr� �g� dot_edges�edger� r� �verify_propertiesrU r) r) r* r o s( � � �zKCC.setup_graphc C sL | � |||||�}|st�d|j � dS t�d|j|d jf � |d S )a� Get a bridghead DC for a site. Part of MS-ADTS 6.2.2.3.4.4 :param site: site object representing for which a bridgehead DC is desired. :param part: crossRef for NC to replicate. :param transport: interSiteTransport object for replication traffic. :param partial_ok: True if a DC containing a partial replica or a full replica will suffice, False if only a full replica will suffice. :param detect_failed: True to detect failed DCs and route replication traffic around them, False to assume no DC has failed. :return: dsa object for the bridgehead DC or None z"get_bridgehead FAILED: sitedn = %sNz'get_bridgehead: sitedn = %s bhdn = %sr )�get_all_bridgeheadsr! � DEBUG_MAGENTAr0 � DEBUG_GREENr� )rE rp r� r] � partial_ok� detect_failed�bhsr) r) r* �get_bridgehead� s ���zKCC.get_bridgeheadc C s< g }|j dkrtd|j f ��t|j� |j�� D ]k}|�� }t|j�dkr,||jvr,q| j� |�rH|� |�\} } } | r@| rA|sAq|� |j �} n|� |j �} | du sX| � � rY|sYq| j�� rm| durm| �� rm|�tj�smq| �||�rxtd� qtd|j � |�|� q|�� r�|jtt�d� nt � |� t � |� |S )a� Get all bridghead DCs on a site satisfying the given criteria Part of MS-ADTS 6.2.2.3.4.4 :param site: site object representing the site for which bridgehead DCs are desired. :param part: partition for NC to replicate. :param transport: interSiteTransport object for replication traffic. :param partial_ok: True if a DC containing a partial replica or a full replica will suffice, False if only a full replica will suffice. :param detect_failed: True to detect failed DCs and route replication traffic around them, FALSE to assume no DC has failed. :return: list of dsa object for available bridgehead DCs rK z7get_all_bridgeheads has run into a non-IP transport! %rr Nzbridgehead is failedzfound a bridgehead: %s��key) rU r r r� rn �get_parent_dnstrr� �bridgehead_listr> r �should_be_presentr r r r< r� � is_default�is_minimum_behaviorr �DS_DOMAIN_FUNCTION_2008r� r r� r� � is_random_bridgehead_disabled�sortr r+ �random�shuffler! � DEBUG_YELLOW) rE rp r� r] r9 r: r; r� �pdnstrr� r� �partial�repr) r) r* r6 � s@ � zKCC.get_all_bridgeheadsc C s" |sdS | j jd@ r dS | �|�S )ad Determine whether a given DC is known to be in a failed state :param dsa: the bridgehead to test :param detect_failed: True to really check, False to assume no failure :return: True if and only if the DC should be considered failed Here we DEPART from the pseudo code spec which appears to be wrong. It says, in full: /***** BridgeheadDCFailed *****/ /* Determine whether a given DC is known to be in a failed state. * IN: objectGUID - objectGUID of the DC's nTDSDSA object. * IN: detectFailedDCs - TRUE if and only failed DC detection is * enabled. * RETURNS: TRUE if and only if the DC should be considered to be in a * failed state. */ BridgeheadDCFailed(IN GUID objectGUID, IN bool detectFailedDCs) : bool { IF bit NTDSSETTINGS_OPT_IS_TOPL_DETECT_STALE_DISABLED is set in the options attribute of the site settings object for the local DC's site RETURN FALSE ELSEIF a tuple z exists in the kCCFailedLinks or kCCFailedConnections variables such that z.UUIDDsa = objectGUID, z.FailureCount > 1, and the current time - z.TimeFirstFailure > 2 hours RETURN TRUE ELSE RETURN detectFailedDCs ENDIF } where you will see detectFailedDCs is not behaving as advertised -- it is acting as a default return code in the event that a failure is not detected, not a switch turning detection on or off. Elsewhere the documentation seems to concur with the comment rather than the code. F� )r> r, r� )rE r� r: r) r) r* r� s ( zKCC.is_bridgehead_failedc C s* | � |||| d�} tdd� | D ��} t�dt| �dd� | D �f � | � |||| d�} |�� r4| �|� t�dt| �dd� | D �f � | D ]�}|j�� D ]�}| � |j �}|d u rZqMt� d |j � |� � �r>|�� �s>|j|jk�r>|�� s�|�|�s�||_|�d � |�� r�|�� r�|tj@ d kr�| jtjtjB M _|�d � n|tj@ d kr�| jtjtjB O _|�d � |� � r�|tj @ d kr�| jtj M _|�d � n|tj @ d kr�| jtj O _|�d � |� � �r|tj @ d k�r| jtj! M _|�d � n|tj @ d k�r| jtj!O _|�d � | j"�s$|�� �r8|j#�r/t$�%d | � |j&| j'd d� qM|�&| j'� qMqFd }| D ]J}|j�� D ]A}| � |j �}|d u �rZ�qKt� d|j � |� � �rn|j|jk�r�|�� �s�| �(|| ��s�| �(|| ��s�|d7 }| j)�*|� �qK�qDt�+d| � t,d| j)f � |d k�rtj-}|tj@ d k�r�|tjtjB O }|tj @ d k�r�|tj O }|tj @ d k�r�|tj!O }t.d| j/j � tj0tj1B }|�2||||j |�}| j"�s�|�� �r|j3�r�t$�%d| � |j&| j'd d� n|�&| j'� | j)�*|� d S d S )a� Create an nTDSConnection object as specified if it doesn't exist. Part of MS-ADTS 6.2.2.3.4.5 :param part: crossRef object for the NC to replicate. :param rbh: nTDSDSA object for DC to act as the IDL_DRSGetNCChanges server (which is in a site other than the local DC's site). :param rsite: site of the rbh :param transport: interSiteTransport object for the transport to use for replication traffic. :param lbh: nTDSDSA object for DC to act as the IDL_DRSGetNCChanges client (which is in the local DC's site). :param lsite: site of the lbh :param link_opt: Replication parameters (aggregated siteLink options, etc.) :param link_sched: Schedule specifying the times at which to begin replicating. :partial_ok: True if bridgehead DCs containing partial replicas of the NC are acceptable. :param detect_failed: True to detect failed DCs and route replication traffic around them, FALSE to assume no DC has failed. Fc s s � | ]}|j |fV qd S rd �r� rf r) r) r* ri ^ s � z(KCC.create_connection.<locals>.<genexpr>zrbhs_all: %s %sc S � g | ]}|j �qS r) rN rf r) r) r* � <listcomp>a � z)KCC.create_connection.<locals>.<listcomp>zlbhs_all: %s %sc S rO r) rN rf r) r) r* rP m rQ Nz rdsa is %sTr r� r� zround 2: rdsa is %sr$ zvalid connections %dzkept_connections: %sznew connection, KCC dsa: %sr� )4r6 �dictr! � DEBUG_GREYr� r� r� r� rn r4 r� r� r� r� r� r� rq �is_user_owned_schedule�is_equivalent_scheduler� � set_modified�is_override_notify_default� is_use_notifyr �NTDSSITELINK_OPT_USE_NOTIFYr� r� r� �is_twoway_sync� NTDSSITELINK_OPT_TWOWAY_SYNCr� �!is_intersite_compression_disabled�$NTDSSITELINK_OPT_DISABLE_COMPRESSIONr� rB r� r r� r� r? r� r: r� r& r �NTDSCONN_OPT_IS_GENERATEDr r< � SYSTEM_FLAG_CONFIG_ALLOW_RENAME� SYSTEM_FLAG_CONFIG_ALLOW_MOVE�new_connectionr� )rE r� �rbh�rsiter] �lbh�lsite�link_opt� link_schedr9 r: �rbhs_all� rbh_table�lbhs_all�ldsar� �rdsa�valid_connections�opt� system_flagsr) r) r* �create_connectionA s � � � � �� ��� � �� � ��� � ��� ��q � � �� � �� � � �zKCC.create_connectionc C s� g |_ g |_d}||jv r@t| jj�}| �|j|j| j|� � |�}|du r4|j� � r1|j � |� nd}n |j � |� |j� |� |j � d� |j� d� |S )a~ Build a Vertex's transport lists Each vertex has accept_red_red and accept_black lists that list what transports they accept under various conditions. The only transport that is ever accepted is IP, and a dummy extra transport called "EDGE_TYPE_ALL". Part of MS-ADTS 6.2.2.3.4.3 -- ColorVertices :param vertex: the remote vertex we are thinking about :param local_vertex: the vertex relating to the local site. :param graph: the intersite graph :param detect_failed: whether to detect failed links :return: True if some bridgeheads were not found FNT� EDGE_TYPE_ALL) �accept_red_red� accept_black�connected_verticesrR r0 rq r< rp r� �is_black� is_rodc_siter� )rE �vertex� local_vertex�graphr: � found_failed�t_guid�bhr) r) r* �add_transports= s$ � zKCC.add_transportsc C s� d}d}t d|j|f � t| j|�}|�� |jD ]}|�� | �||||�r*d}q|�� r3||fS t|| j|j d�\}} t d|j| f � | dkrMd}|� � } | j } t d| � |D ]�} | j rk| jd j| ju rkq\| jd j| ju r{| jd j} n| jd j} | | ju r�t d � q\| �| || | |�}|d u r�q\| j�� r�| j}| j}n | j}| �||| | |�}|d u r�t�d � d S t d || f � t d| jf � t�d||df � | j}|d u r�d}d }n|j}|j}| �||| | ||||| |� q\||fS )a1 Create intersite NTDSConnections as needed by a partition Construct an NC replica graph for the NC identified by the given crossRef, then create any additional nTDSConnection objects required. :param graph: site graph. :param part: crossRef object for NC. :param detect_failed: True to detect failed DCs and route replication traffic around them, False to assume no DC has failed. Modifies self.kept_connections by adding any connections deemed to be "in use". :return: (all_connected, found_failed_dc) (all_connected) True if the resulting NC replica graph connects all sites that need to be connected. (found_failed_dc) True if one or more failed DCs were detected. TFz8create_connections(): enter partdn=%s detect_failed=%s)r* z%s Number of components: %dr$ z edge_list %sr zrsite is my_siteNzDISASTER! lbh is None)FTzlsite: %s rsite: %sz vertices %szbridgeheads %s %s %szF----------------------------------------------------------------------)r r r r> � color_vertexr/ r} �is_whiter r� ru r0 r r) rp r< r< r� r! r& � DEBUG_BLUE� site_linkr� r� rp )rE ry r� r: r� rz � my_vertex�v� edge_list� n_componentsr9 r] r� rc rb re rd rb rf rg r) r) r* �create_connectionso s� � � �� � � �zKCC.create_connectionsc C s~ d}t � | _| j�� D ]1}|�� sq |�� rq | �|�}d}| �||d�\}}td||f � |s<d}|r<| �||d� q |S )a� Create NTDSConnections as necessary for all partitions. Computes an NC replica graph for each NC replica that "should be present" on the local DC or "is present" on any DC in the same site as the local DC. For each edge directed to an NC replica on such a DC from an NC replica on a DC in another site, the KCC creates an nTDSConnection object to imply that edge if one does not already exist. Modifies self.kept_connections - A set of nTDSConnection objects for edges that are directed to the local DC's site in one or more NC replica graphs. :return: True if spanning trees were created for all NC replica graphs, otherwise False. TFz0with detect_failed: connected %s Found failed %s) r8 r: r. rn r� � is_foreignr r� r )rE r� r� ry rz � connectedr) r) r* � create_intersite_connections� s* ���z KCC.create_intersite_connectionsc C s� | j }| j}d}td� | jr|j| j|dd� n |j| j|dd� |�� r.td| � |S |�� s:td| � |S | �|� | � � }td| � |S )am Generate the inter-site KCC replica graph and nTDSConnections As per MS-ADTS 6.2.2.3. If self.readonly is False, the connections are added to self.samdb. Produces self.kept_connections which is a set of NTDS Connections that should be kept during subsequent pruning process. After this has run, all sites should be connected in a minimum spanning tree. :param ping: An oracle function of remote site availability :return (True or False): (True) if the produced NC replica graph connects all sites that need to be connected Tzintersite(): enterr� Fz+intersite(): exit disabled all_connected=%dz+intersite(): exit not istg all_connected=%dz"intersite(): exit all_connected=%d) r< r> r rB � select_istgr? � is_intersite_topology_disabledr� r' r� )rE r� r� �mysiter� r) r) r* � intersite% s* �� z KCC.intersiteTc s� | j �� sdS | j j�� }dd� |D �� � fdd�|D �}|r@� rB� D ]}|d }|j|_|j|_d|_q#| j j| j|d� dS dS dS )zoUpdates the RODC NTFRS connection object. If the local DSA is not an RODC, this does nothing. Nc S s g | ]}|� � r|�qS r) )r� rf r) r) r* rP t s z.KCC.update_rodc_connection.<locals>.<listcomp>c s g | ]}|� vr|�qS r) r) rf ��ro_connectionsr) r* rP u s �r Tr� ) r< r� r� rn r� r� r� r� r? )rE r� �all_connections�rw_connections�conr� r) r� r* �update_rodc_connection` s �zKCC.update_rodc_connectionc C sF d} |d|| d| d krn|d }q|d }|dk r!|S dS )am Find the maximum number of edges directed to an intrasite node The KCC does not create more than 50 edges directed to a single DC. To optimize replication, we compute that each node should have n+2 total edges directed to it such that (n) is the smallest non-negative integer satisfying (node_count <= 2*(n*n) + 6*n + 7) (If the number of edges is m (i.e. n + 2), that is the same as 2 * m*m - 2 * m + 3). We think in terms of n because that is the number of extra connections over the double directed ring that exists by default. edges n nodecount 2 0 7 3 1 15 4 2 27 5 3 43 ... 50 48 4903 :param node_count: total number of nodes in the replica graph The intention is that there should be no more than 3 hops between any two DSAs at a site. With up to 7 nodes the 2 edges of the ring are enough; any configuration of extra edges with 8 nodes will be enough. It is less clear that the 3 hop guarantee holds at e.g. 15 nodes in degenerate cases, but those are quite unlikely given the extra edges are randomly arranged. :param node_count: the number of nodes in the site "return: The desired maximum number of connections r Tr� � � r$ �2 r) )rE � node_count�nr) r) r* �intrasite_max_node_edges� s # �z KCC.intrasite_max_node_edgesc " s� |� |�\}}}t�dd| d| d| d| d| d| � |s1t�d|j � d S t||j�} | ��j� || _|| _ |� | � g } �j j � � D ]G} |j| jvrYqP| j|j } | �� rdqP| �� siqP| �� sq| |u rrqP|ry| �� syqP|r�|s�|jtjkr�| �tj�s�qP|r���| �r�qP| �| � qP|rj j � � D ]6} |j| jvr�q�| j|j } | �� s�q�| �� s�q�| �� s�| |u r�q�|r�| �� s�q�|rш�| �r�q�| �| � q�| �| � | jd d � d � t | �}�� |�}g }| D ] }t |j |�}|�|� q�d }||d k �rK| | �� �r| |d �� �r$||d � | | j � | |d �� �r4| | �� �r@|| � | |d j � |d }||d k �s| |d �� �r[| d �� �rg|d � | |d j � | d �� �rw| |d �� �r�||d � | d j � t!dt | � � t!d�"dd� | D ��� �j#d u�o��j}�j$�s�|�rg }t%� }|D ] }|�&|j'� |j(D ]}|�||j'f� |�&|� �q��q�d}t)d||d|j*t+|j |jf |t!�j$�j#dd� t%�fdd�|D ��� � fdd�|D �}d}t)d |� d|j*t+|j |jf |t!�j$�j#dd� |D ]"} �j j | j' } | j,� � D ]} | j-} | �j j v �r7| � | � �q&�qt!d d �"d d� | D �� � t!d d �"d!d� |D �� � |D ]��|d"k�r���.� �s��fd#d�|D �} t�/d$�j'|t |�t | �f � t!d%d&d� | D � � | �r���.� �s�t0�1| �}!t!d'|!j' � �� |!j'��s�t�d(|!j' � | �2|!� | �r���.� �r�nt3d)�j'|t �j(��j4f � t3d*� � �j'|j'k�r݈�5|�j6� �qY�j$�s�|�rWg }t%� }|D ] }|�&|j'� |j(D ]}|�||j'f� |�&|� �q��q�d}t)d+||d|j*t+|j |jf |t!�j$�j#dd� t%�fd,d�|D ��� � fd-d�|D �}d}t)d.|� d|j*t+|j |jf |t!�j$�j#dd� d S d S )/aT Create an intrasite graph using given parameters This might be called a number of times per site with different parameters. Based on [MS-ADTS] 6.2.2.2 :param site_local: site for which we are working :param dc_local: local DC that potentially needs a replica :param nc_x: naming context (x) that we are testing if it "should be present" on the local DC :param gc_only: Boolean - only consider global catalog servers :param detect_stale: Boolean - check whether links seems down :return: None z"construct_intrasite_graph(): enterz gc_only=%dz detect_stale=%dz needed=%sz ro=%sz partial=%sz %szH%s lacks 'should be present' status, aborting construct_intrasite_graph!Nc S s t | j�S rd )r � rep_dsa_guid)rL r) r) r* �<lambda>� s z/KCC.construct_intrasite_graph.<locals>.<lambda>r= r r$ zr_list is length %s� c s s � | ] }t |j|jf�V qd S rd )rR r� � rep_dsa_dnstrrf r) r) r* ri � s � �z0KCC.construct_intrasite_graph.<locals>.<genexpr>�r� �intrasite_pre_ntdsconz %s__%s__%sT)r* r+ r! rC rD r) c 3 �" � | ] }� � |��� s|V qd S rd �r6 r� rf rs r) r* ri � � � �c �( g | ]\}}|� v r|� v r||f�qS r) r) �rg r� r� ��rw_dot_verticesr) r* rP � � �z1KCC.construct_intrasite_graph.<locals>.<listcomp>)r� � directed_double_ring_or_small�intrasite_rw_pre_ntdsconz reps are: %sz c s � � | ]}|j V qd S rd )r� rf r) r) r* ri � � � z dsas are: %sc s r� rd rN rf r) r) r* ri � r� � c s$ g | ]}|� ur|j � jvr|�qS r) )r� � edge_fromrf )�tnoder) r* rP � s �zDlooking for random link for %s. r_len %d, graph len %d candidates %dz candidates %sc S rO r) rN rf r) r) r* rP � rQ ztrying to add candidate %szcould not add %sz0not adding links to %s: nodes %s, links is %s/%sz%s�intrasite_post_ntdsconc 3 r� rd r� rf rs r) r* ri ' r� c r� r) r) r� r� r) r* rP ) r� �intrasite_rw_post_ntdscon)7rA r! rI r& r r �identify_by_basednr? � rep_partial�rep_ro�add_needed_replicar> rm rn r r� r r% �nc_typer �domainrC r rD r� r� r rF r� r� r r� � add_edge_fromr �joinrD rC r8 r� r� r� r r0 r r� r� �has_sufficient_edgesr� rG �choice�remover � max_edges�add_connections_from_edgesr0 )"rE � site_local�dc_local�nc_x�gc_only� detect_staler� r� rK �l_of_x�r_list�dc_s�f_of_x�p_of_x�r_len�max_node_edges� graph_listrL �node�i� do_dot_filesr3 � dot_vertices�v1�v2r5 � rw_dot_edges�rw_verify_propertiesrw r� r� �remote� candidates�otherr) )r� rE r� r* �construct_intrasite_graph� sz #������� � � ��� �� �� �� ���� � ��� � ��z KCC.construct_intrasite_graphc C s� | j }td� | j}|�� rdS |�� }|j�� D ] }|jr&t� d| � q| j � � D ] \}}| � |||d|� |j�� D ] }|jrJt� d| � q>q,|j�� D ] }|jr]t�d| � qQ| j � � D ]\}}|�� rt| � |||d|� qc|j�� D ] }|jr�t� d| � qz| j � � D ] \}}| � |||dd� q�|j�� D ] }|jr�t�d| � q�| j � � D ]\}}|�� r�| � |||dd� q�| �|� dS )a� Generate the intrasite KCC connections As per MS-ADTS 6.2.2.2. If self.readonly is False, the connections are added to self.samdb. After this call, all DCs in each site with more than 3 DCs should be connected in a bidirectional ring. If a site has 2 DCs, they will bidirectionally connected. Sites with many DCs may have arbitrary extra connections. :return: None zintrasite(): enterNr� FT)r< r r> � is_intrasite_topology_disabled�is_detect_stale_disabledr� rn r� r! � DEBUG_CYANr. �itemsr� r� rI � is_configr& r� )rE r� r� r� r� �partdnr� r) r) r* � intrasite7 s` � ���� �� � �� ��z KCC.intrasitec C sb | � � | �� | �� | �� | �� | �� g }| j�� D ]}|�dd� |j �� D �� q |S )a Compile a comprehensive list of DSA DNs These are all the DSAs on all the sites that KCC would be dealing with. This method is not idempotent and may not work correctly in sequence with KCC.run(). :return: a list of DSA DN strings. c S s g | ] }|j �d dd��qS )zCN=NTDS Settings,r{ r$ )r� �replace)rg r� r) r) r* rP � s �z!KCC.list_dsas.<locals>.<listcomp>) rt r� rw r� r^ rc r/ rn �extendrm )rE �dsasrp r) r) r* � list_dsas� s �z KCC.list_dsasc C sb |s| j du r/z t|t� ||d�| _ W dS tjy. } z |j\}}td||f ��d}~ww dS )aS Load the database using an url, loadparm, and credentials If force is False, the samdb won't be reloaded if it already exists. :param dburl: a database url. :param lp: a loadparm object. :param creds: a Credentials object. :param force: a boolean indicating whether to overwrite. N)�url� session_info� credentials�lpz#Unable to open sam database %s : %s)r? r r r rP rQ r )rE �dburlr� �creds�force�e1�numr[ r) r) r* � load_samdb� s � ����zKCC.load_samdbr) c C s� |o| j }|s| jdu rdS g }g }g }g }| j�� D ]7}|�|j� |�� r-|�d� n|�d� |j�� D ]} | �� rC|�d� n|�d� |�| j |jf� q7qt |||| j |t || jd||d� dS )z�Helper function to plot and verify NTDSConnections :param basename: an identifying string to use in filenames and logs. :param verify_properties: properties to verify (default empty) Nz#cc0000z#0000cc�red�blueT) r/ r* r+ r! rC rD r) � edge_colors� vertex_colors) rC rD r2 rn r� r� r� r� r� r� r r; r ) rE �basenamer5 rC r3 r� � edge_colours�vertex_coloursr� r� r) r) r* �plot_all_connections� s2 � �zKCC.plot_all_connectionsc " s� � j du rtd|f � � j|||dd� |r � j �d| � �z5� �� � �� � �� � �� � �� � � � � j sB� j du�r.i }� j � � D ]�|�dd� �j�� D �� qI� �d� g } � j�� \} } | �� D ]\} } td | � | �� jj| f� qktd | d � jd t� j � j d � g } � j � � D ]6��j� � D ].}|�� \} } | �� D ]!\}}|jD ]}td| � t|j�}|| }| �|j|f� q�q�q�q�td| d � jd t� j � j d � g } g }� j � � D ]7}ddl m } |j � d�}d||��!� dd� }t"�#|j$d�D ]\}}| �|d |d f� |�|� �qq�d}td| d� j|t� j � j |d� |�rO� j%j� � D ]}t&� fdd�|j'�� D ��|_'�q7� �d� |�ry� j � � D ] ��j� � D ]}t&� �fd d�|j'�� D ��|_'�q^�qW� �d � |�r�d d � } nd} � �(| � � �)� � �*| �} � �+| � � �,� � �-� � �.� � j �s�� j du�rS� �d d� t/�0d!t1|� � g } g } � jj} � j�� \} } | �� D ](\} } | jD ] }t|j�}!| �| ||! f� | �dt| j2�dd� � �qՐq�td"| d � jd t� j � j | d� g } � j � � D ]2��j� � D ])}|�� \} } | � � D ]} | jD ]}t|j�}|| }| �|j|f� �q&�q!�q�qtd#| d � jd t� j � j d � W dS W dS � )$a� Perform a KCC run, possibly updating repsFrom topology :param dburl: url of the database to work with. :param lp: a loadparm object. :param creds: a Credentials object. :param forced_local_dsa: pretend to be on the DSA with this dn_str :param forget_local_links: calculate as if no connections existed (boolean, default False) :param forget_intersite_links: calculate with only intrasite connection (boolean, default False) :param attempt_live_connections: attempt to connect to remote DSAs to determine link availability (boolean, default False) :return: 1 on error, 0 otherwise Nz$samdb is None; let's load it from %sF)r� zCN=NTDS Settings,%sc s s" � | ] \}}t |j�|fV qd S rd re )rg r\ r� r) r) r* ri � s � �zKCC.run.<locals>.<genexpr>� dsa_initialzc_rep %s�dsa_repsFrom_initialTr) r( zrep %s�dsa_repsFrom_initial_allr )�md5r} �#r� r� r$ r� �dsa_sitelink_initial)r) r* r+ r! rC rD r� c 3 s2 � | ]\}}|� � s|j� jjvr||fV qd S rd )r� r� r> rm �rg �kr� rs r) r* ri 2 s � �����dsa_forgotten_localc 3 s. � | ]\}}�� j u r|�� r||fV qd S rd )r> r� r� �rE rp r) r* ri < s � ����dsa_forgotten_allc S s0 z t �|| j| j� W dS t jy Y dS w )NFT)r �drsuapi_connectr� r� � drsException)rE �dnsnamer) r) r* r� F s ��zKCC.run.<locals>.ping� dsa_finalzthere are %d dsa guids�dsa_repsFrom_final�dsa_repsFrom_final_all)3r? r r� �set_ntds_settings_dnrt r� rw r� r^ rc rC rD r/ rn rl rm r� r� r< r� r r� r� r r; r� rR r� r1 �hashlibr� r\ �encode� hexdigestr� r. � site_listr> rR r� r� r� r� r� r% r� r� r! r7 r� �nc_guid)"rE r� r� r� �forced_local_dsa�forget_local_links�forget_intersite_links�attempt_live_connections� guid_to_dnstrr3 � current_reps� needed_repsr\ r r� ro rL r� r& �dsa_dn� dot_colours�linkr� �tmp_str�colourr� r� r+ r� r� r� �my_dnstrr �guid_strr) r� r* �run� s � � � ��� � �� � �� �� �� �����*�zKCC.runc C sL z t �||||�| _W dS t jy% } z t�|� W Y d}~dS d}~ww )aI Import relevant objects and attributes from an LDIF file. The point of this function is to allow a programmer/debugger to import an LDIF file with non-security relevent information that was previously extracted from a DC database. The LDIF file is used to create a temporary abbreviated database. The KCC algorithm can then run against this abbreviated database for debug or test verification that the topology generated is computationally the same between different OSes and algorithms. :param dburl: path to the temporary abbreviated db to create :param lp: a loadparm object. :param ldif_file: path to the ldif file to import :param forced_local_dsa: perform KCC from this DSA's point of view :return: zero on success, 1 on error Nr$ r )r � ldif_to_samdbr? � LdifErrorr �critical)rE r� r� � ldif_filer r� r) r) r* � import_ldif� s �� ��zKCC.import_ldifc C sN z t �| j||||� W dS t jy& } z t�|� W Y d}~dS d}~ww )a- Save KCC relevant details to an ldif file The point of this function is to allow a programmer/debugger to extract an LDIF file with non-security relevent information from a DC database. The LDIF file can then be used to "import" via the import_ldif() function this file into a temporary abbreviated database. The KCC algorithm can then run against this abbreviated database for debug or test verification that the topology generated is computationally the same between different OSes and algorithms. :param dburl: LDAP database URL to extract info from :param lp: a loadparm object. :param cred: a Credentials object. :param ldif_file: output LDIF file name to create :return: zero on success, 1 on error Nr$ r )r �samdb_to_ldif_filer? r r r )rE r� r� r� r r� r) r) r* � export_ldif� s �� ��zKCC.export_ldif)FFFNrd )T)F)r) )NFFF),�__name__� __module__� __qualname__�__doc__rF r^ rc rj rt rw r� r� r� r� r� r� r� r� r� r� r� r r r% r' r r< r6 r� rp r} r� r� r� r� r� r� r� r� r� r� r r r r) r) r) r* r- N sn �*# : 4!49 P ' ( Y3 }2|: ;$- P # � ; r- )4rG r� � functoolsr r� �sambar r r r r � samba.authr � samba.samdbr � samba.dcerpcr r �samba.kcc.kcc_utilsr r r r r r r r r r r �samba.kcc.graphr � samba.ndrr �samba.kcc.graph_utilsr � samba.kccr r r r �samba.kcc.debugr r r r! � samba.commonr" r+ r, �objectr- r) r) r) r* �<module> s0
Simpan