HEX

File: //lib/python3/dist-packages/samba/kcc/__pycache__/__init__.cpython-310.pyc
o

�/a���@sPddlZddlZddlmZddlZddlmZmZddlmZm	Z	m
Z
ddlmZddl
mZddlmZmZddlmZmZmZmZdd	lmZmZmZmZdd
lmZmZmZddlmZddl m!Z!dd
l"m#Z#ddl$m%Z%ddlm&Z&m'Z'ddlm(Z(ddl)m*Z*m+Z+m,Z,ddl$m-Z-ddl.m/Z/dd�Z0dd�Z1Gdd�de2�Z3dS)�N)�
cmp_to_key)�unix2nttime�nttime2unix)�ldb�dsdb�	drs_utils)�system_session)�SamDB)�drsuapi�misc)�Site�	Partition�	Transport�SiteLink)�	NCReplica�NCType�
nctype_lut�	GraphNode)�
RepsFromTo�KCCError�KCCFailedObject)�convert_schedule_to_repltimes)�ndr_pack)�verify_and_dot)�ldif_import_export)�setup_graph�get_spanning_tree_edges)�Vertex)�DEBUG�DEBUG_FN�logger)�debug)�cmpcCs>|��r
|��s
dS|��s|��rdStt|j�t|j��S)aHelper to sort DSAs by guid global catalog status

    GC DSAs come before non-GC DSAs, other than that, the guids are
    sorted in NDR form.

    :param dsa1: A DSA object
    :param dsa2: Another DSA
    :return: -1, 0, or 1, indicating sort order.
    ����)�is_gcr"r�dsa_guid)�dsa1�dsa2�r)�4/usr/lib/python3/dist-packages/samba/kcc/__init__.py�sort_dsa_by_gc_and_guid2s

r+cCsdS)z�Can the KCC use SMTP replication?

    Currently always returns false because Samba doesn't implement
    SMTP transfer for NC changes between DCs.

    :return: Boolean (always False)
    Fr)r)r)r)r*�is_smtp_replication_availableCsr,c@sleZdZdZ		dVdd�Zdd�Zdd	�Zd
d�Zdd
�Zdd�Z	dd�Z
dd�ZdWdd�Zdd�Z
dd�Zdd�Zdd�Zdd�Zd d!�Zd"d#�Zd$d%�Zd&d'�Zd(d)�ZdWd*d+�ZdWd,d-�Zd.d/�Zd0d1�Zd2d3�Zd4d5�Zd6d7�Zd8d9�Zd:d;�Zd<d=�Z d>d?�Z!dXdAdB�Z"dCdD�Z#dEdF�Z$dGdH�Z%dIdJ�Z&dYdKdL�Z'dZdNdO�Z(			d[dPdQ�Z)dWdRdS�Z*dTdU�Z+dS)\�KCCa;The Knowledge Consistency Checker class.

    A container for objects and methods allowing a run of the KCC.  Produces a
    set of connections in the samdb for which the Distributed Replication
    Service can then utilize to replicate naming contexts

    :param unix_now: The putative current time in seconds since 1970.
    :param readonly: Don't write to the database.
    :param verify: Check topological invariants for the generated graphs
    :param debug: Write verbosely to stderr.
    :param dot_file_dir: write diagnostic Graphviz files in this directory
    FNcCs�i|_i|_d|_i|_i|_i|_|jj|_|jj|_i|_	t
�|_t
�|_d|_
d|_d|_d|_d|_||_t|�|_||_||_||_||_dS)z�Initializes the partitions class which can hold
        our local DCs partitions or all the partitions in
        the forest
        N)�
part_table�
site_table�ip_transport�sitelink_table�dsa_by_dnstr�dsa_by_guid�get�get_dsa_by_guidstr�get_dsa�kcc_failed_links�set�kcc_failed_connections�kept_connections�my_dsa_dnstr�my_dsa�
my_site_dnstr�my_site�samdb�unix_nowr�nt_now�readonly�verifyr!�dot_file_dir)�selfr@rBrCr!rDr)r)r*�__init__[s,



zKCC.__init__c
Cs�z|jjd|j��tjdd�}Wntjy)}z|j\}}td|��d}~ww|D].}t|j	�}t
|�}|�|j�|jdkrF||_
q,|jdkrQt�d�q,t�d	|jf�q,|j
durdtd
��dS)z�Loads the inter-site transport objects for Sites

        :return: None
        :raise KCCError: if no IP transport is found
        �$CN=Inter-Site Transports,CN=Sites,%sz (objectClass=interSiteTransport)��scope�
expressionz+Unable to find inter-site transports - (%s)N�IP�SMTPz2Samba KCC is ignoring the obsolete SMTP transport.z3Samba KCC does not support the transport called %r.z(there doesn't seem to be an IP transport)r?�search�get_config_basednr�
SCOPE_SUBTREE�LdbError�argsr�str�dnr�load_transport�namer0r r!�warning)rE�res�e2�enum�estr�msg�dnstr�	transportr)r)r*�load_ip_transport�s8�
�
���


�
�zKCC.load_ip_transportc
C�z|jjd|j��tjdd�}Wntjy)}z|j\}}td|��d}~ww|D]}t|j	�}||j
vr9q,t|�}|�|j�||j
|<q,dS)zyLoads the inter-site siteLink objects

        :return: None
        :raise KCCError: if site-links aren't found
        rGz(objectClass=siteLink)rHz*Unable to find inter-site siteLinks - (%s)N)
r?rMrNrrOrPrQrrRrSr1r�
load_sitelink)rErW�e3rYrZr[r\�sitelinkr)r)r*�load_all_sitelinks�s(�
�
��

�zKCC.load_all_sitelinkscCsjt||j�}|�|j�t|j�}||jvr0||j|<|j�|j	�|j
�dd�|j	��D��|j|S)z�Helper for load_my_site and load_all_sites.

        Put all the site's DSAs into the KCC indices.

        :param dn_str: a site dn_str
        :return: the Site object pertaining to the dn_str
        css�|]
}t|j�|fVqdS�N�rRr&��.0�xr)r)r*�	<genexpr>�s��z KCC.load_site.<locals>.<genexpr>)rr@�	load_siter?rR�	site_guidr/r2�update�	dsa_tabler3�values)rE�dn_str�site�guidr)r)r*rj�s


�
z
KCC.load_sitecCs,d|j��|j��f|_|�|j�|_dS)zGLoad the Site object for the local DSA.

        :return: None
        zCN=%s,CN=Sites,%sN)r?�server_site_namerNr=rjr>�rEr)r)r*�load_my_site�s
�zKCC.load_my_sitec
Csvz|jjd|j��tjdd�}Wntjy)}z|j\}}td|��d}~ww|D]}t|j	�}|�
|�q,dS)z|Discover all sites and create Site objects.

        :return: None
        :raise: KCCError if sites can't be found
        zCN=Sites,%sz(objectClass=site)rHzUnable to find sites - (%s)N)r?rMrNrrOrPrQrrRrSrj)rErW�e4rYrZr[�sitestrr)r)r*�load_all_sites�s �
�
��
�zKCC.load_all_sitesc

Cs�d|j��}t�|j|�}z
|jj|tjdgd�}Wnbtjy}}zU|j\}}td|||f�z(|jjdtjdgd�}t�|j|ddd�	d��}|jj|tjdgd�}Wntjyr}z|j\}}t
d	|��d
}~wwWYd
}~nd
}~wwt|�dkr�t
d|����t
�|j���}	t
�|ddd�|	kr�t
d
��t|dj�|_|j�|j�|_|j|jvr�t�d|j�|j|j|j<|j|jt|jj�<d
Sd
S)z|Discover my nTDSDSA dn thru the rootDSE entry

        :return: None
        :raise: KCCError if DSA can't be found
        z	<GUID=%s>�
objectGUID)�baserI�attrszsSearch for dn '%s' [from %s] failed: %s. This typically happens in --importldif mode due to lack of module support.��
dsServiceNamer�utf8z Unable to find my nTDSDSA - (%s)Nr$zUnable to find my nTDSDSA at %sz>Did not find the GUID we expected, perhaps due to --importldifz�my_dsa %s isn't in self.dsas_by_dnstr: it must be RODC.
Let's add it, because my_dsa is special!
(likewise for self.dsa_by_guid))r?�
get_ntds_GUIDr�DnrM�
SCOPE_BASErPrQr�decoder�len�extended_strr�GUIDrRrSr;r>r6r<r2r!�DEBUG_DARK_YELLOWr3r&)
rE�dn_queryrSrW�e5rYrZ�service_name_res�e�	ntds_guidr)r)r*�load_my_dsa�s\
�
���
�
��������zKCC.load_my_dsac
Cr_)z�Discover and load all partitions.

        Each NC is inserted into the part_table by partition
        dn string (not the nCName dn string)

        :return: None
        :raise: KCCError if partitions can't be found
        zCN=Partitions,%sz(objectClass=crossRef)rHz Unable to find partitions - (%s)N)
r?rMrNrrOrPrQrrRrSr.r
�load_partition)rErW�e6rYrZr[�partstr�partr)r)r*�load_all_partitions5s(	�
�
��

�zKCC.load_all_partitionscCsi|_|j��\}}|��D]G}|jD]A}|j}|dkrqt|j�}|j}|j	}	|j
}
|j�|�}|durCt||||	|
�}||j|<qt
|j|�|_t|j|�|_|	|_qqt�}|durztd�|jD]}
||
j�rq|�|
�qd|
jd7_qdntd�|j�|�dS)z�Ensure the failed links list is up to date

        Based on MS-ADTS 6.2.2.1

        :param ping: An oracle function of remote site availability
        :return: None
        rNz6refresh_failed_links: checking if links are still downr$zdrefresh_failed_links: not checking live links because we
weren't asked to --attempt-live-connections)r7r<�get_rep_tablesrn�rep_repsFrom�consecutive_sync_failuresrR�source_dsa_obj_guid�last_success�last_attempt�	dns_name1r4r�max�
failure_count�min�time_first_failure�last_resultr8rr9�dns_name�add�difference_update)rE�ping�current�needed�replica�	reps_fromr�r&r�r�r��f�restore_connections�
connectionr)r)r*� refresh_failed_links_connectionsSsD	

���

�z$KCC.refresh_failed_links_connectionscCsT|j�t|j��}|r(|jdkr(t|j�}||jkrt�	d�|j|dkr(dSdS)aLCheck whether a link to a remote DSA is stale

        Used in MS-ADTS 6.2.2.2 Intrasite Connection Creation

        Returns True if the remote seems to have been down for at
        least two hours, otherwise False.

        :param target_dsa: the remote DSA object
        :return: True if link is stale, otherwise False
        rz_The last success time attribute for                                  repsFrom is in the future!i TF)
r7r4rRr&r�rr�r@r �error)rE�
target_dsa�failed_link�unix_first_failurer)r)r*�is_stale_link_connection�s
�

zKCC.is_stale_link_connectioncCsdSrdr)rsr)r)r*�(remove_unneeded_failed_links_connections�sz,KCC.remove_unneeded_failed_links_connectionscCsH|D]}|jdur!|jrt�tt����|_|j|_q|�	|j
�qdS)aTLoad or fake-load NTDSConnections lacking GUIDs

        New connections don't have GUIDs and created times which are
        needed for sorting. If we're in read-only mode, we make fake
        GUIDs, otherwise we ask SamDB to do it for us.

        :param connections: an iterable of NTDSConnection objects.
        :return: None
        N)rqrBrr�rR�uuid�uuid4rA�whenCreated�load_connectionr?)rE�connections�cn_connr)r)r*�_ensure_connections_are_loaded�s


��z"KCC._ensure_connections_are_loadedcCs>|jj��D]}|��}|durtd|j|f�d|_qdS)z�Find NTDS Connections that lack a remote

        I'm not sure how they appear. Let's be rid of them by marking
        them with the to_be_deleted attribute.

        :return: None
        Nz%s has phantom connection %sT)r<�
connect_tablern�get_from_dnstrr�
to_be_deleted)rEr��s_dnstrr)r)r*�_mark_broken_ntdsconn�s���zKCC._mark_broken_ntdsconnc
Cs"|j��rtd|j�dS|j}z
|�|j���Wnty+|��r)YdSYnwg}|j��D]#}|�	�}||jj
vrV|��pF|��}t
|j�}|�||||f�q3t|�dkr_dSt�|d�D])\}}|\}}}}|\}	}
}}|r�||
kr�|j|	jks�|j|	jkr�||kr�d|_qedS)aFind unneeded intrasite NTDS Connections for removal

        Based on MS-ADTS 6.2.2.4 Removing Unnecessary Connections.
        Every DC removes its own unnecessary intrasite connections.
        This function tags them with the to_be_deleted attribute.

        :return: None
        z>not doing ntdsconn cleanup for site %s, because it is disabledN�T)r>�is_cleanup_ntdsconn_disabledrr<r�r�rnr�is_ror�rm�is_generated�is_rodc_topologyrrq�appendr��	itertools�permutationsr�r�)
rE�mydsa�local_connectionsr�r��	removable�packed_guid�a�b�cn_conn2�s_dnstr2�packed_guid2�
removable2r)r)r*�_mark_unneeded_local_ntdsconn�sL
����
����z!KCC._mark_unneeded_local_ntdsconnc
Cs@|j��rdS|jj}g}|��D];}|j��D]3}|jrq|��}|dur'q||vrK|�|�}|dus8d|vrCt	�
d|�d|_q|�|||f�qq|�dd�|D��|D]D\}}}|�
�rf|��rgqY||jvry|�|d�sy|�|d�syqY|j}|j��D]}	||	jvr�|D]\}
}}||
ur�||	jvr�d|_q�q�qYdS)a(find unneeded intersite NTDS Connections for removal

        Based on MS-ADTS 6.2.2.4 Removing Unnecessary Connections. The
        intersite topology generator removes links for all DCs in its
        site. Here we just tag them with the to_be_deleted attribute.

        :return: None
        N�\0ADELz+DSA appears deleted, removing connection %sTcss�|]}|dVqdS)rNr)rfr)r)r*ri's�z8KCC._mark_unneeded_intersite_ntdsconn.<locals>.<genexpr>)r<r�r>rmrnr�r�r�r6r �infor�r�r�r�r:�is_bridgehead_failed�	dsa_dnstrr/�rw_dsa_table)
rE�
local_dsas�connections_and_dsas�dsa�cnr��from_dsa�to_dsa�
from_dnstrrp�cn2�to_dsa2�	from_dsa2r)r)r*�!_mark_unneeded_intersite_ntdsconnsT

���

�
�

���z%KCC._mark_unneeded_intersite_ntdsconncCs~|��s|jr7|j��D] }|jrt�d|�|jr"t�d|�|jr,t�d|�q|j	|j
dd�dS|�	|j
�dS)N�TO BE DELETED:
%s�TO BE ADDED:
%s�TO BE MODIFIED:
%sT��ro)r�rBr�rnr�r r��to_be_added�to_be_modified�commit_connectionsr?)rEr��connectr)r)r*�_commit_changes>s�zKCC._commit_changescCsF|��|��|j��r|r|��|jj��D]}|�|�qdS)z�Remove unneeded NTDS Connections once topology is calculated

        Based on MS-ADTS 6.2.2.4 Removing Unnecessary Connections

        :param all_connected: indicates whether all sites are connected
        :return: None
        N)	r�r�r<�is_istgr�r>rmrnr�)rE�
all_connectedr�r)r)r*�remove_unneeded_ntdsconnOs�zKCC.remove_unneeded_ntdsconnc
CsB|j}||jjv}t|j�}||jkr||_|jtj@dkr&|jtjO_|��r:|jtj	@dkr:|jtj	O_|sA|�
|�rQ|jtj@dkrQ|jtjO_|jt
j@dkrr|jt
j@dkrq|jtj@dkrq|jtjO_n|s�|jtj@dkr�|jtjO_|s�|jt
j@dkr�|jtj@dkr�|jtjO_|jt
j@dkr�|jtj@dkr�|jtjO_|��s�|jtj@dkr�|jtjO_|jtj@dkr�|jtjO_d|j|j��f}	|jtj@dkr�|jtjM_t��|_|j|	k�r|	|_|j dk�r|j!|	k�r|	|_!|�"��rt#d|�dSdS)a$Update an repsFrom object if required.

        Part of MS-ADTS 6.2.2.5.

        Update t_repsFrom if necessary to satisfy requirements. Such
        updates are typically required when the IDL_DRSGetNCChanges
        server has moved from one site to another--for example, to
        enable compression when the server is moved from the
        client's site to another site.

        The repsFrom.update_flags bit field may be modified
        auto-magically if any changes are made here. See
        kcc_utils.RepsFromTo for gory details.


        :param n_rep: NC replica we need
        :param t_repsFrom: repsFrom tuple to modify
        :param s_rep: NC replica at source DSA
        :param s_dsa: source DSA
        :param cn_conn: Local DSA NTDSConnection child

        :return: None
        rz%s._msdcs.%sr$zmodify_repsFrom(): %sN)$r�r>rmr�schedule�
replica_flagsr
�DRSUAPI_DRS_ADD_REF�!is_schedule_minimum_once_per_week�DRSUAPI_DRS_PER_SYNC�is_fsmo_role_owner�DRSUAPI_DRS_INIT_SYNC�optionsr�$NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT�NTDSCONN_OPT_USE_NOTIFY�DRSUAPI_DRS_NEVER_NOTIFY�*NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION�DRSUAPI_DRS_USE_COMPRESSION�NTDSCONN_OPT_TWOWAY_SYNC�DRSUAPI_DRS_TWOWAY_SYNC�
is_enabled�DRSUAPI_DRS_DISABLE_AUTO_SYNC�!DRSUAPI_DRS_DISABLE_PERIODIC_SYNCr&r?�forest_dns_name�DRSUAPI_DRS_MAIL_REPrr��transport_guidr��version�	dns_name2�is_modifiedr)
rE�n_rep�
t_repsFrom�s_rep�s_dsar�r��	same_site�times�nastrr)r)r*�modify_repsFromas�

��������
������������������?��
	
�zKCC.modify_repsFromcCsf|��r|��r
dS|��}|�|�}|durdS|�|j�}|dur1|��r1|��r/|��r1|SdS)a�If a connection imply a replica, find the relevant DSA

        Given a NC replica and NTDS Connection, determine if the
        connection implies a repsFrom tuple should be present from the
        source DSA listed in the connection to the naming context. If
        it should be, return the DSA; otherwise return None.

        Based on part of MS-ADTS 6.2.2.5

        :param n_rep: NC replica
        :param cn_conn: NTDS Connection
        :return: source DSA or None
        N)	r�r�r�r6�get_current_replica�nc_dnstr�
is_presentr��
is_partial)rErr�r�rrr)r)r*�get_dsa_for_implied_replica0s 
���zKCC.get_dsa_for_implied_replicac	Cs�d}|dur	|j}|��rd}|��rtd�dStd�|��\}}t�}|D]>}|r]||}|�|j�|jD]}t	j
t	jBt	jBt	j
Bt	jB}	|j|	krR|	|_q9|j|j|jd�q(||vrf|�|�q(tdt|�t|�t|�f�|r�td|�|D]}||=q�|��D]�}
|
�|j�|
�|j�|
jD]U}t|j�}|�|�}|dur�t�d	|�d|_q�|j}
|�|
�}|D]}|��s�nq�d|_q�|� |
j!�}|dus�|�"�r�|
��s�|�#�r�d|_q�|�$|
||||�q�|j%��D]O}|�&|
|�}|du�rq�|
jD]}t|j�}||�|�u�rd}n�q|du�r"q�t'|
j!�}|j(|_|� |
j!�}|�$|
||||�|�)��rE|
j�*|�q�|j�sM|�rr|
�+�}|�r[t�,d
|�|
�-�}|�rit�,d|�|
j|jdd�q�|
�|j�q�|�r~dS|��D]w}
|
�.|j�|
j/D]D}t|j�}|�|�}|du�r�t�d|�d|_�q�|j}
d
|
v�r�t�d|�d|_�q�|�|j0�}t|�dk�r͐q�d|_�q�|j�r�|
j/D]}|j�r�t�,d|��q�|
j1|jdd��q�|
�1|j��q�dS)a[Adjust repsFrom to match NTDSConnections

        This function adjusts values of repsFrom abstract attributes of NC
        replicas on the local DC to match those implied by
        nTDSConnection objects.

        Based on [MS-ADTS] 6.2.2.5

        :param current_dsa: optional DSA on whose behalf we are acting.
        :return: None
        FNTz;skipping translate_ntdsconn() because disabling flag is setztranslate_ntdsconn(): enterr�zcurrent %d needed %d delete %dzdeleting these reps: %sz'repsFrom source DSA guid (%s) not foundr�r�z%repsTo source DSA guid (%s) not foundr�z+repsTo source DSA guid (%s) appears deletedrzREMOVING REPS-TO: %s)2r<r��is_translate_ntdsconn_disabledrr�r8�
load_repsFromr?r�r
r�r�r��%DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING�DRSUAPI_DRS_NONGC_RO_REPr��commit_repsFromrBr�r�rrn�load_fsmo_rolesrRr�r5r rVr�r��get_connection_by_from_dnstrr�rrr
rr
r�rrr&rr��dumpstr_to_be_deletedr��dumpstr_to_be_modified�load_repsTo�
rep_repsTor;�
commit_repsTo)rE�current_dsar��current_rep_table�needed_rep_table�delete_repsr\�c_reprr�r�guidstrrr�r�r�r�text�t_repsTo�rtr)r)r*�translate_ntdsconnWs
����
�
�
�


�
�
��


�


�	



�
�

��zKCC.translate_ntdsconncCs"|durt�d�dStd�dS)a�Merge of kCCFailedLinks and kCCFailedLinks from bridgeheads.

        The KCC on a writable DC attempts to merge the link and connection
        failure information from bridgehead DCs in its own site to help it
        identify failed bridgehead DCs.

        Based on MS-ADTS 6.2.2.3.2 "Merge of kCCFailedLinks and kCCFailedLinks
        from Bridgeheads"

        :param ping: An oracle of current bridgehead availability
        :return: None
        Nz'merge_failed_links() is NOT IMPLEMENTEDz}skipping merge_failed_links() because it requires real network connections
and we weren't asked to --attempt-live-connections)r!�	DEBUG_REDr)rEr�r)r)r*�merge_failed_linksVszKCC.merge_failed_linksc
Cs�|jjd@dk}t|jj�}t||j||j|�}|js |j	durUg}|j
D]}t�|j
d�D]\}}|�|jj|jjf�q.q%d}	d|j}
t|
|d|j|	t|j|j	d�|S)	a�Set up an intersite graph

        An intersite graph has a Vertex for each site object, a
        MultiEdge for each SiteLink object, and a MutliEdgeSet for
        each siteLinkBridge object (or implied siteLinkBridge). It
        reflects the intersite topology in a slightly more abstract
        graph form.

        Roughly corresponds to MS-ADTS 6.2.2.3.4.3

        :param part: a Partition object
        :returns: an InterSiteGraph object
        irNr�r)z
site_edges_%sF��directed�label�
propertiesr!rCrD)r>�site_optionsrRr0rqrr/r1rCrD�edgesr��combinations�verticesr�rp�
site_dnstrr�rr;r)rEr��bridges_requiredr��g�	dot_edges�edger�r��verify_propertiesrUr)r)r*ros(
�
�
�zKCC.setup_graphcCsL|�|||||�}|st�d|j�dSt�d|j|djf�|dS)a�Get a bridghead DC for a site.

        Part of MS-ADTS 6.2.2.3.4.4

        :param site: site object representing for which a bridgehead
            DC is desired.
        :param part: crossRef for NC to replicate.
        :param transport: interSiteTransport object for replication
            traffic.
        :param partial_ok: True if a DC containing a partial
            replica or a full replica will suffice, False if only
            a full replica will suffice.
        :param detect_failed: True to detect failed DCs and route
            replication traffic around them, False to assume no DC
            has failed.
        :return: dsa object for the bridgehead DC or None
        z"get_bridgehead FAILED:
sitedn = %sNz'get_bridgehead:
	sitedn = %s
	bhdn = %sr)�get_all_bridgeheadsr!�
DEBUG_MAGENTAr0�DEBUG_GREENr�)rErpr�r]�
partial_ok�
detect_failed�bhsr)r)r*�get_bridgehead�s
���zKCC.get_bridgeheadc
Cs<g}|jdkrtd|jf��t|j�|j��D]k}|��}t|j�dkr,||jvr,q|j�	|�rH|�
|�\}	}
}|	r@|rA|sAq|�|j�}n|�|j�}|dusX|�
�rY|sYq|j��rm|durm|��rm|�tj�smq|�||�rxtd�qtd|j�|�|�q|��r�|jtt�d�nt�|�t�|�|S)a�Get all bridghead DCs on a site satisfying the given criteria

        Part of MS-ADTS 6.2.2.3.4.4

        :param site: site object representing the site for which
            bridgehead DCs are desired.
        :param part: partition for NC to replicate.
        :param transport: interSiteTransport object for
            replication traffic.
        :param partial_ok: True if a DC containing a partial
            replica or a full replica will suffice, False if
            only a full replica will suffice.
        :param detect_failed: True to detect failed DCs and route
            replication traffic around them, FALSE to assume
            no DC has failed.
        :return: list of dsa object for available bridgehead DCs
        rKz7get_all_bridgeheads has run into a non-IP transport! %rrNzbridgehead is failedzfound a bridgehead: %s��key) rUrrr�rn�get_parent_dnstrr��bridgehead_listr>r�should_be_presentrrrr<r��
is_default�is_minimum_behaviorr�DS_DOMAIN_FUNCTION_2008r�rr�r��is_random_bridgehead_disabled�sortrr+�random�shuffler!�DEBUG_YELLOW)
rErpr�r]r9r:r;r��pdnstrr�r��partial�repr)r)r*r6�s@
�



zKCC.get_all_bridgeheadscCs"|sdS|jjd@rdS|�|�S)adDetermine whether a given DC is known to be in a failed state

        :param dsa: the bridgehead to test
        :param detect_failed: True to really check, False to assume no failure
        :return: True if and only if the DC should be considered failed

        Here we DEPART from the pseudo code spec which appears to be
        wrong. It says, in full:

    /***** BridgeheadDCFailed *****/
    /* Determine whether a given DC is known to be in a failed state.
     * IN: objectGUID - objectGUID of the DC's nTDSDSA object.
     * IN: detectFailedDCs - TRUE if and only failed DC detection is
     *     enabled.
     * RETURNS: TRUE if and only if the DC should be considered to be in a
     *          failed state.
     */
    BridgeheadDCFailed(IN GUID objectGUID, IN bool detectFailedDCs) : bool
    {
        IF bit NTDSSETTINGS_OPT_IS_TOPL_DETECT_STALE_DISABLED is set in
        the options attribute of the site settings object for the local
        DC's site
            RETURN FALSE
        ELSEIF a tuple z exists in the kCCFailedLinks or
        kCCFailedConnections variables such that z.UUIDDsa =
        objectGUID, z.FailureCount > 1, and the current time -
        z.TimeFirstFailure > 2 hours
            RETURN TRUE
        ELSE
            RETURN detectFailedDCs
        ENDIF
    }

        where you will see detectFailedDCs is not behaving as
        advertised -- it is acting as a default return code in the
        event that a failure is not detected, not a switch turning
        detection on or off. Elsewhere the documentation seems to
        concur with the comment rather than the code.
        F�)r>r,r�)rEr�r:r)r)r*r�s
(
zKCC.is_bridgehead_failedcCs*|�||||	d�}tdd�|D��}t�dt|�dd�|D�f�|�||||	d�}
|��r4|
�|�t�dt|
�dd�|
D�f�|
D]�}|j��D]�}|�	|j
�}|d	urZqMt�d
|j�|�
��r>|���s>|j|jk�r>|��s�|�|�s�||_|�d�|��r�|��r�|tj@dkr�|jtjtjBM_|�d�n|tj@dkr�|jtjtjBO_|�d�|��r�|tj@dkr�|jtjM_|�d�n|tj@dkr�|jtjO_|�d�|���r|tj @dk�r|jtj!M_|�d�n|tj @dk�r|jtj!O_|�d�|j"�s$|���r8|j#�r/t$�%d
|�|j&|j'dd�qM|�&|j'�qMqFd}|
D]J}|j��D]A}|�	|j
�}|d	u�rZ�qKt�d|j�|�
��rn|j|jk�r�|���s�|�(||
��s�|�(||
��s�|d7}|j)�*|��qK�qDt�+d|�t,d|j)f�|dk�rtj-}|tj@dk�r�|tjtjBO}|tj@dk�r�|tjO}|tj @dk�r�|tj!O}t.d|j/j�tj0tj1B}|�2||||j|�}|j"�s�|���r|j3�r�t$�%d|�|j&|j'dd�n|�&|j'�|j)�*|�d	Sd	S)a�Create an nTDSConnection object as specified if it doesn't exist.

        Part of MS-ADTS 6.2.2.3.4.5

        :param part: crossRef object for the NC to replicate.
        :param rbh: nTDSDSA object for DC to act as the
            IDL_DRSGetNCChanges server (which is in a site other
            than the local DC's site).
        :param rsite: site of the rbh
        :param transport: interSiteTransport object for the transport
            to use for replication traffic.
        :param lbh: nTDSDSA object for DC to act as the
            IDL_DRSGetNCChanges client (which is in the local DC's site).
        :param lsite: site of the lbh
        :param link_opt: Replication parameters (aggregated siteLink options,
                                                 etc.)
        :param link_sched: Schedule specifying the times at which
            to begin replicating.
        :partial_ok: True if bridgehead DCs containing partial
            replicas of the NC are acceptable.
        :param detect_failed: True to detect failed DCs and route
            replication traffic around them, FALSE to assume no DC
            has failed.
        Fcss�|]}|j|fVqdSrd�r�rfr)r)r*ri^s�z(KCC.create_connection.<locals>.<genexpr>zrbhs_all: %s %scS�g|]}|j�qSr)rNrfr)r)r*�
<listcomp>a�z)KCC.create_connection.<locals>.<listcomp>zlbhs_all: %s %scSrOr)rNrfr)r)r*rPmrQNz
rdsa is %sTrr�r�zround 2: rdsa is %sr$zvalid connections %dzkept_connections:
%sznew connection, KCC dsa: %sr�)4r6�dictr!�
DEBUG_GREYr�r�r�r�rnr4r�r�r�r�r�r�rq�is_user_owned_schedule�is_equivalent_scheduler��set_modified�is_override_notify_default�
is_use_notifyr�NTDSSITELINK_OPT_USE_NOTIFYr�r�r��is_twoway_sync�NTDSSITELINK_OPT_TWOWAY_SYNCr��!is_intersite_compression_disabled�$NTDSSITELINK_OPT_DISABLE_COMPRESSIONr�rBr�r r�r�r?r�r:r�r&r�NTDSCONN_OPT_IS_GENERATEDrr<�SYSTEM_FLAG_CONFIG_ALLOW_RENAME�SYSTEM_FLAG_CONFIG_ALLOW_MOVE�new_connectionr�)rEr��rbh�rsiter]�lbh�lsite�link_opt�
link_schedr9r:�rbhs_all�	rbh_table�lbhs_all�ldsar��rdsa�valid_connections�opt�system_flagsr)r)r*�create_connectionAs
��
�
�	
��
���
�
��

�	

���
�	���
��q

�

���
�
��
�
��zKCC.create_connectioncCs�g|_g|_d}||jvr@t|jj�}|�|j|j|j|�	�|�}|dur4|j�
�r1|j�|�nd}n|j�|�|j�|�|j�d�|j�d�|S)a~Build a Vertex's transport lists

        Each vertex has accept_red_red and accept_black lists that
        list what transports they accept under various conditions. The
        only transport that is ever accepted is IP, and a dummy extra
        transport called "EDGE_TYPE_ALL".

        Part of MS-ADTS 6.2.2.3.4.3 -- ColorVertices

        :param vertex: the remote vertex we are thinking about
        :param local_vertex: the vertex relating to the local site.
        :param graph: the intersite graph
        :param detect_failed: whether to detect failed links
        :return: True if some bridgeheads were not found
        FNT�
EDGE_TYPE_ALL)�accept_red_red�accept_black�connected_verticesrRr0rqr<rpr��is_black�is_rodc_siter�)rE�vertex�local_vertex�graphr:�found_failed�t_guid�bhr)r)r*�add_transports=s$
�
zKCC.add_transportsc
Cs�d}d}td|j|f�t|j|�}|��|jD]}|��|�||||�r*d}q|��r3||fSt||j|j	d�\}}	td|j|	f�|	dkrMd}|�
�}
|j}td|�|D]�}|j
rk|jdj|jurkq\|jdj|jur{|jdj}
n|jdj}
|
|jur�td	�q\|�|
|||
|�}|d
ur�q\|j��r�|j}|j}n|j}|�||||
|�}|d
ur�t�d�dStd
||
f�td|jf�t�d||df�|j}|d
ur�d}d
}n|j}|j}|�|||
||||||
|�
q\||fS)a1Create intersite NTDSConnections as needed by a partition

        Construct an NC replica graph for the NC identified by
        the given crossRef, then create any additional nTDSConnection
        objects required.

        :param graph: site graph.
        :param part: crossRef object for NC.
        :param detect_failed:  True to detect failed DCs and route
            replication traffic around them, False to assume no DC
            has failed.

        Modifies self.kept_connections by adding any connections
        deemed to be "in use".

        :return: (all_connected, found_failed_dc)
        (all_connected) True if the resulting NC replica graph
            connects all sites that need to be connected.
        (found_failed_dc) True if one or more failed DCs were
            detected.
        TFz8create_connections(): enter
	partdn=%s
	detect_failed=%s)r*z%s Number of components: %dr$zedge_list %srzrsite is my_siteNzDISASTER! lbh is None)FTzlsite: %s
rsite: %szvertices %szbridgeheads
%s
%s
%szF----------------------------------------------------------------------)rrrr>�color_vertexr/r}�is_whiterr�rur0rr)rpr<r<r�r!r&�
DEBUG_BLUE�	site_linkr�r�rp)rEryr�r:r�rz�	my_vertex�v�	edge_list�n_componentsr9r]r�rcrbrerdrbrfrgr)r)r*�create_connectionsos��
�
��

�

�
�zKCC.create_connectionscCs~d}t�|_|j��D]1}|��sq|��rq|�|�}d}|�||d�\}}td||f�|s<d}|r<|�||d�q|S)a�Create NTDSConnections as necessary for all partitions.

        Computes an NC replica graph for each NC replica that "should be
        present" on the local DC or "is present" on any DC in the same site
        as the local DC. For each edge directed to an NC replica on such a
        DC from an NC replica on a DC in another site, the KCC creates an
        nTDSConnection object to imply that edge if one does not already
        exist.

        Modifies self.kept_connections - A set of nTDSConnection
        objects for edges that are directed
        to the local DC's site in one or more NC replica graphs.

        :return: True if spanning trees were created for all NC replica
                 graphs, otherwise False.
        TFz0with detect_failed: connected %s Found failed %s)	r8r:r.rnr��
is_foreignrr�r)rEr�r�ryrz�	connectedr)r)r*�create_intersite_connections�s*
���z KCC.create_intersite_connectionscCs�|j}|j}d}td�|jr|j|j|dd�n	|j|j|dd�|��r.td|�|S|��s:td|�|S|�|�|�	�}td|�|S)amGenerate the inter-site KCC replica graph and nTDSConnections

        As per MS-ADTS 6.2.2.3.

        If self.readonly is False, the connections are added to self.samdb.

        Produces self.kept_connections which is a set of NTDS
        Connections that should be kept during subsequent pruning
        process.

        After this has run, all sites should be connected in a minimum
        spanning tree.

        :param ping: An oracle function of remote site availability
        :return (True or False):  (True) if the produced NC replica
            graph connects all sites that need to be connected
        Tzintersite(): enterr�Fz+intersite(): exit disabled all_connected=%dz+intersite(): exit not istg all_connected=%dz"intersite(): exit all_connected=%d)
r<r>rrB�select_istgr?�is_intersite_topology_disabledr�r'r�)rEr�r��mysiter�r)r)r*�	intersite%s*��
	z
KCC.intersiteTcs�|j��sdS|jj��}dd�|D���fdd�|D�}|r@�rB�D]}|d}|j|_|j|_d|_q#|jj|j|d�dSdSdS)zoUpdates the RODC NTFRS connection object.

        If the local DSA is not an RODC, this does nothing.
        NcSsg|]}|��r|�qSr))r�rfr)r)r*rPtsz.KCC.update_rodc_connection.<locals>.<listcomp>csg|]}|�vr|�qSr)r)rf��ro_connectionsr)r*rPus�rTr�)	r<r�r�rnr�r�r�r�r?)rEr��all_connections�rw_connections�conr�r)r�r*�update_rodc_connection`s

�zKCC.update_rodc_connectioncCsFd}	|d||d|dkrn|d}q|d}|dkr!|SdS)amFind the maximum number of edges directed to an intrasite node

        The KCC does not create more than 50 edges directed to a
        single DC. To optimize replication, we compute that each node
        should have n+2 total edges directed to it such that (n) is
        the smallest non-negative integer satisfying
        (node_count <= 2*(n*n) + 6*n + 7)

        (If the number of edges is m (i.e. n + 2), that is the same as
        2 * m*m - 2 * m + 3). We think in terms of n because that is
        the number of extra connections over the double directed ring
        that exists by default.

        edges  n   nodecount
          2    0    7
          3    1   15
          4    2   27
          5    3   43
                  ...
         50   48 4903

        :param node_count: total number of nodes in the replica graph

        The intention is that there should be no more than 3 hops
        between any two DSAs at a site. With up to 7 nodes the 2 edges
        of the ring are enough; any configuration of extra edges with
        8 nodes will be enough. It is less clear that the 3 hop
        guarantee holds at e.g. 15 nodes in degenerate cases, but
        those are quite unlikely given the extra edges are randomly
        arranged.

        :param node_count: the number of nodes in the site
        "return: The desired maximum number of connections
        rTr���r$�2r))rE�
node_count�nr)r)r*�intrasite_max_node_edges�s#�zKCC.intrasite_max_node_edgesc"s�|�|�\}}}t�dd|d|d|d|d|d|�|s1t�d|j�d	St||j�}	|	��j�||	_||	_	|�
|	�g}
�jj�
�D]G}|j|jvrYqP|j|j}|��rdqP|��siqP|��sq||urrqP|ry|��syqP|r�|s�|jtjkr�|�tj�s�qP|r���|�r�qP|
�|�qP|r׈jj�
�D]6}|j|jvr�q�|j|j}
|
��s�q�|
��s�q�|��s�||ur�q�|r�|��s�q�|rш�|�r�q�|
�|
�q�|
�|	�|
jd
d�d�t|
�}��|�}g}|
D]
}t|j|�}|�|�q�d
}||dk�rK|
|���r|
|d���r$||d� |
|j�|
|d���r4|
|���r@||� |
|dj�|d}||dk�s|
|d���r[|
d
���rg|d
� |
|dj�|
d
���rw|
|d���r�||d� |
d
j�t!dt|
��t!d�"dd�|
D����j#d	u�o��j}�j$�s�|�rg}t%�}|D]}|�&|j'�|j(D]}|�||j'f�|�&|��q��q�d}t)d||d|j*t+|j|jf|t!�j$�j#dd�	t%�fdd�|D����fdd�|D�}d}t)d|�d|j*t+|j|jf|t!�j$�j#dd�	|D]"}�jj|j'}|j,�
�D]}|j-}|�jjv�r7|� |��q&�qt!dd�"dd�|
D���t!d d�"d!d�|D���|D]��|d"k�r���.��s��fd#d�|D�} t�/d$�j'|t|�t| �f�t!d%d&d�| D��| �r���.��s�t0�1| �}!t!d'|!j'��� |!j'��s�t�d(|!j'�| �2|!�| �r���.��r�nt3d)�j'|t�j(��j4f�t3d*���j'|j'k�r݈�5|�j6��qY�j$�s�|�rWg}t%�}|D]}|�&|j'�|j(D]}|�||j'f�|�&|��q��q�d}t)d+||d|j*t+|j|jf|t!�j$�j#dd�	t%�fd,d�|D����fd-d�|D�}d}t)d.|�d|j*t+|j|jf|t!�j$�j#dd�	d	Sd	S)/aTCreate an intrasite graph using given parameters

        This might be called a number of times per site with different
        parameters.

        Based on [MS-ADTS] 6.2.2.2

        :param site_local: site for which we are working
        :param dc_local: local DC that potentially needs a replica
        :param nc_x:  naming context (x) that we are testing if it
                    "should be present" on the local DC
        :param gc_only: Boolean - only consider global catalog servers
        :param detect_stale: Boolean - check whether links seems down
        :return: None
        z"construct_intrasite_graph(): enterz
	gc_only=%dz
	detect_stale=%dz
	needed=%sz
	ro=%sz
	partial=%sz
%szH%s lacks 'should be present' status, aborting construct_intrasite_graph!NcSs
t|j�Srd)r�rep_dsa_guid)rLr)r)r*�<lambda>�s
z/KCC.construct_intrasite_graph.<locals>.<lambda>r=rr$zr_list is length %s�
css �|]}t|j|jf�VqdSrd)rRr��
rep_dsa_dnstrrfr)r)r*ri�s��z0KCC.construct_intrasite_graph.<locals>.<genexpr>�r��intrasite_pre_ntdsconz
%s__%s__%sT)r*r+r!rCrDr)c3�"�|]}��|���s|VqdSrd�r6r�rfrsr)r*ri����c�(g|]\}}|�vr|�vr||f�qSr)r)�rgr�r���rw_dot_verticesr)r*rP���z1KCC.construct_intrasite_graph.<locals>.<listcomp>)r��directed_double_ring_or_small�intrasite_rw_pre_ntdsconz
reps are:  %sz   cs��|]}|jVqdSrd)r�rfr)r)r*ri���z
dsas are:  %scsr�rdrNrfr)r)r*ri�r��cs$g|]}|�ur|j�jvr|�qSr))r��	edge_fromrf)�tnoder)r*rP�s
�zDlooking for random link for %s. r_len %d, graph len %d candidates %dz
candidates %scSrOr)rNrfr)r)r*rP�rQztrying to add candidate %szcould not add %sz0not adding links to %s: nodes %s, links is %s/%sz%s�intrasite_post_ntdsconc3r�rdr�rfrsr)r*ri'	r�cr�r)r)r�r�r)r*rP)	r��intrasite_rw_post_ntdscon)7rAr!rIr&rr�identify_by_basednr?�rep_partial�rep_ro�add_needed_replicar>rmrnrr�r
r%�nc_typer�domainrCrrDr�r�rrFr�r�rr��
add_edge_fromr�joinrDrCr8r�r�r�rr0rr�r��has_sufficient_edgesr�rG�choice�remover�	max_edges�add_connections_from_edgesr0)"rE�
site_local�dc_local�nc_x�gc_only�detect_staler�r�rK�l_of_x�r_list�dc_s�f_of_x�p_of_x�r_len�max_node_edges�
graph_listrL�node�i�do_dot_filesr3�dot_vertices�v1�v2r5�rw_dot_edges�rw_verify_propertiesrwr�r��remote�
candidates�otherr))r�rEr�r*�construct_intrasite_graph�sz#�������


  �  
�
���	��
����

�����
���	�
��zKCC.construct_intrasite_graphcCs�|j}td�|j}|��rdS|��}|j��D]}|jr&t�	d|�q|j
��D]\}}|�|||d|�|j��D]}|jrJt�
d|�q>q,|j��D]}|jr]t�d|�qQ|j
��D]\}}|��rt|�|||d|�qc|j��D]}|jr�t�
d|�qz|j
��D]
\}}|�|||dd�q�|j��D]}|jr�t�d|�q�|j
��D]\}}|��r�|�|||dd�q�|�|�dS)a�Generate the intrasite KCC connections

        As per MS-ADTS 6.2.2.2.

        If self.readonly is False, the connections are added to self.samdb.

        After this call, all DCs in each site with more than 3 DCs
        should be connected in a bidirectional ring. If a site has 2
        DCs, they will bidirectionally connected. Sites with many DCs
        may have arbitrary extra connections.

        :return: None
        zintrasite(): enterNr�FT)r<rr>�is_intrasite_topology_disabled�is_detect_stale_disabledr�rnr�r!�
DEBUG_CYANr.�itemsr�r�rI�	is_configr&r�)rEr�r�r�r��partdnr�r)r)r*�	intrasite7	s`
�������	�����z
KCC.intrasitecCsb|��|��|��|��|��|��g}|j��D]}|�dd�|j	��D��q|S)aCompile a comprehensive list of DSA DNs

        These are all the DSAs on all the sites that KCC would be
        dealing with.

        This method is not idempotent and may not work correctly in
        sequence with KCC.run().

        :return: a list of DSA DN strings.
        cSsg|]
}|j�ddd��qS)zCN=NTDS Settings,r{r$)r��replace)rgr�r)r)r*rP�	s�z!KCC.list_dsas.<locals>.<listcomp>)
rtr�rwr�r^rcr/rn�extendrm)rE�dsasrpr)r)r*�	list_dsas�	s

�z
KCC.list_dsasc
Csb|s|jdur/z
t|t�||d�|_WdStjy.}z
|j\}}td||f��d}~wwdS)aSLoad the database using an url, loadparm, and credentials

        If force is False, the samdb won't be reloaded if it already
        exists.

        :param dburl: a database url.
        :param lp: a loadparm object.
        :param creds: a Credentials object.
        :param force: a boolean indicating whether to overwrite.

        N)�url�session_info�credentials�lpz#Unable to open sam database %s : %s)r?r	rrrPrQr)rE�dburlr��creds�force�e1�numr[r)r)r*�
load_samdb�	s�
����zKCC.load_samdbr)c

Cs�|o|j}|s|jdurdSg}g}g}g}|j��D]7}|�|j�|��r-|�d�n|�d�|j��D]}	|	��rC|�d�n|�d�|�|	j	|jf�q7qt
||||j|t||jd||d�dS)z�Helper function to plot and verify NTDSConnections

        :param basename: an identifying string to use in filenames and logs.
        :param verify_properties: properties to verify (default empty)
        Nz#cc0000z#0000cc�red�blueT)	r/r*r+r!rCrDr)�edge_colors�
vertex_colors)
rCrDr2rnr�r�r�r�r�r�rr;r)
rE�basenamer5rCr3r��edge_colours�vertex_coloursr�r�r)r)r*�plot_all_connections�	s2


�
�zKCC.plot_all_connectionsc"s��jdurtd|f��j|||dd�|r�j�d|��z5�����������������	��j
sB�jdu�r.i}�j�
�D]�|�dd��j��D��qI��d�g}	�j��\}
}|
��D]\}}
td	|
�|	��jj|f�qktd
|	d�jdt�j
�jd
�g}	�j�
�D]6��j�
�D].}|��\}
}|
��D]!\}}|jD]}td|�t|j�}||}|	�|j|f�q�q�q�q�td|	d�jdt�j
�jd
�g}	g}�j�
�D]7}ddlm}|j� d�}d||��!�dd�}t"�#|j$d�D]\}}|	�|d|df�|�|��qq�d}td|	d�j|t�j
�j|d�	|�rO�j%j�
�D]}t&�fdd�|j'��D��|_'�q7��d�|�ry�j�
�D]��j�
�D]}t&��fdd�|j'��D��|_'�q^�qW��d�|�r�dd�}nd}��(|���)���*|�}��+|���,���-���.��j
�s��jdu�rS��d d�t/�0d!t1|��g}	g}�jj}�j��\}
}|��D](\}} | jD]}t|j�}!|	�|||!f�|�dt| j2�dd���qՐq�td"|	d�jdt�j
�j|d�	g}	�j�
�D]2��j�
�D])}|��\}
}|�
�D]} | jD]}t|j�}||}|	�|j|f��q&�q!�q�qtd#|	d�jdt�j
�jd
�WdSWdS�)$a�Perform a KCC run, possibly updating repsFrom topology

        :param dburl: url of the database to work with.
        :param lp: a loadparm object.
        :param creds: a Credentials object.
        :param forced_local_dsa: pretend to be on the DSA with this dn_str
        :param forget_local_links: calculate as if no connections existed
               (boolean, default False)
        :param forget_intersite_links: calculate with only intrasite connection
               (boolean, default False)
        :param attempt_live_connections: attempt to connect to remote DSAs to
               determine link availability (boolean, default False)
        :return: 1 on error, 0 otherwise
        Nz$samdb is None; let's load it from %sF)r�zCN=NTDS Settings,%scss"�|]\}}t|j�|fVqdSrdre)rgr\r�r)r)r*ri�	s��zKCC.run.<locals>.<genexpr>�dsa_initialzc_rep %s�dsa_repsFrom_initialTr)r(zrep %s�dsa_repsFrom_initial_allr)�md5r}�#r�r�r$r��dsa_sitelink_initial)r)r*r+r!rCrDr�c3s2�|]\}}|��s|j�jjvr||fVqdSrd)r�r�r>rm�rg�kr�rsr)r*ri2
s�
�����dsa_forgotten_localc3s.�|]\}}��jur|��r||fVqdSrd)r>r�r��rErpr)r*ri<
s�

����dsa_forgotten_allcSs0zt�||j|j�WdStjyYdSw)NFT)r�drsuapi_connectr�r��drsException)rE�dnsnamer)r)r*r�F
s��zKCC.run.<locals>.ping�	dsa_finalzthere are %d dsa guids�dsa_repsFrom_final�dsa_repsFrom_final_all)3r?rr��set_ntds_settings_dnrtr�rwr�r^rcrCrDr/rnrlrmr�r�r<r�rr�r�rr;r�rRr�r1�hashlibr�r\�encode�	hexdigestr�r.�	site_listr>rRr�r�r�r�r�r%r�r�r!r7r��nc_guid)"rEr�r�r��forced_local_dsa�forget_local_links�forget_intersite_links�attempt_live_connections�
guid_to_dnstrr3�current_reps�needed_repsr\r r�rorLr�r&�dsa_dn�dot_colours�linkr��tmp_str�colourr�r�r+r�r�r��my_dnstrr�guid_strr)r�r*�run�	s
�

�
�

���	����
��




��

 ��

�����*�zKCC.runc
CsLzt�||||�|_WdStjy%}zt�|�WYd}~dSd}~ww)aIImport relevant objects and attributes from an LDIF file.

        The point of this function is to allow a programmer/debugger to
        import an LDIF file with non-security relevent information that
        was previously extracted from a DC database.  The LDIF file is used
        to create a temporary abbreviated database.  The KCC algorithm can
        then run against this abbreviated database for debug or test
        verification that the topology generated is computationally the
        same between different OSes and algorithms.

        :param dburl: path to the temporary abbreviated db to create
        :param lp: a loadparm object.
        :param ldif_file: path to the ldif file to import
        :param forced_local_dsa: perform KCC from this DSA's point of view
        :return: zero on success, 1 on error
        Nr$r)r�
ldif_to_samdbr?�	LdifErrorr �critical)rEr�r��	ldif_filerr�r)r)r*�import_ldif�
s
��
��zKCC.import_ldifc
CsNz
t�|j||||�WdStjy&}zt�|�WYd}~dSd}~ww)a-Save KCC relevant details to an ldif file

        The point of this function is to allow a programmer/debugger to
        extract an LDIF file with non-security relevent information from
        a DC database.  The LDIF file can then be used to "import" via
        the import_ldif() function this file into a temporary abbreviated
        database.  The KCC algorithm can then run against this abbreviated
        database for debug or test verification that the topology generated
        is computationally the same between different OSes and algorithms.

        :param dburl: LDAP database URL to extract info from
        :param lp: a loadparm object.
        :param cred: a Credentials object.
        :param ldif_file: output LDIF file name to create
        :return: zero on success, 1 on error
        Nr$r)r�samdb_to_ldif_filer?rr r)rEr�r�r�rr�r)r)r*�export_ldif�
s��
��zKCC.export_ldif)FFFNrd)T)F)r))NFFF),�__name__�
__module__�__qualname__�__doc__rFr^rcrjrtrwr�r�r�r�r�r�r�r�r�r�r�r
rr%r'rr<r6r�rpr}r�r�r�r�r�r�r�r�r�r�rrr r)r)r)r*r-Nsn
�*#:
4!49P
'
(Y3}2|:
;$-	P

#
�
;r-)4rGr��	functoolsrr��sambarrrrr�
samba.authr�samba.samdbr	�samba.dcerpcr
r�samba.kcc.kcc_utilsrr
rrrrrrrrr�samba.kcc.graphr�	samba.ndrr�samba.kcc.graph_utilsr�	samba.kccrrrr�samba.kcc.debugrrr r!�samba.commonr"r+r,�objectr-r)r)r)r*�<module>s0