
    bFS             
          d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZm	Z	 d dl
mZmZmZmZ d dlmZ d dlmZ d dlmZ d dlZd dlmZ d dlmZ d d	lmZmZmZ d d
lmZ d dlmZ d dlm Z  d dlm!Z! d dl"m#Z# d dl$Z$d dl%m&Z&m'Z'm(Z( d dl)m*Z* d dl+m,Z,m-Z-m.Z.m/Z/ d dl0m1Z1 d dl2m3Z3 d dl2m4Z4 d dl5m6Z6 d dl7m8Z8 d dl9Z9dZ:dZ;dZ<dZ=dddddddddd	Z>dddddddddZ?h dZ@dZAdeAz  ZBdZCd ZD e8eE           ZFd! ZGd" ZHd# ZI G d$ d%eJ          ZK G d& d'eL          ZMd( ZNd) ZO G d* d+eL          ZP G d, d-eL          ZQ G d. d/eL          ZR G d0 d1eR          ZSdd3ZTd4 ZUd5 ZVd6 ZW G d7 d8eL          ZXdd:ZYi d;d<d=d>d?d>d@d>dAd>dBd>dCd<dDd>dEd>dFd>dGd>dHd>dId<dJd<dKd>dLd<ZZi dMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdldmdni dodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddddddddZdddd\ddi ddddddddddddddddnddpddddddddddddddddi ddddddddddddddddddddddēddƓddȓddʓdd̓ddΓddГi ddғddԓdd֓ddؓddړddܓddޓdddddddddddddddddddddddddddddZ[d Z\d Z]d dZ^d!dZ_	 	 	 	 	 	 	 	 	 d"d Z`d Zad Zbd Zc edd          Zdd Ze	 d#dZfd	 Zgd
 Zhd Zid$dZjd Zkd#dZl	 d#dZmd Znd Zod Zp	 d#dZq G d deL          Zrd Zsd Ztd Zud Zvd Zwd ZxdS (%      N)ECHILDESRCH)OrderedDictCounterdefaultdict
namedtuple)query)traffic_packets)SamDB)LdbError)ClientConnection)securitydrsuapilsa)netlogon)netr_Authenticator)srvsvc)samr)
drs_DsBind)CredentialsDONT_USE_KERBEROSMUST_USE_KERBEROS)system_session)UF_NORMAL_ACCOUNTUF_SERVER_TRUST_ACCOUNTUF_TRUSTED_FOR_DELEGATIONUF_WORKSTATION_TRUST_ACCOUNT)SEC_CHAN_BDC)gensec)sd_utils)
get_string)get_samba_logger   ga2U0*3?-      ?)	dns0smb0x72ldapr(   r-   3r-   2cldapr/   dcerpc11r5   14nbnsr(   )r'   1r-   r<   r-   4r-   5r3   rA   r5   12r5   13r5   15>   r*   smb2browsersmb_netlogong      $@)i)namec                     | t           k    rL|st          |t          j                   dS t          |t	          |          z  t          j                   dS dS )a  Print a formatted debug message to standard error.


    :param level: The debug level, message will be printed if it is <= the
                  currently set debug level. The debug level can be set with
                  the -d option.
    :param msg:   The message to be logged, can contain C-Style format
                  specifiers
    :param args:  The parameters required by the format specifiers
    fileN)DEBUG_LEVELprintsysstderrtuple)levelmsgargss      7/usr/lib/python3/dist-packages/samba/emulate/traffic.pydebugrZ   e   s`      	6#CJ''''''#d##*555555	     c                  V   t          j        d          }t          d|d         d         d|d         d         ddt          j                   | D ]}t          |t          j        	           t          t          j        	           t          j                                         d
S )zK Print an unformatted log message to stderr, contaning the line number
    r#   )limit r   z	:[01;33m   z [00m)endrP   rO   N)	tracebackextract_stackrR   rS   rT   flush)rX   tbas      rY   debug_linenorf   w   s     
	 q	)	)	)B	E!!uQxxxAq39<z     " "acj!!!!!	szJr[   c                 Z    | r$d}| D ]}|dz  }||z  }|dz  }dd|z   z  fd}nd }|S )zReturn a function that prints a coloured line to stderr. The colour
    of the line depends on a sort of hash of the integer arguments.      z
[38;5;%dm   c                  l    t           dk    r%| D ]$}t          |dt          j                   #d S d S )Nr   z[00mrO   rQ   rR   rS   rT   )rX   re   prefixs     rY   pzrandom_colour_print.<locals>.p   sS    Q I IAFFAAA6SZHHHHH I Ir[   c                  `    t           dk    r | D ]}t          |t          j                   d S d S )Nr   rO   rl   )rX   re   s     rY   rn   zrandom_colour_print.<locals>.p   sC    Q . .A!#*----- . .r[    )seedssxrn   rm   s       @rY   random_colour_printrt      s      . 	 	AGAFAHAA BF+	I 	I 	I 	I 	I 	I
	. 	. 	.
 Hr[   c                       e Zd ZdS )FakePacketErrorN)__name__
__module____qualname__rp   r[   rY   rv   rv      s        Dr[   rv   c                   l    e Zd ZdZdZd Zed             ZddZd Z	d Z
d	 Zd
 Zd Zd Zd ZddZdS )PacketzDetails of a network packet
	timestampip_protocolstream_numbersrcdestprotocolopcodedescextra	endpointsc
                     || _         || _        || _        || _        || _        || _        || _        || _        |	| _        | j        | j        k     r| j        | j        f| _	        d S | j        | j        f| _	        d S Nr|   )
selfr}   r~   r   r   r   r   r   r   r   s
             rY   __init__zPacket.__init__   sz    "&*	 	
8di"h	2DNNN"i2DNNNr[   c                    |                     d                              d          }|d d         \  }}}}}}}	}
|dd          }t          |          }t          |          }t          |          } | |||||||	|
|	  	        S )N
	   )rstripsplitfloatint)clslinefieldsr}   r~   r   r   r   r   r   r   r   s               rY   	from_linezPacket.from_line   s    T""((.. 								qrr
)$$	#hh4yys9k=#tVT52 2 	2r[           c                     d                     | j                  }| j        |z   }|d|| j        | j        pd| j        | j        | j        | j        | j	        |f	z  fS )z5Format the packet as a traffic_summary line.
        r   z%f	%s	%s	%d	%d	%s	%s	%s	%s )
joinr   r}   r~   r   r   r   r   r   r   )r   time_offsetr   ts       rY   
as_summaryzPacket.as_summary   sm     		$*%%N[(7!#)r	 	 		r[   c                     d| j         | j        | j        | j        pd| j        | j        | j        | j        | j        r dd	                    | j                  z   dz   ndf	z  S )Nz:%.3f: %d -> %d; ip %s; strm %s; prot %s; op %s; desc %s %sr$      «r^      »r   )
r}   r   r   r~   r   r   r   r   r   r   r   s    rY   __str__zPacket.__str__   sg    L49d6F6M##T]DK8<
J$$*---44MM 	Nr[   c                     d| z  S )Nz<Packet @%s>rp   r   s    rY   __repr__zPacket.__repr__   s    $$r[   c                     |                      | j        | j        | j        | j        | j        | j        | j        | j        | j	        	  	        S r   )
	__class__r}   r~   r   r   r   r   r   r   r   r   s    rY   copyzPacket.copy   sF    ~~dn"."0"h"i"m"k"i"j* * 	*r[   c                 (    | j         d| j        }|S )N:r   r   )r   r   s     rY   as_packet_typezPacket.as_packet_type   s    }}}dkk2r[   c                 |    | j         | j        f}|t          v rt          |         S |t          v rt          |          S dS )zA positive number means we think it is a client; a negative number
        means we think it is a server. Zero means no idea. range: -1 to 1.
        r   )r   r   CLIENT_CLUESSERVER_CLUES)r   keys     rY   client_scorezPacket.client_score   sF     }dk*,$$, %%%sr[   c           
         d| j         d| j        }	 t          t          |          }n># t          $ r1}t          d|j        d|t          j                   Y d}~dS d}~ww xY w| j         dk    rt          dd|j        d	|           t          j
                    }	  || ||          r@t          j
                    }||z
  }t          d
||j        | j         | j        |fz             dS dS # t          $ rJ}t          j
                    }||z
  }t          d||j        | j         | j        ||fz             Y d}~dS d}~ww xY w)zSend the packet over the network, if required.

        Some packets are ignored, i.e. for  protocols not handled,
        server response messages, or messages that are generated by the
        protocol layer associated with other packets.
        packet__zConversation(z) Missing handler rO   Nkerberosr#   z) Calling handler z%f	%s	%s	%s	%f	True	z%f	%s	%s	%s	%f	False	%s)r   r   getattrr
   AttributeErrorrR   conversation_idrS   rT   rZ   time	Exception)	r   conversationcontextfn_namefnestartr`   durations	            rY   playzPacket.play  s     %)MMM4;;?	'22BB 	 	 	E///:z# # # # FFFFF		 =J&&!!"222GG= > > > 		.r$g.. / ikk;2L8$-{H.. / / / / // /  	. 	. 	.)++CU{H14dm;!-- . . . . . . . . .	.s-   * 
A%&A  A%"AC1 1
E;?E  Ec                      | j         |j         z
  S r   r}   r   others     rY   __cmp__zPacket.__cmp__+  s    ~//r[   Nc                 6    t          | j        | j                  S r   )is_a_real_packetr   r   )r   missing_packet_statss     rY   is_really_a_packetzPacket.is_really_a_packet.  s    t{;;;r[   )r   r   )rw   rx   ry   __doc__	__slots__r   classmethodr   r   r   r   r   r   r   r   r   r   rp   r[   rY   r{   r{      s        %%	I3 3 3  2 2 [2&    N N N% % %	* 	* 	*  	 	 	&. &. &.P0 0 0< < < < < <r[   r{   c                     | t           v rdS | dk    r|dk    rdS d| d|}t          t          |d          }|+t                              d|z  t
          j                   dS |t          j        u rdS d	S )
zdIs the packet one that can be ignored?

    If so removing it will have no effect on the replay
    Fr-   r   r   r   Nzmissing packet %srO   T)SKIPPED_PROTOCOLSr   r
   LOGGERrZ   rS   rT   null_packet)r   r   r   r   s       rY   r   r   2  s    
 $$$u6fllu (&&1G	'4	0	0B	z(72DDDu	_(((u4r[   c                 B    | dk    rdS | |fdv rdS t          | |          S )zReturn true if a packet generates traffic in its own right. Some of
    these will generate traffic in certain contexts (e.g. ldap unbind
    after a bind) but not if the conversation consists only of these packets.
    waitF)r   r   r0   rG   r5   16)r   r   s     rY   is_a_traffic_generating_packetr   H  sB    
 6u&   
 uHf---r[   c                       e Zd ZdZddddddddddej                            d          ddfdZd Zd Z	d Z
d Zd	 Zd
 ZddZddZddZddZddZddZddZddZd Zd Zd Zd ZdS )ReplayContextaW  State/Context for a conversation between an simulated client and a
       server. Some of the context is shared amongst all conversations
       and should be generated before the fork, while other context is
       specific to a particular conversation and should be generated
       *after* the fork, in generate_process_local_config().
    NDOMAINc                    || _         d | _        || _        || _        |rt          | _        nt          | _        |	| _        |
| _        || _	        || _
        || _        || _        |                    d          | _        || _        || _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        || _        |                                  d S )NrealmF)servernetlogon_connectioncredslpr   kerberos_stater   oubase_dndomainstatsdirglobal_tempdir
domain_sidgetr   instance_idbadpassword_frequencylast_lsarpc_badlast_lsarpc_named_badlast_simple_bind_badlast_bind_badlast_srvsvc_badlast_drsuapi_badlast_netlogon_badlast_samlogon_badtotal_conversationsgenerate_ldap_search_tables)r   r   r   r   r   r   prefer_kerberostempdirr   r   r   r   r   r   s                 rY   r   zReplayContext.__init__a  s     )/(, (-
(* 	4"3D"3D(*(/(.(0(/(2(*w
(3 )>"(-(-"(-!(-(-(-(-(-(; ((*****r[   c                    t                      }t          d| j        z  || j        | j                  }|                    |                                t          j        dgdg          }i }dg i}|D ]}t          |j
                  }d                    d |                    d          D                                                       }|                    |g           }	|	                    |           |                    d	          r|d                             |           t#          |                                          D ]}
|
d
d          dk    r|
d d
         }|d
d          dk    r|d d
         }|d
d          dk    t'          d          D ]>}|dz  }||
k    r&||v r"t)          d|
d|t*          j                   3||
         ||<   ?|| _        || _        i | _        |                    |                                t          j        dgd          }d                    d |D                       }d                    |          | j        d<   d}dD ]-}|d                    ||                                          z  }.d                    |          | j        d<   d| j        d<   |                    dt          j        dg          }d                    |d         d                   | j        d<   d S ) N	ldap://%s)urlsession_infocredentialsr   zpaged_results:1:1000dn)scopecontrolsattrsinvocationId,c              3   N   K   | ] }|                                 d d         V  !d S )Nr#   )lstrip.0rs   s     rY   	<genexpr>z<ReplayContext.generate_ldap_search_tables.<locals>.<genexpr>  s2      EE!qxxzz"1"~EEEEEEr[   zCN=NTDS Settings,rL   z,DC   zdn_map collison r^   rO   z"(objectclass=groupPolicyContainer))r   r   
expressionr   c              3   L   K   | ]}d                      |d                   V   dS )z(distinguishedName={0})r   N)format)r  rW   s     rY   r  z<ReplayContext.generate_ldap_search_tables.<locals>.<genexpr>  s5      XXS6==c$iHHXXXXXXr[   z(|{0})gPCFileSysPath)zDomain Controllers,ztraffic_replay,r   z(distinguishedName={0}{1})gpLinkz'(objectCategory=pKICertificateTemplate)pKIExtendedKeyUsagehighestCommittedUSN)r   r   z(usnChanged>={0})r   
usnChanged)r   r   r   r   r   search	domain_dnldbSCOPE_SUBTREEstrr   r   r   upper
setdefaultappend
startswithlistkeysrangerR   rS   rT   dn_mapattribute_clue_mapsearch_filtersr
  
SCOPE_BASE)r   sessiondbresr  r  rr   patternr'   krn   i
gpos_by_dnou_strr   s                   rY   r   z)ReplayContext.generate_ldap_search_tables  sK    ""{T[0 '#zg  
 ii!/"8!9#f  & & B
  	> 	>AQTBhhEErxx}}EEEEEKKMMG##GR00CJJrNNN}}011 >">299"=== fkkmm$$ 	& 	&Av#2#ABCC&E//crcF BCC&E//1XX & &U
66a6kkEQQQ:"z+ + + +"1Iq		& "4
 ! iic.?v#G  I IWWXXTWXXXXX
 19
0K0K,- @ 	N 	NB299"bllnnMMMFF(0(?(?H%
 6 	12
 ii#.9N8OiPP&&s1v.C'DEE 	L)))r[   c                     | j                                         D ]}||v r| j         |         c S |dk    r5t          j                    | j        z  }t	          | j        |          }d|z  S dS )NzDC,DCz((&(sAMAccountName=%s)(objectClass=user))z(objectClass=*))r  r  randomr   	user_namer   )r   r   dn_sigr   r   random_user_idaccount_names          rY   guess_search_filterz!ReplayContext.guess_search_filter  s     &++-- 	0 	0Ce||*3//// 
 W#]__t/GGN$T%5~FFL=LL ! r[   c                    g | _         g | _        g | _        g | _        g | _        g | _        g | _        |j        | _        |j        | _        |j	        | _	        |j
        | _
        t          | j        d|j        z            | _        | j                            d| j                   | j                            d| j                   | j                            d| j                   | j                            dd           d| _        d| j        d	| j        | _        d| j	        d	| j        | _        |                                  |                                  d S )
Nzconversation-%dzprivate dirzlock dirzstate directoryztls verify peerno_checkz/root/ncalrpc_as_systemcn=r  )ldap_connectionsdcerpc_connectionslsarpc_connectionslsarpc_connections_nameddrsuapi_connectionssrvsvc_connectionssamr_contextsnetbios_namemachinepassusernameuserpassmk_masked_dirr   r   r   r   setremoteAddressr   samlogon_dnuser_dngenerate_machine_credsgenerate_user_creds)r   accountr   s      rY   generate_process_local_configz+ReplayContext.generate_process_local_config  s]   (*(*(*(*%(* (*(*(/(<(/(;(/(8(/(8$T%8%6%1%A&BC C 	M4<000J---%t|444%z2226#000$'';  $}}}dgg7 	##%%%  """""r[   c                     |sE| j         r<t          j                    | j         k     r 	  ||           n# t          $ r Y nw xY wd}nd} ||          }||fS )a  Execute the supplied logon function, randomly choosing the
           bad credentials.

           Based on the frequency in badpassword_frequency randomly perform the
           function with the supplied bad credentials.
           If run with bad credentials, the function is re-run with the good
           credentials.
           failed_last_time is used to prevent consecutive bad credential
           attempts. So the over all bad credential frequency will be lower
           than that requested, but not significantly.
        TF)r   r*  r   )r   fgoodbadfailed_last_timeresults         rY   with_random_bad_credentialsz)ReplayContext.with_random_bad_credentials  s       	)* 
)$"<<<AcFFFF     D $(  #( 4())s   3 
A A c                 H   t                      | _        | j                            | j                   | j                            | j                   | j                            | j                   | j                            | j	                   | j        
                    | j                   | j                            | j                   t                      | _        | j                            | j                   | j                            | j                   | j                            | j        dd                    | j                            | j	                   | j                            | j                   t                      | _        | j                            | j                   | j                            | j                   | j                            | j                   | j                            | j	                   | j                            | j                                        t$          j        z             | j                            | j                   | j                            | j                   t                      | _        | j                            | j                   | j                            | j                   | j                            | j        dd                    | j                            | j	                   | j                            | j                                        t$          j        z             | j                            | j                   | j                            | j                   dS )a;  Generate the conversation specific user Credentials.

        Each Conversation has an associated user account used to simulate
        any non Administrative user traffic.

        Generates user credentials with good and bad passwords and ldap
        simple bind credentials with good and bad passwords.
        N)r   
user_credsguessr   set_workstationr:  set_passwordr=  set_usernamer<  
set_domainr   set_kerberos_stater   user_creds_badsimple_bind_credsset_gensec_featuresget_gensec_featuresr   FEATURE_SEALset_bind_dnrB  simple_bind_creds_badr   s    rY   rD  z!ReplayContext.generate_user_creds1  s     &--dg&&&''(9:::$$T]333$$T]333""4;///**4+>???)mm!!$'***++D,=>>>((ss);<<<((777..t/BCCC "-$$TW---..t/@AAA++DM:::++DM:::22"66886;NN	P 	P 	P11$2EFFF**4<888%0]]""((111"2243DEEE"//crc0BCCC"//>>>"66&::<< 	! 	! 	! 	"55d6IJJJ"..t|<<<<<r[   c                    t                      | _        | j                            | j                   | j                            | j                   | j                            t                     | j                            | j	                   | j        
                    | j        dz              | j                            | j                   | j                            | j                   t                      | _        | j                            | j                   | j                            | j                   | j                            t                     | j                            | j	        dd                    | j        
                    | j        dz              | j                            | j                   dS )zGenerate the conversation specific machine Credentials.

        Each Conversation has an associated machine account.

        Generates machine credentials with good and bad passwords.
        $NrO  )r   machine_credsrQ  r   rR  r:  set_secure_channel_typer   rS  r;  rT  rU  r   rV  r   machine_creds_badr   s    rY   rC  z$ReplayContext.generate_machine_creds_  s~    )]]  )))**4+<===22<@@@''(8999''(9C(?@@@%%dk222--d.ABBB!,$$TW---..t/@AAA66|DDD++D,<SbS,ABBB++D,=,CDDD11$2EFFFFFr[   c                    | j                             |          }|rt          j        |          S |                                }|r4|| j        v rt          j        | j        |                   S |dd          }|4| j        S )N   )r  r   r*  choicer  r  r   )r   r$  
attributes	attr_clues       rY   get_matching_dnzReplayContext.get_matching_dnx  s     +//
;;	 	,=+++--// 	"$+%%}T[%9:::abbkG	  	" |r[   Fc                     d}| j         r|s| j         d         S t          d| j        z  |df| j                  }| j                             |           |S )Nz$12345678-1234-abcd-ef00-01234567cffbzncacn_ip_tcp:%sr_   )r4  r   r   r   r  )r   newguidcs       rY   get_dcerpc_connectionz#ReplayContext.get_dcerpc_connection  sg    5" 	/3 	/*2...<"AY1 1&&q)))r[   c                       j         r|s j         d         S  fd}                     | j         j         j                  \  } _         j                             |           |S )Nrj  c                 J    t          j         dj        z  j        |           S Nzncacn_np:%s)r   r   r   r   r   s    rY   connectz4ReplayContext.get_srvsvc_connection.<locals>.connect  s(    =$+!>!%!&( ( (r[   )r8  rM  rP  rW  r   r  r   rk  rs  rm  s   `   rY   get_srvsvc_connectionz#ReplayContext.get_srvsvc_connection  s    " 	/3 	/*2..	( 	( 	( 	( 	( ,,W-1_-1-@-1-AC C 	"D  	&&q)))r[   c                       j         r|s j         d         S  fd}                     | j         j         j                  \  } _         j                             |           |S )Nrj  c                 V    d}t          j        dj        d|dj        |           S )Nzschannel,seal,signncacn_ip_tcp:[]r   lsarpcr   r   )r   binding_optionsr   s     rY   rs  z4ReplayContext.get_lsarpc_connection.<locals>.connect  s:    2O::#{{{OOO="g#% % %r[   )r5  rM  r`  rb  r   r  rt  s   `   rY   get_lsarpc_connectionz#ReplayContext.get_lsarpc_connection  s    " 	/3 	/*2..	% 	% 	% 	% 	% ,,W-1-?-1-C-1-AC C 	"D  	&&q)))r[   c                       j         r|s j         d         S  fd}                     | j         j         j                  \  } _         j                             |           |S )Nrj  c                 J    t          j        dj        z  j        |           S rq  r{  rr  s    rY   rs  z?ReplayContext.get_lsarpc_named_pipe_connection.<locals>.connect  s(    :mt{;"g#% % %r[   )r6  rM  r`  rb  r   r  rt  s   `   rY    get_lsarpc_named_pipe_connectionz.ReplayContext.get_lsarpc_named_pipe_connection  s    ( 	5 	5044	% 	% 	% 	% 	% ,,W-1-?-1-C-1-GI I 	(D& 	%,,Q///r[   c                       j         r|s j         d         }|S  fd}                     | j         j         j                  \  } _        t          |          \  }}||f} j                             |           |S )zget a (drs, drs_handle) tuplerj  c                 Z    d}dj         d|d}t          j        |j        |           S )Nsealrx  ry  rz  )r   r   r   )r   r}  binding_stringr   s      rY   rs  z:ReplayContext.get_drsuapi_connection_pair.<locals>.connect  s6    $OO"kkk???<N?>47EBBBr[   )r7  rM  rP  rW  r   r   r  )r   rk  unbindrm  rs  drs
drs_handlesupported_extensionss   `       rY   get_drsuapi_connection_pairz)ReplayContext.get_drsuapi_connection_pair  s    # 	C 	(,AH	C 	C 	C 	C 	C ,,W-1_-1-@-1-BD D 	%d# .8__*)* ''***r[   c                 >     j         r|s j         d         S  fd} fd}|r0                     | j         j         j                  \  } _        n/                     | j         j         j                  \  } _         j                             |           |S )Nrj  c                 B    t          dj        z  | j                  S )a$  
            To run simple bind against Windows, we need to run
            following commands in PowerShell:

                Install-windowsfeature ADCS-Cert-Authority
                Install-AdcsCertificationAuthority -CAType EnterpriseRootCA
                Restart-Computer

            z
ldaps://%sr   r   r   r   r   rr  s    rY   simple_bindz6ReplayContext.get_ldap_connection.<locals>.simple_bind  s-     3%* G% % % %r[   c                 B    t          dj        z  | j                  S )Nr   r  r  rr  s    rY   	sasl_bindz4ReplayContext.get_ldap_connection.<locals>.sasl_bind  s+    t{2%* G% % % %r[   )	r3  rM  rX  r]  r   rP  rW  r   r  )r   rk  simpler  r  samdbs   `     rY   get_ldap_connectionz!ReplayContext.get_ldap_connection  s      	- 	-(,,	% 	% 	% 	% 	%	% 	% 	% 	% 	%  	E00151G151K151JL L /UD-- 0015151D151CE E (UD& 	$$U+++r[   c                     | j         r|r9| j                             t          | j        | j        | j                             | j         d         S )N)r   r   rj  )r9  r  SamrContextr   r   r   )r   rk  s     rY   get_samr_contextzReplayContext.get_samr_context  sZ    ! 	HS 	H%%DKDG4:FFFH H H!"%%r[   c                       j         r j         S  fd}                     | j         j         j                  \  } _        | _         |S )Nc                 J    t          j         dj        z  j        |           S )Nzncacn_ip_tcp:%s[schannel,seal])r   r   r   rr  s    rY   rs  z6ReplayContext.get_netlogon_connection.<locals>.connect  s-    $%E&*k&3%)W%*, , ,r[   )r   rM  r`  rb  r   )r   rs  rm  s   `  rY   get_netlogon_connectionz%ReplayContext.get_netlogon_connection  sv    # 	,++	, 	, 	, 	, 	, ,,W-1-?-1-C-1-CE E 	$D"
 $% r[   c                     | j         dfS )NAr   r   s    rY   guess_a_dns_lookupz ReplayContext.guess_a_dns_lookup$  s    
C  r[   c                     | j                                         }t                      }d |d         D             |j        _        |d         |_        t                      }||fS )Nc                 Z    g | ](}t          |t                    r|nt          |          )S rp   )
isinstancer   ordr  s     rY   
<listcomp>z3ReplayContext.get_authenticator.<locals>.<listcomp>*  sA     : : :!" #-Q"4"4@QQ#a&& : : :r[   
credentialr}   )r`  new_client_authenticatorr   creddatar}   )r   authcurrent
subsequents       rY   get_authenticatorzReplayContext.get_authenticator'  sl    !::<<%'': :&*<&8: : : -'))
$$r[   c                     t           j                            | j        |          }t	          |d          }|                                D ]\  }}t          |d||           |                                 dS )zWrite arbitrary key/value pairs to a file in our stats directory in
        order for them to be picked up later by another process working out
        statistics.wz: rO   N)ospathr   r   openitemsrR   close)r   filenamekwargsrH  r%  vs         rY   write_statszReplayContext.write_stats1  sw     7<<x883LLNN 	- 	-DAqaaa#!,,,,,						r[   r   )F)FF)rw   rx   ry   r   r  environr   r   r   r/  rF  rM  rD  rC  rh  rn  ru  r~  r  r  r  r  r  r  r  r  rp   r[   rY   r   r   Z  s         %)'+!%
x00 !*+ *+ *+ *+XPF PF PFn! ! !$# # #>* * *8,= ,= ,=\G G G2   ,      $   (   $   .$ $ $ $L& & & &  $! ! !% % %    r[   r   c                   &    e Zd ZdZddZd Zd ZdS )r  z5State/Context associated with a samr connection.
    Nc                     d | _         d | _        d | _        d | _        d | _        d | _        d | _        || _        || _        || _	        d S r   )

connectionhandledomain_handler   group_handleuser_handleridsr   r   r   )r   r   r   r   s       rY   r   zSamrContext.__init__?  sO    !!!!!!!	#"


r[   c                 z    | j         s.t          j        d| j        z  | j        | j                  | _         | j         S )Nzncacn_ip_tcp:%s[seal])lp_ctxr   )r  r   r   r   r   r   s    rY   get_connectionzSamrContext.get_connectionK  sB     	("i'4;7w J( ( (DO
 r[   c                     | j         s9|                                 }|                    d t          j                  | _         | j         S r   )r  r  Connect2r   SEC_FLAG_MAXIMUM_ALLOWED)r   rm  s     rY   
get_handlezSamrContext.get_handleT  s>    { 	N##%%A**T8+LMMDK{r[   NN)rw   rx   ry   r   r   r  r  rp   r[   rY   r  r  <  sP         
# 
# 
# 
#      r[   r  c                   r    e Zd ZdZ	 	 ddZd Zd Z	 ddZd	 ZeZ	d
 Z
d Zd Zd ZddZddZd Zd ZdS )ConversationzADetails of a converation between a simulated client and a server.Nrp   c                     || _         || _        g | _        t          |          | _        d| _        || _        |D ]} | j        |  d S )Nr   )
start_timer   packetsrt   rW   client_balancer   add_short_packet)r   r  r   seqr   rn   s         rY   r   zConversation.__init__]  sb    $"&y11!. 	& 	&A!D!1%%%	& 	&r[   c                 V    | j         |j         dS dS |j         dS | j         |j         z
  S )Nr   rj  r_   )r  r   s     rY   r   zConversation.__cmp__h  s;    ?"'q2#1!111r[   c                    |                                 }| j        |j        | _        | j        |j        | _        |j        | j        k    rt	          d| j        d|j                  |xj        | j        z  c_        |j        |j        d         k    r#| xj        |                                z  c_        n"| xj        |                                z  c_        |                                r| j	        
                    |           dS dS )zmAdd a packet object to this conversation, making a local copy with
        a conversation-relative timestamp.NzConversation endpoints z don't matchpacket endpoints r   )r   r  r}   r   rv   r   r  r   r   r  r  )r   packetrn   s      rY   
add_packetzConversation.add_packetq  s    KKMM?"kDO>![DN;$.((!/#'>>>1;;#@ A A A 	
t&5AKN""1>>#3#331>>#3#33!! 	#L"""""	# 	#r[   Tc                 0   |rt          ||          sdS |                                 \  }}|s||}}||f}	t                              |	d          }
t                              |d          }t          || j        z
  |d|||||
|	  	        }|j        |j        d         k    r#| xj	        |
                                z  c_	        n"| xj	        |
                                z  c_	        |                                r| j                            |           dS dS )zCreate a packet from a timestamp, and 'protocol:opcode' pair, and a
        (possibly empty) list of extra data. If client is True, assume
        this packet is from the client to the server.
        Nr   06r   )r   guess_client_serverOP_DESCRIPTIONSr   IP_PROTOCOLSr{   r  r   r   r  r   r   r  r  )r   r}   r   r   r   clientskip_unused_packetsr   r   r   r   r~   r  s                rY   r  zConversation.add_short_packet  s;     	'7&'I'I 	F,,..	T 	"cC ""3++"&&x66	DO3[C &$7 7 :)!,,,6#6#6#8#886#6#6#8#88$$&& 	(L'''''	( 	(r[   c                 V    d| j         | j        | j        t          | j                  fz  S )Nz-<Conversation %s %s starting %.3f %d packets>)r   r   r  lenr  r   s    rY   r   zConversation.__str__  s/    ?%t~tT\""$$ 	%r[   c                 *    t          | j                  S r   )iterr  r   s    rY   __iter__zConversation.__iter__  s    DL!!!r[   c                 *    t          | j                  S r   )r  r  r   s    rY   __len__zConversation.__len__  s    4<   r[   c                     t          | j                  dk     rdS | j        d         j        | j        d         j        z
  S )Nr#   r   rj  )r  r  r}   r   s    rY   get_durationzConversation.get_duration  s:    t|q  1|B)DLO,EEEr[   c                 *      fd j         D             S )Nc                 D    g | ]}|                     j                  S rp   )r   r  )r  rn   r   s     rY   r  z8Conversation.replay_as_summary_lines.<locals>.<listcomp>  s'    DDD!T_--DDDr[   )r  r   s   `rY   replay_as_summary_linesz$Conversation.replay_as_summary_lines  s    DDDDt|DDDDr[   c                 n   | j         }t          j                    |z
  }||z
  }|t          z
  }|dk    rt          j        |           t          j                    |z
  |z
  }|                     d| |fz             d}	d}
t          j                    }| j        D ]}t          j                    |z
  }||j        z
  }||	k    r|}	|dk     rS| t          z
  }|dk    rBt          j        |           t          j                    |z
  }||j        z
  |
k    r
||j        z
  }
|                    | |           |	||
fS )zMReplay the conversation at the right time.
        (We're already in a fork).r   zstarting %s [miss %.3f]r   )r  r   SLEEP_OVERHEADsleeprW   r  r}   r   )r   r   r   rE  r   nowgap
sleep_timemissmax_gapmax_sleep_missp_startrn   s                rY   replay_with_delayzConversation.replay_with_delay  sF    OikkE!#g>)
>>Jz"""	e#q(*dD\9:::)++ 	" 	"A)++'C#CW}}Qww!TN2
>>Jz***	g-A1;77)*Q[FF4!!!!n,,r[   c                 f    | j         \  }}| j        dk     r||fS | j        dk    r
||k    r||fS ||fS )zhHave a go at deciding who is the server and who is the client.
        returns (client, server)
        r   )r   r  )r   server_cluere   bs       rY   r  z Conversation.guess_client_server  sR     ~1""q6M
 !##q(8(8q6M1vr[   c                 |    fd| j         D             | _         | j         r| j         d         j        nd| _        dS )zPrune any packets outside the timne window we're interested in

        :param s: start of the window
        :param e: end of the window
        c                 >    g | ]}|j         cxk    rk    n n|S rp   r   )r  rn   r   rr   s     rY   r  z>Conversation.forget_packets_outside_window.<locals>.<listcomp>  s<    IIIa13H3H3H3Hq3H3H3H3H3H3H3H3Hr[   r   Nr  r}   r  )r   rr   r   s    ``rY   forget_packets_outside_windowz*Conversation.forget_packets_outside_window  sG     JIIII4<III7;|M$,q/33r[   c                 l    | j         D ]}|xj        |z  c_        | j        | xj        |z  c_        dS dS )z=Adjust the packet start times relative to the new start time.Nr  )r   r  rn   s      rY   renormalise_timeszConversation.renormalise_times  sI     	& 	&AKK:%KKK?&OOz)OOOO '&r[   )NNrp   N)TTr  r   )rw   rx   ry   r   r   r   r  r  r   r   r  r  r  r  r  r  r  r  rp   r[   rY   r  r  [  s       KK<>!%	& 	& 	& 	&2 2 2# # #6 ;?( ( ( (8% % %
 H" " "! ! !F F F
E E E!- !- !- !-F   "N N N* * * * *r[   r  c                   0    e Zd ZdZddZd ZddZddZdS )	DnsHammerzOA lightweight conversation that generates a lot of dns:0 packets on
    the flyNc                     t          |z            }fdt          |          D             | _        | j                                         || _        | _        d| _        |                     |          | _        d S )Nc                 :    g | ]}t          j        d           S )r   )r*  uniform)r  r&  r   s     rY   r  z&DnsHammer.__init__.<locals>.<listcomp>  s%    DDDafnQ11DDDr[   r   
query_file)	r   r  timessortrater   r  _get_query_choicesquery_choices)r   dns_rater   r  ns     `  rY   r   zDnsHammer.__init__  s|    8#$$DDDD588DDD

	 !44
4KKr[   c                 J    dt          | j                  | j        | j        fz  S )Nz-<DnsHammer %d packets over %.1fs (rate %.2f)>)r  r  r   r  r   s    rY   r   zDnsHammer.__str__  s%    ?TZ$-;< 	=r[   c                    |rt          |d          5 }|                                }ddd           n# 1 swxY w Y   g }|                                D ]l}|                                }|rT|                    d          s?|                    d          }t          |          dk    sJ |                    |           m|S g dS )z
        Read dns query choices from a file, or return default

        rname may contain format string like `{realm}`
        realm can be fetched from context.realm
        r#  N#r     )
)r   {realm}r  yes)r_   r  NSr  )r#   	*.{realm}r  no)rd  r  r  r  )
   _msdcs.{realm}r  r  )   r  r  r  )   nx.realm.comr  r  )   r  r  r  )   *.nx.realm.comr  r  )   r  r  r  )r  read
splitlinesstripr  r   r  r  )r   r  rH  textchoicesr   rX   s          rY   r  zDnsHammer._get_query_choices  s     	j#&&  !vvxx                             G)) ) )zz|| ) 4 4 )::c??Dt99>>>>NN4(((N   s   488c           
         |sJ |j         sJ t          j                    }| j        D ]+}t          j                    |z
  }||z
  }|t          z
  }|dk    rt          j        |           t          j        | j                  \  }}}	}
|                    |j                   }d}t          j                    }	 t          ||	          }|
dk    rt          |          sd}n# t          $ r d}Y nw xY wt          j                    }||z
  }t          d||||fz             # t          j                    }||z
  }t          d||||fz             w xY wd S )Nr   r  Tr  Fz%f	DNS	dns	%s	%f	%s	)r   r   r  r  r  r*  re  r  r
  	dns_queryr  r   rR   )r   r   r   r   r  r  r  r   rnamertypeexistsuccesspacket_startanswersr`   r   s                   rY   replayzDnsHammer.replay4  s   }	 	W 	WA)++%Cc'C~-JA~~
:&&&*0-8J*K*K'FE5%LLw}L55EG9;;L
W#E511E>>#g,,>#G        ikk-2c68W5UUVVVV ikk-2c68W5UUVVVV+	W 	Ws*   9'C! D"!C0-D"/C00D""0Er   )rw   rx   ry   r   r   r   r  r(  rp   r[   rY   r  r    st         L L L L= = =   BW W W W W Wr[   r  countc                 "   t          t                    }g }| D ]}t          |t                    rt	          |          }t          d|j        t          j                   |D ]X}t          
                    |          }|j        dk    r|dk    r||j        xx         dz  cc<   C|                    |           Y|                                 |sg dfS t          d |D                       }t!          d |D                       }t          d	t          j                   t#                      }	t%          |          D ]c\  }
}|xj        |z  c_        |	                    |j                  }|t-          |
dz             }||	|j        <   |                    |           dg }|	                                D ]*}t3          |          dk    r|                    |           +t5          ||z
            }t3          |	          |z  }||||fS )zLLoad a summary traffic summary file and generated Converations from it.
    z
Ingesting rO   r'   includer_   r   c              3   $   K   | ]}|j         V  d S r   r   r  rn   s     rY   r  z#ingest_summaries.<locals>.<genexpr>f  s$      22QQ[222222r[   c              3   $   K   | ]}|j         V  d S r   r   r-  s     rY   r  z#ingest_summaries.<locals>.<genexpr>g  s$      33aak333333r[   z$gathering packets into conversationsNr#   )r   )r   r   r  r  r  rR   rM   rS   rT   r{   r   r   r   r  r  minmaxr   	enumerater}   r   r   r  r  valuesr  r   )filesdns_mode
dns_countsr  rH  r   rn   r  last_packetconversationsr&  rm  conversation_listr   mean_intervals                  rY   ingest_summariesr:  P  s8    S!!JG  a 	QA(sz:::: 	" 	"D  &&AzU""x9'<'<18$$$)$$$$q!!!!					 1u22'22222J33733333K	
0szBBBBMMM'""  1	z!ak**9a!e555A)*M!+&	Q !!## ( (q66Q;;$$Q'''
 [:-..H&&1MmXzAAr[   c                     t                      }| D ]}|                    |j                   |r|                    d          d         S d S )Nr_   r   )r   updater   most_common)r7  	addressesrm  s      rY   guess_server_addressr?    s^    		I & &%%%% +$$Q''**+ +r[   c                 r    i }|                                  D ]\  }}d                    |          }|||<    |S Nr   )r  r   )rs   yr%  r  k2s        rY   stringify_keysrD    sA    
A		  1YYq\\"Hr[   c                     i }|                                  D ]9\  }}t          t          |                              d                    }|||<   :|S rA  )r  rU   r  r   )rs   rB  r%  r  r   s        rY   unstringify_keysrF    sQ    
A		  1#a&&,,t$$%%!Hr[   c                   V    e Zd ZddZi fdZd Zd Z	 	 	 	 	 dd
Zd Zd Z		 	 ddZ
dS )TrafficModelrd  c                     i | _         i | _        || _        t          t                    | _        d| _        ddg| _        d S )Nr   r   r_   )ngramsquery_detailsr  r   r   dns_opcountscumulative_durationpacket_rate)r   r  s     rY   r   zTrafficModel.__init__  sB    ',,#& q6r[   c           
         d}d}t           f| j        dz
  z  }t          |          }|                                D ]\  }}| j        |xx         |z  cc<   t          |          dk    rb|d         j        }	d}
|	dz   }|D ]4}|
t          |          z  }
t          ||j        d         j	                  }5|
| j
        d<   ||	z
  | j
        d<   |D ]m}|                    |          \  }}||                                z  }t           f| j        dz
  z  }|D ]$}|j        |k    r|j	        |z
  }|j	        }|t          k    ridt          j        t          d|t"          z                      z  }| j                            |g                               |           |dd          |fz   }|                                }| j                            |g                               t/          |j                             | j                            |g                               |           |dd          |fz   }&o| xj        |z  c_        | j                            |g                               t                      d S )Nr   r_   r   g?rj  wait:%dr%   )
NON_PACKETr  r?  r  rL  r  r  r0  r  r}   rN  r  r  r   WAIT_THRESHOLDmathlog
WAIT_SCALErJ  r  r  r   rK  rU   r   rM  )r   r7  rL  prevcum_durationr   r   r%  r  firsttotallastrm  r  rn   elapsedr   short_ps                     rY   learnzTrafficModel.learn  s   mtvz*%m44 &&(( 	& 	&DAqa   A%    }!!!!$/EE3;D" : :Q42!899"'DQ"&,DQ 	+ 	+A226::NFFANN,,,L-46A:.C + +5F??+,{^++$S5<z5I2K 2K )L )L MDK**333::4@@@abb'TG+C**,,"--g.02 228&qw2H2H2H&&sB//66w???!""g
*#+& 	  L0  sB''..z:::::r[   c                    i }| j                                         D ]9\  }}d                    |          }t          t	          |                    ||<   :i }| j                                        D ].\  }}t          t	          d |D                                 ||<   /||| j        | j        t          d}| j	        |d<   t          |t                    rt          |d          }t          j        ||d           d S )Nr   c              3   H   K   | ]}|rd                      |          ndV  dS )r   r$   N)r   r  s     rY   r  z$TrafficModel.save.<locals>.<genexpr>  sI       ,8 ,801 =>,FDIIaLLL3 ,8 ,8 ,8 ,8 ,8 ,8r[   )rJ  rK  rM  rN  versionr'   r  r#   )indent)rJ  r  r   dictr   rK  rM  rN  CURRENT_MODEL_VERSIONrL  r  r  r  jsondump)r   rH  rJ  r%  r  rK  ds          rY   savezTrafficModel.save  s#   K%%'' 	) 	)DAq		!AWQZZ((F1II&,,.. 	9 	9DAq#G ,8 ,856,8 ,8 ,8 %8 %8  9  9M! *#'#;+,
 
 $%a 	QA	!Qq!!!!!!r[   c           	         t          |t                    rt          |          }t          j        |          }	 |d         }|t
          k     rt          d|t
          fz            n%# t          $ r t          dt
          z            w xY w|d                                         D ]\  }}t          t          |          
                    d                    }| j                            |g           }|                                D ]+\  }}|                    t          |          g|z             ,|                                 |d                                         D ]\  }}| j                            t          |          g           }|                                D ]k\  }}|dk    r|                    dg|z             %|                    t          t          |          
                    d                    g|z             l|                                 d	|v r5|d	                                         D ]\  }}| j        |xx         |z  cc<   |d
         | _        |d         | _        d S )Nr`  z4the model file is version %d; version %d is requiredz=the model file lacks a version number; version %d is requiredrJ  r   rK  r$   rp   r'   rM  rN  )r  r  r  rd  loadREQUIRED_MODEL_VERSION
ValueErrorKeyErrorr  rU   r   rJ  r  extendr  rK  rL  rM  rN  )	r   rH  rf  r`  r%  r  r2  rn   r)  s	            rY   ri  zTrafficModel.load  s   a 	QAIaLL		;	lG///  ":")+A!B"C D D D 0  	; 	; 	;  ":"8": ; ; ;	;
 hK%%'' 	 	DAqc!ffll4(())A[++Ar22FGGII 0 05s1vvh.////KKMMMMo&,,.. 	 	DAq'223q662>>FGGII G G588MM2$,////MM5Qd););#<#<"="EFFFFKKMMMMA::%(( * *1!!$$$)$$$$#$%:#; ]+s   ,A' '"B	r   Nr_   r   c                    g }t           f| j        dz
  z  }||dz
  }	 t          j        | j                            |t           f                    }|t           k    rw||k     rnt          j                    |k    r"t          d||fz  t          j                   njdt          j	        dd          z  }t          d	|z  t          j                   || j
        v r t          j        | j
        |                   }	ng }	|                    d
d          \  }
}|
dk    rHt          |          t          j                    z   }t          j        |          t          |z  z  }||z  }nWt          j        t"           }t          j        |          |z  }||z  }|||k    rnj||k    r|                    ||
||	f           |dd         |fz   }|d         dd         dk    r'|d         dd         dk    rt           f| j        dz
  z  }|S )zUConstruct an individual conversation packet sequence from the
        model.
        r_   NTz"ending after %s (persistence %.1f)rO   rP  r     ztrying %s instead of endr   r   zwait:rj  )rQ  r  r*  re  rJ  r   rR   rS   rT   	randrangerK  r   r   rS  exprU  r  NO_WAIT_LOG_TIME_RANGEr  )r   r}   	hard_stopreplay_speedignore_beforepersistencerm  r   rn   r   r   r   log_wait_timer   log_waits                  rY   construct_conversation_sequencez,TrafficModel.construct_conversation_sequence  s$    mtvz* %MM%	3dkoocJ=AABBAJ},,=??[00>#{ASS"z+ + + + 0B 7 770143:FFFFD&&&d&8&;<< wwsAHf6!! #Ffmoo =x..*|2KLT!		!>+ABx))L8T!	(Y-B-B--HHi65ABBBabb'QD.C2wrr{g%%#b'"1"+*@*@ "mtvz2K%	3N r[   c                 &    | j         \  }}||z  |z  S r   rN  )r   scalerate_nrate_ts       rY   scale_to_packet_ratez!TrafficModel.scale_to_packet_rateN  s    *v~&&r[   c                 &    | j         \  }}||z  |z  S r   r|  )r   ppsr~  r  s       rY   packet_rate_to_scalez!TrafficModel.packet_rate_to_scaleR  s    *fv%%r[   c                    d|z  }t          ||z            }g }d}||k     rzt          j        | |          }	|                     |	||d|          }
|
D ]\  }}}}t	          ||          r nS|                    |
           |t          |
          z  }||k     z|                     |          }t          d||t          |          ||fz  t          j
                   |                                 |S )z<Generate a list of conversation descriptions from the model.	   r   )rt  ru  rv  rw  zGwe have %d packets (target %d) in %d conversations at %.1f/s (scale %f)rO   )r   r*  r  rz  r   r  r  r  rR   rS   rT   r  )r   rN  r   ru  rw  lead_intarget_packetsr7  	n_packetsr   rm  r}   r   r   r   r}  s                   rY   generate_conversation_sequencesz,TrafficModel.generate_conversation_sequencesV  sM    h,[8344	.((NG8X66E44U?GBNCDAL	 5 N NA 78  2	8VU1(FCC E   ###QI% .((( ))+66 (.#m:L:L*E33 :	 	 	 	 	r[   )rd  )r   Nr_   r   r   )r_   r   )rw   rx   ry   r   r]  rg  ri  rz  r  r  r  rp   r[   rY   rH  rH    s        " " " " 13 .; .; .; .;`" " "2&, &, &,P 9<26566745	4 4 4 4l' ' '& & & ST45% % % % % %r[   rH  r_   c                     g }| D ]=}|r9t          |d         d         ||f|          }|dz  }|                    |           >|S )Nr   r_   )r  r  )r  r   r  r7  rr   rm  s         rY   seq_to_conversationsr  ~  s`    M $ $ 	$QqT!Wvv&6::AaKF  ###r[   r'   r6   rpc_netlogonr  r   r*   rI   r-   r3   r|  r   r5   epmr   rJ   rK   r   r:   )rJ   0x01zHost Announcement (0x01))rJ   0x02zRequest Announcement (0x02))rJ   0x08zBrowser Election Request (0x08))rJ   0x09zGet Backup List Request (0x09))rJ   0x0cz$Domain/Workgroup Announcement (0x0c))rJ   0x0fz Local Master Announcement (0x0f)r2   searchRequestrB   searchResDone)r5   r(   Requestr4   BindrC   Bind_ackrE   Bind_nakr7   Alter_contextrG   Alter_context_respr   AUTH3)r5   r1   Responser&   r	   r;   response)r   r(   DsBind)r   rD   DsCrackNames)r   rF   DsWriteAccountSpn)r   r<   DsUnbind)r   r1   DsReplicaSync)r   r/   DsGetNCChanges)r   r?   DsReplicaUpdateRefs)r  r/   Mapr   r   r,   bindRequestr=   bindResponser0   unbindRequestr.   r>   searchResEntryr@   )r-   r   z*** Unknown ***)r|  r8   lsa_LookupNames)r|  rH   lsa_LookupSids)r|  39lsa_QueryTrustedDomainInfoBySid)r|  40lsa_SetTrustedDomainInfo)r|  6lsa_OpenPolicy)r|  76lsa_LookupSids3)r|  77lsa_LookupNames4r9   )r:   r<   )r  21NetrLogonDummyRoutine1)r  26NetrServerAuthenticate3)r  29NetrLogonGetDomainInfo)r  30NetrServerPasswordSet2)r  r  NetrLogonSamLogonEx)r  r  DsrEnumerateDomainTrusts)r  45NetrLogonSamLogonWithFlags)r  r?   NetrServerReqChallenge)r   r(   Connect)r   r   GetAliasMembership)r   17LookupNames)r   18
LookupRids)r   19	OpenGroup)r   r<   Close)r   25QueryGroupMember)r   34OpenUser)r   36QueryUserInfo)r   r  GetGroupsForUser)r   r/   QuerySecurity)r   rA   LookupDomain)r   64Connect5)r   r  EnumDomains)r   7
OpenDomain)r   8QueryDomainInfo)r*   0x04zClose (0x04))r*   0x24zLocking AndX (0x24))r*   0x2ezRead AndX (0x2e))r*   0x32zTrans2 (0x32))r*   0x71zTree Disconnect (0x71)r)   zNegotiate Protocol (0x72))r*   0x73zSession Setup AndX (0x73))r*   0x74zLogoff AndX (0x74))r*   0x75zTree Connect AndX (0x75))r*   0xa2zNT Create AndX (0xa2))rI   r(   NegotiateProtocol)rI   r6   Ioctl)rI   r8   Find)rI   r   GetInfo)rI   r  Break)rI   r<   SessionSetup)rI   r1   SessionLogoff)rI   r/   TreeConnectTreeDisconnectCreateReadz$SAM LOGON request from client (0x12)z3SAM Active Directory Response - user unknown (0x17)NetShareGetInfoNetSrvGetInfo))rI   r?   )rI   rA   )rI   r  )rI   r  )rK   0x12)rK   0x17)r   r   )r   r  c                    |                      dd          \  }}t                              ||fd          }t                              |d          }||d|||||g}	|	                    |           d                    |	          S )Nr   r_   r   r  r   )r   r  r   r  rm  r   )
rn   r}   r   r   r   r   r   r   r~   r   s
             rY   expand_short_packetr    s    wwsAHf&1266D""8T22K{BT8VTJDKK99T??r[   c                     t           j                                         t           j                                         t	          j        d           dS )zSignal handler closes standard out and error.

    Triggered by a sigterm, ensures that the log messages are flushed
    to disk and not lost.
    r   N)rS   rT   r  stdoutr  _exit)signalframes     rY   flushing_signal_handlerr    s=     JJHQKKKKKr[   c                    |dz  t          j        dd          z   }t          j                                         t          j                                         t          j                    }|dk    r|S 	 t          j        |           ||f}d}	| d         d         }
t          |
|| |          }t          j
        t          j        t                     |                    ||           t          j                                         t          j        d           t          j                            |j        d|j        z            }t)          |d          }	 t          j                                         t          j        d           n4# t*          $ r'}t,                              d|z             Y d	}~nd	}~ww xY w|t          _        t1          j                    |z
  }|
|z
  }|t2          z
  }|dk    rt1          j        |           |                    ||
          \  }}}t9          d|z             t9          d|z             t9          d|z             n# t:          $ rr d}	t9          dt          j                    |fz  t          j                   t?          j         t          j                   t          j                                         Y nw xY wt          j                                         t          j                                         t          j!        |	           d	S # t          j                                         t          j                                         t          j!        |	           w xY w)z8Fork a new process and replay the conversation sequence.  r   i  )r  r   zstats-conversation-%dr  r_   stdout closing failed with %sN)r   r   zMaximum lag: %fzStart lag: %fzMax sleep miss: %fz*EXCEPTION in child PID %d, conversation %srO   )"r*  randintrS   r  rc   rT   r  forkseedr  r  SIGTERMr  rF  stdinr  r  r   r   r   r  IOErrorr   infor   r  r  r  rR   r   getpidra   	print_excr  )csr   r   rE  	client_id	server_idr  pidr   statusr   rm  r  rH  r   r  r  r  max_lag	start_lagr  s                        rY   replay_seq_in_forkr    sA    tfnQ444D JJ
'))C
axx

*D	*	qE!HI2yIIIfn&=>>>--gq999	
7<< 02I ! 132 3 33	=JHQKKKK 	= 	= 	=KK7!;<<<<<<<<	= 
ikkE!#g>)
>>Jz"""-.-@-@uIP .A .R .R*N')***o	)***"^34444   ;ry{{A>NN:	 	 	 	CJ'''
 	


 	


sX   4C$I 2F I 
F=F83I 8F==BI L. A9KL. KL. .AN c                    t           j                                         t           j                                         t	          j                    }|dk    r|S t           j                                         t	          j        d           	 t           j                                         t	          j        d           n4# t          $ r'}t          
                    d|z             Y d }~nd }~ww xY wt          j                            |j        d          }t          |d          t           _        	 d}t          j        t          j        t"                     t%          | ||          }|                    |           n_# t(          $ rR d}t+          dt	          j                    z  t           j        	           t/          j        t           j                   Y nw xY wt           j                                         t           j                                         t	          j        |           d S # t           j                                         t           j                                         t	          j        |           w xY w)
Nr   r_   r  z	stats-dnsr  r   )r   z)EXCEPTION in child PID %d, the DNS hammerrO   )rS   r  rc   rT   r  r  r  r  r  r   warnr  r   r   r  r  r  r  r  r(  r   rR   r  ra   r  r  )	r  r   r   r  r  r   r  r  hammers	            rY   dnshammer_in_forkr  Q  s'   JJ
'))C
axx
IOOHQKKK9

 9 9 93a7888888889w||G,k::Hh$$CJfn&=>>>8X*EEEg&&&& ( ( (:bikkJ:	 	 	 	CJ'''''	( 	


 	


sE   2B> >
C/C**C/2AF  H2 AGH2 GH2 2AJFc
                 4   t          d|||t          |           d|
}t          |          t          |           k     r.t          dt          |          t          |           fz            t          j                     t          |           dz  }t          j                    |z   }|| d         d         d         |z   }t          d|z  t          j                   t          d||z   z  t          j                   t          d	|z  t          j                   ||z   d
z   }t          
                    dt          |           |fz             |                    dt          |           t          d | D                                  i }	 |rt          ||||          }d||<   t          |           D ]*\  }}||         }|dz   }t          |||||          }|||<   +t          j                    }t          d||z
  |z   ||z
  fz  t          j                   t          j                    |k     r|rt          j        d           	 t          j        dt          j                  \  }}n(# t&          $ r}|j        t*          k    r Y d }~n{d }~ww xY w|rX|                    |d           }t.          dk    r.t          d||t          |          fz  t          j                   |	r|dk    rnt          j                    |k     r|n># t0          $ r1 t          dt          j                   t3          j                     Y nw xY w|                    dt          |                     dD ]}t          dt          |          |fz  t          j                   |D ]@}	 t          j        ||           # t&          $ r}|j        t8          k    r Y d }~9d }~ww xY wt          j        d           t          j                    dz   }|r	 t          j        dt          j                  \  }}n(# t&          $ r}|j        t*          k    r Y d }~nd }~ww xY w|dk    r|                    |d           }|bt          d|z             t          j                                         t          j                                         t          j        d           t          d||t          |          fz  t          j                   t          j                    |k    rn||s nt          j        d           |r+t          dt          |          z  t          j                   	 t          j         dd           d S # tB          $ r t          dt          j                   Y d S w xY w# |                    dt          |                     dD ]}t          dt          |          |fz  t          j                   |D ]@}	 t          j        ||           # t&          $ r}|j        t8          k    r Y d }~9d }~ww xY wt          j        d           t          j                    dz   }|r	 t          j        dt          j                  \  }}n(# t&          $ r}|j        t*          k    r Y d }~nd }~ww xY w|dk    r|                    |d           }|bt          d|z             t          j                                         t          j                                         t          j        d           t          d||t          |          fz  t          j                   t          j                    |k    rn||s nt          j        d           |r+t          dt          |          z  t          j                   	 t          j         dd           w # tB          $ r t          dt          j                   Y w w xY wxY w) N)r   r   r   r   z(we have %d accounts but %d conversationsg{Gz?rj  r   zWe will start in %.1f secondsrO   zWe will stop after %.1f secondszruntime %.1f secondsr%   z6Replaying traffic for %u conversations over %d seconds
intentionsc              3   4   K   | ]}t          |          V  d S r   )r  r  s     rY   r  zreplay.<locals>.<genexpr>  s(      +M+MqCFF+M+M+M+M+M+Mr[   )Planned_conversationsPlanned_packetsr   r_   r#   z,all forks done in %.1f seconds, waiting %.1fg~jth?z-process %d finished conversation %d; %d to gozEXCEPTION in parent
unfinished)Unfinished_conversations)   r  r  zkilling %d children with -%d      ?zchildren is %s, no pid foundz)kill -%d %d KILLED conversation; %d to goz%d children are missingzignoring fake ^Crp   )"r   r  rk  r  setpgrpr   rR   rS   rT   r   r  r  sumr  r1  r  r  waitpidWNOHANGOSErrorerrnor   poprQ   r   ra   r  killr   rc   r  r  killpgKeyboardInterrupt)conversation_seqhostr   r   accountsr  dns_query_filer   latency_timeoutstop_on_any_errorr  r   delayr   r`   childrenr  r&  r	  rE  r
  r   r  r   rm  rr   s                             rY   r(  r(  s  s~	     &4"'!034D0E0E& & %	& &G 8}}s+,,,,Dx==#.>*?*?@A C C 	C
 JLLL  !!D(EIKK%E $B'+A.@	
)E
1z   	
+x%/?
@z   	
 8
+z    (
S
 C
KKH!""H-. / / / .12B.C.C(++M+M<L+M+M+M(M(M  O O O HY7 	#Hh/=? ? ?CHSM/00 	& 	&EArqkGAI$R)LLC%HSMM IKK<5y5 !e),-:	 	 	 	 ikkCHJu jRZ88VV   7f$$  LLd++?? 'CMM23:=*F F F F % 1 ikkCH"    ##*5555 	L58]] 	 	D 	D 	D  !	 !	A1MM1%&-0Z9 9 9 9  GCOOOO   w%'' ('''' JsOOO)++/C "$*R"<"<KC   w&(( )(((( !88 S$//Ay<xGHHH
((***
((*** &sCMM23  #z+ + + + 9;;#%%%  (  JqMMMM 	#+c(mm;z# # # #	7IaOOOOO  	7 	7 	7$3:6666666	7c 	L58]] 	 	D 	D 	D  !	 !	A1MM1%&-0Z9 9 9 9  GCOOOO   w%'' ('''' JsOOO)++/C "$*R"<"<KC   w&(( )(((( !88 S$//Ay<xGHHH
((***
((*** &sCMM23  #z+ + + + 9;;#%%%  (  JqMMMM 	#+c(mm;z# # # #	7IaOOOO  	7 	7 	7$3:666666	7s  B=L "I2 1L 2
J<JL JA6L V2 8M	V2 M		V2 'N==
O"OO""P66
Q QQ/V %V/.V/2A`X$#`$
Y	.Y?`Y		0`:"Z`
[	'Z=	8`=[	D`_,+`,%````c                 R    t                      }t          d| z  |dg||          }|S )Nr   zmodules:paged_searches)r   r   optionsr   r   )r   r   )r)  r   r   r   r  s        rY   openLdbr2    s>    G
K$&$12!	  C
 Jr[   c                 *    d| | j                     fz  S )z(Generate an ou name from the instance idz#ou=instance-%d,ou=traffic_replay,%s)r  )r  r   s     rY   ou_namer4    s$    0K4ACMOO4E E Er[   c                 N   t          | |          }	  | j        |                    dd          d         dd           n(# t          $ r}|j        \  }}|dk    r Y d}~nd}~ww xY w	  | j        |dd           n(# t          $ r}|j        \  }}|dk    r Y d}~nd}~ww xY w|S )zCreate an ou, all created user and machine accounts will belong to it.

    This allows all the created resources to be cleaned up easily.
    r  r_   organizationalunit)r   objectclassD   N)r4  addr   r   rX   r  r   r   r   r  r   s         rY   	create_our;    s   
 
k	"	"BrxxQ''* 46 6 	7 	7 	7 	7   fR<< <<<<
r 46 6 	7 	7 	7 	7   fR<< <<<<
 Is/   -A   
A%
A  A%)A= =
B"BB"ConversationAccounts)r:  r;  r<  r=  c                     g }t          d|dz             D ]I}t          ||          }t          ||          }t          ||||          }|                    |           J|S )z;Generate a series of unique machine and user account names.r_   )r  machine_namer+  r<  r  )	r  r   numberpasswordr*  r&  r:  r<  rE  s	            rY   generate_replay_accountsrA  :  sv     H1fqj!! ! !#K33[!,,&|Xx'/1 1    Or[   Tc                    t          | |          }d|d|}dt          |          z                      d          }|rt          t          t
          z            }nt          t                    } | j        |dd|z  ||d           dS )	z"Create a machine account via ldap.r2  r  "%s"	utf-16-lecomputerz%s$r   r7  sAMAccountNameuserAccountControl
unicodePwdN)r4  r!   encoder  r   r   r   r9  )	r  r   r:  r;  traffic_accountr   r   utf16pwaccount_controlss	            rY   create_machine_accountrN  H  s     
k	"	"BB#||RR	(B
;///77DDG = 86 7 8 8 ;<<CG!,..           r[   c                 $   t          | |          }d|d|}dt          |          z                      d          } | j        |d|t	          t
                    |d           t          j        |           }|                    |d           dS )	zCreate a user account via ldap.r2  r  rC  rD  userrF  z(A;;WP;;;PS)N)	r4  r!   rJ  r9  r  r   r    SDUtilsdacl_add_ace)r  r   r<  r=  r   rB  rL  sdutilss           rY   create_user_accountrT  a  s    	k	"	"BB$HHbb)G
8,,,44[AAGCG"!"344     s##G.11111r[   c                 ^    t          | |          }d|d|} | j        |d|d           dS )zCreate a group via ldap.r2  r  group)r   r7  rG  N)r4  r9  )r  r   rM   r   r   s        rY   create_grouprW  s  sX     
k	"	"BBttRR	 BCG      r[   c                     d| |fz  S )z-Generate a user name based in the instance idz
STGU-%d-%drp   r   r&  s     rY   r+  r+        ;***r[   rP  rG  c                 l     | j         d                    |          g          }fd|D             S )z'Seach objectclass, return attr in a setz(objectClass={}))r  r   c                 :    h | ]}t          |                   S rp   )r  )r  objattrs     rY   	<setcomp>z%search_objectclass.<locals>.<setcomp>  s#    +++sCD	NN+++r[   )r  r
  )r  r7  r^  objss     ` rY   search_objectclassra    sM    3:%,,[99f  D ,+++d++++r[   c                     t          | d          }d}t          |dd          D ]U}t          ||          }||vr?t          | |||           |dz  }|dz  dk    rt                              d||fz             V|S )zAdd users to the serverrP  r7  r   rj  r_   2   zCreated %u/%u users)ra  r  r+  rT  r   r  )r  r   r?  r@  existing_objectsusersr&  rM   s           rY   generate_usersrg    s    )#6BBBE61b!! E Ea(('''[$AAAQJErzQ1UFOCDDDLr[   c                 "    |rd| |fz  S d| |fz  S )z1Generate a machine account name from instance id.z
STGM-%d-%dzPC-%d-%drp   )r   r&  rK  s      rY   r>  r>    s.     
- {A... [!,,,r[   c                    t          | d          }d}t          |dd          D ]Z}t          |||          }|dz   |vr@t          | ||||           |dz  }|dz  dk    rt                              d||fz             [|S )	z"Add machine accounts to the serverrE  rc  r   rj  r_  r_   rd  zCreated %u/%u machine accounts)ra  r  r>  rN  r   r  )	r  r   r?  r@  rK  re  addedr&  rM   s	            rY   generate_machine_accountsrk    s     *#:FFFE61b!! P PKO<<#:---"3T8#24 4 4QJErzQ<vNOOOLr[   c                     d| |fz  S )z'Generate a group name from instance id.z
STGG-%d-%drp   rY  s     rY   
group_namerm    rZ  r[   c                     t          | d          }d}t          |dd          D ]T}t          ||          }||vr>t          | ||           |dz  }|dz  dk    rt                              d||fz             U|S )z3Create the required number of groups on the server.rV  rc  r   rj  r_   r  zCreated %u/%u groups)ra  r  rm  rW  r   r  )r  r   r?  re  groupsr&  rM   s          rY   generate_groupsrp    s    )#7CCCF61b!! G G+q))'''k4000aKF}!!2ff5EEFFFMr[   c                     t          | |          }	  | j        |dg           dS # t          $ r}|j        \  }}|dk    r Y d}~dS d}~ww xY w)z7Remove the created accounts and groups from the server.ztree_delete:1    N)r4  deleter   rX   r:  s         rY   clean_up_accountsrt    sx    	k	"	"B
2()))))   fR<< <<<<<s   & 
AAAc	                    d}	d}
d}t          | |           t                              d           t          | |||          }t                              d           t	          | ||||          }|dk    r+t                              d           t          | ||          }
|dk    rmt                              d           t          ||
||||          }t                              d           t          | ||           |                                }	|
dk    r&|dk    r ||
k    rt          	                    d           t                              d|||
|	fz             d	S )
zTGenerate the required users and groups, allocating the users to
       those groups.r   zGenerating dummy user accountsz!Generating dummy machine accountszGenerating dummy groupszAssigning users to groupszAdding users to groupsz(The added groups will contain no membersz:Added %d users (%d machines), %d groups and %d membershipsN)
r;  r   r  rg  rk  rp  GroupAssignmentsadd_users_to_groupsrY  warning)r  r   r@  number_of_usersnumber_of_groupsgroup_membershipsmax_membersmachine_accountstraffic_accountsmemberships_addedgroups_addedcomputers_addedusers_addedassignmentss                 rY   generate_users_and_groupsr    s    LOc;
KK0111 k?HMMK
KK3444/[0@(0@B BO !-...&sK9IJJ1/000&'7'3'6'2'8'24 4 	,---Ck:::'--//q[A--<''ABBB
KKLo|"$$ % % % % %r[   c                   P    e Zd Zd Zd Zd Zd Zd Zd Zd Z	d Z
d	 Zd
 Zd ZdS )rv  c                     d| _         |                     |           |                     ||           || _        t	          t
                    | _        |                     |||||           d S )Nr   )r)  generate_group_distributiongenerate_user_distributionr|  r   r  r  assign_groups)r   rz  r  ry  r  r{  r|  s          rY   r   zGroupAssignments.__init__
  s~     
(()9:::''9JKKK&&t,,+\?&(9	; 	; 	; 	; 	;r[   c                     g }t          |          }|dk    rd S d}|D ]}||z  }|                    ||z              |S )Nr   r   )r  r  )r   weightsdistrY  
cumulativeprobabilitys         rY   cumulative_distributionz(GroupAssignments.cumulative_distribution  s_     GA::4
" 	, 	,K+%JKK
U*++++r[   c                     |dk    rd}n|dk    rd}n|dk    rd}nd}g }t          d|dz             D ]+}t          j        |          }|                    |           ,|                     |          | _        d	S )
zAProbability distribution of a user belonging to a group.
        i@KL g      @i g      @i g      @g      ?r_   N)r  r*  paretovariater  r  	user_dist)r   	num_usersnum_membershipsshaper  rs   rn   s          rY   r  z+GroupAssignments.generate_user_distribution&  s     W$$EEw&&EEv%%EEEq)a-(( 	 	A$U++ANN1 55g>>r[   c                     g }t          d|dz             D ]}d|dz  z  }|                    |            || _        |                     |          | _        dS )z6Probability distribution of a group containing a user.r_   g?N)r  r  group_weightsr  
group_dist)r   r  r  rs   rn   s        rY   r  z,GroupAssignments.generate_group_distribution@  si    
 q!a% 	 	AQVANN1 %66w??r[   c                     t          j         | j        t          j                              }t          j         | j        t          j                              }||fS )z2Returns a randomly generated user-group membership)bisectr  r*  r  r   rP  rV  s      rY   generate_random_membershipz+GroupAssignments.generate_random_membershipN  s@     }T^V]__==dov}??U{r[   c                     | j         |         S r   )r  )r   rV  s     rY   users_in_groupzGroupAssignments.users_in_groupZ  s    &&r[   c                 4    | j                                         S r   )r  r  r   s    rY   
get_groupszGroupAssignments.get_groups]  s    $$&&&r[   c                    t          | j        |                   }||k    r^t                              d                    ||                     d| j        |dz
  <   |                     | j                  }|| _        dS dS )z?Prevent the group's membership from exceeding the max specifiedzGroup {0} has {1} membersr   r_   N)r  r  r   r  r
  r  r  r  )r   rV  r|  num_membersnew_dists        rY   cap_group_membershipz%GroupAssignments.cap_group_membership`  s    $*5122+%%KK3::5+NNOOO -.Duqy)33D4FGGH&DOOO &%r[   c                     || j         |         vr0| j         |                             |           | xj        dz  c_        | j        r|                     || j                   d S d S )Nr_   )r  r  r)  r|  r  r  s      rY   add_assignmentzGroupAssignments.add_assignmentl  sx     t'...U#**4000JJ!OJJ  	?%%eT-=>>>>>	? 	?r[   c                    |dk    rdS t          j        t          |          t          |          t          |          z  z            }| j        rt	          || j        |z            }||z
  dz
  }||z
  dz
  }|                                 |k     rY|                                 \  }}	|	|k    s||k    r|                     |dz   |	dz              |                                 |k     WdS dS )a  Allocate users to groups.

        The intention is to have a few users that belong to most groups, while
        the majority of users belong to a few groups.

        A few groups will contain most users, with the remaining only having a
        few users.
        r   Nr_   )rS  ceilr   r|  r/  rY  r  r  )
r   rz  r  ry  r  r{  existing_usersexisting_groupsrP  rV  s
             rY   r  zGroupAssignments.assign_groupsx  s     !!F !I#$$;%"8"88:; ;  	I #$5$($47G$G!I !I *[8A=*\9A=jjll...99;;KD%&&$*?*? ##D1Heai888 jjll.......r[   c                     | j         S r   r)  r   s    rY   rY  zGroupAssignments.total  s
    zr[   N)rw   rx   ry   r   r  r  r  r  r  r  r  r  r  rY  rp   r[   rY   rv  rv  	  s        	; 	; 	;  "? ? ?4@ @ @
 
 
' ' '' ' '
' 
' 
'
? 
? 
?9 9 9B    r[   rv  c                    |                                 }d}d}|                                D ]}|                    |          }t          |          dk    r+t	          dt          |          d          D ]`}|||dz            }	t          | |||	           |t          |	          z  }|dz  }|dz  dk    rt                              d||fz             adS )zDTakes the assignments of users to groups and applies them to the DB.r   r  r_   rd  zAdded %u/%u membershipsN)rY  r  r  r  r  add_group_membersr   r  )
r!  r   r  rY  r)  rj  rV  r  chunkchunk_of_userss
             rY   rw  rw    s
    EEE'')) H H$33E::~!##
 1c.11488 	H 	HE+E%$,,>?Nb+unEEES(((EQJErzQ5FGGG	HH Hr[   c                   
 t          | |          

fd} |t          ||                    }t          j                    }t          j        | |          |_        |D ]P} |t          ||                    }dt          |          z   }	t          j        |t          j	        d          ||	<   Q| 
                    |           dS )z(Adds the given users to group specified.c                     d| dS )Nr2  r  rp   )rM   r   s    rY   build_dnz#add_group_members.<locals>.build_dn  s     !TT22&'r[   zmember-memberN)r4  rm  r  MessageDnr   r+  r  MessageElementFLAG_MOD_ADDmodify)r!  r   rV  r  r  group_dnmrP  rB  idxr   s             @rY   r  r    s     
[	!	!B( ( ( ( ( x
;6677HA6"hAD I I(9[$7788#d))##GS-=xHH#IIaLLLLLr[   c                 	   t           j        j        }d}d}d}i }t                      }t	                      }||j        }	nd }	 |	d           dddd}
dddd}t          j        |           D ]}t          j        	                    | |          }t          |d          5 }|D ]}	 |                    d                              d	          }|d
         }|d         }|d         }t          |d                   }t          |d                   }t          ||z
  |          }t          ||          }||f}|                    |g                               |           |d         dk    r|d
z  }n|d
z  }||xx         d
z  cc<   |                    |            |	|           # t$          t&          f$ r d|v r|                    dd
          \  }}||
v r't          t          |          |
|                   |
|<   nb||v r't          t)          |          ||                   ||<   n7t+          |t           j                   nt+          |t           j                   Y w xY w	 ddd           n# 1 swxY w Y   ||z
  }|dk    rd}n||z  }|dk    rd}n||z  }t/          |          }t+          d|z             t+          d||fz             t+          d||fz             t1          |
                                          D ]0\  }}t+          d|                    dd          dz   |fz             1t1          |                                          D ]0\  }}t+          d|                    dd          dz   |fz             1t+          d           i }|D ]5\  }}||vrt	                      ||<   ||                             |           6t1          |                                          } | D ]}t1          ||         t8                    }!|!D ]}||f}||         }"t1          |"          }"t/          |"          }#||         }t;          |"          |#z  }$t=          |"d          }%t=          |"d          }&|"d         |"d         z
  }'|"d         }(t>                               |d          })t+          d|||)|#||$|%|&|'|(f
z             dS ) z/Generate and print the summary stats for a run.r   Nc                     d S r   rp   )rs   s    rY   twzgenerate_stats.<locals>.tw  s    Dr[   z2time	conv	protocol	type	duration	successful	error
)zMaximum lagz	Start lagzMax sleep miss)r  r  r  r#  r   r   r_   r#   rd  r  r  Truer   rO   zTotal conversations:   %10dz-Successful operations: %10d (%.3f per second)z-Failed operations:     %10d (%.3f per second)z%-28s %fr   r^   z%-28s %dzProtocol    Op Code  Description                                Count       Failed         Mean       Median          95%        Range          Max)r   r  gffffff?rj  r   z?%-12s   %4s  %-35s %12d %12d %12.6f %12.6f %12.6f %12.6f %12.6f)!rS   
float_infor0  r   r?  writer  listdirr  r   r  r   r   r   r/  r  r  r9  rk  
IndexErrorr   rR   rT   r  sortedr  replacer  
opcode_keyr  calc_percentiler  r   )*r   timing_filerX  rZ  
successfulfailed	latenciesfailuresunique_conversationsr  float_values
int_valuesr  r  rH  r   r   r   r   packet_typelatencyr   opr%  r  r   success_ratefailure_rater7  opsprotor  	protocolspacket_typesr2  r)  meanmedian
percentilerngmaxvr   s*                                             rY   generate_statsr    s   #EDJFIH55	 	 	 BBCCC  L "#$% J Jx(( &5 &5w||Hh//$__ $	5 #5 #5"5#';;t#4#4#:#:4#@#@F#)!9L#)!9H#)!9K#(#3#3GfQi((A#&q7{E#:#:E#&q$<<D"K0B((R0077@@@ayF**"a

! )(,,\:::BtHHHH"J/ 5 5 5d{{#zz#q111,,.1%((2>q//C /CLOO*__,/A0:1-? -?JqMM "$SZ88888 d44445-#5$	5 $	5 $	5 $	5 $	5 $	5 $	5 $	5 $	5 $	5 $	5 $	5 $	5 $	5 $	5L e|HQ!H,{{(,--M	
'-
7888	
9&' ( ( (	
9\"# $ $ $ |))++,, ; ;1jAIIc3//#5q99::::z''))** ; ;1jAIIc3//#5q99::::	 * + + + C"  vCJE
vsxxzz""I  c(m<<<' 	 	KK(B"2FFVE!"FVu,D(66F(66JfQi/CD(,,R44D 0 	    	 s8   !I:(DF+)I:+B;I*	&I:)I*	*I::I>	I>	c                 L    	 dt          |           z  S # t          $ r | cY S w xY w)zCSort key for the operation code to ensure that it sorts numericallyz%03d)r   rk  )r  s    rY   r  r  K	  s;    A   s    ##c                 0   | sdS t          |           dz
  |z  }t          j        |          }t          j        |          }||k    r| t	          |                   S | t	          |                   ||z
  z  }| t	          |                   ||z
  z  }||z   S )ztCalculate the specified percentile from the list of values.

    Assumes the list is sorted in ascending order.
    r   r_   )r  rS  floorr  r   )r2  r  r%  rH  rm  d0d1s          rY   r  r  S	  s      q	VqJ&A
1A	!AAvvc!ff~	A1q5	!B	A1q5	!B7Nr[   c                      t          j        j        |  }t          j        d          }t          j        |           t          j        |           |S )zuIn a testenv we end up with 0777 directories that look an alarming
    green colour with ls. Use umask to avoid that.?   )r  r  r   umaskmkdir)r  rf  masks      rY   r>  r>  e	  s>     	dA8E??DHQKKKHTNNNHr[   r  )r_   r#   )r_   r   )	NNNNr   NNr%   F)T)rP  rG  )yr   r  r*  rd  rS  rS   r  r#  r   r   collectionsr   r   r   r   dns.resolverr	   r!  samba.emulater
   samba.samdbr   r  r   samba.dcerpcr   r   r   r   r   samba.dcerpc.netlogonr   r   r   samba.drs_utilsr   ra   samba.credentialsr   r   r   
samba.authr   
samba.dsdbr   r   r   r   samba.dcerpc.miscr   sambar   r    samba.commonr!   samba.loggerr"   r  rc  rj  r  rQ  r   r   r   rU  rR  rs  rQ   rw   r   rZ   rf   rt   r   rv   objectr{   r   r   r   r  r  r  r:  r?  rD  rF  rH  r  r  r  r  r  r  r  r(  r2  r4  r;  r<  rA  rN  rT  rW  r+  ra  rg  r>  rk  rm  rp  rt  r  rv  rw  r  r  r  r  r>  rp   r[   rY   <module>r     sA  (  				    



          E E E E E E E E E E E E + + + + + + ) ) ) ) ) )       



       ) ) ) ) ) ) / / / / / / / / / / ! ! ! ! ! ! 4 4 4 4 4 4             & & & & & &     O O O O O O O O O O % % % % % %            + * * * * *             # # # # # # ) ) ) ) ) )    
 
 
 	 	 ?>> 

""  		x	(	(	(6 6 6$
 
 
  0	 	 	 	 	i 	 	 	O< O< O< O< O<V O< O< O<d  ,. . .$_ _ _ _ _F _ _ _D    &   >d* d* d* d* d*6 d* d* d*NKW KW KW KW KW KW KW KW\2B 2B 2B 2Bj+ + +    ] ] ] ] ]6 ] ] ]@   	4D  
4	
 D D T d D d 
4 t t D d  D!&_3_6_ :_ 9	_
 ?_ ;_ O_ O_ Y_ f_ j_ j_ o_ *_ g_  Z!_" '#_ _$ *%_& h'_( ~)_* *+_, j-_. o/_0 &1_2 +3_4 %5_6 b7_8 =9_: >;_< ?=_> ??_@ #A_B ?C_D #E_ _ _F 'G_H &I_J 7K_L 0M_N %O_P 'Q_R (S_T 7U_V :W_X 4Y_Z 5[_\ 4]_^ 4__` 1a_b 6c_d 8e_f 3g_ _ _h Ii_j (k_l Mm_n Lo_p Kq_r 7s_t &u_v Jw_x Oy_z &{_| ?}_~ >_@ JA_B =C_D <E_F $G_H ^I_ _ _J *K_L 'M_N _O_P -Q_R 0S_T 0U_V )W_X /Y_Z ,[_\ &]_^ G__` Fa_b Ic_d Ge_f >g_h ?i_j =k_ _l $D 5'%}_ _ _D    < < < <~   F "P7 P7 P7 P7f  E E E  : "z"8#/0 0    ,0       22 2 2$	 	 	+ + +
, , , ,  - - - -  /3   "+ + +
  	 	 	 BF*% *% *% *%ZQ Q Q Q Qv Q Q QhH H H0  (  D    $    r[   