
    IdS             
          d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlmZm	Z	 d dl
mZmZmZmZ d dlmZ d dlmZ d dlmZ d dlZd dlmZ d dlmZ d d	lmZmZmZ d d
lmZ d dlmZ d dlm Z  d dlm!Z! d dl"m#Z# d dl$Z$d dl%m&Z&m'Z'm(Z( d dl)m*Z* d dl+m,Z,m-Z-m.Z.m/Z/ d dl0m1Z1 d dl2m3Z3 d dl2m4Z4 d dl5m6Z6 d dl7m8Z8 d dl9Z9dZ:dZ;dZ<dZ=dddddddddd	Z>dddddddddZ?h dZ@dZAdeAz  ZBdZCd ZD e8eE       ZFd! ZGd" ZHd# ZI G d$ d%eJ      ZK G d& d'eL      ZMd( ZNd) ZO G d* d+eL      ZP G d, d-eL      ZQ G d. d/eL      ZR G d0 d1eR      ZSdd2ZTd3 ZUd4 ZVd5 ZW G d6 d7eL      ZXdd8ZYi d9d:d;d<d=d<d>d<d?d<d@d<dAd:dBd<dCd<dDd<dEd<dFd<dGd:dHd:dId<dJd:ZZi dKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdli dmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddddddXddddZddi ddddddddddddddddlddnddddddddddddddddi ddddddddddddddddddddddddēddƓddȓddʓdd̓ddΓi ddГddғddԓdd֓ddؓddړddܓddޓdddddddddddddddddddddddddddZ[d Z\d Z]ddZ^ddZ_	 	 	 	 	 	 	 	 	 ddZ`d Zad Zbd  Zc edd      Zdd Ze	 ddZfd Zgd Zhd ZiddZjd	 Zkdd
Zl	 ddZmd Znd Zod Zp	 ddZq G d deL      Zrd Zsd Ztd Zud Zvd Zwd Zxy(      N)ECHILDESRCH)OrderedDictCounterdefaultdict
namedtuple)query)traffic_packets)SamDB)LdbError)ClientConnection)securitydrsuapilsa)netlogon)netr_Authenticator)srvsvc)samr)
drs_DsBind)CredentialsDONT_USE_KERBEROSMUST_USE_KERBEROS)system_session)UF_NORMAL_ACCOUNTUF_SERVER_TRUST_ACCOUNTUF_TRUSTED_FOR_DELEGATIONUF_WORKSTATION_TRUST_ACCOUNT)SEC_CHAN_BDC)gensec)sd_utils)
get_string)get_samba_logger   ga2U0*3?-      ?)	dns0smb0x72ldapr(   r-   3r-   2cldapr/   dcerpc11r5   14nbnsr(   )r'   1r-   r<   r-   4r-   5r3   rA   r5   12r5   13r5   15>   r*   smb2browsersmb_netlogong      $@)i)namec                     | t         k  rF|st        |t        j                         yt        |t	        |      z  t        j                         yy)a  Print a formatted debug message to standard error.


    :param level: The debug level, message will be printed if it is <= the
                  currently set debug level. The debug level can be set with
                  the -d option.
    :param msg:   The message to be logged, can contain C-Style format
                  specifiers
    :param args:  The parameters required by the format specifiers
    fileN)DEBUG_LEVELprintsysstderrtuple)levelmsgargss      7/usr/lib/python3/dist-packages/samba/emulate/traffic.pydebugrZ   e   s9     #CJJ'#d##**5	     c                  B   t        j                  d      }t        d|d   d   d|d   d   ddt        j                         | D ]  }t        |t        j                  	        t        t        j                  	       t        j                  j                          y
)zL Print an unformatted log message to stderr, containing the line number
    r#   )limit r   z	:[01;33m   z [00m)endrP   rO   N)	tracebackextract_stackrR   rS   rT   flush)rX   tbas      rY   debug_linenorf   w   s{     
	 	 q	)B	!!uQxAq39<zz  "acjj!"	szzJJr[   c                 `    | r'd}| D ]  }|dz  }||z  }|dz  } dd|z   z  fd}|S d }|S )zReturn a function that prints a coloured line to stderr. The colour
    of the line depends on a sort of hash of the integer arguments.      z
[38;5;%dm   c                  h    t         dkD  r(| D ]"  }t        |dt        j                         $ y y )Nr   z[00mrO   rQ   rR   rS   rT   )rX   re   prefixs     rY   pzrandom_colour_print.<locals>.p   s3    Q IAFA6SZZHI r[   c                  \    t         dkD  r#| D ]  }t        |t        j                          y y )Nr   rO   rl   )rX   re   s     rY   rn   zrandom_colour_print.<locals>.p   s+    Q .A!#**-. r[    )seedssxrn   rm   s       @rY   random_colour_printrt      s`      	AGAFAHA	 !BF+	I H	.
 Hr[   c                       e Zd Zy)FakePacketErrorN)__name__
__module____qualname__rp   r[   rY   rv   rv      s    r[   rv   c                   d    e Zd ZdZdZd Zed        ZddZd Z	d Z
d Zd	 Zd
 Zd Zd ZddZy)PacketzDetails of a network packet
	timestampip_protocolstream_numbersrcdestprotocolopcodedescextra	endpointsc
                 *   || _         || _        || _        || _        || _        || _        || _        || _        |	| _        | j                  | j                  k  r| j                  | j                  f| _	        y | j                  | j                  f| _	        y Nr|   )
selfr}   r~   r   r   r   r   r   r   r   s
             rY   __init__zPacket.__init__   s{    "&*	 	
88dii"hh		2DN"ii2DNr[   c                     |j                  d      j                  d      }|d d \  }}}}}}}	}
|dd  }t        |      }t        |      }t        |      } | |||||||	|
|	      S )N
	   )rstripsplitfloatint)clslinefieldsr}   r~   r   r   r   r   r   r   r   s               rY   	from_linezPacket.from_line   s    T"((. 								qr
)$	#h4y9k=#tVT52 	2r[   c                 
   dj                  | j                        }| j                  |z   }|d|| j                  | j                  xs d| j
                  | j                  | j                  | j                  | j                  |f	z  fS )z5Format the packet as a traffic_summary line.
        r   z%f	%s	%s	%d	%d	%s	%s	%s	%s )
joinr   r}   r~   r   r   r   r   r   r   )r   time_offsetr   ts       rY   
as_summaryzPacket.as_summary   s~     		$**%NN[(7!!##)r	 	 		r[   c                 &   d| j                   | j                  | j                  | j                  xs d| j                  | j
                  | j                  | j                  | j                  r$ddj                  | j                        z   dz   f	z  S df	z  S )Nz:%.3f: %d -> %d; ip %s; strm %s; prot %s; op %s; desc %s %sr$      «r^      »r   )
r}   r   r   r~   r   r   r   r   r   r   r   s    rY   __str__zPacket.__str__   s    L499d6F6F6M###T]]DKK8<

$$**--4MM 	N IKMM 	Nr[   c                     d| z  S )Nz<Packet @%s>rp   r   s    rY   __repr__zPacket.__repr__   s    $$r[   c                     | j                  | j                  | j                  | j                  | j                  | j
                  | j                  | j                  | j                  | j                  	      S r   )
	__class__r}   r~   r   r   r   r   r   r   r   r   s    rY   copyzPacket.copy   sU    ~~dnn".."00"hh"ii"mm"kk"ii"jj* 	*r[   c                 <    | j                   d| j                  }|S )N:r   r   )r   r   s     rY   as_packet_typezPacket.as_packet_type   s    }}dkk2r[   c                 z    | j                   | j                  f}|t        v r	t        |   S |t        v r
t        |    S y)zA positive number means we think it is a client; a negative number
        means we think it is a server. Zero means no idea. range: -1 to 1.
                )r   r   CLIENT_CLUESSERVER_CLUES)r   keys     rY   client_scorezPacket.client_score   sB     }}dkk*,$$, %%%r[   c           
         d| j                   d| j                  }	 t        t        |      }| j                   dk7  rt        dd|j                  d	|       t        j                         }	  || ||      rKt        j                         }||z
  }t        d
||j                  | j                   | j                  |fz         yy# t        $ r5}t        d|j                  d|t        j                         Y d}~yd}~ww xY w# t        $ rU}t        j                         }||z
  }t        d||j                  | j                   | j                  ||fz         Y d}~yd}~ww xY w)zSend the packet over the network, if required.

        Some packets are ignored, i.e. for  protocols not handled,
        server response messages, or messages that are generated by the
        protocol layer associated with other packets.
        packet__zConversation(z) Missing handler rO   Nkerberosr#   z) Calling handler z%f	%s	%s	%s	%f	True	z%f	%s	%s	%s	%f	False	%s)r   r   getattrr
   AttributeErrorrR   conversation_idrS   rT   rZ   time	Exception)	r   conversationcontextfn_namefnestartr`   durations	            rY   playzPacket.play  sH    %)MM4;;?	'2B ==J&!"22G= > 			.$g. iik;2L88$--{{H.. / /  	//:zz# 		,  	.))+CU{H144dmm;;!-- . .	.s1   C .AD 	D+C==D	E#AEE#c                 4    | j                   |j                   z
  S r   r}   r   others     rY   __cmp__zPacket.__cmp__+  s    ~~//r[   Nc                 B    t        | j                  | j                        S r   )is_a_real_packetr   r   )r   missing_packet_statss     rY   is_really_a_packetzPacket.is_really_a_packet.  s    t{{;;r[   )r   r   )rw   rx   ry   __doc__	__slots__r   classmethodr   r   r   r   r   r   r   r   r   r   rp   r[   rY   r{   r{      sT    %	I3  2 2& N%	*	&.P0<r[   r{   c                     | t         v ry| dk(  r|dk(  ryd| d|}t        t        |d      }|)t        j	                  d|z  t
        j                         y|t        j                  u ryy	)
zdIs the packet one that can be ignored?

    If so removing it will have no effect on the replay
    Fr-   r   r   r   Nzmissing packet %srO   T)SKIPPED_PROTOCOLSr   r
   LOGGERrZ   rS   rT   null_packet)r   r   r   r   s       rY   r   r   2  sp    
 $$6fl (&1G	'4	0B	z(72D	_(((r[   c                 4    | dk(  ry| |fdv ryt        | |      S )zReturn true if a packet generates traffic in its own right. Some of
    these will generate traffic in certain contexts (e.g. ldap unbind
    after a bind) but not if the conversation consists only of these packets.
    waitF)r   r   r0   rG   r5   16)r   r   s     rY   is_a_traffic_generating_packetr   H  s3    
 6&  
 Hf--r[   c                       e Zd ZdZddddddddddej
                  j                  d      ddfdZd Zd Z	d Z
d Zd	 Zd
 ZddZddZddZddZddZddZddZddZd Zd Zd Zd Zy)ReplayContextaW  State/Context for a conversation between an simulated client and a
       server. Some of the context is shared amongst all conversations
       and should be generated before the fork, while other context is
       specific to a particular conversation and should be generated
       *after* the fork, in generate_process_local_config().
    NDOMAINc                    || _         d | _        || _        || _        |rt        | _        nt        | _        |	| _        |
| _        || _	        || _
        || _        || _        |j                  d      | _        || _        || _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        d| _        || _        | j5                          y )NrealmF)servernetlogon_connectioncredslpr   kerberos_stater   oubase_dndomainstatsdirglobal_tempdir
domain_sidgetr   instance_idbadpassword_frequencylast_lsarpc_badlast_lsarpc_named_badlast_simple_bind_badlast_bind_badlast_srvsvc_badlast_drsuapi_badlast_netlogon_badlast_samlogon_badtotal_conversationsgenerate_ldap_search_tables)r   r   r   r   r   r   prefer_kerberostempdirr   r   r   r   r   r   s                 rY   r   zReplayContext.__init__a  s     )/(, (-
(*"3D"3D(*(/(.(0(/(2(*w
(3 )>"(-(-"(-!(-(-(-(-(-(; ((*r[   c                 l   t               }t        d| j                  z  || j                  | j                        }|j                  |j                         t        j                  dgdg      }i }dg i}|D ]  }t        |j                        }dj                  d |j                  d      D              j                         }|j                  |g       }	|	j                  |       |j!                  d	      s|d   j                  |        t#        |j%                               D ]n  }
|
d
d  dk7  r|
d d
 }|d
d  dk(  r|d d
 }|d
d  dk(  rt'        d      D ]:  }|dz  }||
k7  r&||v r"t)        d|
d|t*        j,                         3||
   ||<   < p || _        || _        i | _        |j                  |j                         t        j                  dgd      }dj                  d |D              }dj5                  |      | j2                  d<   d}dD ]%  }|dj5                  ||j                               z  }' dj5                  |      | j2                  d<   d| j2                  d<   |j                  dt        j6                  dg      }dj5                  |d   d         | j2                  d<   y ) N	ldap://%s)urlsession_infocredentialsr   zpaged_results:1:1000dn)scopecontrolsattrsinvocationId,c              3   B   K   | ]  }|j                         d d   y w)Nr#   )lstrip.0rs   s     rY   	<genexpr>z<ReplayContext.generate_ldap_search_tables.<locals>.<genexpr>  s     E!qxxz"1~Es   zCN=NTDS Settings,rL   z,DC   zdn_map collision r^   rO   z"(objectclass=groupPolicyContainer))r   r   
expressionr   c              3   D   K   | ]  }d j                  |d           yw)z(distinguishedName={0})r   N)format)r  rW   s     rY   r  z<ReplayContext.generate_ldap_search_tables.<locals>.<genexpr>  s      XS6==c$iHXs    z(|{0})gPCFileSysPath)zDomain Controllers,ztraffic_replay,r   z(distinguishedName={0}{1})gpLinkz'(objectCategory=pKICertificateTemplate)pKIExtendedKeyUsagehighestCommittedUSN)r   r   z(usnChanged>={0})r   
usnChanged)r   r   r   r   r   search	domain_dnldbSCOPE_SUBTREEstrr   r   r   upper
setdefaultappend
startswithlistkeysrangerR   rS   rT   dn_mapattribute_clue_mapsearch_filtersr
  
SCOPE_BASE)r   sessiondbresr  r  rr   patternr'   krn   i
gpos_by_dnou_strr   s                   rY   r   z)ReplayContext.generate_ldap_search_tables  s    "{T[[0 '#zzgg
 ii!//"8!9#f  & B
  	>AQTTBhhErxx}EEKKMG##GR0CJJrN}}01">299"=	> fkkm$ 	&Av#2ABC&E/crF BC&E/1X &U
6a6ka;"zz+"1Iq	&	& "4
 ! iic.?.?v#G  IWWXTWXX
 19
0K,- @ 	NB299"bllnMMF	N(0(?H%
 6 	12
 ii#..9N8OiP&&s1v.C'DE 	L)r[   c                     | j                   j                         D ]  }||v s| j                   |   c S  |dk(  r<t        j                         | j                  z  }t	        | j
                  |      }d|z  S y)NzDC,DCz((&(sAMAccountName=%s)(objectClass=user))z(objectClass=*))r  r  randomr   	user_namer   )r   r   dn_sigr   r   random_user_idaccount_names          rY   guess_search_filterz!ReplayContext.guess_search_filter  s|     &&++- 	0Ce|**3//	0 W#]]_t/G/GGN$T%5%5~FL=LL !r[   c                 ,   g | _         g | _        g | _        g | _        g | _        g | _        g | _        |j                  | _        |j                  | _        |j                  | _	        |j                  | _
        t        | j                  d|j                  z        | _        | j                  j!                  d| j                         | j                  j!                  d| j                         | j                  j!                  d| j                         | j                  j!                  dd       d| _        d| j                  d	| j$                  | _        d| j                  d	| j$                  | _        | j+                          | j-                          y )
Nzconversation-%dzprivate dirzlock dirzstate directoryztls verify peerno_checkz/root/ncalrpc_as_systemcn=r  )ldap_connectionsdcerpc_connectionslsarpc_connectionslsarpc_connections_nameddrsuapi_connectionssrvsvc_connectionssamr_contextsnetbios_namemachinepassusernameuserpassmk_masked_dirr   r   r   r   setremoteAddressr   samlogon_dnuser_dngenerate_machine_credsgenerate_user_creds)r   accountr   s      rY   generate_process_local_configz+ReplayContext.generate_process_local_config  sB   (*(*(*(*%(* (*(*(/(<(<(/(;(;(/(8(8(/(8(8$T%8%8%6%1%A%A&BC 	M4<<0J-%t||4%z26#00$'';  $}}dgg7 	##%  "r[   c                     |s;| j                   r-t        j                         | j                   k  r	  ||       d}nd} ||      }||fS # t        $ r Y w xY w)a  Execute the supplied logon function, randomly choosing the
           bad credentials.

           Based on the frequency in badpassword_frequency randomly perform the
           function with the supplied bad credentials.
           If run with bad credentials, the function is re-run with the good
           credentials.
           failed_last_time is used to prevent consecutive bad credential
           attempts. So the over all bad credential frequency will be lower
           than that requested, but not significantly.
        TF)r   r*  r   )r   fgoodbadfailed_last_timeresults         rY   with_random_bad_credentialsz)ReplayContext.with_random_bad_credentials  si      **$"<"<<cF
 $( #( 4()) !  s   A
 
	AAc                 >   t               | _        | j                  j                  | j                         | j                  j	                  | j
                         | j                  j                  | j                         | j                  j                  | j                         | j                  j                  | j                         | j                  j                  | j                         t               | _        | j                  j                  | j                         | j                  j	                  | j
                         | j                  j                  | j                  dd        | j                  j                  | j                         | j                  j                  | j                         t               | _        | j                  j                  | j                         | j                  j	                  | j
                         | j                  j                  | j                         | j                  j                  | j                         | j                  j!                  | j                  j#                         t$        j&                  z         | j                  j                  | j                         | j                  j)                  | j*                         t               | _        | j,                  j                  | j                         | j,                  j	                  | j
                         | j,                  j                  | j                  dd        | j,                  j                  | j                         | j,                  j!                  | j,                  j#                         t$        j&                  z         | j,                  j                  | j                         | j,                  j)                  | j*                         y)a;  Generate the conversation specific user Credentials.

        Each Conversation has an associated user account used to simulate
        any non Administrative user traffic.

        Generates user credentials with good and bad passwords and ldap
        simple bind credentials with good and bad passwords.
        N)r   
user_credsguessr   set_workstationr:  set_passwordr=  set_usernamer<  
set_domainr   set_kerberos_stater   user_creds_badsimple_bind_credsset_gensec_featuresget_gensec_featuresr   FEATURE_SEALset_bind_dnrB  simple_bind_creds_badr   s    rY   rD  z!ReplayContext.generate_user_creds1  s    &-dgg&''(9(9:$$T]]3$$T]]3""4;;/**4+>+>?)m!!$''*++D,=,=>((s);<((7..t/B/BC "-$$TWW-..t/@/@A++DMM:++DMM:22""6686;N;NN	P11$2E2EF**4<<8%0]"""((1""2243D3DE""//cr0BC""//>""66&&::< 	! 	""55d6I6IJ""..t||<r[   c                    t               | _        | j                  j                  | j                         | j                  j	                  | j
                         | j                  j                  t               | j                  j                  | j                         | j                  j                  | j
                  dz          | j                  j                  | j                         | j                  j                  | j                         t               | _        | j                  j                  | j                         | j                  j	                  | j
                         | j                  j                  t               | j                  j                  | j                  dd        | j                  j                  | j
                  dz          | j                  j                  | j                         y)zGenerate the conversation specific machine Credentials.

        Each Conversation has an associated machine account.

        Generates machine credentials with good and bad passwords.
        $NrO  )r   machine_credsrQ  r   rR  r:  set_secure_channel_typer   rS  r;  rT  rU  r   rV  r   machine_creds_badr   s    rY   rC  z$ReplayContext.generate_machine_creds_  si    )]  )**4+<+<=22<@''(8(89''(9(9C(?@%%dkk2--d.A.AB!,$$TWW-..t/@/@A66|D++D,<,<Sb,AB++D,=,=,CD11$2E2EFr[   c                    | j                   j                  |      }|rt        j                  |      S |j	                         }|r8|| j
                  v r"t        j                  | j
                  |         S |dd  }|r8| j                  S )N   )r  r   r*  choicer  r  r   )r   r$  
attributes	attr_clues       rY   get_matching_dnzReplayContext.get_matching_dnx  sz     ++//
;	==++--/$++%}}T[[%9::abkG	  ||r[   c                     d}| j                   r|s| j                   d   S t        d| j                  z  |df| j                        }| j                   j	                  |       |S )Nz$12345678-1234-abcd-ef00-01234567cffbzncacn_ip_tcp:%sr_   )r4  r   r   r   r  )r   newguidcs       rY   get_dcerpc_connectionz#ReplayContext.get_dcerpc_connection  s_    5""3**2...<"AY1&&q)r[   c                       j                   r|s j                   d   S  fd} j                  | j                   j                   j                        \  } _         j                   j                  |       |S )Nrj  c                 `    t        j                   dj                  z  j                  |       S Nzncacn_np:%s)r   r   r   r   r   s    rY   connectz4ReplayContext.get_srvsvc_connection.<locals>.connect  s)    ==$++!>!%!&( (r[   )r8  rM  rP  rW  r   r  r   rk  rs  rm  s   `   rY   get_srvsvc_connectionz#ReplayContext.get_srvsvc_connection  sw    ""3**2..	( ,,W-1__-1-@-@-1-A-AC 	"D  	&&q)r[   c                       j                   r|s j                   d   S  fd} j                  | j                   j                   j                        \  } _         j                   j                  |       |S )Nrj  c                 l    d}t        j                  dj                  d|dj                  |       S )Nzschannel,seal,signncacn_ip_tcp:[]r   lsarpcr   r   )r   binding_optionsr   s     rY   rs  z4ReplayContext.get_lsarpc_connection.<locals>.connect  s1    2O::#{{O="gg#% %r[   )r5  rM  r`  rb  r   r  rt  s   `   rY   get_lsarpc_connectionz#ReplayContext.get_lsarpc_connection  sy    ""3**2..	% ,,W-1-?-?-1-C-C-1-A-AC 	"D  	&&q)r[   c                       j                   r|s j                   d   S  fd} j                  | j                   j                   j                        \  } _         j                   j                  |       |S )Nrj  c                 `    t        j                  dj                  z  j                  |       S rq  r{  rr  s    rY   rs  z?ReplayContext.get_lsarpc_named_pipe_connection.<locals>.connect  s)    ::mt{{;"gg#% %r[   )r6  rM  r`  rb  r   r  rt  s   `   rY    get_lsarpc_named_pipe_connectionz.ReplayContext.get_lsarpc_named_pipe_connection  sy    ((0044	% ,,W-1-?-?-1-C-C-1-G-GI 	(D& 	%%,,Q/r[   c                      j                   r|s j                   d   }|S  fd} j                  | j                   j                   j                        \  } _        t        |      \  }}||f} j                   j                  |       |S )zget a (drs, drs_handle) tuplerj  c                 p    d}dj                   d|d}t        j                  |j                  |       S )Nsealrx  ry  rz  )r   r   r   )r   r}  binding_stringr   s      rY   rs  z:ReplayContext.get_drsuapi_connection_pair.<locals>.connect  s/    $O"kk?<N??>477EBBr[   )r7  rM  rP  rW  r   r   r  )r   rk  unbindrm  rs  drs
drs_handlesupported_extensionss   `       rY   get_drsuapi_connection_pairz)ReplayContext.get_drsuapi_connection_pair  s    ##C((,AH	C ,,W-1__-1-@-@-1-B-BD 	%d# .8_*)*  ''*r[   c                 z     j                   r|s j                   d   S  fd} fd}|r; j                  | j                   j                   j                        \  } _        n: j                  | j
                   j                   j                        \  } _         j                   j                  |       |S )Nrj  c                 N    t        dj                  z  | j                        S )a$  
            To run simple bind against Windows, we need to run
            following commands in PowerShell:

                Install-windowsfeature ADCS-Cert-Authority
                Install-AdcsCertificationAuthority -CAType EnterpriseRootCA
                Restart-Computer

            z
ldaps://%sr   r   r   r   r   rr  s    rY   simple_bindz6ReplayContext.get_ldap_connection.<locals>.simple_bind  s'     3%* GG% %r[   c                 N    t        dj                  z  | j                        S )Nr   r  r  rr  s    rY   	sasl_bindz4ReplayContext.get_ldap_connection.<locals>.sasl_bind  s%    t{{2%* GG% %r[   )	r3  rM  rX  r]  r   rP  rW  r   r  )r   rk  simpler  r  samdbs   `     rY   get_ldap_connectionz!ReplayContext.get_ldap_connection  s      ((,,	%	% 00151G1G151K1K151J1JL /UD- 0015151D1D151C1CE (UD& 	$$U+r[   c                     | j                   r|rE| j                   j                  t        | j                  | j                  | j
                               | j                   d   S )N)r   r   rj  )r9  r  SamrContextr   r   r   )r   rk  s     rY   get_samr_contextzReplayContext.get_samr_context  sK    !!S%%DKKDGG4::FH!!"%%r[   c                       j                   r j                   S  fd} j                  | j                   j                   j                        \  } _        | _         |S )Nc                 `    t        j                   dj                  z  j                  |       S )Nzncacn_ip_tcp:%s[schannel,seal])r   r   r   rr  s    rY   rs  z6ReplayContext.get_netlogon_connection.<locals>.connect  s/    $$%E&*kk&3%)WW%*, ,r[   )r   rM  r`  rb  r   )r   rs  rm  s   `  rY   get_netlogon_connectionz%ReplayContext.get_netlogon_connection  sf    ##+++	, ,,W-1-?-?-1-C-C-1-C-CE 	$D"
 $% r[   c                     | j                   dfS )NAr   r   s    rY   guess_a_dns_lookupz ReplayContext.guess_a_dns_lookup$  s    

C  r[   c                     | j                   j                         }t               }|d   D cg c]  }t        |t              r|n
t        |      ! c}|j                  _        |d   |_        t               }||fS c c}w )N
credentialr}   )	r`  new_client_authenticatorr   
isinstancer   ordcreddatar}   )r   authcurrentrs   
subsequents        rY   get_authenticatorzReplayContext.get_authenticator'  sy    !!::<%'&*<&8:!" #-Q"4Q#a&@ : -')
$$:s   $A:c                     t         j                  j                  | j                  |      }t	        |d      }|j                         D ]  \  }}t        |d||        |j                          y)zWrite arbitrary key/value pairs to a file in our stats directory in
        order for them to be picked up later by another process working out
        statistics.wz: rO   N)ospathr   r   openitemsrR   close)r   filenamekwargsrH  r%  vs         rY   write_statszReplayContext.write_stats1  sY     77<<x83LLN 	-DAqa#!,	-		r[   r   )F)FF)rw   rx   ry   r   r  environr   r   r   r/  rF  rM  rD  rC  rh  rn  ru  r~  r  r  r  r  r  r  r  r  rp   r[   rY   r   r   Z  s     %)'+!%

x0 !*+XPFn!$#>*8,=\G2,$($.$L&$!%r[   r   c                   $    e Zd ZdZddZd Zd Zy)r  z5State/Context associated with a samr connection.
    Nc                     d | _         d | _        d | _        d | _        d | _        d | _        d | _        || _        || _        || _	        y r   )

connectionhandledomain_handler   group_handleuser_handleridsr   r   r   )r   r   r   r   s       rY   r   zSamrContext.__init__?  sK    !!!!!!!	#"
r[   c                     | j                   s>t        j                  d| j                  z  | j                  | j                        | _         | j                   S )Nzncacn_ip_tcp:%s[seal])lp_ctxr   )r  r   r   r   r   r   s    rY   get_connectionzSamrContext.get_connectionK  s?    "ii'4;;7ww JJ(DO
 r[   c                     | j                   s5| j                         }|j                  d t        j                        | _         | j                   S r   )r  r  Connect2r   SEC_FLAG_MAXIMUM_ALLOWED)r   rm  s     rY   
get_handlezSamrContext.get_handleT  s9    {{##%A**T8+L+LMDK{{r[   NN)rw   rx   ry   r   r   r  r  rp   r[   rY   r  r  <  s    
#r[   r  c                   p    e Zd ZdZ	 	 ddZd Zd Z	 ddZd ZeZ	d Z
d	 Zd
 Zd ZddZddZd Zd Zy)ConversationzADetails of a converation between a simulated client and a server.Nc                     || _         || _        g | _        t        |      | _        d| _        || _        |D ]  } | j                  |   y )Nr   )
start_timer   packetsrt   rW   client_balancer   add_short_packet)r   r  r   seqr   rn   s         rY   r   zConversation.__init__]  sR    $"&y1!. 	&A!D!!1%	&r[   c                     | j                   |j                   yy|j                   y| j                   |j                   z
  S )Nr   rj  r_   )r  r   s     rY   r   zConversation.__cmp__h  sB    ??"'#!1!111r[   c                 p   |j                         }| j                  |j                  | _        | j                  |j                  | _        |j                  | j                  k7  r%t	        d| j                  d|j                        |xj                  | j                  z  c_        |j
                  |j                  d   k(  r$| xj                  |j                         z  c_        n#| xj                  |j                         z  c_        |j                         r| j                  j                  |       yy)zmAdd a packet object to this conversation, making a local copy with
        a conversation-relative timestamp.NzConversation endpoints z don't matchpacket endpoints r   )r   r  r}   r   rv   r   r  r   r   r  r  )r   packetrn   s      rY   
add_packetzConversation.add_packetq  s     KKM??"kkDO>>![[DN;;$..(!#'>>1;;#@ A A 	
t&55AKKN"1>>#331>>#33!LL" "r[   c                    |rt        ||      sy| j                         \  }}|s||}}||f}	t        j                  |	d      }
t        j                  |d      }t        || j                  z
  |d|||||
|	      }|j                  |j                  d   k(  r$| xj                  |j                         z  c_	        n#| xj                  |j                         z  c_	        |j                         r| j                  j                  |       yy)zCreate a packet from a timestamp, and 'protocol:opcode' pair, and a
        (possibly empty) list of extra data. If client is True, assume
        this packet is from the client to the server.
        Nr   06r   )r   guess_client_serverOP_DESCRIPTIONSr   IP_PROTOCOLSr{   r  r   r   r  r   r   r  r  )r   r}   r   r   r   clientskip_unused_packetsr   r   r   r   r~   r  s                rY   r  zConversation.add_short_packet  s     '7&'I,,.	TcC ""3+"&&x6	DOO3[C &$7 ::))!,,6#6#6#886#6#6#88$$&LL' 'r[   c                 v    d| j                   | j                  | j                  t        | j                        fz  S )Nz-<Conversation %s %s starting %.3f %d packets>)r   r   r  lenr  r   s    rY   r   zConversation.__str__  s5    ?%%t~~tT\\"$$ 	%r[   c                 ,    t        | j                        S r   )iterr  r   s    rY   __iter__zConversation.__iter__  s    DLL!!r[   c                 ,    t        | j                        S r   )r  r  r   s    rY   __len__zConversation.__len__  s    4<<  r[   c                     t        | j                        dk  ry| j                  d   j                  | j                  d   j                  z
  S )Nr#   r   rj  )r  r  r}   r   s    rY   get_durationzConversation.get_duration  s>    t||q ||B))DLLO,E,EEEr[   c                 r    | j                   D cg c]  }|j                  | j                         c}S c c}w r   )r  r   r  )r   rn   s     rY   replay_as_summary_linesz$Conversation.replay_as_summary_lines  s'    7;||D!T__-DDDs   "4c                    | j                   }t        j                         |z
  }||z
  }|t        z
  }|dkD  rt        j                  |       t        j                         |z
  |z
  }| j	                  d| |fz         d}	d}
t        j                         }| j
                  D ]  }t        j                         |z
  }||j                  z
  }||	kD  r|}	|dk  r\| t        z
  }|dkD  rMt        j                  |       t        j                         |z
  }||j                  z
  |
kD  r||j                  z
  }
|j                  | |        |	||
fS )zMReplay the conversation at the right time.
        (We're already in a fork).r   zstarting %s [miss %.3f]r   )r  r   SLEEP_OVERHEADsleeprW   r  r}   r   )r   r   r   rE  r   nowgap
sleep_timemissmax_gapmax_sleep_missp_startrn   s                rY   replay_with_delayzConversation.replay_with_delay  s0    OOiikE!#g>)
>JJz"		e#q(*dD\9:))+ 	"A))+'C#CW}Qw!TN2
>JJz*		g-A1;;7)*Q[[FF4!	" n,,r[   c                 ~    | j                   \  }}| j                  dk  r||fS | j                  dk(  r	||k(  r||fS ||fS )zhHave a go at deciding who is the server and who is the client.
        returns (client, server)
        r   )r   r  )r   server_cluere   bs       rY   r  z Conversation.guess_client_server  sQ     ~~1"q6M
 !#q(8q6M1vr[   c                     | j                   D cg c]  }||j                  cxk  r|k  sn n| c}| _         | j                   r| j                   d   j                  | _        yd| _        yc c}w )zPrune any packets outside the time window we're interested in

        :param s: start of the window
        :param e: end of the window
        r   Nr  r}   r  )r   rr   r   rn   s       rY   forget_packets_outside_windowz*Conversation.forget_packets_outside_window  sQ     $(<<Ia13Hq3HI7;||$,,q/33 Js
   A,A,c                     | j                   D ]  }|xj                  |z  c_         | j                  | xj                  |z  c_        yy)z=Adjust the packet start times relative to the new start time.Nr  )r   r  rn   s      rY   renormalise_timeszConversation.renormalise_times  sB     	&AKK:%K	& ??&OOz)O 'r[   )NNrp   N)TTr  r   )rw   rx   ry   r   r   r   r  r  r   r   r  r  r  r  r  r  r  r  rp   r[   rY   r  r  [  s\    K<>!%	&2#6 ;?(8%
 H"!F
E!-F"N*r[   r  c                   .    e Zd ZdZddZd ZddZddZy)	DnsHammerzOA lightweight conversation that generates a lot of dns:0 packets on
    the flyNc                    t        ||z        }t        |      D cg c]  }t        j                  d|       c}| _        | j                  j                          || _        || _        d| _        | j                  |      | _
        y c c}w )Nr   
query_file)r   r  r*  uniformtimessortrater   r  _get_query_choicesquery_choices)r   dns_rater   r  nr&  s         rY   r   zDnsHammer.__init__  sq    8#$;@8DafnnQ1D


	 !44
4K Es   Bc                 `    dt        | j                        | j                  | j                  fz  S )Nz-<DnsHammer %d packets over %.1fs (rate %.2f)>)r  r  r   r  r   s    rY   r   zDnsHammer.__str__  s)    ?TZZ$--;< 	=r[   c                 P   |rt        |d      5 }|j                         }ddd       g }j                         D ]Y  }|j                         }|s|j	                  d      r(|j                  d      }t        |      dk(  sJ |j                  |       [ |S g dS # 1 sw Y   }xY w)z
        Read dns query choices from a file, or return default

        rname may contain format string like `{realm}`
        realm can be fetched from context.realm
        r#  N#r     )
)r   {realm}r  yes)r_   r  NSr	  )r#   	*.{realm}r  no)rd  r  r
  r  )
   _msdcs.{realm}r  r	  )   r  r
  r	  )   nx.realm.comr  r  )   r  r
  r  )   *.nx.realm.comr  r  )   r  r
  r  )r  read
splitlinesstripr  r   r  r  )r   r  rH  textchoicesr   rX   s          rY   r   zDnsHammer._get_query_choices  s     j#&  !vvx G) )zz| 4::c?Dt9>)>NN4() N    s   BB%c           
         |sJ |j                   sJ t        j                         }| j                  D ]  }t        j                         |z
  }||z
  }|t        z
  }|dkD  rt        j                  |       t        j                  | j                        \  }}}	}
|j                  |j                         }d}t        j                         }	 t        ||	      }|
dk(  rt        |      sd}t        j                         }||z
  }t        d||||fz          y # t        $ r d}Y ;w xY w# t        j                         }||z
  }t        d||||fz         w xY w)Nr   r  Tr	  Fz%f	DNS	dns	%s	%f	%s	)r   r   r  r  r  r*  re  r  r
  	dns_queryr  r   rR   )r   r   r   r   r  r  r  r   rnamertypeexistsuccesspacket_startanswersr`   r   s                   rY   replayzDnsHammer.replay4  sC   w}}}		 	WA))+%Cc'C~-JA~

:&*0--8J8J*K'FE5%LLw}}L5EG99;L
W#E51E>#g,#G iik-2c68W5UUV+	W      iik-2c68W5UUVs$   DD&#D)%D&&D))-Er   )rw   rx   ry   r   r   r   r   r#  rp   r[   rY   r  r    s    L=BWr[   r  c                    t        t              }g }| D ]  }t        |t              rt	        |      }t        d|j                  t        j                         |D ]T  }t        j                  |      }|j                  dk(  r|dk7  r||j                  xx   dz  cc<   D|j                  |       V |j                           |sg dfS t        d |D              }t!        d |D              }t        d	t        j                         t#               }	t%        |      D ]f  \  }
}|xj&                  |z  c_        |	j)                  |j*                        }|t-        |
d
z         }||	|j*                  <   |j/                  |       h g }|	j1                         D ]"  }t3        |      dk7  s|j                  |       $ t5        ||z
        }t3        |	      |z  }||||fS )zLLoad a summary traffic summary file and generated Converations from it.
    z
Ingesting rO   r'   includer_   r   c              3   4   K   | ]  }|j                     y wr   r   r  rn   s     rY   r  z#ingest_summaries.<locals>.<genexpr>f  s     2QQ[[2   c              3   4   K   | ]  }|j                     y wr   r   r'  s     rY   r  z#ingest_summaries.<locals>.<genexpr>g  s     3aakk3r(  z$gathering packets into conversationsr#   )r   )r   r   r  r  r  rR   rM   rS   rT   r{   r   r   r   r  r  minmaxr   	enumerater}   r   r   r  r  valuesr  r   )filesdns_mode
dns_countsr  rH  r   rn   r  last_packetconversationsr&  rm  conversation_listr   mean_intervals                  rY   ingest_summariesr5  P  s    S!JG aQA(szz: 	"D  &AzzU"x9'<188$)$q!	" 	
	 1u2'22J3733K	
0szzBMM'" 1	z!akk*9a!e5A)*M!++&	Q !!# (q6Q;$$Q'( [:-.H&1MmXzAAr[   c                     t               }| D ]  }|j                  |j                          |r|j                  d      d   S y )Nr_   r   )r   updater   most_common)r2  	addressesrm  s      rY   guess_server_addressr:    sH    	I &%&$$Q'** r[   c                 f    i }| j                         D ]  \  }}dj                  |      }|||<    |S Nr   )r  r   )rs   yr%  r  k2s        rY   stringify_keysr?    s=    
A	 1YYq\" Hr[   c                     i }| j                         D ]-  \  }}t        t        |      j                  d            }|||<   / |S r<  )r  rU   r  r   )rs   r=  r%  r  r   s        rY   unstringify_keysrA    sG    
A	 1#a&,,t$%! Hr[   c                   R    e Zd Zd
dZddZd Zd Z	 	 	 	 	 ddZd Zd Z		 	 dd	Z
y)TrafficModelc                 v    i | _         i | _        || _        t        t              | _        d| _        ddg| _        y )Nr   r   r_   )ngramsquery_detailsr  r   r   dns_opcountscumulative_durationpacket_rate)r   r  s     rY   r   zTrafficModel.__init__  s9    ',#& q6r[   Nc           
         |i }d}d}t         f| j                  dz
  z  }t        |      }|j                         D ]  \  }}| j                  |xx   |z  cc<    t        |      dkD  ro|d   j                  }	d}
|	dz   }|D ]3  }|
t        |      z  }
t        ||j                  d   j                        }5 |
| j                  d<   ||	z
  | j                  d<   |D ]]  }|j                  |      \  }}||j                         z  }t         f| j                  dz
  z  }|D ]  }|j                  |k7  r|j                  |z
  }|j                  }|t        kD  r]dt        j                   t        d|t"        z              z  }| j$                  j'                  |g       j)                  |       |dd  |fz   }|j+                         }| j,                  j'                  |g       j)                  t/        |j0                               | j$                  j'                  |g       j)                  |       |dd  |fz   } ` | xj2                  |z  c_        | j$                  j'                  |g       j)                  t                y )Nr   r_   r   g?rj  wait:%dr%   )
NON_PACKETr  r:  r  rG  r  r  r+  r  r}   rI  r  r  r   WAIT_THRESHOLDmathlog
WAIT_SCALErE  r  r  r   rF  rU   r   rH  )r   r2  rG  prevcum_durationr   r   r%  r  firsttotallastrm  r  rn   elapsedr   short_ps                     rY   learnzTrafficModel.learn  sj   Lmtvvz*%m4 &&( 	&DAqa A% 	& }!!!$//EE3;D" :Q42!8!89: #(DQ"&,DQ 	+A226:NFFANN,,L-466A:.C +55F?++,{{^+$S5<z5I2K )L MDKK**33::4@ab'TG+C**,""--g.0228&qww2H&&sB/66w?!"g
*#+		+. 	  L0 sB'..z:r[   c                    i }| j                   j                         D ]-  \  }}dj                  |      }t        t	        |            ||<   / i }| j
                  j                         D ]#  \  }}t        t	        d |D                    ||<   % ||| j                  | j                  t        d}| j                  |d<   t        |t              rt        |d      }t        j                  ||d       y )Nr   c              3   F   K   | ]  }|rd j                  |      nd  yw)r   r$   N)r   r  s     rY   r  z$TrafficModel.save.<locals>.<genexpr>  s'      ,801 =>DIIaL3,F ,8s   !)rE  rF  rH  rI  versionr'   r  r#   )indent)rE  r  r   dictr   rF  rH  rI  CURRENT_MODEL_VERSIONrG  r  r  r  jsondump)r   rH  rE  r%  r  rF  ds          rY   savezTrafficModel.save  s    KK%%' 	)DAq		!AWQZ(F1I	) &&,,. 	9DAq#G ,856,8 %8  9M!	9
 *#'#;#;++,
 $$%aQA		!Qq!r[   c           	      0   t        |t              rt        |      }t        j                  |      }	 |d   }|t
        k  rt        d|t
        fz        	 |d   j                         D ]  \  }}t        t        |      j                  d            }| j                  j                  |g       }|j                         D ]#  \  }}|j                  t        |      g|z         % |j                           |d   j                         D ]  \  }}| j                  j                  t        |      g       }|j                         D ]V  \  }}|dk(  r|j                  dg|z         !|j                  t        t        |      j                  d            g|z         X |j                           d	|v r2|d	   j                         D ]  \  }}| j                   |xx   |z  cc<    |d
   | _        |d   | _        y # t        $ r t        dt
        z        w xY w)Nr[  z4the model file is version %d; version %d is requiredz=the model file lacks a version number; version %d is requiredrE  r   rF  r$   rp   r'   rH  rI  )r  r  r  r_  loadREQUIRED_MODEL_VERSION
ValueErrorKeyErrorr  rU   r   rE  r  extendr  rF  rG  rH  rI  )	r   rH  ra  r[  r%  r  r-  rn   counts	            rY   rd  zTrafficModel.load  s   aQAIIaL		;	lG//  ":")+A!B"C D D 0 hK%%' 	DAqc!fll4()A[[++Ar2FGGI 05s1vh./0KKM	 o&,,. 	DAq''223q62>FGGI G58MM2$,/MM5Qd);#<"="EF	G
 KKM	 A:%( *1!!!$)$* $%%:#; ]+5  	;  ":"8": ; ;	;s   "G9 9Hc                    g }t         f| j                  dz
  z  }||dz
  }	 t        j                  | j                  j                  |t         f            }|t         k(  ry||k  r	 |S t        j                         |kD  r#t        d||fz  t        j                         	 |S dt        j                  dd      z  }t        d|z  t        j                         || j                  v r#t        j                  | j                  |         }	ng }	|j                  d	d      \  }
}|
d
k(  rEt        |      t        j                         z   }t        j                  |      t        |z  z  }||z  }nWt        j                   t"         }t        j                  |      |z  }||z  }|||kD  r	 |S ||k\  r|j%                  ||
||	f       |dd |fz   }|d   dd dk(  r"|d   dd dk(  rt         f| j                  dz
  z  })zUConstruct an individual conversation packet sequence from the
        model.
        r_   Nz"ending after %s (persistence %.1f)rO   rK  r     ztrying %s instead of endr   r   zwait:rj  )rL  r  r*  re  rE  r   rR   rS   rT   	randrangerF  r   r   rN  exprP  r  NO_WAIT_LOG_TIME_RANGEr  )r   r}   	hard_stopreplay_speedignore_beforepersistencerm  r   rn   r   r   r   log_wait_timer   log_waits                  rY   construct_conversation_sequencez,TrafficModel.construct_conversation_sequence  s    mtvvz* %MMdkkoocJ=ABAJ},F E ==?[0>#{ASS"zz+> ;  0 0B 770143::FD&&&d&8&8&;< wwsAHf6! #Ffmmo =xx.*|2KLT!	!>>+ABxx)L8T!	(Y-B  -HHi65ABab'QD.C2wr{g%#b'"1+*@ "mtvvz2K r[   c                 0    | j                   \  }}||z  |z  S r   rI  )r   scalerate_nrate_ts       rY   scale_to_packet_ratez!TrafficModel.scale_to_packet_rateP  s     **v~&&r[   c                 0    | j                   \  }}||z  |z  S r   rx  )r   ppsrz  r{  s       rY   packet_rate_to_scalez!TrafficModel.packet_rate_to_scaleT  s     **fv%%r[   c                    d|z  }t        ||z        }g }d}||k  rmt        j                  | |      }	| j                  |	||d|      }
|
D ]  \  }}}}t	        ||      s n M|j                  |
       |t        |
      z  }||k  rm| j                  |      }t        d||t        |      ||fz  t        j                         |j                          |S )z<Generate a list of conversation descriptions from the model.	   r   )rp  rq  rr  rs  zGwe have %d packets (target %d) in %d conversations at %.1f/s (scale %f)rO   )r   r*  r  rv  r   r  r  r  rR   rS   rT   r  )r   rI  r   rq  rs  lead_intarget_packetsr2  	n_packetsr   rm  r}   r   r   r   ry  s                   rY   generate_conversation_sequencesz,TrafficModel.generate_conversation_sequencesX  s    h,[834	.(NNG8X6E44U?GBNCDAL	 5 NA 78 2	8VU1(FC   #QI% .(( ))+6 (.#m:L*E33 ::	 	r[   )rd  r   )r   Nr_   r   r   )r_   r   )rw   rx   ry   r   rX  rb  rd  rv  r|  r  r  rp   r[   rY   rC  rC    sH    "0;d"2&,P 9<26566745	4l'& ST45%r[   rC  c                 t    g }| D ]0  }|st        |d   d   ||f|      }|dz  }|j                  |       2 |S )Nr   r_   )r  r  )r  r   r  r2  rr   rm  s         rY   seq_to_conversationsr    sS    M $QqT!Wvv&6:AaKF  #	$
 r[   r'   r6   rpc_netlogonr  r   r*   rI   r-   r3   r|  r   r5   epmr   rJ   rK   r   r:   )rJ   0x01zHost Announcement (0x01))rJ   0x02zRequest Announcement (0x02))rJ   0x08zBrowser Election Request (0x08))rJ   0x09zGet Backup List Request (0x09))rJ   0x0cz$Domain/Workgroup Announcement (0x0c))rJ   0x0fz Local Master Announcement (0x0f)r2   searchRequestrB   searchResDone)r5   r(   Requestr4   BindrC   Bind_ackrE   Bind_nakr7   Alter_contextrG   Alter_context_respr   AUTH3)r5   r1   Responser&   r	   r;   response)r   r(   DsBind)r   rD   DsCrackNames)r   rF   DsWriteAccountSpn)r   r<   DsUnbind)r   r1   DsReplicaSync)r   r/   DsGetNCChanges)r   r?   DsReplicaUpdateRefs)r  r/   Mapr   r   r,   bindRequestr=   bindResponser0   unbindRequestr.   r>   searchResEntryr@   )r-   r   z*** Unknown ***)r|  r8   lsa_LookupNames)r|  rH   lsa_LookupSids)r|  39lsa_QueryTrustedDomainInfoBySid)r|  40lsa_SetTrustedDomainInfo)r|  6lsa_OpenPolicy)r|  76lsa_LookupSids3)r|  77lsa_LookupNames4r9   )r:   r<   )r  21NetrLogonDummyRoutine1)r  26NetrServerAuthenticate3)r  29NetrLogonGetDomainInfo)r  30NetrServerPasswordSet2)r  r  NetrLogonSamLogonEx)r  r  DsrEnumerateDomainTrusts)r  45NetrLogonSamLogonWithFlags)r  r?   NetrServerReqChallenge)r   r(   Connect)r   r   GetAliasMembership)r   17LookupNames)r   18
LookupRids)r   19	OpenGroup)r   r<   Close)r   25QueryGroupMember)r   34OpenUser)r   36QueryUserInfo)r   r  GetGroupsForUser)r   r/   QuerySecurity)r   rA   LookupDomain)r   64Connect5)r   r  EnumDomains)r   7
OpenDomain)r   8QueryDomainInfo)r*   0x04zClose (0x04))r*   0x24zLocking AndX (0x24))r*   0x2ezRead AndX (0x2e))r*   0x32zTrans2 (0x32))r*   0x71zTree Disconnect (0x71)r)   zNegotiate Protocol (0x72))r*   0x73zSession Setup AndX (0x73))r*   0x74zLogoff AndX (0x74))r*   0x75zTree Connect AndX (0x75))r*   0xa2zNT Create AndX (0xa2))rI   r(   NegotiateProtocol)rI   r6   Ioctl)rI   r8   Find)rI   r   GetInfo)rI   r  Break)rI   r<   SessionSetup)rI   r1   SessionLogoff)rI   r/   TreeConnectTreeDisconnectCreateReadz$SAM LOGON request from client (0x12)z3SAM Active Directory Response - user unknown (0x17)NetShareGetInfoNetSrvGetInfo))rI   r?   )rI   rA   )rI   r  )rI   r  )rK   0x12)rK   0x17)r   r   )r   r  c                     | j                  dd      \  }}t        j                  ||fd      }t        j                  |d      }||d|||||g}	|	j	                  |       dj                  |	      S )Nr   r_   r   r  r   )r   r  r   r  rh  r   )
rn   r}   r   r   r   r   r   r   r~   r   s
             rY   expand_short_packetr    so    wwsAHf&126D""8T2K{BT8VTJDKK99T?r[   c                     t         j                  j                          t         j                  j                          t	        j
                  d       y)zSignal handler closes standard out and error.

    Triggered by a sigterm, ensures that the log messages are flushed
    to disk and not lost.
    r   N)rS   rT   r  stdoutr  _exit)signalframes     rY   flushing_signal_handlerr  	  s/     JJJJHHQKr[   c                    |dz  t        j                  dd      z   }t        j                  j	                          t        j
                  j	                          t        j                         }|dk7  r|S 	 t        j                  |       ||f}d}	| d   d   }
t        |
|| |      }t        j                  t        j                  t               |j                  ||       t        j                  j                          t        j                  d       t        j                   j#                  |j$                  d|j&                  z        }t)        |d      }	 t        j                  j                          t        j                  d       |t        _        t1        j0                         |z
  }|
|z
  }|t2        z
  }|dkD  rt1        j4                  |       |j7                  ||
      \  }}}t9        d|z         t9        d|z         t9        d|z         t        j
                  j                          t        j                  j                          t        jB                  |	       y	# t*        $ r#}t,        j/                  d|z         Y d	}~d	}~ww xY w# t:        $ ry d}	t9        dt        j<                         fz  t        j
                         t?        j@                  t        j
                         t        j
                  j	                          Y w xY w# t        j
                  j                          t        j                  j                          t        jB                  	       w xY w)z8Fork a new process and replay the conversation sequence.  r   i  )r  r   zstats-conversation-%dr  r_   stdout closing failed with %sN)r   r   zMaximum lag: %fzStart lag: %fzMax sleep miss: %fz*EXCEPTION in child PID %d, conversation %srO   )"r*  randintrS   r  rc   rT   r  forkseedr  r  SIGTERMr  rF  stdinr  r  r   r   r   r  IOErrorr   infor   r  r  r  rR   r   getpidra   	print_excr  )csr   r   rE  	client_id	server_idr  pidr   statusr   rm  r  rH  r   r  r  r  max_lag	start_lagr  s                        rY   replay_seq_in_forkr    s    tfnnQ44D JJJJ
'')C
ax

*D	*	qE!HI2yIfnn&=>--gq9		
77<< 0 02I ! 1 132 33	=JJHHQK 
iikE!#g>)
>JJz"-.-@-@uIP .A .R*N')*o	)*"^34 	




3  	=KK7!;<<	=   ;ryy{A>NN::	CJJ'

 	




sR   5C"J 3I( BJ (	J1J	J JJ A>LL LL AM/c                    t         j                  j                          t         j                  j                          t	        j
                         }|dk7  r|S t         j                  j                          t	        j                  d       	 t         j                  j                          t	        j                  d       t        j                  j                  |j                  d      }t        |d      t         _        	 d}t        j                  t        j                   t"               t%        | ||      }|j'                  |       t         j                  j                          t         j                  j                          t	        j2                  |       y # t        $ r#}t        j                  d|z         Y d }~d }~ww xY w# t(        $ rX d}t+        dt	        j,                         z  t         j                  	       t/        j0                  t         j                         Y w xY w# t         j                  j                          t         j                  j                          t	        j2                         w xY w)
Nr   r_   r  z	stats-dnsr  r  )r   z)EXCEPTION in child PID %d, the DNS hammerrO   )rS   r  rc   rT   r  r  r   r  r  r   warnr  r   r   r  r  r  r  r  r#  r   rR   r  ra   r  r  )	r  r   r   r  r  r   r  r	  hammers	            rY   dnshammer_in_forkr  S  s   JJJJ
'')C
ax
IIOOHHQK9


 ww||G,,k:Hh$CJfnn&=>8X*Eg& 	




%  93a7889  (:biikJ::	CJJ'	( 	




s?   3F ?A
G
 	G$GG
AH+(H. *H++H. .AJc
                 p   t        d|||t        |       d|
}t        |      t        |       k  r"t        dt        |      t        |       fz        t        j                          t        |       dz  }t        j
                         |z   }|| d   d   d   |z   }t        d|z  t        j                         t        d||z   z  t        j                         t        d	|z  t        j                         ||z   d
z   }t        j                  dt        |       |fz         |j                  dt        |       t        d | D                     i }	 |rt        ||||      }d||<   t        |       D ]#  \  }}||   }|dz   }t        |||||      }|||<   % t        j
                         }t        d||z
  |z   ||z
  fz  t        j                         t        j
                         |k  r|rt        j                   d       	 t        j"                  dt        j$                        \  }}|rM|j-                  |d       }t.        dkD  r*t        d||t        |      fz  t        j                         |	r|dk7  rnt        j
                         |k  r|r|j                  dt        |             dD ]v  }t        dt        |      |fz  t        j                         |D ]  }	 t        j6                  ||        t        j                   d       t        j
                         dz   }|r	 t        j"                  dt        j$                        \  }}dk7  r|j-                  |d       }|_t        d|z         t        j                  j;                          t        j<                  j;                          t        j>                  d       t        d||t        |      fz  t        j                         t        j
                         |k\  rn|r|s nt        j                   d       y |r't        dt        |      z  t        j                         	 t        j@                  dd       y # t&        $ r}|j(                  t*        k7  r Y d }~d }~ww xY w# t0        $ r3 t        dt        j                         t3        j4                          Y ?w xY w# t&        $ r}|j(                  t8        k7  r Y d }~d }~ww xY w# t&        $ r}|j(                  t*        k7  r Y d }~d }~ww xY w# tB        $ r t        dt        j                         Y y w xY w# |j                  dt        |             dD ]  }t        dt        |      |fz  t        j                         |D ]C  }	 t        j6                  ||       # t&        $ r}|j(                  t8        k7  r Y d }~=d }~ww xY w t        j                   d       t        j
                         dz   }|r	 t        j"                  dt        j$                        \  }}n*# t&        $ r}|j(                  t*        k7  r Y d }~nd }~ww xY wdk7  r|j-                  |d       }|_t        d|z         t        j                  j;                          t        j<                  j;                          t        j>                  d       t        d||t        |      fz  t        j                         t        j
                         |k\  rn|r|s nt        j                   d        |r't        dt        |      z  t        j                         	 t        j@                  dd       w # tB        $ r t        dt        j                         Y w w xY wxY w) N)r   r   r   r   z(we have %d accounts but %d conversationsg{Gz?rj  r   zWe will start in %.1f secondsrO   zWe will stop after %.1f secondszruntime %.1f secondsr%   z6Replaying traffic for %u conversations over %d seconds
intentionsc              3   2   K   | ]  }t        |        y wr   )r  r  s     rY   r  zreplay.<locals>.<genexpr>  s     +MqCF+Ms   )Planned_conversationsPlanned_packetsr  r_   r#   z,all forks done in %.1f seconds, waiting %.1fg~jth?z-process %d finished conversation %d; %d to gozEXCEPTION in parent
unfinished)Unfinished_conversations)   r  r  zkilling %d children with -%d      ?zchildren is %s, no pid foundz)kill -%d %d KILLED conversation; %d to goz%d children are missingzignoring fake ^Crp   )"r   r  rf  r  setpgrpr   rR   rS   rT   r   r  r  sumr  r,  r  r  waitpidWNOHANGOSErrorerrnor   poprQ   r   ra   r  killr   rc   r  r  killpgKeyboardInterrupt)conversation_seqhostr   r   accountsr  dns_query_filer   latency_timeoutstop_on_any_errorr  r   delayr   r`   childrenr  r&  r  rE  r  r   r	  r   rm  rr   s                             rY   r#  r#  u  s     &4"'!034D0E& %	&G 8}s+,,Dx=#.>*?@A C 	C
 JJL  !D(EIIK%E $B'+A.@	
)E
1zz	
+x%/?
@zz	
 8
+zz (
S
 C
KKH!"H-. / .12B.C(++M<L+M(M  O HY7#Hh/=?CHSM/0 	&EArqkGAI$R)LC%HSM		& IIK<5y5 !e),-::	 iikCHJJu jjRZZ8V
 LLd+? 'CM23:=**F %1 iikCH* 	L58] 	 	D  !	A1M1%&-0ZZ9 GGCO JJsO))+/C"$**R"<KC !8 S$/Ay<xGH

((*

((* &sCM23  #zz+ 99;#%% ( JJqMC!	F +c(m;zz#	7IIaOC  77f$  ##**5  ww%' (  ww&( )@ ! 	7$3::6	7c 	L58] 	 	D  !	A1M1%&-0ZZ9 GGCO ww%' ( JJsO))+/C"$**R"<KC ww&( ) !8 S$/Ay<xGH

((*

((* &sCM23  #zz+ 99;#%% ( JJqMC!	F +c(m;zz#	7IIaO  	7$3::6	7s  B2R 'Q0 .A(R (S/'TT0 0	R9RR RR 8SU SU 	T#S==T	T-T((T-0$UUA^5,W^5	W*W% ^5%W**3^5'Y^5	Y-	Y(	#^5(Y-	-B?^5.A^54^
^5$^2/^51^22^5c                 B    t               }t        d| z  |dg||      }|S )Nr   zmodules:paged_searches)r   r   optionsr   r   )r   r   )r%  r   r   r   r  s        rY   openLdbr.    s1    G
K$&$12!	C
 Jr[   c                 .    d| | j                          fz  S )z(Generate an ou name from the instance idz#ou=instance-%d,ou=traffic_replay,%s)r  )r  r   s     rY   ou_namer0    s$    0K4ACMMO4E E Er[   c                 J   t        | |      }	  | j                  |j                  dd      d   dd       	  | j                  |dd       |S # t        $ r}|j                  \  }}|dk7  r Y d}~;d}~ww xY w# t        $ r }|j                  \  }}|dk7  r Y d}~|S d}~ww xY w)zCreate an ou, all created user and machine accounts will belong to it.

    This allows all the created resources to be cleaned up easily.
    r  r_   organizationalunit)r   objectclassD   N)r0  addr   r   rX   r  r   r   r   r	  r   s         rY   	create_our7    s    
 
k	"BrxxQ'* 46 	7r 46 	7 I  ffR<   ffR< Is.   (A A9 	A6A11A69	B"BB"ConversationAccounts)r:  r;  r<  r=  c                     g }t        d|dz         D ]9  }t        ||      }t        ||      }t        ||||      }|j	                  |       ; |S )z;Generate a series of unique machine and user account names.r_   )r  machine_namer+  r8  r  )	r  r   numberpasswordr&  r&  r:  r<  rE  s	            rY   generate_replay_accountsr=  <  sa     H1fqj! !#K3[!,&|Xx'/1 ! Or[   c                     t        | |      }d|d|}dt        |      z  j                  d      }|rt        t        t
        z        }nt        t              } | j                  |dd|z  ||d       y)	z"Create a machine account via ldap.r2  r  "%s"	utf-16-lecomputerz%s$r   r3  sAMAccountNameuserAccountControl
unicodePwdN)r0  r!   encoder  r   r   r   r5  )	r  r   r:  r;  traffic_accountr   r   utf16pwaccount_controlss	            rY   create_machine_accountrJ  J  s     
k	"B#R	(B
;//77DG 86 7 8 ;<CGG!,..  r[   c                     t        | |      }d|d|}dt        |      z  j                  d      } | j                  |d|t	        t
              |d       t        j                  |       }|j                  |d       y)	zCreate a user account via ldap.r2  r  r?  r@  userrB  z(A;;WP;;;PS)N)	r0  r!   rF  r5  r  r   r    SDUtilsdacl_add_ace)r  r   r<  r=  r   rB  rH  sdutilss           rY   create_user_accountrP  c  s|    	k	"B$b)G
8,,44[AGCGG"!"34  s#G.1r[   c                 X    t        | |      }d|d|} | j                  |d|d       y)zCreate a group via ldap.r2  r  group)r   r3  rC  N)r0  r5  )r  r   rM   r   r   s        rY   create_grouprS  u  s6     
k	"BR	 BCGG r[   c                     d| |fz  S )z-Generate a user name based in the instance idz
STGU-%d-%drp   r   r&  s     rY   r+  r+        ;***r[   c                      | j                   dj                  |      |g      }|D ch c]  }t        ||          c}S c c}w )z(Search objectclass, return attr in a setz(objectClass={}))r  r   )r  r
  r  )r  r3  attrobjsobjs        rY   search_objectclassr[    sC    3::%,,[9fD '++sCD	N+++s   Ac                     t        | d      }d}t        |dd      D ]I  }t        ||      }||vst        | |||       |dz  }|dz  dk(  s0t        j                  d||fz         K |S )zAdd users to the serverrL  r3  r   rj  r_   2   zCreated %u/%u users)r[  r  r+  rP  r   r  )r  r   r;  r<  existing_objectsusersr&  rM   s           rY   generate_usersra    s    )#6BE61b! Ea(''[$AQJErzQ1UFOCDE Lr[   c                 "    |rd| |fz  S d| |fz  S )z1Generate a machine account name from instance id.z
STGM-%d-%dzPC-%d-%drp   )r   r&  rG  s      rY   r:  r:    s)     {A... [!,,,r[   c                     t        | d      }d}t        |dd      D ]N  }t        |||      }|dz   |vst        | ||||       |dz  }|dz  dk(  s5t        j                  d||fz         P |S )	z"Add machine accounts to the serverrA  r]  r   rj  r_  r_   r^  zCreated %u/%u machine accounts)r[  r  r:  rJ  r   r  )	r  r   r;  r<  rG  r_  addedr&  rM   s	            rY   generate_machine_accountsre    s     *#:FE61b! PKO<#:--"3T8#24QJErzQ<vNOP Lr[   c                     d| |fz  S )z'Generate a group name from instance id.z
STGG-%d-%drp   rU  s     rY   
group_namerg    rV  r[   c                     t        | d      }d}t        |dd      D ]H  }t        ||      }||vst        | ||       |dz  }|dz  dk(  s/t        j                  d||fz         J |S )z3Create the required number of groups on the server.rR  r]  r   rj  r_   r  zCreated %u/%u groups)r[  r  rg  rS  r   r  )r  r   r;  r_  groupsr&  rM   s          rY   generate_groupsrj    s    )#7CF61b! G+q)''k40aKF}!2ff5EEFG Mr[   c                     t        | |      }	  | j                  |dg       y# t        $ r}|j                  \  }}|dk7  r Y d}~yd}~ww xY w)z7Remove the created accounts and groups from the server.ztree_delete:1    N)r0  deleter   rX   r6  s         rY   clean_up_accountsrn    sR    	k	"B

2() ffR< s   # 	AAAc	                 <   d}	d}
d}t        | |       t        j                  d       t        | |||      }t        j                  d       t	        | ||||      }|dkD  r"t        j                  d       t        | ||      }
|dkD  rWt        j                  d       t        ||
||||      }t        j                  d       t        | ||       |j                         }	|
dkD  r|dk(  r||
k7  rt        j                  d       t        j                  d|||
|	fz         y	)
zTGenerate the required users and groups, allocating the users to
       those groups.r   zGenerating dummy user accountsz!Generating dummy machine accountszGenerating dummy groupszAssigning users to groupszAdding users to groupsz(The added groups will contain no membersz:Added %d users (%d machines), %d groups and %d membershipsN)
r7  r   r  ra  re  rj  GroupAssignmentsadd_users_to_groupsrT  warning)r  r   r<  number_of_usersnumber_of_groupsgroup_membershipsmax_membersmachine_accountstraffic_accountsmemberships_addedgroups_addedcomputers_addedusers_addedassignmentss                 rY   generate_users_and_groupsr~    s'    LOc;
KK01 k?HMK
KK34/[0@(0@BO !-.&sK9IJ1/0&'7'3'6'2'8'24 	,-Ck:'--/q[A-<'AB
KKLo|"$$ %r[   c                   N    e Zd Zd Zd Zd Zd Zd Zd Zd Z	d Z
d	 Zd
 Zd Zy)rp  c                     d| _         | j                  |       | j                  ||       || _        t	        t
              | _        | j                  |||||       y )Nr   )ri  generate_group_distributiongenerate_user_distributionrv  r   r  r}  assign_groups)r   rt  rz  rs  r|  ru  rv  s          rY   r   zGroupAssignments.__init__  s[     
(()9:''9JK&&t,+\?&(9	;r[   c                 p    g }t        |      }|dk(  ry d}|D ]  }||z  }|j                  ||z          |S )Nr   r   )r  r  )r   weightsdistrT  
cumulativeprobabilitys         rY   cumulative_distributionz(GroupAssignments.cumulative_distribution  sR     GA:
" 	,K+%JKK
U*+	, r[   c                     |dkD  rd}n|dkD  rd}n
|dkD  rd}nd}g }t        d|dz         D ](  }t        j                  |      }|j                  |       * | j	                  |      | _        y	)
zAProbability distribution of a user belonging to a group.
        i@KL g      @i g      @i g      @g      ?r_   N)r  r*  paretovariater  r  	user_dist)r   	num_usersnum_membershipsshaper  rs   rn   s          rY   r  z+GroupAssignments.generate_user_distribution(  s     W$Ew&Ev%EEq)a-( 	A$$U+ANN1	
 55g>r[   c                     g }t        d|dz         D ]  }d|dz  z  }|j                  |        || _        | j                  |      | _        y)z6Probability distribution of a group containing a user.r_   g?N)r  r  group_weightsr  
group_dist)r   r  r  rs   rn   s        rY   r  z,GroupAssignments.generate_group_distributionB  sW    
 q!a% 	AQVANN1	
 %66w?r[   c                     t        j                   | j                  t        j                               }t        j                   | j                  t        j                               }||fS )z2Returns a randomly generated user-group membership)bisectr  r*  r  r   rL  rR  s      rY   generate_random_membershipz+GroupAssignments.generate_random_membershipP  sB     }}T^^V]]_=doov}}?U{r[   c                      | j                   |   S r   )r}  )r   rR  s     rY   users_in_groupzGroupAssignments.users_in_group\  s    &&r[   c                 6    | j                   j                         S r   )r}  r  r   s    rY   
get_groupszGroupAssignments.get_groups_  s    $$&&r[   c                     t        | j                  |         }||k\  rZt        j                  dj	                  ||             d| j
                  |dz
  <   | j                  | j
                        }|| _        yy)z?Prevent the group's membership from exceeding the max specifiedzGroup {0} has {1} membersr   r_   N)r  r}  r   r  r
  r  r  r  )r   rR  rv  num_membersnew_dists        rY   cap_group_membershipz%GroupAssignments.cap_group_membershipb  sq    $**512+%KK3::5+NO -.Duqy)33D4F4FGH&DO &r[   c                     || j                   |   vr3| j                   |   j                  |       | xj                  dz  c_        | j                  r| j	                  || j                         y y )Nr_   )r}  r  ri  rv  r  r  s      rY   add_assignmentzGroupAssignments.add_assignmentn  sc     t''..U#**40JJ!OJ %%eT-=-=> r[   c                    |dk  ryt        j                  t        |      t        |      t        |      z  z        }| j                  rt	        || j                  |z        }||z
  dz
  }||z
  dz
  }| j                         |k  rJ| j                         \  }}	|	|kD  s||kD  r| j                  |dz   |	dz          | j                         |k  rIyy)a  Allocate users to groups.

        The intention is to have a few users that belong to most groups, while
        the majority of users belong to a few groups.

        A few groups will contain most users, with the remaining only having a
        few users.
        r   Nr_   )rN  ceilr   rv  r*  rT  r  r  )
r   rt  rz  rs  r|  ru  existing_usersexisting_groupsrL  rR  s
             rY   r  zGroupAssignments.assign_groupsz  s     ! !II#$;%"88:;  #$5$($4$47G$G!I *[8A=*\9A=jjl..99;KD%&$*? ##D1Heai8 jjl..r[   c                     | j                   S r   ri  r   s    rY   rT  zGroupAssignments.total  s    zzr[   N)rw   rx   ry   r   r  r  r  r  r  r  r  r  r  rT  rp   r[   rY   rp  rp    s;    	;"?4@
''
'
?9Br[   rp  c                 d   |j                         }d}d}|j                         D ]  }|j                  |      }t        |      dk(  r#t	        dt        |      d      D ]N  }|||dz    }	t        | |||	       |t        |	      z  }|dz  }|dz  dk(  s5t        j                  d||fz         P  y)zDTakes the assignments of users to groups and applies them to the DB.r   r  r_   r^  zAdded %u/%u membershipsN)rT  r  r  r  r  add_group_membersr   r  )
r!  r   r}  rT  ri  rd  rR  r  chunkchunk_of_userss
             rY   rq  rq    s     EEE'') H$33E:~!#
 1c.148 	HE+E%$,?Nb+unES((EQJErzQ5FG	HHr[   c                 j  
 t        | |      

fd} |t        ||            }t        j                         }t        j                  | |      |_        |D ]J  } |t        ||            }dt        |      z   }	t        j                  |t        j                  d      ||	<   L | j                  |       y)z(Adds the given users to group specified.c                     d| dS )Nr2  r  rp   )rM   r   s    rY   build_dnz#add_group_members.<locals>.build_dn  s    !2&'r[   zmember-memberN)r0  rg  r  MessageDnr   r+  r  MessageElementFLAG_MOD_ADDmodify)r!  r   rR  r  r  group_dnmrL  rB  idxr   s             @rY   r  r    s     
[	!B( 
;67HA66"hAD I9[$78#d)###GS-=-=xH#I
 IIaLr[   c                    t         j                  j                  }d}d}d}i }t               }t	               }||j
                  }	nd }	 |	d       dddd}
dddd}t        j                  |       D ]  }t        j                  j                  | |      }t        |d      5 }|D ]  }	 |j                  d      j                  d	      }|d
   }|d   }|d   }t        |d         }t        |d         }t        ||z
  |      }t        ||      }||f}|j                  |g       j!                  |       |d   dk(  r|d
z  }n|d
z  }||xx   d
z  cc<   |j#                  |        |	|        	 ddd        ||z
  }|dk(  rd}n||z  }|dk(  rd}n||z  }t/        |      }t+        d|z         t+        d||fz         t+        d||fz         t1        |
j3                               D ](  \  }}t+        d|j5                  dd      dz   |fz         * t1        |j3                               D ](  \  }}t+        d|j5                  dd      dz   |fz         * t+        d       i }|D ]*  \  }}||vrt	               ||<   ||   j#                  |       , t1        |j7                               } | D ]  }t1        ||   t8              }!|!D ]  }||f}||   }"t1        |"      }"t/        |"      }#||   }t;        |"      |#z  }$t=        |"d      }%t=        |"d      }&|"d   |"d   z
  }'|"d   }(t>        jA                  |d      })t+        d|||)|#||$|%|&|'|(f
z           y# t$        t&        f$ r d|v rq|j                  dd
      \  }}||
v rt        t        |      |
|         |
|<   nW||v rt        t)        |      ||         ||<   n7t+        |t         j,                         nt+        |t         j,                         Y Xw xY w# 1 sw Y   xY w) z/Generate and print the summary stats for a run.r   Nc                      y r   rp   )rs   s    rY   twzgenerate_stats.<locals>.tw  s    r[   z2time	conv	protocol	type	duration	successful	error
)zMaximum lagz	Start lagzMax sleep miss)r  r  r  r#  r   r   r_   r#   rd  r  r  Truer   rO   zTotal conversations:   %10dz-Successful operations: %10d (%.3f per second)z-Failed operations:     %10d (%.3f per second)z%-28s %fr   r^   z%-28s %dzProtocol    Op Code  Description                                Count       Failed         Mean       Median          95%        Range          Max)r   r  gffffff?rj  r   z?%-12s   %4s  %-35s %12d %12d %12.6f %12.6f %12.6f %12.6f %12.6f)!rS   
float_infor+  r   r?  writer  listdirr  r   r  r   r   r   r*  r  r  r5  rf  
IndexErrorr   rR   rT   r  sortedr  replacer  
opcode_keyr  calc_percentiler  r   )*r   timing_filerS  rU  
successfulfailed	latenciesfailuresunique_conversationsr  float_values
int_valuesr  r  rH  r   r   r   r   packet_typelatencyr   opr%  r  r   success_ratefailure_rater2  opsprotor  	protocolspacket_typesr-  ri  meanmedian
percentilerngmaxvr   s*                                             rY   generate_statsr    s   ##EDJFIH5	 BC L "#$%J JJx( &5ww||Hh/$_ $	5 #5"5#';;t#4#:#:4#@F#)!9L#)!9H#)!9K#(#3GfQi(A#&q7{E#:E#&q$<D"K0B((R077@ayF*"a
! )(,,\:tH+#5$	5 $	5&5P e|HQ!H,{(,-M	
'-
78	
9&' (	
9\"# $ |))+, ;1jAIIc3/#5q99:;z'')* ;1jAIIc3/#5q99:; 
 * + C" vCJE
v sxxz"I c(m<' 	KK(B"2FFVE!"FVu,D(6F(6JfQi/CD(,,R4D 0 	 	c #J/ 5d{#zz#q11,.1%(2>q//CLO*_,/A0:1-?JqM "$SZZ8 d45/$	5 $	5s2   "P)CM-PBO>	:P=O>	>PP	c                 B    	 dt        |       z  S # t        $ r | cY S w xY w)zCSort key for the operation code to ensure that it sorts numericallyz%03d)r   rf  )r  s    rY   r  r  M	  s)    A s    c                     | syt        |       dz
  |z  }t        j                  |      }t        j                  |      }||k(  r| t	        |         S | t	        |         ||z
  z  }| t	        |         ||z
  z  }||z   S )ztCalculate the specified percentile from the list of values.

    Assumes the list is sorted in ascending order.
    r   r_   )r  rN  floorr  r   )r-  r  r%  rH  rm  d0d1s          rY   r  r  U	  s     	VqJ&A

1A		!AAvc!f~	A1q5	!B	A1q5	!B7Nr[   c                      t        j                  j                  |  }t        j                  d      }t        j                  |       t        j                  |       |S )zuIn a testenv we end up with 0777 directories that look an alarming
    green colour with ls. Use umask to avoid that.?   )r  r  r   umaskmkdir)r  ra  masks      rY   r>  r>  g	  s>     	dA88E?DHHQKHHTNHr[   r  )r_   r#   )r_   r   )	NNNNr   NNr%   F)T)rL  rC  )yr   r  r*  r_  rN  rS   r  r  r   r   collectionsr   r   r   r   dns.resolverr	   r  samba.emulater
   samba.samdbr   r  r   samba.dcerpcr   r   r   r   r   samba.dcerpc.netlogonr   r   r   samba.drs_utilsr   ra   samba.credentialsr   r   r   
samba.authr   
samba.dsdbr   r   r   r   samba.dcerpc.miscr   sambar   r    samba.commonr!   samba.loggerr"   r  r^  re  r  rL  r   r   r   rP  rM  ro  rQ   rw   r   rZ   rf   rt   r   rv   objectr{   r   r   r   r  r  r  r5  r:  r?  rA  rC  r  r  r  r  r  r  r  r#  r.  r0  r7  r8  r=  rJ  rP  rS  r+  r[  ra  r:  re  rg  rj  rn  r~  rp  rq  r  r  r  r  r>  rp   r[   rY   <module>r     sM  (  	    
   E E + )  
  ) / / ! 4   &  O O %  +   # )    
 
 	 ? 

""  	x	(6$
0	i 	O<V O<d,.$_F _D& >d*6 d*NKW KW\2Bj+_6 _D	4D  
4	
 D D T d D d 
4 t t D d  D!&_3_6_ :_ 9	_
 ?_ ;_ O_ O_ Y_ f_ j_ j_ o_ *_ g_  Z!_" '#_$ *%_& h'_( ~)_* *+_, j-_. o/_0 &1_2 +3_4 %5_6 b7_8 =9_: >;_< ?=_> ??_@ #A_B ?C_D #E_F 'G_H &I_J 7K_L 0M_N %O_P 'Q_R (S_T 7U_V :W_X 4Y_Z 5[_\ 4]_^ 4__` 1a_b 6c_d 8e_f 3g_h Ii_j (k_l Mm_n Lo_p Kq_r 7s_t &u_v Jw_x Oy_z &{_| ?}_~ >_@ JA_B =C_D <E_F $G_H ^I_J *K_L 'M_N _O_P -Q_R 0S_T 0U_V )W_X /Y_Z ,[_\ &]_^ G__` Fa_b Ic_d Ge_f >g_h ?i_j =k_l $D 5'%}_D<~F "P7fE: ""8#/0  ,0 22$	+
,-  /3"+
	 BF*%ZQv QhH0(D$r[   