def _getnc_req10(self, dest_dsa, invocation_id, nc_dn_str, exop,
replica_flags=0, max_objects=0, partial_attribute_set=None,
partial_attribute_set_ex=None, mapping_ctr=None,
more_flags=0):
req10 = drsuapi.DsGetNCChangesRequest10()
req10.destination_dsa_guid = misc.GUID(dest_dsa) if dest_dsa else misc.GUID()
req10.source_dsa_invocation_id = misc.GUID(invocation_id)
req10.naming_context = drsuapi.DsReplicaObjectIdentifier()
req10.naming_context.dn = unicode(nc_dn_str)
req10.highwatermark = drsuapi.DsReplicaHighWaterMark()
req10.highwatermark.tmp_highest_usn = 0
req10.highwatermark.reserved_usn = 0
req10.highwatermark.highest_usn = 0
req10.uptodateness_vector = None
req10.replica_flags = replica_flags
req10.max_object_count = max_objects
req10.max_ndr_size = 402116
req10.extended_op = exop
req10.fsmo_info = 0
req10.partial_attribute_set = partial_attribute_set
req10.partial_attribute_set_ex = partial_attribute_set_ex
if mapping_ctr:
req10.mapping_ctr = mapping_ctr
else:
req10.mapping_ctr.num_mappings = 0
req10.mapping_ctr.mappings = None
req10.more_flags = more_flags
return req10
def zero_highwatermark(self):
"""Returns a zeroed highwatermark so that all DRS data gets returned"""
hwm = drsuapi.DsReplicaHighWaterMark()
hwm.tmp_highest_usn = 0
hwm.reserved_usn = 0
hwm.highest_usn = 0
return hwm
def get_supplemental_creds_drs(self):
binding_str = "ncacn_ip_tcp:%s[seal]" % os.environ["SERVER"]
dn = "cn=" + USER_NAME + ",cn=users," + self.base_dn
drs = drsuapi.drsuapi(binding_str, self.get_loadparm(), self.creds)
(drs_handle, supported_extensions) = drs_utils.drs_DsBind(drs)
req8 = drsuapi.DsGetNCChangesRequest8()
null_guid = misc.GUID()
req8.destination_dsa_guid = null_guid
req8.source_dsa_invocation_id = null_guid
req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
req8.naming_context.dn = unicode(dn)
req8.highwatermark = drsuapi.DsReplicaHighWaterMark()
req8.highwatermark.tmp_highest_usn = 0
req8.highwatermark.reserved_usn = 0
req8.highwatermark.highest_usn = 0
req8.uptodateness_vector = None
req8.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC |
drsuapi.DRSUAPI_DRS_PER_SYNC |
drsuapi.DRSUAPI_DRS_GET_ANC |
drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
drsuapi.DRSUAPI_DRS_WRIT_REP)
req8.max_object_count = 402
req8.max_ndr_size = 402116
req8.extended_op = drsuapi.DRSUAPI_EXOP_REPL_OBJ
req8.fsmo_info = 0
req8.partial_attribute_set = None
req8.partial_attribute_set_ex = None
req8.mapping_ctr.num_mappings = 0
req8.mapping_ctr.mappings = None
(level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
obj_item = ctr.first_object
obj = obj_item.object
sc_blob = None
for i in range(0, obj.attribute_ctr.num_attributes):
attr = obj.attribute_ctr.attributes[i]
if attid_equal(attr.attid,
drsuapi.DRSUAPI_ATTID_supplementalCredentials):
net_ctx = net.Net(self.creds)
net_ctx.replicate_decrypt(drs, attr, 0)
sc_blob = attr.value_ctr.values[0].blob
sc = ndr_unpack(drsblobs.supplementalCredentialsBlob, sc_blob)
return sc
def _get_highest_hwm_utdv(self, ldb_conn):
res = ldb_conn.search("", scope=ldb.SCOPE_BASE, attrs=["highestCommittedUSN"])
hwm = drsuapi.DsReplicaHighWaterMark()
hwm.tmp_highest_usn = long(res[0]["highestCommittedUSN"][0])
hwm.reserved_usn = 0
hwm.highest_usn = hwm.tmp_highest_usn
utdv = drsuapi.DsReplicaCursorCtrEx()
cursors = []
c1 = drsuapi.DsReplicaCursor()
c1.source_dsa_invocation_id = misc.GUID(ldb_conn.get_invocation_id())
c1.highest_usn = hwm.highest_usn
cursors.append(c1)
utdv.count = len(cursors)
utdv.cursors = cursors
return (hwm, utdv)
def _drs_fetch_pfm(server, samdb, creds, lp):
"""Fetch prefixMap using DRS interface"""
binding_str = "ncacn_ip_tcp:%s[print,seal]" % server
drs = drsuapi.drsuapi(binding_str, lp, creds)
(drs_handle, supported_extensions) = drs_DsBind(drs)
print("DRS Handle: %s" % drs_handle)
req8 = drsuapi.DsGetNCChangesRequest8()
dest_dsa = misc.GUID("9c637462-5b8c-4467-aef2-bdb1f57bc4ef")
replica_flags = 0
req8.destination_dsa_guid = dest_dsa
req8.source_dsa_invocation_id = misc.GUID(samdb.get_invocation_id())
req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
req8.naming_context.dn = text_type(samdb.get_schema_basedn())
req8.highwatermark = drsuapi.DsReplicaHighWaterMark()
req8.highwatermark.tmp_highest_usn = 0
req8.highwatermark.reserved_usn = 0
req8.highwatermark.highest_usn = 0
req8.uptodateness_vector = None
req8.replica_flags = replica_flags
req8.max_object_count = 0
req8.max_ndr_size = 402116
req8.extended_op = 0
req8.fsmo_info = 0
req8.partial_attribute_set = None
req8.partial_attribute_set_ex = None
req8.mapping_ctr.num_mappings = 0
req8.mapping_ctr.mappings = None
(level, ctr) = drs.DsGetNCChanges(drs_handle, 8, req8)
pfm = ctr.mapping_ctr
# check for schemaInfo element
pfm_it = pfm.mappings[-1]
assert pfm_it.id_prefix == 0
assert pfm_it.oid.length == 21
s = ''
for x in pfm_it.oid.binary_oid:
s += chr(x)
pfm_schi = ndr_unpack(drsblobs.schemaInfoBlob, s)
assert pfm_schi.marker == 0xFF
# remove schemaInfo element
pfm.num_mappings -= 1
return (pfm, pfm_schi)
def _exop_req8(self, dest_dsa, invocation_id, nc_dn_str, exop):
req8 = drsuapi.DsGetNCChangesRequest8()
req8.destination_dsa_guid = misc.GUID(dest_dsa)
req8.source_dsa_invocation_id = misc.GUID(invocation_id)
req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
req8.naming_context.dn = unicode(nc_dn_str)
req8.highwatermark = drsuapi.DsReplicaHighWaterMark()
req8.highwatermark.tmp_highest_usn = 0
req8.highwatermark.reserved_usn = 0
req8.highwatermark.highest_usn = 0
req8.uptodateness_vector = None
req8.replica_flags = 0
req8.max_object_count = 0
req8.max_ndr_size = 402116
req8.extended_op = exop
req8.fsmo_info = 0
req8.partial_attribute_set = None
req8.partial_attribute_set_ex = None
req8.mapping_ctr.num_mappings = 0
req8.mapping_ctr.mappings = None
return req8
def replicate(self,
dn,
source_dsa_invocation_id,
destination_dsa_guid,
schema=False,
exop=drsuapi.DRSUAPI_EXOP_NONE,
rodc=False,
replica_flags=None):
'''replicate a single DN'''
# setup for a GetNCChanges call
req8 = drsuapi.DsGetNCChangesRequest8()
req8.destination_dsa_guid = destination_dsa_guid
req8.source_dsa_invocation_id = source_dsa_invocation_id
req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
req8.naming_context.dn = dn
req8.highwatermark = drsuapi.DsReplicaHighWaterMark()
req8.highwatermark.tmp_highest_usn = 0
req8.highwatermark.reserved_usn = 0
req8.highwatermark.highest_usn = 0
req8.uptodateness_vector = None
if replica_flags is not None:
req8.replica_flags = replica_flags
elif exop == drsuapi.DRSUAPI_EXOP_REPL_SECRET:
req8.replica_flags = 0
else:
req8.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC
| drsuapi.DRSUAPI_DRS_PER_SYNC
| drsuapi.DRSUAPI_DRS_GET_ANC
| drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
drsuapi.DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP)
if rodc:
req8.replica_flags |= (
drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
else:
req8.replica_flags |= drsuapi.DRSUAPI_DRS_WRIT_REP
req8.max_object_count = 402
req8.max_ndr_size = 402116
req8.extended_op = exop
req8.fsmo_info = 0
req8.partial_attribute_set = None
req8.partial_attribute_set_ex = None
req8.mapping_ctr.num_mappings = 0
req8.mapping_ctr.mappings = None
if not schema and rodc:
req8.partial_attribute_set = self.drs_get_rodc_partial_attribute_set(
)
if self.supported_extensions & drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8:
req_level = 8
req = req8
else:
req_level = 5
req5 = drsuapi.DsGetNCChangesRequest5()
for a in dir(req5):
if a[0] != '_':
setattr(req5, a, getattr(req8, a))
req = req5
while True:
(level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level,
req)
if ctr.first_object is None and ctr.object_count != 0:
raise RuntimeError(
"DsGetNCChanges: NULL first_object with object_count=%u" %
(ctr.object_count))
self.net.replicate_chunk(self.replication_state,
level,
ctr,
schema=schema,
req_level=req_level,
req=req)
if ctr.more_data == 0:
break
req.highwatermark = ctr.new_highwatermark
def replicate(self,
dn,
source_dsa_invocation_id,
destination_dsa_guid,
schema=False,
exop=drsuapi.DRSUAPI_EXOP_NONE,
rodc=False,
replica_flags=None,
full_sync=True,
sync_forced=False):
'''replicate a single DN'''
# setup for a GetNCChanges call
req8 = drsuapi.DsGetNCChangesRequest8()
req8.destination_dsa_guid = destination_dsa_guid
req8.source_dsa_invocation_id = source_dsa_invocation_id
req8.naming_context = drsuapi.DsReplicaObjectIdentifier()
req8.naming_context.dn = dn
# Default to a full replication if we don't find an upToDatenessVector
udv = None
hwm = drsuapi.DsReplicaHighWaterMark()
hwm.tmp_highest_usn = 0
hwm.reserved_usn = 0
hwm.highest_usn = 0
if not full_sync:
res = self.samdb.search(base=dn,
scope=ldb.SCOPE_BASE,
attrs=["repsFrom"])
if "repsFrom" in res[0]:
for reps_from_packed in res[0]["repsFrom"]:
reps_from_obj = ndr_unpack(drsblobs.repsFromToBlob,
reps_from_packed)
if reps_from_obj.ctr.source_dsa_invocation_id == source_dsa_invocation_id:
hwm = reps_from_obj.ctr.highwatermark
udv = drsuapi.DsReplicaCursorCtrEx()
udv.version = 1
udv.reserved1 = 0
udv.reserved2 = 0
cursors_v1 = []
cursors_v2 = dsdb._dsdb_load_udv_v2(
self.samdb, self.samdb.get_default_basedn())
for cursor_v2 in cursors_v2:
cursor_v1 = drsuapi.DsReplicaCursor()
cursor_v1.source_dsa_invocation_id = cursor_v2.source_dsa_invocation_id
cursor_v1.highest_usn = cursor_v2.highest_usn
cursors_v1.append(cursor_v1)
udv.cursors = cursors_v1
udv.count = len(cursors_v1)
req8.highwatermark = hwm
req8.uptodateness_vector = udv
if replica_flags is not None:
req8.replica_flags = replica_flags
elif exop == drsuapi.DRSUAPI_EXOP_REPL_SECRET:
req8.replica_flags = 0
else:
req8.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC
| drsuapi.DRSUAPI_DRS_PER_SYNC
| drsuapi.DRSUAPI_DRS_GET_ANC
| drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
drsuapi.DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP)
if rodc:
req8.replica_flags |= (
drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
else:
req8.replica_flags |= drsuapi.DRSUAPI_DRS_WRIT_REP
if sync_forced:
req8.replica_flags |= drsuapi.DRSUAPI_DRS_SYNC_FORCED
req8.max_object_count = 402
req8.max_ndr_size = 402116
req8.extended_op = exop
req8.fsmo_info = 0
req8.partial_attribute_set = None
req8.partial_attribute_set_ex = None
req8.mapping_ctr.num_mappings = 0
req8.mapping_ctr.mappings = None
if not schema and rodc:
req8.partial_attribute_set = drs_get_rodc_partial_attribute_set(
self.samdb)
if self.supported_extensions & drsuapi.DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8:
req_level = 8
req = req8
else:
req_level = 5
req5 = drsuapi.DsGetNCChangesRequest5()
for a in dir(req5):
if a[0] != '_':
setattr(req5, a, getattr(req8, a))
req = req5
num_objects = 0
num_links = 0
while True:
(level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level,
req)
if ctr.first_object is None and ctr.object_count != 0:
raise RuntimeError(
"DsGetNCChanges: NULL first_object with object_count=%u" %
(ctr.object_count))
self.net.replicate_chunk(self.replication_state,
level,
ctr,
schema=schema,
req_level=req_level,
req=req)
num_objects += ctr.object_count
# Cope with servers that do not return level 6, so do not return any links
try:
num_links += ctr.linked_attributes_count
except AttributeError:
pass
if ctr.more_data == 0:
break
req.highwatermark = ctr.new_highwatermark
return (num_objects, num_links)
store_dn = store_blob[store_dn_ofs:store_dn_ofs + store_dn_len]
store_hwm_blob = store_blob[store_hwm_ofs:store_hwm_ofs +
store_hwm_len]
store_utdv_blob = store_blob[store_utdv_ofs:store_utdv_ofs +
store_utdv_len]
store_hwm = ndr_unpack(drsuapi.DsReplicaHighWaterMark, store_hwm_blob)
store_utdv = ndr_unpack(drsblobs.replUpToDateVectorBlob,
store_utdv_blob)
assert store_dn == dn
#print "%s" % ndr_print(store_hwm)
#print "%s" % ndr_print(store_utdv)
except Exception:
store_dn = dn
store_hwm = drsuapi.DsReplicaHighWaterMark()
store_hwm.tmp_highest_usn = 0
store_hwm.reserved_usn = 0
store_hwm.highest_usn = 0
store_utdv = None
binding_str = "ncacn_ip_tcp:%s[spnego,seal]" % server
drs_conn = drsuapi.drsuapi(binding_str, lp, creds)
bind_info = drsuapi.DsBindInfoCtr()
bind_info.length = 28
bind_info.info = drsuapi.DsBindInfo28()
bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_BASE
bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_ASYNC_REPLICATION
bind_info.info.supported_extensions |= drsuapi.DRSUAPI_SUPPORTED_EXTENSION_REMOVEAPI
def replicate(self,
dn,
source_dsa_invocation_id,
destination_dsa_guid,
schema=False,
exop=drsuapi.DRSUAPI_EXOP_NONE,
rodc=False,
replica_flags=None,
full_sync=True,
sync_forced=False,
more_flags=0):
'''replicate a single DN'''
# setup for a GetNCChanges call
if self.supports_ext & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V10:
req = drsuapi.DsGetNCChangesRequest10()
req.more_flags = (more_flags | self.more_flags)
req_level = 10
else:
req_level = 8
req = drsuapi.DsGetNCChangesRequest8()
req.destination_dsa_guid = destination_dsa_guid
req.source_dsa_invocation_id = source_dsa_invocation_id
req.naming_context = drsuapi.DsReplicaObjectIdentifier()
req.naming_context.dn = dn
# Default to a full replication if we don't find an upToDatenessVector
udv = None
hwm = drsuapi.DsReplicaHighWaterMark()
hwm.tmp_highest_usn = 0
hwm.reserved_usn = 0
hwm.highest_usn = 0
if not full_sync:
res = self.samdb.search(base=dn,
scope=ldb.SCOPE_BASE,
attrs=["repsFrom"])
if "repsFrom" in res[0]:
for reps_from_packed in res[0]["repsFrom"]:
reps_from_obj = ndr_unpack(drsblobs.repsFromToBlob,
reps_from_packed)
if reps_from_obj.ctr.source_dsa_invocation_id == source_dsa_invocation_id:
hwm = reps_from_obj.ctr.highwatermark
udv = drsuapi.DsReplicaCursorCtrEx()
udv.version = 1
udv.reserved1 = 0
udv.reserved2 = 0
cursors_v1 = []
cursors_v2 = dsdb._dsdb_load_udv_v2(
self.samdb, self.samdb.get_default_basedn())
for cursor_v2 in cursors_v2:
cursor_v1 = drsuapi.DsReplicaCursor()
cursor_v1.source_dsa_invocation_id = cursor_v2.source_dsa_invocation_id
cursor_v1.highest_usn = cursor_v2.highest_usn
cursors_v1.append(cursor_v1)
udv.cursors = cursors_v1
udv.count = len(cursors_v1)
req.highwatermark = hwm
req.uptodateness_vector = udv
if replica_flags is not None:
req.replica_flags = replica_flags
elif exop == drsuapi.DRSUAPI_EXOP_REPL_SECRET:
req.replica_flags = 0
else:
req.replica_flags = (drsuapi.DRSUAPI_DRS_INIT_SYNC
| drsuapi.DRSUAPI_DRS_PER_SYNC
| drsuapi.DRSUAPI_DRS_GET_ANC
| drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
drsuapi.DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP)
if rodc:
req.replica_flags |= (
drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
else:
req.replica_flags |= drsuapi.DRSUAPI_DRS_WRIT_REP
if sync_forced:
req.replica_flags |= drsuapi.DRSUAPI_DRS_SYNC_FORCED
req.max_object_count = 402
req.max_ndr_size = 402116
req.extended_op = exop
req.fsmo_info = 0
req.partial_attribute_set = None
req.partial_attribute_set_ex = None
req.mapping_ctr.num_mappings = 0
req.mapping_ctr.mappings = None
if not schema and rodc:
req.partial_attribute_set = drs_get_rodc_partial_attribute_set(
self.samdb)
if not self.supports_ext & DRSUAPI_SUPPORTED_EXTENSION_GETCHGREQ_V8:
req_level = 5
req5 = drsuapi.DsGetNCChangesRequest5()
for a in dir(req5):
if a[0] != '_':
setattr(req5, a, getattr(req, a))
req = req5
num_objects = 0
num_links = 0
first_chunk = True
while True:
(level, ctr) = self.drs.DsGetNCChanges(self.drs_handle, req_level,
req)
if ctr.first_object is None and ctr.object_count != 0:
raise RuntimeError(
"DsGetNCChanges: NULL first_object with object_count=%u" %
(ctr.object_count))
try:
self.process_chunk(level, ctr, schema, req_level, req,
first_chunk)
except WERRORError as e:
# Check if retrying with the GET_TGT flag set might resolve this error
if self._should_retry_with_get_tgt(e.args[0], req):
print("Missing target object - retrying with DRS_GET_TGT")
req.more_flags |= drsuapi.DRSUAPI_DRS_GET_TGT
# try sending the request again (this has the side-effect
# of causing the DC to restart the replication from scratch)
first_chunk = True
continue
else:
raise e
first_chunk = False
num_objects += ctr.object_count
# Cope with servers that do not return level 6, so do not return any links
try:
num_links += ctr.linked_attributes_count
except AttributeError:
pass
if ctr.more_data == 0:
break
# update the request's HWM so we get the next chunk
drs_copy_highwater_mark(req.highwatermark, ctr.new_highwatermark)
return (num_objects, num_links)
