Ur, d Z ddlZddlZddlZddlZddlZddlZddlm Z ddl
m Z ddl m
Z
mZmZmZmZmZmZ ddlmZmZ ddlmZmZ ej e Z dZ d e d
e d e fd Z e!h d
Z" e!h d Z#d e d
e$d e$fdZ% e dd Z& e dd Z' e dd Z( e%dd Z)dZ*de d e fdZ+ G d de Z,dS ) u3
Feature flags synchronisation plugin (AV mode only).
In IM360 mode the Go resident-agent handles feature-flag sync.
In AV mode there is no resident-agent, so this plugin takes over.
Periodically POSTs the local file checksum to the API and writes
back any updated flags to ``/var/imunify360/feature_flags.json`` (legacy map
``{flag: true}`` on disk) and ``/var/imunify360/feature_flags`` (plain names,
one per line). The POSTed checksum is over the canonical JSON **array** of
enabled names, matching the correlation sync API—not over the on-disk map bytes.
N)Core)
MessageSource)
FLAGS_PATHFLAGS_PLAIN_PATHenabled_flag_names_sorted$plain_text_payload_for_enabled_flags$serialize_feature_flags_file_payload!sync_checksum_hex_from_flags_filesync_response_file_bytes)IAIDTokenErrorIndependentAgentIDAPI)Scopeatomic_rewritez/api/sync/v1/feature-flagsnamedefaultreturnc t j | }|s|S t | S # t $ r" t
d| || |cY S w xY w)u Read an int env var tolerantly.
A non-numeric value (empty string, typo, etc.) must NOT raise at
import time — the plugin lives in the AV agent entry point and a
bad env var would otherwise kill the whole agent.
z4feature-flags: %s=%r is not an int, using default %d)osenvirongetint
ValueErrorloggerwarning)r r raws Z/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/plugins/feature_flags.py_env_intr + s|
*..
C 3xx B
s 4 )A A > 1onyestrue> 0noofffalsec t j | }|s|S | }|t
v rdS |t v rdS t d| || |S )NTFz4feature-flags: %s=%r is not a bool, using default %s) r r r striplower _TRUE_VALUES
_FALSE_VALUESr r )r r r
normalizeds r _env_boolr, E s
*..
C ""$$J\!!t]""u
NN> N I360_FEATURE_FLAGS_SYNC_INTERVALi I360_FEATURE_FLAGS_INIT_DELAY
I360_FEATURE_FLAGS_UNREG_DELAY #I360_FEATURE_FLAGS_USE_SERVER_DELAYT server_delayc . t r| dk r| S t S )Nr )_USE_SERVER_DELAY_SYNC_INTERVAL)r4 s r _next_delayr8 ^ s \A - - r- c e Zd Zej Zd Zd ZdefdZ d Z
de fdZ e
dej j defd Ze
d d d
Zd S )
FeatureFlagsSyncc ~ K || _ || _ | | | _ d S N)_loop_sink create_task
_sync_loop_task)selfloopsinks r
create_sourcez FeatureFlagsSync.create_sourceg s7
%%doo&7&788
r- c K | j ?| j | j d {V d S # t j $ r Y d S w xY wd S r< )rA cancelasyncioCancelledErrorrB s r shutdownzFeatureFlagsSync.shutdownl st : ! J
j )
" !s
3 AAr c * t t S r< )r
r rJ s r _local_checksumz FeatureFlagsSync._local_checksumt s 0<< >E)
K
K
K :TJJJJJ
K-&& & & & & & & & 's AA. .5B&%B&c K t j d {V }n+# t $ r t d Y dS w xY wt j }| d | j d {V }t j
d|i }t j
dt j }| d t" z }t$ j ||d|dd } | d | j | d {V }n# t$ j j $ rq} d
| j cxk rd k r-n n*t d | j || j |
n't d | j || j Y d } ~ dS d } ~ wt$ j j $ r,} t d|| j Y d } ~ dS d } ~ wt6 $ r! t d|d
Y dS w xY w t j | }
n0# t j $ r t d Y dS w xY w|
dd } |
d du r t d | S |
d } |
d pi }
| #| d | j | |
d {V | S )Nz*no IAID token, skipping feature flags syncr checksumI360_FEATURE_FLAGS_API_URL/zapplication/json)z Content-TypezX-AuthPOST)dataheadersmethodi iX z$feature flags sync HTTP %s on %s: %srO z.feature flags sync connection failed on %s: %sz'feature flags sync request failed on %sTz&failed to parse feature flags responserW changedFz'feature flags unchanged, skipping writeflagsparams)!r
get_tokenr r r rH get_event_looprun_in_executorrM jsondumpsencoder getenvr API_BASE_URLrstrip _SYNC_URLurllibrequestRequest_blocking_requesterror HTTPErrorcodereasonURLErrorrV loadsJSONDecodeErrorr debug _write_flags)rB tokenrC rY payloadbase_urlurlreq resp_bodyeresultr4 ra rb s r rU zFeatureFlagsSync._do_sync s /9;;;;;;;;EE NNG H H H11 %'' --dD4HIIIIIIII*j( 344;;==9 94;LMMooc""Y.n$$ 2 %
' " 2 2d,c II |% af""""s""""" :FH :FH 11111|$
NN@
11111 LL9
11
Z **FF# LLA B B B11 zz'1-- ::i E ) ) LLB C C C
7##H%%+ &&tT->vNN N N N N N N NsL $AA"D+ +H?A&F++H!G))*HHH0 0)I I r~ c t j | t 5 }| cd d d S # 1 swxY w Y d S )N)timeout)rm rn urlopen
_HTTP_TIMEOUTread)r~ resps r rp z"FeatureFlagsSync._blocking_request s
^
#
#C
#
?
? 499;; s AA A Nc |pi } t | t r;d | D }d | D }t || }nt | }n># t
$ r1 t dt | j Y dS w xY wt t | } t j
t j t d t# t |d t% | }t# t& |d t d | dS # t* $ r t d
d Y dS w xY w) u^ Persist flags + params on disk in the canonical sync-response
shape so the next sync's checksum matches what the server returned.
Falls back to the legacy ``{name: true}`` map when ``flags`` is not
a list (response shape we don't recognise) — keeps the long-standing
on-disk contract from older code paths.
c < g | ]}t |t |S
isinstancestr).0ns r
z1FeatureFlagsSync._write_flags.. s' @@@qZ3-?-?@@@@r- c i | ]<\ }}t |t t |t /|d |D =S )c < g | ]}t |t |S r r )r vs r r z.. s' AAAjC.@.@A1AAAr- )r r list)r r valss r
z1FeatureFlagsSync._write_flags.. sa "d!$,, 2r s_ 1 1 1 1 1 1 ; ; ; ; ; ; 8 7 7 7 7 7 7 7 8 $ $ ( 3 , y33344 55566
C $ 4 $ > h ?DD I CTJJ
c c _F _F _F _F _F} _F _F _F _F _Fr-