pendulum

#!/usr/bin/env zsh
#
# Copyright (C) 2016 Dyne.org Foundation
#
# Designed, written and maintained by Denis Roio <jaromil@dyne.org>
#
# This source code is free software; you can redistribute it
# and/or modify it under the terms of the GNU Public License
# as published by the Free Software Foundation; either
# version 3 of the License, or (at your option) any later
# version.
#
# This source code is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE.  Please refer to the GNU Public License for more
# details.
#
# You should have received a copy of the GNU Public License
# along with this source code; if not, write to: Free
# Software Foundation, Inc., 675 Mass Ave, Cambridge, MA
# 02139, USA.

# This standalone program runs every N seconds and gathers current
# information on network objects, updating it in redis


source /usr/local/dowse/zshrc

[[ -r $H/run/redis-server.pid ]] || {
	error "Dowse is not running"
	error "pid not found: $H/run/redis-server.pid"
	return 1 }

# gather_network_info fills in global maps
net_devices=()
net.scan_devices
net_ip4_addr=()
net.scan_addresses

now=`date --utc +'%s'`

pendulum_ip_to_network() {
    fn pendulum_ip_to_network $*
    local _addr="$1"
    req=(_addr)
    ckreq || return $?
    print "${_addr[(ws:.:)1]}.${_addr[(ws:.:)2]}.${_addr[(ws:.:)3]}.0/24"
}


_pendulum_resolve_hostname() {
    fn pendulum_resolve_hostname $*
    [[ "$obj[ip4]" = "" ]] && return 1

    hh="`host $obj[ip4] | awk '
/NXDOMAIN/ { exit }
{ print $NF }'`"
    # hh[${#hh}]='\0'
    [[ "$hh" = "" ]] || {
        obj[hostname]=${hh%%.*}
    }
}

watchdog_daemons() {
	# map all running pids
	# for p in ${(f)"$(ps -o pid ax)"}; do
	# 	[[ "$p" =~ "PID" ]] && continue
	# 	pidmap+=($p 1)

	# done
	# act "${#pidmap} pids found running"

	# generic restart of any daemon that has left pids behind
	for d in ${(f)"$(find $H/run -name '*.pid')"}; do
		func "watchdog: $d"
		# remove path prefix
		daemon=${d##*/}
		# remove .pid postfix
		daemon=${daemon%.*}
		func "daemon: $daemon"

		[[ "$daemon" = "seccrond" ]] && {
			func "watchdog skip seccrond parent"
			continue }

		pid_list=`cat $d`
		[[ "$pid_list" = "" ]] && {
			NOW=`date +"%Y/%m/%d %H:%M:%S"`
			err="$NOW $d pidfile found empty."
			error $err
			print $err >> $H/log/watchdog.log

			act "attempting restart: $daemon"
			start $daemon
			if [[ $? = 0 ]]; then
				err="$NOW (stat) succesfully restarted: $daemon"
				notice $err
				print $err >> $H/log/watchdog.log
			else
				err="watchdog fails to restart: $daemon"
				error $err
				print $err >> $H/log/watchdog.log
			fi
			break;
		}

        for pid in ${=pid_list} ; do
			act "$pid \t $daemon" 2>&1 #| tee -a $H/log/watchdog.log
			if [[ -r /proc/${pid}/stat ]]; then
				[[ $DEBUG = 1 ]] && {
					func "found running: $daemon"
					func "`cat /proc/$pid/cmdline`"
				}

			else
				NOW=`date +"%Y/%m/%d %H:%M:%S"`
				err="$NOW a component of $daemon [$pid] was not found running (crash?)"
				error $err
				print $err >> $H/log/watchdog.log
				# delete and kill old pid
				kill -9 $pid_list
				rm -f $d
				act "attempting restart: $daemon"
				start $daemon
				if [[ $? = 0 ]]; then
					err="$NOW (stat) succesfully restarted: $daemon"
					notice $err
					print $err >> $H/log/watchdog.log
				else
					err="watchdog fails to restart: $daemon"
					error $err
					print $err >> $H/log/watchdog.log
				fi
				break;
			fi
        done
	done

	# daemons that should always be running
	core_daemons=(redis-server dnscrypt-proxy)
	#echo "Home [$H]" | tee -a $H/log/watchdog.log
	for d in $core_daemons; do
		pidfile=$H/run/$d.pid
		[[ -r $pidfile ]] || {
			start $d 2>&1 | tee -a $H/log/watchdog.log
			if [[ $? = 0 ]]; then
				NOW=`date +"%Y/%m/%d %H:%M:%S"`
				err="$NOW (core_daemons) succesfully restarted: $d "
				notice $err
				print $err >> $H/log/watchdog.log
			else
				err="watchdog fails to restart: $d "
				error $err
				print $err >> $H/log/watchdog.log
			fi
		}
	done
}

exec_next_cmd() {
	fn exec_next_cmd $*
	local cmd
	cmd=`launch dowse-cmd-fifo`
	[[ "$cmd" = "" ]] && return 1

	# check if valid command (prefix CMD)
	[[ "${cmd[1,4]}" = "CMD," ]] || {
		error "invalid command: $cmd"
		return 1 }

	# TODO: ACL check if IP (2nd field) is authorised

	local action
	action=${cmd[(ws:,:)3]}
	[[ "$action" = "" ]] && {
		error "no action found: $cmd"
		return 1 }
	func "action: $action"
	epoch=${cmd[(ws:,:)4]}
	func "ackid we use epoch: $epoch"

	# set acl on/off switch matching the action
	acl=DROP
	[[ "$action" =~ "THING_ON"  ]] && { acl=ACCEPT ; old_acl=DROP ;}
	[[ "$action" =~ "THING_OFF" ]] && { acl=DROP ; old_acl=ACCEPT;}

    case $action in
        ALL_THINGS_OFF)
            # 5th arg is the admin macaddress to NOT disable
            local mac_admin
            mac_admin=${cmd[(ws:,:)5]}
            [[ "$mac_admin" = "" ]] && {
                error "invalid mac admin address: $mac_admin"
                return 1 }

            ip_admin=${cmd[(ws:,:)2]}
            [[ "$ip_admin" = "" ]] && {
                error "invalid ip admin address: $ip_admin"
                return 1 }

            local _things="$(print keys 'thing_*' | redis storage)"
            for i in ${=_things}; do
                [[ "$i" = "thing_$mac_admin" ]] && continue
                print "hset $i enable_to_browse no" | redis storage
                local mac=${i[(ws:_:)2]}
                local ip=`print "hget $i ip4" | redis storage`
                iptables-set-thing "OFF" $ip $mac
            done
            print "set state_all_things off" | redis storage
			;;


        ALL_THINGS_ON)
            local _things="$(print keys 'thing_*' | redis storage)"
            for i in ${=_things}; do
                print "hset $i enable_to_browse yes" | redis storage
                local mac=${i[(ws:_:)2]}
                local ip=`print "hget $i ip4" | redis storage`
                iptables-set-thing "ON" $ip $mac
            done
            print "set state_all_things on" | redis storage
			;;

        THING_OFF|THING_ON)
            local macb=${cmd[(ws:,:)5]}
            local ipb=${cmd[(ws:,:)6]}
            local state=${action[(ws:_:)2]}
            iptables-set-thing $state $ipb $macb
            ;;

		DOMAIN_OFF|DOMAIN_ON)
			error "TODO: domainblock command"
			;;

		NMAP_SCAN_IP)
			local ipt=${cmd[(ws:,:)5]}
			act "Starting nmap scan on IP $ipt"
			for l in ${(f)"$(sup nmap -n -F -sS -v $ipt 2>&1)"}; do
				print "publish nmap-channel '$l'" | redis dynamic
			done
			;;

		*)
			error "unknown action: $cmd"
			;;
	esac

	return 0
}

# DNS rotation if current dnscrypt server is unreachable
round_robin_dns() {
	fn round_robin_dns $*

    local _dnslog=1
	local _ttl=1

    [[ $DEBUG = 1 ]] && _dnslog=7

	# check currently used server, trigger rotation only if necessary
	local _dns
    _dns=$(print "GET dns-server-selected" | redis dynamic)
	# trim a nil response from redis as empty string
	# TODO: should it go into the redis wrapper?
	_dns=${_dns/\(nil\)/}
	[[ "$_dns" = "" ]] || {
		# test currently used dns
		${execmap[dnscrypt-proxy]} -L $R/share/dnscrypt-resolvers.csv \
								   -R ${_dns} -t $_ttl -m $_dnslog
		# return success if current dns works and rotation not
		# necessary
		[[ $? = 0 ]] && {
			func "rrdns: current dnscrypt server '$_dns' OK"
			return 0 }
	}

	warning "rrdns: current dnscrypt server is unreachable, rotating"

	# generate a random entry for dnscrypt-proxy test with a single
	# csv line TODO: choose specific servertype with no logs, dnssec
	# etc.
	ztmp
	local _dnsrand=$ztmpfile
	sed 1q $R/share/dnscrypt-resolvers.csv > $_dnsrand
    local _rndresolv
	_rndresolv="$(perl -wne '$a = $_ if rand $. < 1 ; END { print $a }' $R/share/dnscrypt-resolvers.csv)"
	print "$_rndresolv" >> $_dnsrand
    dnscrypt_name="${_rndresolv[(ws:,:)1]}"

	func "rrdns: testing $dnscrypt_name"

	(sleep $_ttl; rm -f $_dnsrand) &
	# run the dnscrypt-proxy in test mode with 10s timeout
	${execmap[dnscrypt-proxy]} -L $_dnsrand -R ${dnscrypt_name} \
							   -t $_ttl -m $_dnslog

    if [[ $? = 0 ]]; then
		func "rrdns: found working"
		func "${_rndresolv}"
		# Saving on redis the dnscrypt_name
		print "SET dns-server-selected ${dnscrypt_name}" | redis dynamic
		# stop the currently running daemon
		stop dnscrypt-proxy
		# let the watchdog start it
	else
		# unreachable, then recur with another random target
		dnscrypt-roundrobin
	fi
	return 0
}

################
# MAIN functions

fn "pendulum $*"

case "$1" in

	watchdog)
		wlid=`lock watchdog 60`
		[[ $wlid = 0 ]] && {
			func "watchdog already running"
			return 1 }

		# check that all registered pids are running
		# restart them if not running (and log that)
		pidmap=()
		watchdog_daemons

		unlock watchdog $wlid
		;;

	nextcmd)
		ncmd=`lock nextcmd 0`
		[[ "$ncmd" = "0" ]] && {
			func "nextcmd already locked"
			return 1 }

		exec_next_cmd

		unlock nextcmd $ncmd

		;;

	lease)
		# called by dhcp daemon when adding a new lease
		print "PUBLISH dhcp-lease-channel $*" | redis dynamic
		# shift 1
		return 0
		;;

	nmap)
		nlock=`lock nmap 30`
		# [[ $nlock = 0 ]] && {
		# 	func "nmap already running"
		# 	return 1 }

		nmapfile=$H/run/nmap_scan.xml
		ztmp
		processedfile=$ztmpfile

		ztmp
		varfile=$ztmpfile

		notice "Starting nmap scap of $dowse_net"
		act "results saved in $nmapfile"

 		sup nmap -n -F -sS -oX $nmapfile $dowse_net

		nmap-preprocess
		nmap-parse

		rm -f "${varfile}"
		rm -f "${processedfile}"

		#		unlock nmap $nlock
		;;

    netscan)
		slid=`lock netscan 30`
		[[ $? = 0 ]] || {
			func "netscan already running"
			return 1 }

        # parse everything in this map
        obj=()
		ip neigh | parse-ip-neigh.py

		unlock netscan $slid
        ;;

    rrdns)
		dlid=`lock rrdns 30`
		[[ $? = 0 ]] || {
			func "rrdns already running"
			return 1 }

		round_robin_dns

		unlock rrdns $dlid
		;;

esac