Commit Graph

11 Commits

Author SHA1 Message Date
b4fcccfbf9 feat(luci-app-cloner): Add partition tools to ASU builds
- Add fdisk, resize2fs, partx-utils to ASU package list
- Enables partition expansion on first boot for fresh installs
- Addresses kernel limitation with online ext4 resize

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-13 08:13:53 +01:00
4ee7fe2143 fix(luci-app-cloner): Fix SSH host key mismatch and button disabled issues
- Fix build button being unclickable by properly handling disabled attribute
  (only set when isBuilding is true, not undefined/false)
- Fix SSH host key mismatch errors in do_scp by cleaning stale known_hosts
  entries from all possible locations (/root/.ssh, /.ssh, /overlay/upper/.ssh)
  before transfers - prevents failures after device reflash
- Add cursor:pointer style to build button for better UX

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-13 07:45:28 +01:00
b5b2b98b68 feat(luci-app-cloner): Add remote device management and ASU clone builder
- Add remote device management: scan_network, list_remotes, add_remote,
  remove_remote, remote_status, remote_upload, remote_flash RPCD methods
- Add secubox-asu-clone script for on-the-fly firmware generation via
  OpenWrt ASU (Attended Sysupgrade) API
- Include full LuCI packages in ASU builds (luci-base, luci-mod-admin-full,
  luci-mod-network, luci-mod-status, luci-mod-system, etc.)
- Add partition expansion script (10-expand-rootfs) to use full SD card/eMMC
  with proper UUID and boot config handling for both MBR and GPT
- Add robust provisioning script (99-secubox-provision) with network retry,
  firewall handling, and SecuBox package installation from local feed
- Use dropbear's dbclient for SSH operations (OpenWrt native)
- Support mochabin, espressobin-v7, espressobin-ultra, x86-64 devices
- Default to OpenWrt version 24.10.5

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-13 07:30:36 +01:00
3e5c246ea8 fix(cloner): Fix RPC unwrapping in refresh() for images/tokens/clones
Same expect unwrapping bug was present in refresh() function,
causing stats to show counts but content to show "No items"

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-12 09:12:30 +01:00
481ba074db fix(cloner): Add build_progress method and fix device list unwrapping
- Add build_progress RPCD method to track image build status
- Fix handleBuild() to handle RPC expect array unwrapping
- The expect: { devices: [] } unwraps the array, so data IS the array

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-12 09:11:13 +01:00
e5782c1f9c fix(cloner): Add build_progress method to ACL read permissions
The build_progress RPCD method was missing from ACL, causing
"Access denied" (-32002) errors when polling build status.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-12 08:54:59 +01:00
b1c9abe5cf fix(cloner): Fix empty devices list due to RPC expect unwrapping
RPC declarations with expect: { field: [] } unwrap the response,
so data[n] IS the array, not data[n].field.

Changed:
- this.images = data[1] || []
- this.tokens = data[2] || []
- this.clones = data[3] || []
- this.devices = data[4] || []

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-12 08:52:44 +01:00
fdc7467630 feat(kiss): Add sub-tabs navigation and fix Streamlit reupload
KISS Theme:
- Add expandable sub-tabs under active sidebar items
- Apps with multiple views show nested tabs when active
- Support for CrowdSec, HAProxy, WireGuard, Ollama, Tor Shield,
  CDN Cache, InterceptoR, mitmproxy, Client Guardian

Cloner:
- Full KISS theme rewrite with stats grid, quick actions
- TFTP boot commands with copy button
- Progress tracking for image builds

Streamlit:
- Fix reupload not applying changes - auto-restart service after upload
- Show "Restarting..." spinner during service reload

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-12 07:36:36 +01:00
e58f479cd4 feat(waf): Update WAF scenarios with 2024-2025 CVEs and OWASP threats
Add detection patterns for latest actively exploited vulnerabilities:
- CVE-2025-55182 (React2Shell, CVSS 10.0)
- CVE-2025-8110 (Gogs RCE), CVE-2025-53770 (SharePoint)
- CVE-2025-52691 (SmarterMail), CVE-2025-40551 (SolarWinds)
- CVE-2024-47575 (FortiManager), CVE-2024-21887 (Ivanti)
- CVE-2024-3400, CVE-2024-0012, CVE-2024-9474 (PAN-OS)

New attack categories based on OWASP Top 10 2025:
- HTTP Request Smuggling (TE.CL/CL.TE conflicts)
- AI/LLM Prompt Injection (ChatML, instruction markers)
- WAF Bypass techniques (Unicode normalization, double encoding)
- Supply Chain attacks (CI/CD poisoning, dependency confusion)
- Extended SSTI (Jinja2, Freemarker, Velocity, Thymeleaf)
- API Abuse (BOLA/IDOR, mass assignment)

CrowdSec scenarios split into 11 separate files for reliability.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-12 05:02:57 +01:00
750f79db3c feat(cloner): Add multi-device image support
- Support building images for: mochabin, espressobin-v7, espressobin-ultra, x86-64
- New CLI: secubox-cloner build --device espressobin-v7
- New CLI: secubox-cloner devices (list supported devices)
- RPCD: list_devices method, build_image accepts device_type param
- LuCI: Device selection dropdown in build modal
- LuCI: Device column in images table with badges
- Each device type has its own TFTP image file

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-11 06:17:12 +01:00
06d9d08f86 feat(luci-app-cloner): Add cloning station LuCI dashboard
- Dashboard with status cards: device, TFTP, tokens, clones
- Quick actions: Build Image, Start/Stop TFTP, Token generation
- Clone images table with size and TFTP-ready status
- Token management with auto-approve option
- U-Boot flash commands display when TFTP is running
- RPCD handler with 10 methods for full cloner management

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-11 05:13:33 +01:00