v46.1-ui-mt76: Argon theme + hardened WG tunnel + Link Health dashboard

基于 v46 正式版(mt76)只恢复 UI 层: - luci-theme-argon 2.4.3: local-background-wins 登录页 + bg1.jpg fallback - luci-app-argon-config: 去 ui.changes.apply, ACL mutator 移 write - luci-app-wgtunnel: rpcd ucode 后端(get/status/prepare/apply/rollback/reconnect), JSONMap 前端, 60s 一次性 token, 快照回滚, 无全局 network ACL - luci-app-tr3000-status: 只读 rpcd ucode + 5s 轮询仪表盘 - tools/: audit_ui_packages.py + install_preview.sh + rollback_watchdog.sh - docs/: 开发经历与翻车记录 + 固件哈希记录固件本体(含烤入 WG 私钥/PSK)不入 git, 仅 K 盘保存. kernel 成员与 v46 byte-identical; 尚未刷机.
2026-08-19 15:04:02 +08:00
parent c6c90c1db8
commit 29cf67154a
92 changed files with 16036 additions and 0 deletions
@@ -0,0 +1,98 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-3.0-only
+
+. /lib/functions.sh
+. /usr/share/libubox/jshn.sh
+
+readonly bg_path="/www/luci-static/argon/background"
+readonly tmp_path="/tmp/argon_background.tmp"
+readonly max_size=5242880
+readonly builtin_bg="bg1.jpg"
+
+valid_name() {
+	local name="$1" ext
+	[ -n "$name" ] || return 1
+	[ "$name" = "${name##*/}" ] || return 1
+	[ "$name" = "${name##*\\}" ] || return 1
+	[ "$name" = "${name#.*}" ] || return 1
+	case "$name" in *..*|*[!A-Za-z0-9_.-]*) return 1 ;; esac
+	ext="${name##*.}"
+	[ "$ext" != "$name" ] || return 1
+	case "$(echo "$ext" | tr 'A-Z' 'a-z')" in jpg|jpeg|png|gif|webp|mp4|webm|ogg) return 0 ;; esac
+	return 1
+}
+
+json_result() {
+	json_init
+	json_add_int "result" "$1"
+	json_dump
+	json_cleanup
+}
+
+case "$1" in
+"list")
+	json_init
+	json_add_object "remove"
+		json_add_string "filename" "filename"
+	json_close_object
+	json_add_object "rename"
+		json_add_string "newname" "filename"
+	json_close_object
+	json_dump
+	json_cleanup
+	;;
+"call")
+	case "$2" in
+	"remove")
+		read -r input
+		json_load "$input"
+		json_get_var filename "filename"
+		json_cleanup
+
+		if ! valid_name "$filename" || [ "$filename" = "$builtin_bg" ] || [ -L "$bg_path/$filename" ]; then
+			json_result 255
+			exit 255
+		fi
+
+		rm -f -- "$bg_path/$filename"
+		json_result 0
+		;;
+	"rename")
+		read -r input
+		json_load "$input"
+		json_get_var newname "newname"
+		json_cleanup
+
+		if ! valid_name "$newname" || [ "$newname" = "$builtin_bg" ] || [ -L "$tmp_path" ] || [ ! -f "$tmp_path" ]; then
+			json_result 255
+			exit 255
+		fi
+
+		size="$(wc -c < "$tmp_path" 2>/dev/null)" || size=0
+		case "$size" in *[!0-9]*|'') size=0 ;; esac
+		if [ "$size" -le 0 ] || [ "$size" -gt "$max_size" ]; then
+			rm -f -- "$tmp_path"
+			json_result 254
+			exit 254
+		fi
+
+		mkdir -p -- "$bg_path"
+		target="$bg_path/$newname"
+		if [ -e "$target" ] || [ -L "$target" ]; then
+			json_result 253
+			exit 253
+		fi
+		if (set -C; umask 022; cat "$tmp_path" > "$target") 2>/dev/null; then
+			if chmod 0644 "$target" && rm -f -- "$tmp_path"; then
+				json_result 0
+			else
+				rm -f -- "$target"
+				json_result 1
+			fi
+		else
+			json_result 1
+		fi
+		;;
+	esac
+	;;
+esac
@@ -0,0 +1,14 @@
+{
+	"admin/system/argon-config": {
+		"title": "Argon Config",
+		"order": 90,
+		"action": {
+			"type": "view",
+			"path": "argon-config"
+		},
+		"depends": {
+			"acl": [ "luci-app-argon-config" ],
+			"uci": { "argon": true }
+		}
+	}
+}
@@ -0,0 +1,23 @@
+{
+	"luci-app-argon-config": {
+		"description": "Grant UCI access for luci-app-argon-config",
+		"read": {
+			"file": {
+				"/www/luci-static/argon/background/*": [ "list" ]
+			},
+			"ubus": {
+				"system": [ "info" ]
+			},
+			"uci": [ "argon" ]
+		},
+		"write": {
+			"file": {
+				"/tmp/argon_background.tmp": [ "write" ]
+			},
+			"ubus": {
+				"luci.argon": [ "remove", "rename" ]
+			},
+			"uci": [ "argon" ]
+		}
+	}
+}