fix: repair recon scanning and add macOS deployment
Start scans via the Pager's native /api/pineap/recon/new so history appends instead of rotating. Enforce finite durations (1-86400s, default 30s), remove the unsupported Continuous mode, and refuse the unsafe manual stop that left recon.db locked. Rework scan list and detail reads into single-pass aggregate SQL, shorten lock retries, and serve cached results during short exclusive lock windows. Fall back to immutable read-only access when the firmware leaves a stale lock after native completion. Frontend auto-follows new scans, queues a single in-flight detail refresh, keeps previous tables visible while a scan starts, and shows completion toasts and daemon error details. Add scripts/deploy.sh for macOS/Linux (zip packaging, scp/ssh install, atomic payload replacement, service restart, portal refresh) with README instructions, plus regression coverage for native start, safe stop semantics, aggregate queries, and stale-lock fallback. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
This commit is contained in:
co-authored by
factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
parent
3e1805dab8
commit
2bf39ecb9d
Executable
+186
@@ -0,0 +1,186 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
PAGER_HOST="172.16.52.1"
|
||||
PAGER_USER="root"
|
||||
PASSWORD=""
|
||||
SSH_KEY=""
|
||||
BUILD_DIR=""
|
||||
PORTAL_REFRESH=true
|
||||
|
||||
usage() {
|
||||
cat <<'EOF'
|
||||
Usage: scripts/deploy.sh [options]
|
||||
|
||||
Options:
|
||||
--host HOST Pager address (default: 172.16.52.1)
|
||||
--user USER SSH user (default: root)
|
||||
--password PASSWORD SSH/device password (requires sshpass)
|
||||
--ssh-key PATH SSH private key
|
||||
--build-dir PATH Build output directory (default: <repo>/build)
|
||||
--no-portal-refresh Skip the best-effort portal refresh
|
||||
-h, --help Show this help
|
||||
|
||||
If neither --password nor --ssh-key is supplied, ssh/scp prompt normally.
|
||||
EOF
|
||||
}
|
||||
|
||||
while (($#)); do
|
||||
case "$1" in
|
||||
--host) PAGER_HOST="${2:?missing value for --host}"; shift 2 ;;
|
||||
--user) PAGER_USER="${2:?missing value for --user}"; shift 2 ;;
|
||||
--password) PASSWORD="${2:?missing value for --password}"; shift 2 ;;
|
||||
--ssh-key) SSH_KEY="${2:?missing value for --ssh-key}"; shift 2 ;;
|
||||
--build-dir) BUILD_DIR="${2:?missing value for --build-dir}"; shift 2 ;;
|
||||
--no-portal-refresh) PORTAL_REFRESH=false; shift ;;
|
||||
-h|--help) usage; exit 0 ;;
|
||||
*) printf 'Unknown option: %s\n' "$1" >&2; usage >&2; exit 2 ;;
|
||||
esac
|
||||
done
|
||||
|
||||
for command in python3 zip scp ssh; do
|
||||
command -v "$command" >/dev/null || {
|
||||
printf 'Required command not found: %s\n' "$command" >&2
|
||||
exit 1
|
||||
}
|
||||
done
|
||||
if [[ -n "$PASSWORD" ]] && ! command -v sshpass >/dev/null; then
|
||||
printf 'Password deployment requires sshpass (brew install hudochenkov/sshpass/sshpass).\n' >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
PAYLOAD_KEY="pager-webui"
|
||||
PAYLOAD_CATEGORY="remote_access"
|
||||
PAYLOAD_DIR="$ROOT/payload/user/$PAYLOAD_CATEGORY/$PAYLOAD_KEY"
|
||||
BUILD_DIR="${BUILD_DIR:-$ROOT/build}"
|
||||
OUT_DIR="$BUILD_DIR/$PAYLOAD_KEY"
|
||||
STAGE="$OUT_DIR/stage"
|
||||
|
||||
[[ -d "$PAYLOAD_DIR" ]] || {
|
||||
printf 'Payload directory not found: %s\n' "$PAYLOAD_DIR" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
mkdir -p "$OUT_DIR"
|
||||
rm -rf "$STAGE"
|
||||
mkdir -p "$STAGE/user/$PAYLOAD_CATEGORY"
|
||||
cp -R "$PAYLOAD_DIR" "$STAGE/user/$PAYLOAD_CATEGORY/$PAYLOAD_KEY"
|
||||
find "$STAGE" \( -type d -name __pycache__ -o -type f -name '*.pyc' \) -prune -exec rm -rf {} +
|
||||
|
||||
B64_KEY="$(python3 -c 'import base64; print(base64.urlsafe_b64encode(b"pager-webui").decode().rstrip("="))')"
|
||||
ZIP_NAME="payload-$B64_KEY.zip"
|
||||
ZIP_PATH="$OUT_DIR/$ZIP_NAME"
|
||||
MANIFEST_PATH="$OUT_DIR/_hak5_manifest.json"
|
||||
rm -f "$ZIP_PATH"
|
||||
(
|
||||
cd "$STAGE"
|
||||
zip -q -r "$ZIP_PATH" user
|
||||
)
|
||||
|
||||
HASH="$(python3 -c 'import hashlib, sys; print(hashlib.sha256(open(sys.argv[1], "rb").read()).hexdigest())' "$ZIP_PATH")"
|
||||
python3 - "$PAYLOAD_DIR/_hak5_manifest.json" "$MANIFEST_PATH" "$HASH" "$ZIP_NAME" <<'PY'
|
||||
import json
|
||||
import sys
|
||||
import time
|
||||
|
||||
source, destination, digest, zip_name = sys.argv[1:]
|
||||
with open(source, encoding='utf-8') as handle:
|
||||
manifest = json.load(handle)
|
||||
manifest['time'] = int(time.time())
|
||||
manifest['last_hash'] = digest
|
||||
manifest['zip'] = zip_name
|
||||
with open(destination, 'w', encoding='ascii') as handle:
|
||||
json.dump(manifest, handle, indent=2)
|
||||
handle.write('\n')
|
||||
PY
|
||||
printf 'Built: %s\n' "$ZIP_PATH"
|
||||
|
||||
TARGET="$PAGER_USER@$PAGER_HOST"
|
||||
|
||||
run_scp() {
|
||||
if [[ -n "$PASSWORD" && -n "$SSH_KEY" ]]; then
|
||||
SSHPASS="$PASSWORD" sshpass -e scp -i "$SSH_KEY" "$@"
|
||||
elif [[ -n "$PASSWORD" ]]; then
|
||||
SSHPASS="$PASSWORD" sshpass -e scp "$@"
|
||||
elif [[ -n "$SSH_KEY" ]]; then
|
||||
scp -i "$SSH_KEY" "$@"
|
||||
else
|
||||
scp "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
run_ssh() {
|
||||
if [[ -n "$PASSWORD" && -n "$SSH_KEY" ]]; then
|
||||
SSHPASS="$PASSWORD" sshpass -e ssh -i "$SSH_KEY" "$@"
|
||||
elif [[ -n "$PASSWORD" ]]; then
|
||||
SSHPASS="$PASSWORD" sshpass -e ssh "$@"
|
||||
elif [[ -n "$SSH_KEY" ]]; then
|
||||
ssh -i "$SSH_KEY" "$@"
|
||||
else
|
||||
ssh "$@"
|
||||
fi
|
||||
}
|
||||
|
||||
run_scp "$ZIP_PATH" "$MANIFEST_PATH" "$TARGET:/tmp/"
|
||||
|
||||
REMOTE_PAYLOAD_DIR="user/$PAYLOAD_CATEGORY/$PAYLOAD_KEY"
|
||||
LEGACY_PAYLOAD_DIR="user/general/$PAYLOAD_KEY"
|
||||
REMOTE_COMMAND="set -e
|
||||
cd /root/payloads
|
||||
stage='.pager-webui.deploy.\$\$'
|
||||
backup='.pager-webui.backup.\$\$'
|
||||
trap 'rm -rf \"\$stage\" \"\$backup\"' EXIT
|
||||
mkdir -p \"\$stage\"
|
||||
cd \"\$stage\"
|
||||
unzip -q '/tmp/$ZIP_NAME'
|
||||
new=\"\$PWD/$REMOTE_PAYLOAD_DIR\"
|
||||
[ -f \"\$new/server.py\" ] && [ -f \"\$new/payload.sh\" ] && [ -d \"\$new/www\" ]
|
||||
cp /tmp/_hak5_manifest.json \"\$new/_hak5_manifest.json\"
|
||||
chmod +x \"\$new/payload.sh\" \"\$new/pagerwebui.init\"
|
||||
chmod -R 755 \"\$new/www\"
|
||||
cd /root/payloads
|
||||
if [ -d '$REMOTE_PAYLOAD_DIR' ]; then
|
||||
mkdir -p \"\$(dirname \"\$backup\")\"
|
||||
mv '$REMOTE_PAYLOAD_DIR' \"\$backup\"
|
||||
fi
|
||||
if mv \"\$new\" '$REMOTE_PAYLOAD_DIR'; then
|
||||
rm -rf \"\$backup\" '$LEGACY_PAYLOAD_DIR'
|
||||
else
|
||||
[ ! -d \"\$backup\" ] || mv \"\$backup\" '$REMOTE_PAYLOAD_DIR'
|
||||
exit 1
|
||||
fi
|
||||
rm -f '/tmp/$ZIP_NAME' /tmp/_hak5_manifest.json
|
||||
if [ -x /etc/init.d/pagerwebui ] && /etc/init.d/pagerwebui running >/dev/null 2>&1; then
|
||||
/etc/init.d/pagerwebui restart
|
||||
fi
|
||||
echo EXTRACT_OK"
|
||||
run_ssh "$TARGET" "$REMOTE_COMMAND"
|
||||
printf 'Installed to /root/payloads/%s/\n' "$REMOTE_PAYLOAD_DIR"
|
||||
|
||||
if $PORTAL_REFRESH && [[ -n "$PASSWORD" ]]; then
|
||||
PASSWORD_B64="$(printf '%s' "$PASSWORD" | base64)"
|
||||
PORTAL_OK=false
|
||||
for attempt in 1 2 3; do
|
||||
if printf '%s\n' "$PASSWORD_B64" | run_ssh "$TARGET" 'read -r password_b64
|
||||
password=$(printf "%s" "$password_b64" | base64 -d)
|
||||
login_body=$(printf "%s" "$password" | python3 -c '"'"'import json, sys; print(json.dumps({"username": "root", "password": sys.stdin.read()}))'"'"')
|
||||
token=$(curl -sS -X POST http://127.0.0.1:1471/api/login -H "Content-Type: application/json" -d "$login_body" |
|
||||
python3 -c '"'"'import json, sys; print(json.load(sys.stdin).get("token", ""))'"'"')
|
||||
[ -n "$token" ] &&
|
||||
curl -fsS -X POST http://127.0.0.1:1471/api/payloads/portal/refresh -H "Authorization: Bearer $token" >/dev/null'; then
|
||||
PORTAL_OK=true
|
||||
break
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
if $PORTAL_OK; then
|
||||
printf 'Portal refreshed.\n'
|
||||
else
|
||||
printf 'Warning: portal refresh failed; payload installation is complete.\n' >&2
|
||||
fi
|
||||
elif $PORTAL_REFRESH; then
|
||||
printf 'Skipping portal refresh without --password; payload installation is complete.\n'
|
||||
fi
|
||||
|
||||
printf 'Deploy complete. Browse http://%s:8080/\n' "$PAGER_HOST"
|
||||
Reference in New Issue
Block a user