Add new page or tab to the webUI

[Oracle]

What does it take to add an extra page / tab to the router web UI?
Like the Diversion tab on "LAN" or the dn-vnstat page on Addons (user1.asp and user2.asp).
Could anyone share a basic template?
E.g. add a page user3.asp that reads Hello world out of a file and hook it up somewhere?

I want to add a textbox that allows preview and editing of files in user-specified path.

 

[ColinTaylor]

Addons API

Third party firmware for Asus routers (newer codebase) - RMerl/asuswrt-merlin.ng

github.com

P.S. I suggest you remove the Entware prefix from your title as this is not an Entware question.

 

[Oracle]

Just what I was looking for.
Now, before I reinvent hot water, is there such an addon already - one that allows users to set cron or edit scripts on the web UI?
I can't be the first person to think of it.

 

[Viktor Jaep]

Just what I was looking for.
Now, before I reinvent hot water, is there such an addon already - one that allows users to set cron or edit scripts on the web UI?
I can't be the first person to think of it.

scMerlin lets you see cronjobs through the webUI, but doesn't allow you to edit them! Looking forward to seeing what you cook up!

 

[dave14305]

There is limited ability to write data to the router through the webui.

 

[Oracle]

Great.
I have a lousy page now which is hooked to Tools instead of Addons and I don't know how to move it.
And I can't see how to access the shell from the page.

 

[ColinTaylor]

And I can't see how to access the shell from the page.

I think these replies from RMerlin are still relevant (as alluded to by Dave).

Request: populate a user.asp with a terminal

As I understand it the Merlin firmware once upon a time contained a little command prompt located next to Tools - Other Settings. Wouldnt that be so nice to have again? with nearly 15 still open and empty user.asp's maybe someone would consider populating one of them with a command prompt so...

www.snbforums.com

Generate config file on router from WebUI page

I have been poking around if there would be anyway to generate a file on the router from input on a page appended into the WebUI. Eg. I would like to create functionality so a user can add/delete/modify QoS rules within the WebUI. Rules can be generated within a table and upon hitting submit a...

www.snbforums.com

 

[Oracle]

I think these replies from RMerlin are still relevant (as alluded to by Dave).
...

That hurt.
Feels like I crashed into a wall.
So it's not possible to read and write to a file from the webUI.
Well, except the settings file in /jffs/addons that can't even display a value with a space in it.

 

[Jack Yaz]

That hurt.
Feels like I crashed into a wall.
So it's not possible to read and write to a file from the webUI.
Well, except the settings file in /jffs/addons that can't even display a value with a space in it.

base64 encode to write to custom_settings with your data from the webui and then decode it in your script which picks up on a service-event call from the webui

 

[Oracle]

May I know what exactly is the security problem?
I've done pages on PHP before and I'm aware of the general injection risk but it doesn't mean there's no way to read and write files at all.
Of course, it's one thing if it's just a data file and another if it's executable script.

I guess I'm not happy working on scripts in a console with MS-DOS era interface. Feels like going back to the stone age.

Productivity-wise, it sucks.

 

[dave14305]

May I know what exactly is the security problem?

It’s an internet-facing device, prone to attacks. Asus likely chooses to minimize the attack surface of the httpd daemon. Edit on your preferred machine with Unix line-endings and scp it back to the router, using ssh keys instead of password prompts.

 

[RMerlin]

May I know what exactly is the security problem?

httpd in the firmware runs as root (since it needs to be able to manage the router settings), while your typical Apache/nginx server runs as a restricted user. A buffer overrun exploit on an Apache server would only run the code as the apache (or nobody) user, while on your router it would run as root.

 

[Oracle]

Interesting.
httpd has to run as root in order to allow configuring the router?
How so? Excuse me if I'm asking a very stupid question (I'm a rookie in this environment) but inquiring minds wanna know.
I've made solutions where the web interface is able to set params of the host OS and it doesn't run as root. That's through dedicated functions.
E.g., httpd has access to certain config files and the OS (root) can also read these config files and pick values, validate them and work accordingly.
So what is this configuration that the Asus webUI does which requires 'root'? You can start and stop services, you can change labels (names) and IP addresses and stuff like that without root.

 

[ColinTaylor]

Interesting.
httpd has to run as root in order to allow configuring the router?
How so? Excuse me if I'm asking a very stupid question (I'm a rookie in this environment) but inquiring minds wanna know.
I've made solutions where the web interface is able to set params of the host OS and it doesn't run as root. That's through dedicated functions.
E.g., httpd has access to certain config files and the OS (root) can also read these config files and pick values, validate them and work accordingly.
So what is this configuration that the Asus webUI does which requires 'root'? You can start and stop services, you can change labels (names) and IP addresses and stuff like that without root.

The router is not a Linux distro, it's a turnkey appliance. Almost everything on the router runs as root. It doesn't run as a traditional multi-user OS. It doesn't run a "real" httpd deamon (with all the associated security provisions) but a minimalist version called milli_httpd that's been modified by Asus. RMerlin has added the ability to customise a lot of the router's features but the underlying OS is the same.

 

[capncybo]

Interesting.
httpd has to run as root in order to allow configuring the router?
How so? Excuse me if I'm asking a very stupid question (I'm a rookie in this environment) but inquiring minds wanna know.
I've made solutions where the web interface is able to set params of the host OS and it doesn't run as root. That's through dedicated functions.
E.g., httpd has access to certain config files and the OS (root) can also read these config files and pick values, validate them and work accordingly.
So what is this configuration that the Asus webUI does which requires 'root'? You can start and stop services, you can change labels (names) and IP addresses and stuff like that without root.

On almost all linux devices, making a network change(s) is deemed administrative & requires elevated privileges.
Most ROUTING changes to a network are "in-fact" important & any improper configurations can certainly cause issues.

 

[SomeWhereOverTheRainBow]

The router is not a Linux distro, it's a turnkey appliance. Almost everything on the router runs as root. It doesn't run as a traditional multi-user OS. It doesn't run a "real" httpd deamon (with all the associated security provisions) but a minimalist version called milli_httpd that's been modified by Asus. RMerlin has added the ability to customise a lot of the router's features but the underlying OS is the same.

This statement definitely sums it up quite nicely. Thank you for that @ColinTaylor

 

[Oracle]

Understood.
Looks like any knowledge and skill I may have is to a large extent useless here.

I somehow had the expectation that a dual-core 1.8 GHz CPU and 512 MB RAM provide a lot of opportunity.
Especially given that I was running quite a bit of stuff with the Optware extensions and some custom code on a DD-WRT flashed 32 MB Asus router many years ago. Turns out I was wrong.

 

[L&LD]

Dual-core 1.8GHz CPUs and 512MB RAM are old news in 2017 and earlier. Today, they're just barely able to give enough performance for a full/symmetrical 1Gbps ISP connection with very simple scripts running.

What actual router do you have? What firmware is it running? There are some that need (almost all) that RAM just for themselves.

Even quad-core 1.8GHz models with 1GB of RAM are woefully underpowered today. If you want to use them past their routing/WiFi duties.

 

[L&LD]

Even the latest SoCs are pretty pathetic, with a whole 200MHz boost to CPU power.

News - Broadcom BCM49428 Quad-core ARM v8 compliant 64-bit processor for enterprise access point (AP) applications

BCM49428 Contact Sales Check Inventory Request Info Quad-core ARM v8 compliant 64-bit processor for enterprise access point (AP) applications Overview Specifications Documentation The BCM49428 is a high-performance quad-core ARM v8 compliant 64-bit processor that has been designed from the...

www.snbforums.com

To put this in perspective, this was effectively launched (at least a flavor of it) back in 2016.

Broadcom Announces Volume Production of Quad-core 64-bit 2GHz ARMv8 SoCs | Broadcom Inc.

 

[Oracle]

L&LD,
Decided to check what were you talking about - "quad-core 1.8GHz models with 1GB of RAM are woefully underpowered".
Well, I run an AC86U, considered it a beast when I ordered it. (Previous router in its place was TP-Link with 560 MHz CPU and 128 MB RAM.)
Not so impressed now and it seems like I already went too far with it. Swap is pretty efficient on a USB 3 SSD drive but that's a lot of it. The 2 CPU cores are also often maxed out. For some reason, reading / writing files to the SMB shared USB 3 drive just seems to hog the poor thing. Maybe I have to optimize the Samba somehow but that's for another topic.