wireguard: Implement optional PSK for post-quantum stuff

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/doc/language_issues.de b/doc/language_issues.de
index 72f926b64f6556ae1ab5b3e1fcd68bebe75db659..cc40436f47ec83f48132e16b448dc8871c34e0cb 100644 (file)
--- a/doc/language_issues.de
+++ b/doc/language_issues.de
@@ -1040,6 +1040,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_issues.en b/doc/language_issues.en
index 52e2b00f0d08760d4b030490f15bb3a3b0abf6ad..4f527dc2743b7a0e44bc35734368d48769478ae8 100644 (file)
--- a/doc/language_issues.en
+++ b/doc/language_issues.en
@@ -2147,6 +2147,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_issues.es b/doc/language_issues.es
index be5eca549d345847cc3252de1d08cc0bcfb44542..facbd5aa6df50414b64d366302e310d82e6306f3 100644 (file)
--- a/doc/language_issues.es
+++ b/doc/language_issues.es
@@ -1107,6 +1107,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_issues.fr b/doc/language_issues.fr
index 9559a95edc8d0831e1810ff7fd56af35b021a8e3..cb0bea9060f05791d71fdd8107e64bdf8186f965 100644 (file)
--- a/doc/language_issues.fr
+++ b/doc/language_issues.fr
@@ -1047,6 +1047,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_issues.it b/doc/language_issues.it
index b6a3d5bd548c4b989480b9bf7fe9bf0ef28bb6f3..40363f9b6296667c612a1420469d3590048523d0 100644 (file)
--- a/doc/language_issues.it
+++ b/doc/language_issues.it
@@ -1393,6 +1393,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_issues.nl b/doc/language_issues.nl
index b77ea2fef43a3fcd46ea0008355577c13c844c68..dc0f9b4c94ccfbb4df43c225a82e0d065b48a2f7 100644 (file)
--- a/doc/language_issues.nl
+++ b/doc/language_issues.nl
@@ -1414,6 +1414,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_issues.pl b/doc/language_issues.pl
index c8a289b6fd52c238a509c45be0931a3c775c0438..610d8e29cfce9f52ea170e1d0686dffa7de4ef66 100644 (file)
--- a/doc/language_issues.pl
+++ b/doc/language_issues.pl
@@ -1656,6 +1656,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_issues.ru b/doc/language_issues.ru
index 39e48fdfe2e72f4440558c4377efc00ceafdff97..61808edb47686530d8734b3f2eeec67b16b221e4 100644 (file)
--- a/doc/language_issues.ru
+++ b/doc/language_issues.ru
@@ -1649,6 +1649,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_issues.tr b/doc/language_issues.tr
index e05c2bee36089532728fe11b48427437e08d8fe7..45516c4ff6aaac6ed13dcb2574c06d210c30ed75 100644 (file)
--- a/doc/language_issues.tr
+++ b/doc/language_issues.tr
@@ -1276,6 +1276,7 @@ WARNING: untranslated string: wg invalid endpoint address = Invalid endpoint add
 WARNING: untranslated string: wg invalid endpoint port = Invalid endpoint port
 WARNING: untranslated string: wg invalid local subnet = Invalid local subnet
 WARNING: untranslated string: wg invalid name = Invalid name (Only letters, numbers, space and hyphen are allowed)
+WARNING: untranslated string: wg invalid psk = Invalid pre-shared key
 WARNING: untranslated string: wg invalid public key = Invalid public key
 WARNING: untranslated string: wg invalid remote subnet = Invalid remote subnet
 WARNING: untranslated string: wg name is already used = The name is already in use

diff --git a/doc/language_missings b/doc/language_missings
index 797b72348810a08a677ac0c94fb7a6c9c21c84b5..98e28608dcaa62a68b42313d9b2a7e7de07161eb 100644 (file)
--- a/doc/language_missings
+++ b/doc/language_missings
@@ -121,12 +121,14 @@
 < wg invalid endpoint port
 < wg invalid local subnet
 < wg invalid name
+< wg invalid psk
 < wg invalid public key
 < wg invalid remote subnet
 < wg name is already used
 < wg no local subnets
 < wg no remote subnets
 < wg peer does not exist
+< wg pre-shared key (optional)
 < winbind daemon
 < wireguard
 < wlanap 802.11w disabled
@@ -202,12 +204,14 @@
 < wg invalid endpoint port
 < wg invalid local subnet
 < wg invalid name
+< wg invalid psk
 < wg invalid public key
 < wg invalid remote subnet
 < wg name is already used
 < wg no local subnets
 < wg no remote subnets
 < wg peer does not exist
+< wg pre-shared key (optional)
 < whitelisted
 < wireguard
 < wlanap
@@ -261,12 +265,14 @@
 < wg invalid endpoint port
 < wg invalid local subnet
 < wg invalid name
+< wg invalid psk
 < wg invalid public key
 < wg invalid remote subnet
 < wg name is already used
 < wg no local subnets
 < wg no remote subnets
 < wg peer does not exist
+< wg pre-shared key (optional)
 < whitelisted
 < wireguard
 < wlanap hide ssid
@@ -774,12 +780,14 @@
 < wg invalid endpoint port
 < wg invalid local subnet
 < wg invalid name
+< wg invalid psk
 < wg invalid public key
 < wg invalid remote subnet
 < wg name is already used
 < wg no local subnets
 < wg no remote subnets
 < wg peer does not exist
+< wg pre-shared key (optional)
 < whitelisted
 < whois results from
 < winbind daemon
@@ -1363,12 +1371,14 @@
 < wg invalid endpoint port
 < wg invalid local subnet
 < wg invalid name
+< wg invalid psk
 < wg invalid public key
 < wg invalid remote subnet
 < wg name is already used
 < wg no local subnets
 < wg no remote subnets
 < wg peer does not exist
+< wg pre-shared key (optional)
 < whitelisted
 < whois results from
 < winbind daemon
@@ -2368,12 +2378,14 @@
 < wg invalid endpoint port
 < wg invalid local subnet
 < wg invalid name
+< wg invalid psk
 < wg invalid public key
 < wg invalid remote subnet
 < wg name is already used
 < wg no local subnets
 < wg no remote subnets
 < wg peer does not exist
+< wg pre-shared key (optional)
 < whitelisted
 < whois results from
 < winbind daemon
@@ -3410,12 +3422,14 @@
 < wg invalid endpoint port
 < wg invalid local subnet
 < wg invalid name
+< wg invalid psk
 < wg invalid public key
 < wg invalid remote subnet
 < wg name is already used
 < wg no local subnets
 < wg no remote subnets
 < wg peer does not exist
+< wg pre-shared key (optional)
 < whitelisted
 < whois results from
 < winbind daemon
@@ -3829,12 +3843,14 @@
 < wg invalid endpoint port
 < wg invalid local subnet
 < wg invalid name
+< wg invalid psk
 < wg invalid public key
 < wg invalid remote subnet
 < wg name is already used
 < wg no local subnets
 < wg no remote subnets
 < wg peer does not exist
+< wg pre-shared key (optional)
 < whitelisted
 < whois results from
 < winbind daemon

diff --git a/html/cgi-bin/wireguard.cgi b/html/cgi-bin/wireguard.cgi
index fb0fcd5ded47efaa47c2f09057c2d090eb265c14..bc53b778906e09f6079402d972b5c2e9c1d7ddf5 100644 (file)
--- a/html/cgi-bin/wireguard.cgi
+++ b/html/cgi-bin/wireguard.cgi
@@ -129,6 +129,7 @@ if ($cgiparams{"ACTION"} eq $Lang::tr{'save'}) {
                "REMOTE_SUBNETS"        => $peers{$key}[6],
                "REMARKS"                       => &decode_base64($peers{$key}[7]),
                "LOCAL_SUBNETS"         => $peers{$key}[8],
+               "PSK"                           => $peers{$key}[9],
        );
 
        # Jump to the editor
@@ -158,6 +159,11 @@ if ($cgiparams{"ACTION"} eq $Lang::tr{'save'}) {
                push(@errormessages, $Lang::tr{'wg invalid public key'});
        }
 
+       # Check PSK
+       if (defined $cgiparams{'PSK'} && !&publickey_is_valid($cgiparams{'PSK'})) {
+               push(@errormessages, $Lang::tr{'wg invalid psk'});
+       }
+
        # Check the endpoint address
        unless (&Network::check_ip_address($cgiparams{'ENDPOINT_ADDRESS'})) {
                push(@errormessages, $Lang::tr{'wg invalid endpoint address'});
@@ -217,6 +223,8 @@ if ($cgiparams{"ACTION"} eq $Lang::tr{'save'}) {
                &encode_remarks($cgiparams{"REMARKS"}),
                # 8 = Local Subnets
                join("|", @local_subnets),
+               # 9 = PSK
+               $cgiparams{"PSK"} || "",
        ];
 
        # Store the configuration
@@ -579,6 +587,14 @@ EDITOR:
                                                        min="1" max="65535" placeholder="${DEFAULT_PORT}"/>
                                        </td>
                                </tr>
+
+                               <tr>
+                                       <td>$Lang::tr{'wg pre-shared key (optional)'}</td>
+                                       <td>
+                                               <input type="text" name="PSK"
+                                                       value="$cgiparams{'PSK'}" />
+                                       </td>
+                               </tr>
                        </table>
 
                        <h6>$Lang::tr{'routing'}</h6>

diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 35fe20c10fe94b4737d6a7b36d3805413171bdf7..ff735f215b604f9b110c21acbfc67f36089d6ed5 100644 (file)
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -3044,12 +3044,14 @@
 'wg invalid endpoint port' => 'Invalid endpoint port',
 'wg invalid local subnet' => 'Invalid local subnet',
 'wg invalid name' => 'Invalid name (Only letters, numbers, space and hyphen are allowed)',
+'wg invalid psk' => 'Invalid pre-shared key',
 'wg invalid public key' => 'Invalid public key',
 'wg invalid remote subnet' => 'Invalid remote subnet',
 'wg name is already used' => 'The name is already in use',
 'wg no local subnets' => 'No local subnets given',
 'wg no remote subnets' => 'No remote subnets given',
 'wg peer does not exist' => 'Peer does not exist',
+'wg pre-shared key (optional)' => 'Pre-Shared Key (optional)',
 'whitelisted' => 'Whitelisted',
 'whois results from' => 'WHOIS results from',
 'wildcards' => 'Wildcards',

diff --git a/src/initscripts/system/wireguard b/src/initscripts/system/wireguard
index 2ad6b9fe26e28ec82b08814ee57b4b521bf924bc..6c44b770d7355e20f9222eb1cd532a29c7bde2d1 100644 (file)
--- a/src/initscripts/system/wireguard
+++ b/src/initscripts/system/wireguard
@@ -45,6 +45,9 @@ generate_config() {
        local endpoint
        local port
        local routes
+       local remarks
+       local local_subnets
+       local psk
        local _rest
 
        local route
@@ -52,13 +55,19 @@ generate_config() {
        # Flush all previously set routes
        ip route flush dev "${INTF}"
 
-       while read -r id enabled type name pubkey endpoint port routes _rest; do
+       while read -r id enabled type name pubkey endpoint port routes \
+                       remarks local_subnets psk _rest; do
                # Skip peers that are not enabled
                [ "${enabled}" = "on" ] || continue
 
                echo "[Peer]"
                echo "PublicKey = ${pubkey}"
 
+               # Set PSK (if set)
+               if [ -n "${psk}" ]; then
+                       echo "PresharedKey= ${psk}"
+               fi
+
                # Set endpoint
                if [ -n "${endpoint}" ]; then
                        echo "Endpoint = ${endpoint}${port:+:}${port}"