From 516e820ab7886823e965bc2322f2bc51f37bbec5 Mon Sep 17 00:00:00 2001 From: "Sean E. Russell" Date: Thu, 11 Aug 2022 16:27:18 -0500 Subject: [PATCH 1/6] Adds ability to user-supplied private keys. --- cmd/cli/add.go | 8 ++++++-- cmd/root.go | 12 +++++++++--- lib/peer.go | 16 ++++++++++++---- 3 files changed, 27 insertions(+), 9 deletions(-) diff --git a/cmd/cli/add.go b/cmd/cli/add.go index d922844..55ad7a9 100644 --- a/cmd/cli/add.go +++ b/cmd/cli/add.go @@ -9,12 +9,16 @@ import ( ) // Add prompts for the required information and creates a new peer -func Add(hostname, owner, description string, confirm bool) { +func Add(hostname string, readKey bool, owner, description string, confirm bool) { // TODO accept existing pubkey config, err := LoadConfigFile() check(err, "failed to load configuration file") server := GetServer(config) + var key string + if readKey { + key = MustPromptString("private key", true) + } if owner == "" { owner = MustPromptString("owner", true) } @@ -30,7 +34,7 @@ func Add(hostname, owner, description string, confirm bool) { // newline (not on stdout) to separate config fmt.Fprintln(os.Stderr) - peer, err := lib.NewPeer(server, owner, hostname, description) + peer, err := lib.NewPeer(server, key, owner, hostname, description) check(err, "failed to get new peer") // TODO Some kind of recovery here would be nice, to avoid diff --git a/cmd/root.go b/cmd/root.go index 528d2ec..4fd4705 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -56,8 +56,8 @@ var ( } addCmd = &cobra.Command{ - Use: "add [hostname]", - Short: "Add a new peer + sync", + Use: "add ", + Short: "Add a new peer + sync, optionally using a provided WireGuard private key", PreRunE: func(cmd *cobra.Command, args []string) error { // Make sure we have the hostname if len(args) != 1 { @@ -66,7 +66,11 @@ var ( return nil }, Run: func(cmd *cobra.Command, args []string) { - cli.Add(args[0], owner, description, confirm) + userKey, err := cmd.PersistentFlags().GetBool("key") + if err != nil { + cli.ExitFail("%w - error processing key flag", err) + } + cli.Add(args[0], userKey, owner, description, confirm) }, } @@ -123,6 +127,7 @@ var ( Use: "version", Short: "Print version", } + ) func init() { @@ -131,6 +136,7 @@ func init() { addCmd.Flags().StringVar(&owner, "owner", "", "owner of the new peer") addCmd.Flags().StringVar(&description, "description", "", "description of the new peer") addCmd.Flags().BoolVar(&confirm, "confirm", false, "confirm") + addCmd.PersistentFlags().BoolP("key", "k", false, "User-supplied key on stdin") removeCmd.Flags().BoolVar(&confirm, "confirm", false, "confirm") // Environment variable handling. diff --git a/lib/peer.go b/lib/peer.go index f17a56c..f7710d0 100644 --- a/lib/peer.go +++ b/lib/peer.go @@ -37,7 +37,7 @@ type Peer struct { KeepAlive time.Duration } -func NewPeer(server *Server, owner string, hostname string, description string) (Peer, error) { +func NewPeer(server *Server, key, owner, hostname, description string) (Peer, error) { if owner == "" { return Peer{}, errors.New("missing owner") } @@ -45,9 +45,17 @@ func NewPeer(server *Server, owner string, hostname string, description string) return Peer{}, errors.New("missing hostname") } - privateKey, err := GenerateJSONPrivateKey() - if err != nil { - return Peer{}, fmt.Errorf("failed to generate private key: %s", err) + var privateKey JSONKey + if key != "" { + userKey := &JSONKey{} + userKey.UnmarshalJSON([]byte(key)) + privateKey = *userKey + } else { + var err error + privateKey, err = GenerateJSONPrivateKey() + if err != nil { + return Peer{}, fmt.Errorf("failed to generate private key: %s", err) + } } publicKey := privateKey.PublicKey() From e02790b24abc6cb02bfbdcca5ea2974b4520a8df Mon Sep 17 00:00:00 2001 From: "Sean E. Russell" Date: Fri, 12 Aug 2022 11:43:54 -0500 Subject: [PATCH 2/6] Remove spurious newline. --- cmd/root.go | 1 - 1 file changed, 1 deletion(-) diff --git a/cmd/root.go b/cmd/root.go index 4fd4705..ed9e6bf 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -127,7 +127,6 @@ var ( Use: "version", Short: "Print version", } - ) func init() { From 9cd98ff65451e7ada751b2341142f6e8f403ddff Mon Sep 17 00:00:00 2001 From: "Sean E. Russell" Date: Fri, 12 Aug 2022 14:09:36 -0500 Subject: [PATCH 3/6] Implements code comment to-do as well: allow user to provide public key. --- cmd/cli/add.go | 14 ++++++++------ cmd/root.go | 8 +++++--- lib/peer.go | 36 ++++++++++++++++++++++++++++++++---- 3 files changed, 45 insertions(+), 13 deletions(-) diff --git a/cmd/cli/add.go b/cmd/cli/add.go index 55ad7a9..cba5fa4 100644 --- a/cmd/cli/add.go +++ b/cmd/cli/add.go @@ -9,15 +9,17 @@ import ( ) // Add prompts for the required information and creates a new peer -func Add(hostname string, readKey bool, owner, description string, confirm bool) { - // TODO accept existing pubkey +func Add(hostname string, privKey, pubKey bool, owner, description string, confirm bool) { config, err := LoadConfigFile() check(err, "failed to load configuration file") server := GetServer(config) - var key string - if readKey { - key = MustPromptString("private key", true) + var private, public string + if privKey { + private = MustPromptString("private key", true) + } + if pubKey { + public = MustPromptString("public key", true) } if owner == "" { owner = MustPromptString("owner", true) @@ -34,7 +36,7 @@ func Add(hostname string, readKey bool, owner, description string, confirm bool) // newline (not on stdout) to separate config fmt.Fprintln(os.Stderr) - peer, err := lib.NewPeer(server, key, owner, hostname, description) + peer, err := lib.NewPeer(server, private, public, owner, hostname, description) check(err, "failed to get new peer") // TODO Some kind of recovery here would be nice, to avoid diff --git a/cmd/root.go b/cmd/root.go index ed9e6bf..126c9c3 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -66,11 +66,12 @@ var ( return nil }, Run: func(cmd *cobra.Command, args []string) { - userKey, err := cmd.PersistentFlags().GetBool("key") + privKey, err := cmd.PersistentFlags().GetBool("private-key") + pubKey, err := cmd.PersistentFlags().GetBool("public-key") if err != nil { cli.ExitFail("%w - error processing key flag", err) } - cli.Add(args[0], userKey, owner, description, confirm) + cli.Add(args[0], privKey, pubKey, owner, description, confirm) }, } @@ -135,7 +136,8 @@ func init() { addCmd.Flags().StringVar(&owner, "owner", "", "owner of the new peer") addCmd.Flags().StringVar(&description, "description", "", "description of the new peer") addCmd.Flags().BoolVar(&confirm, "confirm", false, "confirm") - addCmd.PersistentFlags().BoolP("key", "k", false, "User-supplied key on stdin") + addCmd.PersistentFlags().BoolP("private-key", "r", false, "Accept user-supplied private key. If supplied, dsnet will generate a public key.") + addCmd.PersistentFlags().BoolP("public-key", "u", false, "Accept user-supplied public key. If supplied, the user must add the private key to the generated config (or provide it with --private-key).") removeCmd.Flags().BoolVar(&confirm, "confirm", false, "confirm") // Environment variable handling. diff --git a/lib/peer.go b/lib/peer.go index f7710d0..9d324ea 100644 --- a/lib/peer.go +++ b/lib/peer.go @@ -4,7 +4,11 @@ import ( "errors" "fmt" "net" + "os" + "strings" "time" + + "golang.zx2c4.com/wireguard/wgctrl/wgtypes" ) // PeerType is what configuration to use when generating @@ -37,7 +41,15 @@ type Peer struct { KeepAlive time.Duration } -func NewPeer(server *Server, key, owner, hostname, description string) (Peer, error) { +// NewPeer generates a peer from the supplied arguments and generates keys if needed. +// - server is required and provides network information +// - private is a base64-encoded private key; if the empty string, a new key will be generated +// - public is a base64-encoded public key. If empty, it will be generated from the private key. +// If **not** empty, the private key will be included IFF a private key was provided. +// - owner is the owner name (required) +// - hostname is the name of the peer (required) +// - description is the annotation for the peer +func NewPeer(server *Server, private, public, owner, hostname, description string) (Peer, error) { if owner == "" { return Peer{}, errors.New("missing owner") } @@ -46,9 +58,9 @@ func NewPeer(server *Server, key, owner, hostname, description string) (Peer, er } var privateKey JSONKey - if key != "" { + if private != "" { userKey := &JSONKey{} - userKey.UnmarshalJSON([]byte(key)) + userKey.UnmarshalJSON([]byte(private)) privateKey = *userKey } else { var err error @@ -57,7 +69,21 @@ func NewPeer(server *Server, key, owner, hostname, description string) (Peer, er return Peer{}, fmt.Errorf("failed to generate private key: %s", err) } } - publicKey := privateKey.PublicKey() + + var publicKey JSONKey + if public != "" { + b64Key := strings.Trim(string(public), "\"") + key, err := wgtypes.ParseKey(b64Key) + if err != nil { + return Peer{}, err + } + publicKey = JSONKey { Key: key } + if private == "" { + privateKey = JSONKey { Key: wgtypes.Key([wgtypes.KeyLen]byte{}) } + } + } else { + publicKey = privateKey.PublicKey() + } presharedKey, err := GenerateJSONKey() if err != nil { @@ -74,6 +100,8 @@ func NewPeer(server *Server, key, owner, hostname, description string) (Peer, er PresharedKey: presharedKey, Networks: []JSONIPNet{}, } +fmt.Fprintf(os.Stderr, "peer public key => %s\n", newPeer.PublicKey) +fmt.Fprintf(os.Stderr, "peer Private key => %s\n", newPeer.PrivateKey) if len(server.Network.IPNet.Mask) > 0 { newIP, err := server.AllocateIP() From f0180df5e4ef64ea4235b3150767f6348ee9db98 Mon Sep 17 00:00:00 2001 From: "Sean E. Russell" Date: Fri, 12 Aug 2022 14:26:00 -0500 Subject: [PATCH 4/6] Adds key validation for user data --- lib/peer.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lib/peer.go b/lib/peer.go index 9d324ea..9311270 100644 --- a/lib/peer.go +++ b/lib/peer.go @@ -80,6 +80,12 @@ func NewPeer(server *Server, private, public, owner, hostname, description strin publicKey = JSONKey { Key: key } if private == "" { privateKey = JSONKey { Key: wgtypes.Key([wgtypes.KeyLen]byte{}) } + } else { + pubK := privateKey.PublicKey() + ascK := pubK.Key.String() + if ascK != public { + return Peer{}, fmt.Errorf("user-supplied private and public keys are not related") + } } } else { publicKey = privateKey.PublicKey() From ee0d0712283dfd00ec9851ce03c7fac184da1612 Mon Sep 17 00:00:00 2001 From: "Sean E. Russell" Date: Fri, 2 Sep 2022 09:18:30 -0500 Subject: [PATCH 5/6] Remove trace code --- lib/peer.go | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/lib/peer.go b/lib/peer.go index 9311270..dba5ecc 100644 --- a/lib/peer.go +++ b/lib/peer.go @@ -42,13 +42,13 @@ type Peer struct { } // NewPeer generates a peer from the supplied arguments and generates keys if needed. -// - server is required and provides network information -// - private is a base64-encoded private key; if the empty string, a new key will be generated -// - public is a base64-encoded public key. If empty, it will be generated from the private key. -// If **not** empty, the private key will be included IFF a private key was provided. -// - owner is the owner name (required) -// - hostname is the name of the peer (required) -// - description is the annotation for the peer +// - server is required and provides network information +// - private is a base64-encoded private key; if the empty string, a new key will be generated +// - public is a base64-encoded public key. If empty, it will be generated from the private key. +// If **not** empty, the private key will be included IFF a private key was provided. +// - owner is the owner name (required) +// - hostname is the name of the peer (required) +// - description is the annotation for the peer func NewPeer(server *Server, private, public, owner, hostname, description string) (Peer, error) { if owner == "" { return Peer{}, errors.New("missing owner") @@ -77,9 +77,9 @@ func NewPeer(server *Server, private, public, owner, hostname, description strin if err != nil { return Peer{}, err } - publicKey = JSONKey { Key: key } + publicKey = JSONKey{Key: key} if private == "" { - privateKey = JSONKey { Key: wgtypes.Key([wgtypes.KeyLen]byte{}) } + privateKey = JSONKey{Key: wgtypes.Key([wgtypes.KeyLen]byte{})} } else { pubK := privateKey.PublicKey() ascK := pubK.Key.String() @@ -106,8 +106,6 @@ func NewPeer(server *Server, private, public, owner, hostname, description strin PresharedKey: presharedKey, Networks: []JSONIPNet{}, } -fmt.Fprintf(os.Stderr, "peer public key => %s\n", newPeer.PublicKey) -fmt.Fprintf(os.Stderr, "peer Private key => %s\n", newPeer.PrivateKey) if len(server.Network.IPNet.Mask) > 0 { newIP, err := server.AllocateIP() From cfcea9e62415220864f15912f3eded60978973f7 Mon Sep 17 00:00:00 2001 From: "Sean E. Russell" Date: Fri, 4 Nov 2022 08:59:40 -0500 Subject: [PATCH 6/6] The merge keeps missing this, and I didn't catch it this time. --- lib/peer.go | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/peer.go b/lib/peer.go index 9522b6c..8935a1d 100644 --- a/lib/peer.go +++ b/lib/peer.go @@ -4,7 +4,6 @@ import ( "errors" "fmt" "net" - "os" "strings" "time"