From c3f4f3a8e91072f3a3b05c84de84eb9053e88507 Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Tue, 22 Feb 2022 15:06:56 +0000 Subject: [PATCH 01/15] add fields to form --- templates/base.html | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/templates/base.html b/templates/base.html index b3c254cd..f8f4b2e5 100644 --- a/templates/base.html +++ b/templates/base.html @@ -185,6 +185,23 @@

New Wireguard Client

+
+ Optional Keys +
+ + +
+
+ + +
+
From b4eedfbbcdd45d1566eed6c00b2918c21018f99f Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Tue, 22 Feb 2022 15:10:03 +0000 Subject: [PATCH 02/15] fix placement typo --- templates/base.html | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/templates/base.html b/templates/base.html index f8f4b2e5..3fabbe3b 100644 --- a/templates/base.html +++ b/templates/base.html @@ -184,24 +184,24 @@

New Wireguard Client

+
+ Optional Keys +
+ + +
+
+ + +
+
-
- Optional Keys -
- - -
-
- - -
-
From 0caa8d6e325faff9e44f4e05752b329bc78fc861 Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Tue, 22 Feb 2022 15:13:29 +0000 Subject: [PATCH 03/15] no details dropdown --- templates/base.html | 31 ++++++++++++++----------------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/templates/base.html b/templates/base.html index 3fabbe3b..36e26ebf 100644 --- a/templates/base.html +++ b/templates/base.html @@ -184,23 +184,20 @@

New Wireguard Client

-
- Optional Keys -
- - -
-
- - -
-
+
+ + +
+
+ + +
From 24d8a4044b8262bd7cc850d674e806242622ca8d Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Tue, 22 Feb 2022 16:14:11 +0000 Subject: [PATCH 04/15] add validation layer for public key --- handler/routes.go | 20 ++++++++++++++------ templates/base.html | 5 ++++- 2 files changed, 18 insertions(+), 7 deletions(-) diff --git a/handler/routes.go b/handler/routes.go index 9c18fc40..9c2720ef 100644 --- a/handler/routes.go +++ b/handler/routes.go @@ -171,10 +171,20 @@ func NewClient(db store.IStore) echo.HandlerFunc { client.ID = guid.String() // gen Wireguard key pair - key, err := wgtypes.GeneratePrivateKey() - if err != nil { - log.Error("Cannot generate wireguard key pair: ", err) - return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot generate Wireguard key pair"}) + if client.PublicKey == "" { + key, err := wgtypes.GeneratePrivateKey() + if err != nil { + log.Error("Cannot generate wireguard key pair: ", err) + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot generate Wireguard key pair"}) + } + client.PrivateKey = key.String() + client.PublicKey = key.PublicKey().String() + } else { + _, err := wgtypes.ParseKey(client.PublicKey) + if err != nil { + log.Error("Cannot verify wireguard public key: ", err) + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot verify Wireguard public key"}) + } } presharedKey, err := wgtypes.GenerateKey() @@ -185,8 +195,6 @@ func NewClient(db store.IStore) echo.HandlerFunc { }) } - client.PrivateKey = key.String() - client.PublicKey = key.PublicKey().String() client.PresharedKey = presharedKey.String() client.CreatedAt = time.Now().UTC() client.UpdatedAt = client.CreatedAt diff --git a/templates/base.html b/templates/base.html index 36e26ebf..c6380e2a 100644 --- a/templates/base.html +++ b/templates/base.html @@ -328,9 +328,12 @@

{{template "page_title" .}}

if ($("#enabled").is(':checked')){ enabled = true; } + const public_key = $("#client_public_key").val(); + const preshared_key = $("#client_preshared_key").val(); const data = {"name": name, "email": email, "allocated_ips": allocated_ips, "allowed_ips": allowed_ips, - "extra_allowed_ips": extra_allowed_ips, "use_server_dns": use_server_dns, "enabled": enabled}; + "extra_allowed_ips": extra_allowed_ips, "use_server_dns": use_server_dns, "enabled": enabled, + "public_key": public_key, "preshared_key": preshared_key}; $.ajax({ cache: false, From 98edcd0d04494a07987ec9423feec61af712587e Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Tue, 22 Feb 2022 17:14:48 +0000 Subject: [PATCH 05/15] add preshared key validator --- handler/routes.go | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/handler/routes.go b/handler/routes.go index 9c2720ef..9a6b39ee 100644 --- a/handler/routes.go +++ b/handler/routes.go @@ -187,15 +187,22 @@ func NewClient(db store.IStore) echo.HandlerFunc { } } - presharedKey, err := wgtypes.GenerateKey() - if err != nil { - log.Error("Cannot generated preshared key: ", err) - return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{ - false, "Cannot generate Wireguard preshared key", - }) + if client.PresharedKey == "" { + presharedKey, err := wgtypes.GenerateKey() + if err != nil { + log.Error("Cannot generated preshared key: ", err) + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{ + false, "Cannot generate Wireguard preshared key", + }) + } + client.PresharedKey = presharedKey.String() + } else { + _, err := wgtypes.ParseKey(client.PresharedKey) + if err != nil { + log.Error("Cannot verify wireguard preshared key: ", err) + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot verify Wireguard preshared key"}) + } } - - client.PresharedKey = presharedKey.String() client.CreatedAt = time.Now().UTC() client.UpdatedAt = client.CreatedAt From 943b2c1090d7e83ff11a19a2ab906b935d96a600 Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Tue, 22 Feb 2022 17:23:31 +0000 Subject: [PATCH 06/15] reset keys field --- templates/base.html | 2 ++ 1 file changed, 2 insertions(+) diff --git a/templates/base.html b/templates/base.html index c6380e2a..5d0d0a61 100644 --- a/templates/base.html +++ b/templates/base.html @@ -451,6 +451,8 @@

{{template "page_title" .}}

$("#modal_new_client").on('shown.bs.modal', function (e) { $("#client_name").val(""); $("#client_email").val(""); + $("#client_public_key").val(""); + $("#client_preshared_key").val(""); $("#client_allocated_ips").importTags(''); $("#client_extra_allowed_ips").importTags(''); updateIPAllocationSuggestion(); From e2b4997e87b4bea60282bc4d4271bcda1789e4b4 Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Tue, 22 Feb 2022 17:47:28 +0000 Subject: [PATCH 07/15] visualize security --- custom/js/helper.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/custom/js/helper.js b/custom/js/helper.js index 6fe8847e..3a48eeb8 100644 --- a/custom/js/helper.js +++ b/custom/js/helper.js @@ -67,6 +67,8 @@ function renderClientList(data) { + allocatedIpsHtml + `Allowed IPs` + allowedIpsHtml + + ` + ${obj.Client.private_key ? 'Private Key stored (insecure)' : 'No Private key'}` +`
` From 465a8c0b6546b36c0164d59108e53a108e1ae824 Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Tue, 22 Feb 2022 18:36:33 +0000 Subject: [PATCH 08/15] Revert "visualize security" This reverts commit e2b4997e87b4bea60282bc4d4271bcda1789e4b4. --- custom/js/helper.js | 2 -- 1 file changed, 2 deletions(-) diff --git a/custom/js/helper.js b/custom/js/helper.js index 3a48eeb8..6fe8847e 100644 --- a/custom/js/helper.js +++ b/custom/js/helper.js @@ -67,8 +67,6 @@ function renderClientList(data) { + allocatedIpsHtml + `Allowed IPs` + allowedIpsHtml - + ` - ${obj.Client.private_key ? 'Private Key stored (insecure)' : 'No Private key'}` +` ` From 6e252c7a1d0c0b0394543ddbdac6d0b703684e16 Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Wed, 23 Feb 2022 00:10:12 +0300 Subject: [PATCH 09/15] Update base.html --- templates/base.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/templates/base.html b/templates/base.html index 5d0d0a61..20ccf804 100644 --- a/templates/base.html +++ b/templates/base.html @@ -192,7 +192,7 @@

New Wireguard Client

name="client_public_key" placeholder="Autogenerated">
- + name="client_public_key" placeholder="Autogenerated (insecure)">
-
- - -
-
- - -
+
+ Public and Preshared Keys +
+ + +
+
+ + +
+
From ec6f0b7506ed7e5e02678afa0c0fe3bf9722398b Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Sun, 13 Mar 2022 13:12:13 +0000 Subject: [PATCH 13/15] add handling of missing QR --- handler/routes.go | 17 ++++++++++++----- store/jsondb/jsondb.go | 4 ++-- templates/clients.html | 2 +- 3 files changed, 15 insertions(+), 8 deletions(-) diff --git a/handler/routes.go b/handler/routes.go index 603e5eea..da7ecd2f 100644 --- a/handler/routes.go +++ b/handler/routes.go @@ -255,18 +255,25 @@ func EmailClient(db store.IStore, mailer emailer.Emailer, emailSubject, emailCon config := util.BuildClientConfig(*clientData.Client, server, globalSettings) cfg_att := emailer.Attachment{"wg0.conf", []byte(config)} - qrdata, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(clientData.QRCode, "data:image/png;base64,")) - if err != nil { - return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "decoding: " + err.Error()}) + var attachments []emailer.Attachment + if clientData.Client.PrivateKey != "" { + qrdata, err := base64.StdEncoding.DecodeString(strings.TrimPrefix(clientData.QRCode, "data:image/png;base64,")) + if err != nil { + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "decoding: " + err.Error()}) + } + qr_att := emailer.Attachment{"wg.png", qrdata} + attachments = []emailer.Attachment{cfg_att, qr_att} + } else { + attachments = []emailer.Attachment{cfg_att} } - qr_att := emailer.Attachment{"wg.png", qrdata} err = mailer.Send( clientData.Client.Name, payload.Email, emailSubject, emailContent, - []emailer.Attachment{cfg_att, qr_att}, + attachments, ) + if err != nil { return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, err.Error()}) } diff --git a/store/jsondb/jsondb.go b/store/jsondb/jsondb.go index 763756ef..4ee35cac 100644 --- a/store/jsondb/jsondb.go +++ b/store/jsondb/jsondb.go @@ -155,7 +155,7 @@ func (o *JsonDB) GetClients(hasQRCode bool) ([]model.ClientData, error) { } // generate client qrcode image in base64 - if hasQRCode { + if hasQRCode && client.PrivateKey != "" { server, _ := o.GetServer() globalSettings, _ := o.GetGlobalSettings() @@ -185,7 +185,7 @@ func (o *JsonDB) GetClientByID(clientID string, hasQRCode bool) (model.ClientDat } // generate client qrcode image in base64 - if hasQRCode { + if hasQRCode && client.PrivateKey != "" { server, _ := o.GetServer() globalSettings, _ := o.GetGlobalSettings() diff --git a/templates/clients.html b/templates/clients.html index 16d2057a..5d52dd78 100644 --- a/templates/clients.html +++ b/templates/clients.html @@ -68,7 +68,7 @@

QR Code

- QR code + QR code not available From 0c91c3bf8a241e30d232234e794e750235f9adbd Mon Sep 17 00:00:00 2001 From: Maxim Kochurov Date: Sun, 13 Mar 2022 13:51:50 +0000 Subject: [PATCH 14/15] use button disable --- custom/js/helper.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/custom/js/helper.js b/custom/js/helper.js index 6fe8847e..dd4b4974 100644 --- a/custom/js/helper.js +++ b/custom/js/helper.js @@ -31,7 +31,7 @@ function renderClientList(data) {
+ data-clientname="${obj.Client.name}" ${obj.QRCode != "" ? '' : ' disabled'}>Scan
- QR code not available + QR code