Add PresharedKeys functionality and option to rotate private keys

.gitignore

@@ -118,3 +118,6 @@ venv.bak/
 # IntelliJ IDEA
 .idea
 *.iml
+
+# wg-meshconf output
+output

wg_meshconf/database_manager.py

@@ -317,7 +317,7 @@ def showpeers(self, Name: str, verbose: bool = False):
         # print the constructed table in console
         Console().print(table)
 
-    def genconfig(self, Name: str, output: pathlib.Path):
+    def genconfig(self, Name: str, output: pathlib.Path, presharedkeys: bool = False):
         database = self.read_database()
 
         # check if peer ID is specified
@@ -338,6 +338,10 @@ def genconfig(self, Name: str, output: pathlib.Path):
             print(f"Creating output directory: {output}", file=sys.stderr)
             output.mkdir(exist_ok=True)
 
+        # generate preshared key sets for all peers
+        if presharedkeys:
+            preshared_dict = WireGuard.generatepresharedkeysdict(peers)
+
         # for every peer in the database
         for peer in peers:
             local_peer = database["peers"][peer]
@@ -381,10 +385,23 @@ def genconfig(self, Name: str, output: pathlib.Path):
                             allowed_ips = ", ".join(remote_peer["Address"])
                         config.write("AllowedIPs = {}\n".format(allowed_ips))
 
+                    if presharedkeys:
+                        if preshared_dict.get(frozenset([peer, p])) is not None:
+                            config.write("PresharedKey = {}\n".format(preshared_dict[frozenset([peer, p])]))
+
                     for key in PEER_OPTIONAL_ATTRIBUTES_REMOTE:
                         if remote_peer.get(key) is not None:
                             config.write("{} = {}\n".format(key, remote_peer[key]))
 
                     for key in PEER_OPTIONAL_ATTRIBUTES_LOCAL:
                         if local_peer.get(key) is not None:
                             config.write("{} = {}\n".format(key, local_peer[key]))
+
+    def rotatekeys(self):
+        database = self.read_database()
+
+        for peer in database["peers"]:
+            privatekey = self.wireguard.genkey()
+            database["peers"][peer]["PrivateKey"] = privatekey
+
+        self.write_database(database)

wg_meshconf/wg_meshconf.py

@@ -129,13 +129,28 @@ def parse_arguments():
         type=pathlib.Path,
         default=pathlib.Path.cwd() / "output",
     )
+    genconfig.add_argument(
+        "-psk",
+        "--presharedkeys",
+        help="generate configuration with preshared keys",
+        action="store_true",
+        default=None,
+    )
+    genconfig.add_argument(
+        "-rk",
+        "--rotatekeys",
+        help="rotate keys for all peers",
+        action="store_true",
+        default=None,
+    )
+
+    rotatekeys = subparsers.add_parser("rotatekeys")
 
     return parser.parse_args()
 
 
 # if the file is not being imported
 def main():
-
     args = parse_arguments()
 
     database_manager = DatabaseManager(args.database)
@@ -190,7 +205,12 @@ def main():
         database_manager.showpeers(args.name, args.verbose)
 
     elif args.command == "genconfig":
-        database_manager.genconfig(args.name, args.output)
+        database_manager.genconfig(args.name, args.output, args.presharedkeys)
+        if args.rotatekeys:
+            database_manager.rotatekeys()
+
+    elif args.command == "rotatekeys":
+        database_manager.rotatekeys()
 
     # if no commands are specified
     else:

wg_meshconf/wireguard.py

@@ -11,6 +11,7 @@
 """
 
 import base64
+from typing import List, Dict, FrozenSet
 
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey
@@ -70,3 +71,13 @@ def genpsk() -> str:
             str: generated PSK encoded as a base64 string
         """
         return WireGuard.genkey()
+
+    @staticmethod
+    def generatepresharedkeysdict(peers: List[str]) -> Dict[FrozenSet, str]:
+        presharedkeys_dict: Dict[FrozenSet, str] = {}
+        for local_peer in peers:
+            for remote_peer in peers:
+                if remote_peer != local_peer and frozenset([local_peer, remote_peer]) not in presharedkeys_dict:
+                    presharedkeys_dict[frozenset([local_peer, remote_peer])] = WireGuard.genpsk()
+
+        return presharedkeys_dict