fix psk behaviour and allow to clear psk

2026-09-01 20:41:28 +02:00 · 2026-06-15 10:43:48 +02:00
parent ec366163e3
commit 79e0a05f52
12 changed files with 25 additions and 49 deletions
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -462,7 +462,7 @@ func setConfigInputFromRequest(msg *proto.SetConfigRequest) (profilemanager.Conf
 		wgPort := int(*msg.WireguardPort)
 		config.WireguardPort = &wgPort
 	}
-	if msg.OptionalPreSharedKey != nil && *msg.OptionalPreSharedKey != "" {
+	if msg.OptionalPreSharedKey != nil {
 		config.PreSharedKey = msg.OptionalPreSharedKey
 	}

--- a/client/ui/frontend/src/contexts/SettingsContext.tsx
+++ b/client/ui/frontend/src/contexts/SettingsContext.tsx
@@ -26,9 +26,6 @@ type SettingsContextValue = {
    guiVersion: string;
    setField: <K extends keyof Config>(k: K, v: Config[K]) => void;
    saveField: <K extends keyof Config>(k: K, v: Config[K]) => Promise<void>;
-    // opts.preSharedKey carries a new PSK to write. Config no longer exposes the
-    // PSK value (only preSharedKeySet), so it rides alongside the Config fields
-    // here and is sent only when non-empty.
    saveFields: (partial: Partial<Config>, opts?: { preSharedKey?: string }) => Promise<void>;
    saveNow: () => Promise<void>;
 };
@@ -113,13 +110,11 @@ const useSettingsState = () => {

    const save = useCallback(
        async (profileName: string, next: Config, preSharedKey?: string) => {
+            const preSharedKeyWrite = preSharedKey !== undefined ? { preSharedKey } : {};
            try {
                await SettingsSvc.SetConfig({
                    ...next,
-                    // The daemon never returns the PSK value (only preSharedKeySet),
-                    // so send one only when the user actually typed a new key; an
-                    // empty field means "leave unchanged", never "clear".
-                    ...(preSharedKey ? { preSharedKey } : {}),
+                    ...preSharedKeyWrite,
                    profileName,
                    username,
                });
@@ -181,7 +176,12 @@ const useSettingsState = () => {
                clearTimeout(saveTimer.current);
                saveTimer.current = null;
            }
-            const next = { ...loaded.data, ...partial };
+
+            const merged: Config = { ...loaded.data, ...partial };
+            const next: Config =
+                opts?.preSharedKey !== undefined
+                    ? { ...merged, preSharedKeySet: opts.preSharedKey !== "" }
+                    : merged;
            setLoaded({ profileName: loaded.profileName, data: next });
            await save(loaded.profileName, next, opts?.preSharedKey);
        },
--- a/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsAdvanced.tsx
@@ -24,18 +24,22 @@ const PORT_MAX = 65535;
 const MTU_MIN = 576;
 const MTU_MAX = 8192;

+const PSK_MASK = "**********";
+
 export function SettingsAdvanced() {
    const { t } = useTranslation();
    const { config, saveFields } = useSettings();
    const { mdm } = useRestrictions();

+    const initialPsk = config.preSharedKeySet ? PSK_MASK : "";
+
    const [values, setValues] = useState({
        interfaceName: config.interfaceName,
        wireguardPort: config.wireguardPort,
        mtu: config.mtu,
    });

-    const [psk, setPsk] = useState("");
+    const [pskInputValue, setPskInputValue] = useState(initialPsk);
    const [saving, setSaving] = useState(false);

    useEffect(() => {
@@ -44,7 +48,7 @@ export function SettingsAdvanced() {
            wireguardPort: config.wireguardPort,
            mtu: config.mtu,
        });
-        setPsk("");
+        setPskInputValue(config.preSharedKeySet ? PSK_MASK : "");
    }, [config.interfaceName, config.wireguardPort, config.mtu, config.preSharedKeySet]);

    const errors = useMemo(() => {
@@ -70,11 +74,12 @@ export function SettingsAdvanced() {

    const filteredErrors = mdm.wireguardPort ? { ...errors, wireguardPort: undefined } : errors;
    const hasErrors = Object.values(filteredErrors).some((v) => v !== undefined);
+    const pskChanged = pskInputValue !== initialPsk;
    const hasChanges =
        values.interfaceName !== config.interfaceName ||
        (!mdm.wireguardPort && values.wireguardPort !== config.wireguardPort) ||
        values.mtu !== config.mtu ||
-        (!mdm.preSharedKey && psk !== "");
+        (!mdm.preSharedKey && pskChanged);

    const handleSave = async () => {
        if (!hasChanges || saving || hasErrors) return;
@@ -82,8 +87,11 @@ export function SettingsAdvanced() {
        try {
            const partial: typeof values = { ...values };
            if (mdm.wireguardPort) partial.wireguardPort = config.wireguardPort;
-            const pskOpts = !mdm.preSharedKey && psk ? { preSharedKey: psk } : undefined;
+
+            const pskEdited = !mdm.preSharedKey && pskChanged && pskInputValue !== PSK_MASK;
+            const pskOpts = pskEdited ? { preSharedKey: pskInputValue } : undefined;
            await saveFields(partial, pskOpts);
+            if (pskEdited) setPskInputValue(pskInputValue === "" ? "" : PSK_MASK);
        } finally {
            setSaving(false);
        }
@@ -139,14 +147,10 @@ export function SettingsAdvanced() {
                        <HelpText>{t("settings.advanced.psk.help")}</HelpText>
                        <Input
                            type={"password"}
-                            showPasswordToggle={psk !== ""}
-                            placeholder={
-                                config.preSharedKeySet
-                                    ? t("settings.advanced.psk.configured")
-                                    : "kQv0qF3oQpJYdgD5mC9hL7sB2xZ8nT4eU6wY1aR3jK0="
-                            }
-                            value={psk}
-                            onChange={(e) => setPsk(e.target.value)}
+                            showPasswordToggle={pskInputValue !== PSK_MASK}
+                            placeholder={"kQv0qF3oQpJYdgD5mC9hL7sB2xZ8nT4eU6wY1aR3jK0="}
+                            value={pskInputValue}
+                            onChange={(e) => setPskInputValue(e.target.value)}
                        />
                    </div>
                </SectionGroup>
--- a/client/ui/i18n/locales/de/common.json
+++ b/client/ui/i18n/locales/de/common.json
@@ -701,9 +701,6 @@
    "settings.advanced.psk.help": {
        "message": "Optionaler WireGuard-PSK für zusätzliche symmetrische Verschlüsselung. Nicht identisch mit einem NetBird Setup-Key. Sie kommunizieren nur mit Peers, die denselben Pre-shared Key verwenden."
    },
-    "settings.advanced.psk.configured": {
-        "message": "Ein Pre-shared Key ist gesetzt – geben Sie einen neuen ein, um ihn zu ersetzen."
-    },
    "settings.troubleshooting.section.title": {
        "message": "Debug-Paket"
    },
--- a/client/ui/i18n/locales/en/common.json
+++ b/client/ui/i18n/locales/en/common.json
@@ -935,10 +935,6 @@
        "message": "Optional WireGuard PSK for extra symmetric encryption. Not the same as a NetBird Setup Key. You will only communicate with peers that use the same pre-shared key.",
        "description": "Helper text for the WireGuard PSK. 'WireGuard', 'PSK', and 'NetBird Setup Key' are product/technical terms — keep them."
    },
-    "settings.advanced.psk.configured": {
-        "message": "A pre-shared key is set — enter a new one to replace it.",
-        "description": "Placeholder shown in the empty PSK input when a pre-shared key is already configured; the field stays blank because the daemon never returns the value."
-    },
    "settings.troubleshooting.section.title": {
        "message": "Debug bundle",
        "description": "Section heading: Debug bundle."
--- a/client/ui/i18n/locales/es/common.json
+++ b/client/ui/i18n/locales/es/common.json
@@ -701,9 +701,6 @@
    "settings.advanced.psk.help": {
        "message": "PSK de WireGuard opcional para cifrado simétrico adicional. No es lo mismo que una clave de instalación de NetBird. Solo se comunicará con peers que usen la misma clave precompartida."
    },
-    "settings.advanced.psk.configured": {
-        "message": "Hay una clave precompartida configurada: introduzca una nueva para reemplazarla."
-    },
    "settings.troubleshooting.section.title": {
        "message": "Paquete de diagnóstico"
    },
--- a/client/ui/i18n/locales/fr/common.json
+++ b/client/ui/i18n/locales/fr/common.json
@@ -701,9 +701,6 @@
    "settings.advanced.psk.help": {
        "message": "PSK WireGuard facultative pour un chiffrement symétrique supplémentaire. Différente d’une clé d’installation NetBird. Vous ne communiquerez qu’avec les pairs utilisant la même clé pré-partagée."
    },
-    "settings.advanced.psk.configured": {
-        "message": "Une clé pré-partagée est définie — saisissez-en une nouvelle pour la remplacer."
-    },
    "settings.troubleshooting.section.title": {
        "message": "Lot de diagnostic"
    },
--- a/client/ui/i18n/locales/hu/common.json
+++ b/client/ui/i18n/locales/hu/common.json
@@ -701,9 +701,6 @@
    "settings.advanced.psk.help": {
        "message": "Opcionális WireGuard PSK további szimmetrikus titkosításhoz. Nem azonos a NetBird telepítőkulccsal. Csak olyan Peerekkel kommunikál, akik ugyanazt a pre-shared kulcsot használják."
    },
-    "settings.advanced.psk.configured": {
-        "message": "Pre-shared kulcs be van állítva – új megadásával cserélhető."
-    },
    "settings.troubleshooting.section.title": {
        "message": "Hibakeresési csomag"
    },
--- a/client/ui/i18n/locales/it/common.json
+++ b/client/ui/i18n/locales/it/common.json
@@ -701,9 +701,6 @@
    "settings.advanced.psk.help": {
        "message": "PSK WireGuard opzionale per una crittografia simmetrica aggiuntiva. Non è la stessa cosa di una chiave di configurazione NetBird. Comunicherà solo con i peer che usano la stessa chiave pre-condivisa."
    },
-    "settings.advanced.psk.configured": {
-        "message": "Una chiave pre-condivisa è impostata: ne inserisca una nuova per sostituirla."
-    },
    "settings.troubleshooting.section.title": {
        "message": "Pacchetto di debug"
    },
--- a/client/ui/i18n/locales/pt/common.json
+++ b/client/ui/i18n/locales/pt/common.json
@@ -701,9 +701,6 @@
    "settings.advanced.psk.help": {
        "message": "PSK opcional do WireGuard para criptografia simétrica adicional. Não é o mesmo que uma chave de configuração do NetBird. Você só se comunicará com peers que usem a mesma chave pré-compartilhada."
    },
-    "settings.advanced.psk.configured": {
-        "message": "Uma chave pré-compartilhada está definida — introduza uma nova para a substituir."
-    },
    "settings.troubleshooting.section.title": {
        "message": "Pacote de depuração"
    },
--- a/client/ui/i18n/locales/ru/common.json
+++ b/client/ui/i18n/locales/ru/common.json
@@ -701,9 +701,6 @@
    "settings.advanced.psk.help": {
        "message": "Необязательный PSK WireGuard для дополнительного симметричного шифрования. Это не то же самое, что ключ установки NetBird. Вы будете обмениваться данными только с пирами, использующими тот же общий ключ."
    },
-    "settings.advanced.psk.configured": {
-        "message": "Общий ключ установлен — введите новый, чтобы заменить его."
-    },
    "settings.troubleshooting.section.title": {
        "message": "Отладочный пакет"
    },
--- a/client/ui/i18n/locales/zh-CN/common.json
+++ b/client/ui/i18n/locales/zh-CN/common.json
@@ -701,9 +701,6 @@
    "settings.advanced.psk.help": {
        "message": "可选的 WireGuard PSK，用于额外的对称加密。它与 NetBird 设置密钥不同。您将只能与使用相同预共享密钥的对等节点通信。"
    },
-    "settings.advanced.psk.configured": {
-        "message": "已设置预共享密钥，输入新密钥即可替换。"
-    },
    "settings.troubleshooting.section.title": {
        "message": "调试包"
    },