From bd77408b992eaabed2794144a96f8bd1ecf6668f Mon Sep 17 00:00:00 2001
From: fzoske <fzoske@users.noreply.github.com>
Date: Wed, 18 Jul 2018 13:35:43 +0200
Subject: [PATCH] Add Possibility to Configure PSK based Encryption on UI
 (#708)

---
 net-mgmt/zabbix-proxy/Makefile                |  2 +-
 .../OPNsense/Zabbixproxy/forms/general.xml    | 21 +++++++++++++++++++
 .../models/OPNsense/Zabbixproxy/General.xml   | 18 +++++++++++++++-
 .../templates/OPNsense/Zabbixproxy/+TARGETS   |  1 +
 .../OPNsense/Zabbixproxy/zabbix_proxy.conf    |  9 ++++++++
 .../OPNsense/Zabbixproxy/zabbix_proxy.psk     |  5 +++++
 6 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/zabbix_proxy.psk

diff --git a/net-mgmt/zabbix-proxy/Makefile b/net-mgmt/zabbix-proxy/Makefile
index a2a4a959d..2db24d54d 100644
--- a/net-mgmt/zabbix-proxy/Makefile
+++ b/net-mgmt/zabbix-proxy/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		zabbix-proxy
-PLUGIN_VERSION=		1.0
+PLUGIN_VERSION=		1.1
 PLUGIN_COMMENT=		Zabbix Proxy enables decentralized monitoring
 PLUGIN_DEPENDS=		zabbix3-proxy
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
diff --git a/net-mgmt/zabbix-proxy/src/opnsense/mvc/app/controllers/OPNsense/Zabbixproxy/forms/general.xml b/net-mgmt/zabbix-proxy/src/opnsense/mvc/app/controllers/OPNsense/Zabbixproxy/forms/general.xml
index 5df2c2987..e680d0b3f 100644
--- a/net-mgmt/zabbix-proxy/src/opnsense/mvc/app/controllers/OPNsense/Zabbixproxy/forms/general.xml
+++ b/net-mgmt/zabbix-proxy/src/opnsense/mvc/app/controllers/OPNsense/Zabbixproxy/forms/general.xml
@@ -113,4 +113,25 @@
         <type>text</type>
         <help>Specifies how long we wait for agent, SNMP device or external check (in seconds).</help>
     </field>
+    <field>
+        <id>general.encryption</id>
+        <label>PSK based encryption</label>
+        <type>checkbox</type>
+        <help>Enable PSK based encryption for communicating with the Zabbix server</help>
+        <advanced>true</advanced>
+    </field>
+    <field>
+        <id>general.encryptionidentity</id>
+        <label>PSK Identity</label>
+        <type>text</type>
+        <help>The PSK identity configured on the Zabbix server</help>
+        <advanced>true</advanced>
+    </field>
+    <field>
+        <id>general.encryptionpsk</id>
+        <label>PSK</label>
+        <type>text</type>
+        <help>The PSK configured on the Zabbix server</help>
+        <advanced>true</advanced>
+    </field>
 </form>
diff --git a/net-mgmt/zabbix-proxy/src/opnsense/mvc/app/models/OPNsense/Zabbixproxy/General.xml b/net-mgmt/zabbix-proxy/src/opnsense/mvc/app/models/OPNsense/Zabbixproxy/General.xml
index 386ab994a..aefdc4007 100644
--- a/net-mgmt/zabbix-proxy/src/opnsense/mvc/app/models/OPNsense/Zabbixproxy/General.xml
+++ b/net-mgmt/zabbix-proxy/src/opnsense/mvc/app/models/OPNsense/Zabbixproxy/General.xml
@@ -1,7 +1,7 @@
 <model>
     <mount>//OPNsense/zabbixproxy/general</mount>
     <description>Zabbix Proxy configuration</description>
-    <version>1.0.0</version>
+    <version>1.1.0</version>
     <items>
         <enabled type="BooleanField">
             <default>0</default>
@@ -79,5 +79,21 @@
             <default>4</default>
             <Required>N</Required>
         </timeout>
+        <encryption type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </encryption>
+        <encryptionidentity type="TextField">
+            <default></default>
+            <Required>N</Required>
+            <mask>/^.{1,128}$/</mask>
+            <ValidationMessage>Should be a string between 1 and 128 characters.</ValidationMessage>
+        </encryptionidentity>
+        <encryptionpsk type="TextField">
+            <default></default>
+            <Required>N</Required>
+            <mask>/^[A-Fa-f0-9]{32,512}$/</mask>
+            <ValidationMessage>Should be a hexadecimal string between 32 and 512 characters.</ValidationMessage>
+        </encryptionpsk>
     </items>
 </model>
diff --git a/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/+TARGETS b/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/+TARGETS
index d9acf9ec4..557e72c25 100644
--- a/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/+TARGETS
+++ b/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/+TARGETS
@@ -1,2 +1,3 @@
 zabbix_proxy:/etc/rc.conf.d/zabbix_proxy
 zabbix_proxy.conf:/usr/local/etc/zabbix3/zabbix_proxy.conf
+zabbix_proxy.psk:/usr/local/etc/zabbix3/zabbix_proxy.psk
diff --git a/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/zabbix_proxy.conf b/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/zabbix_proxy.conf
index ba0a923ee..6ccb03d01 100644
--- a/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/zabbix_proxy.conf
+++ b/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/zabbix_proxy.conf
@@ -61,4 +61,13 @@ Timeout={{ OPNsense.zabbixproxy.general.timeout }}
 {% endif %}
 FpingLocation=/usr/local/sbin/fping
 Fping6Location=/usr/local/sbin/fping6
+{% if helpers.exists('OPNsense.zabbixproxy.general.encryption') and OPNsense.zabbixproxy.general.encryption == '1' %}
+{% if helpers.exists('OPNsense.zabbixproxy.general.proxymode') and OPNsense.zabbixproxy.general.proxymode == '1' %}
+TLSAccept=psk
+{% else %}
+TLSConnect=psk
+{% endif %}
+TLSPSKFile=/usr/local/etc/zabbix3/zabbix_proxy.psk
+TLSPSKIdentity={{ OPNsense.zabbixproxy.general.encryptionidentity }}
+{% endif %}
 {% endif %}
diff --git a/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/zabbix_proxy.psk b/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/zabbix_proxy.psk
new file mode 100644
index 000000000..61cc1da64
--- /dev/null
+++ b/net-mgmt/zabbix-proxy/src/opnsense/service/templates/OPNsense/Zabbixproxy/zabbix_proxy.psk
@@ -0,0 +1,5 @@
+{% if helpers.exists('OPNsense.zabbixproxy.general.enabled') and OPNsense.zabbixproxy.general.enabled == '1' %}
+{% if helpers.exists('OPNsense.zabbixproxy.general.encryption') and OPNsense.zabbixproxy.general.encryption == '1' %}
+{{ OPNsense.zabbixproxy.general.encryptionpsk }}
+{% endif %}
+{% endif %}
\ No newline at end of file