Split WireGuard rules (Private/Preshared Key)

praetorian-inc · Dec 15, 2023 · 7e43b57 · 7e43b57
1 parent 8a7b0cd
commit 7e43b57
Show file tree

Hide file tree

Showing 5 changed files with 28 additions and 11 deletions.
diff --git a/...oseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_check_builtins-2.snap b/...oseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_check_builtins-2.snap
@@ -2,5 +2,5 @@
 source: crates/noseyparker-cli/tests/rules/mod.rs
 expression: stdout
 ---
-115 rules and 3 rulesets: no issues detected
+116 rules and 3 rulesets: no issues detected
 
diff --git a/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_json-2.snap b/crates/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_json-2.snap
@@ -462,14 +462,18 @@ expression: stdout
     },
     {
       "id": "np.wireguard.1",
-      "name": "WireGuard PrivateKey/PresharedKey"
+      "name": "WireGuard Private Key"
+    },
+    {
+      "id": "np.wireguard.2",
+      "name": "WireGuard Preshared Key"
     }
   ],
   "rulesets": [
     {
       "id": "default",
       "name": "Nosey Parker default rules",
-      "num_rules": 95
+      "num_rules": 96
     },
     {
       "id": "np.assets",

diff --git a/...s/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_noargs-2.snap b/...s/noseyparker-cli/tests/rules/snapshots/test_noseyparker__rules__rules_list_noargs-2.snap
@@ -119,11 +119,12 @@ expression: stdout
  np.twilio.1         Twilio API Key 
  np.twitter.1        Twitter Client ID 
  np.twitter.2        Twitter Secret Key 
- np.wireguard.1      WireGuard PrivateKey/PresharedKey 
+ np.wireguard.1      WireGuard Private Key 
+ np.wireguard.2      WireGuard Preshared Key 
 
  Ruleset ID   Ruleset Name                         Rules 
 ─────────────────────────────────────────────────────────
- default      Nosey Parker default rules              95 
+ default      Nosey Parker default rules              96 
  np.assets    Nosey Parker asset detection rules      15 
  np.hashes    Nosey Parker password hash rules         5 
 
diff --git a/crates/noseyparker/data/default/builtin/rules/wireguard.yml b/crates/noseyparker/data/default/builtin/rules/wireguard.yml
@@ -3,20 +3,30 @@
 
 rules:
 
-- name: WireGuard PrivateKey/PresharedKey
+- name: WireGuard Private Key
   id: np.wireguard.1
 
-  pattern: |
-    (?x)
-    PrivateKey|PresharedKey\s*=\s*
-    ([A-Za-z0-9+/]{43}={1})
+  pattern: PrivateKey\s*=\s*([A-Za-z0-9+/]{43})
 
   examples:
   - |
       [Interface]
       Address = 10.200.200.3/32
       PrivateKey = AsaFot43bfs1fEWjvtty+rGcjh3rP1H6sug1l3u19ix=
       DNS = 8.8.8.8
+
+  references:
+  - https://www.wireguard.com/quickstart/
+  - https://manpages.debian.org/testing/wireguard-tools/wg.8.en.html
+  - https://gist.github.com/lanceliao/5d2977f417f34dda0e3d63ac7e217fd6
+
+- name: WireGuard Preshared Key
+  id: np.wireguard.2
+
+  pattern: PresharedKey\s*=\s*([A-Za-z0-9+/]{43}=)
+
+  examples:
+  - |
       [Peer]
       PublicKey = [Server's public key]
       PresharedKey = uRsfsZ2Ts1rach4Zv3hhwcx6wa5fuIo2u3w7sa+7j81=
@@ -25,4 +35,5 @@ rules:
 
   references:
   - https://www.wireguard.com/quickstart/
+  - https://manpages.debian.org/testing/wireguard-tools/wg.8.en.html
   - https://gist.github.com/lanceliao/5d2977f417f34dda0e3d63ac7e217fd6
diff --git a/crates/noseyparker/data/default/builtin/rulesets/default.yml b/crates/noseyparker/data/default/builtin/rulesets/default.yml
@@ -109,4 +109,5 @@ rulesets:
   - np.telegram.1     # Telegram Bot Token
   - np.twilio.1       # Twilio API Key
   - np.twitter.2      # Twitter Secret Key
-  - np.wireguard.1    # WireGuard PrivateKey/PresharedKey
+  - np.wireguard.1    # WireGuard Private Key
+  - np.wireguard.2    # WireGuard Preshared Key