IPSec: add PSK validator

packages/ns-api/README.md

@@ -4390,6 +4390,9 @@ Create a tunnel:
 api-cli ns.ipsectunnel add-tunnel --data '{"ns_name": "tun1", "ike": {"hash_algorithm": "md5", "encryption_algorithm": "3des", "dh_group": "modp1024", "rekeytime": "3600"}, "esp": {"hash_algorithm": "md5", "encryption_algorithm": "3des", "dh_group": "modp1024", "rekeytime": "3600"}, "pre_shared_key": "xxxxxxxxxxxxxxxxxxx", "local_identifier": "@ipsec1.local", "remote_identifier": "@ipsec1.remote", "local_subnet": ["192.168.100.0/24"], "remote_subnet": ["192.168.200.0/24"], "enabled": "1", "local_ip": "192.168.122.49", "keyexchange": "ike", "ipcomp": "false", "dpdaction": "restart", "closeaction": "trap", "gateway": "10.10.0.172"}'
 ```
 
+Validation notes:
+- `pre_shared_key` must not contain curly braces (`{` or `}`); the API returns a validation error if they are present.
+
 Response example:
 ```json
 {"id": "ns_81df3995"}
@@ -4402,6 +4405,8 @@ Edit a tunnel:
 api-cli ns.ipsectunnel edit-tunnel --data '{"id": "ns_81df3995", "ns_name": "tun1", "ike": {"hash_algorithm": "md5", "encryption_algorithm": "3des", "dh_group": "modp1024", "rekeytime": "3600"}, "esp": {"hash_algorithm": "md5", "encryption_algorithm": "3des", "dh_group": "modp1024", "rekeytime": "3600"}, "pre_shared_key": "xxxxxxxxxxxxxxxxxxx", "local_identifier": "@ipsec1.local", "remote_identifier": "@ipsec1.remote", "local_subnet": ["192.168.100.0/24"], "remote_subnet": ["192.168.200.0/24"], "enabled": "1", "local_ip": "192.168.122.49", "keyexchange": "ike", "ipcomp": "false", "dpdaction": "restart", "closeaction": "trap", "gateway": "10.10.0.172"}'
 ```
 
+The same `pre_shared_key` validation applies here: curly braces (`{` or `}`) are rejected.
+
 Response example:
 ```json
 {"id": "ns_81df3995"}

packages/ns-api/files/ns.ipsectunnel

@@ -150,6 +150,11 @@ def uci_set_if_changed(u, config, section, option, value):
         return True
     return False
 
+def validate_pre_shared_key(pre_shared_key):
+    if isinstance(pre_shared_key, str) and ("{" in pre_shared_key or "}" in pre_shared_key):
+        return utils.validation_error("pre_shared_key", "invalid", pre_shared_key)
+    return None
+
 
 ## APIs
 
@@ -213,6 +218,9 @@ def list_tunnels():
     return {"tunnels": ret}
 
 def add_tunnel(args):
+    validation = validate_pre_shared_key(args.get("pre_shared_key", ""))
+    if validation:
+        return validation
     u = EUci()
     iname = utils.get_random_id()
     return setup_tunnel(u, iname, args)
@@ -309,6 +317,10 @@ def edit_tunnel(args):
         u.get("ipsec", id)
     except:
         return utils.validation_error("tunnel_not_found")
+
+    validation = validate_pre_shared_key(args.get("pre_shared_key", ""))
+    if validation:
+        return validation
 
     ike_p = f'{id}_ike'
     esp_p = f'{id}_esp'