artizirk/0README.md

## 0README.md

      
    Raw
  

              0README.md
            
          
    Wireguard autmatic configuration ideas

Collection of ideas for automatic wireguard interface configuration
Generating ipv6 aadresses


Interface gets a link local ip like so fe80::hash(interfacepubkey)/64
Each peer allowed ips get fe80::hash(peerpubkey)/128

Pushing ipv6 configuration

Because NDP runs over ICMPv6 we are able to just use standard protocols to push config
radvd can push configuration to unicast addresses automatically if
client ip addresses are given to it.
Example config could look like this
# /etc/radvd.conf
interface wgnet0 {
    AdvSendAdvert on;
    IgnoreIfMissing on;
    #UnicastOnly on;
    prefix fd00::/64 {
        AdvOnLink on;
        AdvAutonomous on;
    };
    clients {
        fe80::ca8d:3088:f1b:9b24;
    };

};

TODO: need to figure out how to add radvd advertised ip addresses to allowed-ip list
IPv4 ??

ipv4 relies on ugly layer 2 hack to push config (dhcp) probably needs something custom

  
## wireguard_link_local.py
#!/usr/bin/env python3
"""
Generate link local ip from wireguard public key

Usage: ./wireguard_link_local.py wireguard_public_key

Example:
    $ ./wireguard_link_local.py RlmFDyd8KdFDYNxqFD6t9LL1St5e1wwNTQSEVniQ1l8=
    fe80::ff0f:5f65:d551:b6c6
"""


import sys
from base64 import b64decode
from hashlib import blake2s  # WireGuard uses this hash
from binascii import hexlify

if len(sys.argv) < 2:
    print("Usage: {} public_key".format(sys.argv[0]))
    sys.exit(1)

hex_pubkey = sys.argv[1]
pubkey = b64decode(hex_pubkey)

parts = hexlify(blake2s(pubkey, digest_size=8).digest()).decode()

print("fe80::"+":".join((parts[x:x + 4] for x in range(0, len(parts), 4))))
	#!/usr/bin/env python3
	"""
	Generate link local ip from wireguard public key

	Usage: ./wireguard_link_local.py wireguard_public_key

	Example:
	$ ./wireguard_link_local.py RlmFDyd8KdFDYNxqFD6t9LL1St5e1wwNTQSEVniQ1l8=
	fe80::ff0f:5f65:d551:b6c6
	"""


	import sys
	from base64 import b64decode
	from hashlib import blake2s # WireGuard uses this hash
	from binascii import hexlify

	if len(sys.argv) < 2:
	print("Usage: {} public_key".format(sys.argv[0]))
	sys.exit(1)

	hex_pubkey = sys.argv[1]
	pubkey = b64decode(hex_pubkey)

	parts = hexlify(blake2s(pubkey, digest_size=8).digest()).decode()

	print("fe80::"+":".join((parts[x:x + 4] for x in range(0, len(parts), 4))))