From fccdb6b2087ca9be68159b2328704790f4bdef0a Mon Sep 17 00:00:00 2001
From: snuffy22 <22233310+snuffy22@users.noreply.github.com>
Date: Sat, 1 Aug 2026 18:49:01 -0400
Subject: [PATCH] OpenBSD Wireguard implementation

---
 netsim/ansible/templates/initial/openbsd-ifconfig.j2 |  6 ++++++
 netsim/devices/openbsd.yml                           |  5 ++++-
 netsim/extra/tunnel/wireguard/openbsd.initial.j2     |  3 +++
 netsim/extra/tunnel/wireguard/openbsd.j2             | 10 ++++++++++
 4 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 netsim/extra/tunnel/wireguard/openbsd.initial.j2
 create mode 100644 netsim/extra/tunnel/wireguard/openbsd.j2

diff --git a/netsim/ansible/templates/initial/openbsd-ifconfig.j2 b/netsim/ansible/templates/initial/openbsd-ifconfig.j2
index 65c8720533..68fcbdf3de 100644
--- a/netsim/ansible/templates/initial/openbsd-ifconfig.j2
+++ b/netsim/ansible/templates/initial/openbsd-ifconfig.j2
@@ -28,4 +28,10 @@ ifconfig {{ intf.ifname }} down
 {% else %}
 ifconfig {{ intf.ifname }} up
 {% endif %}
+{%   if 'ipv6' in intf and intf.tunnel.mode|default('') in ['wireguard'] %}
+# OpenBSD Wireguard does not automatically create IPv6 LLA make it ourselves
+{% set _last = range(1, 65536) | random %}
+{% set _lla = 'fe80::%x/64' | format(_last) %}
+ifconfig {{ intf.ifname }} inet6 {{ _lla }}
+{%   endif %}
 {% endmacro %}
diff --git a/netsim/devices/openbsd.yml b/netsim/devices/openbsd.yml
index 22e5b36603..c0a6a98639 100644
--- a/netsim/devices/openbsd.yml
+++ b/netsim/devices/openbsd.yml
@@ -3,7 +3,9 @@ support:
   level: best-effort
 interface_name: vio{ifindex}
 loopback_interface_name: lo{ifindex}
-tunnel_interface_name: gre{ifindex}
+tunnel_interface_name:
+  gre: gre{ifindex}
+  wireguard: wg{ifindex}
 ifindex_offset: 1
 mgmt_if: vio0
 role: router
@@ -59,6 +61,7 @@ features:
     vtep6: True
   tunnel:
     gre: [ ipv4 ]
+    wireguard: [ ipv4, ipv6 ]
 libvirt:
   create_template: openbsd.xml.j2
   image: netlab/openbsd
diff --git a/netsim/extra/tunnel/wireguard/openbsd.initial.j2 b/netsim/extra/tunnel/wireguard/openbsd.initial.j2
new file mode 100644
index 0000000000..7de6f20448
--- /dev/null
+++ b/netsim/extra/tunnel/wireguard/openbsd.initial.j2
@@ -0,0 +1,3 @@
+{% for l in interfaces if l.type == 'tunnel' and l.tunnel.mode == 'wireguard' %}
+ifconfig {{ l.ifname }} create
+{% endfor %}
diff --git a/netsim/extra/tunnel/wireguard/openbsd.j2 b/netsim/extra/tunnel/wireguard/openbsd.j2
new file mode 100644
index 0000000000..71c09c73d5
--- /dev/null
+++ b/netsim/extra/tunnel/wireguard/openbsd.j2
@@ -0,0 +1,10 @@
+#!/bin/sh
+# wg endpoint
+{% for intf in netlab_interfaces if intf.tunnel.mode|default('') in ['wireguard'] %}
+{%   set dst = intf.tunnel._destination %}
+{%   set peer_ip = ('[' ~ dst.ipv6 ~ ']') if intf.tunnel.af == 'ipv6' else dst.ipv4 %}
+{%   set peer_endpoint = peer_ip ~ ':' ~ dst.listen_port %}
+ifconfig {{ intf.ifname }} wgkey {{ intf.tunnel.private_key }} wgport {{ intf.tunnel.listen_port }} up
+ifconfig {{ intf.ifname }} wgpeer {{ dst.public_key }} wgendpoint {{ peer_ip }} {{ dst.listen_port }} wgpka {{ intf.tunnel.persistent_keepalive }}
+ifconfig {{ intf.ifname }} wgpeer {{ dst.public_key }} wgaip {{ intf.tunnel.allowed_ips.split(',') | join(' wgaip ') }}
+{% endfor %}