I was answering to the first part of his comment, about bringing the whole kitchen sink in a tunneling protocol instead of having composable tools allowing for

I was answering to the first part of his comment, about bringing the whole kitchen sink in a tunneling protocol instead of having composable tools allowing for things the designers never imagined. But OK, this doesn't cover the second need, I'm guessing what you need is down one layer, and should be done in kernel if you really think it important, but how does wg prevent you from doing that? Build your tunnel obfuscator one layer down (I did some stateful, user-land driven, packet patching not long ago, with ebpf, it is not easy but the tooling is getting better. It seems the new way to do things nowadays anyway... And it runs in-kernel. Then lay wg above it. But having the wg codebase do what in fact the kernel should propose (pluggable transports, etc.) seems... asking the wrong team. The Linux kernel network stack is already plenty composable without ebpf...