What's stopping the initial handshake packet from being replayed into the network stack? Seems like there would be no packets lost that way. Also, what is the purpose of checking for "udp[8] = 1" in the eBPF filter?
I'm not sure if initial handshakes can be replayed, but since WireGuard ignores unknown clients, it might be possible.
Out of that, you can construct a userspace process that reads a packet from the queue, decrypts the noise initiation, requests configuration, adds wireguard config via netlink, and then releases the packet. And you can do that with multiple packets in flight concurrently.
It also allows things like fail-open if the userspace process is broken or overwhelmed, which would be useful here (already in-kernel wg peers would keep working), and spreading load over multiple workers.
https://netfilter.org/projects/nftables/manpage.html (search for queue)
https://wiki.nftables.org/wiki-nftables/index.php/Queueing_t...
Here's a nice & simple Rust library for the userspace part, to give an idea of what the shape of the API is: https://docs.rs/nfq/latest/nfq/
Also, I'm available for contract work ;) Say hi to Ben from Tv.