gutd — WireGuard traffic obfuscator via TC/XDP eBPF (no kernel patches)

[sh0rch]

Hi all,

I've been working on a WireGuard obfuscator and wanted to share it in case it's useful or someone wants to try it out and give feedback.

**gutd** obfuscates WireGuard UDP traffic using Linux TC/XDP eBPF programs - no kernel patches, no kernel modules, no DKMS. It attaches at the TC egress hook on a veth pair and the XDP ingress hook on the physical NIC, so packet processing happens in the kernel datapath at near-native speed, but the implementation lives entirely in userspace-loaded BPF programs.

##How it works:
- Egress (TC): masks each WireGuard UDP payload with a ChaCha keystream before it leaves the host
- Ingress (XDP): unmasks the packet before passing it up the stack WireGuard sees nothing unusual
- The WireGuard process is completely unaware of gutd

##Key properties:
- No kernel patches or modules - just `bpf()` syscall
- Port striping across multiple UDP ports per peer
- Probabilistic keepalive drop to suppress timing patterns
- Hot reload via SIGHUP, no tunnel restart
- Static musl binary available (single file, no dependencies)
- IPv4 and IPv6 outer transport

Shared symmetric key (not WireGuard keypairs) -`gutd genkey` generates a random 256-bit key.

Repo: https://github.com/sh0rch/gutd

Would appreciate any feedback - especially on the BPF approach, the wire format, or anything that seems wrong or could be done better.

Thanks