That's plain wrong. The first thing a normal wireguard faces is... the wild network of the Internet, with many servers and hordes of malicious agents. This is what makes is an "encrypted VPN", it's expected to withstand being transmitted by garbage media.
>potential for RCE before packets reach wireguard
There is no such thing as "rce packets". Moreover, every wireguard implementation has a different surface for RCEs (bugs), it's not a property of wireguard, it's a property of the implementation, of which there are at least three.
You didn't get it. It would be more clear if you implement it.
With these wrappers, peers also install and run wrapper and unwrapper services, to encapsulate udp packets into websocket frames and vice versa. For example, the software that proceses incoming packets from the internet could be wstunnel listening on 443/TCP. This layer converts the websocket TCP traffic to wireguard UDP, which wireguard would then decrypt. Wireguard could even listen to local host.
In popular implementations, this layer could have notable attack surface, particularly because it often provides additional features, such as obfuscation behind https, authentication, TLS client certificate validation, etc. I recall Debian has a minimal package which does only UDP to tcp parsing and conversion, which is written in C and not maintained. That layer could be insecure, and may lead to code execution on server before wireguard is even involved.
No, the parent commenter's logic is sounder than yours. WireGuard in its natural configuration can't trust incoming packets at all, so there's nothing to subtract by layering things on top of it.
Obviously, all software creates an opportunity for a bug, so even though this is pretty low-risk as attack surface goes, if you're making a choice between plain natural WireGuard and WireGuard wrapped in WebSockets, the "plain" version has marginally less attack surface.
But if your choice is between WireGuard wrapped in WebSockets or an entire new VPN protocol, clearly the new protocol drastically increases the attack surface.
In any case: wrapping WireGuard with something else does nothing at a design level to put WireGuard's security at risk. That's not how it works.
In your implementation, you wrote software that listens to public internet, takes as input websocket traffic and outputs UDP. Right there, there is potential for vulnerabilities and code execution. This piece has nothing to do with software that would next process UDP.
That's why wireguard over TCP is not as secure as wireguard UDP.
This makes no sense. It's marginally less safe to accept UDP packets than TCP packets, for which you at least need to complete a 3WH to deliver frames. I don't think you've thought this through.
IIUC the parent's point is that if you first have to unwrap incoming, say, HTTPS traffic to obtain the Wireguard UDP packets, that unwrapping code might contain vulnerabilities, so an attack compromising the machine Wireguard is running on might occur before the packets ever reach the Wireguard implementation. From where I stand that's a somewhat academic scenario, though. (Unwrapping correctly & safely is usually not that difficult. Just don't use a memory-unsafe language for parsing & unpacking maybe.)
Wrapping-Unwrapping code is irrelevant to the security of wireguard.
Even if your wrapper-unwrapper is an outright remote shell without authorization, it would do nothing to compromise wireguard itself, as long as that shell has no sudo.
But in any case, that wrapper-unwrapper is usually just a packet rewriter, port-to-port, runs as a disabled user with no login privileges, no shell, and in a chroot. The only thing your RCE can do is to exit(1) the rewriter itself.
>My interpretation of OP is that they trust Wireguard’s code to be secure - random wrappers, somewhat less so.
There is not such thing as "wireguard code". Wireguard is a protocol, and "the security of wireguard" is the inability of the attackers to read the contents of the stream. This is not affected by the wrapper, because a wrapper is no more hazardous than the high seas, i.e. the Internet.
Speaking of implementation code. There are three wireguard implementations that I am aware of: Go, Linux, and OpenBSD. I am quite sure that none of those are bug-free, but adding a wrapper around wireguard packets has NO effect on the security of the implementation. The implementation is receiving packets from "something". This something can be either the net, or the wrapper, or even /dev/urandom
>Always? If emails are not answered you'll usually notice unless you're a Spammer
Means you're not using your email seriously. For example, to send CVs in response to job postings.
I send up to 20 email per day to people who have issues with their package build scripts, and I have no idea whether they ignore me because they stopped using the distro or because mail got dropped.
Not at all. China, Russia, and Iran are the three biggest markets for VPNs.
In China about 150 million people use a VPN, in Russia about 60 million, about half the population
reply