linux.patch

From fe67360af4afe7888b0663fc26337e731dd19724 Mon Sep 17 00:00:00 2001
From: Ivan Trubach <mr.trubach@icloud.com>
Date: Fri, 27 Sep 2024 01:46:59 +0300
Subject: [PATCH] Add AmneziaWG protocol improvements for WireGuard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Based on patches from AmneziaWG project (rebased for the stable Linux
kernel instead of an out-of-tree module), except for
002-unknown-peers-notifications.patch (that we don’t really need).

https://github.com/amnezia-vpn/amneziawg-linux-kernel-module/blob/master/src/patches
---
 drivers/net/wireguard/cookie.c   |   4 +-
 drivers/net/wireguard/cookie.h   |   2 +-
 drivers/net/wireguard/device.c   | 120 +++++++++++++++++++++++++++++++
 drivers/net/wireguard/device.h   |  15 ++++
 drivers/net/wireguard/main.c     |   4 +-
 drivers/net/wireguard/messages.h |  10 +++
 drivers/net/wireguard/netlink.c  |  94 ++++++++++++++++++++++--
 drivers/net/wireguard/noise.c    |  15 ++--
 drivers/net/wireguard/noise.h    |   6 +-
 drivers/net/wireguard/peer.c     |   1 +
 drivers/net/wireguard/peer.h     |   1 +
 drivers/net/wireguard/receive.c  | 103 +++++++++++++++++---------
 drivers/net/wireguard/send.c     |  91 +++++++++++++++++++----
 drivers/net/wireguard/socket.c   |  12 ++++
 drivers/net/wireguard/socket.h   |   2 +
 include/uapi/linux/wireguard.h   |  35 ++++++++-
 16 files changed, 450 insertions(+), 65 deletions(-)

diff --git a/drivers/net/wireguard/cookie.c b/drivers/net/wireguard/cookie.c
index f89581b5e8cb..3816cf878ef5 100644
--- a/drivers/net/wireguard/cookie.c
+++ b/drivers/net/wireguard/cookie.c
@@ -179,13 +179,13 @@ void wg_cookie_add_mac_to_packet(void *message, size_t len,
 
 void wg_cookie_message_create(struct message_handshake_cookie *dst,
 			      struct sk_buff *skb, __le32 index,
-			      struct cookie_checker *checker)
+			      struct cookie_checker *checker, u32 message_type)
 {
 	struct message_macs *macs = (struct message_macs *)
 		((u8 *)skb->data + skb->len - sizeof(*macs));
 	u8 cookie[COOKIE_LEN];
 
-	dst->header.type = cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE);
+	dst->header.type = cpu_to_le32(message_type);
 	dst->receiver_index = index;
 	get_random_bytes_wait(dst->nonce, COOKIE_NONCE_LEN);
 
diff --git a/drivers/net/wireguard/cookie.h b/drivers/net/wireguard/cookie.h
index c4bd61ca03f2..2b506609c8f0 100644
--- a/drivers/net/wireguard/cookie.h
+++ b/drivers/net/wireguard/cookie.h
@@ -52,7 +52,7 @@ void wg_cookie_add_mac_to_packet(void *message, size_t len,
 
 void wg_cookie_message_create(struct message_handshake_cookie *src,
 			      struct sk_buff *skb, __le32 index,
-			      struct cookie_checker *checker);
+			      struct cookie_checker *checker, u32 message_type);
 void wg_cookie_message_consume(struct message_handshake_cookie *src,
 			       struct wg_device *wg);
 
diff --git a/drivers/net/wireguard/device.c b/drivers/net/wireguard/device.c
index 45e9b908dbfb..27feb0234116 100644
--- a/drivers/net/wireguard/device.c
+++ b/drivers/net/wireguard/device.c
@@ -375,6 +375,11 @@ static int wg_newlink(struct net *src_net, struct net_device *dev,
 	 */
 	dev->priv_destructor = wg_destruct;
 
+	wg->advanced_security_config.init_packet_magic_header = MESSAGE_HANDSHAKE_INITIATION;
+	wg->advanced_security_config.response_packet_magic_header = MESSAGE_HANDSHAKE_RESPONSE;
+	wg->advanced_security_config.cookie_packet_magic_header = MESSAGE_HANDSHAKE_COOKIE;
+	wg->advanced_security_config.transport_packet_magic_header = MESSAGE_DATA;
+
 	pr_debug("%s: Interface created\n", dev->name);
 	return ret;
 
@@ -470,3 +475,118 @@ void wg_device_uninit(void)
 	unregister_pm_notifier(&pm_notifier);
 	rcu_barrier();
 }
+
+int wg_device_handle_post_config(struct net_device *dev, struct amnezia_config *asc)
+{
+	struct wg_device *wg = netdev_priv(dev);
+	bool a_sec_on = false;
+	int ret = 0;
+
+	if (!asc->advanced_security)
+		goto out;
+
+	if (asc->junk_packet_count < 0) {
+		net_dbg_ratelimited("%s: JunkPacketCount should be non negative\n", dev->name);
+		ret = -EINVAL;
+	}
+
+	wg->advanced_security_config.junk_packet_count = asc->junk_packet_count;
+	if (asc->junk_packet_count != 0)
+		a_sec_on = true;
+
+	wg->advanced_security_config.junk_packet_min_size = asc->junk_packet_min_size;
+	if (asc->junk_packet_min_size != 0)
+		a_sec_on = true;
+
+	if (asc->junk_packet_count > 0 && asc->junk_packet_min_size == asc->junk_packet_max_size)
+		asc->junk_packet_max_size++;
+
+	if (asc->junk_packet_max_size >= MESSAGE_MAX_SIZE) {
+		wg->advanced_security_config.junk_packet_min_size = 0;
+		wg->advanced_security_config.junk_packet_max_size = 1;
+
+		net_dbg_ratelimited("%s: JunkPacketMaxSize: %d; should be smaller than maxSegmentSize: %d\n",
+							dev->name, asc->junk_packet_max_size,
+							MESSAGE_MAX_SIZE);
+		ret = -EINVAL;
+	} else if (asc->junk_packet_max_size < asc->junk_packet_min_size) {
+		net_dbg_ratelimited("%s: maxSize: %d; should be greater than minSize: %d\n",
+							dev->name, asc->junk_packet_max_size,
+							asc->junk_packet_min_size);
+		ret = -EINVAL;
+	} else
+		wg->advanced_security_config.junk_packet_max_size = asc->junk_packet_max_size;
+
+	if (asc->junk_packet_max_size != 0)
+		a_sec_on = true;
+
+	if (asc->init_packet_junk_size + MESSAGE_INITIATION_SIZE >= MESSAGE_MAX_SIZE) {
+		net_dbg_ratelimited("%s: init header size (%d) + junkSize (%d) should be smaller than maxSegmentSize: %d\n",
+		                    dev->name, MESSAGE_INITIATION_SIZE,
+							asc->init_packet_junk_size, MESSAGE_MAX_SIZE);
+		ret = -EINVAL;
+	} else
+		wg->advanced_security_config.init_packet_junk_size = asc->init_packet_junk_size;
+
+	if (asc->init_packet_junk_size != 0)
+		a_sec_on = true;
+
+	if (asc->response_packet_junk_size + MESSAGE_RESPONSE_SIZE >= MESSAGE_MAX_SIZE) {
+		net_dbg_ratelimited("%s: response header size (%d) + junkSize (%d) should be smaller than maxSegmentSize: %d\n",
+		                    dev->name, MESSAGE_RESPONSE_SIZE,
+		                    asc->response_packet_junk_size, MESSAGE_MAX_SIZE);
+		ret = -EINVAL;
+	} else
+		wg->advanced_security_config.response_packet_junk_size = asc->response_packet_junk_size;
+
+	if (asc->response_packet_junk_size != 0)
+		a_sec_on = true;
+
+	if (asc->init_packet_magic_header > MESSAGE_DATA) {
+		a_sec_on = true;
+		wg->advanced_security_config.init_packet_magic_header = asc->init_packet_magic_header;
+	}
+
+	if (asc->response_packet_magic_header > MESSAGE_DATA) {
+		a_sec_on = true;
+		wg->advanced_security_config.response_packet_magic_header = asc->response_packet_magic_header;
+	}
+
+	if (asc->cookie_packet_magic_header > MESSAGE_DATA) {
+		a_sec_on = true;
+		wg->advanced_security_config.cookie_packet_magic_header = asc->cookie_packet_magic_header;
+	}
+
+	if (asc->transport_packet_magic_header > MESSAGE_DATA) {
+		a_sec_on = true;
+		wg->advanced_security_config.transport_packet_magic_header = asc->transport_packet_magic_header;
+	}
+
+	if (wg->advanced_security_config.init_packet_magic_header == wg->advanced_security_config.response_packet_magic_header ||
+			wg->advanced_security_config.init_packet_magic_header == wg->advanced_security_config.cookie_packet_magic_header ||
+			wg->advanced_security_config.init_packet_magic_header == wg->advanced_security_config.transport_packet_magic_header ||
+			wg->advanced_security_config.response_packet_magic_header == wg->advanced_security_config.cookie_packet_magic_header ||
+			wg->advanced_security_config.response_packet_magic_header == wg->advanced_security_config.transport_packet_magic_header ||
+			wg->advanced_security_config.cookie_packet_magic_header == wg->advanced_security_config.transport_packet_magic_header) {
+		net_dbg_ratelimited("%s: magic headers should differ; got: init:%d; recv:%d; unde:%d; tran:%d\n",
+		                    dev->name,
+							wg->advanced_security_config.init_packet_magic_header,
+		                    wg->advanced_security_config.response_packet_magic_header,
+							wg->advanced_security_config.cookie_packet_magic_header,
+							wg->advanced_security_config.transport_packet_magic_header);
+		ret = -EINVAL;
+	}
+
+	if (MESSAGE_INITIATION_SIZE + wg->advanced_security_config.init_packet_junk_size ==
+		MESSAGE_RESPONSE_SIZE + wg->advanced_security_config.response_packet_junk_size) {
+		net_dbg_ratelimited("%s: new init size:%d; and new response size:%d; should differ\n",
+		                    dev->name,
+		                    MESSAGE_INITIATION_SIZE + asc->init_packet_junk_size,
+		                    MESSAGE_RESPONSE_SIZE + asc->response_packet_junk_size);
+		ret = -EINVAL;
+	}
+
+	wg->advanced_security_config.advanced_security = a_sec_on;
+out:
+	return ret;
+}
diff --git a/drivers/net/wireguard/device.h b/drivers/net/wireguard/device.h
index 43c7cebbf50b..9bffb47ea52e 100644
--- a/drivers/net/wireguard/device.h
+++ b/drivers/net/wireguard/device.h
@@ -37,6 +37,19 @@ struct prev_queue {
 	atomic_t count;
 };
 
+struct amnezia_config {
+	bool advanced_security;
+	u16 junk_packet_count;
+	u16 junk_packet_min_size;
+	u16 junk_packet_max_size;
+	u16 init_packet_junk_size;
+	u16 response_packet_junk_size;
+	u32 init_packet_magic_header;
+	u32 response_packet_magic_header;
+	u32 cookie_packet_magic_header;
+	u32 transport_packet_magic_header;
+};
+
 struct wg_device {
 	struct net_device *dev;
 	struct crypt_queue encrypt_queue, decrypt_queue, handshake_queue;
@@ -50,6 +63,7 @@ struct wg_device {
 	struct allowedips peer_allowedips;
 	struct mutex device_update_lock, socket_update_lock;
 	struct list_head device_list, peer_list;
+	struct amnezia_config advanced_security_config;
 	atomic_t handshake_queue_len;
 	unsigned int num_peers, device_update_gen;
 	u32 fwmark;
@@ -58,5 +72,6 @@ struct wg_device {
 
 int wg_device_init(void);
 void wg_device_uninit(void);
+int wg_device_handle_post_config(struct net_device *dev, struct amnezia_config *asc);
 
 #endif /* _WG_DEVICE_H */
diff --git a/drivers/net/wireguard/main.c b/drivers/net/wireguard/main.c
index a00671b58701..41fd9630e6b1 100644
--- a/drivers/net/wireguard/main.c
+++ b/drivers/net/wireguard/main.c
@@ -45,7 +45,7 @@ static int __init wg_mod_init(void)
 	if (ret < 0)
 		goto err_netlink;
 
-	pr_info("WireGuard " WIREGUARD_VERSION " loaded. See www.wireguard.com for information.\n");
+	pr_info("Amnezia WireGuard " WIREGUARD_VERSION " loaded. See www.wireguard.com for information.\n");
 	pr_info("Copyright (C) 2015-2019 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.\n");
 
 	return 0;
@@ -71,7 +71,7 @@ static void __exit wg_mod_exit(void)
 module_init(wg_mod_init);
 module_exit(wg_mod_exit);
 MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("WireGuard secure network tunnel");
+MODULE_DESCRIPTION("Amnezia WireGuard secure network tunnel");
 MODULE_AUTHOR("Jason A. Donenfeld <Jason@zx2c4.com>");
 MODULE_VERSION(WIREGUARD_VERSION);
 MODULE_ALIAS_RTNL_LINK(KBUILD_MODNAME);
diff --git a/drivers/net/wireguard/messages.h b/drivers/net/wireguard/messages.h
index 208da72673fc..65b9ad1e5a6d 100644
--- a/drivers/net/wireguard/messages.h
+++ b/drivers/net/wireguard/messages.h
@@ -117,6 +117,16 @@ enum message_alignments {
 	MESSAGE_MINIMUM_LENGTH = message_data_len(0)
 };
 
+enum message_size {
+	MESSAGE_INITIATION_SIZE = sizeof(struct message_handshake_initiation),
+	MESSAGE_RESPONSE_SIZE = sizeof(struct message_handshake_response),
+	MESSAGE_COOKIE_REPLY_SIZE = sizeof(struct message_handshake_cookie),
+	MESSAGE_TRANSPORT_SIZE = sizeof(struct message_data),
+	MESSAGE_MAX_SIZE = 65535
+};
+
+#define SKB_TYPE_LE32(skb) (((struct message_header *)(skb)->data)->type)
+
 #define SKB_HEADER_LEN                                       \
 	(max(sizeof(struct iphdr), sizeof(struct ipv6hdr)) + \
 	 sizeof(struct udphdr) + NET_SKB_PAD)
diff --git a/drivers/net/wireguard/netlink.c b/drivers/net/wireguard/netlink.c
index f7055180ba4a..70cbff5a8fd2 100644
--- a/drivers/net/wireguard/netlink.c
+++ b/drivers/net/wireguard/netlink.c
@@ -27,7 +27,16 @@ static const struct nla_policy device_policy[WGDEVICE_A_MAX + 1] = {
 	[WGDEVICE_A_FLAGS]		= { .type = NLA_U32 },
 	[WGDEVICE_A_LISTEN_PORT]	= { .type = NLA_U16 },
 	[WGDEVICE_A_FWMARK]		= { .type = NLA_U32 },
-	[WGDEVICE_A_PEERS]		= { .type = NLA_NESTED }
+	[WGDEVICE_A_PEERS]		= { .type = NLA_NESTED },
+	[WGDEVICE_A_JC]			= { .type = NLA_U16 },
+	[WGDEVICE_A_JMIN]		= { .type = NLA_U16 },
+	[WGDEVICE_A_JMAX]		= { .type = NLA_U16 },
+	[WGDEVICE_A_S1]			= { .type = NLA_U16 },
+	[WGDEVICE_A_S2]			= { .type = NLA_U16 },
+	[WGDEVICE_A_H1]			= { .type = NLA_U32 },
+	[WGDEVICE_A_H2]			= { .type = NLA_U32 },
+	[WGDEVICE_A_H3]			= { .type = NLA_U32 },
+	[WGDEVICE_A_H4]			= { .type = NLA_U32 }
 };
 
 static const struct nla_policy peer_policy[WGPEER_A_MAX + 1] = {
@@ -40,7 +49,8 @@ static const struct nla_policy peer_policy[WGPEER_A_MAX + 1] = {
 	[WGPEER_A_RX_BYTES]				= { .type = NLA_U64 },
 	[WGPEER_A_TX_BYTES]				= { .type = NLA_U64 },
 	[WGPEER_A_ALLOWEDIPS]				= { .type = NLA_NESTED },
-	[WGPEER_A_PROTOCOL_VERSION]			= { .type = NLA_U32 }
+	[WGPEER_A_PROTOCOL_VERSION]			= { .type = NLA_U32 },
+	[WGPEER_A_ADVANCED_SECURITY]    		= { .type = NLA_FLAG }
 };
 
 static const struct nla_policy allowedip_policy[WGALLOWEDIP_A_MAX + 1] = {
@@ -142,7 +152,9 @@ get_peer(struct wg_peer *peer, struct sk_buff *skb, struct dump_ctx *ctx)
 				      WGPEER_A_UNSPEC) ||
 		    nla_put_u64_64bit(skb, WGPEER_A_RX_BYTES, peer->rx_bytes,
 				      WGPEER_A_UNSPEC) ||
-		    nla_put_u32(skb, WGPEER_A_PROTOCOL_VERSION, 1))
+		    nla_put_u32(skb, WGPEER_A_PROTOCOL_VERSION, 1) ||
+		    (peer->advanced_security &&
+		     nla_put_flag(skb, WGPEER_A_ADVANCED_SECURITY)))
 			goto err;
 
 		read_lock_bh(&peer->endpoint_lock);
@@ -233,7 +245,25 @@ static int wg_get_device_dump(struct sk_buff *skb, struct netlink_callback *cb)
 				wg->incoming_port) ||
 		    nla_put_u32(skb, WGDEVICE_A_FWMARK, wg->fwmark) ||
 		    nla_put_u32(skb, WGDEVICE_A_IFINDEX, wg->dev->ifindex) ||
-		    nla_put_string(skb, WGDEVICE_A_IFNAME, wg->dev->name))
+		    nla_put_string(skb, WGDEVICE_A_IFNAME, wg->dev->name) ||
+		    nla_put_u16(skb, WGDEVICE_A_JC,
+					    wg->advanced_security_config.junk_packet_count) ||
+		    nla_put_u16(skb, WGDEVICE_A_JMIN,
+					    wg->advanced_security_config.junk_packet_min_size) ||
+		    nla_put_u16(skb, WGDEVICE_A_JMAX,
+					    wg->advanced_security_config.junk_packet_max_size) ||
+		    nla_put_u16(skb, WGDEVICE_A_S1,
+					    wg->advanced_security_config.init_packet_junk_size) ||
+		    nla_put_u16(skb, WGDEVICE_A_S2,
+					    wg->advanced_security_config.response_packet_junk_size) ||
+		    nla_put_u32(skb, WGDEVICE_A_H1,
+					    wg->advanced_security_config.init_packet_magic_header) ||
+		    nla_put_u32(skb, WGDEVICE_A_H2,
+					    wg->advanced_security_config.response_packet_magic_header) ||
+		    nla_put_u32(skb, WGDEVICE_A_H3,
+					    wg->advanced_security_config.cookie_packet_magic_header) ||
+		    nla_put_u32(skb, WGDEVICE_A_H4,
+					    wg->advanced_security_config.transport_packet_magic_header))
 			goto out;
 
 		down_read(&wg->static_identity.lock);
@@ -479,6 +509,11 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs)
 			wg_packet_send_keepalive(peer);
 	}
 
+	if (attrs[WGPEER_A_ADVANCED_SECURITY] || flags & WGPEER_F_SET_ADVANCED_SECURITY) {
+		peer->advanced_security = wg->advanced_security_config.advanced_security &&
+				nla_get_flag(attrs[WGPEER_A_ADVANCED_SECURITY]);
+	}
+
 	if (netif_running(wg->dev))
 		wg_packet_send_staged_packets(peer);
 
@@ -493,6 +528,7 @@ static int set_peer(struct wg_device *wg, struct nlattr **attrs)
 static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
 {
 	struct wg_device *wg = lookup_interface(info->attrs, skb);
+	struct amnezia_config *asc = kzalloc(sizeof(*asc), GFP_KERNEL);
 	u32 flags = 0;
 	int ret;
 
@@ -537,6 +573,51 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
 			goto out;
 	}
 
+	if (info->attrs[WGDEVICE_A_JC]) {
+		asc->advanced_security = true;
+		asc->junk_packet_count = nla_get_u16(info->attrs[WGDEVICE_A_JC]);
+	}
+
+	if (info->attrs[WGDEVICE_A_JMIN]) {
+		asc->advanced_security = true;
+		asc->junk_packet_min_size = nla_get_u16(info->attrs[WGDEVICE_A_JMIN]);
+	}
+
+	if (info->attrs[WGDEVICE_A_JMAX]) {
+		asc->advanced_security = true;
+		asc->junk_packet_max_size = nla_get_u16(info->attrs[WGDEVICE_A_JMAX]);
+	}
+
+	if (info->attrs[WGDEVICE_A_S1]) {
+		asc->advanced_security = true;
+		asc->init_packet_junk_size = nla_get_u16(info->attrs[WGDEVICE_A_S1]);
+	}
+
+	if (info->attrs[WGDEVICE_A_S2]) {
+		asc->advanced_security = true;
+		asc->response_packet_junk_size = nla_get_u16(info->attrs[WGDEVICE_A_S2]);
+	}
+
+	if (info->attrs[WGDEVICE_A_H1]) {
+		asc->advanced_security = true;
+		asc->init_packet_magic_header = nla_get_u32(info->attrs[WGDEVICE_A_H1]);
+	}
+
+	if (info->attrs[WGDEVICE_A_H2]) {
+		asc->advanced_security = true;
+		asc->response_packet_magic_header = nla_get_u32(info->attrs[WGDEVICE_A_H2]);
+	}
+
+	if (info->attrs[WGDEVICE_A_H3]) {
+		asc->advanced_security = true;
+		asc->cookie_packet_magic_header = nla_get_u32(info->attrs[WGDEVICE_A_H3]);
+	}
+
+	if (info->attrs[WGDEVICE_A_H4]) {
+		asc->advanced_security = true;
+		asc->transport_packet_magic_header = nla_get_u32(info->attrs[WGDEVICE_A_H4]);
+	}
+
 	if (flags & WGDEVICE_F_REPLACE_PEERS)
 		wg_peer_remove_all(wg);
 
@@ -580,6 +661,10 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
 	}
 skip_set_private_key:
 
+	ret = wg_device_handle_post_config(wg->dev, asc);
+	if (ret < 0)
+		goto out;
+
 	if (info->attrs[WGDEVICE_A_PEERS]) {
 		struct nlattr *attr, *peer[WGPEER_A_MAX + 1];
 		int rem;
@@ -601,6 +686,7 @@ static int wg_set_device(struct sk_buff *skb, struct genl_info *info)
 	rtnl_unlock();
 	dev_put(wg->dev);
 out_nodev:
+	kfree(asc);
 	if (info->attrs[WGDEVICE_A_PRIVATE_KEY])
 		memzero_explicit(nla_data(info->attrs[WGDEVICE_A_PRIVATE_KEY]),
 				 nla_len(info->attrs[WGDEVICE_A_PRIVATE_KEY]));
diff --git a/drivers/net/wireguard/noise.c b/drivers/net/wireguard/noise.c
index 202a33af5a72..433c2adcd93f 100644
--- a/drivers/net/wireguard/noise.c
+++ b/drivers/net/wireguard/noise.c
@@ -515,7 +515,7 @@ static void tai64n_now(u8 output[NOISE_TIMESTAMP_LEN])
 
 bool
 wg_noise_handshake_create_initiation(struct message_handshake_initiation *dst,
-				     struct noise_handshake *handshake)
+				     struct noise_handshake *handshake, u32 message_type)
 {
 	u8 timestamp[NOISE_TIMESTAMP_LEN];
 	u8 key[NOISE_SYMMETRIC_KEY_LEN];
@@ -532,7 +532,7 @@ wg_noise_handshake_create_initiation(struct message_handshake_initiation *dst,
 	if (unlikely(!handshake->static_identity->has_identity))
 		goto out;
 
-	dst->header.type = cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION);
+	dst->header.type = cpu_to_le32(message_type);
 
 	handshake_init(handshake->chaining_key, handshake->hash,
 		       handshake->remote_static);
@@ -582,7 +582,7 @@ wg_noise_handshake_create_initiation(struct message_handshake_initiation *dst,
 
 struct wg_peer *
 wg_noise_handshake_consume_initiation(struct message_handshake_initiation *src,
-				      struct wg_device *wg)
+				      struct wg_device *wg, u32 message_type)
 {
 	struct wg_peer *peer = NULL, *ret_peer = NULL;
 	struct noise_handshake *handshake;
@@ -617,6 +617,10 @@ wg_noise_handshake_consume_initiation(struct message_handshake_initiation *src,
 	peer = wg_pubkey_hashtable_lookup(wg->peer_hashtable, s);
 	if (!peer)
 		goto out;
+
+	if (peer->advanced_security != (message_type != MESSAGE_HANDSHAKE_INITIATION))
+		goto out;
+
 	handshake = &peer->handshake;
 
 	/* ss */
@@ -659,13 +663,14 @@ wg_noise_handshake_consume_initiation(struct message_handshake_initiation *src,
 	memzero_explicit(hash, NOISE_HASH_LEN);
 	memzero_explicit(chaining_key, NOISE_HASH_LEN);
 	up_read(&wg->static_identity.lock);
+
 	if (!ret_peer)
 		wg_peer_put(peer);
 	return ret_peer;
 }
 
 bool wg_noise_handshake_create_response(struct message_handshake_response *dst,
-					struct noise_handshake *handshake)
+					struct noise_handshake *handshake, u32 message_type)
 {
 	u8 key[NOISE_SYMMETRIC_KEY_LEN];
 	bool ret = false;
@@ -681,7 +686,7 @@ bool wg_noise_handshake_create_response(struct message_handshake_response *dst,
 	if (handshake->state != HANDSHAKE_CONSUMED_INITIATION)
 		goto out;
 
-	dst->header.type = cpu_to_le32(MESSAGE_HANDSHAKE_RESPONSE);
+	dst->header.type = cpu_to_le32(message_type);
 	dst->receiver_index = handshake->remote_index;
 
 	/* e */
diff --git a/drivers/net/wireguard/noise.h b/drivers/net/wireguard/noise.h
index c527253dba80..091719e4a5e6 100644
--- a/drivers/net/wireguard/noise.h
+++ b/drivers/net/wireguard/noise.h
@@ -118,13 +118,13 @@ void wg_noise_precompute_static_static(struct wg_peer *peer);
 
 bool
 wg_noise_handshake_create_initiation(struct message_handshake_initiation *dst,
-				     struct noise_handshake *handshake);
+				     struct noise_handshake *handshake, u32 message_type);
 struct wg_peer *
 wg_noise_handshake_consume_initiation(struct message_handshake_initiation *src,
-				      struct wg_device *wg);
+				      struct wg_device *wg, u32 message_type);
 
 bool wg_noise_handshake_create_response(struct message_handshake_response *dst,
-					struct noise_handshake *handshake);
+					struct noise_handshake *handshake, u32 message_type);
 struct wg_peer *
 wg_noise_handshake_consume_response(struct message_handshake_response *src,
 				    struct wg_device *wg);
diff --git a/drivers/net/wireguard/peer.c b/drivers/net/wireguard/peer.c
index 1cb502a932e0..98ea8edcf48d 100644
--- a/drivers/net/wireguard/peer.c
+++ b/drivers/net/wireguard/peer.c
@@ -41,6 +41,7 @@ struct wg_peer *wg_peer_create(struct wg_device *wg,
 				public_key, preshared_key, peer);
 	peer->internal_id = atomic64_inc_return(&peer_counter);
 	peer->serial_work_cpu = nr_cpumask_bits;
+	peer->advanced_security = wg->advanced_security_config.advanced_security;
 	wg_cookie_init(&peer->latest_cookie);
 	wg_timers_init(peer);
 	wg_cookie_checker_precompute_peer_keys(peer);
diff --git a/drivers/net/wireguard/peer.h b/drivers/net/wireguard/peer.h
index 76e4d3128ad4..c6b78523468b 100644
--- a/drivers/net/wireguard/peer.h
+++ b/drivers/net/wireguard/peer.h
@@ -64,6 +64,7 @@ struct wg_peer {
 	struct list_head allowedips_list;
 	struct napi_struct napi;
 	u64 internal_id;
+	bool advanced_security;
 };
 
 struct wg_peer *wg_peer_create(struct wg_device *wg,
diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
index eb8851113654..82d1e1fb90d1 100644
--- a/drivers/net/wireguard/receive.c
+++ b/drivers/net/wireguard/receive.c
@@ -23,27 +23,60 @@ static void update_rx_stats(struct wg_peer *peer, size_t len)
 	peer->rx_bytes += len;
 }
 
-#define SKB_TYPE_LE32(skb) (((struct message_header *)(skb)->data)->type)
-
-static size_t validate_header_len(struct sk_buff *skb)
+static size_t validate_header_len(struct sk_buff *skb, struct wg_device *wg)
 {
 	if (unlikely(skb->len < sizeof(struct message_header)))
 		return 0;
-	if (SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_DATA) &&
+	if ((SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.transport_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_DATA)) &&
 	    skb->len >= MESSAGE_MINIMUM_LENGTH)
 		return sizeof(struct message_data);
-	if (SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION) &&
-	    skb->len == sizeof(struct message_handshake_initiation))
-		return sizeof(struct message_handshake_initiation);
-	if (SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_RESPONSE) &&
-	    skb->len == sizeof(struct message_handshake_response))
-		return sizeof(struct message_handshake_response);
-	if (SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE) &&
-	    skb->len == sizeof(struct message_handshake_cookie))
-		return sizeof(struct message_handshake_cookie);
+	if ((SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.init_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION)) &&
+	    skb->len == MESSAGE_INITIATION_SIZE)
+		return MESSAGE_INITIATION_SIZE;
+	if ((SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.response_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_RESPONSE)) &&
+	    skb->len == MESSAGE_RESPONSE_SIZE)
+		return MESSAGE_RESPONSE_SIZE;
+	if ((SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.cookie_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE)) &&
+	    skb->len == MESSAGE_COOKIE_REPLY_SIZE)
+		return MESSAGE_COOKIE_REPLY_SIZE;
 	return 0;
 }
 
+static void prepare_advanced_secured_message(struct sk_buff *skb, struct wg_device *wg)
+{
+	u32 assumed_type, assumed_offset;
+
+	if (wg->advanced_security_config.advanced_security) {
+		if (skb->len == MESSAGE_INITIATION_SIZE + wg->advanced_security_config.init_packet_junk_size) {
+			assumed_type = cpu_to_le32(wg->advanced_security_config.init_packet_magic_header);
+			assumed_offset = wg->advanced_security_config.init_packet_junk_size;
+		} else if (skb->len == MESSAGE_RESPONSE_SIZE + wg->advanced_security_config.response_packet_junk_size) {
+			assumed_type = cpu_to_le32(wg->advanced_security_config.response_packet_magic_header);
+			assumed_offset = wg->advanced_security_config.response_packet_junk_size;
+		} else
+			return;
+
+		if (unlikely(assumed_offset <= 0) || unlikely(!pskb_may_pull(skb, assumed_offset)))
+			return;
+
+		if (skb_is_nonlinear(skb) && unlikely(skb_linearize(skb))) {
+			net_dbg_skb_ratelimited("%s: non-linear sk_buff from %pISpfsc could not be linearized, dropping packet\n",
+			                        wg->dev->name, skb);
+			return;
+		}
+
+		skb_pull(skb, assumed_offset);
+
+		if (SKB_TYPE_LE32(skb) != assumed_type) {
+			skb_push(skb, assumed_offset);
+		}
+	}
+}
+
 static int prepare_skb_header(struct sk_buff *skb, struct wg_device *wg)
 {
 	size_t data_offset, data_len, header_len;
@@ -79,7 +112,8 @@ static int prepare_skb_header(struct sk_buff *skb, struct wg_device *wg)
 	if (unlikely(skb->len != data_len))
 		/* Final len does not agree with calculated len */
 		return -EINVAL;
-	header_len = validate_header_len(skb);
+	prepare_advanced_secured_message(skb, wg);
+	header_len = validate_header_len(skb, wg);
 	if (unlikely(!header_len))
 		return -EINVAL;
 	__skb_push(skb, data_offset);
@@ -101,7 +135,8 @@ static void wg_receive_handshake_packet(struct wg_device *wg,
 	bool packet_needs_cookie;
 	bool under_load;
 
-	if (SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE)) {
+	if (SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.cookie_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE)) {
 		net_dbg_skb_ratelimited("%s: Receiving cookie response from %pISpfsc\n",
 					wg->dev->name, skb);
 		wg_cookie_message_consume(
@@ -131,8 +166,8 @@ static void wg_receive_handshake_packet(struct wg_device *wg,
 		return;
 	}
 
-	switch (SKB_TYPE_LE32(skb)) {
-	case cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION): {
+	if (SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.init_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION)) {
 		struct message_handshake_initiation *message =
 			(struct message_handshake_initiation *)skb->data;
 
@@ -141,7 +176,8 @@ static void wg_receive_handshake_packet(struct wg_device *wg,
 							message->sender_index);
 			return;
 		}
-		peer = wg_noise_handshake_consume_initiation(message, wg);
+		peer = wg_noise_handshake_consume_initiation(message, wg,
+							     le32_to_cpu(SKB_TYPE_LE32(skb)));
 		if (unlikely(!peer)) {
 			net_dbg_skb_ratelimited("%s: Invalid handshake initiation from %pISpfsc\n",
 						wg->dev->name, skb);
@@ -152,9 +188,9 @@ static void wg_receive_handshake_packet(struct wg_device *wg,
 				    wg->dev->name, peer->internal_id,
 				    &peer->endpoint.addr);
 		wg_packet_send_handshake_response(peer);
-		break;
 	}
-	case cpu_to_le32(MESSAGE_HANDSHAKE_RESPONSE): {
+	if (SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.response_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_RESPONSE)) {
 		struct message_handshake_response *message =
 			(struct message_handshake_response *)skb->data;
 
@@ -185,8 +221,6 @@ static void wg_receive_handshake_packet(struct wg_device *wg,
 			 */
 			wg_packet_send_keepalive(peer);
 		}
-		break;
-	}
 	}
 
 	if (unlikely(!peer)) {
@@ -543,10 +577,13 @@ void wg_packet_receive(struct wg_device *wg, struct sk_buff *skb)
 {
 	if (unlikely(prepare_skb_header(skb, wg) < 0))
 		goto err;
-	switch (SKB_TYPE_LE32(skb)) {
-	case cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION):
-	case cpu_to_le32(MESSAGE_HANDSHAKE_RESPONSE):
-	case cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE): {
+
+	if (SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.init_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.response_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.cookie_packet_magic_header) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_RESPONSE) ||
+	    SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_HANDSHAKE_COOKIE)) {
 		int cpu, ret = -EBUSY;
 
 		if (unlikely(!rng_is_initialized()))
@@ -559,23 +596,21 @@ void wg_packet_receive(struct wg_device *wg, struct sk_buff *skb)
 		} else
 			ret = ptr_ring_produce_bh(&wg->handshake_queue.ring, skb);
 		if (ret) {
-	drop:
+drop:
 			net_dbg_skb_ratelimited("%s: Dropping handshake packet from %pISpfsc\n",
-						wg->dev->name, skb);
+			                        wg->dev->name, skb);
 			goto err;
 		}
 		atomic_inc(&wg->handshake_queue_len);
 		cpu = wg_cpumask_next_online(&wg->handshake_queue.last_cpu);
 		/* Queues up a call to packet_process_queued_handshake_packets(skb): */
 		queue_work_on(cpu, wg->handshake_receive_wq,
-			      &per_cpu_ptr(wg->handshake_queue.worker, cpu)->work);
-		break;
-	}
-	case cpu_to_le32(MESSAGE_DATA):
+		              &per_cpu_ptr(wg->handshake_queue.worker, cpu)->work);
+	} else if (SKB_TYPE_LE32(skb) == cpu_to_le32(wg->advanced_security_config.transport_packet_magic_header) ||
+	           SKB_TYPE_LE32(skb) == cpu_to_le32(MESSAGE_DATA)) {
 		PACKET_CB(skb)->ds = ip_tunnel_get_dsfield(ip_hdr(skb), skb);
 		wg_packet_consume_data(wg, skb);
-		break;
-	default:
+	} else {
 		WARN(1, "Non-exhaustive parsing of packet header lead to unknown packet type!\n");
 		goto err;
 	}
diff --git a/drivers/net/wireguard/send.c b/drivers/net/wireguard/send.c
index 26e09c30d596..19695bde69c1 100644
--- a/drivers/net/wireguard/send.c
+++ b/drivers/net/wireguard/send.c
@@ -14,13 +14,27 @@
 #include <linux/uio.h>
 #include <linux/inetdevice.h>
 #include <linux/socket.h>
+#include <linux/random.h>
 #include <net/ip_tunnels.h>
 #include <net/udp.h>
 #include <net/sock.h>
 
+static u32 wg_get_random_u32_inclusive(u32 floor, u32 ceil)
+{
+	u32 diff = ceil - floor + 1;
+	return floor + (get_random_u32() % diff);
+}
+
 static void wg_packet_send_handshake_initiation(struct wg_peer *peer)
 {
 	struct message_handshake_initiation packet;
+	struct wg_device *wg = peer->device;
+	void *buffer;
+	u8 ds;
+	u16 junk_packet_count, junk_packet_size;
+
+	u32 init_packet_magic_header = peer->advanced_security ?
+		wg->advanced_security_config.init_packet_magic_header : MESSAGE_HANDSHAKE_INITIATION;
 
 	if (!wg_birthdate_has_expired(atomic64_read(&peer->last_sent_handshake),
 				      REKEY_TIMEOUT))
@@ -31,14 +45,40 @@ static void wg_packet_send_handshake_initiation(struct wg_peer *peer)
 			    peer->device->dev->name, peer->internal_id,
 			    &peer->endpoint.addr);
 
-	if (wg_noise_handshake_create_initiation(&packet, &peer->handshake)) {
+	if (wg->advanced_security_config.advanced_security && peer->advanced_security) {
+		junk_packet_count = wg->advanced_security_config.junk_packet_count;
+		buffer = kzalloc(wg->advanced_security_config.junk_packet_max_size, GFP_KERNEL);
+
+		while (junk_packet_count-- > 0) {
+			junk_packet_size = (u16) wg_get_random_u32_inclusive(
+					wg->advanced_security_config.junk_packet_min_size,
+					wg->advanced_security_config.junk_packet_max_size);
+
+			get_random_bytes(buffer, junk_packet_size);
+			get_random_bytes(&ds, 1);
+			wg_socket_send_buffer_to_peer(peer, buffer, junk_packet_size, ds);
+		}
+
+		kfree(buffer);
+	}
+
+	net_dbg_ratelimited("%s: Initiation magic header: %u\n",
+	                    peer->device->dev->name, init_packet_magic_header);
+
+	if (wg_noise_handshake_create_initiation(&packet, &peer->handshake, init_packet_magic_header)) {
 		wg_cookie_add_mac_to_packet(&packet, sizeof(packet), peer);
 		wg_timers_any_authenticated_packet_traversal(peer);
 		wg_timers_any_authenticated_packet_sent(peer);
 		atomic64_set(&peer->last_sent_handshake,
 			     ktime_get_coarse_boottime_ns());
-		wg_socket_send_buffer_to_peer(peer, &packet, sizeof(packet),
-					      HANDSHAKE_DSCP);
+
+		if (wg->advanced_security_config.advanced_security && peer->advanced_security) {
+			wg_socket_send_junked_buffer_to_peer(peer, &packet, sizeof(packet),
+			                              HANDSHAKE_DSCP, wg->advanced_security_config.init_packet_junk_size);
+		} else {
+			wg_socket_send_buffer_to_peer(peer, &packet, sizeof(packet),
+			                              HANDSHAKE_DSCP);
+		}
 		wg_timers_handshake_initiated(peer);
 	}
 }
@@ -85,13 +125,17 @@ void wg_packet_send_queued_handshake_initiation(struct wg_peer *peer,
 void wg_packet_send_handshake_response(struct wg_peer *peer)
 {
 	struct message_handshake_response packet;
+	struct wg_device *wg = peer->device;
 
 	atomic64_set(&peer->last_sent_handshake, ktime_get_coarse_boottime_ns());
 	net_dbg_ratelimited("%s: Sending handshake response to peer %llu (%pISpfsc)\n",
 			    peer->device->dev->name, peer->internal_id,
 			    &peer->endpoint.addr);
 
-	if (wg_noise_handshake_create_response(&packet, &peer->handshake)) {
+	if (wg_noise_handshake_create_response(&packet, &peer->handshake,
+		                                   peer->advanced_security ?
+		                                   wg->advanced_security_config.response_packet_magic_header :
+		                                   MESSAGE_HANDSHAKE_RESPONSE)) {
 		wg_cookie_add_mac_to_packet(&packet, sizeof(packet), peer);
 		if (wg_noise_handshake_begin_session(&peer->handshake,
 						     &peer->keypairs)) {
@@ -100,9 +144,16 @@ void wg_packet_send_handshake_response(struct wg_peer *peer)
 			wg_timers_any_authenticated_packet_sent(peer);
 			atomic64_set(&peer->last_sent_handshake,
 				     ktime_get_coarse_boottime_ns());
-			wg_socket_send_buffer_to_peer(peer, &packet,
-						      sizeof(packet),
-						      HANDSHAKE_DSCP);
+			if (wg->advanced_security_config.advanced_security && peer->advanced_security) {
+				wg_socket_send_junked_buffer_to_peer(peer, &packet,
+				                              sizeof(packet),
+				                              HANDSHAKE_DSCP,
+				                              wg->advanced_security_config.response_packet_junk_size);
+			} else {
+				wg_socket_send_buffer_to_peer(peer, &packet,
+							      sizeof(packet),
+							      HANDSHAKE_DSCP);
+			}
 		}
 	}
 }
@@ -115,8 +166,16 @@ void wg_packet_send_handshake_cookie(struct wg_device *wg,
 
 	net_dbg_skb_ratelimited("%s: Sending cookie response for denied handshake message for %pISpfsc\n",
 				wg->dev->name, initiating_skb);
-	wg_cookie_message_create(&packet, initiating_skb, sender_index,
-				 &wg->cookie_checker);
+
+	if (SKB_TYPE_LE32(initiating_skb) == cpu_to_le32(MESSAGE_HANDSHAKE_INITIATION) ||
+	    SKB_TYPE_LE32(initiating_skb) == cpu_to_le32(MESSAGE_HANDSHAKE_RESPONSE)) {
+		wg_cookie_message_create(&packet, initiating_skb, sender_index,
+		                         &wg->cookie_checker, MESSAGE_HANDSHAKE_COOKIE);
+
+	} else {
+		wg_cookie_message_create(&packet, initiating_skb, sender_index,
+		                         &wg->cookie_checker, wg->advanced_security_config.cookie_packet_magic_header);
+	}
 	wg_socket_send_buffer_as_reply_to_skb(wg, initiating_skb, &packet,
 					      sizeof(packet));
 }
@@ -159,7 +218,7 @@ static unsigned int calculate_skb_padding(struct sk_buff *skb)
 	return padded_size - last_unit;
 }
 
-static bool encrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair)
+static bool encrypt_packet(u32 message_type, struct sk_buff *skb, struct noise_keypair *keypair)
 {
 	unsigned int padding_len, plaintext_len, trailer_len;
 	struct scatterlist sg[MAX_SKB_FRAGS + 8];
@@ -203,7 +262,7 @@ static bool encrypt_packet(struct sk_buff *skb, struct noise_keypair *keypair)
 	 */
 	skb_set_inner_network_header(skb, 0);
 	header = (struct message_data *)skb_push(skb, sizeof(*header));
-	header->header.type = cpu_to_le32(MESSAGE_DATA);
+	header->header.type = cpu_to_le32(message_type);
 	header->key_idx = keypair->remote_index;
 	header->counter = cpu_to_le64(PACKET_CB(skb)->nonce);
 	pskb_put(skb, trailer, trailer_len);
@@ -289,13 +348,19 @@ void wg_packet_encrypt_worker(struct work_struct *work)
 	struct crypt_queue *queue = container_of(work, struct multicore_worker,
 						 work)->ptr;
 	struct sk_buff *first, *skb, *next;
+	struct wg_peer *peer;
+	struct wg_device *wg;
 
 	while ((first = ptr_ring_consume_bh(&queue->ring)) != NULL) {
 		enum packet_state state = PACKET_STATE_CRYPTED;
 
 		skb_list_walk_safe(first, skb, next) {
-			if (likely(encrypt_packet(skb,
-					PACKET_CB(first)->keypair))) {
+			peer = PACKET_PEER(first);
+			wg = peer->device;
+			if (likely(encrypt_packet(peer->advanced_security ?
+						  wg->advanced_security_config.transport_packet_magic_header : MESSAGE_DATA,
+						  skb,
+						  PACKET_CB(first)->keypair))) {
 				wg_reset_packet(skb, true);
 			} else {
 				state = PACKET_STATE_DEAD;
diff --git a/drivers/net/wireguard/socket.c b/drivers/net/wireguard/socket.c
index 0414d7a6ce74..23fa6d12a4eb 100644
--- a/drivers/net/wireguard/socket.c
+++ b/drivers/net/wireguard/socket.c
@@ -200,6 +200,18 @@ int wg_socket_send_buffer_to_peer(struct wg_peer *peer, void *buffer,
 	return wg_socket_send_skb_to_peer(peer, skb, ds);
 }
 
+int wg_socket_send_junked_buffer_to_peer(struct wg_peer *peer, void *buffer,
+                                          size_t len, u8 ds, u16 junk_size)
+{
+	int ret;
+	void *new_buffer = kzalloc(len + junk_size, GFP_KERNEL);
+	get_random_bytes(new_buffer, junk_size);
+	memcpy(new_buffer + junk_size, buffer, len);
+	ret = wg_socket_send_buffer_to_peer(peer, new_buffer, len + junk_size, ds);
+	kfree(new_buffer);
+	return ret;
+}
+
 int wg_socket_send_buffer_as_reply_to_skb(struct wg_device *wg,
 					  struct sk_buff *in_skb, void *buffer,
 					  size_t len)
diff --git a/drivers/net/wireguard/socket.h b/drivers/net/wireguard/socket.h
index bab5848efbcd..e4e3f96eaf9b 100644
--- a/drivers/net/wireguard/socket.h
+++ b/drivers/net/wireguard/socket.h
@@ -16,6 +16,8 @@ void wg_socket_reinit(struct wg_device *wg, struct sock *new4,
 		      struct sock *new6);
 int wg_socket_send_buffer_to_peer(struct wg_peer *peer, void *data,
 				  size_t len, u8 ds);
+int wg_socket_send_junked_buffer_to_peer(struct wg_peer *peer, void *data,
+                                  size_t len, u8 ds, u16 junk_size);
 int wg_socket_send_skb_to_peer(struct wg_peer *peer, struct sk_buff *skb,
 			       u8 ds);
 int wg_socket_send_buffer_as_reply_to_skb(struct wg_device *wg,
diff --git a/include/uapi/linux/wireguard.h b/include/uapi/linux/wireguard.h
index ae88be14c947..2270094d47d0 100644
--- a/include/uapi/linux/wireguard.h
+++ b/include/uapi/linux/wireguard.h
@@ -49,9 +49,19 @@
  *                    ...
  *                ...
  *            WGPEER_A_PROTOCOL_VERSION: NLA_U32
+ *            WGPEER_A_ADVANCED_SECURITY: NLA_FLAG
  *        0: NLA_NESTED
  *            ...
  *        ...
+ *    WGDEVICE_A_JC: NLA_U16
+ *    WGDEVICE_A_JMIN: NLA_U16
+ *    WGDEVICE_A_JMAX: NLA_U16
+ *    WGDEVICE_A_S1: NLA_U16
+ *    WGDEVICE_A_S2: NLA_U16
+ *    WGDEVICE_A_H1: NLA_U32
+ *    WGDEVICE_A_H2: NLA_U32
+ *    WGDEVICE_A_H3: NLA_U32
+ *    WGDEVICE_A_H4: NLA_U32
  *
  * It is possible that all of the allowed IPs of a single peer will not
  * fit within a single netlink message. In that case, the same peer will
@@ -111,9 +121,21 @@
  *                                       most recent protocol will be used when
  *                                       this is unset. Otherwise, must be set
  *                                       to 1.
+ *            WGPEER_A_ADVANCED_SECURITY: NLA_FLAG, flag indicating that
+ *                                        advanced security techniques provided
+ *                                        by AmneziaWG should be used.
  *        0: NLA_NESTED
  *            ...
  *        ...
+ *    WGDEVICE_A_JC: NLA_U16, junk packet count (Jc)
+ *    WGDEVICE_A_JMIN: NLA_U16, junk packet minimum size (Jmin)
+ *    WGDEVICE_A_JMAX: NLA_U16, junk packet maximum size (Jmax)
+ *    WGDEVICE_A_S1: NLA_U16, init packet junk size (S1)
+ *    WGDEVICE_A_S2: NLA_U16, response packet junk size (S2)
+ *    WGDEVICE_A_H1: NLA_U32, init packet magic header (H1)
+ *    WGDEVICE_A_H2: NLA_U32, response packet magic header (H2)
+ *    WGDEVICE_A_H3: NLA_U32, cookie packet magic header (H3)
+ *    WGDEVICE_A_H4: NLA_U32, transport packet magic header (H4)
  *
  * It is possible that the amount of configuration data exceeds that of
  * the maximum message length accepted by the kernel. In that case, several
@@ -157,6 +179,15 @@ enum wgdevice_attribute {
 	WGDEVICE_A_LISTEN_PORT,
 	WGDEVICE_A_FWMARK,
 	WGDEVICE_A_PEERS,
+	WGDEVICE_A_JC,
+	WGDEVICE_A_JMIN,
+	WGDEVICE_A_JMAX,
+	WGDEVICE_A_S1,
+	WGDEVICE_A_S2,
+	WGDEVICE_A_H1,
+	WGDEVICE_A_H2,
+	WGDEVICE_A_H3,
+	WGDEVICE_A_H4,
 	__WGDEVICE_A_LAST
 };
 #define WGDEVICE_A_MAX (__WGDEVICE_A_LAST - 1)
@@ -165,8 +196,9 @@ enum wgpeer_flag {
 	WGPEER_F_REMOVE_ME = 1U << 0,
 	WGPEER_F_REPLACE_ALLOWEDIPS = 1U << 1,
 	WGPEER_F_UPDATE_ONLY = 1U << 2,
+	WGPEER_F_SET_ADVANCED_SECURITY = 1U << 3,
 	__WGPEER_F_ALL = WGPEER_F_REMOVE_ME | WGPEER_F_REPLACE_ALLOWEDIPS |
-			 WGPEER_F_UPDATE_ONLY
+			 WGPEER_F_UPDATE_ONLY | WGPEER_F_SET_ADVANCED_SECURITY
 };
 enum wgpeer_attribute {
 	WGPEER_A_UNSPEC,
@@ -180,6 +212,7 @@ enum wgpeer_attribute {
 	WGPEER_A_TX_BYTES,
 	WGPEER_A_ALLOWEDIPS,
 	WGPEER_A_PROTOCOL_VERSION,
+	WGPEER_A_ADVANCED_SECURITY,
 	__WGPEER_A_LAST
 };
 #define WGPEER_A_MAX (__WGPEER_A_LAST - 1)
-- 
2.44.1