Post B5o0cPKkyjDmssSMl6 by mirabilos@toot.mirbsd.org
 (DIR) More posts by mirabilos@toot.mirbsd.org
 (DIR) Post #B5nz2HiTirBqsclP3w by equinox@chaos.social
       0 likes, 0 repeats
       
       I don't understand why everyone is picking on algif_aead for copy.fail. It's authencesn that's actually fucking things up.Sure, you could keep using authencesn for IPsec if you break AF_ALG AEADs. But why? I'd rather break ESN support in IPsec and keep AF_ALG working for AEADs.It doesn't even break IPsec, it just makes it rotate keys more often in very high bandwidth situations.
       
 (DIR) Post #B5nz2IFRkHYsWsBjRw by lanodan@queer.hacktivis.me
       0 likes, 0 repeats
       
       @equinox Well it's what CVE-2026-31431 mentions, what it's linked commits to stable modify, and what the python PoC seems to be using.
       
 (DIR) Post #B5nz6q4XviOyajG0bw by mirabilos@toot.mirbsd.org
       1 likes, 0 repeats
       
       @equinox the website makes it sound as if you actually want to block the af_alg module as there will be more things to be disclosed
       
 (DIR) Post #B5o0cPBXWzqgQI90OO by equinox@chaos.social
       0 likes, 0 repeats
       
       @mirabilos hm, I didn't see that, where is that?
       
 (DIR) Post #B5o0cPKkyjDmssSMl6 by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @equinox bit between the lines, but they recommend it for container users and there is a note that further bugs are being disclosed atm
       
 (DIR) Post #B5o1gqHIqGtdYxWGjg by equinox@chaos.social
       0 likes, 0 repeats
       
       @mirabilos I still don't see mentions of more upcoming shit, but then again I'm tired and it's slop-y text.As for their recommendation: being able to get exploits out of an LLM and understanding what's what in the kernel are not the same skill. Nuking algif_aead "fixes" it. So does nuking authencesn. I see no reason given by them to prefer nuking AF_ALG. I guess it's a user interface? Counterargument: authencesn has network exposure.
       
 (DIR) Post #B5o1gqTM7SXOAL9tWS by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @equinox dalias also recommends blocking AF_ALG entirely or even compiling it out, so…
       
 (DIR) Post #B5ou0qfoTdJc6ayMro by equinox@chaos.social
       0 likes, 0 repeats
       
       @mirabilos sure, if that's your choice then that's your choice.I have written code for AF_ALG and I run IPsec. (without ESNs, because that's the default in StrongSwan, and I haven't had reason to worry about rekeying.)I know who @dalias is and I greatly respect them for their work on musl. But I'll stick with my opinion until someone claims at least the same experience level as I have. Maybe that's dalias, maybe not, idk their skills on this.
       
 (DIR) Post #B5ou0qrrkoxMhybzea by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @dalias @equinox ok, I don’t run IPsec ;) (tried in a lab, once; decided on OpenVPN)
       
 (DIR) Post #B64A1exi1AqUi79PtY by equinox@chaos.social
       0 likes, 0 repeats
       
       @mirabilos @dalias surprise! the AF_ALG / algif_aead code is essentially "innocent". (=> dirty.frag)
       
 (DIR) Post #B64A1fA7H2lpKaxKEa by mirabilos@toot.mirbsd.org
       0 likes, 0 repeats
       
       @dalias @equinox gna, another fucking full disclosure before a patch, and at night