{"id":181666,"date":"2026-05-22T18:25:08","date_gmt":"2026-05-22T16:25:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti"},"modified":"2026-05-22T18:25:08","modified_gmt":"2026-05-22T16:25:08","slug":"iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","title":{"rendered":"Zero-copy po hiqet nga AF_ALG n\u00eb Linux p\u00ebr arsye sigurie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb n\u00ebn-sistemin e kriptografis\u00eb Linux po p\u00ebrgatitet heqja e mb\u00ebshtetjes zero-copy<\/strong> nga nd\u00ebrfaqja AF_ALG<\/strong> p\u00ebr llojet e algoritmeve SKCIPHER<\/strong> dhe AEAD<\/strong>. Ndryshimi tashm\u00eb ndodhet n\u00eb pem\u00ebn cryptodev dhe pritet t\u00eb d\u00ebrgohet n\u00eb dritaren e bashkimit Linux 7.2<\/strong>, e cila pritet t\u00eb hapet n\u00eb qershor. Shkaku jan\u00eb shqet\u00ebsimet n\u00eb rritje rreth siguris\u00eb s\u00eb mekanizmave zero-copy n\u00eb b\u00ebrtham\u00eb, sidomos pas dob\u00ebsive t\u00eb fundit n\u00eb kodin kriptografik t\u00eb Linux.<\/p>\n

<\/p>\n

AF_ALG<\/strong> \u2014 \u00ebsht\u00eb nd\u00ebrfaqja p\u00ebrdoruesit<\/a> n\u00eb API-n\u00eb kriptografike t\u00eb b\u00ebrtham\u00ebs Linux. P\u00ebrmes saj, programet mund t\u00eb aksesojn\u00eb implementimet e cifrave, hasheve dhe algoritmeve AEAD n\u00eb b\u00ebrtham\u00eb si sokete. Dokumentacioni i Linux p\u00ebrshkruan ve\u00e7mas p\u00ebr AF_ALG m\u00ebnyr\u00ebn zero-copy p\u00ebrmes splice() dhe vmsplice(), ku b\u00ebrthama p\u00ebrpiqet t\u00eb shmang\u00eb kopjimin e panevojsh\u00ebm t\u00eb t\u00eb dh\u00ebnave n\u00eb memorien e b\u00ebrtham\u00ebs.<\/p>\n

<\/noindex><\/noindex><\/p>\n

<\/p>\n

Problemi \u00ebsht\u00eb se p\u00ebr AF_ALG, kjo p\u00ebrmir\u00ebsim n\u00eb performanc\u00eb nuk rezultoi aq i r\u00ebnd\u00ebsish\u00ebm, dhe rreziqet jan\u00eb tep\u00ebr t\u00eb m\u00ebdha. Autori i ndryshimit, zhvilluesi i n\u00ebn-sistemit kriptografik t\u00eb Linux, Erik Biggers nga Google, specifikoja<\/a>, tha se zero-copy lejon hap\u00ebsir\u00ebn p\u00ebr p\u00ebrdoruesit t\u00eb kryej\u00eb operacione kriptografike drejtp\u00ebrdrejt mbi faqet e caches t\u00eb skedar\u00ebve, p\u00ebr shembull, binarin su, dhe gjithashtu krijon kushte p\u00ebr dob\u00ebsi TOCTOU, kur memorie mund t\u00eb ndryshoj\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb nj\u00ebkohshme me operacionin mbi t\u00eb.<\/p>\n

<\/noindex><\/p>\n

Me fjal\u00eb t\u00eb tjera, mekanizmi, i dobish\u00ebm n\u00eb input-output rrjetor ose skedar\u00ebsh, n\u00eb AF_ALG duket si nj\u00eb optimizim tep\u00ebr t\u00eb rreziksh\u00ebm. Vet\u00eb AF_ALG, sipas zhvilluesit, tani ruhet kryesisht p\u00ebr shkak t\u00eb pajtueshm\u00ebris\u00eb mbrapa me nj\u00eb num\u00ebr t\u00eb vog\u00ebl programesh, si\u00e7 \u00ebsht\u00eb iwd, t\u00eb cilat ende nuk jan\u00eb transferuar n\u00eb kriptografin\u00eb n\u00eb hap\u00ebsir\u00ebn e p\u00ebrdoruesit. Fillimisht AF_ALG ishte menduar p\u00ebr aksesin n\u00eb akcelarator\u00ebt ekzistues t\u00eb kriptografis\u00eb, por n\u00eb praktik\u00eb rezultoi si nj\u00eb nd\u00ebrfaqe jo shum\u00eb efektive p\u00ebr k\u00ebt\u00eb detyr\u00eb.<\/p>\n

\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se nuk b\u00ebhet fjal\u00eb p\u00ebr nj\u00eb heqje t\u00eb plot\u00eb t\u00eb splice() ose sendfile() p\u00ebr AF_ALG. Ndryshimi p\u00ebrshkruhet si nj\u00eb \"prishje e but\u00eb\" e pajtueshm\u00ebris\u00eb: transferimi i t\u00eb dh\u00ebnave n\u00eb k\u00ebrkesat e AF_ALG p\u00ebrmes splice() dhe sendfile() do t\u00eb vazhdoj\u00eb t\u00eb funksionoj\u00eb, por b\u00ebrthama tani do t\u00eb krijoj\u00eb nj\u00eb kopje t\u00eb brendshme t\u00eb q\u00ebndrueshme t\u00eb t\u00eb dh\u00ebnave p\u00ebrpara operacionit kriptografik. Performanca n\u00eb disa raste mund t\u00eb bie, megjithat\u00eb API formale p\u00ebr p\u00ebrdoruesin nuk d\u00ebmtohet.<\/p>\n

Ve\u00e7mas theksohet se p\u00ebr momentin zero-copy po hiqet nga skcipher<\/strong> dhe aead<\/strong>. Mb\u00ebshtetja p\u00ebr llojin hash<\/strong> do t\u00eb shqyrtohet ve\u00e7mas.<\/p>\n

<\/p>\n

Konteksti i ndryshimit \u00ebsht\u00eb i pak\u00ebndsh\u00ebm. N\u00eb fund t\u00eb prillit u zbulua nj\u00eb dob\u00ebsi Copy Fail<\/a><\/strong> (CVE-2026-31431<\/strong>) n\u00eb algif_aead, q\u00eb do t\u00eb thot\u00eb se pik\u00ebrisht n\u00eb nd\u00ebrfaqen e kriptografis\u00eb s\u00eb p\u00ebrdoruesit AF_ALG. Hulumtuesit treguan se lidhja AF_ALG, splice() dhe ve\u00e7orit\u00eb e p\u00ebrpunimit AEAD lejonin nj\u00eb p\u00ebrdorues t\u00eb paautorizuar t\u00eb d\u00ebmtonte page cache, p\u00ebrfshir\u00eb faqet q\u00eb p\u00ebrputhen me binar\u00ebt setuid, dhe t\u00eb fitonte nj\u00eb rritje privilegjesh deri n\u00eb root.<\/p>\n

<\/noindex>
\n<\/p>\n

Shfaqja Copy Fail<\/a> ishte e lidhur me optimizimin e vitit 2017, i cili kaloi operacionet AEAD n\u00eb p\u00ebrpunim \"n\u00eb vend\"; gjat\u00eb kalimit t\u00eb nj\u00eb skedari p\u00ebrmes splice() n\u00eb AF_ALG, b\u00ebrlloku i krijuar punonte jo me nj\u00eb kopje, por me referenca ndaj faqeve n\u00eb page cache. Si rezultat, nj\u00eb pjes\u00eb e t\u00eb dh\u00ebnave, t\u00eb cilat konsideroheshin vet\u00ebm si hyr\u00ebse, mund t\u00eb ishin gjetur n\u00eb scatterlist q\u00eb mund t\u00eb shkruhej.<\/p>\n

<\/noindex><\/p>\n

Heqja e zero-copy nga AF_ALG nuk \u00ebsht\u00eb nj\u00eb rregullim t\u00eb vet\u00ebm nj\u00eb dob\u00ebsie. M\u00eb s\u00eb shumti, kjo \u00ebsht\u00eb nj\u00eb p\u00ebrpjekje p\u00ebr t\u00eb hequr nj\u00eb klas\u00eb t\u00eb t\u00ebr\u00eb skenar\u00ebsh t\u00eb rreziksh\u00ebm nga UAPI i pak p\u00ebrdorur, ku p\u00ebrfitimi nga optimizimi nuk justifikon kompleksitetin dhe pasojat e mundshme. P\u00ebr p\u00ebrdoruesit e zakonsh\u00ebm, ndryshimi ndoshta do t\u00eb mbetet i paqart\u00eb; p\u00ebr programet e rralla, q\u00eb p\u00ebrdorin aktivisht AF_ALG p\u00ebrmes splice() ose sendfile(), nj\u00eb r\u00ebnie e performanc\u00ebs \u00ebsht\u00eb e mundshme p\u00ebr shkak t\u00eb kopjimit shtes\u00eb.<\/p>\n

Burimi: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD. \u0418\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 \u0434\u0435\u0440\u0435\u0432\u0435 cryptodev \u0438 \u043e\u0436\u0438\u0434\u0430\u0435\u0442\u0441\u044f \u043a \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0432 \u043e\u043a\u043d\u043e \u0441\u043b\u0438\u044f\u043d\u0438\u044f Linux 7.2, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0434\u043e\u043b\u0436\u043d\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u044c\u0441\u044f \u0432 \u0438\u044e\u043d\u0435. \u041f\u043e\u0432\u043e\u0434\u043e\u043c \u0441\u0442\u0430\u043b\u0438 \u0440\u0430\u0441\u0442\u0443\u0449\u0438\u0435 \u043e\u043f\u0430\u0441\u0435\u043d\u0438\u044f \u0432\u043e\u043a\u0440\u0443\u0433 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 zero-copy-\u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0432 \u044f\u0434\u0440\u0435, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u043a\u043e\u0434\u0435 Linux. AF_ALG […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-181666","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Zero-copy po hiqet nga AF_ALG n\u00eb Linux p\u00ebr arsye sigurie | ProHoster","description":"N\u00eb n\u00ebn-sistemin e kriptografis\u00eb Linux po p\u00ebrgatitet heqja e mb\u00ebshtetjes zero-copy nga nd\u00ebrfaqja AF_ALG p\u00ebr llojet e algoritmeve SKCIPHER dhe AEAD.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0437 AF_ALG \u0432 Linux \u0443\u0431\u0438\u0440\u0430\u044e\u0442 zero-copy \u0438\u0437 \u0441\u043e\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0412 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 Linux \u0433\u043e\u0442\u043e\u0432\u0438\u0442\u0441\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 zero-copy \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 AF_ALG \u0434\u043b\u044f \u0442\u0438\u043f\u043e\u0432 \u0430\u043b\u0433\u043e\u0440\u0438\u0442\u043c\u043e\u0432 SKCIPHER \u0438 AEAD.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/iz-af_alg-v-linux-ubirayut-zero-copy-iz-soobrazhenij-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-22T16:25:08+00:00","article:modified_time":"2026-05-22T16:25:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/181666","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=181666"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/181666\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=181666"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=181666"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=181666"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}