v0.5.23

Added

• The eBPF verifier gives the result of kernel/bpf/verifier.c of Linux for all programs of bpf/test_verifier of the socket filter and cgroup program types. It prunes the paths with equal states at the jump targets and refuses a loop that does not end, it refines the bounds of a register after BPF_JSET and after a BPF_JMP32 that compares as 64 bits, and it checks the alignment of the pointers and the size of each context field as Linux, with the errors and the log messages of Linux in the same order. bpf(BPF_PROG_TEST_RUN) runs a program on a packet or a context from user space. The kselftest boot test runs bpf/test_verifier, and tools/kselftest/bpf.md gives the result: 281 passed and 0 failed (#537).
• The stateful expressions of the sets of nf_tables, as nft_set_elem_expr_alloc of Linux: NFTA_SET_EXPR and NFTA_SET_EXPRESSIONS of a set, NFTA_SET_ELEM_EXPR and NFTA_SET_ELEM_EXPRESSIONS of an element, and NFTA_DYNSET_EXPR and NFTA_DYNSET_EXPRESSIONS of dynset. The expressions are counter, quota, limit and connlimit, two at most. Each element has its own state: a copy of the expressions of the set, or the ones that it gives with the same types. A lookup and a dynset run the expressions of the element that they find. The connlimit expression of nft_connlimit.c counts the connections that connection tracking still has (#542).
• The AF_ALG sockets with the type hash, as crypto/af_alg.c and crypto/algif_hash.c of Linux. A socket binds to a hash of rk-crypto by its name, setsockopt(SOL_ALG, ALG_SET_KEY) sets the key of an HMAC, and accept gives a socket for one computation. A send with MSG_MORE adds data, and a recv gives the digest. An accept on the socket of a computation copies its state. As with crypto.af_alg_restrict=1 of Linux, a name that is not in the allow list gives ENOENT, and a name that needs a capability gives ENOENT without CAP_SYS_ADMIN or CAP_NET_ADMIN (#541).