From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by sourceware.org (Postfix) with ESMTP id 1D3F1385800B for ; Fri, 20 Aug 2021 12:44:38 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 1D3F1385800B Received: from mail-ej1-f69.google.com (mail-ej1-f69.google.com [209.85.218.69]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-386-1oDj8w2IMs2-wImjqQl-Xw-1; Fri, 20 Aug 2021 08:44:35 -0400 X-MC-Unique: 1oDj8w2IMs2-wImjqQl-Xw-1 Received: by mail-ej1-f69.google.com with SMTP id ke4-20020a17090798e4b02905b869727055so3666127ejc.11 for ; Fri, 20 Aug 2021 05:44:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vcR+Av2TbWdx3eKGInihvm3+Mc/WoHrNzx1sSFo6/ak=; b=J/gfo65CK+kZ9mlz+/KIXBpzH67D+Lrbb5RZbqGKIr4wZ08X2Up19WSeFJ5JhXjdQV fSQLGikCIrBMFgJOzX4dLfARUAiEXdEQN6SN0Y10jQ5IAs237UM6hGCBdHWFVegcG20S B/UQnSEh3QLlNRkzx21PL9xUD65HA4hFx2z99lWdmyRjl8CvEEdauZvtLCYJzusLOfVc D6LBuujoXTdzO7ZKOFL/OUc8Y/UB6fKRyE3Ui6ee1RECil7UXRPBpIEzEoQ7IxSGsN7V 4XvSmVFLFVEetENnQ2aFfBsAohHSDR2RZSj8JBpkyvhW1twWeq9I/38ilJBf71OYcAEQ A+Qg== X-Gm-Message-State: AOAM5330WbngG59Ox0Hb0iA4vP+R3LC2+GKbWFz2gbkbwhb+8NyknGmJ 0unVF5tWXsGJ1Xz+yn0eLbANNAt8TTplZpAxMj9uU65KfdhD6Ozto6w9l3H0mewNawdrqfA57uh mnG0IXJIRsUvj1amFqrl/PaWvjKwJX90UIbv9zKa8dQ== X-Received: by 2002:a50:ff0a:: with SMTP id a10mr22221683edu.273.1629463474682; Fri, 20 Aug 2021 05:44:34 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx8sIZKClYEHra2FAVrPJkas1I0utJV4NyafSRem0+p6WWticpKjs+cVK/LsADuFjAdYsOOwOcu2Ykv73pwXDI= X-Received: by 2002:a50:ff0a:: with SMTP id a10mr22221667edu.273.1629463474493; Fri, 20 Aug 2021 05:44:34 -0700 (PDT) MIME-Version: 1.0 References: <20210818225541.GE6064@redhat.com> In-Reply-To: <20210818225541.GE6064@redhat.com> From: Di Chen Date: Fri, 20 Aug 2021 20:44:23 +0800 Message-ID: Subject: Re: [PATCH] debuginfod: PR27917 - protect against federation loops To: "Frank Ch. Eigler" Cc: elfutils-devel@sourceware.org X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: multipart/mixed; boundary="000000000000928bb205c9fd0722" X-Spam-Status: No, score=-13.2 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, HTML_MESSAGE, KAM_BADIPHTTP, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2, SPF_HELO_NONE, SPF_NONE, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: elfutils-devel@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Elfutils-devel mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Aug 2021 12:44:48 -0000 --000000000000928bb205c9fd0722 Content-Type: text/plain; charset="UTF-8" Hey Frank, 1) moved the XFF check to handle_buildid. 2) replace "livelock" with "deadlock" in the commit message. - dichen On Thu, Aug 19, 2021 at 6:55 AM Frank Ch. Eigler wrote: > Hi - > > > This patch aims to reduce the risk by adding an option to debuginfod > > that functions kind of like an IP packet's TTL: a limit on the > > length of XFF: header that debuginfod is willing to process. If > > X-Forwarded-For: exceeds N hops, it will not delegate a local lookup > > miss to upstream debuginfods. [...] > > Thank you very much! > > > > Commit ab38d167c40c99 causes federation loops for non-existent > > resources to result in multiple temporary livelocks, each lasting > > for $DEBUGINFOD_TIMEOUT seconds. [...] > > (FWIW, the term "livelock" is not quite right here, try just > "deadlock".) > > The patch looks functional, and thank you also for including the > docs and test case. Thorough enough! > > > > @@ -1862,6 +1869,12 @@ handle_buildid (MHD_Connection* conn, > > // We couldn't find it in the database. Last ditch effort > > // is to defer to other debuginfo servers. > > > > + // if X-Forwarded-For: exceeds N hops, > > + // do not delegate a local lookup miss to upstream debuginfods. > > + if (disable_query_server) > > + throw reportable_exception(MHD_HTTP_NOT_FOUND, "not found, > > --forwared-ttl-limit reached \ > > +and will not query the upstream servers"); > > One part I don't understand is why you added the code to check for XFF > length into handler_cb(), and then passed the disable_query_server > result flag to this function. Was there some reason not to perform > the XFF comma-counting right here? > > > - FChE > > --000000000000928bb205c9fd0722 Content-Type: text/x-patch; charset="US-ASCII"; name="0001-debuginfod-PR27917-protect-against-federation-loops.patch" Content-Disposition: attachment; filename="0001-debuginfod-PR27917-protect-against-federation-loops.patch" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_kskcfq8b0 RnJvbSBhMGIzZDRiYTNkMTViODNkMjNkMzU5NGI2MTRjOGU3MmI4N2U2MjZjIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiBEaSBDaGVuIDxkaWNoZW5AcmVkaGF0LmNvbT4KRGF0ZTogRnJp LCAyMCBBdWcgMjAyMSAxMzowMzoyMSArMDgwMApTdWJqZWN0OiBbUEFUQ0hdIGRlYnVnaW5mb2Q6 IFBSMjc5MTcgLSBwcm90ZWN0IGFnYWluc3QgZmVkZXJhdGlvbiBsb29wcwoKSWYgc29tZW9uZSBt aXNjb25maWd1cmVzIGEgZGVidWdpbmZvZCBmZWRlcmF0aW9uIHRvIGhhdmUgbG9vcHMsIGFuZAph IG5vbmV4aXN0ZW50IGJ1aWxkaWQgbG9va3VwIGlzIGF0dGVtcHRlZCwgYmFkIHRoaW5ncyB3aWxs IGhhcHBlbiwKYXMgaXMgZG9jdW1lbnRlZC4KClRoaXMgcGF0Y2ggYWltcyB0byByZWR1Y2UgdGhl IHJpc2sgYnkgYWRkaW5nIGFuIG9wdGlvbiB0byBkZWJ1Z2luZm9kCnRoYXQgZnVuY3Rpb25zIGtp bmQgb2YgbGlrZSBhbiBJUCBwYWNrZXQncyBUVEw6IGEgbGltaXQgb24gdGhlIGxlbmd0aCBvZgpY RkY6IGhlYWRlciB0aGF0IGRlYnVnaW5mb2QgaXMgd2lsbGluZyB0byBwcm9jZXNzLiBJZiBYLUZv cndhcmRlZC1Gb3I6CmV4Y2VlZHMgTiBob3BzLCBpdCB3aWxsIG5vdCBkZWxlZ2F0ZSBhIGxvY2Fs IGxvb2t1cCBtaXNzIHRvIHVwc3RyZWFtCmRlYnVnaW5mb2RzLgoKQ29tbWl0IGFiMzhkMTY3YzQw Yzk5IGNhdXNlcyBmZWRlcmF0aW9uIGxvb3BzIGZvciBub24tZXhpc3RlbnQgcmVzb3VyY2VzCnRv IHJlc3VsdCBpbiBtdWx0aXBsZSB0ZW1wb3JhcnkgZGVhZGxvY2tzLCBlYWNoIGxhc3RpbmcgZm9y ICRERUJVR0lORk9EX1RJTUVPVVQKc2Vjb25kcy4gU2luY2UgY29uY3VycmVudCByZXF1ZXN0cyBm b3IgZWFjaCB1bmlxdWUgcmVzb3VyY2UgYXJlIG5vdwpzZXJpYWxpemVkLCBmZWRlcmF0aW9uIGxv b3BzIGNhbiByZXN1bHQgaW4gb25lIHNlcnZlciB0aHJlYWQgd2FpdGluZyB0bwphY3F1aXJlIGEg bG9jayB3aGlsZSB0aGUgc2VydmVyIHRocmVhZCBob2xkaW5nIHRoZSBsb2NrIHdhaXRzIGZvciB0 aGUKZmlyc3QgdGhyZWFkIHRvIHJlc3BvbmQgdG8gYW4gaHR0cCByZXF1ZXN0LgoKVGhpcyBQUiBj YW4gaGVscCBwcm90ZWN0IGFnYWluc3QgdGhlIGFib3ZlIG11bHRpcGxlIHRlbXBvcmFyeSBkZWFk bG9ja3MKYmVoYXZpb3VyLiBFeC4gaWYgLS1mb3J3YXJkZWQtdHRsLWxpbWl0PTAgdGhlbiB0aGUg dGltZW91dCBiZWhhdmlvdXIgb2YKbG9jYWwgbG9vcHMgc2hvdWxkIGJlIGF2b2lkZWQuCgpodHRw czovL3NvdXJjZXdhcmUub3JnL2J1Z3ppbGxhL3Nob3dfYnVnLmNnaT9pZD0yNzkxNwoKU2lnbmVk LW9mZi1ieTogRGkgQ2hlbiA8ZGljaGVuQHJlZGhhdC5jb20+Ci0tLQogZGVidWdpbmZvZC9kZWJ1 Z2luZm9kLmN4eCAgICB8IDE4ICsrKysrKysrKysrKysrKysKIGRvYy9kZWJ1Z2luZm9kLjggICAg ICAgICAgICAgfCAgNiArKysrKysKIHRlc3RzL3J1bi1kZWJ1Z2luZm9kLWZpbmQuc2ggfCA0MiAr KysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKy0KIDMgZmlsZXMgY2hhbmdlZCwgNjUg aW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQoKZGlmZiAtLWdpdCBhL2RlYnVnaW5mb2QvZGVi dWdpbmZvZC5jeHggYi9kZWJ1Z2luZm9kL2RlYnVnaW5mb2QuY3h4CmluZGV4IDRkZGQ5MjU1Li4y NjEwNDlmMiAxMDA2NDQKLS0tIGEvZGVidWdpbmZvZC9kZWJ1Z2luZm9kLmN4eAorKysgYi9kZWJ1 Z2luZm9kL2RlYnVnaW5mb2QuY3h4CkBAIC0zNzUsNiArMzc1LDggQEAgc3RhdGljIGNvbnN0IHN0 cnVjdCBhcmdwX29wdGlvbiBvcHRpb25zW10gPQogI2RlZmluZSBBUkdQX0tFWV9GRENBQ0hFX1BS RUZFVENIX0ZEUyAweDEwMDYKICAgIHsgImZkY2FjaGUtcHJlZmV0Y2gtZmRzIiwgQVJHUF9LRVlf RkRDQUNIRV9QUkVGRVRDSF9GRFMsICJOVU0iLCAwLCJOdW1iZXIgb2YgZmlsZXMgYWxsb2NhdGVk IHRvIHRoZSBcCiAgICAgICBwcmVmZXRjaCBjYWNoZS4iLCAwfSwKKyNkZWZpbmUgQVJHUF9LRVlf Rk9SV0FSREVEX1RUTF9MSU1JVCAweDEwMDcKKyAgIHsiZm9yd2FyZGVkLXR0bC1saW1pdCIsIEFS R1BfS0VZX0ZPUldBUkRFRF9UVExfTElNSVQsICJOVU0iLCAwLCAiTGltaXQgb2YgWC1Gb3J3YXJk ZWQtRm9yIGhvcHMsIGRlZmF1bHQgOC4iLCAwfSwKICAgIHsgTlVMTCwgMCwgTlVMTCwgMCwgTlVM TCwgMCB9LAogICB9OwogCkBAIC00MjIsNiArNDI0LDcgQEAgc3RhdGljIGxvbmcgZmRjYWNoZV9w cmVmZXRjaDsKIHN0YXRpYyBsb25nIGZkY2FjaGVfbWludG1wOwogc3RhdGljIGxvbmcgZmRjYWNo ZV9wcmVmZXRjaF9tYnM7CiBzdGF0aWMgbG9uZyBmZGNhY2hlX3ByZWZldGNoX2ZkczsKK3N0YXRp YyB1bnNpZ25lZCBmb3J3YXJkZWRfdHRsX2xpbWl0ID0gODsKIHN0YXRpYyBzdHJpbmcgdG1wZGly OwogCiBzdGF0aWMgdm9pZCBzZXRfbWV0cmljKGNvbnN0IHN0cmluZyYga2V5LCBkb3VibGUgdmFs dWUpOwpAQCAtNTU0LDYgKzU1Nyw5IEBAIHBhcnNlX29wdCAoaW50IGtleSwgY2hhciAqYXJnLAog ICAgICAgaWYoIGZkY2FjaGVfbWludG1wID4gMTAwIHx8IGZkY2FjaGVfbWludG1wIDwgMCApCiAg ICAgICAgIGFyZ3BfZmFpbHVyZShzdGF0ZSwgMSwgRUlOVkFMLCAiZmRjYWNoZSBtaW50bXAgcGVy Y2VudCIpOwogICAgICAgYnJlYWs7CisgICAgY2FzZSBBUkdQX0tFWV9GT1JXQVJERURfVFRMX0xJ TUlUOgorICAgICAgZm9yd2FyZGVkX3R0bF9saW1pdCA9ICh1bnNpZ25lZCkgYXRvaShhcmcpOwor ICAgICAgYnJlYWs7CiAgICAgY2FzZSBBUkdQX0tFWV9BUkc6CiAgICAgICBzb3VyY2VfcGF0aHMu aW5zZXJ0KHN0cmluZyhhcmcpKTsKICAgICAgIGJyZWFrOwpAQCAtMTg4MSw2ICsxODg3LDE3IEBA IGhhbmRsZV9idWlsZGlkIChNSERfQ29ubmVjdGlvbiogY29ubiwKICAgICAgICAgICBpZiAoeGZm ICE9ICIiKQogICAgICAgICAgICAgeGZmICs9IHN0cmluZygiLCAiKTsgLy8gY29tbWEgc2VwYXJh dGVkIGxpc3QKIAorICAgICAgICAgIHVuc2lnbmVkIGludCB4ZmZfY291bnQgPSAwOworICAgICAg ICAgIGZvciAoYXV0byYmIGkgOiB4ZmYpeworICAgICAgICAgICAgaWYgKGkgPT0gJywnKSB4ZmZf Y291bnQrKzsKKyAgICAgICAgICB9CisKKyAgICAgICAgICAvLyBpZiBYLUZvcndhcmRlZC1Gb3I6 IGV4Y2VlZHMgTiBob3BzLAorICAgICAgICAgIC8vIGRvIG5vdCBkZWxlZ2F0ZSBhIGxvY2FsIGxv b2t1cCBtaXNzIHRvIHVwc3RyZWFtIGRlYnVnaW5mb2RzLgorICAgICAgICAgIGlmICh4ZmZfY291 bnQgPj0gZm9yd2FyZGVkX3R0bF9saW1pdCkKKyAgICAgICAgICAgIHRocm93IHJlcG9ydGFibGVf ZXhjZXB0aW9uKE1IRF9IVFRQX05PVF9GT1VORCwgIm5vdCBmb3VuZCwgLS1mb3J3YXJlZC10dGwt bGltaXQgcmVhY2hlZCBcCithbmQgd2lsbCBub3QgcXVlcnkgdGhlIHVwc3RyZWFtIHNlcnZlcnMi KTsKKwogICAgICAgICAgIC8vIENvbXB1dGUgdGhlIGNsaWVudCdzIG51bWVyaWMgSVAgYWRkcmVz cyBvbmx5IC0gc28gY2FuJ3QgbWVyZ2Ugd2l0aCBjb25uaW5mbygpCiAgICAgICAgICAgY29uc3Qg dW5pb24gTUhEX0Nvbm5lY3Rpb25JbmZvICp1ID0gTUhEX2dldF9jb25uZWN0aW9uX2luZm8gKGNv bm4sCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIE1IRF9DT05ORUNUSU9OX0lORk9fQ0xJRU5UX0FERFJFU1MpOwpA QCAtMzcxOSw2ICszNzM2LDcgQEAgbWFpbiAoaW50IGFyZ2MsIGNoYXIgKmFyZ3ZbXSkKICAgb2Jh dGNoZWQoY2xvZykgPDwgImdyb29tIHRpbWUgIiA8PCBncm9vbV9zIDw8IGVuZGw7CiAgIG9iYXRj aGVkKGNsb2cpIDw8ICJwcmVmZXRjaCBmZHMgIiA8PCBmZGNhY2hlX3ByZWZldGNoX2ZkcyA8PCBl bmRsOwogICBvYmF0Y2hlZChjbG9nKSA8PCAicHJlZmV0Y2ggbWJzICIgPDwgZmRjYWNoZV9wcmVm ZXRjaF9tYnMgPDwgZW5kbDsKKyAgb2JhdGNoZWQoY2xvZykgPDwgImZvcndhcmRlZCB0dGwgbGlt aXQgIiA8PCBmb3J3YXJkZWRfdHRsX2xpbWl0IDw8IGVuZGw7CiAKICAgaWYgKHNjYW5fYXJjaGl2 ZXMuc2l6ZSgpPjApCiAgICAgewpkaWZmIC0tZ2l0IGEvZG9jL2RlYnVnaW5mb2QuOCBiL2RvYy9k ZWJ1Z2luZm9kLjgKaW5kZXggZjcwYWY2MjUuLjRmNTMyY2I4IDEwMDY0NAotLS0gYS9kb2MvZGVi dWdpbmZvZC44CisrKyBiL2RvYy9kZWJ1Z2luZm9kLjgKQEAgLTIzNiw2ICsyMzYsMTIgQEAgYXJl IGludGVuZGVkIHRvIGdpdmUgYW4gb3BlcmF0b3Igbm90aWNlIGFib3V0IHN0b3JhZ2Ugc2NhcmNp dHkgLSB3aGljaAogY2FuIHRyYW5zbGF0ZSB0byBSQU0gc2NhcmNpdHkgaWYgdGhlIGRpc2sgaGFw cGVucyB0byBiZSBvbiBhIFJBTQogdmlydHVhbCBkaXNrLiAgVGhlIGRlZmF1bHQgdGhyZXNob2xk IGlzIDI1JS4KIAorLlRQCisuQiAiXC1cLWZvcndhcmRlZFwtdHRsXC1saW1pdD1OVU0iCitDb25m aWd1cmUgbGltaXRzIG9mIFgtRm9yd2FyZGVkLUZvciBob3BzLiBpZiBYLUZvcndhcmRlZC1Gb3IK K2V4Y2VlZHMgTiBob3BzLCBpdCB3aWxsIG5vdCBkZWxlZ2F0ZSBhIGxvY2FsIGxvb2t1cCBtaXNz IHRvCit1cHN0cmVhbSBkZWJ1Z2luZm9kcy4gVGhlIGRlZmF1bHQgbGltaXQgaXMgOC4KKwogLlRQ CiAuQiAiXC12IgogSW5jcmVhc2UgdmVyYm9zaXR5IG9mIGxvZ2dpbmcgdG8gdGhlIHN0YW5kYXJk IGVycm9yIGZpbGUgZGVzY3JpcHRvci4KZGlmZiAtLWdpdCBhL3Rlc3RzL3J1bi1kZWJ1Z2luZm9k LWZpbmQuc2ggYi90ZXN0cy9ydW4tZGVidWdpbmZvZC1maW5kLnNoCmluZGV4IDk5MWQxZGM1Li5k YmYyMDk3NSAxMDA3NTUKLS0tIGEvdGVzdHMvcnVuLWRlYnVnaW5mb2QtZmluZC5zaAorKysgYi90 ZXN0cy9ydW4tZGVidWdpbmZvZC1maW5kLnNoCkBAIC0zNyw2ICszNyw4IEBAIFBJRDE9MAogUElE Mj0wCiBQSUQzPTAKIFBJRDQ9MAorUElENT0wCitQSUQ2PTAKIAogY2xlYW51cCgpCiB7CkBAIC00 NCw2ICs0Niw4IEBAIGNsZWFudXAoKQogICBpZiBbICRQSUQyIC1uZSAwIF07IHRoZW4ga2lsbCAk UElEMjsgd2FpdCAkUElEMjsgZmkKICAgaWYgWyAkUElEMyAtbmUgMCBdOyB0aGVuIGtpbGwgJFBJ RDM7IHdhaXQgJFBJRDM7IGZpCiAgIGlmIFsgJFBJRDQgLW5lIDAgXTsgdGhlbiBraWxsICRQSUQ0 OyB3YWl0ICRQSUQ0OyBmaQorICBpZiBbICRQSUQ1IC1uZSAwIF07IHRoZW4ga2lsbCAkUElENTsg d2FpdCAkUElENTsgZmkKKyAgaWYgWyAkUElENiAtbmUgMCBdOyB0aGVuIGtpbGwgJFBJRDY7IHdh aXQgJFBJRDY7IGZpCiAgIHJtIC1yZiBGIFIgRCBMIFogJHtQV0R9L2Zvb2JhciAke1BXRH0vbW9j a3RyZWUgJHtQV0R9Ly5jbGllbnRfY2FjaGUqICR7UFdEfS90bXAqCiAgIGV4aXRfY2xlYW51cAog fQpAQCAtNTQsNyArNTgsNyBAQCB0cmFwIGNsZWFudXAgMCAxIDIgMyA1IDkgMTUKIGVycmZpbGVz X2xpc3Q9CiBlcnIoKSB7CiAgICAgZWNobyBFUlJPUiBSRVBPUlRTCi0gICAgZm9yIHBvcnRzIGlu ICRQT1JUMSAkUE9SVDIgJFBPUlQzCisgICAgZm9yIHBvcnRzIGluICRQT1JUMSAkUE9SVDIgJFBP UlQzICRQT1JUNCAkUE9SVDUKICAgICBkbwogICAgICAgICBlY2hvIEVSUk9SIFJFUE9SVCAkcG9y dCBtZXRyaWNzCiAgICAgICAgIGN1cmwgLXMgaHR0cDovLzEyNy4wLjAuMTokcG9ydC9tZXRyaWNz CkBAIC04MDQsNCArODA4LDQwIEBAIGlmIFsgJHJldHJ5X2F0dGVtcHRzIC1uZSAxMCBdOyB0aGVu CiAgICAgZXhpdCAxOwogICBmaQogCisjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMj IyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMKKworIyBUZXN0IHdoZW4gZGVi dWdpbmZvZCBoaXR0aW5nIFgtRm9yd2FyZGVkLUZvciBob3BzIGxpbWl0LgorIyBUaGlzIHRlc3Qg d2lsbCBzdGFydCB0d28gc2VydmVycyAoYXMgYSBsb29wKSB3aXRoIHR3byBkaWZmZXJlbnQgaG9w IGxpbWl0cy4KKword2hpbGUgdHJ1ZTsgZG8KKyAgICBQT1JUND1gZXhwciAnKCcgJFJBTkRPTSAl IDEwMDAgJyknICsgOTAwMGAKKyAgICBQT1JUNT1gZXhwciAnKCcgJFJBTkRPTSAlIDEwMDAgJykn ICsgOTAwMGAKKyAgICBzcyAtYXRuIHwgZmdyZXAgLWUgIjokUE9SVDQiIC1lICI6JFBPUlQ1Inx8 IGJyZWFrCitkb25lCisKK2VudiBMRF9MSUJSQVJZX1BBVEg9JGxkcGF0aCBERUJVR0lORk9EX1VS TFM9aHR0cDovLzEyNy4wLjAuMTokUE9SVDUgJHthYnNfYnVpbGRkaXJ9Ly4uL2RlYnVnaW5mb2Qv ZGVidWdpbmZvZCAkVkVSQk9TRSAtLWZvcndhcmRlZC10dGwtbGltaXQgMCAtcCAkUE9SVDQgPiB2 bG9nJFBPUlQ0IDI+JjEgJgorUElENT0kIQorCitlbnYgTERfTElCUkFSWV9QQVRIPSRsZHBhdGgg REVCVUdJTkZPRF9VUkxTPWh0dHA6Ly8xMjcuMC4wLjE6JFBPUlQ0ICR7YWJzX2J1aWxkZGlyfS8u Li9kZWJ1Z2luZm9kL2RlYnVnaW5mb2QgJFZFUkJPU0UgLS1mb3J3YXJkZWQtdHRsLWxpbWl0IDEg LXAgJFBPUlQ1ID4gdmxvZyRQT1JUNSAyPiYxICYKK1BJRDY9JCEKKword2FpdF9yZWFkeSAkUE9S VDQgJ3JlYWR5JyAxCit3YWl0X3JlYWR5ICRQT1JUNSAncmVhZHknIDEKKworZXhwb3J0IERFQlVH SU5GT0RfVVJMUz0iaHR0cDovLzEyNy4wLjAuMTokUE9SVDQvIgordGVzdHJ1biAke2Fic190b3Bf YnVpbGRkaXJ9L2RlYnVnaW5mb2QvZGVidWdpbmZvZC1maW5kIGRlYnVnaW5mbyAwMTIzNDU2NyB8 fCB0cnVlCisKKyMgVXNlIGEgZGlmZmVyZW50IGJ1aWxkaWQgdG8gYXZvaWQgdXNpbmcgc2FtZSBj YWNoZS4KK2V4cG9ydCBERUJVR0lORk9EX1VSTFM9Imh0dHA6Ly8xMjcuMC4wLjE6JFBPUlQ1LyIK K3Rlc3RydW4gJHthYnNfdG9wX2J1aWxkZGlyfS9kZWJ1Z2luZm9kL2RlYnVnaW5mb2QtZmluZCBk ZWJ1Z2luZm8gMTEyMzQ1NjcgfHwgdHJ1ZQorCitncmVwICJmb3J3YXJlZC10dGwtbGltaXQgcmVh Y2hlZCBhbmQgd2lsbCBub3QgcXVlcnkgdGhlIHVwc3RyZWFtIHNlcnZlcnMiIHZsb2ckUE9SVDQK K2dyZXAgLXYgImZvcndhcmVkLXR0bC1saW1pdCByZWFjaGVkIGFuZCB3aWxsIG5vdCBxdWVyeSB0 aGUgdXBzdHJlYW0gc2VydmVycyIgdmxvZyRQT1JUNSB8IGdyZXAgIm5vdCBmb3VuZCIgdmxvZyRQ T1JUNQorCitraWxsICRQSUQ1ICRQSUQ2Cit3YWl0ICRQSUQ1ICRQSUQ2CisKK1BJRDU9MAorUElE Nj0wCisKIGV4aXQgMAotLSAKMi4zMS4xCgo= --000000000000928bb205c9fd0722--