From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9AADCC761A6 for ; Tue, 28 Mar 2023 07:47:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232318AbjC1Hrd (ORCPT ); Tue, 28 Mar 2023 03:47:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33046 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230093AbjC1Hrb (ORCPT ); Tue, 28 Mar 2023 03:47:31 -0400 Received: from frasgout12.his.huawei.com (frasgout12.his.huawei.com [14.137.139.154]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 582C61A8; Tue, 28 Mar 2023 00:47:29 -0700 (PDT) Received: from mail02.huawei.com (unknown [172.18.147.227]) by frasgout12.his.huawei.com (SkyGuard) with ESMTP id 4Pm1jq5DGmz9v7Y6; Tue, 28 Mar 2023 15:37:35 +0800 (CST) Received: from roberto-ThinkStation-P620 (unknown [10.204.63.22]) by APP1 (Coremail) with SMTP id LxC2BwBn6QRkmyJkwsvWAQ--.64076S2; Tue, 28 Mar 2023 08:46:57 +0100 (CET) Message-ID: <1e08006f9011efa48deaf656c358ca3d438b9768.camel@huaweicloud.com> Subject: Re: [PATCH v8 4/6] security: Allow all LSMs to provide xattrs for inode_init_security hook From: Roberto Sassu To: Paul Moore Cc: mark@fasheh.com, jlbec@evilplan.org, joseph.qi@linux.alibaba.com, zohar@linux.ibm.com, dmitry.kasatkin@gmail.com, jmorris@namei.org, serge@hallyn.com, stephen.smalley.work@gmail.com, eparis@parisplace.org, casey@schaufler-ca.com, ocfs2-devel@oss.oracle.com, reiserfs-devel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, linux-kernel@vger.kernel.org, keescook@chromium.org, nicolas.bouchinet@clip-os.org, Roberto Sassu Date: Tue, 28 Mar 2023 09:46:41 +0200 In-Reply-To: References: <20230314081720.4158676-1-roberto.sassu@huaweicloud.com> <20230314081720.4158676-5-roberto.sassu@huaweicloud.com> <939e6c88662ad90b963993c4cc1b702083e74a7a.camel@huaweicloud.com> <8b63d00d8ac3f686e51889ea4fc8d83f8ecb300d.camel@huaweicloud.com> Content-Type: text/plain; charset="UTF-8" User-Agent: Evolution 3.36.5-0ubuntu1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID: LxC2BwBn6QRkmyJkwsvWAQ--.64076S2 X-Coremail-Antispam: 1UD129KBjvJXoW3Xw1UKw4ftFWDCF15KFyxuFg_yoWfKF48pr WUJ3Wjkr4DJFyUCrySqa18uw1agrWrGrWUXrn8JryUAr1qyr1xJry0kr45uFykXrW8Jr1q qr4jyr47urn8A3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkjb4IE77IF4wAFF20E14v26ryj6rWUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Gr0_Cr1l84ACjcxK6I8E87Iv67AKxVWUJVW8JwA2z4x0Y4vEx4A2jsIEc7CjxV AFwI0_Gr0_Gr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40E x7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x 0Yz7v_Jr0_Gr1lF7xvr2IY64vIr41lFIxGxcIEc7CjxVA2Y2ka0xkIwI1l42xK82IYc2Ij 64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x 8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r4a6rW5MIIYrxkI7VAKI48JMIIF0xvE 2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42 xK8VAvwI8IcIk0rVWrZr1j6s0DMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIE c7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x07UZ18PUUUUU= X-CM-SenderInfo: purev21wro2thvvxqx5xdzvxpfor3voofrz/1tbiAQAKBF1jj4s6twADs7 X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 2023-03-27 at 17:02 -0400, Paul Moore wrote: > On Mon, Mar 27, 2023 at 3:30 AM Roberto Sassu > wrote: > > On Fri, 2023-03-24 at 17:39 -0400, Paul Moore wrote: > > > On Fri, Mar 24, 2023 at 9:26 AM Roberto Sassu > > > wrote: > > > > On Fri, 2023-03-24 at 11:18 +0100, Roberto Sassu wrote: > > > > > On Thu, 2023-03-23 at 20:09 -0400, Paul Moore wrote: > > > > > > On Tue, Mar 14, 2023 at 4:19 AM Roberto Sassu > > > > > > wrote: > > > > > > > From: Roberto Sassu > > > > > > > > > > > > > > Currently, security_inode_init_security() supports only one LSM providing > > > > > > > an xattr and EVM calculating the HMAC on that xattr, plus other inode > > > > > > > metadata. > > > > > > > > > > > > > > Allow all LSMs to provide one or multiple xattrs, by extending the security > > > > > > > blob reservation mechanism. Introduce the new lbs_xattr field of the > > > > > > > lsm_blob_sizes structure, so that each LSM can specify how many xattrs it > > > > > > > needs, and the LSM infrastructure knows how many xattr slots it should > > > > > > > allocate. > > > > > > > > > > > > > > Dynamically allocate the xattrs array to be populated by LSMs with the > > > > > > > inode_init_security hook, and pass it to the latter instead of the > > > > > > > name/value/len triple. Update the documentation accordingly, and fix the > > > > > > > description of the xattr name, as it is not allocated anymore. > > > > > > > > > > > > > > Since the LSM infrastructure, at initialization time, updates the number of > > > > > > > the requested xattrs provided by each LSM with a corresponding offset in > > > > > > > the security blob (in this case the xattr array), it makes straightforward > > > > > > > for an LSM to access the right position in the xattr array. > > > > > > > > > > > > > > There is still the issue that an LSM might not fill the xattr, even if it > > > > > > > requests it (legitimate case, for example it might have been loaded but not > > > > > > > initialized with a policy). Since users of the xattr array (e.g. the > > > > > > > initxattrs() callbacks) detect the end of the xattr array by checking if > > > > > > > the xattr name is NULL, not filling an xattr would cause those users to > > > > > > > stop scanning xattrs prematurely. > > > > > > > > > > > > > > Solve that issue by introducing security_check_compact_filled_xattrs(), > > > > > > > which does a basic check of the xattr array (if the xattr name is filled, > > > > > > > the xattr value should be too, and viceversa), and compacts the xattr array > > > > > > > by removing the holes. > > > > > > > > > > > > > > An alternative solution would be to let users of the xattr array know the > > > > > > > number of elements of that array, so that they don't have to check the > > > > > > > termination. However, this seems more invasive, compared to a simple move > > > > > > > of few array elements. > > > > > > > > > > > > > > security_check_compact_filled_xattrs() also determines how many xattrs in > > > > > > > the xattr array have been filled. If there is none, skip > > > > > > > evm_inode_init_security() and initxattrs(). Skipping the former also avoids > > > > > > > EVM to crash the kernel, as it is expecting a filled xattr. > > > > > > > > > > > > > > Finally, adapt both SELinux and Smack to use the new definition of the > > > > > > > inode_init_security hook, and to correctly fill the designated slots in the > > > > > > > xattr array. For Smack, reserve space for the other defined xattrs although > > > > > > > they are not set yet in smack_inode_init_security(). > > > > > > > > > > > > > > Reported-by: Nicolas Bouchinet (EVM crash) > > > > > > > Link: https://lore.kernel.org/linux-integrity/Y1FTSIo+1x+4X0LS@archlinux/ > > > > > > > Signed-off-by: Roberto Sassu > > > > > > > Reviewed-by: Casey Schaufler > > > > > > > Reviewed-by: Mimi Zohar > > > > > > > --- > > > > > > > include/linux/lsm_hook_defs.h | 3 +- > > > > > > > include/linux/lsm_hooks.h | 1 + > > > > > > > security/security.c | 119 +++++++++++++++++++++++++++++----- > > > > > > > security/selinux/hooks.c | 19 ++++-- > > > > > > > security/smack/smack_lsm.c | 33 ++++++---- > > > > > > > 5 files changed, 137 insertions(+), 38 deletions(-) > > > > > > ... > > > > > > > > > > @@ -1604,33 +1654,66 @@ int security_inode_init_security(struct inode *inode, struct inode *dir, > > > > > > > const struct qstr *qstr, > > > > > > > const initxattrs initxattrs, void *fs_data) > > > > > > > { > > > > > > > - struct xattr new_xattrs[MAX_LSM_EVM_XATTR + 1]; > > > > > > > - struct xattr *lsm_xattr, *evm_xattr, *xattr; > > > > > > > - int ret; > > > > > > > + struct security_hook_list *P; > > > > > > > + struct xattr *new_xattrs; > > > > > > > + struct xattr *xattr; > > > > > > > + int ret = -EOPNOTSUPP, num_filled_xattrs = 0; > > > > > > > > > > > > > > if (unlikely(IS_PRIVATE(inode))) > > > > > > > return 0; > > > > > > > > > > > > > > + if (!blob_sizes.lbs_xattr) > > > > > > > + return 0; > > > > > > > + > > > > > > > if (!initxattrs) > > > > > > > return call_int_hook(inode_init_security, -EOPNOTSUPP, inode, > > > > > > > - dir, qstr, NULL, NULL, NULL); > > > > > > > - memset(new_xattrs, 0, sizeof(new_xattrs)); > > > > > > > - lsm_xattr = new_xattrs; > > > > > > > - ret = call_int_hook(inode_init_security, -EOPNOTSUPP, inode, dir, qstr, > > > > > > > - &lsm_xattr->name, > > > > > > > - &lsm_xattr->value, > > > > > > > - &lsm_xattr->value_len); > > > > > > > - if (ret) > > > > > > > + dir, qstr, NULL); > > > > > > > + /* Allocate +1 for EVM and +1 as terminator. */ > > > > > > > + new_xattrs = kcalloc(blob_sizes.lbs_xattr + 2, sizeof(*new_xattrs), > > > > > > > + GFP_NOFS); > > > > > > > + if (!new_xattrs) > > > > > > > + return -ENOMEM; > > > > > > > + > > > > > > > + hlist_for_each_entry(P, &security_hook_heads.inode_init_security, > > > > > > > + list) { > > > > > > > + ret = P->hook.inode_init_security(inode, dir, qstr, new_xattrs); > > > > > > > + if (ret && ret != -EOPNOTSUPP) > > > > > > > + goto out; > > > > > > > + /* > > > > > > > + * As documented in lsm_hooks.h, -EOPNOTSUPP in this context > > > > > > > + * means that the LSM is not willing to provide an xattr, not > > > > > > > + * that it wants to signal an error. Thus, continue to invoke > > > > > > > + * the remaining LSMs. > > > > > > > + */ > > > > > > > + if (ret == -EOPNOTSUPP) > > > > > > > + continue; > > > > > > > + /* > > > > > > > + * As the number of xattrs reserved by LSMs is not directly > > > > > > > + * available, directly use the total number blob_sizes.lbs_xattr > > > > > > > + * to keep the code simple, while being not the most efficient > > > > > > > + * way. > > > > > > > + */ > > > > > > > > > > > > Is there a good reason why the LSM can't return the number of xattrs > > > > > > it is adding to the xattr array? It seems like it should be fairly > > > > > > trivial for the individual LSMs to determine and it could save a lot > > > > > > of work. However, given we're at v8 on this patchset I'm sure I'm > > > > > > missing something obvious, can you help me understand why the idea > > > > > > above is crazy stupid? ;) > > > > > > > > Much simple answer. Yes, LSMs could return the number of xattrs set, > > > > but security_check_compact_filled_xattrs() also needs to know from > > > > which offset (the lbs_xattr of each LSM) it should start compacting. > > > > > > > > Example: suppose that you have three LSMs with: > > > > > > > > LSM#1: lbs_xattr 1 > > > > LSM#2: lbs_xattr 2 (disabled) > > > > LSM#3: lbs_xattr 1 > > > > > > > > The current compaction interval is: already compacted xattrs - end of > > > > new_xattr array. > > > > > > > > When the security_inode_init_security() loop calls LSM#3, the > > > > compaction interval is: 1 - 2 (LSM#2 returns 0), which clearly isn't > > > > right. The correct compaction interval should be: 3 - 4. > > > > > > > > Going to the end of new_xattrs is an approximation, but it ensures > > > > that security_check_compact_filled_xattrs() reaches the xattr set by > > > > LSM#3. > > > > > > > > The alternative I was mentioning of passing num_filled_xattrs to LSMs > > > > goes again in the direction of doing on-the-fly compaction, while LSMs > > > > are more familiar with using the lbs_* fields. > > > > > > I guess I was thinking of the case where the LSM layer, i.e. > > > security_inode_init_security(), allocates an xattr array like it does > > > now based on the maximum number of xattrs possible using the > > > lsm_blob_sizes values and passes a pointer to the individual LSMs > > > which is incremented based on how many xattrs are created by the > > > individual LSMs. Here is some *very* rough pseudo code: > > > > > > int security_inode_init_security(...) > > > { > > > > > > /* allocate an xattr array */ > > > xattrs = kcalloc(blob_sizes, sizeof(*xattrs), GFP_BLAH); > > > > > > /* loop on the lsms */ > > > xa_cnt = 0; > > > while (lsm_hooks) { > > > rc = call_hook(lsm_hook, &xattrs[xa_cnt]); > > > if (rc > 0) > > > xa_cnt += rc; > > > } > > > > > > /* evm magic */ > > > evm_inode_init_security(...) > > > } > > > > > > Does that work? Am I missing something? > > > > Oh, unfortunately not. EVM needs to see all xattrs (when it is moved to > > the LSM infrastructure). > > Okay, that's fair, but we could still pass the full xattrs array and a > reference to the current count which could be both read and updated by > the individual LSMs, right? Yes, we could do. > The issue is that the separate compaction stage is not something we > want to have to do if we can avoid it. Maybe we're stuck with it, but > I'm not yet convinced that we can't make some minor changes to the > LSMs to avoid the compaction step. I liked more the idea that LSMs do what they are most familiar with, get an offset in a security blob or, in this case, a starting slot in the new_xattrs array, and write there. v3 had the lsm_find_xattr_slot() helper, to get the starting slot, but somehow I find it less intuitive. Ok, if you prefer to avoid the compaction stage, I will rewrite this patch. Thanks Roberto From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aib29ajc246.phx1.oracleemaildelivery.com (aib29ajc246.phx1.oracleemaildelivery.com [192.29.103.246]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 03BA3C76196 for ; Tue, 28 Mar 2023 07:47:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=oss-phx-1109; d=oss.oracle.com; h=Date:To:From:Subject:Message-Id:MIME-Version:Sender; bh=RLeiqjdc0xRSF98IY7dEXAuKs6FaAjq141QkcdDe9Hc=; b=qdX9QxtjAH1LzHq5mzppE/2U29LTmHw6iXygFI1z3+Yh4t7md9Kz/lC71brKFRXhevpcR1Lx7up1 dL4YG6r3qabgxwRaW4T1eJrCyrk7oFJDmMVaIR6+bqP0zYw3Cj2LMweOd4wlEEBYw8fvINHszjnU FCi5keZSemjUTjO4L0gMDs4/yNTqLdFP1vqaZnMqrNltkXjU8jTCxt/+nVuPhSuNdFEntPz9AGtD Wd7bXBnyvgOwSluyjMeJlh81D1ZczyE+2UQylUFPE6npmMUO0BFQyMbnSuEjtdD2EZTtbsa5PveP NDEYbv6Mc4PJGbNAiOUaII8HMSE2/V/6vAhB6A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=prod-phx-20191217; d=phx1.rp.oracleemaildelivery.com; h=Date:To:From:Subject:Message-Id:MIME-Version:Sender; bh=RLeiqjdc0xRSF98IY7dEXAuKs6FaAjq141QkcdDe9Hc=; b=aUkgEb1PkwXFd80Ym0DO0fqvkpq0t3xfUPB7sLTQMMt9ZmXRR8krWcCeJdrcelaclVBEs69J4hmx LxUDWgWS4AgY45JCbvb7k2cUeInhJiq/TTktK8lKO1/WGJO3SYtGME3vqk52i9Z0Hg7VHXkyiP0S Qk3ItPpsbnMzmQp2imiMSoMrGN47thWgFa73lPZMLlvUNwdTQJYegTBbG5bQVmEp2l9e94gOEYvQ cIYskSf7PAm1AxUDXAw8GfO9EWOVd1tmI4H5mfu9yRaShTahSq1HJ/Bv+AVo2givVGEWMAmI6+BL aFhf/yASNpqdeAD3vRbE0gCHFsCjabn93YYYYw== Received: by omta-ad1-fd3-101-us-phoenix-1.omtaad1.vcndpphx.oraclevcn.com (Oracle Communications Messaging Server 8.1.0.1.20230317 64bit (built Mar 17 2023)) with ESMTPS id <0RS800IDR0BD84C0@omta-ad1-fd3-101-us-phoenix-1.omtaad1.vcndpphx.oraclevcn.com> for ocfs2-devel@archiver.kernel.org; Tue, 28 Mar 2023 07:47:37 +0000 (GMT) Message-id: <1e08006f9011efa48deaf656c358ca3d438b9768.camel@huaweicloud.com> To: Paul Moore Date: Tue, 28 Mar 2023 09:46:41 +0200 In-reply-to: References: <20230314081720.4158676-1-roberto.sassu@huaweicloud.com> <20230314081720.4158676-5-roberto.sassu@huaweicloud.com> <939e6c88662ad90b963993c4cc1b702083e74a7a.camel@huaweicloud.com> <8b63d00d8ac3f686e51889ea4fc8d83f8ecb300d.camel@huaweicloud.com> User-Agent: Evolution 3.36.5-0ubuntu1 MIME-version: 1.0 X-Source-IP: 14.137.139.23 X-Proofpoint-Virus-Version: vendor=nai engine=6500 definitions=10662 signatures=596816 X-Proofpoint-Spam-Details: rule=tap_notspam policy=tap score=0 suspectscore=0 clxscore=73 malwarescore=0 mlxscore=0 mlxlogscore=929 adultscore=0 spamscore=0 impostorscore=0 bulkscore=0 lowpriorityscore=0 phishscore=0 priorityscore=30 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2303200000 definitions=main-2303280064 Cc: nicolas.bouchinet@clip-os.org, linux-kernel@vger.kernel.org, keescook@chromium.org, selinux@vger.kernel.org, dmitry.kasatkin@gmail.com, Roberto Sassu , jmorris@namei.org, zohar@linux.ibm.com, reiserfs-devel@vger.kernel.org, linux-security-module@vger.kernel.org, casey@schaufler-ca.com, eparis@parisplace.org, linux-integrity@vger.kernel.org, stephen.smalley.work@gmail.com, ocfs2-devel@oss.oracle.com, serge@hallyn.com Subject: Re: [Ocfs2-devel] [PATCH v8 4/6] security: Allow all LSMs to provide xattrs for inode_init_security hook X-BeenThere: ocfs2-devel@oss.oracle.com X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Roberto Sassu via Ocfs2-devel Reply-to: Roberto Sassu Content-type: text/plain; charset="utf-8" Content-transfer-encoding: base64 Errors-to: ocfs2-devel-bounces@oss.oracle.com X-CM-TRANSID: LxC2BwBn6QRkmyJkwsvWAQ--.64076S2 X-Coremail-Antispam: 1UD129KBjvJXoW3Xw1UKw4ftFWDCF15KFyxuFg_yoWfKF48pr WUJ3Wjkr4DJFyUCrySqa18uw1agrWrGrWUXrn8JryUAr1qyr1xJry0kr45uFykXrW8Jr1q qr4jyr47urn8A3DanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkjb4IE77IF4wAFF20E14v26ryj6rWUM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4 vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7Cj xVAFwI0_Gr0_Cr1l84ACjcxK6I8E87Iv67AKxVWUJVW8JwA2z4x0Y4vEx4A2jsIEc7CjxV AFwI0_Gr0_Gr1UM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40E x7xfMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x 0Yz7v_Jr0_Gr1lF7xvr2IY64vIr41lFIxGxcIEc7CjxVA2Y2ka0xkIwI1l42xK82IYc2Ij 64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x 8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r4a6rW5MIIYrxkI7VAKI48JMIIF0xvE 2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42 xK8VAvwI8IcIk0rVWrZr1j6s0DMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIE c7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x07UZ18PUUUUU= X-CM-SenderInfo: purev21wro2thvvxqx5xdzvxpfor3voofrz/1tbiAQAKBF1jj4s6twADs7 X-CFilter-Loop: Reflected X-ServerName: frasgout11.his.huawei.com X-Proofpoint-SPF-Result: pass X-Proofpoint-SPF-Record: v=spf1 ip4:45.249.212.51 ip4:45.249.212.56 ip4:185.176.79.53 ip4:14.137.139.23 ip4:14.137.139.154 ip4:14.137.139.46 ip4:124.71.93.99 ip4:124.71.93.112 ip4:124.71.94.104 include:spf.saas.huaweicloud.com -all X-Spam: Clean X-Proofpoint-GUID: jVNAWkCfOHKoa5-5XJ72LDeqAyA-_S79 X-Proofpoint-ORIG-GUID: jVNAWkCfOHKoa5-5XJ72LDeqAyA-_S79 Reporting-Meta: AAE3H8uK4r8L/3LXh8Zatqjan9/7X7Yy/Lpz0V51efFjHwtJNvToYGBiE0Fpfo9S DVSEilDbXg6745X7vDuuuG65csOSKeLwN89tdgp+BRCI8cOXaObV0gAXXFcH7h0W fMvL7EWVQvQB6YosxFyCCZXZBLm7+fwoDIf1U7l4wYN6zJSuZx4pNWIdja69kBso bhDmD7M8gXdTJeMaW//TK5rAS0cquzzgk95Ebsol0xiL/cxOGxst5JpI1asYCpNC nCHu+ZkUMTW+aZXZh3VsOR5aya2Ez0vvs5L7Bp05+LuWUVpZYX8HmXFSyPvSwF8L GhUmPVThCW14stTMN/NdbpKsTmF9d1pXhCLmmqFPoHuWW4kbECnkQPp9h5vZhMQD VdPZokgAmgsgwx3NJ21jhsnN+vv/w5Un6Zb2f+6ZY52+6CaChgeUN6uBMPvS6ZA3 bWSl2AP4Ze12YAsHyIbLAI7DRQnFzObpDlwT4jXe9USA/pQ6dS4WpVRtxZRZ6d6Q PdPFFP/eaHae+Y4XF6xzAL9pSc+s2c+Xj6Qdz4kIGQxP T24gTW9uLCAyMDIzLTAzLTI3IGF0IDE3OjAyIC0wNDAwLCBQYXVsIE1vb3JlIHdyb3RlOgo+IE9u IE1vbiwgTWFyIDI3LCAyMDIzIGF0IDM6MzDigK9BTSBSb2JlcnRvIFNhc3N1Cj4gPHJvYmVydG8u c2Fzc3VAaHVhd2VpY2xvdWQuY29tPiB3cm90ZToKPiA+IE9uIEZyaSwgMjAyMy0wMy0yNCBhdCAx NzozOSAtMDQwMCwgUGF1bCBNb29yZSB3cm90ZToKPiA+ID4gT24gRnJpLCBNYXIgMjQsIDIwMjMg YXQgOToyNuKAr0FNIFJvYmVydG8gU2Fzc3UKPiA+ID4gPHJvYmVydG8uc2Fzc3VAaHVhd2VpY2xv dWQuY29tPiB3cm90ZToKPiA+ID4gPiBPbiBGcmksIDIwMjMtMDMtMjQgYXQgMTE6MTggKzAxMDAs IFJvYmVydG8gU2Fzc3Ugd3JvdGU6Cj4gPiA+ID4gPiBPbiBUaHUsIDIwMjMtMDMtMjMgYXQgMjA6 MDkgLTA0MDAsIFBhdWwgTW9vcmUgd3JvdGU6Cj4gPiA+ID4gPiA+IE9uIFR1ZSwgTWFyIDE0LCAy MDIzIGF0IDQ6MTnigK9BTSBSb2JlcnRvIFNhc3N1Cj4gPiA+ID4gPiA+IDxyb2JlcnRvLnNhc3N1 QGh1YXdlaWNsb3VkLmNvbT4gd3JvdGU6Cj4gPiA+ID4gPiA+ID4gRnJvbTogUm9iZXJ0byBTYXNz dSA8cm9iZXJ0by5zYXNzdUBodWF3ZWkuY29tPgo+ID4gPiA+ID4gPiA+IAo+ID4gPiA+ID4gPiA+ IEN1cnJlbnRseSwgc2VjdXJpdHlfaW5vZGVfaW5pdF9zZWN1cml0eSgpIHN1cHBvcnRzIG9ubHkg b25lIExTTSBwcm92aWRpbmcKPiA+ID4gPiA+ID4gPiBhbiB4YXR0ciBhbmQgRVZNIGNhbGN1bGF0 aW5nIHRoZSBITUFDIG9uIHRoYXQgeGF0dHIsIHBsdXMgb3RoZXIgaW5vZGUKPiA+ID4gPiA+ID4g PiBtZXRhZGF0YS4KPiA+ID4gPiA+ID4gPiAKPiA+ID4gPiA+ID4gPiBBbGxvdyBhbGwgTFNNcyB0 byBwcm92aWRlIG9uZSBvciBtdWx0aXBsZSB4YXR0cnMsIGJ5IGV4dGVuZGluZyB0aGUgc2VjdXJp dHkKPiA+ID4gPiA+ID4gPiBibG9iIHJlc2VydmF0aW9uIG1lY2hhbmlzbS4gSW50cm9kdWNlIHRo ZSBuZXcgbGJzX3hhdHRyIGZpZWxkIG9mIHRoZQo+ID4gPiA+ID4gPiA+IGxzbV9ibG9iX3NpemVz IHN0cnVjdHVyZSwgc28gdGhhdCBlYWNoIExTTSBjYW4gc3BlY2lmeSBob3cgbWFueSB4YXR0cnMg aXQKPiA+ID4gPiA+ID4gPiBuZWVkcywgYW5kIHRoZSBMU00gaW5mcmFzdHJ1Y3R1cmUga25vd3Mg aG93IG1hbnkgeGF0dHIgc2xvdHMgaXQgc2hvdWxkCj4gPiA+ID4gPiA+ID4gYWxsb2NhdGUuCj4g PiA+ID4gPiA+ID4gCj4gPiA+ID4gPiA+ID4gRHluYW1pY2FsbHkgYWxsb2NhdGUgdGhlIHhhdHRy cyBhcnJheSB0byBiZSBwb3B1bGF0ZWQgYnkgTFNNcyB3aXRoIHRoZQo+ID4gPiA+ID4gPiA+IGlu b2RlX2luaXRfc2VjdXJpdHkgaG9vaywgYW5kIHBhc3MgaXQgdG8gdGhlIGxhdHRlciBpbnN0ZWFk IG9mIHRoZQo+ID4gPiA+ID4gPiA+IG5hbWUvdmFsdWUvbGVuIHRyaXBsZS4gVXBkYXRlIHRoZSBk b2N1bWVudGF0aW9uIGFjY29yZGluZ2x5LCBhbmQgZml4IHRoZQo+ID4gPiA+ID4gPiA+IGRlc2Ny aXB0aW9uIG9mIHRoZSB4YXR0ciBuYW1lLCBhcyBpdCBpcyBub3QgYWxsb2NhdGVkIGFueW1vcmUu Cj4gPiA+ID4gPiA+ID4gCj4gPiA+ID4gPiA+ID4gU2luY2UgdGhlIExTTSBpbmZyYXN0cnVjdHVy ZSwgYXQgaW5pdGlhbGl6YXRpb24gdGltZSwgdXBkYXRlcyB0aGUgbnVtYmVyIG9mCj4gPiA+ID4g PiA+ID4gdGhlIHJlcXVlc3RlZCB4YXR0cnMgcHJvdmlkZWQgYnkgZWFjaCBMU00gd2l0aCBhIGNv cnJlc3BvbmRpbmcgb2Zmc2V0IGluCj4gPiA+ID4gPiA+ID4gdGhlIHNlY3VyaXR5IGJsb2IgKGlu IHRoaXMgY2FzZSB0aGUgeGF0dHIgYXJyYXkpLCBpdCBtYWtlcyBzdHJhaWdodGZvcndhcmQKPiA+ ID4gPiA+ID4gPiBmb3IgYW4gTFNNIHRvIGFjY2VzcyB0aGUgcmlnaHQgcG9zaXRpb24gaW4gdGhl IHhhdHRyIGFycmF5Lgo+ID4gPiA+ID4gPiA+IAo+ID4gPiA+ID4gPiA+IFRoZXJlIGlzIHN0aWxs IHRoZSBpc3N1ZSB0aGF0IGFuIExTTSBtaWdodCBub3QgZmlsbCB0aGUgeGF0dHIsIGV2ZW4gaWYg aXQKPiA+ID4gPiA+ID4gPiByZXF1ZXN0cyBpdCAobGVnaXRpbWF0ZSBjYXNlLCBmb3IgZXhhbXBs ZSBpdCBtaWdodCBoYXZlIGJlZW4gbG9hZGVkIGJ1dCBub3QKPiA+ID4gPiA+ID4gPiBpbml0aWFs aXplZCB3aXRoIGEgcG9saWN5KS4gU2luY2UgdXNlcnMgb2YgdGhlIHhhdHRyIGFycmF5IChlLmcu IHRoZQo+ID4gPiA+ID4gPiA+IGluaXR4YXR0cnMoKSBjYWxsYmFja3MpIGRldGVjdCB0aGUgZW5k IG9mIHRoZSB4YXR0ciBhcnJheSBieSBjaGVja2luZyBpZgo+ID4gPiA+ID4gPiA+IHRoZSB4YXR0 ciBuYW1lIGlzIE5VTEwsIG5vdCBmaWxsaW5nIGFuIHhhdHRyIHdvdWxkIGNhdXNlIHRob3NlIHVz ZXJzIHRvCj4gPiA+ID4gPiA+ID4gc3RvcCBzY2FubmluZyB4YXR0cnMgcHJlbWF0dXJlbHkuCj4g PiA+ID4gPiA+ID4gCj4gPiA+ID4gPiA+ID4gU29sdmUgdGhhdCBpc3N1ZSBieSBpbnRyb2R1Y2lu ZyBzZWN1cml0eV9jaGVja19jb21wYWN0X2ZpbGxlZF94YXR0cnMoKSwKPiA+ID4gPiA+ID4gPiB3 aGljaCBkb2VzIGEgYmFzaWMgY2hlY2sgb2YgdGhlIHhhdHRyIGFycmF5IChpZiB0aGUgeGF0dHIg bmFtZSBpcyBmaWxsZWQsCj4gPiA+ID4gPiA+ID4gdGhlIHhhdHRyIHZhbHVlIHNob3VsZCBiZSB0 b28sIGFuZCB2aWNldmVyc2EpLCBhbmQgY29tcGFjdHMgdGhlIHhhdHRyIGFycmF5Cj4gPiA+ID4g PiA+ID4gYnkgcmVtb3ZpbmcgdGhlIGhvbGVzLgo+ID4gPiA+ID4gPiA+IAo+ID4gPiA+ID4gPiA+ IEFuIGFsdGVybmF0aXZlIHNvbHV0aW9uIHdvdWxkIGJlIHRvIGxldCB1c2VycyBvZiB0aGUgeGF0 dHIgYXJyYXkga25vdyB0aGUKPiA+ID4gPiA+ID4gPiBudW1iZXIgb2YgZWxlbWVudHMgb2YgdGhh dCBhcnJheSwgc28gdGhhdCB0aGV5IGRvbid0IGhhdmUgdG8gY2hlY2sgdGhlCj4gPiA+ID4gPiA+ ID4gdGVybWluYXRpb24uIEhvd2V2ZXIsIHRoaXMgc2VlbXMgbW9yZSBpbnZhc2l2ZSwgY29tcGFy ZWQgdG8gYSBzaW1wbGUgbW92ZQo+ID4gPiA+ID4gPiA+IG9mIGZldyBhcnJheSBlbGVtZW50cy4K PiA+ID4gPiA+ID4gPiAKPiA+ID4gPiA+ID4gPiBzZWN1cml0eV9jaGVja19jb21wYWN0X2ZpbGxl ZF94YXR0cnMoKSBhbHNvIGRldGVybWluZXMgaG93IG1hbnkgeGF0dHJzIGluCj4gPiA+ID4gPiA+ ID4gdGhlIHhhdHRyIGFycmF5IGhhdmUgYmVlbiBmaWxsZWQuIElmIHRoZXJlIGlzIG5vbmUsIHNr aXAKPiA+ID4gPiA+ID4gPiBldm1faW5vZGVfaW5pdF9zZWN1cml0eSgpIGFuZCBpbml0eGF0dHJz KCkuIFNraXBwaW5nIHRoZSBmb3JtZXIgYWxzbyBhdm9pZHMKPiA+ID4gPiA+ID4gPiBFVk0gdG8g Y3Jhc2ggdGhlIGtlcm5lbCwgYXMgaXQgaXMgZXhwZWN0aW5nIGEgZmlsbGVkIHhhdHRyLgo+ID4g PiA+ID4gPiA+IAo+ID4gPiA+ID4gPiA+IEZpbmFsbHksIGFkYXB0IGJvdGggU0VMaW51eCBhbmQg U21hY2sgdG8gdXNlIHRoZSBuZXcgZGVmaW5pdGlvbiBvZiB0aGUKPiA+ID4gPiA+ID4gPiBpbm9k ZV9pbml0X3NlY3VyaXR5IGhvb2ssIGFuZCB0byBjb3JyZWN0bHkgZmlsbCB0aGUgZGVzaWduYXRl ZCBzbG90cyBpbiB0aGUKPiA+ID4gPiA+ID4gPiB4YXR0ciBhcnJheS4gRm9yIFNtYWNrLCByZXNl cnZlIHNwYWNlIGZvciB0aGUgb3RoZXIgZGVmaW5lZCB4YXR0cnMgYWx0aG91Z2gKPiA+ID4gPiA+ ID4gPiB0aGV5IGFyZSBub3Qgc2V0IHlldCBpbiBzbWFja19pbm9kZV9pbml0X3NlY3VyaXR5KCku Cj4gPiA+ID4gPiA+ID4gCj4gPiA+ID4gPiA+ID4gUmVwb3J0ZWQtYnk6IE5pY29sYXMgQm91Y2hp bmV0IDxuaWNvbGFzLmJvdWNoaW5ldEBjbGlwLW9zLm9yZz4gKEVWTSBjcmFzaCkKPiA+ID4gPiA+ ID4gPiBMaW5rOiBodHRwczovL2xvcmUua2VybmVsLm9yZy9saW51eC1pbnRlZ3JpdHkvWTFGVFNJ bysxeCs0WDBMU0BhcmNobGludXgvCj4gPiA+ID4gPiA+ID4gU2lnbmVkLW9mZi1ieTogUm9iZXJ0 byBTYXNzdSA8cm9iZXJ0by5zYXNzdUBodWF3ZWkuY29tPgo+ID4gPiA+ID4gPiA+IFJldmlld2Vk LWJ5OiBDYXNleSBTY2hhdWZsZXIgPGNhc2V5QHNjaGF1Zmxlci1jYS5jb20+Cj4gPiA+ID4gPiA+ ID4gUmV2aWV3ZWQtYnk6IE1pbWkgWm9oYXIgPHpvaGFyQGxpbnV4LmlibS5jb20+Cj4gPiA+ID4g PiA+ID4gLS0tCj4gPiA+ID4gPiA+ID4gIGluY2x1ZGUvbGludXgvbHNtX2hvb2tfZGVmcy5oIHwg ICAzICstCj4gPiA+ID4gPiA+ID4gIGluY2x1ZGUvbGludXgvbHNtX2hvb2tzLmggICAgIHwgICAx ICsKPiA+ID4gPiA+ID4gPiAgc2VjdXJpdHkvc2VjdXJpdHkuYyAgICAgICAgICAgfCAxMTkgKysr KysrKysrKysrKysrKysrKysrKysrKysrKystLS0tLQo+ID4gPiA+ID4gPiA+ICBzZWN1cml0eS9z ZWxpbnV4L2hvb2tzLmMgICAgICB8ICAxOSArKysrLS0KPiA+ID4gPiA+ID4gPiAgc2VjdXJpdHkv c21hY2svc21hY2tfbHNtLmMgICAgfCAgMzMgKysrKysrLS0tLQo+ID4gPiA+ID4gPiA+ICA1IGZp bGVzIGNoYW5nZWQsIDEzNyBpbnNlcnRpb25zKCspLCAzOCBkZWxldGlvbnMoLSkKPiA+ID4gCj4g PiA+IC4uLgo+ID4gPiAKPiA+ID4gPiA+ID4gPiBAQCAtMTYwNCwzMyArMTY1NCw2NiBAQCBpbnQg c2VjdXJpdHlfaW5vZGVfaW5pdF9zZWN1cml0eShzdHJ1Y3QgaW5vZGUgKmlub2RlLCBzdHJ1Y3Qg aW5vZGUgKmRpciwKPiA+ID4gPiA+ID4gPiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBjb25zdCBzdHJ1Y3QgcXN0ciAqcXN0ciwKPiA+ID4gPiA+ID4gPiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICBjb25zdCBpbml0eGF0dHJzIGluaXR4YXR0cnMsIHZvaWQgKmZzX2Rh dGEpCj4gPiA+ID4gPiA+ID4gIHsKPiA+ID4gPiA+ID4gPiAtICAgICAgIHN0cnVjdCB4YXR0ciBu ZXdfeGF0dHJzW01BWF9MU01fRVZNX1hBVFRSICsgMV07Cj4gPiA+ID4gPiA+ID4gLSAgICAgICBz dHJ1Y3QgeGF0dHIgKmxzbV94YXR0ciwgKmV2bV94YXR0ciwgKnhhdHRyOwo+ID4gPiA+ID4gPiA+ IC0gICAgICAgaW50IHJldDsKPiA+ID4gPiA+ID4gPiArICAgICAgIHN0cnVjdCBzZWN1cml0eV9o b29rX2xpc3QgKlA7Cj4gPiA+ID4gPiA+ID4gKyAgICAgICBzdHJ1Y3QgeGF0dHIgKm5ld194YXR0 cnM7Cj4gPiA+ID4gPiA+ID4gKyAgICAgICBzdHJ1Y3QgeGF0dHIgKnhhdHRyOwo+ID4gPiA+ID4g PiA+ICsgICAgICAgaW50IHJldCA9IC1FT1BOT1RTVVBQLCBudW1fZmlsbGVkX3hhdHRycyA9IDA7 Cj4gPiA+ID4gPiA+ID4gCj4gPiA+ID4gPiA+ID4gICAgICAgICBpZiAodW5saWtlbHkoSVNfUFJJ VkFURShpbm9kZSkpKQo+ID4gPiA+ID4gPiA+ICAgICAgICAgICAgICAgICByZXR1cm4gMDsKPiA+ ID4gPiA+ID4gPiAKPiA+ID4gPiA+ID4gPiArICAgICAgIGlmICghYmxvYl9zaXplcy5sYnNfeGF0 dHIpCj4gPiA+ID4gPiA+ID4gKyAgICAgICAgICAgICAgIHJldHVybiAwOwo+ID4gPiA+ID4gPiA+ ICsKPiA+ID4gPiA+ID4gPiAgICAgICAgIGlmICghaW5pdHhhdHRycykKPiA+ID4gPiA+ID4gPiAg ICAgICAgICAgICAgICAgcmV0dXJuIGNhbGxfaW50X2hvb2soaW5vZGVfaW5pdF9zZWN1cml0eSwg LUVPUE5PVFNVUFAsIGlub2RlLAo+ID4gPiA+ID4gPiA+IC0gICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICBkaXIsIHFzdHIsIE5VTEwsIE5VTEwsIE5VTEwpOwo+ID4gPiA+ID4gPiA+ IC0gICAgICAgbWVtc2V0KG5ld194YXR0cnMsIDAsIHNpemVvZihuZXdfeGF0dHJzKSk7Cj4gPiA+ ID4gPiA+ID4gLSAgICAgICBsc21feGF0dHIgPSBuZXdfeGF0dHJzOwo+ID4gPiA+ID4gPiA+IC0g ICAgICAgcmV0ID0gY2FsbF9pbnRfaG9vayhpbm9kZV9pbml0X3NlY3VyaXR5LCAtRU9QTk9UU1VQ UCwgaW5vZGUsIGRpciwgcXN0ciwKPiA+ID4gPiA+ID4gPiAtICAgICAgICAgICAgICAgICAgICAg ICAgICAgJmxzbV94YXR0ci0+bmFtZSwKPiA+ID4gPiA+ID4gPiAtICAgICAgICAgICAgICAgICAg ICAgICAgICAgJmxzbV94YXR0ci0+dmFsdWUsCj4gPiA+ID4gPiA+ID4gLSAgICAgICAgICAgICAg ICAgICAgICAgICAgICZsc21feGF0dHItPnZhbHVlX2xlbik7Cj4gPiA+ID4gPiA+ID4gLSAgICAg ICBpZiAocmV0KQo+ID4gPiA+ID4gPiA+ICsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIGRpciwgcXN0ciwgTlVMTCk7Cj4gPiA+ID4gPiA+ID4gKyAgICAgICAvKiBBbGxvY2F0ZSAr MSBmb3IgRVZNIGFuZCArMSBhcyB0ZXJtaW5hdG9yLiAqLwo+ID4gPiA+ID4gPiA+ICsgICAgICAg bmV3X3hhdHRycyA9IGtjYWxsb2MoYmxvYl9zaXplcy5sYnNfeGF0dHIgKyAyLCBzaXplb2YoKm5l d194YXR0cnMpLAo+ID4gPiA+ID4gPiA+ICsgICAgICAgICAgICAgICAgICAgICAgICAgICAgR0ZQ X05PRlMpOwo+ID4gPiA+ID4gPiA+ICsgICAgICAgaWYgKCFuZXdfeGF0dHJzKQo+ID4gPiA+ID4g PiA+ICsgICAgICAgICAgICAgICByZXR1cm4gLUVOT01FTTsKPiA+ID4gPiA+ID4gPiArCj4gPiA+ ID4gPiA+ID4gKyAgICAgICBobGlzdF9mb3JfZWFjaF9lbnRyeShQLCAmc2VjdXJpdHlfaG9va19o ZWFkcy5pbm9kZV9pbml0X3NlY3VyaXR5LAo+ID4gPiA+ID4gPiA+ICsgICAgICAgICAgICAgICAg ICAgICAgICAgICAgbGlzdCkgewo+ID4gPiA+ID4gPiA+ICsgICAgICAgICAgICAgICByZXQgPSBQ LT5ob29rLmlub2RlX2luaXRfc2VjdXJpdHkoaW5vZGUsIGRpciwgcXN0ciwgbmV3X3hhdHRycyk7 Cj4gPiA+ID4gPiA+ID4gKyAgICAgICAgICAgICAgIGlmIChyZXQgJiYgcmV0ICE9IC1FT1BOT1RT VVBQKQo+ID4gPiA+ID4gPiA+ICsgICAgICAgICAgICAgICAgICAgICAgIGdvdG8gb3V0Owo+ID4g PiA+ID4gPiA+ICsgICAgICAgICAgICAgICAvKgo+ID4gPiA+ID4gPiA+ICsgICAgICAgICAgICAg ICAgKiBBcyBkb2N1bWVudGVkIGluIGxzbV9ob29rcy5oLCAtRU9QTk9UU1VQUCBpbiB0aGlzIGNv bnRleHQKPiA+ID4gPiA+ID4gPiArICAgICAgICAgICAgICAgICogbWVhbnMgdGhhdCB0aGUgTFNN IGlzIG5vdCB3aWxsaW5nIHRvIHByb3ZpZGUgYW4geGF0dHIsIG5vdAo+ID4gPiA+ID4gPiA+ICsg ICAgICAgICAgICAgICAgKiB0aGF0IGl0IHdhbnRzIHRvIHNpZ25hbCBhbiBlcnJvci4gVGh1cywg Y29udGludWUgdG8gaW52b2tlCj4gPiA+ID4gPiA+ID4gKyAgICAgICAgICAgICAgICAqIHRoZSBy ZW1haW5pbmcgTFNNcy4KPiA+ID4gPiA+ID4gPiArICAgICAgICAgICAgICAgICovCj4gPiA+ID4g PiA+ID4gKyAgICAgICAgICAgICAgIGlmIChyZXQgPT0gLUVPUE5PVFNVUFApCj4gPiA+ID4gPiA+ ID4gKyAgICAgICAgICAgICAgICAgICAgICAgY29udGludWU7Cj4gPiA+ID4gPiA+ID4gKyAgICAg ICAgICAgICAgIC8qCj4gPiA+ID4gPiA+ID4gKyAgICAgICAgICAgICAgICAqIEFzIHRoZSBudW1i ZXIgb2YgeGF0dHJzIHJlc2VydmVkIGJ5IExTTXMgaXMgbm90IGRpcmVjdGx5Cj4gPiA+ID4gPiA+ ID4gKyAgICAgICAgICAgICAgICAqIGF2YWlsYWJsZSwgZGlyZWN0bHkgdXNlIHRoZSB0b3RhbCBu dW1iZXIgYmxvYl9zaXplcy5sYnNfeGF0dHIKPiA+ID4gPiA+ID4gPiArICAgICAgICAgICAgICAg ICogdG8ga2VlcCB0aGUgY29kZSBzaW1wbGUsIHdoaWxlIGJlaW5nIG5vdCB0aGUgbW9zdCBlZmZp Y2llbnQKPiA+ID4gPiA+ID4gPiArICAgICAgICAgICAgICAgICogd2F5Lgo+ID4gPiA+ID4gPiA+ ICsgICAgICAgICAgICAgICAgKi8KPiA+ID4gPiA+ID4gCj4gPiA+ID4gPiA+IElzIHRoZXJlIGEg Z29vZCByZWFzb24gd2h5IHRoZSBMU00gY2FuJ3QgcmV0dXJuIHRoZSBudW1iZXIgb2YgeGF0dHJz Cj4gPiA+ID4gPiA+IGl0IGlzIGFkZGluZyB0byB0aGUgeGF0dHIgYXJyYXk/ICBJdCBzZWVtcyBs aWtlIGl0IHNob3VsZCBiZSBmYWlybHkKPiA+ID4gPiA+ID4gdHJpdmlhbCBmb3IgdGhlIGluZGl2 aWR1YWwgTFNNcyB0byBkZXRlcm1pbmUgYW5kIGl0IGNvdWxkIHNhdmUgYSBsb3QKPiA+ID4gPiA+ ID4gb2Ygd29yay4gIEhvd2V2ZXIsIGdpdmVuIHdlJ3JlIGF0IHY4IG9uIHRoaXMgcGF0Y2hzZXQg SSdtIHN1cmUgSSdtCj4gPiA+ID4gPiA+IG1pc3Npbmcgc29tZXRoaW5nIG9idmlvdXMsIGNhbiB5 b3UgaGVscCBtZSB1bmRlcnN0YW5kIHdoeSB0aGUgaWRlYQo+ID4gPiA+ID4gPiBhYm92ZSBpcyBj cmF6eSBzdHVwaWQ/IDspCj4gPiA+ID4gCj4gPiA+ID4gTXVjaCBzaW1wbGUgYW5zd2VyLiBZZXMs IExTTXMgY291bGQgcmV0dXJuIHRoZSBudW1iZXIgb2YgeGF0dHJzIHNldCwKPiA+ID4gPiBidXQg c2VjdXJpdHlfY2hlY2tfY29tcGFjdF9maWxsZWRfeGF0dHJzKCkgYWxzbyBuZWVkcyB0byBrbm93 IGZyb20KPiA+ID4gPiB3aGljaCBvZmZzZXQgKHRoZSBsYnNfeGF0dHIgb2YgZWFjaCBMU00pIGl0 IHNob3VsZCBzdGFydCBjb21wYWN0aW5nLgo+ID4gPiA+IAo+ID4gPiA+IEV4YW1wbGU6IHN1cHBv c2UgdGhhdCB5b3UgaGF2ZSB0aHJlZSBMU01zIHdpdGg6Cj4gPiA+ID4gCj4gPiA+ID4gTFNNIzE6 IGxic194YXR0ciAxCj4gPiA+ID4gTFNNIzI6IGxic194YXR0ciAyIChkaXNhYmxlZCkKPiA+ID4g PiBMU00jMzogbGJzX3hhdHRyIDEKPiA+ID4gPiAKPiA+ID4gPiBUaGUgY3VycmVudCBjb21wYWN0 aW9uIGludGVydmFsIGlzOiBhbHJlYWR5IGNvbXBhY3RlZCB4YXR0cnMgLSBlbmQgb2YKPiA+ID4g PiBuZXdfeGF0dHIgYXJyYXkuCj4gPiA+ID4gCj4gPiA+ID4gV2hlbiB0aGUgc2VjdXJpdHlfaW5v ZGVfaW5pdF9zZWN1cml0eSgpIGxvb3AgY2FsbHMgTFNNIzMsIHRoZQo+ID4gPiA+IGNvbXBhY3Rp b24gaW50ZXJ2YWwgaXM6IDEgLSAyIChMU00jMiByZXR1cm5zIDApLCB3aGljaCBjbGVhcmx5IGlz bid0Cj4gPiA+ID4gcmlnaHQuIFRoZSBjb3JyZWN0IGNvbXBhY3Rpb24gaW50ZXJ2YWwgc2hvdWxk IGJlOiAzIC0gNC4KPiA+ID4gPiAKPiA+ID4gPiBHb2luZyB0byB0aGUgZW5kIG9mIG5ld194YXR0 cnMgaXMgYW4gYXBwcm94aW1hdGlvbiwgYnV0IGl0IGVuc3VyZXMKPiA+ID4gPiB0aGF0IHNlY3Vy aXR5X2NoZWNrX2NvbXBhY3RfZmlsbGVkX3hhdHRycygpIHJlYWNoZXMgdGhlIHhhdHRyIHNldCBi eQo+ID4gPiA+IExTTSMzLgo+ID4gPiA+IAo+ID4gPiA+IFRoZSBhbHRlcm5hdGl2ZSBJIHdhcyBt ZW50aW9uaW5nIG9mIHBhc3NpbmcgbnVtX2ZpbGxlZF94YXR0cnMgdG8gTFNNcwo+ID4gPiA+IGdv ZXMgYWdhaW4gaW4gdGhlIGRpcmVjdGlvbiBvZiBkb2luZyBvbi10aGUtZmx5IGNvbXBhY3Rpb24s IHdoaWxlIExTTXMKPiA+ID4gPiBhcmUgbW9yZSBmYW1pbGlhciB3aXRoIHVzaW5nIHRoZSBsYnNf KiBmaWVsZHMuCj4gPiA+IAo+ID4gPiBJIGd1ZXNzIEkgd2FzIHRoaW5raW5nIG9mIHRoZSBjYXNl IHdoZXJlIHRoZSBMU00gbGF5ZXIsIGkuZS4KPiA+ID4gc2VjdXJpdHlfaW5vZGVfaW5pdF9zZWN1 cml0eSgpLCBhbGxvY2F0ZXMgYW4geGF0dHIgYXJyYXkgbGlrZSBpdCBkb2VzCj4gPiA+IG5vdyBi YXNlZCBvbiB0aGUgbWF4aW11bSBudW1iZXIgb2YgeGF0dHJzIHBvc3NpYmxlIHVzaW5nIHRoZQo+ ID4gPiBsc21fYmxvYl9zaXplcyB2YWx1ZXMgYW5kIHBhc3NlcyBhIHBvaW50ZXIgdG8gdGhlIGlu ZGl2aWR1YWwgTFNNcwo+ID4gPiB3aGljaCBpcyBpbmNyZW1lbnRlZCBiYXNlZCBvbiBob3cgbWFu eSB4YXR0cnMgYXJlIGNyZWF0ZWQgYnkgdGhlCj4gPiA+IGluZGl2aWR1YWwgTFNNcy4gIEhlcmUg aXMgc29tZSAqdmVyeSogcm91Z2ggcHNldWRvIGNvZGU6Cj4gPiA+IAo+ID4gPiBpbnQgc2VjdXJp dHlfaW5vZGVfaW5pdF9zZWN1cml0eSguLi4pCj4gPiA+IHsKPiA+ID4gCj4gPiA+ICAgLyogYWxs b2NhdGUgYW4geGF0dHIgYXJyYXkgKi8KPiA+ID4gICB4YXR0cnMgPSBrY2FsbG9jKGJsb2Jfc2l6 ZXMsIHNpemVvZigqeGF0dHJzKSwgR0ZQX0JMQUgpOwo+ID4gPiAKPiA+ID4gICAvKiBsb29wIG9u IHRoZSBsc21zICovCj4gPiA+ICAgeGFfY250ID0gMDsKPiA+ID4gICB3aGlsZSAobHNtX2hvb2tz KSB7Cj4gPiA+ICAgICByYyA9IGNhbGxfaG9vayhsc21faG9vaywgJnhhdHRyc1t4YV9jbnRdKTsK PiA+ID4gICAgIGlmIChyYyA+IDApCj4gPiA+ICAgICAgIHhhX2NudCArPSByYzsKPiA+ID4gICB9 Cj4gPiA+IAo+ID4gPiAgIC8qIGV2bSBtYWdpYyAqLwo+ID4gPiAgIGV2bV9pbm9kZV9pbml0X3Nl Y3VyaXR5KC4uLikKPiA+ID4gfQo+ID4gPiAKPiA+ID4gRG9lcyB0aGF0IHdvcms/ICBBbSBJIG1p c3Npbmcgc29tZXRoaW5nPwo+ID4gCj4gPiBPaCwgdW5mb3J0dW5hdGVseSBub3QuIEVWTSBuZWVk cyB0byBzZWUgYWxsIHhhdHRycyAod2hlbiBpdCBpcyBtb3ZlZCB0bwo+ID4gdGhlIExTTSBpbmZy YXN0cnVjdHVyZSkuCj4gCj4gT2theSwgdGhhdCdzIGZhaXIsIGJ1dCB3ZSBjb3VsZCBzdGlsbCBw YXNzIHRoZSBmdWxsIHhhdHRycyBhcnJheSBhbmQgYQo+IHJlZmVyZW5jZSB0byB0aGUgY3VycmVu dCBjb3VudCB3aGljaCBjb3VsZCBiZSBib3RoIHJlYWQgYW5kIHVwZGF0ZWQgYnkKPiB0aGUgaW5k aXZpZHVhbCBMU01zLCByaWdodD8KClllcywgd2UgY291bGQgZG8uCgo+IFRoZSBpc3N1ZSBpcyB0 aGF0IHRoZSBzZXBhcmF0ZSBjb21wYWN0aW9uIHN0YWdlIGlzIG5vdCBzb21ldGhpbmcgd2UKPiB3 YW50IHRvIGhhdmUgdG8gZG8gaWYgd2UgY2FuIGF2b2lkIGl0LiAgTWF5YmUgd2UncmUgc3R1Y2sg d2l0aCBpdCwgYnV0Cj4gSSdtIG5vdCB5ZXQgY29udmluY2VkIHRoYXQgd2UgY2FuJ3QgbWFrZSBz b21lIG1pbm9yIGNoYW5nZXMgdG8gdGhlCj4gTFNNcyB0byBhdm9pZCB0aGUgY29tcGFjdGlvbiBz dGVwLgoKSSBsaWtlZCBtb3JlIHRoZSBpZGVhIHRoYXQgTFNNcyBkbyB3aGF0IHRoZXkgYXJlIG1v c3QgZmFtaWxpYXIgd2l0aCwKZ2V0IGFuIG9mZnNldCBpbiBhIHNlY3VyaXR5IGJsb2Igb3IsIGlu IHRoaXMgY2FzZSwgYSBzdGFydGluZyBzbG90IGluCnRoZSBuZXdfeGF0dHJzIGFycmF5LCBhbmQg d3JpdGUgdGhlcmUuCgp2MyBoYWQgdGhlIGxzbV9maW5kX3hhdHRyX3Nsb3QoKSBoZWxwZXIsIHRv IGdldCB0aGUgc3RhcnRpbmcgc2xvdCwgYnV0CnNvbWVob3cgSSBmaW5kIGl0IGxlc3MgaW50dWl0 aXZlLgoKT2ssIGlmIHlvdSBwcmVmZXIgdG8gYXZvaWQgdGhlIGNvbXBhY3Rpb24gc3RhZ2UsIEkg d2lsbCByZXdyaXRlIHRoaXMKcGF0Y2guCgpUaGFua3MKClJvYmVydG8KCgpfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpPY2ZzMi1kZXZlbCBtYWlsaW5nIGxp c3QKT2NmczItZGV2ZWxAb3NzLm9yYWNsZS5jb20KaHR0cHM6Ly9vc3Mub3JhY2xlLmNvbS9tYWls bWFuL2xpc3RpbmZvL29jZnMyLWRldmVs